From f70c4caac902086fdc4cfbec7fc94c109f4a89d2 Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Thu, 8 Oct 2026 12:19:16 -0700
Subject: [PATCH 001/149] Security: create save staging files with create_new
 (follow-up to #164) (#319)

* Security: create the --root staging file with create_new

Follow-up to #164. write_atomic staged every save at the fixed name
.<name>.pdfcraft-tmp and wrote it with fs::write, which follows a
symbolic link and writes through a hard link. So a link planted there,
in a folder someone else can write to, redirected the bytes to any file
the link pointed at.

The staging file now gets a random 64-bit suffix (std's RandomState,
keyed from the operating system's random source) and is opened with
OpenOptions::create_new, which fails if anything already has the name
(a file, a hard link, a symbolic link even when dangling), on Windows
(CREATE_NEW) as on Unix (O_EXCL). A taken name is skipped, never
opened; Windows reports a folder at the name as "access denied", which
counts as taken when something is there. After 16 taken names the save
fails and nothing is overwritten. A failed write or rename removes only
the file this save created. At most 128 bytes of the target's name go
into the staging name, so it fits every system's name limit.

The #164 tests that planted a sentinel at the old fixed name now also
compare folder listings, and say that the "is a folder" refusal is what
they check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Security: create the desktop app's save staging file with create_new

The same fix as the previous commit, for the desktop app.
editing::write_atomically, which Save, Save As, Export, Print to PDF,
signing and crash recovery all use, staged at
.<name>.pdfcraft-<pid>.tmp and opened it with File::create, which
follows a symbolic link and writes through a hard link. A process id is
easy to guess, so a link planted beside a document in a shared folder
could redirect a save into another file.

The staging file now gets a random 64-bit suffix and is opened with
OpenOptions::create_new; a taken name (on Windows, a folder reports
"access denied") is skipped, never opened, and after 16 the save fails
without overwriting anything. At most 128 bytes of the document's name
go into the staging name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 apps/pdfcraft-cli/tests/run_root.rs   |  10 +-
 crates/automation/src/lib.rs          | 212 +++++++++++++++++++++++-
 crates/automation/tests/automation.rs |  13 +-
 crates/ui-egui/src/editing.rs         | 221 +++++++++++++++++++++++++-
 parity/acrobat-features.toml          |   4 +-
 5 files changed, 449 insertions(+), 11 deletions(-)

diff --git a/apps/pdfcraft-cli/tests/run_root.rs b/apps/pdfcraft-cli/tests/run_root.rs
index 2f9fb69b..511621cc 100644
--- a/apps/pdfcraft-cli/tests/run_root.rs
+++ b/apps/pdfcraft-cli/tests/run_root.rs
@@ -61,11 +61,19 @@ fn script_image_output_is_confined_to_the_root() {
     assert!(!base.join("outside/escaped.png").exists() && !base.join("outside/new").exists());
     assert_eq!(std::fs::read_to_string(base.join("outside/existing.txt")).unwrap(), "SENTINEL\n");
 
-    // "." is the root itself: refused, without staging a temporary file beside the root.
+    // "." is the root itself: refused, without staging a temporary file beside the root. The
+    // file at the old fixed staging name and the listing are canaries; staging names are random.
     std::fs::write(base.join(".root.pdfcraft-tmp"), "SENTINEL\n").unwrap();
+    let listing = || {
+        let mut names: Vec<_> = std::fs::read_dir(&base).unwrap().map(|e| e.unwrap().file_name()).collect();
+        names.sort();
+        names
+    };
+    let before = listing();
     let o = render_to(&base, &base, Some(&root), ".");
     assert!(!o.status.success() && String::from_utf8_lossy(&o.stderr).contains("is a folder"), "{}", String::from_utf8_lossy(&o.stderr));
     assert_eq!(std::fs::read_to_string(base.join(".root.pdfcraft-tmp")).unwrap(), "SENTINEL\n");
+    assert_eq!(listing(), before, "nothing was left beside the root");
 
     // A relative path resolves inside the root, not in the working directory.
     let o = render_to(&base, &base, Some(&root), "relative.png");
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 1e199d2c..b76c71b1 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -1720,6 +1720,12 @@ fn child(dir: &Path, name: &str) -> PathBuf {
 
 /// Write via a temporary file in the same directory, then rename over the target.
 fn write_atomic(path: &Path, bytes: &[u8]) -> Result<()> {
+    write_atomic_with(path, bytes, staging_suffixes())
+}
+
+/// [`write_atomic`], trying the staging names that `suffixes` give.
+fn write_atomic_with(path: &Path, bytes: &[u8], suffixes: impl IntoIterator<Item = u64>) -> Result<()> {
+    use std::io::Write;
     // A folder can't be replaced, and staging beside it could land outside the root: "." names
     // the root itself, whose parent isn't ours to write in.
     if path.is_dir() {
@@ -1728,14 +1734,62 @@ fn write_atomic(path: &Path, bytes: &[u8]) -> Result<()> {
     let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or(Path::new("."));
     let name = path.file_name().ok_or_else(|| failed(format!("{}: not a file path", path.display())))?;
     std::fs::create_dir_all(dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-    let tmp = dir.join(format!(".{}.pdfcraft-tmp", name.to_string_lossy()));
-    std::fs::write(&tmp, bytes).map_err(|e| failed(format!("{}: {e}", tmp.display())))?;
+    let (tmp, file) = create_staging(dir, &name.to_string_lossy(), suffixes).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+    // Closed at the end of the block, before the rename.
+    let written = {
+        let mut file = file;
+        file.write_all(bytes)
+    };
+    if let Err(e) = written {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(failed(format!("{}: {e}", tmp.display())));
+    }
     std::fs::rename(&tmp, path).map_err(|e| {
         let _ = std::fs::remove_file(&tmp);
         failed(format!("{}: {e}", path.display()))
     })
 }
 
+/// How many staging names [`create_staging`] tries. A random 64-bit name is only taken if someone
+/// put a file there on purpose, so running out means refusing, not trying harder.
+const STAGING_ATTEMPTS: usize = 16;
+
+/// Create a new, empty staging file in `dir` for the file `name`, one name per suffix. It is
+/// opened with `create_new`, which fails if anything already has the name (a file, a hard link,
+/// a symbolic link even when dangling, a folder), on Windows as everywhere else; such a name is
+/// skipped, never opened, so a file planted at the staging path can't receive or redirect the
+/// write.
+fn create_staging(dir: &Path, name: &str, suffixes: impl IntoIterator<Item = u64>) -> std::io::Result<(PathBuf, std::fs::File)> {
+    // At most 128 bytes of the target's name, cut between characters, so the staging name fits
+    // the 255-byte (Linux, macOS) and 255-unit (Windows) limits however long that name is.
+    let mut stem = String::new();
+    for c in name.chars() {
+        if stem.len() + c.len_utf8() > 128 {
+            break;
+        }
+        stem.push(c);
+    }
+    for suffix in suffixes.into_iter().take(STAGING_ATTEMPTS) {
+        let tmp = dir.join(format!(".{stem}.{suffix:016x}.pdfcraft-tmp"));
+        match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
+            Ok(file) => return Ok((tmp, file)),
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
+            // Windows reports a folder at the name as "access denied"; it is taken all the same.
+            Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied && tmp.symlink_metadata().is_ok() => {}
+            Err(e) => return Err(e),
+        }
+    }
+    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "every temporary file name tried is taken"))
+}
+
+/// Unpredictable staging-name suffixes, so a name can't be planted in advance. `RandomState` is
+/// keyed from the operating system's random source.
+fn staging_suffixes() -> impl Iterator<Item = u64> {
+    use std::hash::BuildHasher;
+    let state = std::hash::RandomState::new();
+    (0u64..).map(move |i| state.hash_one(i))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1790,4 +1844,158 @@ mod tests {
         assert!(foreign_share(Path::new(r"\\server\other\x.pdf"), shared));
         assert!(foreign_share(Path::new(r"\\attacker\docs\x.pdf"), shared));
     }
+
+    /// A fresh, empty folder for one staging test.
+    fn staging_dir(test: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-staging-{}-{test}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    fn staged(dir: &Path, suffix: u64) -> PathBuf {
+        dir.join(format!(".out.pdf.{suffix:016x}.pdfcraft-tmp"))
+    }
+
+    fn read(p: &Path) -> String {
+        std::fs::read_to_string(p).unwrap()
+    }
+
+    /// A symbolic link to a file, where the system allows one (Windows needs Developer Mode or an
+    /// administrator for it).
+    fn file_symlink(target: &Path, link: &Path) -> std::io::Result<()> {
+        #[cfg(unix)]
+        {
+            std::os::unix::fs::symlink(target, link)
+        }
+        #[cfg(windows)]
+        {
+            std::os::windows::fs::symlink_file(target, link)
+        }
+        #[cfg(not(any(unix, windows)))]
+        {
+            Err(std::io::Error::other(format!("no symbolic links here: {} {}", target.display(), link.display())))
+        }
+    }
+
+    #[test]
+    fn staging_never_writes_through_a_file_planted_at_its_name() {
+        let dir = staging_dir("planted");
+        // A file elsewhere that a planted link points at.
+        let outside = dir.join("outside.txt");
+        std::fs::write(&outside, "PRECIOUS").unwrap();
+        let target = dir.join("out.pdf");
+        // A hard link needs no privileges on any system, and writing to it writes to `outside`.
+        std::fs::hard_link(&outside, staged(&dir, 1)).unwrap();
+        std::fs::write(staged(&dir, 2), "PLANTED").unwrap();
+        write_atomic_with(&target, b"NEW", [1, 2, 3]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert_eq!(read(&outside), "PRECIOUS");
+        assert_eq!(read(&staged(&dir, 1)), "PRECIOUS");
+        assert_eq!(read(&staged(&dir, 2)), "PLANTED");
+        assert!(!staged(&dir, 3).exists(), "the staging file was renamed into place");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn staging_never_writes_through_a_symbolic_link_planted_at_its_name() {
+        let dir = staging_dir("symlink");
+        let outside = dir.join("outside.txt");
+        std::fs::write(&outside, "PRECIOUS").unwrap();
+        let target = dir.join("out.pdf");
+        if let Err(e) = file_symlink(&outside, &staged(&dir, 1)) {
+            eprintln!("symbolic links not checked: {e}");
+            return;
+        }
+        write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert_eq!(read(&outside), "PRECIOUS");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn staging_never_creates_a_file_through_a_dangling_link_at_its_name() {
+        let dir = staging_dir("dangling");
+        let unborn = dir.join("created-through-a-link.txt");
+        let target = dir.join("out.pdf");
+        if let Err(e) = file_symlink(&unborn, &staged(&dir, 1)) {
+            eprintln!("symbolic links not checked: {e}");
+            return;
+        }
+        write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert!(!unborn.exists(), "nothing was created through the dangling link");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn staging_gives_up_rather_than_reuse_a_taken_name() {
+        let dir = staging_dir("taken");
+        let target = dir.join("out.pdf");
+        std::fs::write(&target, "OLD").unwrap();
+        for s in 1..=STAGING_ATTEMPTS as u64 {
+            std::fs::write(staged(&dir, s), "PLANTED").unwrap();
+        }
+        assert!(write_atomic_with(&target, b"NEW", 1..).is_err());
+        assert_eq!(read(&target), "OLD");
+        for s in 1..=STAGING_ATTEMPTS as u64 {
+            assert_eq!(read(&staged(&dir, s)), "PLANTED");
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The names in a folder: what a test can see was left behind.
+    fn listing(dir: &Path) -> Vec<String> {
+        let mut names: Vec<_> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+        names.sort();
+        names
+    }
+
+    #[test]
+    fn staging_names_differ_between_saves_and_fit_long_names() {
+        let suffixes: std::collections::HashSet<u64> = staging_suffixes().take(64).collect();
+        assert_eq!(suffixes.len(), 64);
+        assert_ne!(staging_suffixes().next(), staging_suffixes().next(), "each save draws new names");
+        // 60 four-byte characters: a 244-byte name, within every system's limit. Its staging name
+        // must be too (on Linux the whole name in it would be 275 bytes).
+        let dir = staging_dir("long");
+        let name = format!("{}.pdf", "\u{1F600}".repeat(60));
+        write_atomic(&dir.join(&name), b"NEW").unwrap();
+        assert_eq!(read(&dir.join(&name)), "NEW");
+        assert_eq!(listing(&dir), [name], "no staging file is left behind");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_folder_at_the_staging_name_is_left_alone() {
+        let dir = staging_dir("folder");
+        std::fs::create_dir(staged(&dir, 1)).unwrap();
+        std::fs::write(staged(&dir, 1).join("inside.txt"), "PLANTED").unwrap();
+        let target = dir.join("out.pdf");
+        write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert_eq!(read(&staged(&dir, 1).join("inside.txt")), "PLANTED");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Windows refuses to replace a read-only file, so the rename fails: the staging file must not
+    /// be left behind.
+    #[cfg(windows)]
+    #[test]
+    fn a_failed_rename_removes_the_staging_file() {
+        let dir = staging_dir("readonly");
+        let target = dir.join("out.pdf");
+        std::fs::write(&target, "OLD").unwrap();
+        let mut perms = std::fs::metadata(&target).unwrap().permissions();
+        perms.set_readonly(true);
+        std::fs::set_permissions(&target, perms.clone()).unwrap();
+        let e = write_atomic_with(&target, b"NEW", [7]).unwrap_err();
+        assert!(e.to_string().contains(&target.display().to_string()), "the rename failed, not the staging: {e}");
+        assert_eq!(read(&target), "OLD");
+        assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
+        #[allow(clippy::permissions_set_readonly_false)]
+        perms.set_readonly(false);
+        std::fs::set_permissions(&target, perms).unwrap();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 3083dce4..0f85ec2a 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -405,12 +405,20 @@ fn root_refusals_do_not_reveal_what_exists_outside() {
 #[test]
 fn writing_to_a_folder_touches_nothing_beside_it() {
     // "." names the root itself. Saving there used to stage its temporary file next to the
-    // root, outside it, overwriting and then deleting any file of that name.
+    // root, outside it, overwriting and then deleting any file of that name. Staging names are
+    // random now and a failed rename removes the staging file, so the "is a folder" refusal is
+    // what this checks; the listings and the file at the old staging name are canaries.
     let (base, root) = sandbox("root-itself");
     let mut a = auto(&root);
     let beside = base.join(".root.pdfcraft-tmp");
     std::fs::write(&beside, "SENTINEL").unwrap();
     std::fs::create_dir_all(root.join("folder")).unwrap();
+    let listing = |dir: &Path| {
+        let mut names: Vec<_> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name()).collect();
+        names.sort();
+        names
+    };
+    let (base_before, folder_before) = (listing(&base), listing(&root.join("folder")));
     let doc = ok(&mut a, "doc_open", json!({ "path": "inside.pdf" }))["doc"].as_u64().unwrap();
     for p in [".", "", "folder", "folder/"] {
         let e = a.call("doc_save", &json!({ "doc": doc, "path": p })).unwrap_err();
@@ -419,7 +427,8 @@ fn writing_to_a_folder_touches_nothing_beside_it() {
     let png = vec![1, 2, 3];
     assert!(a.write_output(".", &png).is_err());
     assert_eq!(std::fs::read_to_string(&beside).unwrap(), "SENTINEL");
-    assert!(!root.join(".folder.pdfcraft-tmp").exists());
+    assert_eq!(listing(&base), base_before, "nothing was left beside the root");
+    assert_eq!(listing(&root.join("folder")), folder_before, "nothing was left in the folder");
     // `image_save` adds an extension when the path has none, which turned "." into `root.png`
     // beside the root.
     ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 18 }));
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 51d97cb4..02378e64 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -492,14 +492,23 @@ fn comment_page(edit: &Edit) -> Option<usize> {
 /// Write via a temporary file in the same directory and rename over the target, so a crash or
 /// full disk never leaves a half-written PDF where the original was.
 pub fn write_atomically(path: &str, bytes: &[u8]) -> std::io::Result<()> {
+    write_atomically_with(path, bytes, staging_suffixes())
+}
+
+/// [`write_atomically`], trying the staging names that `suffixes` give.
+fn write_atomically_with(path: &str, bytes: &[u8], suffixes: impl IntoIterator<Item = u64>) -> std::io::Result<()> {
     use std::io::Write;
     let target = std::path::Path::new(path);
     let dir = target.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(std::path::Path::new("."));
-    let tmp = dir.join(format!(".{}.pdfcraft-{}.tmp", target.file_name().and_then(|n| n.to_str()).unwrap_or("save"), std::process::id()));
+    let name = target.file_name().and_then(|n| n.to_str()).unwrap_or("save");
+    let (tmp, f) = create_staging(dir, name, suffixes)?;
     let result = (|| {
-        let mut f = std::fs::File::create(&tmp)?;
-        f.write_all(bytes)?;
-        f.sync_all()?;
+        // Closed at the end of the block, before the rename.
+        {
+            let mut f = f;
+            f.write_all(bytes)?;
+            f.sync_all()?;
+        }
         std::fs::rename(&tmp, target)
     })();
     if result.is_err() {
@@ -508,6 +517,50 @@ pub fn write_atomically(path: &str, bytes: &[u8]) -> std::io::Result<()> {
     result
 }
 
+/// How many staging names [`create_staging`] tries. A random 64-bit name is only taken if someone
+/// put a file there on purpose, so running out means refusing, not trying harder.
+const STAGING_ATTEMPTS: usize = 16;
+
+/// Create a new, empty staging file in `dir` for the file `name`, one name per suffix. It is
+/// opened with `create_new`, which fails if anything already has the name (a file, a hard link,
+/// a symbolic link even when dangling, a folder), on Windows as everywhere else; such a name is
+/// skipped, never opened, so a file planted at the staging path can't receive or redirect the
+/// save.
+fn create_staging(
+    dir: &std::path::Path,
+    name: &str,
+    suffixes: impl IntoIterator<Item = u64>,
+) -> std::io::Result<(std::path::PathBuf, std::fs::File)> {
+    // At most 128 bytes of the target's name, cut between characters, so the staging name fits
+    // the 255-byte (Linux, macOS) and 255-unit (Windows) limits however long that name is.
+    let mut stem = String::new();
+    for c in name.chars() {
+        if stem.len() + c.len_utf8() > 128 {
+            break;
+        }
+        stem.push(c);
+    }
+    for suffix in suffixes.into_iter().take(STAGING_ATTEMPTS) {
+        let tmp = dir.join(format!(".{stem}.pdfcraft-{suffix:016x}.tmp"));
+        match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
+            Ok(file) => return Ok((tmp, file)),
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
+            // Windows reports a folder at the name as "access denied"; it is taken all the same.
+            Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied && tmp.symlink_metadata().is_ok() => {}
+            Err(e) => return Err(e),
+        }
+    }
+    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "every temporary file name tried is taken"))
+}
+
+/// Unpredictable staging-name suffixes, so a name can't be planted in advance. `RandomState` is
+/// keyed from the operating system's random source.
+fn staging_suffixes() -> impl Iterator<Item = u64> {
+    use std::hash::BuildHasher;
+    let state = std::hash::RandomState::new();
+    (0u64..).map(move |i| state.hash_one(i))
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 fn short_name(path: &str) -> String {
     std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string())
@@ -586,3 +639,163 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
     let item = items.get(*first)?;
     if rest.is_empty() { Some(item) } else { bookmark_at(&item.children, rest) }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{STAGING_ATTEMPTS, staging_suffixes, write_atomically, write_atomically_with};
+    use std::path::{Path, PathBuf};
+
+    /// A fresh, empty folder for one staging test.
+    fn staging_dir(test: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-ui-staging-{}-{test}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    fn staged(dir: &Path, suffix: u64) -> PathBuf {
+        dir.join(format!(".out.pdf.pdfcraft-{suffix:016x}.tmp"))
+    }
+
+    fn read(p: &Path) -> String {
+        std::fs::read_to_string(p).unwrap()
+    }
+
+    /// A symbolic link to a file, where the system allows one (Windows needs Developer Mode or an
+    /// administrator for it).
+    fn file_symlink(target: &Path, link: &Path) -> std::io::Result<()> {
+        #[cfg(unix)]
+        {
+            std::os::unix::fs::symlink(target, link)
+        }
+        #[cfg(windows)]
+        {
+            std::os::windows::fs::symlink_file(target, link)
+        }
+        #[cfg(not(any(unix, windows)))]
+        {
+            Err(std::io::Error::other(format!("no symbolic links here: {} {}", target.display(), link.display())))
+        }
+    }
+
+    #[test]
+    fn saving_never_writes_through_a_file_planted_at_the_staging_name() {
+        let dir = staging_dir("planted");
+        let outside = dir.join("outside.txt");
+        std::fs::write(&outside, "PRECIOUS").unwrap();
+        let target = dir.join("out.pdf");
+        let path = target.to_string_lossy().into_owned();
+        // A hard link needs no privileges on any system, and writing to it writes to `outside`.
+        std::fs::hard_link(&outside, staged(&dir, 1)).unwrap();
+        std::fs::write(staged(&dir, 2), "PLANTED").unwrap();
+        write_atomically_with(&path, b"NEW", [1, 2, 3]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert_eq!(read(&outside), "PRECIOUS");
+        assert_eq!(read(&staged(&dir, 1)), "PRECIOUS");
+        assert_eq!(read(&staged(&dir, 2)), "PLANTED");
+        assert!(!staged(&dir, 3).exists(), "the staging file was renamed into place");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn saving_never_writes_through_a_symbolic_link_at_the_staging_name() {
+        let dir = staging_dir("symlink");
+        let outside = dir.join("outside.txt");
+        std::fs::write(&outside, "PRECIOUS").unwrap();
+        let target = dir.join("out.pdf");
+        if let Err(e) = file_symlink(&outside, &staged(&dir, 1)) {
+            eprintln!("symbolic links not checked: {e}");
+            return;
+        }
+        write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert_eq!(read(&outside), "PRECIOUS");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn saving_never_creates_a_file_through_a_dangling_link_at_the_staging_name() {
+        let dir = staging_dir("dangling");
+        let unborn = dir.join("created-through-a-link.txt");
+        let target = dir.join("out.pdf");
+        if let Err(e) = file_symlink(&unborn, &staged(&dir, 1)) {
+            eprintln!("symbolic links not checked: {e}");
+            return;
+        }
+        write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert!(!unborn.exists(), "nothing was created through the dangling link");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_folder_at_the_staging_name_is_left_alone() {
+        let dir = staging_dir("folder");
+        std::fs::create_dir(staged(&dir, 1)).unwrap();
+        std::fs::write(staged(&dir, 1).join("inside.txt"), "PLANTED").unwrap();
+        let target = dir.join("out.pdf");
+        write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
+        assert_eq!(read(&target), "NEW");
+        assert_eq!(read(&staged(&dir, 1).join("inside.txt")), "PLANTED");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn saving_gives_up_rather_than_reuse_a_taken_name() {
+        let dir = staging_dir("taken");
+        let target = dir.join("out.pdf");
+        std::fs::write(&target, "OLD").unwrap();
+        for s in 1..=STAGING_ATTEMPTS as u64 {
+            std::fs::write(staged(&dir, s), "PLANTED").unwrap();
+        }
+        assert!(write_atomically_with(&target.to_string_lossy(), b"NEW", 1..).is_err());
+        assert_eq!(read(&target), "OLD");
+        for s in 1..=STAGING_ATTEMPTS as u64 {
+            assert_eq!(read(&staged(&dir, s)), "PLANTED");
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The names in a folder: what a test can see was left behind.
+    fn listing(dir: &Path) -> Vec<String> {
+        let mut names: Vec<_> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+        names.sort();
+        names
+    }
+
+    #[test]
+    fn saving_a_long_name_leaves_only_the_saved_file() {
+        assert_ne!(staging_suffixes().next(), staging_suffixes().next(), "each save draws new names");
+        // 60 four-byte characters: a 244-byte name, within every system's limit. Its staging name
+        // must be too (on Linux the whole name in it would be 275 bytes).
+        let dir = staging_dir("clean");
+        let name = format!("{}.pdf", "\u{1F600}".repeat(60));
+        let path = dir.join(&name).to_string_lossy().into_owned();
+        write_atomically(&path, b"NEW").unwrap();
+        write_atomically(&path, b"NEWER").unwrap();
+        assert_eq!(read(&dir.join(&name)), "NEWER");
+        assert_eq!(listing(&dir), [name], "no staging file is left behind");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Windows refuses to replace a read-only file, so the rename fails: the staging file must not
+    /// be left behind.
+    #[cfg(windows)]
+    #[test]
+    fn a_failed_save_removes_the_staging_file() {
+        let dir = staging_dir("readonly");
+        let target = dir.join("out.pdf");
+        std::fs::write(&target, "OLD").unwrap();
+        let mut perms = std::fs::metadata(&target).unwrap().permissions();
+        perms.set_readonly(true);
+        std::fs::set_permissions(&target, perms.clone()).unwrap();
+        let e = write_atomically_with(&target.to_string_lossy(), b"NEW", [7]).unwrap_err();
+        assert_eq!(e.kind(), std::io::ErrorKind::PermissionDenied, "the rename failed: {e}");
+        assert_eq!(read(&target), "OLD");
+        assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
+        #[allow(clippy::permissions_set_readonly_false)]
+        perms.set_readonly(false);
+        std::fs::set_permissions(&target, perms).unwrap();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 16674649..9cfa9f7b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -274,8 +274,8 @@ milestone = "M1"
 status = "shipped"
 commands = ["file.save"]
 tools = ["doc_save"]
-evidence = ["crates/ui-egui/tests/editing.rs::save_writes_an_incremental_update_and_clears_dirty", "crates/engine/src/tests.rs::save_is_incremental_stamps_mod_date_and_rebases", "crates/organize/src/tests.rs::successive_incremental_saves_stack_revisions"]
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::save_writes_an_incremental_update_and_clears_dirty", "crates/engine/src/tests.rs::save_is_incremental_stamps_mod_date_and_rebases", "crates/organize/src/tests.rs::successive_incremental_saves_stack_revisions", "crates/automation/src/lib.rs::staging_never_writes_through_a_file_planted_at_its_name", "crates/ui-egui/src/editing.rs::saving_never_writes_through_a_file_planted_at_the_staging_name"]
+notes = "The atomic write stages to a new, randomly named file created with create_new, so a file or link planted at the staging path is never written through (desktop app, automation and CLI)."
 
 [[feature]]
 id = "core.save-as-full-rewrite"

From 9140b44792b59e93029a216117a6d5aa9ffd55c7 Mon Sep 17 00:00:00 2001
From: mlkonrad <marlonk@gmail.com>
Date: Thu, 8 Oct 2026 22:37:10 +0300
Subject: [PATCH 002/149] M4: Combine files in its own tab, with a sortable
 table and unlocking of protected files (#321)

* M4: Combine files in its own tab, with a sortable table and unlocking of protected files

Combine files was a modal dialog with a cramped list and up/down buttons on
every row. It is now a tab next to Home and the documents, showing a table
of the files: File name | Pages | Size | Modified | Warnings.

- Columns sort when their heading is clicked (anywhere in the cell; again to
  reverse; names in natural order), resize from their edges and move by
  dragging the heading. Order and widths are kept in the settings; a
  right-click on a heading resets them.
- Rows select like a file manager (click, Ctrl/Cmd+click, Shift+click,
  Shift+arrows, Ctrl/Cmd+A). One toolbar moves, removes and unlocks the
  selection; Alt+arrows and dragging move it too. Every change to the list
  undoes and redoes with Cmd/Ctrl+Z (also toolbar buttons).
- Add files, Add folder, Add folder and subfolders (a split button), Add open
  documents, or drop files and folders on the tab.
- Problems show before Combine: password-protected files, security settings
  that withhold page assembly, page ranges (checked as typed, with the pages
  they take), duplicates. Files that open but are protected say that the
  combined file won't keep their security; the result is never encrypted.
- Unlock... asks for a file's open or permissions password (one password can
  be tried on several files). Passwords stay in memory, are never printed,
  and reach the engine through combine_unlocked; doc_combine takes them as
  `passwords`. The engine decides whether a password works, since the
  inspector rejects some it accepts (RC4 owner passwords).

organize.combine-sort is shipped and organize.combine-options partial
(include open files). Strings are translated for es, fr, ja, zh-hans, zh-hant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Credit Marlon Konrad (mlkonrad) in the About window

Adds my own entry to contributors/people.toml, as docs/contributors.md asks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                      |   10 +-
 ROADMAP.md                            |    4 +-
 contributors/people.toml              |    5 +
 crates/automation/src/lib.rs          |   10 +-
 crates/automation/src/tools.rs        |    3 +-
 crates/automation/tests/automation.rs |   27 +
 crates/engine/src/lib.rs              |   61 +-
 crates/engine/src/tests.rs            |   32 +
 crates/ui-egui/src/chrome.rs          |   26 +-
 crates/ui-egui/src/combine_ui.rs      | 1556 +++++++++++++++++++++++--
 crates/ui-egui/src/commands.rs        |    6 +-
 crates/ui-egui/src/dialogs.rs         |   14 -
 crates/ui-egui/src/editing.rs         |   13 +-
 crates/ui-egui/src/files.rs           |   53 +-
 crates/ui-egui/src/i18n/es.tsv        |   58 +-
 crates/ui-egui/src/i18n/fr.tsv        |   56 +
 crates/ui-egui/src/i18n/ja.tsv        |   58 +-
 crates/ui-egui/src/i18n/zh-hans.tsv   |   58 +-
 crates/ui-egui/src/i18n/zh-hant.tsv   |   58 +-
 crates/ui-egui/src/lib.rs             |   27 +-
 crates/ui-egui/src/widgets.rs         |   28 +
 crates/ui-egui/tests/editing.rs       |  424 ++++++-
 crates/ui-egui/tests/ui.rs            |   40 +
 parity/acrobat-features.toml          |   24 +-
 24 files changed, 2500 insertions(+), 151 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 36087581..0d355408 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5da2aa2944fcad4720972062f0f97800f73b8bfa5dd0fff6c28f4ec0f8ee19f9"
+sha256 = "cac5e47a10ff49a6d41d87869fda1760778b533319f8ccec2b4e8e67b8a8e0dd"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "39f83ab539f6380df995a855c1c8e8c036bcd060e06b9d1b027771e1e7d6e7ef"
+sha256 = "97de2a56aa5cf32d11f22c19f0efeb76cbe16dff769247f49d8bdecbeac34d90"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4c409434bd3385b56b561c36ff819e19e574bda8979d16cd53232cb5bea3c65f"
+sha256 = "6d2da5a55e6eb10e26efbdd4d34e48be30c2cad8e3f43e1fe811d8ce95dd0a19"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d322ac956218961d22828726a7fe0752b0a68603679c2dcf17c5aa840995e124"
+sha256 = "2be55ac9d1303fea2d61f3f6c594cf5003e2b2aa405eefddffed2ea158a94b5e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4b14f85bc0890823c30bff37723ecb05bc5ea5a8583334644168b08043ab6bde"
+sha256 = "f2a9449db49de5226000d0b14b991ab2318a82e4ca63624b11ea4a753ae2ea74"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index ecd96d48..a3c9f48b 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -93,7 +93,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
 | M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
-| M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M6 | Forms + JavaScript | 160–320 | 45% | 95–185 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 17% | 210–420 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
@@ -133,6 +133,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (M14, #305):** Windows MSI rejects per-user installation overrides while allowing removal of legacy per-user installs and keeps its progress message visible. README documents unattended deployment without a desktop shortcut. Compiled x64 MSI checks pass; ARM64 install regressions added for CI. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-08 (M4, Combine files):** Combine files is now its own tab instead of a dialog: a table of the files (name, pages, size, modified, warnings) whose columns sort, resize and move, with the layout kept in the settings. Files, folders (optionally with subfolders) and open documents can be added, or dropped on the tab; rows select like a file manager (Ctrl/Shift), move as a block by toolbar, Alt+arrows or drag, and every change undoes with ⌘Z. Problems show before Combine: password-protected files, security settings that withhold page assembly, bad page ranges (checked as typed), duplicates; protected files unlock with their open or permissions password, also headlessly (`doc_combine` `passwords`). The result is never encrypted, and the list says so. `organize.combine-sort` shipped; `organize.combine-options` partial (open files). Still missing: protecting the result in the same step, file-size and PDF/A options. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M14, French):** Français (`fr`) is a complete interface catalog (about 1,880 entries), selected automatically for `fr`, `fr_FR`, `fr_CA` and other French locales, and from Preferences. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names. Latin UI faces cover the catalog. Localization remains partial for Czech and Brazilian Portuguese; overall ≈ 30–35% (unchanged).
 
 - **2026-10-08 (M14, right-to-left file names):** A tab with an Arabic or Hebrew file name showed replacement boxes. The interface now takes an `Arab` face from craft-fonts when the build input has one, and on desktop falls back to one font installed on the machine for characters no embedded face has (`PDFCRAFT_SYSTEM_FONTS=0` turns that off; README screenshots do). File names and paths in the tab strip, the recent-files list and Properties are put in display order, since egui joins the letters but does not reorder runs. Still missing: multi-line text (bookmarks, comments, search results), text input and a mirrored layout, so `misc.rtl-ui` stays planned; the craft-fonts revision pinned for releases predates its Arabic face, so release builds rely on the installed font until the pin moves. Overall estimate unchanged (about 30–35%).
diff --git a/contributors/people.toml b/contributors/people.toml
index c0549e9d..d84dff38 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -36,3 +36,8 @@ sync_github_name = false
 real_name = "Hal Goff"
 display_name = "Hal Goff, HG Studio"
 sync_github_name = false
+
+[people.mlkonrad]
+real_name = "Marlon Konrad"
+display_name = "Marlon Konrad"
+sync_github_name = false
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index b76c71b1..952f2ff9 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -1178,6 +1178,13 @@ impl Automation {
             Some(Value::Array(v)) if v.len() == paths.len() => v.iter().map(|x| x.as_str().map(str::to_owned)).collect(),
             Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
         };
+        let passwords: Vec<Option<String>> = match a.get("passwords") {
+            None | Some(Value::Null) => vec![None; paths.len()],
+            Some(Value::Array(v)) if v.len() == paths.len() && v.iter().all(|x| x.is_string() || x.is_null()) => {
+                v.iter().map(|x| x.as_str().map(str::to_owned)).collect()
+            }
+            Some(_) => return Err(ToolError::InvalidArgs("passwords must list a password (or null) for each path".into())),
+        };
         let mut sources = Vec::new();
         for (p, range) in paths.into_iter().zip(ranges) {
             let path = self.resolve(p, false)?;
@@ -1185,7 +1192,8 @@ impl Automation {
             let name = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
             sources.push((name, Arc::new(bytes), range));
         }
-        let bytes = self.session.combine_ranges(&sources).map_err(failed)?;
+        let passwords: Vec<Option<&str>> = passwords.iter().map(Option::as_deref).collect();
+        let bytes = self.session.combine_unlocked(&sources, &passwords).map_err(failed)?;
         self.deliver(a, "Combined", bytes)
     }
 
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 2588efaa..a6838150 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -185,12 +185,13 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "pages": pages("to extract"), "out": save_out.clone(), "open": open.clone(), "separate": { "type": "boolean" }, "out_dir": { "type": "string" }, "delete": { "type": "boolean" } }),
                 &["doc", "pages"],
             )),
-        t("doc_combine", "Combine files", "Combine PDFs, in order, into one (bookmarks are kept under one entry per file). pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages.")
+        t("doc_combine", "Combine files", "Combine PDFs, in order, into one (bookmarks are kept under one entry per file). pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages. passwords, also in step with paths, opens encrypted files (the open password, or the permissions password where a file's security doesn't allow copying pages; null for none). The result is not encrypted. Passwords are never echoed back.")
             .cmd("page.combine")
             .with(schema(
                 json!({
                     "paths": { "type": "array", "items": { "type": "string" }, "minItems": 2 },
                     "pages": { "type": "array", "items": { "type": ["string", "null"] } },
+                    "passwords": { "type": "array", "items": { "type": ["string", "null"] } },
                     "out": save_out,
                     "open": open,
                 }),
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 0f85ec2a..65e5702d 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -756,6 +756,33 @@ fn protecting_through_tools() {
     ok(&mut c, "doc_open", json!({ "path": "open.pdf" }));
 }
 
+#[test]
+fn combine_opens_protected_files_with_their_passwords() {
+    let dir = workdir("combine-passwords");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    // Opens with "open"; only "boss" may assemble pages.
+    ok(&mut a, "doc_protect", json!({ "doc": doc, "open_password": "open", "permissions_password": "boss", "changes": "none" }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "locked.pdf" }));
+    let combine = |a: &mut Automation, passwords: Value| {
+        a.call("doc_combine", &json!({ "paths": ["locked.pdf", "b.pdf"], "passwords": passwords, "open": true }))
+    };
+    let err = |r: Result<_, ToolError>| match r {
+        Err(ToolError::Failed(m)) => m,
+        Err(other) => panic!("expected a failure, got {other:?}"),
+        Ok(_) => panic!("expected a failure"),
+    };
+    assert!(err(combine(&mut a, Value::Null)).contains("password-protected"));
+    assert!(err(combine(&mut a, json!(["wrong", null]))).contains("password is wrong"));
+    assert!(err(combine(&mut a, json!(["open", null]))).contains("don't allow copying pages"));
+    assert!(matches!(combine(&mut a, json!(["boss"])), Err(ToolError::InvalidArgs(_))), "one per path");
+    let done = ok(&mut a, "doc_combine", json!({ "paths": ["locked.pdf", "b.pdf"], "passwords": ["boss", null], "open": true }));
+    assert!(!done.to_string().contains("boss"), "passwords are never echoed");
+    let out = done["document"]["doc"].as_u64().unwrap();
+    assert_eq!(page_text(&mut a, out), ["Page 1", "Page 2", "Page 3", "Page 1", "Page 2"]);
+    assert_eq!(ok(&mut a, "doc_info", json!({ "doc": out }))["security"]["protected"], false, "the result is not encrypted");
+}
+
 /// Restrictions exist only behind a permissions password: open_password alone encrypts and
 /// restricts nothing, and asking for a restriction without one is refused rather than ignored (#134).
 #[test]
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index c7ce0650..2e623506 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -1734,17 +1734,52 @@ pub fn guard<T>(f: impl FnOnce() -> T) -> Result<T, String> {
 
 /// Parse another PDF to copy pages from.
 fn open_source(name: &str, bytes: &Arc<Vec<u8>>) -> Result<pdfcraft_cos::Document, EditError> {
-    match std::panic::catch_unwind(|| pdfcraft_cos::Document::open(bytes.clone())) {
-        Ok(Ok(d)) if d.permissions().is_some_and(|p| !p.assemble()) => {
-            Err(EditError::Source(format!("{name}: its security settings don't allow copying pages")))
-        }
+    open_source_with(name, bytes, None)
+}
+
+/// [`open_source`], authenticating with `password` (user or owner) for an encrypted file.
+fn open_source_with(name: &str, bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<pdfcraft_cos::Document, EditError> {
+    source_document(bytes, password).map_err(|p| EditError::Source(format!("{name}: {p}")))
+}
+
+/// Why a file can't be a source for Combine Files (or Insert / Replace pages).
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
+pub enum SourceProblem {
+    #[error("it is password-protected")]
+    Password,
+    #[error("the password is wrong")]
+    WrongPassword,
+    #[error("its security settings don't allow copying pages")]
+    NotPermitted,
+    #[error("{0}")]
+    Unreadable(String),
+}
+
+fn source_document(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<pdfcraft_cos::Document, SourceProblem> {
+    match std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password)) {
+        Ok(Ok(d)) if d.permissions().is_some_and(|p| !p.assemble()) => Err(SourceProblem::NotPermitted),
         Ok(Ok(d)) => Ok(d),
-        Ok(Err(pdfcraft_cos::CosError::NeedsPassword)) => Err(EditError::Source(format!("{name}: it is password-protected"))),
-        Ok(Err(e)) => Err(EditError::Source(format!("{name}: {e}"))),
-        Err(_) => Err(EditError::Source(format!("{name}: the file could not be read"))),
+        Ok(Err(pdfcraft_cos::CosError::NeedsPassword)) => Err(SourceProblem::Password),
+        Ok(Err(pdfcraft_cos::CosError::WrongPassword)) => Err(SourceProblem::WrongPassword),
+        Ok(Err(e)) => Err(SourceProblem::Unreadable(e.to_string())),
+        Err(_) => Err(SourceProblem::Unreadable("the file could not be read".into())),
     }
 }
 
+/// Whether `bytes` can be combined, opened with `password` (user or owner) if given, and if not
+/// why: what Combine would refuse it for, so the Combine files list can say so before Combine
+/// is pressed. The owner (permissions) password lifts the restriction on copying pages.
+pub fn combine_source_check(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<(), SourceProblem> {
+    source_document(bytes, password).map(|_| ())
+}
+
+/// The number of pages of `bytes`, opened with `password` (user or owner) if given, whatever
+/// its permissions allow; `None` when it can't be read.
+pub fn source_page_count(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Option<usize> {
+    let doc = std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password)).ok()?.ok()?;
+    pdfcraft_organize::page_count(&doc).ok()
+}
+
 fn plural(s: &str, n: usize) -> String {
     if n == 1 { s.to_string() } else { format!("{s}s") }
 }
@@ -2574,7 +2609,17 @@ impl Session {
 
     /// Combine Files with a page range per file ("1-3, 6"; `None` or empty for all pages).
     pub fn combine_ranges(&self, sources: &[CombineSource]) -> Result<Arc<Vec<u8>>, EditError> {
-        let docs = sources.iter().map(|(n, b, _)| open_source(n, b)).collect::<Result<Vec<_>, _>>()?;
+        self.combine_unlocked(sources, &[])
+    }
+
+    /// [`Self::combine_ranges`] with the password each encrypted source is opened with, by
+    /// position (missing or `None`: no password). The result is not encrypted.
+    pub fn combine_unlocked(&self, sources: &[CombineSource], passwords: &[Option<&str>]) -> Result<Arc<Vec<u8>>, EditError> {
+        let docs = sources
+            .iter()
+            .enumerate()
+            .map(|(i, (n, b, _))| open_source_with(n, b, passwords.get(i).copied().flatten()))
+            .collect::<Result<Vec<_>, _>>()?;
         let mut pages = Vec::with_capacity(docs.len());
         for ((name, _, range), d) in sources.iter().zip(&docs) {
             let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 6689667c..07f6b9af 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -631,6 +631,38 @@ fn permissions_password_restricts_others_but_not_this_session() {
     assert!(s2.get(id3).unwrap().allows_security_change());
 }
 
+#[test]
+fn combine_source_check_says_why_a_file_cannot_be_combined() {
+    let (mut s, id) = session_with(1);
+    let plain = s.get(id).unwrap().bytes.clone();
+    assert_eq!(crate::combine_source_check(&plain, None), Ok(()));
+    // Page assembly withheld (Changes::None) without a password to open it.
+    let p = Protection { changes: Changes::None, ..protection(None, Some("boss")) };
+    s.apply(id, Edit::Protect(p)).unwrap();
+    let locked = s.save_bytes(id).unwrap();
+    assert_eq!(crate::combine_source_check(&locked, None), Err(crate::SourceProblem::NotPermitted));
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::Protect(protection(Some("pw"), Some("owner")))).unwrap();
+    let secret = s.save_bytes(id).unwrap();
+    assert_eq!(crate::combine_source_check(&secret, None), Err(crate::SourceProblem::Password));
+    assert_eq!(crate::combine_source_check(&secret, Some("nope")), Err(crate::SourceProblem::WrongPassword));
+    // Its open password reads it, but its permissions withhold assembling pages: the owner's
+    // password allows it.
+    assert_eq!(crate::combine_source_check(&secret, Some("pw")), Err(crate::SourceProblem::NotPermitted));
+    assert_eq!(crate::combine_source_check(&secret, Some("owner")), Ok(()));
+    // The permissions password lifts the restriction on copying pages.
+    assert_eq!(crate::combine_source_check(&locked, Some("boss")), Ok(()));
+    // Combining with the passwords: the result opens without any.
+    let s = Session::new();
+    let sources = vec![("secret".to_string(), secret, None), ("locked".to_string(), locked, None)];
+    assert!(s.combine_ranges(&sources).is_err(), "no passwords, no combining");
+    let out = s.combine_unlocked(&sources, &[Some("owner"), Some("boss")]).unwrap();
+    let combined = pdfcraft_cos::Document::open(out).unwrap();
+    assert!(combined.permissions().is_none(), "the combined file is not encrypted");
+    assert_eq!(pdfcraft_organize::page_count(&combined).unwrap(), 2);
+    assert!(matches!(crate::combine_source_check(&Arc::new(b"not a pdf".to_vec()), None), Err(crate::SourceProblem::Unreadable(_))));
+}
+
 #[test]
 fn protection_is_validated_undoable_and_never_logged() {
     let (mut s, id) = session_with(1);
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index c4591444..41df36e7 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -24,20 +24,31 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             }
             ui.horizontal_centered(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
-                if icons::button(ui, "house", 28.0, app.active.is_none(), tl!("Home")).clicked() {
+                if icons::button(ui, "house", 28.0, app.active.is_none() && !app.combine_showing(), tl!("Home")).clicked() {
                     app.active = None;
+                    app.combine_tab.focused = false;
                 }
                 let mut close = None;
                 for i in 0..app.views.len() {
                     let Some(doc) = app.session.get(app.views[i].id) else { continue };
                     let (name, dirty) = (doc.display_name(), doc.dirty);
-                    if tab(ui, &t, &name, dirty, app.active == Some(i), &mut close, i).clicked() {
+                    if tab(ui, &t, "file-text", &name, dirty, app.active == Some(i), &mut close, i).clicked() {
                         app.active = Some(i);
                     }
                 }
                 if let Some(i) = close {
                     app.request_close_tab(i);
                 }
+                if app.combine_tab.open {
+                    // After the document tabs; its index can't clash with theirs.
+                    let mut close = None;
+                    if tab(ui, &t, "files", tl!("Combine files"), false, app.combine_showing(), &mut close, usize::MAX).clicked() {
+                        app.open_combine_tab();
+                    }
+                    if close.is_some() {
+                        app.close_combine_tab();
+                    }
+                }
                 ui.add_space(4.0);
                 if widgets::ghost_button(ui, "plus", tl!("Open")).on_hover_text(tl!("Open a PDF (⌘O)")).clicked() {
                     app.open_dialog();
@@ -77,7 +88,8 @@ fn theme_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     }
 }
 
-fn tab(ui: &mut egui::Ui, t: &Tokens, name: &str, dirty: bool, active: bool, close: &mut Option<usize>, index: usize) -> egui::Response {
+#[allow(clippy::too_many_arguments)]
+fn tab(ui: &mut egui::Ui, t: &Tokens, icon: &str, name: &str, dirty: bool, active: bool, close: &mut Option<usize>, index: usize) -> egui::Response {
     let font = theme::regular(13.0);
     let label: String = if name.chars().count() > 28 { format!("{}…", name.chars().take(27).collect::<String>()) } else { name.to_string() };
     // Painted text only: the accessibility name below keeps the logical order.
@@ -94,13 +106,7 @@ fn tab(ui: &mut egui::Ui, t: &Tokens, name: &str, dirty: bool, active: bool, clo
         Color32::TRANSPARENT
     };
     ui.painter().rect_filled(rect, CornerRadius { nw: 7, ne: 7, sw: 0, se: 0 }, bg);
-    icons::paint(
-        ui,
-        Rect::from_min_size(rect.min + vec2(6.0, 7.0), vec2(16.0, 16.0)),
-        "file-text",
-        15.0,
-        if active { t.accent } else { t.text_muted },
-    );
+    icons::paint(ui, Rect::from_min_size(rect.min + vec2(6.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, if active { t.accent } else { t.text_muted });
     ui.painter().text(rect.min + vec2(28.0, rect.height() / 2.0), Align2::LEFT_CENTER, label, font, if active { t.text } else { t.text_muted });
     let x_rect = Rect::from_center_size(rect.right_center() - vec2(16.0, 0.0), vec2(20.0, 20.0));
     let x = ui.interact(x_rect, ui.id().with(("tabclose", index)), Sense::click());
diff --git a/crates/ui-egui/src/combine_ui.rs b/crates/ui-egui/src/combine_ui.rs
index 92ea6da5..780d3c5e 100644
--- a/crates/ui-egui/src/combine_ui.rs
+++ b/crates/ui-egui/src/combine_ui.rs
@@ -1,128 +1,1526 @@
-//! Combine files: the files to combine, in order, each with the pages to take (all, or a range
-//! such as "1-3, 6"); reorder, remove or add files, then Combine.
+//! Combine files, in its own tab: the files to combine, in order, each with the pages to take
+//! (all, or a range such as "1-3, 6"), its size, when it was modified and anything that stops it
+//! being combined. Rows are selected like files in a file manager (click, Ctrl/⌘+click,
+//! Shift+click), moved with the toolbar, the keyboard or by dragging, and sorted by clicking a
+//! column heading; PDFs dropped on the tab join the list. Every change to the list can be undone.
 
+use std::cmp::Ordering;
+use std::collections::BTreeSet;
 use std::sync::Arc;
+use std::time::SystemTime;
 
-use egui::{Align, Layout};
+use egui::{Align, Color32, CornerRadius, Layout, Modifiers, Rect, Sense, Stroke, vec2};
+use egui_extras::{Column, TableBuilder};
+use pdfcraft_engine::SourceProblem;
 
 use crate::theme::{self, Tokens};
-use crate::{Dialog, PdfCraftApp, icons, widgets};
+use crate::{PdfCraftApp, icons, widgets};
+
+/// Same reds and ambers as the signature status (`sign_ui`).
+const ERROR: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
+const WARNING: Color32 = Color32::from_rgb(0xE6, 0x86, 0x19);
+/// Undo steps kept for the list (each holds the list itself; the files' bytes are shared).
+const HISTORY: usize = 100;
+
+/// Files found in a folder are added up to this many at a time.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_FOLDER_FILES: usize = 1000;
+/// How deep "Add folder and subfolders" looks.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_FOLDER_DEPTH: usize = 16;
+
+/// A column of the list: what it shows and what it sorts by.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SortKey {
+    Name,
+    Pages,
+    Size,
+    Modified,
+    Warnings,
+}
+
+impl SortKey {
+    pub const ALL: [SortKey; 5] = [SortKey::Name, SortKey::Pages, SortKey::Size, SortKey::Modified, SortKey::Warnings];
+
+    fn index(self) -> usize {
+        self as usize
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            SortKey::Name => tl!("File name"),
+            SortKey::Pages => tl!("Pages"),
+            SortKey::Size => tl!("Size"),
+            SortKey::Modified => tl!("Modified"),
+            SortKey::Warnings => tl!("Warnings"),
+        }
+    }
+
+    /// The narrowest the column may be dragged.
+    fn min_width(self) -> f32 {
+        match self {
+            SortKey::Name => 120.0,
+            SortKey::Pages => 110.0,
+            SortKey::Size => 60.0,
+            SortKey::Modified => 80.0,
+            SortKey::Warnings => 100.0,
+        }
+    }
+}
+
+/// The columns' order and widths, as the user arranged them (kept in the settings).
+#[derive(Clone, Debug, PartialEq)]
+pub struct Columns {
+    pub order: [SortKey; 5],
+    /// By [`SortKey::index`]; `None` until a column is resized: fitted to the window until then.
+    pub widths: Option<[f32; 5]>,
+}
+
+impl Default for Columns {
+    fn default() -> Self {
+        Columns { order: SortKey::ALL, widths: None }
+    }
+}
+
+impl Columns {
+    pub(crate) fn to_json(&self) -> serde_json::Value {
+        serde_json::json!({ "order": self.order, "widths": self.widths })
+    }
+
+    /// Settings written by [`Self::to_json`]; anything malformed gives the default layout.
+    pub(crate) fn from_json(v: &serde_json::Value) -> Self {
+        let order = serde_json::from_value::<Vec<SortKey>>(v["order"].clone())
+            .ok()
+            .filter(|o| SortKey::ALL.iter().all(|k| o.contains(k)))
+            .and_then(|o| <[SortKey; 5]>::try_from(o).ok())
+            .unwrap_or(SortKey::ALL);
+        let widths = serde_json::from_value::<[f32; 5]>(v["widths"].clone())
+            .ok()
+            .filter(|w| w.iter().all(|x| x.is_finite()))
+            .map(|w| std::array::from_fn(|i| w[i].clamp(SortKey::ALL[i].min_width(), 4000.0)));
+        Columns { order, widths }
+    }
+
+    /// The widths to show: the user's, or the window's width shared out.
+    fn resolved(&self, available: f32) -> [f32; 5] {
+        if let Some(w) = self.widths {
+            return w;
+        }
+        let fixed = 170.0 + 84.0 + 110.0;
+        let flexible = (available - fixed).max(260.0);
+        [(flexible * 0.55).max(140.0), 170.0, 84.0, 110.0, (flexible * 0.45).max(120.0)]
+    }
+}
+
+/// A column heading being dragged to a new place.
+#[derive(Clone, Copy)]
+struct HeadingDrag(SortKey);
+
+enum HeadingEvent {
+    Sort(SortKey),
+    /// Put column `kind` before (or after) column `to`.
+    Move {
+        kind: SortKey,
+        to: SortKey,
+        after: bool,
+    },
+    Reset,
+}
+
+/// The Combine files tab. It shows in the Home slot (`active == None`) while `focused`.
+#[derive(Clone, Debug, Default)]
+pub struct CombineTab {
+    pub open: bool,
+    pub focused: bool,
+    /// The selected rows, by [`CombineFile::id`], so a selection survives sorting and moving.
+    pub selected: BTreeSet<u64>,
+    /// Where a Shift+click or Shift+arrow range starts, and where it ends.
+    anchor: Option<u64>,
+    cursor: Option<u64>,
+    /// The column the list is sorted by and whether ascending; cleared when rows are moved.
+    pub sort: Option<(SortKey, bool)>,
+    undo: Vec<Snapshot>,
+    redo: Vec<Snapshot>,
+    /// The list as it was when a Pages field took the keyboard, recorded on its first change.
+    range_edit: Option<Snapshot>,
+    next_id: u64,
+    /// Bumped to make the table take its column widths afresh (columns moved or reset, or the
+    /// window resized while the widths follow it).
+    layout: u64,
+    /// The width the columns were last fitted to.
+    fitted: f32,
+    /// The password box of Unlock…, while it shows.
+    unlock: Option<UnlockPrompt>,
+}
+
+/// A password: kept in memory only, never printed (debug output ends up in logs).
+#[derive(Clone, Default)]
+pub struct Secret(String);
+
+impl std::fmt::Debug for Secret {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(if self.0.is_empty() { "\"\"" } else { "…" })
+    }
+}
+
+/// Which password a protected file still needs before it can be combined.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Lock {
+    /// The password that opens it.
+    Open,
+    /// It opens, but only its permissions (owner) password allows copying its pages.
+    Permissions,
+}
+
+/// Unlock…'s password box: the rows it unlocks and what has been typed.
+#[derive(Clone, Debug)]
+struct UnlockPrompt {
+    rows: Vec<u64>,
+    input: Secret,
+    show: bool,
+    error: Option<String>,
+    /// Where the box opens (below the link or button that asked for it).
+    at: egui::Pos2,
+    focused: bool,
+}
+
+/// What can be known about a file up front, opened with a password or not.
+struct Assessed {
+    pages: usize,
+    problem: Option<String>,
+    lock: Option<Lock>,
+    notes: Vec<String>,
+}
+
+enum AssessError {
+    WrongPassword,
+    Unreadable(String),
+}
+
+/// Read `bytes` (with `password`, if given) for the list: pages, what stops it being combined
+/// and which password would help, and warnings.
+fn assess(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<Assessed, AssessError> {
+    // The engine that combines decides whether the password works; the inspector (which may
+    // not accept every password the engine does, e.g. an RC4 owner password) adds the details.
+    let check = pdfcraft_engine::combine_source_check(bytes, password);
+    if check == Err(SourceProblem::WrongPassword) {
+        return Err(AssessError::WrongPassword);
+    }
+    let info = pdfcraft_render::inspect(bytes.clone(), password);
+    if let (Err(SourceProblem::Unreadable(e)), Err(_)) = (&check, &info) {
+        return Err(AssessError::Unreadable(e.clone()));
+    }
+    let info = info.ok();
+    let pages = match &info {
+        Some(i) => i.pages.len(),
+        None => pdfcraft_engine::source_page_count(bytes, password).unwrap_or(0),
+    };
+    let encrypted = password.is_some() || info.as_ref().is_some_and(|i| i.encrypted);
+    let warnings = info.map(|i| i.warnings).unwrap_or_default();
+    let (problem, lock) = match check {
+        Ok(()) => (None, None),
+        Err(SourceProblem::Password) => (Some(tl!("Password-protected").to_string()), Some(Lock::Open)),
+        Err(SourceProblem::WrongPassword) => return Err(AssessError::WrongPassword),
+        Err(SourceProblem::NotPermitted) if password.is_some() => (
+            Some(tl!("Opened, but its security settings don't allow combining. Enter the permissions password.").to_string()),
+            Some(Lock::Permissions),
+        ),
+        Err(SourceProblem::NotPermitted) => (Some(tl!("Its security settings don't allow copying pages").to_string()), Some(Lock::Permissions)),
+        Err(SourceProblem::Unreadable(e)) => (Some(crate::i18n::fmt(tl!("Can't be read: {e}"), &[("e", &e)])), None),
+    };
+    let mut notes = Vec::new();
+    // The combined file is a new, unprotected document: protection doesn't carry over.
+    if encrypted && problem.is_none() {
+        notes.push(if password.is_some() {
+            tl!("Unlocked: the combined file won't be password-protected").to_string()
+        } else {
+            tl!("Protected: the combined file won't keep its security settings").to_string()
+        });
+    }
+    notes.extend(warnings.into_iter().take(5));
+    Ok(Assessed { pages, problem, lock, notes })
+}
+
+#[derive(Clone, Debug)]
+struct Snapshot {
+    files: Vec<CombineFile>,
+    selected: BTreeSet<u64>,
+    sort: Option<(SortKey, bool)>,
+}
+
+/// A file arriving in the list (picked, dropped or already open).
+pub(crate) struct Incoming {
+    pub name: String,
+    pub bytes: Arc<Vec<u8>>,
+    pub modified: Option<SystemTime>,
+    /// Something to tell the user about where it came from.
+    pub note: Option<String>,
+}
 
 #[derive(Clone, Debug)]
 pub struct CombineFile {
+    /// Stable while the file is in the list (selection, undo).
+    pub id: u64,
     pub name: String,
     pub bytes: Arc<Vec<u8>>,
     pub pages: usize,
     /// The pages to take ("" = all).
     pub range: String,
+    /// When the file was last modified (desktop picks and drops only).
+    pub modified: Option<SystemTime>,
+    /// Why the file can't be combined (password, security settings), if so.
+    pub problem: Option<String>,
+    /// The password that would let it be combined, while one is needed.
+    pub lock: Option<Lock>,
+    /// The password it was unlocked with.
+    password: Option<Secret>,
+    /// Warnings that don't stop it being combined.
+    pub notes: Vec<String>,
+    /// Where it came from, shown among the warnings (e.g. an open document's unsaved changes).
+    origin_note: Option<String>,
+    /// The range last checked and the result: the number of pages it takes, or why it is wrong.
+    checked: Option<(String, Result<usize, String>)>,
+}
+
+impl CombineFile {
+    fn take(&mut self, a: Assessed, password: Option<Secret>) {
+        self.pages = a.pages;
+        self.problem = a.problem;
+        self.lock = a.lock;
+        self.password = password;
+        self.notes = self.origin_note.iter().cloned().chain(a.notes).collect();
+        self.checked = None;
+    }
+
+    /// The number of pages `range` takes, or why it can't be used. Checked again only when the
+    /// range changes.
+    pub fn selection(&mut self) -> Result<usize, String> {
+        if let Some((range, result)) = &self.checked
+            && *range == self.range
+        {
+            return result.clone();
+        }
+        let result = if self.range.trim().is_empty() {
+            Ok(self.pages)
+        } else {
+            match pdfcraft_engine::print::select_pages(self.pages, Some(&self.range), &[], pdfcraft_engine::print::Subset::All, false) {
+                Ok(p) if p.is_empty() => Err(tl!("No pages selected").to_string()),
+                Ok(p) => Ok(p.len()),
+                Err(e) => Err(e.to_string()),
+            }
+        };
+        self.checked = Some((self.range.clone(), result.clone()));
+        result
+    }
+
+    /// 0 = can't be combined, 1 = has warnings, 2 = fine: the Warnings column's sort order.
+    fn severity(&mut self) -> u8 {
+        if self.problem.is_some() || self.selection().is_err() {
+            0
+        } else if !self.notes.is_empty() {
+            1
+        } else {
+            2
+        }
+    }
 }
 
 enum RowAction {
-    Up(usize),
-    Down(usize),
-    Remove(usize),
+    /// A click on row `i` (Ctrl/⌘ toggles it, Shift selects up to it).
+    Click(usize, Modifiers),
+    SelectAll,
+    /// Up/Down arrow; with Shift the selection grows.
+    Step {
+        down: bool,
+        extend: bool,
+    },
+    MoveUp,
+    MoveDown,
+    Remove,
+    /// Row `from` (and the rest of the selection, if it is selected) dropped on row `to`.
+    Drop {
+        from: usize,
+        to: usize,
+    },
+    Sort(SortKey),
+    /// Unlock… on row `i` (and the rest of the selection, if it is selected), or on the
+    /// selection (`None`); the password box opens at the position.
+    Unlock(Option<usize>, egui::Pos2),
 }
 
-pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (bool, bool) {
-    ui.label(egui::RichText::new(tl!("Combine files")).font(theme::semibold(18.0)));
-    ui.add_space(4.0);
-    ui.label(egui::RichText::new(tl!("Files are combined in this order. Leave Pages empty to take every page.")).small().color(t.text_faint));
-    ui.add_space(8.0);
-    let mut action = None;
+/// What the table reports besides row actions.
+#[derive(Default)]
+struct TableEvents {
+    action: Option<RowAction>,
+    range_focused: bool,
+    range_changed: bool,
+}
+
+/// The Combine files page.
+pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let files_hovering = ui.ctx().input(|i| !i.raw.hovered_files.is_empty());
+    // Ranges are checked before anything below reads them.
+    let checks: Vec<Result<usize, String>> = app.combine_draft.iter_mut().map(CombineFile::selection).collect();
     let n = app.combine_draft.len();
-    egui::ScrollArea::vertical().max_height(360.0).auto_shrink([false, true]).show(ui, |ui| {
-        egui::Grid::new("combine-files").num_columns(4).min_col_width(40.0).spacing([10.0, 6.0]).striped(true).show(ui, |ui| {
-            ui.label(egui::RichText::new(tl!("File")).color(t.text_muted));
-            ui.label(egui::RichText::new(tl!("Pages")).color(t.text_muted));
-            ui.label("");
-            ui.label("");
-            ui.end_row();
-            for (i, f) in app.combine_draft.iter_mut().enumerate() {
-                ui.horizontal(|ui| {
-                    ui.add(icons::image("file-text", 16.0, t.icon));
-                    ui.add(egui::Label::new(&f.name).truncate());
-                    let count =
-                        if f.pages == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &f.pages.to_string())]) };
-                    ui.label(egui::RichText::new(count).small().color(t.text_faint));
-                });
-                ui.add_sized([120.0, 22.0], egui::TextEdit::singleline(&mut f.range).hint_text(tl!("All pages")))
-                    .on_hover_text(crate::i18n::fmt(tl!("Pages of {name} to combine, e.g. 1-3, 6"), &[("name", &f.name)]));
-                ui.horizontal(|ui| {
-                    if ui.add_enabled_ui(i > 0, |ui| icons::button(ui, "chevron-up", 24.0, false, tl!("Move up"))).inner.clicked() {
-                        action = Some(RowAction::Up(i));
-                    }
-                    if ui.add_enabled_ui(i + 1 < n, |ui| icons::button(ui, "chevron-down", 24.0, false, tl!("Move down"))).inner.clicked() {
-                        action = Some(RowAction::Down(i));
-                    }
-                });
-                if icons::button(ui, "trash-2", 24.0, false, &crate::i18n::fmt(tl!("Remove {name}"), &[("name", &f.name)])).clicked() {
-                    action = Some(RowAction::Remove(i));
+    let ids: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
+    app.combine_tab.selected.retain(|id| ids.contains(id));
+    let selected: Vec<bool> = ids.iter().map(|id| app.combine_tab.selected.contains(id)).collect();
+    let count = selected.iter().filter(|s| **s).count();
+    let blocker = blocker(&app.combine_draft, &checks);
+    let mut events = TableEvents { action: keyboard(ui, n, count > 0), ..Default::default() };
+    let mut combine = false;
+
+    egui::Frame::NONE.inner_margin(egui::Margin::symmetric(28, 20)).show(ui, |ui| {
+        // Title and Combine.
+        ui.horizontal(|ui| {
+            ui.label(egui::RichText::new(tl!("Combine files")).font(theme::semibold(20.0)));
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                let response = ui.add_enabled_ui(blocker.is_none(), |ui| widgets::icon_pill(ui, "files", tl!("Combine"), true)).inner;
+                if let Some(why) = &blocker {
+                    response.clone().on_disabled_hover_text(why);
                 }
-                ui.end_row();
+                if response.clicked() {
+                    combine = true;
+                }
+            });
+        });
+        ui.label(egui::RichText::new(tl!("Files are combined from top to bottom. Leave Pages empty to take every page.")).color(t.text_faint));
+        ui.add_space(12.0);
+
+        // Toolbar.
+        ui.horizontal(|ui| {
+            ui.spacing_mut().item_spacing.x = 6.0;
+            add_menu(app, ui);
+            let open_docs: Vec<(usize, String)> =
+                app.views.iter().enumerate().filter_map(|(i, v)| app.session.get(v.id).map(|d| (i, d.display_name()))).collect();
+            let response = ui.add_enabled_ui(!open_docs.is_empty(), |ui| widgets::icon_pill(ui, "file-plus", tl!("Add open documents"), false)).inner;
+            response.clone().on_disabled_hover_text(tl!("No documents are open"));
+            egui::Popup::menu(&response).show(|ui| {
+                if open_docs.len() > 1 && ui.button(tl!("All open documents")).clicked() {
+                    app.add_open_documents(&open_docs.iter().map(|(i, _)| *i).collect::<Vec<_>>());
+                    ui.close();
+                }
+                for (i, name) in &open_docs {
+                    if ui.button(crate::bidi::visual(name).as_ref()).clicked() {
+                        app.add_open_documents(&[*i]);
+                        ui.close();
+                    }
+                }
+            });
+            separator(ui, &t);
+            // Moves need a selected row with room to move; the buttons stay put either way.
+            let can_up = selected.iter().skip_while(|s| **s).any(|s| *s);
+            let can_down = selected.iter().rev().skip_while(|s| **s).any(|s| *s);
+            let why = tl!("Select a file first");
+            let remove = match count {
+                1 => {
+                    let name = app.combine_draft.iter().find(|f| app.combine_tab.selected.contains(&f.id)).map_or("", |f| f.name.as_str());
+                    crate::i18n::fmt(tl!("Remove {name}"), &[("name", name)])
+                }
+                0 => tl!("Remove").to_string(),
+                k => crate::i18n::fmt(tl!("Remove {n} files"), &[("n", &k.to_string())]),
+            };
+            if tool(ui, can_up, "chevron-up", tl!("Move up"), why).clicked() {
+                events.action = Some(RowAction::MoveUp);
+            }
+            if tool(ui, can_down, "chevron-down", tl!("Move down"), why).clicked() {
+                events.action = Some(RowAction::MoveDown);
+            }
+            if tool(ui, count > 0, "trash-2", &remove, why).clicked() {
+                events.action = Some(RowAction::Remove);
+            }
+            let locked = app.combine_draft.iter().any(|f| f.lock.is_some() && app.combine_tab.selected.contains(&f.id));
+            let unlock = tool(ui, locked, "lock-open", tl!("Unlock…"), tl!("Select a password-protected file first"));
+            if unlock.clicked() {
+                events.action = Some(RowAction::Unlock(None, unlock.rect.left_bottom() + vec2(0.0, 6.0)));
+            }
+            separator(ui, &t);
+            let (undo, redo) = (!app.combine_tab.undo.is_empty(), !app.combine_tab.redo.is_empty());
+            if tool(ui, undo, "undo-2", tl!("Undo"), tl!("Nothing to undo")).clicked() {
+                app.execute("edit.undo");
+            }
+            if tool(ui, redo, "redo-2", tl!("Redo"), tl!("Nothing to redo")).clicked() {
+                app.execute("edit.redo");
+            }
+            if count > 1 {
+                ui.add_space(6.0);
+                ui.label(egui::RichText::new(crate::i18n::fmt(tl!("{n} selected"), &[("n", &count.to_string())])).color(t.text_muted));
+            }
+        });
+        ui.add_space(10.0);
+
+        // The list, in a card that highlights while files are dragged over the window.
+        let footer_h = 34.0;
+        let card_h = (ui.available_height() - footer_h).max(120.0);
+        let stroke = if files_hovering { Stroke::new(2.0, t.accent) } else { Stroke::new(1.0, t.border) };
+        egui::Frame::NONE.fill(t.card).stroke(stroke).corner_radius(CornerRadius::same(t.radius)).inner_margin(egui::Margin::symmetric(8, 6)).show(
+            ui,
+            |ui| {
+                ui.set_min_height(card_h - 12.0);
+                ui.set_width(ui.available_width());
+                if n == 0 {
+                    empty_state(app, ui, &t, files_hovering);
+                } else {
+                    let table_events = table(app, ui, &t, &checks, &selected);
+                    events.range_focused |= table_events.range_focused;
+                    events.range_changed |= table_events.range_changed;
+                    if table_events.action.is_some() {
+                        events.action = table_events.action;
+                    }
+                }
+            },
+        );
+
+        // Totals.
+        ui.add_space(8.0);
+        if n > 0 {
+            ui.horizontal(|ui| {
+                let pages: usize = checks.iter().filter_map(|c| c.as_ref().ok()).sum();
+                let size: usize = app.combine_draft.iter().map(|f| f.bytes.len()).sum();
+                let files = if n == 1 { tl!("1 file").to_string() } else { crate::i18n::fmt(tl!("{n} files"), &[("n", &n.to_string())]) };
+                let pages = if pages == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &pages.to_string())]) };
+                ui.label(egui::RichText::new(format!("{files} · {pages} · {}", crate::panels::human_size(size))).color(t.text_muted));
+                let bad = app.combine_draft.iter().zip(&checks).filter(|(f, c)| f.problem.is_some() || c.is_err()).count();
+                if bad > 0 {
+                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                        let text = if bad == 1 {
+                            tl!("1 file needs attention").to_string()
+                        } else {
+                            crate::i18n::fmt(tl!("{n} files need attention"), &[("n", &bad.to_string())])
+                        };
+                        ui.label(egui::RichText::new(text).color(ERROR));
+                    });
+                }
+            });
+        }
+    });
+
+    // A Pages field taking the keyboard remembers the list; its first change makes the undo step.
+    if events.range_focused {
+        app.combine_tab.range_edit = Some(app.combine_snapshot());
+    }
+    if events.range_changed
+        && let Some(before) = app.combine_tab.range_edit.take()
+    {
+        app.combine_push_undo(before);
+    }
+    unlock_prompt(app, ui.ctx());
+    if let Some(action) = events.action {
+        app.combine_apply(action);
+    }
+    if combine && blocker.is_none() {
+        app.combine_staged();
+    }
+}
+
+/// Unlock…'s password box, floating below what opened it. Enter unlocks, Escape or a click
+/// elsewhere closes it.
+fn unlock_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(mut prompt) = app.combine_tab.unlock.take() else { return };
+    let t = Tokens::get(ctx);
+    let files: Vec<&CombineFile> = app.combine_draft.iter().filter(|f| prompt.rows.contains(&f.id)).collect();
+    let title = match files.as_slice() {
+        [one] => crate::i18n::fmt(tl!("Unlock {name}"), &[("name", &one.name)]),
+        many => crate::i18n::fmt(tl!("Unlock {n} files"), &[("n", &many.len().to_string())]),
+    };
+    let explain = if files.iter().all(|f| f.lock == Some(Lock::Permissions)) {
+        tl!("Enter the permissions password to allow combining")
+    } else {
+        tl!("Enter the password that opens it")
+    };
+    let batch = files.len() > 1;
+    let (mut submit, mut cancel) = (false, false);
+    let area = egui::Area::new(egui::Id::new("combine-unlock")).order(egui::Order::Foreground).fixed_pos(prompt.at).show(ctx, |ui| {
+        egui::Frame::popup(ui.style()).inner_margin(egui::Margin::same(14)).show(ui, |ui| {
+            ui.set_width(340.0);
+            ui.horizontal(|ui| {
+                ui.add(icons::image("lock", 16.0, t.icon));
+                ui.add(egui::Label::new(egui::RichText::new(&title).font(theme::semibold(14.0))).truncate());
+            });
+            ui.add_space(4.0);
+            ui.label(egui::RichText::new(explain).color(t.text_muted));
+            if batch {
+                ui.label(egui::RichText::new(tl!("The same password is tried on each file.")).small().color(t.text_faint));
+            }
+            ui.add_space(8.0);
+            ui.horizontal(|ui| {
+                let field =
+                    ui.add(egui::TextEdit::singleline(&mut prompt.input.0).password(!prompt.show).hint_text(tl!("Password")).desired_width(290.0));
+                if !prompt.focused {
+                    field.request_focus();
+                    prompt.focused = true;
+                }
+                if field.changed() {
+                    prompt.error = None;
+                }
+                if field.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                    submit = true;
+                }
+                let (icon, tip) = if prompt.show { ("eye-off", tl!("Hide password")) } else { ("eye", tl!("Show password")) };
+                if icons::button(ui, icon, 26.0, false, tip).clicked() {
+                    prompt.show = !prompt.show;
+                }
+            });
+            if let Some(e) = &prompt.error {
+                ui.label(egui::RichText::new(e).color(ERROR));
+            }
+            ui.add_space(6.0);
+            ui.label(egui::RichText::new(tl!("The password is only used to read the file; it isn't saved.")).small().color(t.text_faint));
+            ui.add_space(8.0);
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                if ui.add_enabled_ui(!prompt.input.0.is_empty(), |ui| widgets::pill_button(ui, tl!("Unlock"), true)).inner.clicked() {
+                    submit = true;
+                }
+                if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                    cancel = true;
+                }
+            });
+        });
+    });
+    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) || area.response.clicked_elsewhere() {
+        cancel = true;
+    }
+    if submit && !prompt.input.0.is_empty() {
+        let rows = prompt.rows.clone();
+        if app.combine_unlock(&rows, &prompt.input.0) {
+            return;
+        }
+        prompt.error = Some(tl!("Wrong password").to_string());
+        prompt.focused = false;
+    }
+    if !cancel {
+        app.combine_tab.unlock = Some(prompt);
+    }
+}
+
+fn separator(ui: &mut egui::Ui, t: &Tokens) {
+    ui.add_space(4.0);
+    ui.painter().vline(ui.cursor().left(), ui.max_rect().y_range().shrink(4.0), Stroke::new(1.0, t.divider));
+    ui.add_space(6.0);
+}
+
+/// A toolbar icon button, disabled with a reason.
+fn tool(ui: &mut egui::Ui, enabled: bool, icon: &str, label: &str, disabled_why: &str) -> egui::Response {
+    ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 30.0, false, label)).inner.on_disabled_hover_text(disabled_why)
+}
+
+/// Why Combine can't run yet, if so.
+fn blocker(files: &[CombineFile], checks: &[Result<usize, String>]) -> Option<String> {
+    if files.len() < 2 {
+        return Some(tl!("Add at least two files").to_string());
+    }
+    for (f, check) in files.iter().zip(checks) {
+        if let Some(p) = &f.problem {
+            return Some(crate::i18n::fmt(tl!("{name} can't be combined: {why}"), &[("name", &f.name), ("why", p)]));
+        }
+        if let Err(e) = check {
+            return Some(crate::i18n::fmt(tl!("Check the pages of {name}: {why}"), &[("name", &f.name), ("why", e)]));
+        }
+    }
+    None
+}
+
+/// While no text field has the keyboard: Up/Down select (Shift extends), Alt+Up/Down move the
+/// selection, Delete removes it, Ctrl/⌘+A selects every file.
+fn keyboard(ui: &egui::Ui, n: usize, any_selected: bool) -> Option<RowAction> {
+    if n == 0 || ui.ctx().memory(|m| m.focused().is_some()) {
+        return None;
+    }
+    use egui::Key;
+    ui.ctx().input_mut(|i| {
+        if i.consume_key(Modifiers::COMMAND, Key::A) {
+            return Some(RowAction::SelectAll);
+        }
+        if any_selected {
+            if i.consume_key(Modifiers::ALT, Key::ArrowUp) {
+                return Some(RowAction::MoveUp);
+            }
+            if i.consume_key(Modifiers::ALT, Key::ArrowDown) {
+                return Some(RowAction::MoveDown);
+            }
+            if i.consume_key(Modifiers::NONE, Key::Delete) || i.consume_key(Modifiers::NONE, Key::Backspace) {
+                return Some(RowAction::Remove);
+            }
+        }
+        for (down, key) in [(false, Key::ArrowUp), (true, Key::ArrowDown)] {
+            if i.consume_key(Modifiers::NONE, key) {
+                return Some(RowAction::Step { down, extend: false });
+            }
+            if i.consume_key(Modifiers::SHIFT, key) {
+                return Some(RowAction::Step { down, extend: true });
+            }
+        }
+        None
+    })
+}
+
+fn empty_state(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, files_hovering: bool) {
+    ui.vertical_centered(|ui| {
+        ui.add_space((ui.available_height() / 2.0 - 70.0).max(16.0));
+        ui.add(icons::image("files", 40.0, if files_hovering { t.accent } else { t.text_faint }));
+        ui.add_space(10.0);
+        ui.label(egui::RichText::new(tl!("Add the PDFs to combine")).font(theme::medium(15.0)));
+        ui.add_space(4.0);
+        ui.label(egui::RichText::new(tl!("Drop PDFs or folders here, or choose them.")).color(t.text_faint));
+        ui.add_space(12.0);
+        let folders = cfg!(not(target_arch = "wasm32"));
+        // Centre the buttons: measure them first.
+        let font = theme::medium(12.5);
+        let width = |s: &str| ui.fonts_mut(|f| f.layout_no_wrap(s.to_owned(), font.clone(), t.text).size().x);
+        let total = width(tl!("Add files…")) + 26.0 + if folders { width(tl!("Add folder…")) + 46.0 + 8.0 } else { 0.0 };
+        ui.horizontal(|ui| {
+            ui.add_space(((ui.available_width() - total) / 2.0).max(0.0));
+            ui.spacing_mut().item_spacing.x = 8.0;
+            if widgets::pill_button(ui, tl!("Add files…"), true).clicked() {
+                app.combine_dialog();
+            }
+            if folders && widgets::icon_pill(ui, "folder", tl!("Add folder…"), false).clicked() {
+                app.combine_add_folder(false);
             }
         });
     });
-    match action {
-        Some(RowAction::Up(i)) => app.combine_draft.swap(i, i - 1),
-        Some(RowAction::Down(i)) => app.combine_draft.swap(i, i + 1),
-        Some(RowAction::Remove(i)) => {
-            app.combine_draft.remove(i);
+}
+
+/// "Add files…" with a menu of the other ways to add: folders (desktop).
+fn add_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    if !cfg!(not(target_arch = "wasm32")) {
+        if widgets::icon_pill(ui, "plus", tl!("Add files…"), false).clicked() {
+            app.combine_dialog();
+        }
+        return;
+    }
+    let (main, more) = widgets::split_pill(ui, "plus", tl!("Add files…"), tl!("More ways to add files"));
+    if main.clicked() {
+        app.combine_dialog();
+    }
+    egui::Popup::menu(&more).show(|ui| {
+        ui.set_min_width(220.0);
+        let item = |ui: &mut egui::Ui, icon: &str, label: &str| {
+            ui.add(egui::Button::image_and_text(icons::image(icon, 15.0, ui.visuals().text_color()), label))
+        };
+        if item(ui, "file-plus", tl!("Add files…")).clicked() {
+            app.combine_dialog();
+            ui.close();
+        }
+        if item(ui, "folder", tl!("Add folder…")).on_hover_text(tl!("Every PDF in the folder")).clicked() {
+            app.combine_add_folder(false);
+            ui.close();
+        }
+        if item(ui, "folder-open", tl!("Add folder and subfolders…"))
+            .on_hover_text(tl!("Every PDF in the folder and the folders inside it"))
+            .clicked()
+        {
+            app.combine_add_folder(true);
+            ui.close();
+        }
+    });
+}
+
+/// The file table.
+fn table(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, checks: &[Result<usize, String>], selected: &[bool]) -> TableEvents {
+    let mut events = TableEvents::default();
+    // The same file twice is allowed (e.g. a cover sheet), but probably a mistake.
+    let twice: Vec<bool> = app
+        .combine_draft
+        .iter()
+        .map(|f| app.combine_draft.iter().filter(|g| g.name == f.name && g.bytes.len() == f.bytes.len()).count() > 1)
+        .collect();
+    let dragging = egui::DragAndDrop::has_payload_of_type::<usize>(ui.ctx());
+    // Until the user resizes a column, the widths follow the window.
+    let gap = ui.spacing().item_spacing.x;
+    let available = ui.available_width() - 18.0 - gap * 6.0;
+    if app.combine_columns.widths.is_none() && (available - app.combine_tab.fitted).abs() > 1.0 {
+        app.combine_tab.fitted = available;
+        app.combine_tab.layout = app.combine_tab.layout.wrapping_add(1);
+    }
+    let widths = app.combine_columns.resolved(available);
+    let rows = Rows { checks, selected, twice: &twice, dragging, sort: app.combine_tab.sort };
+    let mut heading_event = None;
+    let mut shown = None;
+    egui::ScrollArea::horizontal()
+        .id_salt("combine-files-h")
+        .show(ui, |ui| table_body(app, ui, t, &rows, widths, &mut events, &mut heading_event, &mut shown));
+    // A column resized by hand keeps its width from now on.
+    if let Some(shown) = shown
+        && shown.iter().zip(&widths).any(|(a, b)| (a - b).abs() > 0.5)
+    {
+        app.combine_columns.widths = Some(shown);
+    }
+    match heading_event {
+        Some(HeadingEvent::Sort(key)) => events.action = Some(RowAction::Sort(key)),
+        Some(HeadingEvent::Move { kind, to, after }) => {
+            let mut order: Vec<SortKey> = app.combine_columns.order.iter().copied().filter(|k| *k != kind).collect();
+            let at = order.iter().position(|k| *k == to).map_or(order.len(), |p| if after { p + 1 } else { p });
+            order.insert(at, kind);
+            if let Ok(order) = <[SortKey; 5]>::try_from(order) {
+                app.combine_columns.order = order;
+                app.combine_tab.layout = app.combine_tab.layout.wrapping_add(1);
+            }
+        }
+        Some(HeadingEvent::Reset) => {
+            app.combine_columns = Columns::default();
+            app.combine_tab.fitted = 0.0;
         }
         None => {}
     }
-    ui.add_space(10.0);
-    let (mut go, mut cancel) = (false, false);
-    ui.horizontal(|ui| {
-        if widgets::pill_button(ui, tl!("Add files…"), false).clicked() {
-            app.combine_dialog();
+    events
+}
+
+/// What every row needs to know.
+struct Rows<'a> {
+    checks: &'a [Result<usize, String>],
+    selected: &'a [bool],
+    twice: &'a [bool],
+    dragging: bool,
+    sort: Option<(SortKey, bool)>,
+}
+
+/// A column heading: the whole cell sorts by its column when clicked, moves the column when
+/// dragged, and offers Reset columns on a right-click.
+fn heading(ui: &mut egui::Ui, t: &Tokens, key: SortKey, sort: Option<(SortKey, bool)>) -> Option<HeadingEvent> {
+    let text = key.label();
+    let rect = ui.max_rect();
+    let response = ui.allocate_rect(rect, Sense::click_and_drag());
+    let arrow = sort.filter(|(k, _)| *k == key).map(|(_, ascending)| ascending);
+    let state = match arrow {
+        Some(true) => tl!("sorted ascending"),
+        Some(false) => tl!("sorted descending"),
+        None => "",
+    };
+    let a11y = if state.is_empty() { text.to_owned() } else { format!("{text}, {state}") };
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &a11y));
+    let being_dragged = egui::DragAndDrop::payload::<HeadingDrag>(ui.ctx()).is_some_and(|p| p.0 == key);
+    if being_dragged || response.is_pointer_button_down_on() {
+        ui.painter().rect_filled(rect, CornerRadius::same(4), t.pressed);
+    } else if response.hovered() {
+        ui.painter().rect_filled(rect, CornerRadius::same(4), t.hover);
+    }
+    let colour = if arrow.is_some() { t.text } else { t.text_muted };
+    let galley = ui.painter().layout_no_wrap(text.to_owned(), theme::medium(12.5), colour);
+    let text_pos = egui::pos2(rect.left() + 4.0, rect.center().y - galley.size().y / 2.0);
+    let text_w = galley.size().x;
+    ui.painter().with_clip_rect(rect).galley(text_pos, galley, colour);
+    if let Some(ascending) = arrow {
+        let r = Rect::from_center_size(egui::pos2(rect.left() + text_w + 14.0, rect.center().y), vec2(12.0, 12.0));
+        icons::paint(ui, r, if ascending { "chevron-up" } else { "chevron-down" }, 12.0, t.text);
+    }
+    if response.drag_started() {
+        egui::DragAndDrop::set_payload(ui.ctx(), HeadingDrag(key));
+    }
+    // Another heading dragged over this one: a line where it would go.
+    let after = |r: &egui::Response| r.ctx.pointer_latest_pos().is_some_and(|p| p.x > rect.center().x);
+    if let Some(dragged) = response.dnd_hover_payload::<HeadingDrag>()
+        && dragged.0 != key
+    {
+        let x = if after(&response) { rect.right() } else { rect.left() };
+        ui.painter().with_clip_rect(rect.expand(3.0)).vline(x, rect.y_range(), Stroke::new(2.5, t.accent));
+    }
+    let mut event = None;
+    if let Some(dragged) = response.dnd_release_payload::<HeadingDrag>()
+        && dragged.0 != key
+    {
+        event = Some(HeadingEvent::Move { kind: dragged.0, to: key, after: after(&response) });
+    }
+    let response = response
+        .on_hover_cursor(if being_dragged { egui::CursorIcon::Grabbing } else { egui::CursorIcon::PointingHand })
+        .on_hover_text(tl!("Click to sort, drag to move the column. Drag its edge to resize it."));
+    response.context_menu(|ui| {
+        if ui.button(tl!("Reset columns")).clicked() {
+            event = Some(HeadingEvent::Reset);
+            ui.close();
         }
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            let ok = app.combine_draft.len() >= 2;
-            if ui
-                .add_enabled_ui(ok, |ui| widgets::pill_button(ui, tl!("Combine"), true))
-                .inner
-                .on_disabled_hover_text(tl!("Add at least two files"))
-                .clicked()
-            {
-                go = true;
+    });
+    if response.clicked() {
+        event = Some(HeadingEvent::Sort(key));
+    }
+    event
+}
+
+#[allow(clippy::too_many_arguments)]
+fn table_body(
+    app: &mut PdfCraftApp,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    rows: &Rows,
+    widths: [f32; 5],
+    events: &mut TableEvents,
+    heading_event: &mut Option<HeadingEvent>,
+    shown: &mut Option<[f32; 5]>,
+) {
+    let n = app.combine_draft.len();
+    let order = app.combine_columns.order;
+    // The heading being dragged follows the pointer.
+    if let (Some(dragged), Some(pos)) = (egui::DragAndDrop::payload::<HeadingDrag>(ui.ctx()), ui.ctx().pointer_latest_pos()) {
+        let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("combine-heading-drag")));
+        let galley = painter.layout_no_wrap(dragged.0.label().to_owned(), theme::medium(12.5), t.text);
+        let r = Rect::from_min_size(pos + vec2(10.0, 8.0), galley.size() + vec2(16.0, 8.0));
+        painter.rect(r, CornerRadius::same(4), t.card, Stroke::new(1.0, t.accent), egui::StrokeKind::Inside);
+        painter.galley(r.min + vec2(8.0, 4.0), galley, t.text);
+    }
+    let mut builder = TableBuilder::new(ui)
+        // Columns moved, reset or refitted: a new table state, built from `widths`.
+        .id_salt(("combine-files", app.combine_tab.layout))
+        .striped(true)
+        .sense(Sense::click())
+        .auto_shrink([false, true])
+        .cell_layout(Layout::left_to_right(Align::Center))
+        .column(Column::exact(18.0));
+    for kind in order {
+        builder = builder.column(Column::initial(widths[kind.index()]).at_least(kind.min_width()).resizable(true).clip(true));
+    }
+    builder
+        .header(26.0, |mut row| {
+            row.col(|_| {});
+            for kind in order {
+                row.col(|ui| {
+                    if let Some(e) = heading(ui, t, kind, rows.sort) {
+                        *heading_event = Some(e);
+                    }
+                });
             }
-            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                cancel = true;
+        })
+        .body(|mut body| {
+            if !body.ui_mut().is_sizing_pass() {
+                let w = body.widths();
+                let mut out = widths;
+                for (kind, width) in order.iter().zip(w.iter().skip(1)) {
+                    out[kind.index()] = *width;
+                }
+                *shown = Some(out);
+            }
+            for i in 0..n {
+                let Some(f) = app.combine_draft.get_mut(i) else { break };
+                let check = rows.checks.get(i).cloned().unwrap_or(Ok(f.pages));
+                body.row(32.0, |mut row| {
+                    row.set_selected(rows.selected.get(i).copied().unwrap_or(false));
+                    // Drag handle.
+                    row.col(|ui| {
+                        let id = ui.id().with(("combine-drag", f.id));
+                        ui.dnd_drag_source(id, i, |ui| {
+                            let (rect, resp) = ui.allocate_exact_size(vec2(12.0, 18.0), Sense::hover());
+                            grip(ui, rect, if resp.hovered() || rows.dragging { t.text_muted } else { t.text_faint });
+                        })
+                        .response
+                        .on_hover_cursor(egui::CursorIcon::Grab)
+                        .on_hover_text(tl!("Drag to reorder"));
+                    });
+                    for kind in order {
+                        row.col(|ui| match kind {
+                            SortKey::Name => {
+                                ui.add(icons::image("file-text", 16.0, t.icon));
+                                ui.add(egui::Label::new(crate::bidi::visual(&f.name).as_ref()).truncate().selectable(false));
+                            }
+                            // The range field and how many pages it takes.
+                            SortKey::Pages => {
+                                let edit = ui.add_enabled(
+                                    f.problem.is_none(),
+                                    egui::TextEdit::singleline(&mut f.range).hint_text(tl!("All pages")).desired_width(88.0),
+                                );
+                                // A visible field on plain and striped rows alike; red when the range is wrong.
+                                let border = if check.is_err() { Stroke::new(1.5, ERROR) } else { Stroke::new(1.0, t.border) };
+                                ui.painter().rect_stroke(edit.rect, CornerRadius::same(4), border, egui::StrokeKind::Inside);
+                                if let Err(e) = &check {
+                                    edit.clone().on_hover_text(e);
+                                } else {
+                                    edit.clone()
+                                        .on_hover_text(crate::i18n::fmt(tl!("Pages of {name} to combine, e.g. 1-3, 6"), &[("name", &f.name)]));
+                                }
+                                if edit.gained_focus() {
+                                    events.range_focused = true;
+                                    events.action = Some(RowAction::Click(i, Modifiers::NONE));
+                                }
+                                if edit.changed() {
+                                    events.range_changed = true;
+                                }
+                                let count = match (&check, f.problem.is_some()) {
+                                    (_, true) => "—".to_string(),
+                                    (Ok(k), _) => crate::i18n::fmt(tl!("{k} of {n}"), &[("k", &k.to_string()), ("n", &f.pages.to_string())]),
+                                    (Err(_), _) => crate::i18n::fmt(tl!("? of {n}"), &[("n", &f.pages.to_string())]),
+                                };
+                                ui.label(egui::RichText::new(count).small().color(if check.is_err() { ERROR } else { t.text_faint }));
+                            }
+                            SortKey::Size => {
+                                ui.label(egui::RichText::new(crate::panels::human_size(f.bytes.len())).color(t.text_muted));
+                            }
+                            SortKey::Modified => match f.modified {
+                                Some(m) => {
+                                    ui.label(egui::RichText::new(ago(m)).color(t.text_muted)).on_hover_text(utc_stamp(m));
+                                }
+                                None => {
+                                    ui.label(egui::RichText::new("—").color(t.text_faint));
+                                }
+                            },
+                            // Blocking problems first, in red.
+                            SortKey::Warnings => {
+                                let mut errors: Vec<String> = f.problem.iter().cloned().collect();
+                                if let Err(e) = &check {
+                                    errors.push(e.clone());
+                                }
+                                let mut warnings = f.notes.clone();
+                                if rows.twice.get(i).copied().unwrap_or(false) {
+                                    warnings.push(tl!("Added more than once").to_string());
+                                }
+                                let (icon, colour, first) = match (errors.first(), warnings.first()) {
+                                    (Some(e), _) => ("circle-x", ERROR, e.clone()),
+                                    (None, Some(w)) => ("triangle-alert", WARNING, w.clone()),
+                                    (None, None) => return,
+                                };
+                                let all = errors.iter().chain(&warnings).cloned().collect::<Vec<_>>().join("\n");
+                                ui.add(icons::image(icon, 15.0, colour));
+                                if f.lock.is_some() {
+                                    let link =
+                                        ui.add(egui::Link::new(egui::RichText::new(tl!("Unlock…")).color(t.accent))).on_hover_text(match f.lock {
+                                            Some(Lock::Permissions) => tl!("Enter the permissions password to allow combining"),
+                                            _ => tl!("Enter the password that opens it"),
+                                        });
+                                    if link.clicked() {
+                                        events.action = Some(RowAction::Unlock(Some(i), link.rect.left_bottom() + vec2(0.0, 6.0)));
+                                    }
+                                }
+                                ui.add(
+                                    egui::Label::new(egui::RichText::new(first).color(if colour == ERROR { ERROR } else { t.text }))
+                                        .truncate()
+                                        .selectable(false),
+                                )
+                                .on_hover_text(all);
+                            }
+                        });
+                    }
+                    let response = row.response();
+                    if f.lock.is_some() {
+                        let at = response.rect.left_bottom();
+                        response.context_menu(|ui| {
+                            if ui
+                                .add(egui::Button::image_and_text(icons::image("lock-open", 15.0, ui.visuals().text_color()), tl!("Unlock…")))
+                                .clicked()
+                            {
+                                events.action = Some(RowAction::Unlock(Some(i), at));
+                                ui.close();
+                            }
+                        });
+                    }
+                    if response.clicked() {
+                        let modifiers = response.ctx.input(|i| i.modifiers);
+                        events.action = Some(RowAction::Click(i, modifiers));
+                    }
+                    // A row dragged over this one goes where the line is drawn.
+                    if let Some(from) = response.dnd_hover_payload::<usize>().map(|p| *p) {
+                        let r = response.rect;
+                        let y = if from > i { r.top() } else { r.bottom() };
+                        if from != i {
+                            response.ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("combine-drop-line"))).hline(
+                                r.x_range(),
+                                y,
+                                Stroke::new(2.0, t.accent),
+                            );
+                        }
+                    }
+                    if let Some(from) = response.dnd_release_payload::<usize>().map(|p| *p) {
+                        events.action = Some(RowAction::Drop { from, to: i });
+                    }
+                });
             }
         });
-    });
-    (go, cancel)
+}
+
+/// The PDFs in `dir` (and, if `recursive`, the folders inside it, not following links), in
+/// natural order, at most [`MAX_FOLDER_FILES`]; and whether there were more.
+#[cfg(not(target_arch = "wasm32"))]
+fn pdfs_in(dir: &std::path::Path, recursive: bool) -> (Vec<std::path::PathBuf>, bool) {
+    let mut found = Vec::new();
+    let mut more = false;
+    let mut folders = vec![(dir.to_path_buf(), 0usize)];
+    'walk: while let Some((folder, depth)) = folders.pop() {
+        let Ok(entries) = std::fs::read_dir(&folder) else { continue };
+        for entry in entries.flatten() {
+            let Ok(kind) = entry.file_type() else { continue };
+            let path = entry.path();
+            if kind.is_dir() {
+                let hidden = entry.file_name().to_string_lossy().starts_with('.');
+                if recursive && !hidden && depth < MAX_FOLDER_DEPTH {
+                    folders.push((path, depth + 1));
+                }
+            } else if path.extension().is_some_and(|e| e.eq_ignore_ascii_case("pdf")) && path.is_file() {
+                if found.len() >= MAX_FOLDER_FILES {
+                    more = true;
+                    break 'walk;
+                }
+                found.push(path);
+            }
+        }
+    }
+    found.sort_by(|a, b| natural(&a.to_string_lossy(), &b.to_string_lossy()));
+    (found, more)
+}
+
+/// File names in the order people expect: case-insensitive, with numbers by value
+/// ("scan2" before "scan10").
+fn natural(a: &str, b: &str) -> Ordering {
+    let (mut a, mut b) = (a.chars().peekable(), b.chars().peekable());
+    loop {
+        match (a.peek().copied(), b.peek().copied()) {
+            (None, None) => return Ordering::Equal,
+            (None, Some(_)) => return Ordering::Less,
+            (Some(_), None) => return Ordering::Greater,
+            (Some(x), Some(y)) if x.is_ascii_digit() && y.is_ascii_digit() => {
+                let take = |it: &mut std::iter::Peekable<std::str::Chars>| {
+                    let mut digits = String::new();
+                    while let Some(c) = it.peek().copied().filter(char::is_ascii_digit) {
+                        digits.push(c);
+                        it.next();
+                    }
+                    digits.trim_start_matches('0').to_owned()
+                };
+                let (x, y) = (take(&mut a), take(&mut b));
+                // Without leading zeros, a longer run of digits is a larger number.
+                match x.len().cmp(&y.len()).then_with(|| x.cmp(&y)) {
+                    Ordering::Equal => {}
+                    other => return other,
+                }
+            }
+            (Some(x), Some(y)) => {
+                match x.to_lowercase().cmp(y.to_lowercase()) {
+                    Ordering::Equal => {}
+                    other => return other,
+                }
+                a.next();
+                b.next();
+            }
+        }
+    }
+}
+
+/// Six dots: the drag handle.
+fn grip(ui: &egui::Ui, rect: Rect, colour: Color32) {
+    for dx in [-2.5, 2.5] {
+        for dy in [-5.0, 0.0, 5.0] {
+            ui.painter().circle_filled(rect.center() + vec2(dx, dy), 1.4, colour);
+        }
+    }
+}
+
+/// How long ago `time` was ("5 min ago"); a date after a week. Relative times need no time zone.
+fn ago(time: SystemTime) -> String {
+    let secs = SystemTime::now().duration_since(time).map(|d| d.as_secs()).unwrap_or(0);
+    let (mins, hours, days) = (secs / 60, secs / 3600, secs / 86_400);
+    match () {
+        _ if mins == 0 => tl!("just now").to_string(),
+        _ if hours == 0 => crate::i18n::fmt(tl!("{n} min ago"), &[("n", &mins.to_string())]),
+        _ if days == 0 => crate::i18n::fmt(tl!("{n} h ago"), &[("n", &hours.to_string())]),
+        _ if days == 1 => tl!("yesterday").to_string(),
+        _ if days < 7 => crate::i18n::fmt(tl!("{n} days ago"), &[("n", &days.to_string())]),
+        _ => utc_stamp(time).get(..10).unwrap_or_default().to_string(),
+    }
+}
+
+/// `time` as "2026-10-08 14:05 UTC".
+fn utc_stamp(time: SystemTime) -> String {
+    let secs = time.duration_since(SystemTime::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
+    let days = i64::try_from(secs / 86_400).unwrap_or(0);
+    let rem = secs % 86_400;
+    // Civil date from days since 1970-01-01 (Howard Hinnant's algorithm).
+    let z = days + 719_468;
+    let era = z.div_euclid(146_097);
+    let doe = z - era * 146_097;
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = yoe + era * 400 + i64::from(m <= 2);
+    format!("{y:04}-{m:02}-{d:02} {:02}:{:02} UTC", rem / 3600, rem % 3600 / 60)
 }
 
 impl PdfCraftApp {
-    /// Add picked files to the Combine files list (and show it).
-    pub(crate) fn stage_combine(&mut self, files: Vec<(String, Vec<u8>)>) {
-        for (name, bytes) in files {
-            let bytes = Arc::new(bytes);
-            match pdfcraft_render::inspect(bytes.clone(), None) {
-                Ok(info) => self.combine_draft.push(CombineFile { name, bytes, pages: info.pages.len(), range: String::new() }),
-                Err(e) => self.notify_fmt("Couldn't add {name}: {e}", &[("name", &name), ("e", &e.to_string())]),
-            }
-        }
-        self.dialog = Some(Dialog::Combine);
+    /// Show the Combine files tab (File ▸ Combine files…), opening it if needed.
+    pub fn open_combine_tab(&mut self) {
+        self.combine_tab.open = true;
+        self.combine_tab.focused = true;
+        self.active = None;
     }
 
-    /// Combine the listed files into a new, unsaved document.
+    /// Whether the Combine files tab is the one showing.
+    pub fn combine_showing(&self) -> bool {
+        self.active.is_none() && self.combine_tab.open && self.combine_tab.focused
+    }
+
+    /// The selected rows, top to bottom (tests and automation).
+    pub fn combine_selection(&self) -> Vec<usize> {
+        self.combine_draft.iter().enumerate().filter(|(_, f)| self.combine_tab.selected.contains(&f.id)).map(|(i, _)| i).collect()
+    }
+
+    /// Select these rows (tests and automation).
+    pub fn select_combine_rows(&mut self, rows: &[usize]) {
+        self.combine_tab.selected = rows.iter().filter_map(|i| self.combine_draft.get(*i)).map(|f| f.id).collect();
+        let last = rows.last().and_then(|i| self.combine_draft.get(*i)).map(|f| f.id);
+        (self.combine_tab.anchor, self.combine_tab.cursor) = (last, last);
+    }
+
+    fn combine_snapshot(&self) -> Snapshot {
+        Snapshot { files: self.combine_draft.clone(), selected: self.combine_tab.selected.clone(), sort: self.combine_tab.sort }
+    }
+
+    fn combine_restore(&mut self, s: Snapshot) {
+        self.combine_draft = s.files;
+        self.combine_tab.selected = s.selected;
+        self.combine_tab.sort = s.sort;
+        self.combine_tab.range_edit = None;
+        // A Pages field with the keyboard would otherwise keep typing into the restored list
+        // without an undo step.
+        if let Some(ctx) = &self.ctx {
+            ctx.memory_mut(|m| m.stop_text_input());
+        }
+    }
+
+    fn combine_push_undo(&mut self, before: Snapshot) {
+        let undo = &mut self.combine_tab.undo;
+        undo.push(before);
+        if undo.len() > HISTORY {
+            undo.remove(0);
+        }
+        self.combine_tab.redo.clear();
+    }
+
+    /// Remember the list before a change, for Undo.
+    fn combine_record(&mut self) {
+        let now = self.combine_snapshot();
+        self.combine_push_undo(now);
+        self.combine_tab.range_edit = None;
+    }
+
+    pub(crate) fn combine_can_undo(&self, undo: bool) -> bool {
+        if undo { !self.combine_tab.undo.is_empty() } else { !self.combine_tab.redo.is_empty() }
+    }
+
+    /// Edit ▸ Undo / Redo (⌘Z, ⇧⌘Z) while the Combine files tab shows.
+    pub(crate) fn combine_history_step(&mut self, undo: bool) {
+        // ⌘Z in the password box is not about the list.
+        if self.combine_tab.unlock.is_some() {
+            return;
+        }
+        let (from, to) =
+            if undo { (&mut self.combine_tab.undo, &mut self.combine_tab.redo) } else { (&mut self.combine_tab.redo, &mut self.combine_tab.undo) };
+        let Some(state) = from.pop() else { return };
+        let now = Snapshot { files: self.combine_draft.clone(), selected: self.combine_tab.selected.clone(), sort: self.combine_tab.sort };
+        to.push(now);
+        self.combine_restore(state);
+    }
+
+    fn combine_sort(&mut self, key: SortKey, ascending: bool) {
+        let list = &mut self.combine_draft;
+        let mut keyed: Vec<(u8, CombineFile)> = list.drain(..).map(|mut f| (f.severity(), f)).collect();
+        keyed.sort_by(|(sa, a), (sb, b)| {
+            let order = match key {
+                SortKey::Name => natural(&a.name, &b.name),
+                SortKey::Pages => a.pages.cmp(&b.pages),
+                SortKey::Size => a.bytes.len().cmp(&b.bytes.len()),
+                SortKey::Modified => match (a.modified, b.modified) {
+                    (Some(x), Some(y)) => x.cmp(&y),
+                    // Unknown times last, whichever the direction.
+                    (x, y) => return x.is_none().cmp(&y.is_none()).then_with(|| natural(&a.name, &b.name)),
+                },
+                SortKey::Warnings => sa.cmp(sb),
+            };
+            let order = if ascending { order } else { order.reverse() };
+            order.then_with(|| natural(&a.name, &b.name))
+        });
+        *list = keyed.into_iter().map(|(_, f)| f).collect();
+        self.combine_tab.sort = Some((key, ascending));
+    }
+
+    fn combine_apply(&mut self, action: RowAction) {
+        let ids: Vec<u64> = self.combine_draft.iter().map(|f| f.id).collect();
+        let n = ids.len();
+        let index_of = |id: Option<u64>| id.and_then(|id| ids.iter().position(|x| *x == id));
+        let tab = &mut self.combine_tab;
+        match action {
+            RowAction::Click(i, m) => {
+                let Some(&id) = ids.get(i) else { return };
+                if m.shift {
+                    let from = index_of(tab.anchor).unwrap_or(i);
+                    let range = ids.get(from.min(i)..=from.max(i)).unwrap_or_default();
+                    if !m.command {
+                        tab.selected.clear();
+                    }
+                    tab.selected.extend(range.iter().copied());
+                    tab.cursor = Some(id);
+                } else if m.command {
+                    if !tab.selected.remove(&id) {
+                        tab.selected.insert(id);
+                    }
+                    (tab.anchor, tab.cursor) = (Some(id), Some(id));
+                } else {
+                    tab.selected = BTreeSet::from([id]);
+                    (tab.anchor, tab.cursor) = (Some(id), Some(id));
+                }
+            }
+            RowAction::SelectAll => {
+                tab.selected = ids.iter().copied().collect();
+            }
+            RowAction::Step { down, extend } => {
+                let next = match index_of(tab.cursor) {
+                    Some(c) if down => (c + 1).min(n.saturating_sub(1)),
+                    Some(c) => c.saturating_sub(1),
+                    None if down => 0,
+                    None => n.saturating_sub(1),
+                };
+                let Some(&id) = ids.get(next) else { return };
+                if extend {
+                    let from = index_of(tab.anchor).unwrap_or(next);
+                    tab.selected = ids.get(from.min(next)..=from.max(next)).unwrap_or_default().iter().copied().collect();
+                } else {
+                    tab.selected = BTreeSet::from([id]);
+                    tab.anchor = Some(id);
+                }
+                tab.cursor = Some(id);
+            }
+            RowAction::MoveUp | RowAction::MoveDown => {
+                let up = matches!(action, RowAction::MoveUp);
+                let selected: Vec<bool> = ids.iter().map(|id| tab.selected.contains(id)).collect();
+                let movable =
+                    if up { selected.iter().skip_while(|s| **s).any(|s| *s) } else { selected.iter().rev().skip_while(|s| **s).any(|s| *s) };
+                if !movable {
+                    return;
+                }
+                self.combine_record();
+                let list = &mut self.combine_draft;
+                let sel = &self.combine_tab.selected;
+                // Each selected file steps past its unselected neighbour; blocks move together.
+                if up {
+                    for i in 1..list.len() {
+                        if sel.contains(&list[i].id) && !sel.contains(&list[i - 1].id) {
+                            list.swap(i, i - 1);
+                        }
+                    }
+                } else {
+                    for i in (0..list.len().saturating_sub(1)).rev() {
+                        if sel.contains(&list[i].id) && !sel.contains(&list[i + 1].id) {
+                            list.swap(i, i + 1);
+                        }
+                    }
+                }
+                self.combine_tab.sort = None;
+            }
+            RowAction::Remove => {
+                let Some(first) = ids.iter().position(|id| tab.selected.contains(id)) else { return };
+                self.combine_record();
+                let sel = std::mem::take(&mut self.combine_tab.selected);
+                self.combine_draft.retain(|f| !sel.contains(&f.id));
+                // The file that took the first removed one's place is selected next.
+                let next = self.combine_draft.get(first).or(self.combine_draft.last()).map(|f| f.id);
+                self.combine_tab.selected = next.into_iter().collect();
+                (self.combine_tab.anchor, self.combine_tab.cursor) = (next, next);
+            }
+            RowAction::Drop { from, to } => {
+                let (Some(&dragged), Some(&target)) = (ids.get(from), ids.get(to)) else { return };
+                // Dragging a selected file takes the whole selection along.
+                let moving: BTreeSet<u64> = if tab.selected.contains(&dragged) { tab.selected.clone() } else { BTreeSet::from([dragged]) };
+                if moving.contains(&target) {
+                    return;
+                }
+                self.combine_record();
+                let list = &mut self.combine_draft;
+                let (taken, mut rest): (Vec<_>, Vec<_>) = list.drain(..).partition(|f| moving.contains(&f.id));
+                let at = rest.iter().position(|f| f.id == target).map_or(rest.len(), |p| if from < to { p + 1 } else { p });
+                rest.splice(at..at, taken);
+                *list = rest;
+                self.combine_tab.selected = moving;
+                self.combine_tab.sort = None;
+            }
+            RowAction::Unlock(row, at) => {
+                let locked: BTreeSet<u64> = self.combine_draft.iter().filter(|f| f.lock.is_some()).map(|f| f.id).collect();
+                let rows: Vec<u64> = match row.and_then(|i| ids.get(i).copied()) {
+                    // A selected row brings the rest of the selection.
+                    Some(id) if tab.selected.contains(&id) => {
+                        ids.iter().copied().filter(|x| tab.selected.contains(x) && locked.contains(x)).collect()
+                    }
+                    Some(id) => {
+                        tab.selected = BTreeSet::from([id]);
+                        (tab.anchor, tab.cursor) = (Some(id), Some(id));
+                        vec![id]
+                    }
+                    None => ids.iter().copied().filter(|x| tab.selected.contains(x) && locked.contains(x)).collect(),
+                };
+                self.combine_ask_password(rows, at);
+            }
+            RowAction::Sort(key) => {
+                let ascending = !matches!(tab.sort, Some((k, true)) if k == key);
+                self.combine_record();
+                self.combine_sort(key, ascending);
+            }
+        }
+    }
+
+    /// Close the Combine files tab and forget its list; the last document shows, if any.
+    pub fn close_combine_tab(&mut self) {
+        let showing = self.combine_showing();
+        self.combine_tab = CombineTab::default();
+        self.combine_draft.clear();
+        if showing {
+            self.active = self.views.len().checked_sub(1);
+        }
+    }
+
+    /// Add picked files to the Combine files list (and show it).
+    pub(crate) fn stage_combine(&mut self, files: Vec<(String, Vec<u8>)>) {
+        let incoming = files.into_iter().map(|(name, bytes)| Incoming { name, bytes: Arc::new(bytes), modified: None, note: None }).collect();
+        self.stage_combine_with(incoming);
+    }
+
+    /// Add files to the Combine files list, with what can be known about them up front.
+    pub(crate) fn stage_combine_with(&mut self, files: Vec<Incoming>) {
+        let mut added = Vec::new();
+        for Incoming { name, bytes, modified, note } in files {
+            let assessed = match assess(&bytes, None) {
+                Ok(a) => a,
+                Err(AssessError::Unreadable(e)) => {
+                    self.notify_fmt("Couldn't add {name}: {e}", &[("name", &name), ("e", &e)]);
+                    continue;
+                }
+                Err(AssessError::WrongPassword) => {
+                    self.notify_fmt("Couldn't add {name}: {e}", &[("name", &name), ("e", "the password is wrong")]);
+                    continue;
+                }
+            };
+            let mut f = CombineFile {
+                id: 0,
+                name,
+                bytes,
+                pages: 0,
+                range: String::new(),
+                modified,
+                problem: None,
+                lock: None,
+                password: None,
+                notes: Vec::new(),
+                origin_note: note,
+                checked: None,
+            };
+            f.take(assessed, None);
+            added.push(f);
+        }
+        if !added.is_empty() {
+            self.combine_record();
+            for mut f in added {
+                f.id = self.combine_tab.next_id;
+                self.combine_tab.next_id = self.combine_tab.next_id.wrapping_add(1);
+                self.combine_draft.push(f);
+            }
+            // A sorted list stays sorted; new files simply join the end otherwise.
+            if let Some((key, ascending)) = self.combine_tab.sort {
+                self.combine_sort(key, ascending);
+            }
+        }
+        self.open_combine_tab();
+    }
+
+    /// Open Unlock…'s password box for `rows`, at `at`.
+    fn combine_ask_password(&mut self, rows: Vec<u64>, at: egui::Pos2) {
+        if rows.is_empty() {
+            return;
+        }
+        self.combine_tab.unlock = Some(UnlockPrompt { rows, input: Secret::default(), show: false, error: None, at, focused: false });
+    }
+
+    /// Try `password` on the protected files `rows` (as one undo step). Returns false when it
+    /// opened none of them.
+    pub fn combine_unlock(&mut self, rows: &[u64], password: &str) -> bool {
+        let mut accepted = Vec::new();
+        for id in rows {
+            let Some(f) = self.combine_draft.iter().find(|f| f.id == *id && f.lock.is_some()) else { continue };
+            if let Ok(a) = assess(&f.bytes, Some(password)) {
+                accepted.push((*id, a));
+            }
+        }
+        if accepted.is_empty() {
+            return false;
+        }
+        self.combine_record();
+        let tried = rows.len();
+        let mut unlocked = 0;
+        for (id, a) in accepted {
+            if let Some(f) = self.combine_draft.iter_mut().find(|f| f.id == id) {
+                f.take(a, Some(Secret(password.to_owned())));
+                unlocked += usize::from(f.lock.is_none());
+            }
+        }
+        if tried > 1 {
+            self.notify_fmt("Unlocked {n} of {m} files", &[("n", &unlocked.to_string()), ("m", &tried.to_string())]);
+        }
+        true
+    }
+
+    /// Unlock… for the files the user named in tests and automation (by row).
+    pub fn combine_unlock_rows(&mut self, rows: &[usize], password: &str) -> bool {
+        let ids: Vec<u64> = rows.iter().filter_map(|i| self.combine_draft.get(*i)).map(|f| f.id).collect();
+        self.combine_unlock(&ids, password)
+    }
+
+    /// Add every PDF in a folder the user picks (and its subfolders, if `recursive`).
+    pub fn combine_add_folder(&mut self, recursive: bool) {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let title = if recursive { tl!("Add folder and subfolders") } else { tl!("Add folder") };
+            let dialog = rfd::AsyncFileDialog::new().set_title(title);
+            self.ask_one(crate::pickers::Ask::Folder(dialog), None, move |app, dir| app.add_folder_to_combine(&dir, recursive));
+        }
+        #[cfg(target_arch = "wasm32")]
+        let _ = recursive;
+    }
+
+    /// Add the PDFs in `dir` to the Combine files list, as one undo step.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn add_folder_to_combine(&mut self, dir: &std::path::Path, recursive: bool) {
+        let (paths, more) = pdfs_in(dir, recursive);
+        let folder = dir.file_name().map_or_else(|| dir.to_string_lossy().into_owned(), |n| n.to_string_lossy().into_owned());
+        if paths.is_empty() {
+            self.notify_fmt("No PDFs found in {folder}", &[("folder", &folder)]);
+            self.open_combine_tab();
+            return;
+        }
+        self.use_paths(crate::files::FilePurpose::Combine, &paths);
+        if more {
+            self.notify_fmt("Added the first {n} PDFs in {folder}", &[("n", &MAX_FOLDER_FILES.to_string()), ("folder", &folder)]);
+        }
+    }
+
+    /// Add documents open in tabs (by tab index), as they are now.
+    pub(crate) fn add_open_documents(&mut self, tabs: &[usize]) {
+        let mut incoming = Vec::new();
+        for &i in tabs {
+            let Some(doc) = self.views.get(i).and_then(|v| self.session.get(v.id)) else { continue };
+            #[cfg(not(target_arch = "wasm32"))]
+            let modified = if doc.dirty { None } else { doc.path.as_ref().and_then(|p| std::fs::metadata(p).and_then(|m| m.modified()).ok()) };
+            #[cfg(target_arch = "wasm32")]
+            let modified = None;
+            let note = doc.dirty.then(|| tl!("Includes unsaved changes").to_string());
+            let name = if doc.name.to_ascii_lowercase().ends_with(".pdf") { doc.name.clone() } else { format!("{}.pdf", doc.name) };
+            incoming.push(Incoming { name, bytes: doc.bytes.clone(), modified, note });
+        }
+        self.stage_combine_with(incoming);
+    }
+
+    /// Combine the listed files into a new, unsaved document; the tab makes way for it.
     pub fn combine_staged(&mut self) {
-        let files = std::mem::take(&mut self.combine_draft);
+        let files = &self.combine_draft;
         if files.is_empty() {
             return;
         }
         let count = files.len();
         let sources: Vec<(String, Arc<Vec<u8>>, Option<String>)> = files
-            .into_iter()
-            .map(|f| (crate::files::strip_pdf(&f.name).to_string(), f.bytes, Some(f.range).filter(|r| !r.trim().is_empty())))
+            .iter()
+            .map(|f| (crate::files::strip_pdf(&f.name).to_string(), f.bytes.clone(), Some(f.range.clone()).filter(|r| !r.trim().is_empty())))
             .collect();
-        match self.session.combine_ranges(&sources) {
+        let passwords: Vec<Option<&str>> = files.iter().map(|f| f.password.as_ref().map(|p| p.0.as_str())).collect();
+        match self.session.combine_unlocked(&sources, &passwords) {
             Ok(bytes) => {
+                self.close_combine_tab();
                 let message = crate::i18n::fmt(tl!("Combined {n} files"), &[("n", &count.to_string())]);
                 self.open_created("Combined.pdf", bytes, &message)
             }
+            // The list stays, so the user can fix it.
             Err(e) => self.notify_fmt("Couldn't combine files: {e}", &[("e", &e.to_string())]),
         }
     }
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 34e96c91..79953088 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -17,6 +17,10 @@ impl PdfCraftApp {
     /// Whether a registered command can run now. The engine judges the document (security,
     /// contents, undo history); view state it can't see is checked here.
     pub(crate) fn command_enabled(&self, spec: &CommandSpec) -> bool {
+        // Undo and Redo act on the Combine files list while its tab shows.
+        if self.combine_showing() && matches!(spec.needs, commands::Needs::Undo | commands::Needs::Redo) {
+            return self.combine_can_undo(spec.needs == commands::Needs::Undo);
+        }
         commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
             && (spec.needs != commands::Needs::TwoPageView || self.active.and_then(|i| self.views.get(i)).is_some_and(crate::DocView::cover_applies))
     }
@@ -76,7 +80,7 @@ impl PdfCraftApp {
         let targets = active.map(|i| self.views[i].target_pages()).unwrap_or_default();
         match id {
             "file.open" => self.open_dialog(),
-            "page.combine" => self.combine_dialog(),
+            "page.combine" => self.open_combine_tab(),
             "file.save" => {
                 self.save_active(SaveTarget::InPlace);
             }
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index a35ccfa3..f1243f2d 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -54,7 +54,6 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let mut a11y_now = false;
     let mut ocr_now = false;
     let mut compare_now = false;
-    let mut combine_now = false;
     let mut images_now = false;
     let mut stamp_now = false;
     let mut alt_now = false;
@@ -843,16 +842,6 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 close = save || cancel;
                 return;
             }
-            Dialog::Combine => {
-                ui.set_width(620.0);
-                let (go, cancel) = crate::combine_ui::body(ui, app, &t);
-                combine_now = go;
-                if cancel {
-                    app.combine_draft.clear();
-                }
-                close = go || cancel;
-                return;
-            }
             Dialog::PdfA => {
                 close = crate::standards_ui::body(ui, app, &t);
                 return;
@@ -1288,9 +1277,6 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
     if stamp_now {
         app.save_custom_stamp();
     }
-    if combine_now {
-        app.combine_staged();
-    }
     if images_now {
         app.finish_image_import();
     } else if dialog == Dialog::CreateImages && app.dialog != Some(Dialog::CreateImages) {
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 02378e64..27b26277 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -73,12 +73,21 @@ impl PdfCraftApp {
         }
     }
 
+    /// Undo the last change: to the Combine files list while its tab shows, else the document.
     pub fn undo(&mut self) {
-        self.history_step(true);
+        if self.combine_showing() {
+            self.combine_history_step(true);
+        } else {
+            self.history_step(true);
+        }
     }
 
     pub fn redo(&mut self) {
-        self.history_step(false);
+        if self.combine_showing() {
+            self.combine_history_step(false);
+        } else {
+            self.history_step(false);
+        }
     }
 
     fn history_step(&mut self, undo: bool) {
diff --git a/crates/ui-egui/src/files.rs b/crates/ui-egui/src/files.rs
index d4c492a1..9d4e10f4 100644
--- a/crates/ui-egui/src/files.rs
+++ b/crates/ui-egui/src/files.rs
@@ -125,7 +125,7 @@ impl Default for RotateDraft {
 }
 
 impl PdfCraftApp {
-    /// Ask for files to combine (File ▸ Combine files…).
+    /// Ask for files to add to the Combine files list (its Add files… button).
     pub fn combine_dialog(&mut self) {
         self.pick_files(FilePurpose::Combine, true);
     }
@@ -178,6 +178,7 @@ impl PdfCraftApp {
     #[cfg(not(target_arch = "wasm32"))]
     pub(crate) fn use_paths(&mut self, purpose: FilePurpose, paths: &[std::path::PathBuf]) {
         let mut files = Vec::new();
+        let mut modified = Vec::new();
         for p in paths {
             let name = p.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "file.pdf".into());
             match std::fs::read(p) {
@@ -187,12 +188,60 @@ impl PdfCraftApp {
                     return;
                 }
             }
+            modified.push(std::fs::metadata(p).and_then(|m| m.modified()).ok());
         }
-        if !files.is_empty() {
+        if files.is_empty() {
+            return;
+        }
+        // Combine files lists when each file was last modified.
+        if purpose == FilePurpose::Combine {
+            let incoming = files
+                .into_iter()
+                .zip(modified)
+                .map(|((name, bytes), modified)| crate::combine_ui::Incoming { name, bytes: Arc::new(bytes), modified, note: None })
+                .collect();
+            self.stage_combine_with(incoming);
+        } else {
             self.use_files(purpose, files);
         }
     }
 
+    /// A file dropped on the Combine files tab: added to its list.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn drop_into_combine(&mut self, f: egui::DroppedFileHandle, _ctx: &egui::Context) {
+        // A folder: the PDFs in it and in the folders inside it.
+        if f.path().is_absolute() && f.path().is_dir() {
+            self.add_folder_to_combine(f.path(), true);
+            return;
+        }
+        if f.path().is_absolute() {
+            self.use_paths(FilePurpose::Combine, &[f.path().to_path_buf()]);
+            return;
+        }
+        let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
+        match f.bytes() {
+            Ok(bytes) => self.use_files(FilePurpose::Combine, vec![(name, bytes)]),
+            Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e.to_string())]),
+        }
+    }
+
+    /// Browsers read dropped files asynchronously; they join the Combine files list next frame.
+    #[cfg(target_arch = "wasm32")]
+    pub(crate) fn drop_into_combine(&mut self, f: egui::DroppedFileHandle, ctx: &egui::Context) {
+        let requests = self.requests.clone();
+        let request = self.file_request(FilePurpose::Combine, Vec::new());
+        let ctx = ctx.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
+            if let Ok(bytes) = f.bytes_async().await
+                && let Ok(mut q) = requests.lock()
+            {
+                q.push(FileRequest { files: vec![(name, bytes)], ..request });
+                ctx.request_repaint();
+            }
+        });
+    }
+
     /// A request to use `files` for `purpose`, bound to the document it will edit: the active
     /// one now, for Insert and Replace. Browsers make it when the picker opens and queue it on
     /// `requests` once the files are read; it is used on a later frame.
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index dce2b18a..38ee8949 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1522,7 +1522,63 @@
 	Sent to {printer}	Enviado a {printer}
 	Sent to {printer}: {msg}	Enviado a {printer}: {msg}
 	Choose a folder for the searchable files	Elige una carpeta para los archivos con búsqueda
-	Files are combined in this order. Leave Pages empty to take every page.	Los archivos se combinan en este orden. Deja Páginas vacío para incluir todas las páginas.
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Los archivos se combinan de arriba abajo. Deja Páginas vacío para incluir todas las páginas.
+	Unlock…	Desbloquear…
+	Select a password-protected file first	Selecciona primero un archivo protegido con contraseña
+	Enter the permissions password to allow combining	Introduce la contraseña de permisos para permitir combinarlo
+	Enter the password that opens it	Introduce la contraseña que lo abre
+	Unlock {name}	Desbloquear {name}
+	Unlock {n} files	Desbloquear {n} archivos
+	The same password is tried on each file.	Se prueba la misma contraseña en cada archivo.
+	Hide password	Ocultar contraseña
+	Show password	Mostrar contraseña
+	Wrong password	Contraseña incorrecta
+	The password is only used to read the file; it isn't saved.	La contraseña solo se usa para leer el archivo; no se guarda.
+	Unlock	Desbloquear
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Se abrió, pero su configuración de seguridad no permite combinarlo. Introduce la contraseña de permisos.
+	Unlocked: the combined file won't be password-protected	Desbloqueado: el archivo combinado no estará protegido con contraseña
+	Unlocked {n} of {m} files	Se desbloquearon {n} de {m} archivos
+	Drop PDFs or folders here, or choose them.	Suelta aquí PDF o carpetas, o elígelos.
+	Add folder…	Añadir carpeta…
+	Add folder and subfolders…	Añadir carpeta y subcarpetas…
+	More ways to add files	Más formas de añadir archivos
+	Every PDF in the folder	Todos los PDF de la carpeta
+	Every PDF in the folder and the folders inside it	Todos los PDF de la carpeta y de las carpetas que contiene
+	Add folder	Añadir carpeta
+	Add folder and subfolders	Añadir carpeta y subcarpetas
+	No PDFs found in {folder}	No se encontraron PDF en {folder}
+	Added the first {n} PDFs in {folder}	Se añadieron los primeros {n} PDF de {folder}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Haz clic para ordenar; arrastra para mover la columna. Arrastra su borde para cambiar el ancho.
+	Reset columns	Restablecer columnas
+	Remove {n} files	Quitar {n} archivos
+	{n} selected	{n} seleccionados
+	sorted ascending	orden ascendente
+	sorted descending	orden descendente
+	Protected: the combined file won't keep its security settings	Protegido: el archivo combinado no conservará su configuración de seguridad
+	Add open documents	Añadir documentos abiertos
+	All open documents	Todos los documentos abiertos
+	No documents are open	No hay documentos abiertos
+	Select a file first	Selecciona primero un archivo
+	1 file	1 archivo
+	{n} files	{n} archivos
+	1 file needs attention	1 archivo necesita atención
+	{n} files need attention	{n} archivos necesitan atención
+	{name} can't be combined: {why}	No se puede combinar {name}: {why}
+	Check the pages of {name}: {why}	Revisa las páginas de {name}: {why}
+	Add the PDFs to combine	Añade los PDF que quieres combinar
+	File name	Nombre de archivo
+	Warnings	Advertencias
+	Drag to reorder	Arrastra para reordenar
+	{k} of {n}	{k} de {n}
+	? of {n}	? de {n}
+	Added more than once	Añadido más de una vez
+	yesterday	ayer
+	{n} days ago	hace {n} días
+	No pages selected	No hay páginas seleccionadas
+	Password-protected	Protegido con contraseña
+	Its security settings don't allow copying pages	Su configuración de seguridad no permite copiar páginas
+	Can't be read: {e}	No se puede leer: {e}
+	Includes unsaved changes	Incluye cambios sin guardar
 	Pages of {name} to combine, e.g. 1-3, 6	Páginas de {name} que combinar, p. ej., 1-3, 6
 	Remove {name}	Quitar {name}
 	Add files…	Añadir archivos…
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index f3c2c18f..d5de2b08 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1931,3 +1931,59 @@
 	Lines +/−	Lignes +/−
 	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login} : {prs} PR, {commits} commits, +{added} / −{deleted} lignes (Δ {delta}), +{bin_added} / −{bin_deleted} fichiers binaires, {first} – {last}
 	Set layer visibility	Définir la visibilité des calques
+
+# Combine files tab
+	1 file	1 fichier
+	1 file needs attention	1 fichier demande votre attention
+	? of {n}	? sur {n}
+	Add folder	Ajouter un dossier
+	Add folder and subfolders	Ajouter un dossier et ses sous-dossiers
+	Add folder and subfolders…	Ajouter un dossier et ses sous-dossiers…
+	Add folder…	Ajouter un dossier…
+	Add open documents	Ajouter des documents ouverts
+	Add the PDFs to combine	Ajoutez les PDF à combiner
+	Added more than once	Ajouté plusieurs fois
+	All open documents	Tous les documents ouverts
+	Can't be read: {e}	Illisible : {e}
+	Check the pages of {name}: {why}	Vérifiez les pages de {name} : {why}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Cliquer pour trier, faire glisser pour déplacer la colonne. Faire glisser son bord pour la redimensionner.
+	Drag to reorder	Faire glisser pour réordonner
+	Drop PDFs or folders here, or choose them.	Déposez ici des PDF ou des dossiers, ou choisissez-les.
+	Enter the password that opens it	Saisissez le mot de passe qui l'ouvre
+	Enter the permissions password to allow combining	Saisissez le mot de passe des autorisations pour permettre de le combiner
+	Every PDF in the folder	Tous les PDF du dossier
+	Every PDF in the folder and the folders inside it	Tous les PDF du dossier et des dossiers qu'il contient
+	File name	Nom du fichier
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Les fichiers sont combinés de haut en bas. Laissez Pages vide pour prendre toutes les pages.
+	Hide password	Masquer le mot de passe
+	Includes unsaved changes	Inclut des modifications non enregistrées
+	Its security settings don't allow copying pages	Ses paramètres de sécurité n'autorisent pas la copie des pages
+	More ways to add files	Autres façons d'ajouter des fichiers
+	No documents are open	Aucun document n'est ouvert
+	No pages selected	Aucune page sélectionnée
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Ouvert, mais ses paramètres de sécurité n'autorisent pas la combinaison. Saisissez le mot de passe des autorisations.
+	Password-protected	Protégé par mot de passe
+	Protected: the combined file won't keep its security settings	Protégé : le fichier combiné ne conservera pas ses paramètres de sécurité
+	Remove {n} files	Retirer {n} fichiers
+	Reset columns	Réinitialiser les colonnes
+	Select a file first	Sélectionnez d'abord un fichier
+	Select a password-protected file first	Sélectionnez d'abord un fichier protégé par mot de passe
+	Show password	Afficher le mot de passe
+	The password is only used to read the file; it isn't saved.	Le mot de passe sert uniquement à lire le fichier ; il n'est pas enregistré.
+	The same password is tried on each file.	Le même mot de passe est essayé sur chaque fichier.
+	Unlock	Déverrouiller
+	Unlock {name}	Déverrouiller {name}
+	Unlock {n} files	Déverrouiller {n} fichiers
+	Unlocked: the combined file won't be password-protected	Déverrouillé : le fichier combiné ne sera pas protégé par mot de passe
+	Unlock…	Déverrouiller…
+	Warnings	Avertissements
+	Wrong password	Mot de passe incorrect
+	sorted ascending	tri croissant
+	sorted descending	tri décroissant
+	yesterday	hier
+	{k} of {n}	{k} sur {n}
+	{name} can't be combined: {why}	Impossible de combiner {name} : {why}
+	{n} days ago	il y a {n} jours
+	{n} files	{n} fichiers
+	{n} files need attention	{n} fichiers demandent votre attention
+	{n} selected	{n} sélectionnés
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index a829bd68..3ecfdc00 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1528,7 +1528,63 @@
 	Sent to {printer}	{printer} に送信しました
 	Sent to {printer}: {msg}	{printer} に送信しました: {msg}
 	Choose a folder for the searchable files	検索可能なファイルの保存先フォルダーを選択
-	Files are combined in this order. Leave Pages empty to take every page.	この順序でファイルを結合します。すべてのページを使用する場合は「ページ」を空欄にしてください。
+	Files are combined from top to bottom. Leave Pages empty to take every page.	ファイルは上から順に結合されます。すべてのページを使用する場合は「ページ」を空欄にしてください。
+	Unlock…	ロックを解除…
+	Select a password-protected file first	先にパスワードで保護されたファイルを選択してください
+	Enter the permissions password to allow combining	結合を許可するには権限パスワードを入力してください
+	Enter the password that opens it	ファイルを開くパスワードを入力してください
+	Unlock {name}	{name} のロックを解除
+	Unlock {n} files	{n} 個のファイルのロックを解除
+	The same password is tried on each file.	同じパスワードを各ファイルに試します。
+	Hide password	パスワードを隠す
+	Show password	パスワードを表示
+	Wrong password	パスワードが違います
+	The password is only used to read the file; it isn't saved.	パスワードはファイルの読み込みにのみ使用され、保存されません。
+	Unlock	ロックを解除
+	Opened, but its security settings don't allow combining. Enter the permissions password.	開けましたが、セキュリティ設定により結合が許可されていません。権限パスワードを入力してください。
+	Unlocked: the combined file won't be password-protected	ロック解除済み: 結合後のファイルはパスワードで保護されません
+	Unlocked {n} of {m} files	{m} 個中 {n} 個のファイルのロックを解除しました
+	Drop PDFs or folders here, or choose them.	ここに PDF またはフォルダーをドロップするか、選択してください。
+	Add folder…	フォルダーを追加…
+	Add folder and subfolders…	フォルダーとサブフォルダーを追加…
+	More ways to add files	ファイルを追加するその他の方法
+	Every PDF in the folder	フォルダー内のすべての PDF
+	Every PDF in the folder and the folders inside it	フォルダーとその中のフォルダーにあるすべての PDF
+	Add folder	フォルダーを追加
+	Add folder and subfolders	フォルダーとサブフォルダーを追加
+	No PDFs found in {folder}	{folder} に PDF が見つかりません
+	Added the first {n} PDFs in {folder}	{folder} の最初の {n} 個の PDF を追加しました
+	Click to sort, drag to move the column. Drag its edge to resize it.	クリックで並べ替え、ドラッグで列を移動します。列の端をドラッグすると幅を変更できます。
+	Reset columns	列をリセット
+	Remove {n} files	{n} 個のファイルを削除
+	{n} selected	{n} 個選択
+	sorted ascending	昇順
+	sorted descending	降順
+	Protected: the combined file won't keep its security settings	保護されています: 結合後のファイルにはセキュリティ設定が引き継がれません
+	Add open documents	開いている文書を追加
+	All open documents	開いているすべての文書
+	No documents are open	開いている文書はありません
+	Select a file first	先にファイルを選択してください
+	1 file	1 個のファイル
+	{n} files	{n} 個のファイル
+	1 file needs attention	1 個のファイルに問題があります
+	{n} files need attention	{n} 個のファイルに問題があります
+	{name} can't be combined: {why}	{name} は結合できません: {why}
+	Check the pages of {name}: {why}	{name} のページ指定を確認してください: {why}
+	Add the PDFs to combine	結合する PDF を追加
+	File name	ファイル名
+	Warnings	警告
+	Drag to reorder	ドラッグして並べ替え
+	{k} of {n}	{k}/{n}
+	? of {n}	?/{n}
+	Added more than once	複数回追加されています
+	yesterday	昨日
+	{n} days ago	{n} 日前
+	No pages selected	ページが選択されていません
+	Password-protected	パスワードで保護されています
+	Its security settings don't allow copying pages	セキュリティ設定によりページのコピーが許可されていません
+	Can't be read: {e}	読み込めません: {e}
+	Includes unsaved changes	未保存の変更を含みます
 	Pages of {name} to combine, e.g. 1-3, 6	結合する {name} のページ（例: 1-3, 6）
 	Remove {name}	{name} を削除
 	Add files…	ファイルを追加…
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 2eb43aaa..34fa5b9f 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -1479,7 +1479,63 @@
 	Sent to {printer}	已发送到{printer}
 	Sent to {printer}: {msg}	已发送到{printer}：{msg}
 	Choose a folder for the searchable files	选择可搜索文件的文件夹
-	Files are combined in this order. Leave Pages empty to take every page.	文件将按此顺序合并。页码留空表示取全部页面。
+	Files are combined from top to bottom. Leave Pages empty to take every page.	文件按从上到下的顺序合并。页码留空表示取全部页面。
+	Unlock…	解锁…
+	Select a password-protected file first	请先选择一个受密码保护的文件
+	Enter the permissions password to allow combining	输入权限密码以允许合并
+	Enter the password that opens it	输入打开该文件的密码
+	Unlock {name}	解锁 {name}
+	Unlock {n} files	解锁 {n} 个文件
+	The same password is tried on each file.	将对每个文件尝试同一密码。
+	Hide password	隐藏密码
+	Show password	显示密码
+	Wrong password	密码错误
+	The password is only used to read the file; it isn't saved.	密码仅用于读取文件，不会被保存。
+	Unlock	解锁
+	Opened, but its security settings don't allow combining. Enter the permissions password.	已打开，但其安全设置不允许合并。请输入权限密码。
+	Unlocked: the combined file won't be password-protected	已解锁：合并后的文件将不受密码保护
+	Unlocked {n} of {m} files	已解锁 {m} 个文件中的 {n} 个
+	Drop PDFs or folders here, or choose them.	将 PDF 或文件夹拖放到此处，或选择它们。
+	Add folder…	添加文件夹…
+	Add folder and subfolders…	添加文件夹及子文件夹…
+	More ways to add files	更多添加文件的方式
+	Every PDF in the folder	文件夹中的所有 PDF
+	Every PDF in the folder and the folders inside it	文件夹及其子文件夹中的所有 PDF
+	Add folder	添加文件夹
+	Add folder and subfolders	添加文件夹及子文件夹
+	No PDFs found in {folder}	在 {folder} 中未找到 PDF
+	Added the first {n} PDFs in {folder}	已添加 {folder} 中的前 {n} 个 PDF
+	Click to sort, drag to move the column. Drag its edge to resize it.	单击以排序，拖动以移动列。拖动列边缘可调整宽度。
+	Reset columns	重置列
+	Remove {n} files	删除 {n} 个文件
+	{n} selected	已选择 {n} 个
+	sorted ascending	升序
+	sorted descending	降序
+	Protected: the combined file won't keep its security settings	受保护：合并后的文件不会保留其安全设置
+	Add open documents	添加已打开的文档
+	All open documents	所有已打开的文档
+	No documents are open	没有打开的文档
+	Select a file first	请先选择一个文件
+	1 file	1 个文件
+	{n} files	{n} 个文件
+	1 file needs attention	1 个文件需要处理
+	{n} files need attention	{n} 个文件需要处理
+	{name} can't be combined: {why}	无法合并 {name}：{why}
+	Check the pages of {name}: {why}	请检查 {name} 的页码：{why}
+	Add the PDFs to combine	添加要合并的 PDF
+	File name	文件名
+	Warnings	警告
+	Drag to reorder	拖动以重新排序
+	{k} of {n}	{k}/{n}
+	? of {n}	?/{n}
+	Added more than once	重复添加
+	yesterday	昨天
+	{n} days ago	{n} 天前
+	No pages selected	未选择任何页面
+	Password-protected	受密码保护
+	Its security settings don't allow copying pages	其安全设置不允许复制页面
+	Can't be read: {e}	无法读取：{e}
+	Includes unsaved changes	包含未保存的更改
 	Pages of {name} to combine, e.g. 1-3, 6	要合并的{name}的页面，例如 1-3、6
 	Remove {name}	删除{name}
 	Add files…	添加文件…
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 8c421725..3729710d 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1437,7 +1437,63 @@
 	Sent to {printer}	已傳送到{printer}
 	Sent to {printer}: {msg}	已傳送到{printer}：{msg}
 	Choose a folder for the searchable files	選擇可搜尋檔案的資料夾
-	Files are combined in this order. Leave Pages empty to take every page.	檔案將按此順序合併。頁碼留空表示取全部頁面。
+	Files are combined from top to bottom. Leave Pages empty to take every page.	檔案將按從上到下的順序合併。頁碼留空表示取全部頁面。
+	Unlock…	解除鎖定…
+	Select a password-protected file first	請先選取一個受密碼保護的檔案
+	Enter the permissions password to allow combining	輸入權限密碼以允許合併
+	Enter the password that opens it	輸入開啟該檔案的密碼
+	Unlock {name}	解除鎖定 {name}
+	Unlock {n} files	解除鎖定 {n} 個檔案
+	The same password is tried on each file.	將對每個檔案嘗試同一密碼。
+	Hide password	隱藏密碼
+	Show password	顯示密碼
+	Wrong password	密碼錯誤
+	The password is only used to read the file; it isn't saved.	密碼僅用於讀取檔案，不會被儲存。
+	Unlock	解除鎖定
+	Opened, but its security settings don't allow combining. Enter the permissions password.	已開啟，但其安全性設定不允許合併。請輸入權限密碼。
+	Unlocked: the combined file won't be password-protected	已解除鎖定：合併後的檔案將不受密碼保護
+	Unlocked {n} of {m} files	已解除鎖定 {m} 個檔案中的 {n} 個
+	Drop PDFs or folders here, or choose them.	將 PDF 或資料夾拖放到此處，或選取它們。
+	Add folder…	新增資料夾…
+	Add folder and subfolders…	新增資料夾及子資料夾…
+	More ways to add files	更多新增檔案的方式
+	Every PDF in the folder	資料夾中的所有 PDF
+	Every PDF in the folder and the folders inside it	資料夾及其子資料夾中的所有 PDF
+	Add folder	新增資料夾
+	Add folder and subfolders	新增資料夾及子資料夾
+	No PDFs found in {folder}	在 {folder} 中找不到 PDF
+	Added the first {n} PDFs in {folder}	已新增 {folder} 中的前 {n} 個 PDF
+	Click to sort, drag to move the column. Drag its edge to resize it.	按一下以排序，拖曳以移動欄。拖曳欄邊緣可調整寬度。
+	Reset columns	重設欄
+	Remove {n} files	刪除 {n} 個檔案
+	{n} selected	已選取 {n} 個
+	sorted ascending	遞增排序
+	sorted descending	遞減排序
+	Protected: the combined file won't keep its security settings	受保護：合併後的檔案不會保留其安全性設定
+	Add open documents	新增已開啟的文件
+	All open documents	所有已開啟的文件
+	No documents are open	沒有開啟的文件
+	Select a file first	請先選取一個檔案
+	1 file	1 個檔案
+	{n} files	{n} 個檔案
+	1 file needs attention	1 個檔案需要處理
+	{n} files need attention	{n} 個檔案需要處理
+	{name} can't be combined: {why}	無法合併 {name}：{why}
+	Check the pages of {name}: {why}	請檢查 {name} 的頁碼：{why}
+	Add the PDFs to combine	新增要合併的 PDF
+	File name	檔案名稱
+	Warnings	警告
+	Drag to reorder	拖曳以重新排序
+	{k} of {n}	{k}/{n}
+	? of {n}	?/{n}
+	Added more than once	重複新增
+	yesterday	昨天
+	{n} days ago	{n} 天前
+	No pages selected	未選取任何頁面
+	Password-protected	受密碼保護
+	Its security settings don't allow copying pages	其安全性設定不允許複製頁面
+	Can't be read: {e}	無法讀取：{e}
+	Includes unsaved changes	包含未儲存的變更
 	Pages of {name} to combine, e.g. 1-3, 6	要合併的{name}的頁面，例如 1-3、6
 	Remove {name}	刪除{name}
 	Add files…	新增檔案…
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 84daa9e4..a8f0fc20 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -19,6 +19,7 @@ mod actions_ui;
 pub mod canvas;
 mod chrome;
 mod combine_ui;
+pub use combine_ui::{Columns as CombineColumns, Lock as CombineLock, SortKey};
 mod commands;
 mod comment_props;
 pub mod comments;
@@ -245,8 +246,6 @@ pub enum Dialog {
     ActionWizard,
     /// Standards ▸ PDF/A.
     PdfA,
-    /// Combine files: the files, their order and pages.
-    Combine,
     /// Custom stamps ▸ Create.
     CreateStamp,
     /// Prepare for accessibility ▸ Add alternate text.
@@ -427,6 +426,10 @@ pub struct PdfCraftApp {
     pub space_audit: Vec<pdfcraft_engine::optimize::SpaceUse>,
     /// Combine files: the files staged so far.
     pub combine_draft: Vec<combine_ui::CombineFile>,
+    /// The Combine files tab: whether it is open, shown, its selection and undo history.
+    pub combine_tab: combine_ui::CombineTab,
+    /// The Combine files table's column order and widths (kept in the settings).
+    pub combine_columns: combine_ui::Columns,
     /// Images waiting for the resolution choice (released on cancel).
     pub image_import: Option<create_ui::ImageImport>,
     /// The custom stamp library, and the stamp being created.
@@ -626,6 +629,8 @@ impl PdfCraftApp {
             cert_viewer: None,
             space_audit: Vec::new(),
             combine_draft: Vec::new(),
+            combine_tab: Default::default(),
+            combine_columns: Default::default(),
             image_import: None,
             custom_stamps: Vec::new(),
             stamp_draft: Default::default(),
@@ -1071,6 +1076,7 @@ impl PdfCraftApp {
             "custom_stamps": stamps_ui::encode(&self.custom_stamps),
             "javascript": self.session.javascript(),
             "actions": actions_ui::encode(&self.custom_actions),
+            "combine_columns": self.combine_columns.to_json(),
         })
         .to_string()
     }
@@ -1078,6 +1084,7 @@ impl PdfCraftApp {
     /// Restore state written by `persist`. Unknown or malformed data is ignored.
     pub fn restore(&mut self, json: &str) {
         let Ok(v) = serde_json::from_str::<serde_json::Value>(json) else { return };
+        self.combine_columns = combine_ui::Columns::from_json(&v["combine_columns"]);
         if let Ok(r) = serde_json::from_value::<Vec<RecentFile>>(v["recent"].clone()) {
             // Only keep entries whose files still exist.
             #[cfg(not(target_arch = "wasm32"))]
@@ -1447,9 +1454,18 @@ impl eframe::App for PdfCraftApp {
             }
         }
         self.sync_theme(ctx);
+        // Showing a document hides the Combine files tab.
+        if self.active.is_some() {
+            self.combine_tab.focused = false;
+        }
         let dropped = ctx.input(|i| i.raw.dropped_files.clone());
         for f in dropped {
-            self.open_dropped(f, ctx);
+            // Files dropped on the Combine files tab join its list instead of opening.
+            if self.combine_showing() {
+                self.drop_into_combine(f, ctx);
+            } else {
+                self.open_dropped(f, ctx);
+            }
         }
         let arrived: Vec<(String, Vec<u8>)> = self.inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
         for (name, bytes) in arrived {
@@ -1527,7 +1543,9 @@ impl eframe::App for PdfCraftApp {
         let title = self
             .active
             .and_then(|i| self.session.get(self.views[i].id))
-            .map_or_else(|| "PdfCraft".to_owned(), |d| format!("{} — PdfCraft", d.display_name()));
+            .map(|d| d.display_name())
+            .or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
+            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name} — PdfCraft"));
         if title != self.window_title {
             ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
             self.window_title = title;
@@ -1561,6 +1579,7 @@ impl eframe::App for PdfCraftApp {
         }
         let t = theme::Tokens::get(&ctx);
         egui::CentralPanel::default().frame(egui::Frame::NONE.fill(t.pasteboard)).show(ui, |ui| match self.active {
+            None if self.combine_showing() => combine_ui::page(self, ui),
             None => home::show(self, ui),
             Some(i) => canvas::document_area(self, i, ui),
         });
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index bbc5784f..9f5d41f2 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -144,6 +144,34 @@ pub fn community_links(ui: &mut egui::Ui) -> Option<&'static str> {
     clicked
 }
 
+/// [`icon_pill`] with a ▾ part at its end that opens a menu of related choices. Returns the
+/// main button's response and the ▾'s (give it to `egui::Popup::menu`).
+pub fn split_pill(ui: &mut egui::Ui, icon: &str, label: &str, more: &str) -> (Response, Response) {
+    let t = Tokens::get(ui.ctx());
+    let font = theme::medium(12.5);
+    let w = ui.fonts_mut(|f| f.layout_no_wrap(label.to_owned(), font.clone(), t.text).size().x);
+    let (rect, _) = ui.allocate_exact_size(vec2(w + 46.0 + 28.0, 30.0), Sense::hover());
+    let (main_rect, more_rect) = rect.split_left_right_at_x(rect.right() - 28.0);
+    let main = ui.interact(main_rect, ui.id().with(("split-pill", label)), Sense::click());
+    let arrow = ui.interact(more_rect, ui.id().with(("split-pill-more", label)), Sense::click());
+    main.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), label));
+    arrow.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), more));
+    let radius = CornerRadius::same(15);
+    ui.painter().rect(rect, radius, t.card, Stroke::new(1.2, t.text_muted), egui::StrokeKind::Inside);
+    let left = CornerRadius { nw: 15, sw: 15, ne: 0, se: 0 };
+    let right = CornerRadius { nw: 0, sw: 0, ne: 15, se: 15 };
+    for (r, resp, corners) in [(main_rect, &main, left), (more_rect, &arrow, right)] {
+        if resp.hovered() {
+            ui.painter().rect_filled(r.shrink(1.2), corners, t.hover);
+        }
+    }
+    ui.painter().vline(more_rect.left(), rect.y_range().shrink(7.0), Stroke::new(1.0, t.text_muted));
+    crate::icons::paint(ui, Rect::from_min_size(rect.min + vec2(12.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, t.text);
+    ui.painter().text(rect.left_center() + vec2(34.0, 0.0), Align2::LEFT_CENTER, label, font, t.text);
+    crate::icons::paint(ui, Rect::from_center_size(more_rect.center(), vec2(14.0, 14.0)), "chevron-down", 13.0, t.text);
+    (main.on_hover_text(label), arrow.on_hover_text(more))
+}
+
 /// A pill button with an icon (primary = filled accent).
 pub fn icon_pill(ui: &mut egui::Ui, icon: &str, label: &str, primary: bool) -> Response {
     let t = Tokens::get(ui.ctx());
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 510fda00..21baf309 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -4,7 +4,7 @@
 use egui::accesskit::Role;
 use egui::{Key, Modifiers};
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{NodeT, Queryable};
 use pdfcraft_render::{PageRenderer, RenderRequest, RequestKind};
 use pdfcraft_ui_egui::{CloseRequest, PdfCraftApp};
 
@@ -507,13 +507,20 @@ fn combine_files_takes_chosen_pages_in_the_order_listed() {
         app.use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("one.pdf".into(), fixture(3)), ("two.pdf".into(), fixture(2))]);
     });
     h.run_steps(3);
-    h.get_by_label_contains("Files are combined in this order");
-    h.get_by_label("3 pages");
-    // two.pdf first; one.pdf's pages 3 and 1.
-    h.get_all_by_label("Move up").last().unwrap().click();
+    h.get_by_label_contains("Files are combined from top to bottom");
+    // Nothing is selected yet: the toolbar's Move up is there but disabled.
+    assert!(h.get_by_label("Move up").accesskit_node().is_disabled());
+    // Select two.pdf with the keyboard and move it up: two.pdf first; one.pdf's pages 3 and 1.
+    h.key_press(Key::ArrowUp);
     h.run_steps(2);
+    assert_eq!(h.state().combine_selection(), [1]);
+    h.get_by_label("Move up").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_draft[0].name, "two.pdf");
+    assert_eq!(h.state().combine_selection(), [0], "the selection follows the moved file");
     h.state_mut().combine_draft[1].range = "3, 1".into();
-    h.run_steps(1);
+    h.run_steps(2);
+    h.get_by_label("2 of 3");
     h.get_by_label("Combine").click();
     h.run_steps(3);
     let app = h.state();
@@ -521,6 +528,405 @@ fn combine_files_takes_chosen_pages_in_the_order_listed() {
     let doc = app.session.get(app.views[1].id).unwrap();
     assert_eq!(doc.info.outline.iter().map(|o| o.title.as_str()).collect::<Vec<_>>(), ["two", "one"]);
     assert!(app.combine_draft.is_empty());
+    assert!(!app.combine_tab.open, "the tab makes way for the result");
+}
+
+#[test]
+fn combine_files_opens_in_its_own_tab() {
+    let mut h = harness(1, |_| {});
+    h.state_mut().execute("page.combine");
+    h.run_steps(3);
+    assert!(h.state().combine_showing() && h.state().active.is_none());
+    h.get_by_label("Add the PDFs to combine");
+    // Back to the document, then to Combine through its tab.
+    h.get_by_label("doc.pdf").click();
+    h.run_steps(3);
+    assert_eq!(h.state().active, Some(0));
+    assert!(!h.state().combine_showing() && h.state().combine_tab.open);
+    // The tab, in the tab strip (All tools lists Combine files too).
+    h.get_all_by_label("Combine files").find(|n| n.rect().top() < 40.0).unwrap().click();
+    h.run_steps(3);
+    assert!(h.state().combine_showing());
+    // Home hides it too.
+    h.get_by_label("Home").click();
+    h.run_steps(3);
+    assert!(!h.state().combine_showing() && h.state().combine_tab.open);
+}
+
+#[test]
+fn closing_the_combine_tab_forgets_its_list() {
+    let mut h = harness(1, |app| {
+        app.use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("one.pdf".into(), fixture(1))]);
+    });
+    h.run_steps(3);
+    assert!(h.state().combine_showing());
+    h.state_mut().close_combine_tab();
+    h.run_steps(3);
+    let app = h.state();
+    assert!(app.combine_draft.is_empty() && !app.combine_tab.open);
+    assert_eq!(app.active, Some(0), "the document next to it shows");
+}
+
+#[test]
+fn combine_lists_size_and_warns_before_combining() {
+    let mut h = harness(1, |app| {
+        app.use_files(
+            pdfcraft_ui_egui::FilePurpose::Combine,
+            vec![
+                ("one.pdf".into(), fixture(3)),
+                ("locked.pdf".into(), protected("", "owner", -1 ^ 1024 ^ 8)),
+                ("secret.pdf".into(), protected("pw", "owner", -1)),
+            ],
+        );
+    });
+    h.run_steps(3);
+    h.get_by_label("File name");
+    h.get_by_label("Warnings");
+    h.get_by_label("Its security settings don't allow copying pages");
+    h.get_by_label("Password-protected");
+    h.get_by_label("2 files need attention");
+    assert!(h.get_by_label("Combine").accesskit_node().is_disabled());
+    // Removing them (Delete on the selection) lets Combine run.
+    for _ in 0..2 {
+        h.state_mut().select_combine_rows(&[1]);
+        h.key_press(Key::Delete);
+        h.run_steps(2);
+    }
+    assert_eq!(h.state().combine_draft.len(), 1);
+    h.get_by_label_contains("1 file · 3 pages");
+}
+
+#[test]
+fn a_bad_range_stops_combine_until_fixed() {
+    let mut h = harness(1, |app| {
+        app.use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("one.pdf".into(), fixture(3)), ("two.pdf".into(), fixture(2))]);
+    });
+    h.run_steps(3);
+    h.get_by_label_contains("2 files · 5 pages");
+    h.state_mut().combine_draft[0].range = "1-99".into();
+    h.run_steps(2);
+    h.get_by_label("1 file needs attention");
+    assert!(h.get_by_label("Combine").accesskit_node().is_disabled());
+    h.state_mut().combine_draft[0].range = "2-3".into();
+    h.run_steps(2);
+    h.get_by_label_contains("2 files · 4 pages");
+    assert!(!h.get_by_label("Combine").accesskit_node().is_disabled());
+}
+
+#[test]
+fn alt_arrows_move_the_selected_file() {
+    let mut h = harness(1, |app| {
+        app.use_files(
+            pdfcraft_ui_egui::FilePurpose::Combine,
+            vec![("a.pdf".into(), fixture(1)), ("b.pdf".into(), fixture(1)), ("c.pdf".into(), fixture(1))],
+        );
+    });
+    h.run_steps(3);
+    h.key_press(Key::ArrowDown);
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowDown);
+    h.run_steps(2);
+    let names: Vec<_> = h.state().combine_draft.iter().map(|f| f.name.clone()).collect();
+    assert_eq!(names, ["b.pdf", "a.pdf", "c.pdf"]);
+    assert_eq!(h.state().combine_selection(), [1]);
+}
+
+fn combine_names(h: &Harness<'static, PdfCraftApp>) -> Vec<String> {
+    h.state().combine_draft.iter().map(|f| f.name.clone()).collect()
+}
+
+fn combine_of(names: &[(&str, usize)]) -> Harness<'static, PdfCraftApp> {
+    let files: Vec<(String, Vec<u8>)> = names.iter().map(|(n, p)| (n.to_string(), fixture(*p))).collect();
+    let mut h = harness(1, move |app| app.use_files(pdfcraft_ui_egui::FilePurpose::Combine, files));
+    h.run_steps(3);
+    h
+}
+
+#[test]
+fn column_headings_sort_the_list_and_flip_on_the_second_click() {
+    let mut h = combine_of(&[("scan10.pdf", 1), ("Scan2.pdf", 3), ("a.pdf", 2)]);
+    h.get_by_label("File name").click();
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["a.pdf", "Scan2.pdf", "scan10.pdf"], "case-insensitive, numbers by value");
+    h.get_by_label("File name, sorted ascending").click();
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["scan10.pdf", "Scan2.pdf", "a.pdf"]);
+    h.get_by_label("Pages").click();
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["scan10.pdf", "a.pdf", "Scan2.pdf"]);
+    // Moving a file by hand ends the sorted order.
+    h.state_mut().select_combine_rows(&[2]);
+    h.get_by_label("Move up").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_tab.sort, None);
+    h.get_by_label("Pages");
+}
+
+#[test]
+fn ctrl_and_shift_clicks_select_several_files_that_move_and_go_together() {
+    let mut h = combine_of(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1), ("d.pdf", 1), ("e.pdf", 1)]);
+    h.get_by_label("b.pdf").click();
+    h.run_steps(1);
+    h.get_by_label("d.pdf").click_modifiers(Modifiers::SHIFT);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1, 2, 3]);
+    h.get_by_label("c.pdf").click_modifiers(Modifiers::COMMAND);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1, 3], "Ctrl/⌘ toggles one file");
+    h.get_by_label("2 selected");
+    h.get_by_label("Move up").click();
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["b.pdf", "a.pdf", "d.pdf", "c.pdf", "e.pdf"]);
+    h.get_by_label("Remove 2 files").click();
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["a.pdf", "c.pdf", "e.pdf"]);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [0, 1, 2]);
+}
+
+#[test]
+fn undo_and_redo_restore_the_combine_list() {
+    let mut h = combine_of(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1)]);
+    h.state_mut().select_combine_rows(&[0, 2]);
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["b.pdf"]);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["a.pdf", "b.pdf", "c.pdf"], "⌘Z brings the removed files back");
+    assert_eq!(h.state().combine_selection(), [0, 2], "…selected as they were");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["b.pdf"]);
+    // The toolbar's buttons do the same; undo also reverses a sort and the files' addition.
+    h.get_by_label("Undo").click();
+    h.run_steps(2);
+    h.get_by_label("File name").click();
+    h.run_steps(2);
+    h.get_by_label("File name, sorted ascending").click();
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["c.pdf", "b.pdf", "a.pdf"]);
+    h.get_by_label("Undo").click();
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["a.pdf", "b.pdf", "c.pdf"]);
+    // A page range typed in is one step.
+    h.state_mut().combine_draft[0].range.clear();
+    let field = h.get_all_by_role(Role::TextInput).next().unwrap();
+    field.focus();
+    h.run_steps(1);
+    h.get_all_by_role(Role::TextInput).next().unwrap().type_text("1");
+    h.run_steps(2);
+    assert_eq!(h.state().combine_draft[0].range, "1");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_draft[0].range, "");
+    // The document's own history is untouched: it has nothing to undo.
+    h.get_by_label("doc.pdf").click();
+    h.run_steps(2);
+    assert!(h.state().session.get(h.state().views[0].id).unwrap().can_undo().is_none());
+}
+
+#[test]
+fn protected_files_that_can_be_combined_are_flagged() {
+    let mut h = harness(1, |app| {
+        app.use_files(
+            pdfcraft_ui_egui::FilePurpose::Combine,
+            vec![("one.pdf".into(), fixture(1)), ("no-copy.pdf".into(), protected("", "owner", -1 ^ 16))],
+        );
+    });
+    h.run_steps(3);
+    let app = h.state();
+    assert!(app.combine_draft[1].problem.is_none(), "copying text is withheld, assembling pages isn't");
+    h.get_by_label("Protected: the combined file won't keep its security settings");
+    assert!(!h.get_by_label("Combine").accesskit_node().is_disabled(), "a warning, not a blocker");
+}
+
+#[test]
+fn the_whole_heading_sorts_and_dragging_it_moves_the_column() {
+    let mut h = combine_of(&[("b.pdf", 1), ("a.pdf", 3)]);
+    // A click in the empty right part of the heading cell, away from its text.
+    let cell = h.get_by_label("File name").rect();
+    let spot = egui::pos2(cell.right() - 30.0, cell.center().y);
+    h.hover_at(spot);
+    h.run_steps(1);
+    h.drag_at(spot);
+    h.run_steps(1);
+    h.drop_at(spot);
+    h.run_steps(2);
+    assert_eq!(combine_names(&h), ["a.pdf", "b.pdf"]);
+    // Drag Size before File name.
+    let size = h.get_by_label("Size").rect().center();
+    let name = h.get_by_label("File name, sorted ascending").rect();
+    drag(&mut h, size, egui::pos2(name.left() + 10.0, name.center().y));
+    use pdfcraft_ui_egui::SortKey::*;
+    assert_eq!(h.state().combine_columns.order, [Size, Name, Pages, Modified, Warnings]);
+    assert_eq!(combine_names(&h), ["a.pdf", "b.pdf"], "moving a column doesn't sort");
+    let (size, name) = (h.get_by_label("Size").rect(), h.get_by_label("File name, sorted ascending").rect());
+    assert!(size.left() < name.left(), "Size now shows first");
+}
+
+#[test]
+fn columns_resize_and_the_layout_is_kept_in_the_settings() {
+    let mut h = combine_of(&[("a.pdf", 1), ("b.pdf", 1)]);
+    let size = h.get_by_label("Size").rect();
+    // The separator after Size: drag it right by 60 points.
+    let edge = egui::pos2(size.right() + 2.0, size.center().y);
+    drag(&mut h, edge, edge + egui::vec2(60.0, 0.0));
+    let widths = h.state().combine_columns.widths.expect("a resized column keeps its width");
+    let size_index = pdfcraft_ui_egui::SortKey::Size as usize;
+    assert!(widths[size_index] > 120.0, "{widths:?}");
+    let saved = h.state().persist();
+    let mut fresh = PdfCraftApp::new();
+    fresh.restore(&saved);
+    assert_eq!(fresh.combine_columns, h.state().combine_columns);
+    // Malformed settings give the default layout.
+    fresh.restore(r#"{"combine_columns":{"order":["size","size"],"widths":[1,2]}}"#);
+    assert_eq!(fresh.combine_columns, Default::default());
+}
+
+#[test]
+fn a_folder_adds_its_pdfs_in_order_and_optionally_its_subfolders() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-combine-folder-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(dir.join("sub")).unwrap();
+    for (name, pages) in [("page10.pdf", 1), ("page2.PDF", 2), ("sub/inner.pdf", 3)] {
+        std::fs::write(dir.join(name), fixture(pages)).unwrap();
+    }
+    std::fs::write(dir.join("notes.txt"), b"not a pdf").unwrap();
+    let mut h = harness(1, |_| {});
+    h.state_mut().execute("page.combine");
+    h.run_steps(2);
+    h.state_mut().pick_override = Some(vec![dir.to_string_lossy().into_owned()]);
+    h.get_by_label("Add folder…").click();
+    h.run_steps(4);
+    assert_eq!(combine_names(&h), ["page2.PDF", "page10.pdf"], "PDFs only, numbers by value");
+    // The toolbar's menu: the folder and its subfolders, as one undo step.
+    h.get_by_label("More ways to add files").click();
+    h.run_steps(2);
+    h.get_by_label("Add folder and subfolders…").click();
+    h.run_steps(4);
+    assert_eq!(combine_names(&h), ["page2.PDF", "page10.pdf", "page2.PDF", "page10.pdf", "inner.pdf"]);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(combine_names(&h).len(), 2);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+fn type_password(h: &mut Harness<'static, PdfCraftApp>, password: &str) {
+    let field = h.get_by_role(Role::PasswordInput);
+    field.focus();
+    field.type_text(password);
+    h.run_steps(1);
+    h.key_press(Key::Enter);
+    h.run_steps(3);
+}
+
+#[test]
+fn a_password_protected_file_is_unlocked_with_its_password_and_combined() {
+    let mut h = combine_of(&[("one.pdf", 1)]);
+    h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("secret.pdf".into(), protected("pw", "owner", -1))]);
+    h.run_steps(3);
+    h.get_by_label("Password-protected");
+    assert!(h.get_by_label("Combine").accesskit_node().is_disabled());
+    // The row's link (the toolbar's Unlock… comes first).
+    h.get_all_by_label("Unlock…").last().unwrap().click();
+    h.run_steps(3);
+    h.get_by_label("Unlock secret.pdf");
+    type_password(&mut h, "nope");
+    h.get_by_label("Wrong password");
+    assert!(h.state().combine_draft[1].lock.is_some());
+    // The box stays open for another try.
+    let field = h.get_by_role(Role::PasswordInput);
+    field.focus();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.run_steps(1);
+    type_password(&mut h, "pw");
+    let f = &h.state().combine_draft[1];
+    assert!(f.lock.is_none() && f.problem.is_none());
+    assert_eq!(f.pages, 2);
+    h.get_by_label("Unlocked: the combined file won't be password-protected");
+    // Never printed: debug output ends up in logs.
+    assert!(!format!("{:?} {:?}", h.state().combine_draft, h.state().combine_tab).contains("pw\""));
+    h.get_by_label("Combine").click();
+    h.run_steps(3);
+    assert_eq!(texts_of(h.state(), 1), ["Page 1", "Page 1", "Page 2"]);
+}
+
+#[test]
+fn one_password_unlocks_several_selected_files_and_undo_locks_them_again() {
+    let mut h = combine_of(&[("one.pdf", 1)]);
+    h.state_mut().use_files(
+        pdfcraft_ui_egui::FilePurpose::Combine,
+        vec![
+            ("a.pdf".into(), protected("same", "o1", -1)),
+            ("b.pdf".into(), protected("same", "o2", -1)),
+            ("c.pdf".into(), protected("other", "o3", -1)),
+        ],
+    );
+    h.run_steps(3);
+    h.state_mut().select_combine_rows(&[1, 2, 3]);
+    h.run_steps(1);
+    h.get_all_by_label("Unlock…").next().unwrap().click(); // the toolbar's (the rows' links come after it)
+    h.run_steps(3);
+    h.get_by_label("Unlock 3 files");
+    type_password(&mut h, "same");
+    let locked: Vec<bool> = h.state().combine_draft.iter().map(|f| f.lock.is_some()).collect();
+    assert_eq!(locked, [false, false, false, true]);
+    h.get_by_label_contains("Unlocked 2 of 3 files");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert!(h.state().combine_draft[1..].iter().all(|f| f.lock.is_some()), "undo locks them again");
+}
+
+#[test]
+fn a_file_that_opens_but_forbids_combining_takes_the_permissions_password() {
+    let mut h = combine_of(&[("one.pdf", 1)]);
+    // Opens with "pw"; only the owner may assemble pages.
+    h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("both.pdf".into(), protected("pw", "owner", -1 ^ 1024 ^ 8))]);
+    h.run_steps(3);
+    assert!(h.state_mut().combine_unlock_rows(&[1], "pw"));
+    h.run_steps(2);
+    assert_eq!(h.state().combine_draft[1].lock, Some(pdfcraft_ui_egui::CombineLock::Permissions));
+    h.get_by_label_contains("Enter the permissions password");
+    h.get_all_by_label("Unlock…").last().unwrap().click();
+    h.run_steps(3);
+    h.get_by_label("Enter the permissions password to allow combining");
+    type_password(&mut h, "owner");
+    assert!(h.state().combine_draft[1].lock.is_none());
+    assert!(!h.get_by_label("Combine").accesskit_node().is_disabled());
+}
+
+#[test]
+fn an_rc4_file_unlocks_with_its_owner_password_too() {
+    // The engine reads RC4 files with their owner password; the inspector may not, and the
+    // engine's answer is the one that counts.
+    let mut h = combine_of(&[("one.pdf", 1)]);
+    h.state_mut().use_files(
+        pdfcraft_ui_egui::FilePurpose::Combine,
+        vec![("rc4.pdf".into(), protected_with(pdfcraft_cos::Algorithm::Rc4_128, "user", "boss", -1))],
+    );
+    h.run_steps(3);
+    assert!(h.state_mut().combine_unlock_rows(&[1], "boss"));
+    let f = &h.state().combine_draft[1];
+    assert!(f.lock.is_none());
+    assert_eq!(f.pages, 2);
+}
+
+#[test]
+fn open_documents_can_be_added_to_combine() {
+    let mut h = harness(2, |_| {});
+    h.state_mut().execute("page.combine");
+    h.run_steps(3);
+    h.get_by_label("Add open documents").click();
+    h.run_steps(2);
+    // The menu's entry, after the tab of the same name.
+    h.get_all_by_label("doc.pdf").last().unwrap().click();
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(app.combine_draft.len(), 1);
+    assert_eq!(app.combine_draft[0].pages, 2);
+    assert!(app.combine_showing());
 }
 
 #[test]
@@ -601,9 +1007,13 @@ fn split_before_selected_pages() {
 // ── Encrypted documents ───────────────────────────────────────────────────────────────────────
 
 fn protected(user: &str, owner: &str, permissions: i32) -> Vec<u8> {
+    protected_with(pdfcraft_cos::Algorithm::Aes256, user, owner, permissions)
+}
+
+fn protected_with(algorithm: pdfcraft_cos::Algorithm, user: &str, owner: &str, permissions: i32) -> Vec<u8> {
     let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(fixture(2))).unwrap();
     doc.set_encryption(&pdfcraft_cos::NewEncryption {
-        algorithm: pdfcraft_cos::Algorithm::Aes256,
+        algorithm,
         user_password: user,
         owner_password: owner,
         permissions,
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index e63c8b72..5299c664 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -256,6 +256,46 @@ fn dropping_a_pdf_on_the_window_opens_it() {
     h.get_by_label_contains("dropped.pdf");
 }
 
+#[test]
+fn pdfs_dropped_on_the_combine_tab_join_its_list() {
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| PdfCraftApp::new());
+    h.run_steps(3);
+    h.state_mut().execute("page.combine");
+    h.run_steps(2);
+    // An absolute path is read from disk, with its modified time.
+    let path = std::env::temp_dir().join(format!("pdfcraft-combine-drop-{}.pdf", std::process::id()));
+    std::fs::write(&path, FIXTURE).unwrap();
+    let on_disk: egui::DroppedFileHandle = std::sync::Arc::new(Dropped { path: path.clone(), bytes: Vec::new() });
+    let in_memory: egui::DroppedFileHandle = std::sync::Arc::new(Dropped { path: "second.pdf".into(), bytes: FIXTURE.to_vec() });
+    h.input_mut().dropped_files.extend([on_disk, in_memory]);
+    h.run_steps(3);
+    std::fs::remove_file(&path).ok();
+    let app = h.state();
+    assert!(app.views.is_empty(), "nothing opens");
+    assert_eq!(app.combine_draft.len(), 2);
+    assert!(app.combine_draft[0].modified.is_some() && app.combine_draft[1].modified.is_none());
+    h.get_by_label("just now");
+}
+
+#[test]
+fn a_folder_dropped_on_the_combine_tab_adds_its_pdfs() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-combine-drop-dir-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(dir.join("inner")).unwrap();
+    std::fs::write(dir.join("one.pdf"), FIXTURE).unwrap();
+    std::fs::write(dir.join("inner").join("two.pdf"), FIXTURE).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| PdfCraftApp::new());
+    h.run_steps(3);
+    h.state_mut().execute("page.combine");
+    h.run_steps(2);
+    let folder: egui::DroppedFileHandle = std::sync::Arc::new(Dropped { path: dir.clone(), bytes: Vec::new() });
+    h.input_mut().dropped_files.push(folder);
+    h.run_steps(3);
+    let _ = std::fs::remove_dir_all(&dir);
+    let names: Vec<_> = h.state().combine_draft.iter().map(|f| f.name.clone()).collect();
+    assert_eq!(names, ["two.pdf", "one.pdf"], "subfolders included, in path order");
+}
+
 #[test]
 fn files_and_quit_from_the_operating_system() {
     // #73: macOS hands Finder double-clicks, Open With and Dock drops over as Apple events.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 9cfa9f7b..777ca4a9 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2890,8 +2890,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
-evidence = ["crates/organize/src/tests.rs::combine_concatenates_with_a_bookmark_per_file", "crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/automation/tests/automation.rs::combine_extract_and_split"]
-notes = ""
+evidence = ["crates/organize/src/tests.rs::combine_concatenates_with_a_bookmark_per_file", "crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/editing.rs::combine_files_opens_in_its_own_tab", "crates/ui-egui/tests/editing.rs::combine_lists_size_and_warns_before_combining", "crates/ui-egui/tests/editing.rs::a_password_protected_file_is_unlocked_with_its_password_and_combined", "crates/ui-egui/tests/editing.rs::a_folder_adds_its_pdfs_in_order_and_optionally_its_subfolders", "crates/ui-egui/tests/ui.rs::pdfs_dropped_on_the_combine_tab_join_its_list", "crates/automation/tests/automation.rs::combine_extract_and_split", "crates/automation/tests/automation.rs::combine_opens_protected_files_with_their_passwords"]
+notes = "Combine files is its own tab: a table of the files (name, pages, size, modified, warnings) with column sorting, resizing and moving; files, folders (with subfolders) and open documents can be added, or dropped on the tab. Problems show before Combine (password, security settings that withhold page assembly, bad page ranges, duplicates); protected files are unlocked with their open or permissions password (also doc_combine passwords). The result is never encrypted, and is not yet offered for protection in the same step."
 
 [[feature]]
 id = "organize.combine-bookmarks"
@@ -2915,7 +2915,7 @@ status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
 evidence = ["crates/ui-egui/tests/editing.rs::combine_files_takes_chosen_pages_in_the_order_listed", "crates/automation/tests/automation.rs::combine_extract_and_split"]
-notes = "Combine files list: order (move up/down), remove, add files, a page range per file (such as 1-3, 6; in the order given); bookmarks to left-out pages lose their destination"
+notes = "A page range per file (such as 1-3, 6; in the order given), checked as it is typed, with the page count it takes; bookmarks to left-out pages lose their destination"
 
 [[feature]]
 id = "organize.combine-sort"
@@ -2923,11 +2923,11 @@ title = "Sort and reorder files before combining"
 area = "D"
 tier = "P2"
 milestone = "M4"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "shipped"
+commands = ["page.combine"]
+tools = ["doc_combine"]
+evidence = ["crates/ui-egui/tests/editing.rs::column_headings_sort_the_list_and_flip_on_the_second_click", "crates/ui-egui/tests/editing.rs::ctrl_and_shift_clicks_select_several_files_that_move_and_go_together", "crates/ui-egui/tests/editing.rs::undo_and_redo_restore_the_combine_list", "crates/automation/tests/automation.rs::combine_extract_and_split"]
+notes = "Sort by any column (name in natural order, pages, size, modified, warnings), ascending or descending; multi-select (Ctrl/Shift) and move up/down, Alt+arrows or drag; every change undoable. doc_combine combines in the order its paths are given."
 
 [[feature]]
 id = "organize.combine-options"
@@ -2935,11 +2935,11 @@ title = "Combine options (file size, convert to PDF/A, include open files)"
 area = "D"
 tier = "P2"
 milestone = "M11"
-status = "planned"
-commands = []
+status = "partial"
+commands = ["page.combine"]
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::open_documents_can_be_added_to_combine"]
+notes = "Include open files: Add open documents (with their unsaved changes). Missing: file-size options and converting the result to PDF/A."
 
 [[feature]]
 id = "organize.resource-dedupe"

From ca9541069fda2996d2506a768feb1709ead6c167 Mon Sep 17 00:00:00 2001
From: Fazmin Nizam <fazmin.nizam@gmail.com>
Date: Thu, 8 Oct 2026 15:37:21 -0400
Subject: [PATCH 003/149] Issue #236: the Save-changes prompt shortens very
 long names to fit the window (#322)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wrapping the title (#161) kept the prompt narrow, but a long enough name
still grew it taller than the window and pushed Save, Cancel and Don't
save off-screen. On the web a `?file=` URL names the document, so the
name has no length limit.

Past 80 characters the name now gives way in the middle ("start…end"),
keeping the start and the extension and version suffix; the full name
shows on hover. The new test checks the title and buttons stay inside
the desktop's minimum window (820×520) for long Latin, Thai and CJK
names and a 2000-character one.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/src/dialogs.rs   | 23 +++++++++++++++++--
 crates/ui-egui/tests/editing.rs | 40 +++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index f1243f2d..14135534 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1344,18 +1344,24 @@ fn save_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
         return;
     };
     let t = Tokens::get(ctx);
+    // Wrapping alone (#161) still let a long enough name (a web `?file=` URL has no limit) grow
+    // the prompt taller than the window (#236); 80 characters wrap to a few lines.
+    let shown = shorten_middle(&name, 80);
     let mut choice: Option<Option<bool>> = None;
     let modal = egui::Modal::new(egui::Id::new("save_prompt")).show(ctx, |ui| {
         ui.set_width(420.0);
         ui.horizontal(|ui| {
             ui.add(crate::icons::image("save", 22.0, t.accent));
-            ui.add(
+            let title = ui.add(
                 egui::Label::new(
-                    egui::RichText::new(crate::i18n::fmt(tl!("Save changes to “{name}” before closing?"), &[("name", &name)]))
+                    egui::RichText::new(crate::i18n::fmt(tl!("Save changes to “{name}” before closing?"), &[("name", &shown)]))
                         .font(theme::semibold(16.0)),
                 )
                 .wrap(),
             );
+            if shown != name {
+                title.on_hover_text(&name);
+            }
         });
         ui.add_space(6.0);
         ui.label(egui::RichText::new(tl!("Your changes will be lost if you don't save them.")).color(t.text_muted));
@@ -1381,6 +1387,19 @@ fn save_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
     }
 }
 
+/// `name` cut to at most `max` characters by replacing its middle with "…", keeping the start and
+/// the end, where the extension and version suffixes sit. Counts `char`s, so it never splits one.
+fn shorten_middle(name: &str, max: usize) -> String {
+    let count = name.chars().count();
+    if count <= max {
+        return name.to_string();
+    }
+    let tail = max / 4;
+    let head: String = name.chars().take(max.saturating_sub(tail + 1)).collect();
+    let end: String = name.chars().skip(count.saturating_sub(tail)).collect();
+    format!("{head}…{end}")
+}
+
 /// "Open this web page?" when a document's link, button or script asks to open an address
 /// (#90, #91). Shows where the address really goes and the whole address; Cancel is the default,
 /// and Escape or clicking outside cancels.
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 21baf309..3aed0f6c 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -411,6 +411,46 @@ fn save_prompt_stays_inside_the_screen_for_a_long_filename() {
     }
 }
 
+#[test]
+fn save_prompt_fits_the_smallest_window_whatever_the_name() {
+    // Issue #236: wrapping (#161) kept the prompt narrow, but a long enough name still grew it
+    // taller than the window and pushed the buttons off-screen. On the web a `?file=` URL names
+    // the document, so the name has no length limit. Long names now give way in the middle.
+    let names = [
+        format!("{}.pdf", "a".repeat(400)),
+        format!("{}.pdf", "Quarterly_Report_FY2026_Final_v3_".repeat(12)),
+        format!("{}.pdf", "รายงานประจำปีงบประมาณ".repeat(15)),
+        format!("{}.pdf", "年".repeat(251)),
+        format!("{}.pdf", "W".repeat(2000)),
+    ];
+    // The desktop window's minimum inner size (apps/pdfcraft/src/main.rs).
+    let size = egui::vec2(820.0, 520.0);
+    for name in names {
+        let start: String = name.chars().take(10).collect();
+        let mut h = Harness::builder().with_size(size).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.open_bytes(&name, None, fixture(1)).expect("fixture opens");
+            app.close_request = Some(CloseRequest::Tab(app.views[0].id));
+            app
+        });
+        h.run_steps(4);
+        let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, size);
+        let inside = |r: egui::Rect| screen.contains(r.min) && screen.contains(r.max);
+        let title = h.get_by_label_contains("Save changes to");
+        let title_rect = title.rect();
+        assert!(inside(title_rect), "{start}…: the title rect {title_rect:?} leaves the screen");
+        let opening = format!("Save changes to “{start}");
+        assert!(
+            h.query_by(|n| n.value().is_some_and(|l| l.starts_with(&opening) && l.contains('…') && l.contains(".pdf” before closing?"))).is_some(),
+            "{start}…: the title keeps the start and the extension"
+        );
+        for button in ["Save", "Cancel", "Don't save"] {
+            let rect = h.get_by_label(button).rect();
+            assert!(inside(rect), "{start}…: the {button} button rect {rect:?} leaves the screen");
+        }
+    }
+}
+
 #[test]
 fn document_properties_edit_is_one_undoable_step() {
     let mut h = harness(1, |app| app.set_option("dialog", "properties").unwrap());

From a21637c7572be84492054dc0b8c68b95f1a18092 Mon Sep 17 00:00:00 2001
From: sanyamsingh001 <sanyamsingh001@duck.com>
Date: Thu, 8 Oct 2026 19:55:42 +0000
Subject: [PATCH 004/149] M14: reject invalid combine page selector types
 (#329)

Validate every doc_combine selector before reading inputs or changing output and session state. Cover invalid types and saved/reopened selection order.

Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/automation/src/lib.rs          |  10 ++-
 crates/automation/tests/automation.rs | 109 ++++++++++++++++++++++++++
 2 files changed, 118 insertions(+), 1 deletion(-)

diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 952f2ff9..35dbadf7 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -1175,7 +1175,15 @@ impl Automation {
         }
         let ranges: Vec<Option<String>> = match a.get("pages") {
             None | Some(Value::Null) => vec![None; paths.len()],
-            Some(Value::Array(v)) if v.len() == paths.len() => v.iter().map(|x| x.as_str().map(str::to_owned)).collect(),
+            Some(Value::Array(v)) if v.len() == paths.len() => v
+                .iter()
+                .enumerate()
+                .map(|(index, value)| match value {
+                    Value::Null => Ok(None),
+                    Value::String(range) => Ok(Some(range.clone())),
+                    _ => Err(ToolError::InvalidArgs(format!("pages[{index}] must be a range string or null"))),
+                })
+                .collect::<Result<_>>()?,
             Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
         };
         let passwords: Vec<Option<String>> = match a.get("passwords") {
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 65e5702d..b3ac82e9 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -2349,3 +2349,112 @@ mod close_argument_tests {
         assert_eq!(std::fs::read(dir.0.join("a.pdf")).unwrap(), source);
     }
 }
+
+mod combine_argument_tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    // Own only a newly created directory; the bounded runner provides project-local TMPDIR.
+    struct CombineDir(PathBuf);
+
+    impl CombineDir {
+        fn new() -> Self {
+            static NEXT: AtomicU64 = AtomicU64::new(0);
+            let parent = std::env::temp_dir();
+            for _ in 0..128 {
+                let serial = NEXT.fetch_add(1, Ordering::Relaxed);
+                let path = parent.join(format!("pdfcraft-combine-{}-{serial}", std::process::id()));
+                match std::fs::create_dir(&path) {
+                    Ok(()) => {
+                        let dir = Self(path);
+                        std::fs::write(dir.0.join("a.pdf"), fixture(3)).unwrap();
+                        std::fs::write(dir.0.join("b.pdf"), fixture(2)).unwrap();
+                        return dir;
+                    }
+                    Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                    Err(error) => panic!("creating combine test directory: {error}"),
+                }
+            }
+            panic!("no unused combine test directory after 128 attempts");
+        }
+    }
+
+    impl Drop for CombineDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn invalid_combine_selectors_preserve_outputs_inputs_and_open_documents() {
+        let dir = CombineDir::new();
+        let first = std::fs::read(dir.0.join("a.pdf")).unwrap();
+        let second = std::fs::read(dir.0.join("b.pdf")).unwrap();
+        let sentinel = b"existing destination";
+        std::fs::write(dir.0.join("combined.pdf"), sentinel).unwrap();
+        let mut a = auto(&dir.0);
+        let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+        ok(&mut a, "doc_set_info", json!({ "doc": doc, "key": "Title", "value": "Unsaved title" }));
+        ok(&mut a, "doc_open", json!({ "path": "b.pdf" }));
+        let list = ok(&mut a, "doc_list", json!({}));
+        let info = ok(&mut a, "doc_info", json!({ "doc": doc }));
+        let text = page_text(&mut a, doc);
+        let bytes = a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes.clone();
+        for invalid in [json!(1), json!(true), json!({ "page": 1 }), json!(["1"])] {
+            for (index, pages) in [json!([invalid, null]), json!([null, invalid])].into_iter().enumerate() {
+                for out in ["combined.pdf", "not-created.pdf"] {
+                    let error = a.call("doc_combine", &json!({ "paths": ["a.pdf", "b.pdf"], "pages": pages, "out": out, "open": true })).unwrap_err();
+                    assert!(
+                        matches!(error, ToolError::InvalidArgs(ref message) if message == &format!("pages[{index}] must be a range string or null"))
+                    );
+                    assert_eq!(std::fs::read(dir.0.join("combined.pdf")).unwrap(), sentinel);
+                    assert!(!dir.0.join("not-created.pdf").exists());
+                    assert_eq!(ok(&mut a, "doc_list", json!({})), list);
+                    assert_eq!(ok(&mut a, "doc_info", json!({ "doc": doc })), info);
+                    assert_eq!(page_text(&mut a, doc), text);
+                    assert_eq!(a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes, bytes);
+                    assert_eq!(std::fs::read(dir.0.join("a.pdf")).unwrap(), first);
+                    assert_eq!(std::fs::read(dir.0.join("b.pdf")).unwrap(), second);
+                }
+            }
+        }
+        let error = a
+            .call("doc_combine", &json!({ "paths": ["missing-a.pdf", "missing-b.pdf"], "pages": [null, false], "out": "not-created.pdf" }))
+            .unwrap_err();
+        assert!(matches!(error, ToolError::InvalidArgs(ref message) if message == "pages[1] must be a range string or null"));
+        assert_eq!(ok(&mut a, "doc_list", json!({})), list);
+        assert_eq!(std::fs::read_dir(&dir.0).unwrap().count(), 3, "no output or staging files are created");
+    }
+
+    #[test]
+    fn valid_combine_selectors_keep_all_pages_and_selected_order_after_reopen() {
+        let dir = CombineDir::new();
+        let first = std::fs::read(dir.0.join("a.pdf")).unwrap();
+        let second = std::fs::read(dir.0.join("b.pdf")).unwrap();
+        let mut a = auto(&dir.0);
+        let all = vec!["Page 1", "Page 2", "Page 3", "Page 1", "Page 2"];
+        for (pages, expected) in [
+            (None, all.clone()),
+            (Some(Value::Null), all.clone()),
+            (Some(json!([null, null])), all.clone()),
+            (Some(json!(["", null])), all),
+            (Some(json!(["3, 1", null])), vec!["Page 3", "Page 1", "Page 1", "Page 2"]),
+            (Some(json!([null, "2"])), vec!["Page 1", "Page 2", "Page 3", "Page 2"]),
+        ] {
+            let mut args = json!({ "paths": ["a.pdf", "b.pdf"], "out": "combined.pdf", "open": false });
+            if let Some(pages) = pages {
+                args["pages"] = pages;
+            }
+            let result = ok(&mut a, "doc_combine", args);
+            assert!(result["bytes"].as_u64().unwrap() > 0);
+            assert!(result.get("document").is_none());
+            assert!(a.session().docs().is_empty());
+            let mut fresh = auto(&dir.0);
+            let opened = ok(&mut fresh, "doc_open", json!({ "path": "combined.pdf" }));
+            assert_eq!(opened["pages"].as_u64().unwrap(), expected.len() as u64);
+            assert_eq!(page_text(&mut fresh, opened["doc"].as_u64().unwrap()), expected);
+            assert_eq!(std::fs::read(dir.0.join("a.pdf")).unwrap(), first);
+            assert_eq!(std::fs::read(dir.0.join("b.pdf")).unwrap(), second);
+        }
+    }
+}

From a2d92daa00d5ac508e64ab59d879623b2ec852af Mon Sep 17 00:00:00 2001
From: Fazmin Nizam <fazmin.nizam@gmail.com>
Date: Thu, 8 Oct 2026 16:04:03 -0400
Subject: [PATCH 005/149] Issue #263: combine, extract and split keep the PDF/X
 output intent and identification (#334)

Combine, extract and split built the new document from copies of the
pages and carried bookmarks, fields, layers, attachments and four Info
keys, but not the catalog's /OutputIntents, the GTS_PDFXVersion,
GTS_PDFXConformance and Trapped Info entries, or the XMP pdfxid
identification. A PDF/X file stopped being one, and a RIP or preflight
lost the intended output condition.

Extract and split now carry the output intents (with their ICC
profiles, through the same object map as the pages), the Info entries
(the version read from Info, else XMP) and a new XMP packet holding the
identification, trapping and title. The source's packet is not copied:
it can claim standards the new file no longer meets, such as PDF/UA,
whose structure tree is not copied. Combine carries the first source's
standard only when every source declares the same version, trapping
and output intents (type, condition and profile bytes).

Not yet: a warning when combine's sources disagree, and XMP dates.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/organize/src/import.rs |  58 +++++++---
 crates/organize/src/lib.rs    |  12 ++-
 crates/organize/src/pdfx.rs   | 195 ++++++++++++++++++++++++++++++++++
 crates/organize/src/tests.rs  | 161 ++++++++++++++++++++++++++++
 parity/acrobat-features.toml  |  12 +--
 5 files changed, 414 insertions(+), 24 deletions(-)
 create mode 100644 crates/organize/src/pdfx.rs

diff --git a/crates/organize/src/import.rs b/crates/organize/src/import.rs
index 05c481f8..9b68dc2e 100644
--- a/crates/organize/src/import.rs
+++ b/crates/organize/src/import.rs
@@ -181,6 +181,13 @@ impl Copier<'_> {
     }
 }
 
+/// Copy `o` from `src` into `dst`, reusing the copies listed in `map` (source → destination), so
+/// an object the copied pages already brought along (an ICC profile) is not stored twice.
+pub(crate) fn copy_object(dst: &mut Document, src: &Document, o: &Object, map: HashMap<ObjRef, ObjRef>) -> Object {
+    let mut c = Copier { src, map, pages: HashMap::new(), annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
+    c.copy_value(dst, o, None)
+}
+
 /// Copy pages `src_pages` (0-based, in the given order) of `src` into `dst`, inserting them at
 /// position `at`. Returns the new page references in order.
 ///
@@ -188,19 +195,24 @@ impl Copier<'_> {
 /// shared rather than stored twice (see `dedupe`).
 pub fn import_pages(dst: &mut Document, src: &Document, src_pages: &[usize], at: usize) -> Result<Vec<ObjRef>, OrganizeError> {
     let first_new = dst.object_numbers().last().map_or(1, |n| n + 1);
-    let pages = import_pages_mapped(dst, src, src_pages, at)?.0;
+    let pages = import_pages_mapped(dst, src, src_pages, at)?.pages;
     let created: Vec<ObjRef> = dst.object_numbers().into_iter().filter(|n| *n >= first_new).map(|n| ObjRef::new(n, dst.generation(n))).collect();
     crate::dedupe::dedupe_resources(dst, &created, true);
     Ok(pages)
 }
 
-/// `import_pages`, also returning the source-page → destination-page map.
-fn import_pages_mapped(
-    dst: &mut Document,
-    src: &Document,
-    src_pages: &[usize],
-    at: usize,
-) -> Result<(Vec<ObjRef>, HashMap<ObjRef, ObjRef>), OrganizeError> {
+/// What `import_pages_mapped` copied.
+struct Imported {
+    /// The new pages, in order.
+    pages: Vec<ObjRef>,
+    /// Source page → destination page.
+    page_map: HashMap<ObjRef, ObjRef>,
+    /// Every source object copied → its copy.
+    objects: HashMap<ObjRef, ObjRef>,
+}
+
+/// `import_pages`, also returning what was copied from where.
+fn import_pages_mapped(dst: &mut Document, src: &Document, src_pages: &[usize], at: usize) -> Result<Imported, OrganizeError> {
     let source = walk(src)?;
     if let Some(bad) = src_pages.iter().find(|i| **i >= source.len()) {
         return Err(OrganizeError::NoSuchPage(*bad));
@@ -278,7 +290,7 @@ fn import_pages_mapped(
     let inserted: Vec<(ObjRef, Dict)> = new_pages.iter().map(|r| (*r, Dict::new())).collect();
     existing.splice(at..at, inserted);
     rebuild(dst, &existing)?;
-    Ok((new_pages, copier.pages))
+    Ok(Imported { pages: new_pages, page_map: copier.pages, objects: copier.map })
 }
 
 /// Look up a named destination in the source (`/Dests` dictionary or `/Names /Dests` tree).
@@ -410,16 +422,19 @@ fn register_fields(dst: &mut Document, fields: &[ObjRef]) -> Result<(), Organize
 }
 
 /// A new document containing copies of `pages` from `src` (Extract Pages / Split).
-/// Document information (title, author…) is carried over.
+/// Document information (title, author…) is carried over, and so is the print standard the
+/// source declares (PDF/X: its output intents and identification, #263).
 pub fn extract_pages(src: &Document, pages: &[usize]) -> Result<Document, OrganizeError> {
     let mut out = Document::new_empty();
     // One source: nothing to deduplicate.
-    import_pages_mapped(&mut out, src, pages, 0)?;
+    let imported = import_pages_mapped(&mut out, src, pages, 0)?;
     for key in crate::INFO_KEYS {
         if let Some(v) = crate::info(src, key) {
             crate::set_info(&mut out, key, &v)?;
         }
     }
+    // After the title: the XMP packet repeats it.
+    crate::pdfx::carry(&mut out, src, &crate::pdfx::PrintStandard::of(src), imported.objects)?;
     // The pages share their source's resource dictionary, so the part would otherwise carry every
     // XObject the source lists — images and all (#204). Keep only what these pages draw.
     crate::prune::prune_unused_xobjects(&mut out)?;
@@ -463,7 +478,8 @@ pub fn split(src: &Document, by: &SplitBy) -> Result<Vec<Document>, OrganizeErro
 /// Combine whole documents, in order, into a new document. Each source gets a top-level
 /// bookmark (its `title`) pointing to its first page, like Acrobat's Combine Files.
 /// The source's own bookmarks are nested (collapsed) under its entry, and its document-level
-/// attachments are carried over.
+/// attachments are carried over. When every source declares the same print standard (PDF/X
+/// with the same output intent), so does the result.
 pub fn combine(sources: &[(&str, &Document)]) -> Result<Document, OrganizeError> {
     let all: Vec<(&str, &Document, Option<&[usize]>)> = sources.iter().map(|(t, d)| (*t, *d, None)).collect();
     combine_selected(&all)
@@ -475,6 +491,10 @@ pub fn combine_selected(sources: &[(&str, &Document, Option<&[usize]>)]) -> Resu
     let mut out = Document::new_empty();
     let mut marks = Vec::new();
     let mut attachments = Vec::new();
+    // The first source's print standard, and what its pages brought along; it carries over
+    // only when every source declares the same one.
+    let mut standard: Option<(crate::pdfx::PrintStandard, &Document, HashMap<ObjRef, ObjRef>)> = None;
+    let mut agreed = true;
     for (title, src, chosen) in sources {
         let n = crate::page_count(src)?;
         let pages: Vec<usize> = match chosen {
@@ -487,11 +507,19 @@ pub fn combine_selected(sources: &[(&str, &Document, Option<&[usize]>)]) -> Resu
             None => (0..n).collect(),
         };
         let at = crate::page_count(&out)?;
-        let (new, page_map) = import_pages_mapped(&mut out, src, &pages, at)?;
-        if let Some(first) = new.first() {
-            marks.push((title.to_string(), *first, *src, page_map));
+        let imported = import_pages_mapped(&mut out, src, &pages, at)?;
+        if let Some(first) = imported.pages.first() {
+            marks.push((title.to_string(), *first, *src, imported.page_map));
         }
         collect_attachments(&mut out, src, &mut attachments);
+        let declared = crate::pdfx::PrintStandard::of(src);
+        match &standard {
+            None => standard = Some((declared, *src, imported.objects)),
+            Some((first, _, _)) => agreed &= first.same_as(&declared),
+        }
+    }
+    if let Some((declared, src, objects)) = standard.filter(|_| agreed) {
+        crate::pdfx::carry(&mut out, src, &declared, objects)?;
     }
     // Sources often share fonts, images and profiles (or are the same file): store them once.
     let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
diff --git a/crates/organize/src/lib.rs b/crates/organize/src/lib.rs
index 0a63a085..1b5d8347 100644
--- a/crates/organize/src/lib.rs
+++ b/crates/organize/src/lib.rs
@@ -18,6 +18,7 @@ mod dedupe;
 mod import;
 mod labels;
 mod outline;
+mod pdfx;
 mod prune;
 pub mod view;
 
@@ -347,12 +348,17 @@ pub fn info(doc: &Document, key: &str) -> Option<String> {
 pub fn set_info(doc: &mut Document, key: &str, value: &str) -> Result<(), OrganizeError> {
     let value = value.trim();
     let entry = (!value.is_empty()).then(|| Object::String(PdfString::text(value)));
+    set_info_entry(doc, key.as_bytes(), entry)
+}
+
+/// Set (or remove, with `None`) a document-information entry of any type.
+fn set_info_entry(doc: &mut Document, key: &[u8], entry: Option<Object>) -> Result<(), OrganizeError> {
     match doc.trailer().get(b"Info").cloned() {
         Some(Object::Ref(r)) if doc.get(r).as_dict().is_some() => {
             doc.update_dict(r, |d| match entry {
-                Some(v) => d.set(key.as_bytes().to_vec(), v),
+                Some(v) => d.set(key.to_vec(), v),
                 None => {
-                    d.remove(key.as_bytes());
+                    d.remove(key);
                 }
             })?;
         }
@@ -362,7 +368,7 @@ pub fn set_info(doc: &mut Document, key: &str, value: &str) -> Result<(), Organi
                 Some(Object::Dict(d)) => d.clone(),
                 _ => Dict::new(),
             };
-            d.set(key.as_bytes().to_vec(), v);
+            d.set(key.to_vec(), v);
             let r = doc.add(d);
             doc.trailer_mut().set(b"Info".to_vec(), Object::Ref(r));
         }
diff --git a/crates/organize/src/pdfx.rs b/crates/organize/src/pdfx.rs
new file mode 100644
index 00000000..eb240d1a
--- /dev/null
+++ b/crates/organize/src/pdfx.rs
@@ -0,0 +1,195 @@
+//! The print standard a document declares (PDF/X, ISO 15930), carried into the new documents
+//! Extract, Split and Combine make from its pages (#263). Apart from its pages, a PDF/X file is
+//! the catalog's `/OutputIntents` (the printing condition and its ICC profile) and the version
+//! it declares, in the document information (`GTS_PDFXVersion`, `GTS_PDFXConformance`,
+//! `Trapped`) and in its XMP metadata (`pdfxid:`).
+//!
+//! The new document gets an XMP packet of its own, holding that identification and the title.
+//! The source's packet is not copied: it can also claim standards the new document no longer
+//! meets, such as PDF/UA, whose structure tree is not copied.
+
+use std::collections::HashMap;
+
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
+
+use crate::OrganizeError;
+
+/// Decoding limit for an output profile or an XMP packet (ICC profiles are a few MB at most).
+const MAX_DECODED: usize = 64 << 20;
+
+/// What a document declares about the print standard it meets.
+#[derive(Debug, Default)]
+pub(crate) struct PrintStandard {
+    /// The catalog's `/OutputIntents`, as written.
+    intents: Option<Object>,
+    /// Each output intent's type (`/S`), printing condition and decoded profile, to compare.
+    conditions: Vec<(Vec<u8>, Vec<u8>, Vec<u8>)>,
+    /// `GTS_PDFXVersion` ("PDF/X-4"), from the document information or else the XMP metadata.
+    version: Option<String>,
+    /// `GTS_PDFXConformance` ("PDF/X-1a:2001"), which PDF/X-1a and PDF/X-3 add.
+    conformance: Option<String>,
+    /// `Trapped`.
+    trapped: Option<&'static str>,
+    /// Whether the document has XMP metadata (a PDF/X-1a:2001 file, PDF 1.3, has none).
+    xmp: bool,
+}
+
+impl PrintStandard {
+    /// What `doc` declares.
+    pub(crate) fn of(doc: &Document) -> Self {
+        let catalog = doc.root().and_then(|r| doc.get(r).as_dict().cloned()).unwrap_or_default();
+        let intents = catalog.get(b"OutputIntents").cloned();
+        let list = intents.as_ref().and_then(|o| doc.resolve(o).as_array().cloned()).unwrap_or_default();
+        let conditions = list
+            .iter()
+            .map(|oi| {
+                let oi = doc.resolve(oi);
+                let d = oi.as_dict();
+                let kind = d.and_then(|d| d.name(b"S")).unwrap_or_default().to_vec();
+                let id = d.and_then(|d| d.get(b"OutputConditionIdentifier")).and_then(|v| doc.resolve(v).as_string().map(|s| s.bytes.clone()));
+                let profile = d.and_then(|d| d.get(b"DestOutputProfile")).map(|p| doc.resolve(p)).and_then(|p| match &*p {
+                    // Undecodable: compare the bytes as stored.
+                    Object::Stream(s) => Some(s.decoded_within(MAX_DECODED).unwrap_or_else(|_| s.raw.as_ref().clone())),
+                    _ => None,
+                });
+                (kind, id.unwrap_or_default(), profile.unwrap_or_default())
+            })
+            .collect();
+        let xmp = metadata(doc, &catalog);
+        let declared = |info_key: &str, xmp_key: &str| {
+            crate::info(doc, info_key)
+                .map(|v| v.trim().to_string())
+                .filter(|v| !v.is_empty())
+                .or_else(|| xmp.as_deref().and_then(|x| xmp_value(x, xmp_key)))
+        };
+        let trapped = info_trapped(doc).or_else(|| xmp.as_deref().and_then(|x| xmp_value(x, "pdf:Trapped")).and_then(|t| trapped(t.as_bytes())));
+        Self {
+            intents,
+            conditions,
+            version: declared("GTS_PDFXVersion", "pdfxid:GTS_PDFXVersion"),
+            conformance: declared("GTS_PDFXConformance", "pdfxid:GTS_PDFXConformance"),
+            trapped,
+            xmp: xmp.is_some(),
+        }
+    }
+
+    /// Whether `other` declares the same standard: the same version and trapping, and the same
+    /// output intents (type, printing condition and profile).
+    pub(crate) fn same_as(&self, other: &Self) -> bool {
+        self.conditions == other.conditions && self.version == other.version && self.conformance == other.conformance && self.trapped == other.trapped
+    }
+}
+
+/// Give `dst` the print standard `src` declares: its output intents, copied with their profiles
+/// (through `map`, what the pages already brought along), and, for PDF/X, the document
+/// information entries and the XMP metadata that identify it.
+pub(crate) fn carry(dst: &mut Document, src: &Document, standard: &PrintStandard, map: HashMap<ObjRef, ObjRef>) -> Result<(), OrganizeError> {
+    let root = dst.root().ok_or(OrganizeError::NoPageTree)?;
+    if let Some(intents) = &standard.intents {
+        let copied = crate::import::copy_object(dst, src, intents, map);
+        dst.update_dict(root, |c| c.set(b"OutputIntents".to_vec(), copied))?;
+    }
+    let Some(version) = &standard.version else { return Ok(()) };
+    crate::set_info_entry(dst, b"GTS_PDFXVersion", Some(Object::String(PdfString::text(version))))?;
+    if let Some(c) = &standard.conformance {
+        crate::set_info_entry(dst, b"GTS_PDFXConformance", Some(Object::String(PdfString::text(c))))?;
+    }
+    if let Some(t) = standard.trapped {
+        crate::set_info_entry(dst, b"Trapped", Some(Object::name(t)))?;
+    }
+    if standard.xmp {
+        let mut md = Dict::new();
+        md.set(b"Type".to_vec(), Object::name("Metadata"));
+        md.set(b"Subtype".to_vec(), Object::name("XML"));
+        // Uncompressed, so other tools can find it.
+        let m = dst.add(Object::Stream(Stream::from_raw(md, packet(dst, standard, version).into_bytes())));
+        dst.update_dict(root, |c| c.set(b"Metadata".to_vec(), Object::Ref(m)))?;
+    }
+    Ok(())
+}
+
+/// The XMP packet identifying `doc` as `version`, with its title and trapping.
+fn packet(doc: &Document, standard: &PrintStandard, version: &str) -> String {
+    let mut props = String::new();
+    if let Some(t) = crate::info(doc, "Title").filter(|t| !t.trim().is_empty()) {
+        props.push_str(&format!("   <dc:title><rdf:Alt><rdf:li xml:lang=\"x-default\">{}</rdf:li></rdf:Alt></dc:title>\n", esc(&t)));
+    }
+    if let Some(t) = standard.trapped {
+        props.push_str(&format!("   <pdf:Trapped>{t}</pdf:Trapped>\n"));
+    }
+    props.push_str(&format!("   <pdfxid:GTS_PDFXVersion>{}</pdfxid:GTS_PDFXVersion>\n", esc(version)));
+    if let Some(c) = &standard.conformance {
+        props.push_str(&format!("   <pdfxid:GTS_PDFXConformance>{}</pdfxid:GTS_PDFXConformance>\n", esc(c)));
+    }
+    format!(
+        "<?xpacket begin=\"\u{feff}\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?>\n\
+<x:xmpmeta xmlns:x=\"adobe:ns:meta/\">\n\
+ <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\">\n\
+  <rdf:Description rdf:about=\"\"\n\
+    xmlns:dc=\"http://purl.org/dc/elements/1.1/\"\n\
+    xmlns:pdf=\"http://ns.adobe.com/pdf/1.3/\"\n\
+    xmlns:pdfxid=\"http://www.npes.org/pdfx/ns/id/\">\n\
+{props}  </rdf:Description>\n\
+ </rdf:RDF>\n\
+</x:xmpmeta>\n\
+<?xpacket end=\"w\"?>"
+    )
+}
+
+/// The document information's `/Trapped` (a name, or a string in older files).
+fn info_trapped(doc: &Document) -> Option<&'static str> {
+    let info = doc.resolve(doc.trailer().get(b"Info")?);
+    let v = doc.resolve(info.as_dict()?.get(b"Trapped")?);
+    match &*v {
+        Object::Name(n) => trapped(n),
+        Object::String(s) => trapped(&s.bytes),
+        _ => None,
+    }
+}
+
+fn trapped(v: &[u8]) -> Option<&'static str> {
+    match v {
+        b"True" => Some("True"),
+        b"False" => Some("False"),
+        b"Unknown" => Some("Unknown"),
+        _ => None,
+    }
+}
+
+/// The catalog's XMP metadata, as text.
+fn metadata(doc: &Document, catalog: &Dict) -> Option<String> {
+    match &*doc.resolve(catalog.get(b"Metadata")?) {
+        Object::Stream(s) => s.decoded_within(MAX_DECODED).ok().map(|b| String::from_utf8_lossy(&b).into_owned()),
+        _ => None,
+    }
+}
+
+/// A simple XMP property, written as an attribute (`pdfxid:GTS_PDFXVersion="PDF/X-4"`) or as an
+/// element (`<pdfxid:GTS_PDFXVersion>PDF/X-4</pdfxid:GTS_PDFXVersion>`).
+fn xmp_value(xmp: &str, key: &str) -> Option<String> {
+    for quote in ['"', '\''] {
+        let attr = format!("{key}={quote}");
+        if let Some(rest) = xmp.find(&attr).and_then(|i| xmp.get(i + attr.len()..)) {
+            return rest.find(quote).and_then(|end| rest.get(..end)).map(unescape).filter(|v| !v.is_empty());
+        }
+    }
+    let open = format!("<{key}>");
+    let rest = xmp.get(xmp.find(&open)? + open.len()..)?;
+    let value = rest.get(..rest.find(&format!("</{key}>"))?)?;
+    Some(unescape(value.trim())).filter(|v| !v.is_empty())
+}
+
+fn unescape(s: &str) -> String {
+    s.replace("&lt;", "<").replace("&gt;", ">").replace("&quot;", "\"").replace("&apos;", "'").replace("&amp;", "&")
+}
+
+/// `s` as XML text: markup escaped, and characters XML 1.0 does not allow left out.
+fn esc(s: &str) -> String {
+    s.chars()
+        .filter(|c| (!c.is_control() || matches!(c, '\t' | '\n' | '\r')) && !matches!(c, '\u{FFFE}' | '\u{FFFF}'))
+        .collect::<String>()
+        .replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+}
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index 16273e44..cff9f984 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -401,6 +401,167 @@ fn split_produces_standalone_documents_with_metadata() {
     }
 }
 
+// ── PDF/X (#263) ───────────────────────────────────────────────────────────────────────────────
+
+/// PDF/X-4 identification in XMP, as an attribute, next to a PDF/UA claim.
+const X4_XMP: &str = "<?xpacket begin=\"\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?><x:xmpmeta xmlns:x=\"adobe:ns:meta/\"><rdf:RDF \
+                      xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"><rdf:Description rdf:about=\"\" \
+                      xmlns:pdfxid=\"http://www.npes.org/pdfx/ns/id/\" xmlns:pdfuaid=\"http://www.aiim.org/pdfua/ns/id/\" \
+                      pdfxid:GTS_PDFXVersion=\"PDF/X-4\" pdfuaid:part=\"1\"/></rdf:RDF></x:xmpmeta><?xpacket end=\"r\"?>";
+
+/// A two-page print file whose output intent prints to `condition` with `profile` as its ICC
+/// profile, with `info` as its document information and `xmp` as its XMP metadata.
+fn doc_print(condition: &str, profile: &str, info: &str, xmp: Option<&str>) -> Document {
+    let metadata = if xmp.is_some() { " /Metadata 10 0 R" } else { "" };
+    let mut b: Vec<String> = vec![
+        format!("<< /Type /Catalog /Pages 2 0 R /OutputIntents [7 0 R]{metadata} >>"), // 1
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 252 144] >>".into(), // 2
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R /TrimBox [9 9 243 135] >>".into(), // 3
+        "<< /Type /Page /Parent 2 0 R /Contents 6 0 R /TrimBox [9 9 243 135] >>".into(), // 4
+        body("X1"),                                                                    // 5
+        body("X2"),                                                                    // 6
+        format!("<< /Type /OutputIntent /S /GTS_PDFX /OutputConditionIdentifier ({condition}) /DestOutputProfile 8 0 R >>"), // 7
+        format!("<< /N 4 /Length {} >>\nstream\n{profile}\nendstream", profile.len()), // 8
+        format!("<< {info} >>"),                                                       // 9
+    ];
+    if let Some(x) = xmp {
+        b.push(format!("<< /Type /Metadata /Subtype /XML /Length {} >>\nstream\n{x}\nendstream", x.len())); // 10
+    }
+    open(build(&b, "/Root 1 0 R /Info 9 0 R"))
+}
+
+/// A PDF/X-4 business card printing to `condition` with `profile`.
+fn doc_x4(condition: &str, profile: &str) -> Document {
+    doc_print(condition, profile, "/Title (Card) /GTS_PDFXVersion (PDF/X-4) /Trapped /False", Some(X4_XMP))
+}
+
+/// What a document says about PDF/X.
+#[derive(Debug, Default, PartialEq)]
+struct Pdfx {
+    /// Each output intent's printing condition and decoded profile.
+    intents: Vec<(String, Vec<u8>)>,
+    version: Option<String>,
+    trapped: Option<Vec<u8>>,
+    xmp: Option<String>,
+}
+
+fn pdfx_of(doc: &Document) -> Pdfx {
+    let cat = catalog(doc);
+    let list = cat.get(b"OutputIntents").map(|o| doc.resolve(o).as_array().cloned().unwrap_or_default()).unwrap_or_default();
+    let intents = list
+        .iter()
+        .filter_map(|oi| {
+            let d = doc.resolve(oi).as_dict().cloned()?;
+            let id = d.get(b"OutputConditionIdentifier").and_then(|v| doc.resolve(v).as_string().map(|s| s.to_text())).unwrap_or_default();
+            let profile = match d.get(b"DestOutputProfile").map(|p| doc.resolve(p)).as_deref() {
+                Some(Object::Stream(s)) => s.decoded().unwrap(),
+                _ => Vec::new(),
+            };
+            Some((id, profile))
+        })
+        .collect();
+    let trapped = doc.trailer().get(b"Info").map(|i| doc.resolve(i)).and_then(|i| i.as_dict().and_then(|d| d.name(b"Trapped")).map(<[u8]>::to_vec));
+    let xmp = match cat.get(b"Metadata").map(|m| doc.resolve(m)).as_deref() {
+        Some(Object::Stream(s)) => Some(String::from_utf8(s.decoded().unwrap()).unwrap()),
+        _ => None,
+    };
+    Pdfx { intents, version: info(doc, "GTS_PDFXVersion"), trapped, xmp }
+}
+
+#[test]
+fn extract_and_split_keep_the_pdfx_output_intent_and_identification() {
+    // #263: the parts had no /OutputIntents, no GTS_PDFXVersion and no XMP pdfxid, so a PDF/X
+    // file stopped being one.
+    let src = doc_x4("FOGRA39", "icc-fogra39");
+    let mut outs = vec![extract_pages(&src, &[1]).unwrap()];
+    outs.extend(split(&src, &SplitBy::PageCount(1)).unwrap());
+    for out in &outs {
+        let x = pdfx_of(&full_roundtrip(out));
+        assert_eq!(x.intents, [("FOGRA39".to_string(), b"icc-fogra39".to_vec())]);
+        assert_eq!(x.version.as_deref(), Some("PDF/X-4"));
+        assert_eq!(x.trapped.as_deref(), Some(&b"False"[..]));
+        let xmp = x.xmp.expect("XMP metadata");
+        assert!(xmp.contains("<pdfxid:GTS_PDFXVersion>PDF/X-4</pdfxid:GTS_PDFXVersion>"), "{xmp}");
+        assert!(xmp.contains(">Card</rdf:li>") && xmp.contains("<pdf:Trapped>False</pdf:Trapped>"), "{xmp}");
+        // The structure tree is not copied, so the source's PDF/UA claim must not be either.
+        assert!(!xmp.contains("pdfuaid"), "{xmp}");
+    }
+}
+
+#[test]
+fn combine_keeps_pdfx_when_every_source_agrees() {
+    // #263: a PDF/X-4 card combined with itself.
+    let (a, b) = (doc_x4("FOGRA39", "icc-fogra39"), doc_x4("FOGRA39", "icc-fogra39"));
+    let out = full_roundtrip(&combine(&[("a", &a), ("b", &b)]).unwrap());
+    assert_eq!(labels(&out), ["X1", "X2", "X1", "X2"]);
+    let x = pdfx_of(&out);
+    assert_eq!(x.intents, [("FOGRA39".to_string(), b"icc-fogra39".to_vec())], "one output intent, not one per source");
+    assert_eq!(x.version.as_deref(), Some("PDF/X-4"));
+    assert!(x.xmp.is_some_and(|x| x.contains("<pdfxid:GTS_PDFXVersion>PDF/X-4</pdfxid:GTS_PDFXVersion>")));
+}
+
+#[test]
+fn combine_claims_no_pdfx_when_the_sources_disagree() {
+    // Another printing condition, the same name with another profile, or a source that is not
+    // PDF/X: no one standard describes the result, so it claims none.
+    let x4 = doc_x4("FOGRA39", "icc-fogra39");
+    for other in [doc_x4("GRACoL2013", "icc-gracol"), doc_x4("FOGRA39", "icc-other"), doc_b()] {
+        let out = full_roundtrip(&combine(&[("a", &x4), ("b", &other)]).unwrap());
+        assert_eq!(pdfx_of(&out), Pdfx::default());
+    }
+}
+
+#[test]
+fn documents_without_a_print_standard_gain_none() {
+    assert_eq!(pdfx_of(&full_roundtrip(&extract_pages(&doc_a(), &[0]).unwrap())), Pdfx::default());
+    assert_eq!(pdfx_of(&full_roundtrip(&combine(&[("a", &doc_a()), ("b", &doc_b())]).unwrap())), Pdfx::default());
+}
+
+#[test]
+fn the_pdfx_version_comes_from_xmp_or_the_document_information() {
+    // A PDF/X-4 file may name its version only in XMP (here as an element); a PDF/X-1a:2001 file
+    // (PDF 1.3) only in its document information, with no XMP, and gets no XMP added.
+    let xmp = "<x:xmpmeta xmlns:x=\"adobe:ns:meta/\"><rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"><rdf:Description \
+               rdf:about=\"\" xmlns:pdfxid=\"http://www.npes.org/pdfx/ns/id/\" xmlns:pdf=\"http://ns.adobe.com/pdf/1.3/\">\
+               <pdfxid:GTS_PDFXVersion> PDF/X-4 </pdfxid:GTS_PDFXVersion><pdf:Trapped>True</pdf:Trapped></rdf:Description></rdf:RDF></x:xmpmeta>";
+    let x = pdfx_of(&full_roundtrip(&extract_pages(&doc_print("FOGRA51", "icc", "/Title (Flyer)", Some(xmp)), &[0]).unwrap()));
+    assert_eq!((x.version.as_deref(), x.trapped.as_deref()), (Some("PDF/X-4"), Some(&b"True"[..])));
+    assert!(x.xmp.is_some_and(|x| x.contains("<pdfxid:GTS_PDFXVersion>PDF/X-4</pdfxid:GTS_PDFXVersion>")));
+
+    let x1a = doc_print("CGATS TR 001", "icc", "/GTS_PDFXVersion (PDF/X-1:2001) /GTS_PDFXConformance (PDF/X-1a:2001) /Trapped (False)", None);
+    let out = full_roundtrip(&extract_pages(&x1a, &[0]).unwrap());
+    let x = pdfx_of(&out);
+    assert_eq!((x.version.as_deref(), x.trapped.as_deref()), (Some("PDF/X-1:2001"), Some(&b"False"[..])));
+    assert_eq!(info(&out, "GTS_PDFXConformance").as_deref(), Some("PDF/X-1a:2001"));
+    assert_eq!(x.xmp, None);
+}
+
+#[test]
+fn malformed_output_intents_and_identification_do_not_fail() {
+    // Untrusted input: intents that are not dictionaries, a missing profile, an intent that is
+    // its own profile, an XMP packet that never closes, and a version full of markup and NULs.
+    let b: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /OutputIntents [5 0 R 42 (junk) 6 0 R] /Metadata 7 0 R >>".into(), // 1
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 100 100] >>".into(),                        // 2
+        "<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>".into(),                                          // 3
+        body("M1"),                                                                                        // 4
+        "<< /Type /OutputIntent /S /GTS_PDFX /DestOutputProfile 99 0 R >>".into(),                         // 5
+        "<< /Type /OutputIntent /S /GTS_PDFX /OutputConditionIdentifier (x) /DestOutputProfile 6 0 R >>".into(), // 6
+        "<< /Length 30 >>\nstream\n<pdfxid:GTS_PDFXConformance>X\nendstream".into(),                       // 7
+        "<< /GTS_PDFXVersion (<PDF/X-4 & \"more\">\\000) /Trapped /Maybe >>".into(),                       // 8
+    ];
+    let src = open(build(&b, "/Root 1 0 R /Info 8 0 R"));
+    let out = full_roundtrip(&extract_pages(&src, &[0]).unwrap());
+    assert_eq!(labels(&out), ["M1"]);
+    let list = catalog(&out).get(b"OutputIntents").map(|o| out.resolve(o).as_array().cloned().unwrap_or_default()).unwrap_or_default();
+    assert_eq!(list.len(), 4, "every entry is kept as written");
+    let x = pdfx_of(&out);
+    assert_eq!(x.trapped, None, "/Maybe is not a trapping state");
+    let xmp = x.xmp.expect("XMP metadata");
+    assert!(xmp.contains("<pdfxid:GTS_PDFXVersion>&lt;PDF/X-4 &amp; &quot;more&quot;&gt;</pdfxid:GTS_PDFXVersion>"), "{xmp}");
+    assert!(!xmp.contains('\0') && !xmp.contains("GTS_PDFXConformance"), "{xmp}");
+}
+
 #[test]
 fn duplicate_pages_become_independent_copies() {
     let out = full_roundtrip(&extract_pages(&doc_b(), &[0, 0]).unwrap());
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 777ca4a9..f5ddc31c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2698,8 +2698,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.extract"]
 tools = ["page_extract"]
-evidence = ["crates/ui-egui/tests/editing.rs::extract_button_copies_selected_pages_to_a_new_tab", "crates/automation/tests/automation.rs::combine_extract_and_split"]
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::extract_button_copies_selected_pages_to_a_new_tab", "crates/automation/tests/automation.rs::combine_extract_and_split", "crates/organize/src/tests.rs::extract_and_split_keep_the_pdfx_output_intent_and_identification"]
+notes = "Carries the PDF/X output intent and identification (#263) in a new XMP packet; the source XMP (dates, other schemas) is not copied."
 
 [[feature]]
 id = "organize.extract-separate-files"
@@ -2818,8 +2818,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.split"]
 tools = ["doc_split"]
-evidence = ["crates/ui-egui/tests/editing.rs::split_dialog_writes_one_file_per_part", "crates/organize/src/tests.rs::split_ranges_cover_every_page_once", "crates/organize/src/tests.rs::split_produces_standalone_documents_with_metadata"]
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::split_dialog_writes_one_file_per_part", "crates/organize/src/tests.rs::split_ranges_cover_every_page_once", "crates/organize/src/tests.rs::split_produces_standalone_documents_with_metadata", "crates/organize/src/tests.rs::extract_and_split_keep_the_pdfx_output_intent_and_identification"]
+notes = "Each part carries the PDF/X output intent and identification (#263), as Extract does."
 
 [[feature]]
 id = "organize.split-before-pages"
@@ -2890,8 +2890,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
-evidence = ["crates/organize/src/tests.rs::combine_concatenates_with_a_bookmark_per_file", "crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/editing.rs::combine_files_opens_in_its_own_tab", "crates/ui-egui/tests/editing.rs::combine_lists_size_and_warns_before_combining", "crates/ui-egui/tests/editing.rs::a_password_protected_file_is_unlocked_with_its_password_and_combined", "crates/ui-egui/tests/editing.rs::a_folder_adds_its_pdfs_in_order_and_optionally_its_subfolders", "crates/ui-egui/tests/ui.rs::pdfs_dropped_on_the_combine_tab_join_its_list", "crates/automation/tests/automation.rs::combine_extract_and_split", "crates/automation/tests/automation.rs::combine_opens_protected_files_with_their_passwords"]
-notes = "Combine files is its own tab: a table of the files (name, pages, size, modified, warnings) with column sorting, resizing and moving; files, folders (with subfolders) and open documents can be added, or dropped on the tab. Problems show before Combine (password, security settings that withhold page assembly, bad page ranges, duplicates); protected files are unlocked with their open or permissions password (also doc_combine passwords). The result is never encrypted, and is not yet offered for protection in the same step."
+evidence = ["crates/organize/src/tests.rs::combine_concatenates_with_a_bookmark_per_file", "crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/editing.rs::combine_files_opens_in_its_own_tab", "crates/ui-egui/tests/editing.rs::combine_lists_size_and_warns_before_combining", "crates/ui-egui/tests/editing.rs::a_password_protected_file_is_unlocked_with_its_password_and_combined", "crates/ui-egui/tests/editing.rs::a_folder_adds_its_pdfs_in_order_and_optionally_its_subfolders", "crates/ui-egui/tests/ui.rs::pdfs_dropped_on_the_combine_tab_join_its_list", "crates/automation/tests/automation.rs::combine_extract_and_split", "crates/automation/tests/automation.rs::combine_opens_protected_files_with_their_passwords", "crates/organize/src/tests.rs::combine_keeps_pdfx_when_every_source_agrees", "crates/organize/src/tests.rs::combine_claims_no_pdfx_when_the_sources_disagree"]
+notes = "Combine files is its own tab: a table of the files (name, pages, size, modified, warnings) with column sorting, resizing and moving; files, folders (with subfolders) and open documents can be added, or dropped on the tab. Problems show before Combine (password, security settings that withhold page assembly, bad page ranges, duplicates); protected files are unlocked with their open or permissions password (also doc_combine passwords). The result is never encrypted, and is not yet offered for protection in the same step. A PDF/X result (output intent, GTS_PDFXVersion, Trapped, XMP pdfxid) only when every source declares the same version and output intent (#263). When they differ the result claims none, and nothing reports that yet; Acrobat behaviour not observed."
 
 [[feature]]
 id = "organize.combine-bookmarks"

From 130b7ea06c334137900ae4912f825b03846a4ecb Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Thu, 8 Oct 2026 13:04:48 -0700
Subject: [PATCH 006/149] Security: print jobs, new digital IDs and the
 --control file no longer write through planted links (#338)

* Security: pipe print jobs to lp instead of a shared temp folder

On macOS, Linux and FreeBSD, Print wrote each job to
<temp>/pdfcraft-print-<pid>/job-<time>.pdf and passed that name to lp.
The folder name is predictable and was made with create_dir_all, which
accepts a folder another local user created first in a shared /tmp and
follows a symlink planted there; the job was then written with fs::write.
That user could read every printed document, or swap the file before lp
read it. The folder was also never removed.

The job now goes to lp on stdin, so nothing is written to disk. lp_args
no longer takes a file. The job is fed on its own thread while lp's
output is collected, so neither side can block on a full pipe; if that
thread can't be started, lp is stopped and an error returned rather than
a panic. When lp refuses a job before reading it (an unknown printer)
the user sees lp's message rather than a broken pipe. CUPS ends its reply
for a job read from stdin with "(0 file(s))", which reads as if nothing
was sent, so that is dropped from the message shown.

submit_via takes the spooler command so tests can run this test binary
as a stand-in lp on every platform; the new test failed on the old code
(it received the temp file as an argument and nothing on stdin).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Security: create a new digital ID file fresh, owner-only

Configure New Digital ID > Create picked the first free name with
`!p.exists()` and then wrote the .p12 with fs::write. That is
check-then-write: a file or link planted at the name between the two is
written through. exists() also follows links, so a dangling symlink
looked free and the private key was created wherever it pointed. The
file got default permissions, readable by other local users on most
Unix systems.

save_new_id_file now creates the file with create_new, never opening
anything already at the name, and with mode 0o600 on Unix. A taken name
moves on to the next ("<name> 2.p12", ...), including a folder, which
Windows reports as access denied rather than already exists. A failed
write removes the partial file.

The dangling-link test failed on the old code (the key was written
through the link); the hard-link and folder test guards the retry loop,
and a Unix-only test checks the 0o600 mode.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Security: never write the --control token through a planted link

write_control_file opened the --control path with create + truncate. A
symlink or hard link already at that path was followed: its target was
truncated and overwritten with the control token before set_permissions
ran, so the token could land in a file another user can read, and any
file the link pointed at was destroyed.

The JSON now goes to a fresh file next to the path, with a random name
(create_new, 0o600 on Unix, another name if one is taken, including a
folder on Windows), which is then renamed over the path. The rename
replaces a link instead of following it, a control file left by an
earlier run is still replaced as before, and a reader polling for the
file never sees it half-written. A failed write or rename removes the
temporary file.

The hard-link and symlink tests failed on the old code (the token was
written into the linked file); a third test covers replacing a previous
run's file, and the owner-only mode on Unix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Contributors: credit jcl-bit as James Locke

My own entry in contributors/people.toml (AGENTS.md, Contributor
credits), added in my PR as asked there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 apps/pdfcraft/src/main.rs     | 128 ++++++++++++++++++++++++++++++----
 contributors/people.toml      |   5 ++
 crates/print/README.md        |   3 +-
 crates/print/src/spool.rs     |  85 +++++++++++++++++-----
 crates/print/src/tests.rs     |  90 +++++++++++++++++++++++-
 crates/ui-egui/src/sign_ui.rs | 123 ++++++++++++++++++++++++++++++--
 6 files changed, 392 insertions(+), 42 deletions(-)

diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 8fae5b58..9bbf2f5a 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -193,23 +193,51 @@ fn main() -> eframe::Result {
 }
 
 /// Write the control endpoint so that only the current user can read the token.
+///
+/// The JSON goes to a new file next to `path`, created fresh (owner-only on Unix), which then
+/// replaces `path`. Opening `path` itself would follow a link planted there and truncate whatever
+/// it points at; a rename replaces the link and leaves its target alone. A reader polling for the
+/// file also never sees it half-written.
 fn write_control_file(path: &str, port: u16, token: &str) -> std::io::Result<()> {
+    use std::io::{ErrorKind, Write};
     let json = serde_json::json!({ "port": port, "token": token, "pid": std::process::id() }).to_string();
-    let mut opts = std::fs::OpenOptions::new();
-    opts.write(true).create(true).truncate(true);
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::OpenOptionsExt;
-        opts.mode(0o600);
+    let path = std::path::Path::new(path);
+    let name = path.file_name().ok_or_else(|| std::io::Error::new(ErrorKind::InvalidInput, "not a file name"))?;
+    // Unpredictable suffixes, so the name can't be planted in advance. `RandomState` is keyed from
+    // the operating system's random source.
+    let random = std::hash::RandomState::new();
+    for i in 0..16u32 {
+        let mut staged = std::ffi::OsString::from(".");
+        staged.push(name);
+        staged.push(format!(".{:016x}.tmp", std::hash::BuildHasher::hash_one(&random, i)));
+        let staged = path.with_file_name(staged);
+        let mut opts = std::fs::OpenOptions::new();
+        opts.write(true).create_new(true);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::OpenOptionsExt;
+            opts.mode(0o600);
+        }
+        let file = match opts.open(&staged) {
+            Ok(f) => f,
+            Err(e) if e.kind() == ErrorKind::AlreadyExists => continue,
+            // Windows refuses `create_new` on a folder with "access denied"; the name is taken all
+            // the same. A folder we can't write to, with nothing at the name, still fails here.
+            Err(e) if e.kind() == ErrorKind::PermissionDenied && staged.symlink_metadata().is_ok() => continue,
+            Err(e) => return Err(e),
+        };
+        // The block closes the file before it is renamed.
+        let written = {
+            let mut file = file;
+            file.write_all(json.as_bytes())
+        };
+        let done = written.and_then(|()| std::fs::rename(&staged, path));
+        if done.is_err() {
+            let _ = std::fs::remove_file(&staged);
+        }
+        return done;
     }
-    use std::io::Write;
-    let mut f = opts.open(path)?;
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt;
-        f.set_permissions(std::fs::Permissions::from_mode(0o600))?;
-    }
-    f.write_all(json.as_bytes())
+    Err(std::io::Error::new(ErrorKind::AlreadyExists, "no free name for the control file's temporary copy"))
 }
 
 /// How wgpu finds a GPU. Each choice yields to its wgpu environment variable.
@@ -377,4 +405,76 @@ mod tests {
         assert!(super::linux_display_gpus(std::path::Path::new("/nonexistent/drm")).is_empty());
         Ok(())
     }
+
+    /// A fresh folder per call: tests run in parallel.
+    fn scratch() -> std::path::PathBuf {
+        static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+        let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let d = std::env::temp_dir().join(format!("pdfcraft-control-file-{}-{n}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    /// The control file's port and token, and every name in its folder.
+    fn written(dir: &std::path::Path) -> (serde_json::Value, Vec<String>) {
+        let json = serde_json::from_str(&std::fs::read_to_string(dir.join("ctl.json")).unwrap()).unwrap();
+        let mut names: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+        names.sort();
+        (json, names)
+    }
+
+    #[test]
+    fn the_control_file_replaces_a_hard_link_instead_of_writing_through_it() {
+        // The file used to be opened with create + truncate, so a link planted at the path had its
+        // target truncated and overwritten with the token.
+        let dir = scratch();
+        std::fs::write(dir.join("victim.txt"), "keep me").unwrap();
+        std::fs::hard_link(dir.join("victim.txt"), dir.join("ctl.json")).unwrap();
+        super::write_control_file(&dir.join("ctl.json").to_string_lossy(), 4242, "t0ken").unwrap();
+        assert_eq!(std::fs::read_to_string(dir.join("victim.txt")).unwrap(), "keep me");
+        let (json, names) = written(&dir);
+        assert_eq!((json["port"].as_u64(), json["token"].as_str()), (Some(4242), Some("t0ken")));
+        assert_eq!(names, ["ctl.json", "victim.txt"], "no temporary file left behind");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_control_file_replaces_a_symlink_instead_of_writing_through_it() {
+        let dir = scratch();
+        let (link, target) = (dir.join("ctl.json"), dir.join("victim.txt"));
+        std::fs::write(&target, "keep me").unwrap();
+        #[cfg(unix)]
+        let made = std::os::unix::fs::symlink(&target, &link);
+        #[cfg(windows)]
+        let made = std::os::windows::fs::symlink_file(&target, &link);
+        if let Err(e) = made {
+            // Windows needs Developer Mode (or admin) for symlinks.
+            eprintln!("skipped: can't create a symlink here: {e}");
+            let _ = std::fs::remove_dir_all(&dir);
+            return;
+        }
+        super::write_control_file(&link.to_string_lossy(), 4242, "t0ken").unwrap();
+        assert_eq!(std::fs::read_to_string(&target).unwrap(), "keep me");
+        assert!(!std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink());
+        assert_eq!(written(&dir).0["token"].as_str(), Some("t0ken"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_control_file_replaces_the_one_a_previous_run_left() {
+        let dir = scratch();
+        std::fs::write(dir.join("ctl.json"), r#"{"port":1,"token":"old"}"#).unwrap();
+        super::write_control_file(&dir.join("ctl.json").to_string_lossy(), 4242, "t0ken").unwrap();
+        let (json, names) = written(&dir);
+        assert_eq!(json["token"].as_str(), Some("t0ken"));
+        assert_eq!(names, ["ctl.json"]);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mode = std::fs::metadata(dir.join("ctl.json")).unwrap().permissions().mode();
+            assert_eq!(mode & 0o077, 0, "only the owner can read the token: {mode:o}");
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/contributors/people.toml b/contributors/people.toml
index d84dff38..2fa78330 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -22,6 +22,11 @@ real_name = "Brandon Thomas"
 display_name = "Brandon Thomas"
 sync_github_name = false
 
+[people.jcl-bit]
+real_name = "James Locke"
+display_name = "James Locke"
+sync_github_name = false
+
 [people.switch87]
 real_name = "Gert Pellin"
 display_name = "Gert Pellin"
diff --git a/crates/print/README.md b/crates/print/README.md
index 62ac388a..2ba1515e 100644
--- a/crates/print/README.md
+++ b/crates/print/README.md
@@ -33,7 +33,8 @@ annotations); sheets place them with a clip. The result is a fresh, unencrypted,
 garbage-collected file (callers check the print permission).
 
 `spool` talks to CUPS (`lpstat -p -d`, `lp` with copies, collation, duplex and monochrome
-options). Other platforms report that printing to a printer isn't available yet; the
+options). The job is piped to `lp` on stdin and never written to a temp file, where another
+local user could read or swap it. Other platforms report that printing to a printer isn't available yet; the
 print-ready PDF can always be saved.
 
 Not yet: Windows and web spoolers, print as image, poster labels, PostScript output, colour
diff --git a/crates/print/src/spool.rs b/crates/print/src/spool.rs
index c9c0fcbf..176b5a2d 100644
--- a/crates/print/src/spool.rs
+++ b/crates/print/src/spool.rs
@@ -1,6 +1,6 @@
 //! The system print spooler. On macOS and Linux this is CUPS: printers come from `lpstat`, jobs
-//! go to `lp` with the job options (copies, collation, duplex, colour). Other platforms report
-//! that printing isn't available yet; the print-ready PDF can still be saved.
+//! are piped to `lp` with the job options (copies, collation, duplex, colour). Other platforms
+//! report that printing isn't available yet; the print-ready PDF can still be saved.
 
 use crate::PrintError;
 
@@ -45,8 +45,8 @@ pub fn parse_lpstat(out: &str) -> Vec<Printer> {
         .collect()
 }
 
-/// The `lp` arguments for a job printing `file`.
-pub fn lp_args(job: &Job, file: &str) -> Vec<String> {
+/// The `lp` arguments for a job. There is no file argument: `lp` reads the job from stdin.
+pub fn lp_args(job: &Job) -> Vec<String> {
     let mut a = Vec::new();
     if let Some(p) = &job.printer {
         a.extend(["-d".to_string(), p.clone()]);
@@ -65,8 +65,6 @@ pub fn lp_args(job: &Job, file: &str) -> Vec<String> {
     }
     // The sheets are already laid out at their final size.
     opt("fit-to-page=false");
-    a.push("--".into());
-    a.push(file.to_string());
     a
 }
 
@@ -99,19 +97,7 @@ pub fn printers() -> Vec<Printer> {
 pub fn submit(pdf: &[u8], job: &Job) -> Result<String, PrintError> {
     #[cfg(all(unix, not(target_arch = "wasm32")))]
     {
-        let dir = std::env::temp_dir().join(format!("pdfcraft-print-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).map_err(|e| PrintError::Spool(e.to_string()))?;
-        let file = dir.join(format!("job-{}.pdf", std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos())));
-        std::fs::write(&file, pdf).map_err(|e| PrintError::Spool(e.to_string()))?;
-        let out = std::process::Command::new("lp").args(lp_args(job, &file.to_string_lossy())).output();
-        let _ = std::fs::remove_file(&file);
-        let out = out.map_err(|e| PrintError::Spool(format!("the print spooler is not available: {e}")))?;
-        if out.status.success() {
-            Ok(String::from_utf8_lossy(&out.stdout).trim().to_string())
-        } else {
-            let err = String::from_utf8_lossy(&out.stderr).trim().to_string();
-            Err(PrintError::Spool(if err.is_empty() { "the print job was refused".into() } else { err }))
-        }
+        submit_via(std::process::Command::new("lp"), pdf, job)
     }
     #[cfg(not(all(unix, not(target_arch = "wasm32"))))]
     {
@@ -119,3 +105,64 @@ pub fn submit(pdf: &[u8], job: &Job) -> Result<String, PrintError> {
         Err(PrintError::Spool("printing to a printer isn't available on this platform yet; save the print-ready PDF instead".into()))
     }
 }
+
+/// [`submit`] with the spooler command given, so tests can stand in for `lp`.
+///
+/// The job goes to `lp` on stdin, never through a file: a predictable job folder in a shared
+/// temp directory lets another local user read printed documents or swap the file before `lp`
+/// reads it.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+pub(crate) fn submit_via(mut lp: std::process::Command, pdf: &[u8], job: &Job) -> Result<String, PrintError> {
+    use std::io::Write;
+    use std::process::Stdio;
+    let mut child = lp
+        .args(lp_args(job))
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .map_err(|e| PrintError::Spool(format!("the print spooler is not available: {e}")))?;
+    let stdin = child.stdin.take();
+    // Feed the job on its own thread while collecting the output, so neither side can fill a
+    // pipe and wait on the other. Dropping `stdin` at the end closes it: the end of the job.
+    let fed_and_out = std::thread::scope(|s| {
+        let feeder = std::thread::Builder::new().name("print job".into()).spawn_scoped(s, move || match stdin {
+            Some(mut stdin) => stdin.write_all(pdf),
+            None => Err(std::io::Error::other("no pipe to the spooler")),
+        });
+        match feeder {
+            Ok(feeder) => {
+                let out = child.wait_with_output();
+                Ok((feeder.join(), out))
+            }
+            Err(e) => {
+                // No thread to feed it: stop `lp` rather than leave it with an empty job.
+                let _ = child.kill();
+                let _ = child.wait();
+                Err(PrintError::Spool(format!("the print job could not be sent to the spooler: {e}")))
+            }
+        }
+    });
+    let (fed, out) = fed_and_out?;
+    let out = out.map_err(|e| PrintError::Spool(format!("the print spooler is not available: {e}")))?;
+    if !out.status.success() {
+        // `lp` may refuse before reading the job (an unknown printer); its message says why,
+        // and the broken pipe that leaves behind does not.
+        let err = String::from_utf8_lossy(&out.stderr).trim().to_string();
+        return Err(PrintError::Spool(if err.is_empty() { "the print job was refused".into() } else { err }));
+    }
+    match fed {
+        Ok(Ok(())) => Ok(job_message(&out.stdout)),
+        Ok(Err(e)) => Err(PrintError::Spool(format!("the print job could not be sent to the spooler: {e}"))),
+        Err(_) => Err(PrintError::Spool("the print job could not be sent to the spooler".into())),
+    }
+}
+
+/// `lp`'s reply ("request id is Office-12"), without the "(0 file(s))" CUPS adds when the job came
+/// on stdin: it reads as if nothing was sent.
+#[cfg(any(test, all(unix, not(target_arch = "wasm32"))))]
+pub(crate) fn job_message(stdout: &[u8]) -> String {
+    let s = String::from_utf8_lossy(stdout);
+    let s = s.trim();
+    s.strip_suffix("(0 file(s))").map_or(s, str::trim_end).to_string()
+}
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index 30ca598b..101e3d4c 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -193,10 +193,10 @@ fn spooler_arguments_and_printer_list() {
     let job =
         Job { printer: Some("Office_Laser".into()), copies: 3, collate: false, duplex: Duplex::LongEdge, grayscale: true, title: "memo.pdf".into() };
     assert_eq!(
-        lp_args(&job, "/tmp/x.pdf").join(" "),
-        "-d Office_Laser -n 3 -t memo.pdf -o collate=false -o sides=two-sided-long-edge -o print-color-mode=monochrome -o fit-to-page=false -- /tmp/x.pdf"
+        lp_args(&job).join(" "),
+        "-d Office_Laser -n 3 -t memo.pdf -o collate=false -o sides=two-sided-long-edge -o print-color-mode=monochrome -o fit-to-page=false"
     );
-    assert_eq!(lp_args(&Job::default(), "f.pdf")[0], "-n", "no -d: the default printer");
+    assert_eq!(lp_args(&Job::default())[0], "-n", "no -d: the default printer");
 }
 
 #[test]
@@ -275,3 +275,87 @@ fn multiple_rejects_hostile_grids_without_panicking() {
         assert!(matches!(layout(&[size], &settings(vec![0], cut_stack(2, 2))), Err(PrintError::Invalid(_))));
     }
 }
+
+/// Set on the child process when a test runs this test binary as a stand-in for `lp`.
+const STAND_IN_LP: &str = "PDFCRAFT_STAND_IN_LP";
+
+/// Not a test of its own: [`stand_in_lp`] re-runs this binary with only this test selected, and it
+/// then plays `lp`. It records its arguments and stdin in the folder named by [`STAND_IN_LP`], or,
+/// when the folder is `refuse`, exits without reading stdin, the way `lp` refuses an unknown
+/// printer.
+#[test]
+fn stand_in_for_lp() {
+    let Some(record) = std::env::var_os(STAND_IN_LP) else { return };
+    if record == "refuse" {
+        eprintln!("lp: The printer or class does not exist.");
+        std::process::exit(1);
+    }
+    let record = std::path::PathBuf::from(record);
+    let args: Vec<String> = std::env::args().skip_while(|a| a != "--").skip(1).collect();
+    let mut stdin = Vec::new();
+    std::io::Read::read_to_end(&mut std::io::stdin(), &mut stdin).unwrap();
+    std::fs::write(record.join("args"), args.join(" ")).unwrap();
+    std::fs::write(record.join("stdin"), stdin).unwrap();
+}
+
+/// A spooler command that runs [`stand_in_for_lp`] with `record` (see there).
+fn stand_in_lp(record: &std::ffi::OsStr) -> std::process::Command {
+    let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+    c.args(["--exact", "tests::stand_in_for_lp", "--nocapture", "--"]).env(STAND_IN_LP, record);
+    c
+}
+
+#[test]
+fn print_jobs_reach_lp_on_stdin_never_through_a_shared_temp_folder() {
+    // The job used to be written to `<temp>/pdfcraft-print-<pid>/job-<time>.pdf` and handed to `lp`
+    // by name. In a shared /tmp another local user can predict that folder, create it first (or
+    // plant a symlink there) and so read every printed document or swap the file before `lp`
+    // reads it. Piping the job to `lp` leaves nothing on disk.
+    static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+    let record =
+        std::env::temp_dir().join(format!("pdfcraft-print-test-{}-{}", std::process::id(), N.fetch_add(1, std::sync::atomic::Ordering::Relaxed)));
+    std::fs::create_dir(&record).unwrap();
+    // Bigger than any pipe buffer, so the spooler must read while the job is still being written.
+    let pdf: Vec<u8> = b"%PDF-1.7 synthetic print job\n".iter().copied().cycle().take(3 << 20).collect();
+    let job = Job { title: "memo.pdf".into(), ..Job::default() };
+    let sent = spool::submit_via(stand_in_lp(record.as_os_str()), &pdf, &job);
+    let args = std::fs::read_to_string(record.join("args"));
+    let stdin = std::fs::read(record.join("stdin"));
+    let _ = std::fs::remove_dir_all(&record);
+    assert!(sent.is_ok(), "{sent:?}");
+    assert_eq!(
+        args.unwrap(),
+        "-n 1 -t memo.pdf -o collate=true -o sides=one-sided -o fit-to-page=false",
+        "no file argument: lp reads the job from stdin"
+    );
+    assert!(stdin.unwrap() == pdf, "lp receives the whole job on stdin");
+    let predictable = std::env::temp_dir().join(format!("pdfcraft-print-{}", std::process::id()));
+    assert!(!predictable.exists(), "nothing is created at {predictable:?}, a name other local users can predict");
+}
+
+#[test]
+fn a_refused_print_job_reports_the_spoolers_message() {
+    // `lp` refuses an unknown printer without reading the job; the user sees why, not a broken pipe.
+    let pdf = vec![b'%'; 3 << 20];
+    let err = spool::submit_via(stand_in_lp("refuse".as_ref()), &pdf, &Job::default());
+    assert_eq!(err, Err(PrintError::Spool("lp: The printer or class does not exist.".into())));
+}
+
+#[test]
+fn the_spoolers_reply_drops_the_file_count_of_a_job_sent_on_stdin() {
+    assert_eq!(
+        spool::job_message(
+            b"request id is Office_Laser-12 (0 file(s))
+"
+        ),
+        "request id is Office_Laser-12"
+    );
+    assert_eq!(
+        spool::job_message(
+            b"request id is Office_Laser-13 (1 file(s))
+"
+        ),
+        "request id is Office_Laser-13 (1 file(s))"
+    );
+    assert_eq!(spool::job_message(b""), "");
+}
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/sign_ui.rs
index 4a09e40b..a43ff478 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/sign_ui.rs
@@ -162,6 +162,40 @@ fn id_dir() -> Option<PathBuf> {
     crate::recovery::RecoveryStore::default_dir().and_then(|d| d.parent().map(|p| p.join("Digital IDs")))
 }
 
+/// Save a new digital ID as `<stem>.p12`, or `<stem> 2.p12`, … when the name is taken. The file
+/// is always created fresh, never opened through a file or link already at the name (checking
+/// first and then writing would let one be planted in between), and on Unix only its owner can
+/// read it: it holds the private key.
+fn save_new_id_file(dir: &std::path::Path, stem: &str, p12: &[u8]) -> std::io::Result<PathBuf> {
+    use std::io::{ErrorKind, Write};
+    for i in 1..=10_000u32 {
+        let path = dir.join(if i == 1 { format!("{stem}.p12") } else { format!("{stem} {i}.p12") });
+        let mut opts = std::fs::OpenOptions::new();
+        opts.write(true).create_new(true);
+        #[cfg(unix)]
+        std::os::unix::fs::OpenOptionsExt::mode(&mut opts, 0o600);
+        let file = match opts.open(&path) {
+            Ok(f) => f,
+            Err(e) if e.kind() == ErrorKind::AlreadyExists => continue,
+            // Windows refuses `create_new` on a folder with "access denied"; the name is taken all
+            // the same. A folder we can't write to, with nothing at the name, still fails here.
+            Err(e) if e.kind() == ErrorKind::PermissionDenied && path.symlink_metadata().is_ok() => continue,
+            Err(e) => return Err(e),
+        };
+        // The block closes the file before a failed one is removed (Windows can't remove an open file).
+        let written = {
+            let mut file = file;
+            file.write_all(p12).and_then(|()| file.sync_all())
+        };
+        if let Err(e) = written {
+            let _ = std::fs::remove_file(&path);
+            return Err(e);
+        }
+        return Ok(path);
+    }
+    Err(std::io::Error::new(ErrorKind::AlreadyExists, "no free file name for the digital ID"))
+}
+
 /// A Keychain identity by its `keychain:` reference.
 fn keychain_id(reference: &str) -> Result<DigitalId, String> {
     #[cfg(target_os = "macos")]
@@ -266,11 +300,7 @@ impl PdfCraftApp {
         .ok_or("There is no folder to save the digital ID in.")?;
         std::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
         let stem: String = d.name.trim().chars().map(|c| if c.is_alphanumeric() || c == ' ' || c == '-' { c } else { '_' }).collect();
-        let path = (1..=u64::MAX)
-            .map(|i| dir.join(if i == 1 { format!("{stem}.p12") } else { format!("{stem} {i}.p12") }))
-            .find(|p| !p.exists())
-            .ok_or("no free file name for the digital ID")?;
-        std::fs::write(&path, &p12).map_err(|e| e.to_string())?;
+        let path = save_new_id_file(&dir, &stem, &p12).map_err(|e| e.to_string())?;
         Ok(self.add_digital_id(&path.to_string_lossy(), &cert))
     }
 
@@ -1079,3 +1109,86 @@ pub(crate) fn cert_viewer(ui: &mut egui::Ui, v: &mut CertViewer, trusted: &[Cert
 pub fn certificate_pem(c: &Certificate) -> String {
     sign::x509::to_pem(c)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A fresh folder per call: tests run in parallel.
+    fn scratch() -> PathBuf {
+        static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+        let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let d = std::env::temp_dir().join(format!("pdfcraft-sign-ui-{}-{n}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    /// Create a digital ID named "Grace Hopper" in `dir`, as Configure New Digital ID ▸ Create
+    /// does. Returns where it was saved.
+    fn create_in(dir: &std::path::Path) -> Result<PathBuf, String> {
+        let mut app = PdfCraftApp::new();
+        app.export_dir_override = Some(dir.to_string_lossy().into_owned());
+        let mut draft = SignDraft::new(0, None, None, None, 0);
+        // P-256 keeps the test fast.
+        let key = KEY_ALGORITHMS.iter().position(|k| k.1 == "p256").unwrap();
+        draft.new_id =
+            NewIdDraft { name: "Grace Hopper".into(), key, password: "secret1".into(), confirm: "secret1".into(), ..NewIdDraft::default() };
+        app.sign_draft = Some(draft);
+        let i = app.create_digital_id()?;
+        Ok(PathBuf::from(&app.digital_ids[i].path))
+    }
+
+    #[test]
+    fn a_new_digital_id_skips_names_already_taken_without_writing_through_them() {
+        let dir = scratch();
+        // Another file's hard link at the first name, and a folder at the second (Windows refuses
+        // `create_new` on a folder with "access denied" rather than "already exists").
+        std::fs::write(dir.join("victim.txt"), "keep me").unwrap();
+        std::fs::hard_link(dir.join("victim.txt"), dir.join("Grace Hopper.p12")).unwrap();
+        std::fs::create_dir(dir.join("Grace Hopper 2.p12")).unwrap();
+        let saved = create_in(&dir).unwrap();
+        assert_eq!(saved, dir.join("Grace Hopper 3.p12"));
+        assert_eq!(std::fs::read_to_string(dir.join("victim.txt")).unwrap(), "keep me");
+        assert!(sign::pkcs12::open(&std::fs::read(&saved).unwrap(), "secret1").is_ok());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_new_digital_id_is_not_written_through_a_dangling_link() {
+        // `exists()` follows links, so a link to a file that doesn't exist yet looked free, and
+        // `fs::write` then created the private key wherever the link pointed.
+        let dir = scratch();
+        let (link, target) = (dir.join("Grace Hopper.p12"), dir.join("elsewhere.p12"));
+        #[cfg(unix)]
+        let made = std::os::unix::fs::symlink(&target, &link);
+        #[cfg(windows)]
+        let made = std::os::windows::fs::symlink_file(&target, &link);
+        #[cfg(not(any(unix, windows)))]
+        let made: std::io::Result<()> = {
+            let _ = (&target, &link);
+            Err(std::io::ErrorKind::Unsupported.into())
+        };
+        if let Err(e) = made {
+            // Windows needs Developer Mode (or admin) for symlinks.
+            eprintln!("skipped: can't create a symlink here: {e}");
+            let _ = std::fs::remove_dir_all(&dir);
+            return;
+        }
+        let saved = create_in(&dir).unwrap();
+        assert!(!target.exists(), "nothing written through the link");
+        assert_eq!(saved, dir.join("Grace Hopper 2.p12"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_new_digital_id_is_readable_by_its_owner_only() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = scratch();
+        let saved = create_in(&dir).unwrap();
+        let mode = std::fs::metadata(&saved).unwrap().permissions().mode();
+        assert_eq!(mode & 0o077, 0, "the private key is not readable by others: {mode:o}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

From bb8fcd006e86830486b12f026de6107cbb179821 Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Thu, 8 Oct 2026 13:07:25 -0700
Subject: [PATCH 007/149] Security: refuse mailto attachments, show link hosts
 in punycode (follow-up to #104) (#337)

* Security: refuse email links that attach or insert a local file

Follow-up to #104. A document's mailto: link could ask the email app to
attach a file from the user's computer (Evolution, KMail and Claws Mail
honour attach=, Evolution and KMail also attachment=) or read one into
the body (Claws Mail's insert=).

document_url now refuses a mailto: address in which any word starting
with attach or insert (any case) is followed by =, wherever it stands
and after each layer of percent-decoding. It also refuses text that
some email tools decode before reading the address: RFC 2047 encoded
words, which KMail decodes across the whole address, and backslash
escapes, which xdg-email's echo decodes. The link is refused rather
than rewritten: PdfCraft doesn't change what a document asks to open,
and the email apps' parsers disagree with one another.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Security: show a link's host as the browser receives it, in punycode

Follow-up to #104. The link prompt's host now comes from
links::display_host, which reads it with url::Url: the webbrowser crate
hands the OS that crate's serialisation, and the web build's browser
parses by the same WHATWG standard. International hosts are shown in
punycode with a note, a label mixing writing systems (UTS #39 resolved
script sets) gets a red warning, numeric hosts such as 3232235777 show
as 192.168.1.1, and a host the browser would reject is refused as
malformed. The Unicode form isn't repeated in the prompt, so a
whole-script lookalike can't read as the real site.

url, idna and icu_properties become direct dependencies of
pdfcraft-engine; all three were already in the graph.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Security: refuse document addresses the URL parser rejects

Follow-up to #104. egui opens links through the webbrowser crate, which
parses the address with url::Url and, when that fails, treats it as a
local file path and opens file:///<cwd>/<address> in the browser.
document_url accepted addresses that don't parse, such as
mailto://a^b/x or https://a^b/ (a forbidden host code point), so a
document could still get the browser to open a local path.

document_url now also requires url::Url to accept the address with the
same scheme, which is exactly the parse webbrowser does first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                       |   6 +-
 Cargo.lock                             |   3 +
 crates/engine/Cargo.toml               |   5 +
 crates/engine/src/links.rs             | 335 ++++++++++++++++++++++++-
 crates/ui-egui/src/dialogs.rs          |  14 +-
 crates/ui-egui/src/i18n/es.tsv         |   2 +
 crates/ui-egui/src/i18n/fr.tsv         |   2 +
 crates/ui-egui/src/i18n/zh-hans.tsv    |   2 +
 crates/ui-egui/src/lib.rs              |  13 +-
 crates/ui-egui/tests/document_links.rs |  67 ++++-
 parity/acrobat-features.toml           |   4 +-
 11 files changed, 439 insertions(+), 14 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 0d355408..5549859e 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cac5e47a10ff49a6d41d87869fda1760778b533319f8ccec2b4e8e67b8a8e0dd"
+sha256 = "d55df478f60a8a8185cdbc428d7f1c276b7ab21a8a4024faf0e978387fd3189e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6d2da5a55e6eb10e26efbdd4d34e48be30c2cad8e3f43e1fe811d8ce95dd0a19"
+sha256 = "51982e7f71c598aa1fd23f1883cc84ee69ca15b4cd31671015328fb18e187e0b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2be55ac9d1303fea2d61f3f6c594cf5003e2b2aa405eefddffed2ea158a94b5e"
+sha256 = "41b46b0540aead4c11b4a30b72758f6fa90888a544c18108a8c55d3682e1da2a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
diff --git a/Cargo.lock b/Cargo.lock
index 2520b60a..e229f2c6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3573,6 +3573,8 @@ name = "pdfcraft-engine"
 version = "0.4.0"
 dependencies = [
  "chrono",
+ "icu_properties",
+ "idna",
  "image",
  "pdfcraft-a11y",
  "pdfcraft-annot",
@@ -3598,6 +3600,7 @@ dependencies = [
  "pdfcraft-xfdf",
  "png 0.18.1",
  "thiserror 2.0.21",
+ "url",
 ]
 
 [[package]]
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 272698ea..5fbc9a4b 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -34,6 +34,11 @@ pdfcraft-create = { workspace = true }
 pdfcraft-model = { workspace = true }
 thiserror = { workspace = true }
 png = "0.18"
+# Already in the graph (url and idna through webbrowser, icu_properties through boa): they show
+# the host of a document's link the way the browser reads it (links::display_host).
+url = "2.5"
+idna = "1.1"
+icu_properties = "2.3"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # Already in the graph through lopdf; used only for the local UTC offset ("today").
diff --git a/crates/engine/src/links.rs b/crates/engine/src/links.rs
index 8255daa4..683d5648 100644
--- a/crates/engine/src/links.rs
+++ b/crates/engine/src/links.rs
@@ -1,6 +1,8 @@
 //! Where PdfCraft and the ArtCraft community live on the web. One table, so the Help menu, the
 //! About dialog, the home screen, the CLI and the README agree.
 
+use icu_properties::props::Script;
+
 /// The app's name in ArtCraft URLs (`getartcraft.com/apps/{APP}`, `github.com/storytold/{APP}`).
 pub const APP: &str = "pdfcraft";
 
@@ -53,6 +55,13 @@ pub enum BlockedLink {
     Malformed,
     /// A scheme other than [`DOCUMENT_SCHEMES`] (lowercased).
     Scheme(String),
+    /// An email address asking the email app to attach a local file (`attach=`, `attachment=`)
+    /// or read one into the message (`insert=`).
+    MailFile,
+    /// An email address containing text that some email tools decode before reading the address,
+    /// so it could spell `attach`: an RFC 2047 encoded word (`=?utf-8?q?…?=`) or a backslash
+    /// escape (`\0141`, `\x61`).
+    MailEncodedWord,
 }
 
 impl std::fmt::Display for BlockedLink {
@@ -63,6 +72,8 @@ impl std::fmt::Display for BlockedLink {
             Self::Hidden => write!(f, "the address contains hidden or invisible characters"),
             Self::Malformed => write!(f, "the address isn't a complete web or email address"),
             Self::Scheme(s) => write!(f, "it is a “{s}:” address"),
+            Self::MailFile => write!(f, "it asks your email app to attach or insert a file from your computer"),
+            Self::MailEncodedWord => write!(f, "it contains encoded text that some email apps turn into other instructions"),
         }
     }
 }
@@ -103,14 +114,106 @@ pub fn document_url(raw: &str) -> Result<String, BlockedLink> {
     }
     let complete = match scheme.as_str() {
         "mailto" => !rest.is_empty(),
-        _ => authority(url).is_some_and(|a| !a.contains(' ')) && host(url).is_some(),
+        _ => authority(url).is_some_and(|a| !a.contains(' ')) && display_host(url).is_some(),
     };
-    if !complete {
+    // The desktop app opens addresses through the webbrowser crate, which treats one the WHATWG URL
+    // parser rejects as a local file path and opens that instead (`mailto://a^b/` would become
+    // `file:///…/mailto:/a^b/`). So only an address the parser accepts, as the same scheme, goes on.
+    if !complete || !url::Url::parse(url).is_ok_and(|u| u.scheme() == scheme) {
         return Err(BlockedLink::Malformed);
     }
+    if scheme == "mailto" {
+        check_mail_parameters(rest)?;
+    }
     Ok(url.to_string())
 }
 
+/// Email-address parameters that make an email app read a file from the user's computer: Evolution,
+/// KMail and Claws Mail attach the file named by `attach` (Evolution and KMail also by
+/// `attachment`), and Claws Mail reads an `insert` file into the message body. Names are matched as
+/// prefixes, so `attachments` is refused too.
+const MAIL_FILE_PARAMETERS: &[&str] = &["attach", "insert"];
+
+/// How many layers of percent-encoding are looked through. Email apps decode once at most.
+const MAIL_DECODE_LAYERS: usize = 8;
+
+/// Refuse an email address (what follows `mailto:`) that asks for a local file. A document can't
+/// need this, and a drafted message carrying the user's files is one click from being sent.
+///
+/// Email apps disagree on how they read the address, so this doesn't try to parse it the way any
+/// one of them does. Every email app reads a parameter as `name=value`, so it refuses any word
+/// that starts with one of [`MAIL_FILE_PARAMETERS`] (in any case) and is followed by `=`, wherever
+/// it stands: after `?`, `&`, `#` or `;` (KMail looks for the first `?` anywhere and reads `&#38;`
+/// as `&`), with no `?` at all (xdg-email reads `mailto:a@example.org&attach=…` as a parameter) or
+/// after a comma (xdg-email copies the subject into Thunderbird's comma-separated `-compose`
+/// argument). The check is repeated after each layer of percent-decoding (KMail decodes names, so
+/// `%61ttach` is `attach`). A word without `=` (`Please attach the invoice`) is fine.
+///
+/// The address is refused, not stripped of the parameter: PdfCraft never rewrites what a document
+/// asks to open, and a stripped address could still be read differently by some email app.
+fn check_mail_parameters(rest: &str) -> Result<(), BlockedLink> {
+    let mut text = rest.to_string();
+    for _ in 0..MAIL_DECODE_LAYERS {
+        check_mail_layer(&text)?;
+        let decoded = String::from_utf8_lossy(&percent_decode(text.as_bytes())).into_owned();
+        if decoded == text {
+            return Ok(());
+        }
+        text = decoded;
+    }
+    check_mail_layer(&text)
+}
+
+/// One layer of [`check_mail_parameters`].
+fn check_mail_layer(text: &str) -> Result<(), BlockedLink> {
+    // KMail decodes RFC 2047 encoded words (`=?utf-8?q?attach?=`) across the whole address before
+    // reading it, and its decoder is lenient, so any `=?` followed later by `?=` is refused.
+    if text.find("=?").is_some_and(|i| text.get(i + 2..).is_some_and(|after| after.contains("?="))) {
+        return Err(BlockedLink::MailEncodedWord);
+    }
+    // xdg-email passes the address through `echo`, which turns `\0141` (octal) or `\x61` into `a`.
+    if text.split('\\').skip(1).any(|after| after.starts_with(|c: char| c.is_ascii_digit() || matches!(c, 'x' | 'X'))) {
+        return Err(BlockedLink::MailEncodedWord);
+    }
+    let lower = text.to_ascii_lowercase();
+    let is_word = |c: char| c.is_ascii_alphanumeric() || matches!(c, '_' | '-');
+    let mut previous = None;
+    for (i, c) in lower.char_indices() {
+        let starts_word = is_word(c) && !previous.is_some_and(is_word);
+        previous = Some(c);
+        if !starts_word {
+            continue;
+        }
+        let Some(word) = lower.get(i..) else { continue };
+        let name_end = word.find(|c: char| !is_word(c)).unwrap_or(word.len());
+        let (name, after) = word.split_at(name_end);
+        let asks = MAIL_FILE_PARAMETERS.iter().any(|p| name.starts_with(p));
+        if asks && after.trim_start_matches([' ', '\t', '+', '\'', '"']).starts_with('=') {
+            return Err(BlockedLink::MailFile);
+        }
+    }
+    Ok(())
+}
+
+/// Decode `%XX` escapes. A `%` not followed by two hex digits is kept as it is.
+fn percent_decode(s: &[u8]) -> Vec<u8> {
+    let hex = |b: Option<&u8>| b.and_then(|b| char::from(*b).to_digit(16)).and_then(|d| u8::try_from(d).ok());
+    let mut out = Vec::with_capacity(s.len());
+    let mut i = 0;
+    while let Some(&b) = s.get(i) {
+        if b == b'%'
+            && let (Some(high), Some(low)) = (hex(s.get(i + 1)), hex(s.get(i + 2)))
+        {
+            out.push((high << 4) | low);
+            i += 3;
+        } else {
+            out.push(b);
+            i += 1;
+        }
+    }
+    out
+}
+
 /// The authority of a web address: what follows `//`, up to the first `/`, `\`, `?` or `#`.
 /// Browsers read `\` as `/` in web addresses (the WHATWG URL standard), so it ends the authority
 /// too; otherwise `https://other.example\@trusted.example/` would seem to go to
@@ -138,6 +241,102 @@ pub fn host(url: &str) -> Option<&str> {
     (!host.is_empty()).then_some(host)
 }
 
+/// How to show a web address's host so that a lookalike can't pass for a familiar site.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct HostDisplay {
+    /// The host the browser connects to: lowercase ASCII, with international labels in punycode
+    /// (`xn--…`) and numeric addresses in their usual form (`192.168.1.1`, `[::1]`). Show this one,
+    /// not the document's spelling.
+    pub ascii: String,
+    /// The host has a label in another alphabet (`xn--…`), whose letters can look like familiar
+    /// ones.
+    pub international: bool,
+    /// A label mixes writing systems, such as the Cyrillic `а` in `pаypal.com`: a common way to
+    /// imitate another site's name.
+    pub mixed_scripts: bool,
+}
+
+/// The host of a web address as the browser will see it (see [`HostDisplay`]). On the desktop the
+/// address is handed to the operating system as the `url` crate (the WHATWG URL standard)
+/// serialises it, and in the browser build the browser parses it by the same standard, so this
+/// reads the host with that crate: percent-decoded, IDNA-mapped (case, fullwidth letters, `。`) and
+/// with numeric hosts such as `0x7f.1` resolved. `None` for a non-web address, one without a host
+/// (see [`host`]), or one the browser would reject.
+pub fn display_host(url: &str) -> Option<HostDisplay> {
+    host(url)?;
+    let parsed = url::Url::parse(url).ok()?;
+    let ascii = match parsed.host()? {
+        url::Host::Domain(d) => d.to_string(),
+        url::Host::Ipv4(a) => a.to_string(),
+        url::Host::Ipv6(a) => format!("[{a}]"),
+    };
+    if !ascii.split('.').any(|label| label.starts_with("xn--")) {
+        return Some(HostDisplay { ascii, international: false, mixed_scripts: false });
+    }
+    let (unicode, valid) = idna::domain_to_unicode(&ascii);
+    let mixed_scripts = valid.is_err() || unicode.split('.').any(mixes_scripts);
+    Some(HostDisplay { ascii, international: true, mixed_scripts })
+}
+
+/// A writing system for comparing the characters of a label. Han characters are written with
+/// Japanese, Korean and Chinese ones, so those three combinations count as one system each
+/// (Unicode TR 39's augmented script sets).
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Writing {
+    Script(Script),
+    Japanese,
+    Korean,
+    Chinese,
+}
+
+/// The writing systems a character belongs to, or `None` for one shared by all (digits, `-`,
+/// combining marks).
+fn writing_systems(c: char) -> Option<Vec<Writing>> {
+    let scripts = icu_properties::script::ScriptWithExtensions::new().get_script_extensions_val(c);
+    let mut out = Vec::new();
+    for s in scripts.iter() {
+        if s == Script::Common || s == Script::Inherited {
+            return None;
+        }
+        out.push(Writing::Script(s));
+        match s {
+            Script::Han => out.extend([Writing::Japanese, Writing::Korean, Writing::Chinese]),
+            Script::Hiragana | Script::Katakana => out.push(Writing::Japanese),
+            Script::Hangul => out.push(Writing::Korean),
+            Script::Bopomofo => out.push(Writing::Chinese),
+            _ => {}
+        }
+    }
+    Some(out)
+}
+
+/// The writing systems every character of `label` belongs to (Unicode TR 39's resolved script
+/// set), skipping characters that `skip` picks. `None` when no character narrows it down.
+fn shared_writing(label: &str, skip: impl Fn(&[Writing]) -> bool) -> Option<Vec<Writing>> {
+    let mut shared: Option<Vec<Writing>> = None;
+    for systems in label.chars().filter_map(writing_systems) {
+        if skip(&systems) {
+            continue;
+        }
+        shared = Some(match shared {
+            None => systems,
+            Some(s) => s.into_iter().filter(|w| systems.contains(w)).collect(),
+        });
+    }
+    shared
+}
+
+/// Whether a label mixes writing systems. Latin alongside Japanese, Korean or Chinese is allowed, as
+/// in Unicode TR 39's "highly restrictive" level (`ソニーstore`).
+fn mixes_scripts(label: &str) -> bool {
+    if shared_writing(label, |_| false).is_none_or(|s| !s.is_empty()) {
+        return false;
+    }
+    let latin = Writing::Script(Script::Latin);
+    let rest = shared_writing(label, |s| s.contains(&latin)).unwrap_or_default();
+    !rest.iter().any(|w| matches!(w, Writing::Japanese | Writing::Korean | Writing::Chinese))
+}
+
 #[cfg(test)]
 mod tests {
     #[test]
@@ -223,4 +422,136 @@ mod tests {
         assert_eq!(host("mailto:a@example.org"), None);
         assert_eq!(host("https:///nohost"), None);
     }
+
+    #[test]
+    fn addresses_the_url_parser_rejects_are_refused() {
+        use super::{BlockedLink as B, document_url};
+        // The webbrowser crate would open each of these as a local file path.
+        for bad in ["mailto://a^b/x", "mailto://a:99999/", "mailto://[x]/", "mailto://a\\b/", "mailto://a b/", "https://a^b/", "http://a<b/"] {
+            assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
+        }
+        for ok in ["mailto://example.org/x", "mailto:a@example.org?subject=a b"] {
+            assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
+        }
+    }
+
+    #[test]
+    fn email_links_may_not_ask_for_a_local_file() {
+        use super::{BlockedLink as B, document_url};
+        for bad in [
+            // Evolution, KMail and Claws Mail attach the named file.
+            "mailto:a@example.org?attach=/home/me/.ssh/id_ed25519",
+            "mailto:a@example.org?subject=Hi&attachment=file:///etc/passwd",
+            // Claws Mail reads an `insert` file into the message body.
+            "mailto:a@example.org?insert=/home/me/notes.txt",
+            // Names are matched case-insensitively (Evolution, KMail) and after percent-decoding (KMail).
+            "mailto:a@example.org?ATTACH=x",
+            "mailto:a@example.org?Attachment=x",
+            "mailto:a@example.org?%61ttach=x",
+            "mailto:a@example.org?%2561ttach=x",
+            "mailto:a@example.org?%49NSERT=x",
+            "mailto:a@example.org?attach%3D/etc/passwd",
+            // An empty value, a repeated name, spaces or quotes before `=`.
+            "mailto:a@example.org?attach=",
+            "mailto:a@example.org?subject=a&attach=x&attach=y",
+            "mailto:a@example.org?subject=a& attach =x",
+            "mailto:a@example.org?subject=a&'attachment'='x'",
+            // No recipient, no `?` at all (xdg-email), a second `?`, and a `?` that only exists once decoded.
+            "mailto:?attach=x",
+            "mailto:a@example.org&attach=/etc/passwd",
+            "mailto:a@example.org?subject=a?attach=x",
+            "mailto:a@example.org%3Fattach=x",
+            // KMail reads the query from the first `?` even inside a fragment, and reads `&#38;` as `&`.
+            "mailto:a@example.org#?attach=x",
+            "mailto:a@example.org?subject=a#&attach=x",
+            "mailto:a@example.org?subject=a&#38;attach=x",
+            "mailto:a@example.org?subject=a;attach=x",
+            // An encoded `&`, and a comma (xdg-email copies the subject into a comma-separated list).
+            "mailto:a@example.org?subject=a%26attach=x",
+            "mailto:a@example.org?subject=a,attachment='/etc/passwd'",
+            // A `+`, an encoded tab or an encoded space between the name and `=`.
+            "mailto:a@example.org?attach+=x",
+            "mailto:a@example.org?attach%09=x",
+            "mailto:a@example.org?attach%20=x",
+        ] {
+            assert_eq!(document_url(bad), Err(B::MailFile), "{bad}");
+        }
+        // KMail decodes RFC 2047 encoded words across the whole address before reading it, so
+        // `=?utf-8?q?attach?=` could become `attach`. Such words never belong in a link.
+        for bad in [
+            "mailto:a@example.org?=?utf-8?q?attach?==/etc/passwd",
+            "mailto:a@example.org?subject==?UTF-8?B?YXR0YWNo?=",
+            "mailto:a@example.org?subject=%3D%3Futf-8%3Fq%3Fattach%3F%3D",
+            "mailto:a@example.org?subject==??q?attach?=",
+            "mailto:a@example.org?subject==?utf-8?base64?YXR0YWNo?=",
+            // Backslash escapes that `echo` in xdg-email decodes, raw and percent-encoded.
+            "mailto:a@example.org?\\0141ttach=x",
+            "mailto:x\\x61ttachment=y",
+            "mailto:a@example.org?%5C0141ttach=x",
+        ] {
+            assert_eq!(document_url(bad), Err(B::MailEncodedWord), "{bad}");
+        }
+        for ok in [
+            "mailto:orders@example.org?subject=Order form&body=Please attach the invoice",
+            "mailto:a@example.org?subject=Attachments%20to%20follow",
+            "mailto:a@example.org?body=Questions%3F%20Attach%20your%20CV",
+            "mailto:a@example.org?body=Hi%3B%20insert%20your%20name",
+            "mailto:a@example.org?cc=b@example.org&bcc=c@example.org&in-reply-to=%3Cid@example.org%3E",
+            "mailto:attach@example.org",
+            "mailto:a@example.org?attach",
+            "mailto:a@example.org?x-attach=1&reattach=2",
+            "mailto:a@example.org?body=Saved in C:\\Users\\me\\Documents",
+        ] {
+            assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
+        }
+    }
+
+    #[test]
+    fn hosts_are_shown_as_the_browser_receives_them() {
+        use super::{BlockedLink as B, HostDisplay, display_host, document_url};
+        let plain = |a: &str| Some(HostDisplay { ascii: a.into(), international: false, mixed_scripts: false });
+        assert_eq!(display_host("https://example.org/path"), plain("example.org"));
+        assert_eq!(display_host("HTTPS://EXAMPLE.ORG/"), plain("example.org"), "lowercased, as the browser does");
+        assert_eq!(display_host("https://example.org./"), plain("example.org."));
+        assert_eq!(display_host("https://ex%61mple.org/"), plain("example.org"), "percent-decoded, as the browser does");
+        assert_eq!(display_host("https://ｅｘａｍｐｌｅ。org/"), plain("example.org"), "fullwidth letters and `。` are mapped");
+        assert_eq!(display_host("https://trusted.example@other.example/"), plain("other.example"));
+        assert_eq!(display_host("https://other.example\\@trusted.example/"), plain("other.example"));
+        assert_eq!(display_host("mailto:a@example.org"), None);
+        // Numeric hosts in the form the browser connects to, so a local address can't hide.
+        assert_eq!(display_host("https://[::1]:8443/"), plain("[::1]"));
+        assert_eq!(display_host("https://[0:0:0:0:0:0:0:1]/"), plain("[::1]"));
+        assert_eq!(display_host("http://3232235777/"), plain("192.168.1.1"));
+        assert_eq!(display_host("http://0x7f.1/"), plain("127.0.0.1"));
+        assert_eq!(display_host("http://0300.0250.01.01/"), plain("192.168.1.1"));
+
+        // International hosts are shown in punycode and marked.
+        let bucher = display_host("https://bücher.example/").unwrap();
+        assert_eq!(bucher, HostDisplay { ascii: "xn--bcher-kva.example".into(), international: true, mixed_scripts: false });
+        assert!(!display_host("https://ソニーstore.example/").unwrap().mixed_scripts, "Latin with Japanese is normal (UTS #39)");
+        assert!(!display_host("https://example.ελ/").unwrap().mixed_scripts, "scripts are compared within a label, not across labels");
+        // Cyrillic `а` (U+0430) in a Latin name: punycode, and flagged as mixed.
+        let lookalike = display_host("https://p\u{0430}ypal.com/").unwrap();
+        assert_eq!(lookalike, HostDisplay { ascii: "xn--pypal-4ve.com".into(), international: true, mixed_scripts: true });
+        // The same lookalike written in punycode in the document, and upper-case.
+        assert_eq!(display_host("https://XN--PYPAL-4VE.com/"), Some(lookalike));
+        // A whole-script lookalike (all Cyrillic) isn't mixed, but is still shown in punycode, marked.
+        let cyrillic = display_host("https://\u{0430}\u{0440}\u{0440}\u{04CF}\u{0435}.com/").unwrap();
+        assert!(cyrillic.ascii.starts_with("xn--") && cyrillic.international && !cyrillic.mixed_scripts, "{cyrillic:?}");
+
+        // A host the browser can't turn into an address is refused rather than shown.
+        for bad in [
+            "https://xn--a.example/",
+            "https://exa%FFmple.org/",
+            "https://\u{0300}a.example/",
+            "https://%E2%80%AEexample.org/",
+            "https://trusted.example%40other.example/",
+            "https://[evil.example]/",
+            "https://example.org:port/",
+            "https://example.org:99999/",
+        ] {
+            assert_eq!(display_host(bad), None, "{bad}");
+            assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
+        }
+    }
 }
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 14135534..fc2a610d 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1423,8 +1423,18 @@ fn link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
         };
         ui.label(crate::i18n::fmt(template, &[("who", tl!(pending.origin.noun()))]));
         ui.add_space(6.0);
-        if let Some(host) = pdfcraft_engine::links::host(&pending.url) {
-            ui.label(egui::RichText::new(host).font(theme::semibold(14.0)));
+        // The host as the browser will connect to it, in punycode when it is international, so a
+        // lookalike such as `pаypal.com` (Cyrillic `а`) reads as `xn--pypal-4ve.com`. Its Unicode
+        // form isn't repeated here: a whole-script lookalike would read as the real site.
+        if let Some(host) = pdfcraft_engine::links::display_host(&pending.url) {
+            ui.label(egui::RichText::new(&host.ascii).font(theme::semibold(14.0)));
+            if host.mixed_scripts {
+                let warning = tl!("This web address mixes letters from different alphabets, a common way to imitate another site's name.");
+                ui.add(egui::Label::new(egui::RichText::new(warning).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B))).wrap());
+            } else if host.international {
+                let note = tl!("This web address uses letters from another alphabet, which can look like familiar ones.");
+                ui.add(egui::Label::new(egui::RichText::new(note).color(t.text)).wrap());
+            }
         }
         egui::ScrollArea::vertical().max_height(120.0).show(ui, |ui| {
             ui.add(egui::Label::new(egui::RichText::new(&pending.url).monospace().small()).wrap().selectable(true));
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 38ee8949..f57ccb83 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1934,6 +1934,8 @@
 	Write this email?	¿Escribir este correo?
 	{who} in this document wants to open this address in your browser:	{who} de este documento quiere abrir esta dirección en tu navegador:
 	{who} in this document wants to open your email app with this address:	{who} de este documento quiere abrir tu aplicación de correo con esta dirección:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Esta dirección web mezcla letras de distintos alfabetos, una forma habitual de imitar el nombre de otro sitio.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Esta dirección web usa letras de otro alfabeto, que pueden parecerse a letras conocidas.
 	Create PDF from images	Crear PDF a partir de imágenes
 	Selected image files: {count}	Archivos de imagen seleccionados: {count}
 	Use image resolution	Usar la resolución de la imagen
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index d5de2b08..5f75508f 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1877,6 +1877,8 @@
 	Write this email?	Écrire ce courriel ?
 	{who} in this document wants to open this address in your browser:	{who} dans ce document veut ouvrir cette adresse dans votre navigateur :
 	{who} in this document wants to open your email app with this address:	{who} dans ce document veut ouvrir votre application de courrier avec cette adresse :
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Cette adresse web mélange des lettres d'alphabets différents, un moyen courant d'imiter le nom d'un autre site.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Cette adresse web utilise des lettres d'un autre alphabet, qui peuvent ressembler à des lettres familières.
 	Create PDF from images	Créer un PDF à partir d'images
 	Selected image files: {count}	Fichiers d'image sélectionnés : {count}
 	Use image resolution	Utiliser la résolution de l'image
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 34fa5b9f..6ad1c90e 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -1977,6 +1977,8 @@
 	Write this email?	是否撰写此邮件？
 	{who} in this document wants to open this address in your browser:	此文档中的{who}请求在浏览器中打开以下地址：
 	{who} in this document wants to open your email app with this address:	此文档中的{who}请求打开邮件应用并使用以下地址：
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	此网址混用了不同字母表的字母，这是仿冒其他网站名称的常见手法。
+	This web address uses letters from another alphabet, which can look like familiar ones.	此网址使用了其他字母表的字母，它们可能看起来像熟悉的字母。
 	CheckBox	复选框
 	Create link	创建链接
 	Duplicate field	复制字段
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index a8f0fc20..400ce5df 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -971,10 +971,15 @@ impl PdfCraftApp {
                     self.pending_link = Some(PendingLink { url, origin });
                 }
             }
-            Err(e) => self.notify_fmt(
-                "{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.",
-                &[("who", tl!(origin.noun())), ("e", &e.to_string())],
-            ),
+            Err(e) => {
+                use pdfcraft_engine::links::BlockedLink;
+                let template = if matches!(e, BlockedLink::MailFile | BlockedLink::MailEncodedWord) {
+                    "{who} in this document tried to open an address PdfCraft won't open: {e}."
+                } else {
+                    "{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents."
+                };
+                self.notify_fmt(template, &[("who", tl!(origin.noun())), ("e", &e.to_string())]);
+            }
         }
     }
 
diff --git a/crates/ui-egui/tests/document_links.rs b/crates/ui-egui/tests/document_links.rs
index b7857ba8..a866a916 100644
--- a/crates/ui-egui/tests/document_links.rs
+++ b/crates/ui-egui/tests/document_links.rs
@@ -156,7 +156,17 @@ fn a_script_asks_first_and_only_once() {
 #[test]
 fn a_script_cannot_open_other_kinds_of_address() {
     let _gpu = gpu();
-    for url in ["file:///etc/passwd", "javascript:alert(1)", "ms-settings:privacy", "smb://server/share", "https://exa\u{202E}gro.elpmaxe"] {
+    // `mailto://a^b/x` and `https://a^b/` don't parse as URLs, so the browser would be handed them
+    // as local file paths.
+    for url in [
+        "file:///etc/passwd",
+        "javascript:alert(1)",
+        "ms-settings:privacy",
+        "smb://server/share",
+        "https://exa\u{202E}gro.elpmaxe",
+        "mailto://a^b/x",
+        "https://a^b/",
+    ] {
         let mut h = harness();
         let id = h.state().views[0].id;
         let script = format!("app.launchURL({});", serde_json::to_string(url).unwrap());
@@ -167,3 +177,58 @@ fn a_script_cannot_open_other_kinds_of_address() {
         assert!(h.state().toast.clone().is_some_and(|t| t.0.contains("won't open")), "{url}: {:?}", h.state().toast);
     }
 }
+
+#[test]
+fn an_email_link_cannot_attach_a_local_file() {
+    let _gpu = gpu();
+    for url in ["mailto:a@example.org?attach=/home/me/.ssh/id_ed25519", "mailto:a@example.org?subject=Hi&%61ttachment=C:/Users/me/x.txt"] {
+        let mut h = harness();
+        let id = h.state().views[0].id;
+        let script = format!("app.launchURL({});", serde_json::to_string(url).unwrap());
+        h.state_mut().run_button_script(id, "web", &script);
+        h.run_steps(3);
+        assert_eq!(h.state().pending_link, None, "{url}");
+        assert_eq!(h.state().last_opened_url, None, "{url}");
+        let toast = h.state().toast.clone().expect("the user is told").0;
+        assert!(toast.contains("attach or insert a file"), "{url}: {toast}");
+    }
+}
+
+/// Ask to open `url` from a script and return the harness with the prompt showing.
+fn prompt_for(url: &str) -> Harness<'static, PdfCraftApp> {
+    let mut h = harness();
+    let id = h.state().views[0].id;
+    let script = format!("app.launchURL({});", serde_json::to_string(url).unwrap());
+    h.state_mut().run_button_script(id, "web", &script);
+    h.run_steps(3);
+    assert_eq!(h.state().pending_link, pending(url, LinkOrigin::Script));
+    h
+}
+
+#[test]
+fn a_lookalike_host_is_shown_in_punycode_and_flagged() {
+    let _gpu = gpu();
+    // `pаypal.com` with a Cyrillic `а` (U+0430).
+    let h = prompt_for("https://p\u{0430}ypal.com/login");
+    h.get_by_label("xn--pypal-4ve.com");
+    assert_eq!(h.query_all_by_label_contains("p\u{0430}ypal.com").count(), 1, "only the full address shows the lookalike form");
+    h.get_by_label_contains("mixes letters from different alphabets");
+}
+
+#[test]
+fn an_international_host_is_shown_in_punycode_and_marked() {
+    let _gpu = gpu();
+    let h = prompt_for("https://bücher.example/");
+    h.get_by_label("xn--bcher-kva.example");
+    assert_eq!(h.query_all_by_label_contains("bücher.example").count(), 1, "only the full address shows the Unicode form");
+    h.get_by_label_contains("letters from another alphabet");
+    assert!(h.query_by_label_contains("mixes letters").is_none());
+}
+
+#[test]
+fn a_numeric_host_is_shown_as_the_address_it_goes_to() {
+    let _gpu = gpu();
+    let h = prompt_for("http://3232235777/admin");
+    h.get_by_label("192.168.1.1");
+    assert!(h.query_by_label_contains("alphabet").is_none());
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index f5ddc31c..1f9e8154 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2202,8 +2202,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.link"]
 tools = ["link_add"]
-evidence = ["crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed", "crates/automation/tests/automation.rs::links_through_tools", "crates/ui-egui/tests/document_links.rs::a_link_asks_first_and_opens_when_allowed", "crates/ui-egui/tests/document_links.rs::a_button_uri_action_asks_first"]
-notes = "Opening a document's link or button URI asks first; only http, https and mailto addresses are offered (#90, #91)."
+evidence = ["crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed", "crates/automation/tests/automation.rs::links_through_tools", "crates/ui-egui/tests/document_links.rs::a_link_asks_first_and_opens_when_allowed", "crates/ui-egui/tests/document_links.rs::a_button_uri_action_asks_first", "crates/ui-egui/tests/document_links.rs::an_email_link_cannot_attach_a_local_file", "crates/ui-egui/tests/document_links.rs::a_lookalike_host_is_shown_in_punycode_and_flagged"]
+notes = "Opening a document's link or button URI asks first; only http, https and mailto addresses are offered (#90, #91), and an email address that asks the email app to attach or insert a local file is refused. The prompt shows the host as the browser receives it: international hosts in punycode, lookalikes that mix alphabets flagged, numeric hosts in their usual form."
 
 [[feature]]
 id = "edit.action-launch"

From f540035db32f4acf870773c403ae1555eb74da3c Mon Sep 17 00:00:00 2001
From: Mawfyy <mawfyy12@gmail.com>
Date: Thu, 8 Oct 2026 15:31:31 -0500
Subject: [PATCH 008/149] Issue #124: a long page label no longer overlaps its
 bookmark title (#328)

* Issue #124: a long page label no longer overlaps its bookmark title

The Bookmarks panel painted the destination's page label right-aligned
with no width limit, while the title's wrap width reserved a fixed 36
px for it. Drawing tools put whole section titles in /PageLabels (the
reporter's file uses "Floor Plans (001 Floor Plans): SITE PLAN" as both
title and label), so the label painted straight over the title.

The label now gets a bounded column (72 px) and is ellipsized on
character boundaries by a pure ellipsized_prefix helper; the title
wraps to the width the column really takes. Short labels ("3", "iv",
"1-1") are unchanged, and a label with no page still shows nothing.

Test: panels.rs::label_column (short labels untouched, long labels cut
to the column with an ellipsis and stay a prefix of the real label,
CJK cut on char boundaries, the loop ends when nothing fits). The
overlap itself is verified against the reporter's file (headless shot
of the Bookmarks panel).

Co-authored-by: Mawfyy <mawfy12@gmail.com>

* Bookmark labels: measure at most 64 characters of a page label

A page label is document text; ellipsizing a huge one character by character laid out
thousands of candidates per row per frame.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mawfyy <mawfy12@gmail.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/panels.rs | 103 +++++++++++++++++++++++++++++++++--
 1 file changed, 97 insertions(+), 6 deletions(-)

diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index adc4f0c5..54759477 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -683,6 +683,31 @@ struct OutlineCtx<'a> {
     expand: Option<usize>,
 }
 
+/// The destination page label gets its own right-aligned column in a bookmark row; drawing
+/// tools put whole section titles in /PageLabels, so the column is bounded (#124).
+const LABEL_COLUMN_MAX: f32 = 72.0;
+/// More characters than ever fit [`LABEL_COLUMN_MAX`] at the label size.
+const LABEL_MEASURE_CHARS: usize = 64;
+
+/// The longest head of `text` that `fits`, plus an ellipsis when the whole string doesn't.
+/// Whole characters are dropped from the end, so the string is only ever cut at a char
+/// boundary, and the loop always ends (at the ellipsis alone). A label is document text: only
+/// its first [`LABEL_MEASURE_CHARS`] characters are measured, so a huge one can't make each
+/// frame lay out thousands of candidates.
+fn ellipsized_prefix(text: &str, mut fits: impl FnMut(&str) -> bool) -> String {
+    let mut s: String = text.chars().take(LABEL_MEASURE_CHARS).collect();
+    if s.len() == text.len() && fits(text) {
+        return text.to_owned();
+    }
+    loop {
+        s.pop();
+        let candidate = format!("{s}\u{2026}");
+        if s.is_empty() || fits(&candidate) {
+            return candidate;
+        }
+    }
+}
+
 fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineItem, path: &[usize], siblings: usize, cx: &mut OutlineCtx<'_>) {
     let depth = path.len() - 1;
     let indent = depth as f32 * 16.0;
@@ -720,8 +745,20 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
             }
         }
     } else {
+        // The page label sits right-aligned in its own bounded column, and the title wraps to
+        // what is really left of it — a long label painted over a long title was the overlap
+        // of #124.
+        let label_font = theme::regular(11.0);
+        let label_galley = item.page.and_then(|p| info.pages.get(p)).map(|page| {
+            ui.fonts_mut(|f| {
+                let text =
+                    ellipsized_prefix(&page.label, |s| f.layout_no_wrap(s.to_owned(), label_font.clone(), t.text_faint).size().x <= LABEL_COLUMN_MAX);
+                f.layout_no_wrap(text, label_font, t.text_faint)
+            })
+        });
+        let label_w = label_galley.as_ref().map_or(0.0, |g| g.size().x);
         let font = if depth == 0 { theme::medium(13.0) } else { theme::regular(13.0) };
-        let wrap_w = (ui.available_width() - indent - 20.0 - 36.0).max(60.0);
+        let wrap_w = (ui.available_width() - indent - 20.0 - label_w - 12.0).max(60.0);
         let galley = ui.fonts_mut(|f| f.layout(item.title.clone(), font, t.text, wrap_w));
         let h = (galley.size().y + 12.0).max(28.0);
         let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), h), Sense::click());
@@ -739,10 +776,11 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
             }
         }
         ui.painter().galley(pos2(x0 + 20.0, rect.top() + 6.0), galley, t.text);
-        if let Some(p) = item.page
-            && let Some(page) = info.pages.get(p)
-        {
-            ui.painter().text(rect.right_top() + vec2(-6.0, 14.0), Align2::RIGHT_CENTER, &page.label, theme::regular(11.0), t.text_faint);
+        if let Some(g) = label_galley {
+            // Right-aligned, vertically centred at the first line, inside the column the title
+            // wrapped around.
+            let pos = pos2(rect.right() - 6.0 - g.size().x, rect.top() + 14.0 - g.size().y / 2.0);
+            ui.painter().galley(pos, g, t.text_faint);
         }
         if resp.clicked()
             && let Some(p) = item.page
@@ -929,7 +967,60 @@ fn fields(
 pub fn human_size(n: usize) -> String {
     match n {
         n if n >= 1 << 20 => format!("{:.1} MB", n as f64 / (1u64 << 20) as f64),
-        n if n >= 1 << 10 => format!("{:.1} KB", n as f64 / 1024.0),
+        n if n >= 1 << 10 => format!("{:.1} KB", n as f64 / (1u64 << 10) as f64),
         n => format!("{n} bytes"),
     }
 }
+
+#[cfg(test)]
+mod label_column {
+    use super::ellipsized_prefix;
+
+    /// A short page label (the usual "3", "iv", "1-1") is shown unchanged.
+    #[test]
+    fn short_labels_are_not_touched() {
+        for label in ["3", "iv", "1-1", "A-201"] {
+            assert_eq!(ellipsized_prefix(label, |s| s.len() <= 10), label);
+        }
+    }
+
+    /// A label wider than its column (#124: whole section titles in /PageLabels) keeps only
+    /// the head that fits, with an ellipsis, and that head is a prefix of the real label.
+    #[test]
+    fn long_labels_are_cut_to_their_column_with_an_ellipsis() {
+        let label = "Floor Plans (001 Floor Plans): GROUND FLOOR PLAN";
+        let shown = ellipsized_prefix(label, |s| s.len() <= 20);
+        assert!(shown.ends_with('\u{2026}'), "{shown:?}");
+        assert!(shown.len() <= 20, "{shown:?}");
+        assert!(label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
+    }
+
+    /// CJK labels (three bytes per character) are cut on character boundaries too.
+    #[test]
+    fn multibyte_labels_are_cut_on_char_boundaries() {
+        let label = "図面（一階平面図）：配置図";
+        let shown = ellipsized_prefix(label, |s| s.len() <= 12);
+        assert!(shown.ends_with('\u{2026}'), "{shown:?}");
+        assert!(shown.len() <= 12, "{shown:?}");
+        assert!(label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
+    }
+
+    /// The pathological floor: nothing fits, the loop still ends with the lone ellipsis.
+    #[test]
+    fn the_loop_ends_when_nothing_fits() {
+        assert_eq!(ellipsized_prefix("Floor Plans", |_| false), "\u{2026}");
+    }
+
+    /// A huge label from a hostile file is measured a bounded number of times per frame.
+    #[test]
+    fn a_huge_label_is_measured_a_bounded_number_of_times() {
+        let label = "x".repeat(1_000_000);
+        let mut calls = 0;
+        let shown = ellipsized_prefix(&label, |s| {
+            calls += 1;
+            s.len() <= 12
+        });
+        assert!(calls <= super::LABEL_MEASURE_CHARS + 1, "{calls} measurements");
+        assert!(shown.ends_with('\u{2026}') && label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
+    }
+}

From e17833a64eef4880731a056af1b021789b39cc36 Mon Sep 17 00:00:00 2001
From: Devon Llewellyn <139090831+remesis@users.noreply.github.com>
Date: Thu, 8 Oct 2026 16:36:26 -0400
Subject: [PATCH 009/149] Add image signatures with placement preview and
 resize controls (#335)

* M5.7: import images as Fill & Sign signatures and initials

* M5.7: preview image signatures and select after placement
---
 ATTRIBUTION.toml                      |  14 +-
 ROADMAP.md                            |   5 +-
 crates/a11y/src/alt.rs                |   6 +-
 crates/annot/README.md                |   2 +
 crates/annot/src/lib.rs               |  23 +-
 crates/automation/src/comments.rs     |  13 +-
 crates/automation/src/tools.rs        |   5 +-
 crates/automation/tests/automation.rs |  66 ++++++
 crates/engine/Cargo.toml              |   2 +-
 crates/engine/src/lib.rs              |   5 +-
 crates/engine/src/signature_image.rs  | 186 +++++++++++++++++
 crates/optimize/src/images.rs         |   6 +-
 crates/ui-egui/Cargo.toml             |   3 +-
 crates/ui-egui/src/a11y_ui.rs         |  13 +-
 crates/ui-egui/src/canvas.rs          |  28 ++-
 crates/ui-egui/src/comments.rs        |   4 +-
 crates/ui-egui/src/dialogs.rs         |  15 +-
 crates/ui-egui/src/editing.rs         |  19 +-
 crates/ui-egui/src/fill_sign.rs       | 260 ++++++++++++++++++++---
 crates/ui-egui/src/i18n/cs.tsv        |   2 +
 crates/ui-egui/src/i18n/es.tsv        |   2 +
 crates/ui-egui/src/i18n/fr.tsv        |   2 +
 crates/ui-egui/src/i18n/ja.tsv        |   2 +
 crates/ui-egui/src/i18n/pt-br.tsv     |   2 +
 crates/ui-egui/src/i18n/zh-hans.tsv   |   2 +
 crates/ui-egui/src/i18n/zh-hant.tsv   |   2 +
 crates/ui-egui/src/lib.rs             |  14 +-
 crates/ui-egui/tests/fill_sign.rs     | 290 +++++++++++++++++++++++++-
 parity/acrobat-features.toml          |   8 +-
 xtask/src/layers.rs                   |   7 +-
 30 files changed, 926 insertions(+), 82 deletions(-)
 create mode 100644 crates/engine/src/signature_image.rs

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 5549859e..bfe6ccec 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d55df478f60a8a8185cdbc428d7f1c276b7ab21a8a4024faf0e978387fd3189e"
+sha256 = "2d0c3c882f0d842230b32834150df3307111b3b91d3c1c403001c78b8f4202df"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "97de2a56aa5cf32d11f22c19f0efeb76cbe16dff769247f49d8bdecbeac34d90"
+sha256 = "bff6a243f40151a20a5082e02a1e7b588e46fca5f7b616ca618e57576b5218e3"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "accf181cff1f0ea86bb33528f6158d1aec18c9c3ff54de62dc758536a24cb677"
+sha256 = "92cd3816ae6f0cf59244f4836cc95a3b12961c88d219dae593fd60dbc6eb8de0"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0ee4d2f630623ef7e06413a7c34a4a0269a2600fba682f06988a1346be4d07a5"
+sha256 = "0cd7b7d0696323e281f7a23ef7511785b6a519c94ddb9d89c2468bcdc44bbc84"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "51982e7f71c598aa1fd23f1883cc84ee69ca15b4cd31671015328fb18e187e0b"
+sha256 = "de653ffb92e6b99e8d390e6c21f5f13ecef198e21be3045e159b86073fbe7f4e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "41b46b0540aead4c11b4a30b72758f6fa90888a544c18108a8c55d3682e1da2a"
+sha256 = "415aa786c8afc8095be14ac9d74b864e968326699ce0130fede5616ccf9e70ad"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f2a9449db49de5226000d0b14b991ab2318a82e4ca63624b11ea4a753ae2ea74"
+sha256 = "d3a89359bdb7c8af830a49a1b574312c65f757e4f69cf221e06f27ea0c0e7373"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index a3c9f48b..b2b1f3c2 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -94,7 +94,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
-| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters. Missing: custom stamps, replace-text proposals, summary layouts with the page |
+| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews and selection for resizing. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M6 | Forms + JavaScript | 160–320 | 45% | 95–185 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 17% | 210–420 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M8 | Security + redaction | 100–180 | 66% | 35–65 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize. Missing: certificate security, redaction codes and pattern locales, DCT re-encoding |
@@ -125,6 +125,9 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 ## Log
 
+- **2026-10-08 (M5.7, signature placement):** Image signatures and initials preview at the pointer at their actual page size, including zoom and document/view rotation. A successful placement switches to Select with the new annotation selected; stamp resize handles use the existing engine edit, automation tool and undo history while preserving the appearance. Synthetic rendered UI and automation tests verify positioning, one placement per selection, resizing, undo/redo and save/reopen. Milestone and overall effort estimates unchanged.
+- **2026-10-08 (M5.7, image signatures):** Fill & Sign imports local PNG/JPEG signatures and initials through the Image tab, with previews, local persistence and undoable placement. The shared engine validates bounded images and preserves transparency and orientation; `fill_sign_add` accepts an image path. Synthetic UI and automation tests cover cancellation, invalid input, settings, undo/redo and save/reopen rendering. Overall effort estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M9, #179):** Windows Current User Personal certificate store identities join file-based digital IDs, signing through CNG without exporting keys. RSA-2048 and ECDSA P-256 round trips use temporary certificates with cleanup guards; enumeration, missing identities, automation errors and the password-free UI have regression coverage. Smart cards and PKCS #11 remain planned; overall effort estimate unchanged.
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
diff --git a/crates/a11y/src/alt.rs b/crates/a11y/src/alt.rs
index 95e272d3..38f0c9f2 100644
--- a/crates/a11y/src/alt.rs
+++ b/crates/a11y/src/alt.rs
@@ -144,10 +144,8 @@ fn content_bbox(doc: &Document, page: &Dict, ids: &HashSet<i64>) -> Option<[f64;
         let top = ctm.last().copied().unwrap_or(Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]));
         match op.op.as_slice() {
             b"q" => ctm.push(top),
-            b"Q" => {
-                if ctm.len() > 1 {
-                    ctm.pop();
-                }
+            b"Q" if ctm.len() > 1 => {
+                ctm.pop();
             }
             b"cm" => {
                 if let Some(m) = Matrix::from_operands(&op.operands)
diff --git a/crates/annot/README.md b/crates/annot/README.md
index b3224b7b..beb0e058 100644
--- a/crates/annot/README.md
+++ b/crates/annot/README.md
@@ -37,6 +37,8 @@ deterministic; the engine supplies them.
   cloudy borders or callouts, instead of leaving a stale appearance.
 - Replies get the parent's `/Rect` and an empty appearance: they appear in comment lists but
   never paint a second icon.
+- Resizing a stamp changes its `/Rect` and preserves its original appearance and resources;
+  viewers scale that appearance into the new rectangle. Locked stamps refuse the edit.
 
 ## Not yet
 
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index a0f76306..77bdc292 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -724,7 +724,6 @@ fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
         | Shape::TextBox { rect, .. }
         | Shape::Typewriter { rect, .. }
         | Shape::Stamp { rect, .. }
-        | Shape::CustomStamp { rect, .. }
         | Shape::TypedSignature { rect, .. }
         | Shape::Mark { rect, .. } => {
             let r = normalize(*rect);
@@ -733,6 +732,14 @@ fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
             }
             r
         }
+        Shape::CustomStamp { rect, .. } => {
+            let r = normalize(*rect);
+            // Image signatures may be very thin; a positive PDF appearance box still works.
+            if !finite(rect) || r[2] <= r[0] || r[3] <= r[1] {
+                return Err(bad("rectangle (empty)"));
+            }
+            r
+        }
         Shape::Line { from, to, arrow } => {
             if !finite(from) || !finite(to) || (from[0] - to[0]).hypot(from[1] - to[1]) < 1.0 {
                 return Err(bad("line (too short)"));
@@ -1353,12 +1360,24 @@ pub fn move_annotation(doc: &mut Document, page: usize, index: usize, dx: f64, d
     Ok(())
 }
 
-/// Resize a rectangle, oval or text box to `rect`; its appearance is redrawn.
+/// Resize a rectangle, oval, text box or stamp to `rect`. Stamps keep their appearance,
+/// which PDF viewers scale from its bounding box into the new rectangle.
 pub fn set_rect(doc: &mut Document, page: usize, index: usize, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
     let (_, r) = annot_ref(doc, page, index)?;
     unlocked(doc, r)?;
     let d = annot_dict(doc, r);
     let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+    if subtype == "Stamp" {
+        let rect = normalize(rect);
+        if !finite(&rect) || rect[2] <= rect[0] || rect[3] <= rect[1] {
+            return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
+        }
+        doc.update_dict(r, |d| {
+            d.set(b"Rect".to_vec(), num_array(&rect));
+            touch(d, meta);
+        })?;
+        return Ok(());
+    }
     if !matches!(subtype.as_str(), "Square" | "Circle" | "FreeText") {
         return Err(AnnotError::Invalid(format!("{subtype} comments can't be resized")));
     }
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index 7b09e4d4..22485246 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -350,13 +350,24 @@ impl Automation {
         let [x, y] = a.need::<2>("at", "Fill & Sign")?;
         let at = to_user(&info, x, y);
         let author = a.opt_str("author")?.unwrap_or(DEFAULT_AUTHOR).to_string();
+        let kind = a.str("type")?;
+        if let Some(path) = a.opt_str("path")? {
+            if !matches!(kind, "signature" | "initials") || a.opt_str("text")?.is_some() {
+                return Err(ToolError::InvalidArgs("path is only for an image signature or initials; pass either path or text".into()));
+            }
+            let path = self.resolve(path, false)?;
+            let file = std::fs::File::open(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?;
+            let image = pdfcraft_engine::SignatureImage::read(file).map_err(|e| ToolError::InvalidArgs(e.to_string()))?;
+            let edit = image.edit(page, at, kind == "initials", &author).ok_or_else(|| ToolError::InvalidArgs("at must be finite".into()))?;
+            return self.apply(a, edit);
+        }
         let size = 10.0;
         let text_at = |t: &str| {
             let w = (pdfcraft_engine::annot_text::text_width(t, size) + 8.0).clamp(20.0, 600.0);
             let h = size * 1.2 + 6.0;
             Shape::Typewriter { rect: [at[0], at[1] - h, at[0] + w, at[1]], font_size: size }
         };
-        let (shape, contents) = match a.str("type")? {
+        let (shape, contents) = match kind {
             "text" => {
                 let t = a.str("text")?.to_string();
                 (text_at(&t), t)
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index a6838150..deae3b4b 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -618,7 +618,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "sort": { "type": "string", "enum": ["page", "author", "date", "type"] }, "out": save_out, "open": open }),
                 &["doc"],
             )),
-        t("comment_edit", "Edit a comment", "Change a comment's text, colour, opacity, line width, rectangle (rectangle/oval/text box) or position (`move` [dx, dy] in points). One undo step.").with(schema(
+        t("comment_edit", "Edit a comment", "Change a comment's text, colour, opacity, line width, rectangle (rectangle/oval/text box/stamp) or position (`move` [dx, dy] in points). Stamps keep their original appearance when resized. One undo step.").with(schema(
             comment_ref(json!({
                 "contents": { "type": "string" },
                 "color": color(),
@@ -893,7 +893,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "fill_sign_add",
             "Fill & Sign: type text or place a mark",
-            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, 10 pt), place a check, cross, dot or line, today's date, or a typed signature or initials (`text` drawn in a script font as filled outlines; at is its left edge, centred vertically), at `at` [x, y] in points from the top-left of the page (the text's top-left; a mark's centre). Creates movable, undoable annotations.",
+            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, 10 pt), place a check, cross, dot or line, today's date, or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 4 megapixels, preserving transparency). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations.",
         )
         .cmd("sign.fill.text")
         .with(schema(
@@ -903,6 +903,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "type": { "type": "string", "enum": ["text", "check", "cross", "dot", "line", "date", "signature", "initials"] },
                 "at": point(),
                 "text": { "type": "string", "minLength": 1 },
+                "path": { "type": "string", "description": "PNG or JPEG for signature/initials; pass either path or text." },
                 "author": { "type": "string" },
             }),
             &["doc", "page", "type", "at"],
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index b3ac82e9..2f4449a9 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1100,6 +1100,72 @@ fn fill_and_sign_through_tools() {
     assert!(matches!(a.call("fill_sign_add", &json!({ "doc": doc, "page": 1, "type": "text", "at": [1, 1] })), Err(ToolError::InvalidArgs(_))));
 }
 
+#[test]
+fn image_signatures_through_tools_preserve_transparency_and_survive_save() {
+    let dir = workdir("image-signatures");
+    let mut png = Vec::new();
+    {
+        let mut encoder = png::Encoder::new(&mut png, 120, 40);
+        encoder.set_color(png::ColorType::Rgba);
+        encoder.set_depth(png::BitDepth::Eight);
+        let rgba: Vec<u8> = (0..40)
+            .flat_map(|y| (0..120).flat_map(move |x| if (40..80).contains(&x) && (10..30).contains(&y) { [0, 0, 0, 255] } else { [0, 0, 0, 0] }))
+            .collect();
+        encoder.write_header().unwrap().write_image_data(&rgba).unwrap();
+    }
+    std::fs::write(dir.join("signature.png"), png).unwrap();
+    std::fs::write(dir.join("broken.png"), b"broken").unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_create", json!({ "from": "blank", "width": 200, "height": 300 }))["doc"].as_u64().unwrap();
+    for (kind, y) in [("signature", 60), ("initials", 120)] {
+        ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": 1, "type": kind, "at": [20, y], "path": "signature.png" }));
+    }
+    let render = |a: &mut Automation, doc| {
+        let output = a.call("page_render", &json!({ "doc": doc, "page": 1, "dpi": 72 })).unwrap();
+        let Content::Png { data, .. } = &output[0] else { panic!() };
+        image::load_from_memory(data).unwrap().to_rgba8()
+    };
+    let before = render(&mut a, doc);
+    assert_eq!(before.get_pixel(25, 60).0, [255, 255, 255, 255], "transparent margin exposes the page");
+    assert_eq!(before.get_pixel(65, 60).0, [0, 0, 0, 255], "signature ink is embedded");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Add initials");
+    assert_eq!(ok(&mut a, "comment_list", json!({ "doc": doc }))["count"], 1);
+    ok(&mut a, "edit_redo", json!({ "doc": doc }));
+    // The same resize edit the selection handles use must keep the imported appearance.
+    for rect in [json!([20, 40, 20, 88]), json!([20, 40, 100000000, 88])] {
+        assert!(a.call("comment_edit", &json!({ "doc": doc, "page": 1, "index": 1, "rect": rect })).is_err());
+    }
+    ok(&mut a, "comment_lock", json!({ "doc": doc, "page": 1, "index": 1 }));
+    assert!(a.call("comment_edit", &json!({ "doc": doc, "page": 1, "index": 1, "rect": [20, 40, 164, 88] })).is_err());
+    ok(&mut a, "comment_lock", json!({ "doc": doc, "page": 1, "index": 1, "locked": false }));
+    assert_eq!(render(&mut a, doc), before, "invalid and locked resizes leave the image intact");
+    ok(&mut a, "comment_edit", json!({ "doc": doc, "page": 1, "index": 1, "rect": [20, 40, 164, 88] }));
+    let resized = render(&mut a, doc);
+    assert_eq!(resized.get_pixel(110, 64).0, [0, 0, 0, 255], "resizing scales the original ink");
+    assert_eq!(resized.get_pixel(25, 64).0, [255, 255, 255, 255], "resizing retains alpha");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Resize comment");
+    assert_eq!(render(&mut a, doc), before);
+    ok(&mut a, "edit_redo", json!({ "doc": doc }));
+    assert_eq!(render(&mut a, doc), resized);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "signed.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "signed.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "comment_list", json!({ "doc": reopened }))["count"], 2);
+    assert_eq!(render(&mut a, reopened), resized, "resized appearances retain alpha and geometry after save");
+    for args in [
+        json!({ "type": "signature", "path": "broken.png" }),
+        json!({ "type": "signature", "path": "signature.png", "text": "Ada" }),
+        json!({ "type": "check", "path": "signature.png" }),
+        json!({ "type": "signature", "path": "../outside.png" }),
+    ] {
+        let mut args = args;
+        args["doc"] = json!(doc);
+        args["page"] = json!(1);
+        args["at"] = json!([20, 80]);
+        assert!(a.call("fill_sign_add", &args).is_err(), "{args}");
+    }
+    assert_eq!(ok(&mut a, "comment_list", json!({ "doc": doc }))["count"], 2, "errors leave the PDF intact");
+}
+
 #[test]
 fn creating_and_reducing_through_tools() {
     let dir = workdir("create");
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 5fbc9a4b..bcf762fc 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -10,7 +10,7 @@ workspace = true
 
 [dependencies]
 pdfcraft-measure = { workspace = true }
-image = { version = "0.25", default-features = false, features = ["jpeg", "tiff"] }
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "tiff"] }
 pdfcraft-render = { workspace = true }
 pdfcraft-cos = { workspace = true }
 pdfcraft-organize = { workspace = true }
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 2e623506..ca97c80f 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -20,8 +20,11 @@ pub mod export;
 pub mod js;
 pub mod links;
 pub mod ocr;
+pub mod signature_image;
 pub mod xfa;
 
+pub use signature_image::SignatureImage;
+
 pub use pdfcraft_organize::{BoxSpec, PageBox, SplitBy, split_ranges};
 
 /// One file produced by a split: (1-based first page, last page, PDF bytes).
@@ -1434,7 +1437,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
         Edit::AddCustomStamp { page, rect, name, file, author } => {
             let src = mark_source(doc, file)?;
             let (sw, sh) = (src.size.0.max(1.0), src.size.1.max(1.0));
-            let rect = if (rect[2] - rect[0]).abs() < 1.0 || (rect[3] - rect[1]).abs() < 1.0 {
+            let rect = if rect[2] == rect[0] && rect[3] == rect[1] {
                 let k = (200.0 / sw.max(sh)).min(1.0);
                 let (w, h) = (sw * k, sh * k);
                 [rect[0] - w / 2.0, rect[1] - h / 2.0, rect[0] + w / 2.0, rect[1] + h / 2.0]
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
new file mode 100644
index 00000000..264c9c73
--- /dev/null
+++ b/crates/engine/src/signature_image.rs
@@ -0,0 +1,186 @@
+//! Local image signatures, shared by Fill & Sign and its automation tool.
+
+use std::io::{Cursor, Read};
+use std::sync::Arc;
+
+use image::{DynamicImage, ImageDecoder, ImageFormat, ImageReader, Limits};
+
+use crate::{Edit, MarkFile};
+
+/// Saved signatures live in settings, so both source and normalized PNG are bounded.
+pub const MAX_SIGNATURE_IMAGE_BYTES: usize = 4 << 20;
+const MAX_PIXELS: u64 = 4 << 20;
+
+#[derive(Debug, thiserror::Error)]
+pub enum SignatureImageError {
+    #[error("Choose a PNG or JPEG image.")]
+    Format,
+    #[error("Choose an image smaller than 4 MiB and 4 megapixels (at most 4096 pixels per side).")]
+    Size,
+    #[error("Couldn't read the signature image: {0}")]
+    Read(#[from] std::io::Error),
+    #[error("Couldn't decode the signature image: {0}")]
+    Decode(#[from] image::ImageError),
+}
+
+/// A validated image, normalized to PNG without source paths or metadata. Alpha is preserved.
+#[derive(Clone, Debug, PartialEq)]
+pub struct SignatureImage {
+    bytes: Arc<Vec<u8>>,
+    rgba: Arc<Vec<u8>>,
+    size: [usize; 2],
+}
+
+impl SignatureImage {
+    /// Read at most the file limit plus one byte, even if the file grows while being read.
+    pub fn read(reader: impl Read) -> Result<Self, SignatureImageError> {
+        let mut bytes = Vec::new();
+        reader.take(MAX_SIGNATURE_IMAGE_BYTES as u64 + 1).read_to_end(&mut bytes)?;
+        Self::from_bytes(&bytes)
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, SignatureImageError> {
+        if bytes.len() > MAX_SIGNATURE_IMAGE_BYTES {
+            return Err(SignatureImageError::Size);
+        }
+        let format = image::guess_format(bytes).map_err(|_| SignatureImageError::Format)?;
+        if !matches!(format, ImageFormat::Png | ImageFormat::Jpeg) {
+            return Err(SignatureImageError::Format);
+        }
+        let mut reader = ImageReader::with_format(Cursor::new(bytes), format);
+        let mut limits = Limits::default();
+        limits.max_image_width = Some(4096);
+        limits.max_image_height = Some(4096);
+        limits.max_alloc = Some(32 << 20);
+        reader.limits(limits);
+        let mut decoder = reader.into_decoder()?;
+        let (w, h) = decoder.dimensions();
+        if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
+            return Err(SignatureImageError::Size);
+        }
+        let orientation = decoder.orientation()?;
+        let mut image = DynamicImage::from_decoder(decoder)?;
+        image.apply_orientation(orientation);
+        let rgba = image.into_rgba8();
+        let size = [rgba.width() as usize, rgba.height() as usize];
+        let mut png = Cursor::new(Vec::new());
+        DynamicImage::ImageRgba8(rgba.clone()).write_to(&mut png, ImageFormat::Png)?;
+        let bytes = png.into_inner();
+        if bytes.len() > MAX_SIGNATURE_IMAGE_BYTES {
+            return Err(SignatureImageError::Size);
+        }
+        Ok(Self { bytes: Arc::new(bytes), rgba: Arc::new(rgba.into_raw()), size })
+    }
+
+    pub fn bytes(&self) -> &Arc<Vec<u8>> {
+        &self.bytes
+    }
+
+    pub fn rgba(&self) -> &[u8] {
+        &self.rgba
+    }
+
+    pub fn size(&self) -> [usize; 2] {
+        self.size
+    }
+
+    /// Left edge at `at`, vertically centered, with the same 150 pt width cap as typed names.
+    pub fn rect(&self, at: [f64; 2], initials: bool) -> Option<[f64; 4]> {
+        if !at.iter().all(|v| v.is_finite()) {
+            return None;
+        }
+        let [w, h] = self.size;
+        let scale = (150.0 / w as f64).min(if initials { 24.0 } else { 32.0 } / h as f64);
+        let (width, height) = (w as f64 * scale, h as f64 * scale);
+        Some([at[0], at[1] - height / 2.0, at[0] + width, at[1] + height / 2.0])
+    }
+
+    pub fn edit(&self, page: usize, at: [f64; 2], initials: bool, author: &str) -> Option<Edit> {
+        let rect = self.rect(at, initials)?;
+        let label = if initials { "Add initials" } else { "Add signature" };
+        Some(Edit::Batch {
+            label: label.into(),
+            edits: vec![Edit::AddCustomStamp {
+                page,
+                rect,
+                name: if initials { "Initials" } else { "Signature" }.into(),
+                file: MarkFile { name: "signature.png".into(), bytes: self.bytes.clone(), page: 0 },
+                author: author.into(),
+            }],
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn png(w: u32, h: u32) -> Vec<u8> {
+        let image = image::RgbaImage::from_pixel(w, h, image::Rgba([40, 60, 80, 128]));
+        let mut out = Cursor::new(Vec::new());
+        image.write_to(&mut out, ImageFormat::Png).unwrap();
+        out.into_inner()
+    }
+
+    #[test]
+    fn image_signatures_preserve_alpha_and_fit_the_signature_box() {
+        let image = SignatureImage::from_bytes(&png(400, 40)).unwrap();
+        assert_eq!(image.size(), [400, 40]);
+        assert_eq!(&image.rgba()[..4], &[40, 60, 80, 128]);
+        let Edit::Batch { edits, .. } = image.edit(0, [20.0, 100.0], false, "Ada").unwrap() else { panic!() };
+        let Edit::AddCustomStamp { rect, .. } = &edits[0] else { panic!() };
+        assert_eq!(*rect, [20.0, 92.5, 170.0, 107.5]);
+        assert!(image.edit(0, [f64::NAN, 0.0], false, "").is_none());
+        assert_eq!(SignatureImage::from_bytes(image.bytes()).unwrap(), image);
+    }
+
+    #[test]
+    fn invalid_and_oversized_signature_images_are_rejected() {
+        assert!(SignatureImage::from_bytes(b"not an image").is_err());
+        assert!(SignatureImage::from_bytes(b"\x89PNG\r\n\x1a\ntruncated").is_err());
+        assert!(SignatureImage::from_bytes(&vec![0; MAX_SIGNATURE_IMAGE_BYTES + 1]).is_err());
+        assert!(SignatureImage::from_bytes(&png(4097, 1)).is_err());
+        assert!(SignatureImage::from_bytes(&png(4096, 1025)).is_err());
+        assert!(SignatureImage::read(std::io::repeat(0)).is_err());
+        assert!(matches!(SignatureImage::from_bytes(b"GIF89a\x02\0\x02\0"), Err(SignatureImageError::Format)));
+    }
+
+    #[test]
+    fn jpeg_signatures_are_normalized_to_png() {
+        let mut jpeg = Cursor::new(Vec::new());
+        image::RgbImage::from_pixel(60, 20, image::Rgb([20, 20, 20])).write_to(&mut jpeg, ImageFormat::Jpeg).unwrap();
+        let image = SignatureImage::from_bytes(&jpeg.into_inner()).unwrap();
+        assert_eq!(image.size(), [60, 20]);
+        assert!(image.bytes().starts_with(b"\x89PNG\r\n\x1a\n"));
+        assert!(image.rgba().chunks_exact(4).all(|p| p[3] == 255));
+    }
+
+    #[test]
+    fn jpeg_signature_orientation_is_applied_before_preview_and_embedding() {
+        let mut jpeg = Cursor::new(Vec::new());
+        image::RgbImage::from_pixel(60, 20, image::Rgb([20, 20, 20])).write_to(&mut jpeg, ImageFormat::Jpeg).unwrap();
+        let jpeg = jpeg.into_inner();
+        // Synthetic EXIF IFD with Orientation=6 (90 degrees clockwise).
+        let exif = b"Exif\0\0II\x2a\0\x08\0\0\0\x01\0\x12\x01\x03\0\x01\0\0\0\x06\0\0\0\0\0\0\0";
+        let mut rotated = jpeg[..2].to_vec();
+        rotated.extend_from_slice(&[0xff, 0xe1]);
+        rotated.extend_from_slice(&((exif.len() + 2) as u16).to_be_bytes());
+        rotated.extend_from_slice(exif);
+        rotated.extend_from_slice(&jpeg[2..]);
+        let image = SignatureImage::from_bytes(&rotated).unwrap();
+        assert_eq!(image.size(), [20, 60]);
+        assert_eq!(SignatureImage::from_bytes(image.bytes()).unwrap().size(), [20, 60]);
+        assert!(!image.bytes().windows(4).any(|w| w == b"Exif"));
+    }
+
+    #[test]
+    fn very_wide_image_signatures_keep_the_requested_rectangle() {
+        let image = SignatureImage::from_bytes(&png(3000, 10)).unwrap();
+        let mut session = crate::Session::new();
+        let blank = session.create_blank(300.0, 400.0, 1).unwrap();
+        let id = session.open_new("form.pdf", blank).unwrap();
+        session.apply(id, image.edit(0, [20.0, 100.0], false, "Ada").unwrap()).unwrap();
+        let a = &session.get(id).unwrap().info.annotations[0];
+        assert_eq!(a.rect, [20.0, 99.75, 170.0, 100.25]);
+    }
+}
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index f023a854..69e16ba3 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -53,10 +53,8 @@ fn walk(doc: &Document, data: &[u8], resources: &Dict, ctm: Matrix, depth: usize
         let top = stack.last().copied().unwrap_or(ctm);
         match op.op.as_slice() {
             b"q" => stack.push(top),
-            b"Q" => {
-                if stack.len() > 1 {
-                    stack.pop();
-                }
+            b"Q" if stack.len() > 1 => {
+                stack.pop();
             }
             b"cm" => {
                 if let Some(m) = Matrix::from_operands(&op.operands)
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index ab00b626..8f817457 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -40,6 +40,7 @@ skrifa = "0.44"
 sys-locale = "0.3"
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
+rfd = { workspace = true, features = ["file-handle-inner"] }
 wasm-bindgen-futures = "0.4"
 wasm-bindgen = "0.2"
 js-sys = "0.3"
@@ -56,4 +57,4 @@ skrifa = "0.44"
 
 [build-dependencies]
 serde_json = { workspace = true }
-toml = "1"
\ No newline at end of file
+toml = "1"
diff --git a/crates/ui-egui/src/a11y_ui.rs b/crates/ui-egui/src/a11y_ui.rs
index 6d157f3a..5a5a9c66 100644
--- a/crates/ui-egui/src/a11y_ui.rs
+++ b/crates/ui-egui/src/a11y_ui.rs
@@ -386,12 +386,13 @@ impl PdfCraftApp {
                         let edit = self.session.get(id).map(|d| d.accessibility_fix(rule, None));
                         match edit {
                             Some(Ok(e)) => {
-                                if self.apply_edit(e) {
-                                    self.run_accessibility_check();
-                                    // The title can then be edited.
-                                    if rule == Rule::Title {
-                                        self.dialog = Some(Dialog::Properties(PropsTab::Description));
-                                    }
+                                if !self.apply_edit(e) {
+                                    return;
+                                }
+                                self.run_accessibility_check();
+                                // The title can then be edited.
+                                if rule == Rule::Title {
+                                    self.dialog = Some(Dialog::Properties(PropsTab::Description));
                                 }
                             }
                             Some(Err(e)) => self.notify_error(e),
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 8a1e5118..37ac3a34 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -275,6 +275,8 @@ pub struct DocView {
     pub marquee_done: Option<crate::zoom_snap::Marquee>,
     /// Fill & Sign text being typed.
     pub fill_text: Option<crate::fill_sign::TypeBox>,
+    /// A queued Fill & Sign signature: select it after its edit succeeds, then leave placement.
+    pub(crate) fill_signature_page: Option<usize>,
     /// A non-edit action requested by the organize toolbar, handled by the app.
     pub pending_action: Option<ViewAction>,
 }
@@ -381,6 +383,7 @@ impl DocView {
             marquee: None,
             marquee_done: None,
             fill_text: None,
+            fill_signature_page: None,
         }
     }
 
@@ -1490,8 +1493,25 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             if let QuickTool::Fill(ft) = tool
                 && allowed
             {
-                match crate::fill_sign::page_input(ui, &resp, &xf, i, info, ft, view, signature.as_ref(), initials.as_ref(), &author, today) {
+                match crate::fill_sign::page_input(
+                    ui,
+                    &resp,
+                    &xf,
+                    i,
+                    info,
+                    ft,
+                    view,
+                    signature.as_ref(),
+                    initials.as_ref(),
+                    &mut app.signature_preview,
+                    &author,
+                    today,
+                ) {
                     Some(crate::fill_sign::FillAction::Edit(e)) => view.pending_edit = Some(*e),
+                    Some(crate::fill_sign::FillAction::Signature(e)) => {
+                        view.pending_edit = Some(*e);
+                        view.fill_signature_page = Some(i);
+                    }
                     Some(crate::fill_sign::FillAction::CreateSignature) => open_signature = true,
                     Some(crate::fill_sign::FillAction::CreateInitials) => open_initials = true,
                     None => {}
@@ -1660,8 +1680,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     }
                 }
             }
-            // Link hover + click.
-            if let Some(p) = pointer {
+            // Fill & Sign keeps its placement cursor clear of link/comment hover feedback.
+            if !matches!(tool, QuickTool::Fill(_))
+                && let Some(p) = pointer
+            {
                 for l in info.links.iter().filter(|l| l.page == i) {
                     let sr = xf.user_rect(info, i, l.rect);
                     if sr.contains(p) {
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index a60819bd..6cec279a 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -483,10 +483,10 @@ fn is_markup(subtype: &str) -> bool {
     matches!(subtype, "Highlight" | "Underline" | "StrikeOut" | "Squiggly")
 }
 
-/// Rectangles, ovals and text boxes. A callout's `/Rect` also holds its leader line, so it
+/// Rectangles, ovals, text boxes and stamps. A callout's `/Rect` also holds its leader line, so it
 /// only moves.
 fn resizable(a: &Annotation) -> bool {
-    matches!(a.subtype.as_str(), "Square" | "Circle" | "FreeText") && a.intent.as_deref() != Some("FreeTextCallout")
+    matches!(a.subtype.as_str(), "Square" | "Circle" | "FreeText" | "Stamp") && a.intent.as_deref() != Some("FreeTextCallout")
 }
 
 const HANDLES: [(i8, i8); 8] = [(-1, -1), (0, -1), (1, -1), (1, 0), (1, 1), (0, 1), (-1, 1), (-1, 0)];
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index fc2a610d..dd9a7889 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -814,14 +814,17 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 return;
             }
             Dialog::Signature => {
-                let (apply, cancel) = crate::fill_sign::signature_pad(ui, &t, &mut app.signature_draft, &mut app.signature_preview);
+                let (apply, cancel, browse) = crate::fill_sign::signature_pad(ui, &t, &mut app.signature_draft, &mut app.signature_preview);
+                if browse {
+                    app.pick_signature_image();
+                }
                 if apply {
                     let d = std::mem::take(&mut app.signature_draft);
                     let tool = if d.initials {
-                        app.initials = Some(d.saved());
+                        app.initials = d.saved();
                         crate::fill_sign::FillTool::Initials
                     } else {
-                        app.signature = Some(d.saved());
+                        app.signature = d.saved();
                         crate::fill_sign::FillTool::Signature
                     };
                     app.quick_tool = crate::QuickTool::Fill(tool);
@@ -1190,10 +1193,8 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 }
             }
         }
-        Some(Dialog::Sanitize) => {
-            if app.apply_edit(Edit::Sanitize) {
-                app.notify_tr("Document sanitized. Save to finish: saving rewrites the whole file.");
-            }
+        Some(Dialog::Sanitize) if app.apply_edit(Edit::Sanitize) => {
+            app.notify_tr("Document sanitized. Save to finish: saving rewrites the whole file.");
         }
         Some(Dialog::RedactApply) => {
             let marks = app.active_ids().and_then(|(_, id)| app.session.get(id)).map_or(0, |d| d.redaction_marks());
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 27b26277..e8a9b8ee 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -208,12 +208,29 @@ impl PdfCraftApp {
     /// user has been told why, so the typing isn't lost and the caller can stop.
     fn apply_queued_edit(&mut self, i: usize) -> bool {
         let Some(edit) = self.views.get_mut(i).and_then(|v| v.pending_edit.take()) else { return true };
+        let signature_page = self.views.get_mut(i).and_then(|v| v.fill_signature_page.take());
         let committed = self.views.get_mut(i).and_then(|v| v.forms.committed.take());
         let typed = match (&edit, &committed) {
             (Edit::SetFieldValue { name, .. }, Some(draft)) => *name == draft.name,
             _ => false,
         };
-        if self.apply_edit(edit) || !typed {
+        if self.apply_edit(edit) {
+            if let Some(page) = signature_page
+                && let Some(view) = self.views.get_mut(i)
+            {
+                // Signature imports are a labeled batch; select their appended stamp just
+                // as AddAnnotation selects a typed or drawn signature.
+                let newest = self
+                    .session
+                    .get(view.id)
+                    .and_then(|d| d.info.annotations.iter().filter(|a| a.page == page && a.in_reply_to.is_none()).map(|a| a.index).max());
+                view.comments.selected = newest.map(|index| (page, index));
+                view.comments.reveal = true;
+                self.quick_tool = crate::QuickTool::Select;
+            }
+            return true;
+        }
+        if !typed {
             return true;
         }
         if let (Some(mut draft), Some(view)) = (committed, self.views.get_mut(i)) {
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index dad01205..702cc9c4 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -4,7 +4,7 @@
 //! any comment.
 
 use egui::{Color32, CornerRadius, Pos2, Sense, Stroke, pos2, vec2};
-use pdfcraft_engine::{Edit, FillMark, NewAnnotation, Shape, Style};
+use pdfcraft_engine::{Edit, FillMark, NewAnnotation, Shape, SignatureImage, Style};
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
@@ -26,11 +26,31 @@ pub const FILL_TOOLS: [FillTool; 8] =
     [FillTool::Text, FillTool::Cross, FillTool::Check, FillTool::Dot, FillTool::Line, FillTool::Date, FillTool::Signature, FillTool::Initials];
 
 /// A saved signature or initials: drawn strokes (normalised to the pad width, y up) or typed
-/// text (drawn in the script font).
+/// text (drawn in the script font), or a locally imported image.
 #[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
 pub enum SavedSig {
     Drawn(Vec<Vec<[f32; 2]>>),
     Typed(String),
+    Image(#[serde(with = "image_data")] SignatureImage),
+}
+
+mod image_data {
+    use base64::Engine as _;
+    use pdfcraft_engine::{SignatureImage, signature_image::MAX_SIGNATURE_IMAGE_BYTES};
+    use serde::{Deserialize, Deserializer, Serializer};
+
+    pub fn serialize<S: Serializer>(image: &SignatureImage, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_str(&base64::engine::general_purpose::STANDARD.encode(image.bytes().as_slice()))
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<SignatureImage, D::Error> {
+        let encoded = String::deserialize(d)?;
+        if encoded.len() > MAX_SIGNATURE_IMAGE_BYTES.div_ceil(3) * 4 {
+            return Err(serde::de::Error::custom("signature image exceeds 4 MiB"));
+        }
+        let bytes = base64::engine::general_purpose::STANDARD.decode(encoded).map_err(serde::de::Error::custom)?;
+        SignatureImage::from_bytes(&bytes).map_err(serde::de::Error::custom)
+    }
 }
 
 /// The Create signature / initials dialog.
@@ -40,6 +60,9 @@ pub struct SigDraft {
     pub text: String,
     /// The Draw tab (otherwise Type).
     pub drawing: bool,
+    /// The Image tab. The file is held in the draft until Apply.
+    pub image_mode: bool,
+    pub image: Option<SignatureImage>,
     /// Creating initials (otherwise the signature).
     pub initials: bool,
     /// Replacing an existing saved value.
@@ -49,7 +72,7 @@ pub struct SigDraft {
 impl SigDraft {
     pub fn new(initials: bool, name: &str) -> Self {
         let text = if initials { name.split_whitespace().filter_map(|w| w.chars().next()).collect() } else { name.trim().to_string() };
-        Self { strokes: Vec::new(), text, drawing: false, initials, editing: false }
+        Self { text, initials, ..Default::default() }
     }
 
     /// Edit a copy of the saved value; Cancel must leave the original untouched.
@@ -57,11 +80,14 @@ impl SigDraft {
         match saved {
             SavedSig::Drawn(strokes) => Self { strokes: strokes.clone(), drawing: true, initials, editing: true, ..Default::default() },
             SavedSig::Typed(text) => Self { text: text.clone(), initials, editing: true, ..Default::default() },
+            SavedSig::Image(image) => Self { image: Some(image.clone()), image_mode: true, initials, editing: true, ..Default::default() },
         }
     }
 
     fn ready(&self) -> bool {
-        if self.drawing {
+        if self.image_mode {
+            self.image.is_some()
+        } else if self.drawing {
             self.strokes.iter().any(|s| s.len() > 1)
         } else {
             !self.text.trim().is_empty()
@@ -69,8 +95,14 @@ impl SigDraft {
         }
     }
 
-    pub fn saved(&self) -> SavedSig {
-        if self.drawing { SavedSig::Drawn(self.strokes.clone()) } else { SavedSig::Typed(self.text.trim().to_string()) }
+    pub fn saved(&self) -> Option<SavedSig> {
+        if self.image_mode {
+            self.image.clone().map(SavedSig::Image)
+        } else if self.drawing {
+            Some(SavedSig::Drawn(self.strokes.clone()))
+        } else {
+            Some(SavedSig::Typed(self.text.trim().to_string()))
+        }
     }
 }
 
@@ -183,6 +215,7 @@ pub fn typed_signature_at(page: usize, at: [f64; 2], text: &str, height: f64, au
 pub fn place(page: usize, at: [f64; 2], sig: &SavedSig, initials: bool, author: &str) -> Option<Edit> {
     match sig {
         SavedSig::Drawn(strokes) => signature_at(page, at, strokes, author),
+        SavedSig::Image(image) => image.edit(page, at, initials, author),
         SavedSig::Typed(text) => {
             let [left, bottom, right, top] = pdfcraft_engine::script_outline(text).bounds();
             let height = if initials { 24.0_f64 } else { 32.0_f64 };
@@ -267,9 +300,9 @@ pub(crate) fn signature_entries(ui: &mut egui::Ui, app: &mut crate::PdfCraftApp,
             match saved {
                 SavedSig::Typed(text) => {
                     let cache = &mut app.saved_signature_previews[i];
-                    if cache.as_ref().is_none_or(|(s, _)| s != text) {
+                    if cache.as_ref().is_none_or(|(s, _)| s != saved) {
                         *cache = Some((
-                            text.clone(),
+                            saved.clone(),
                             ui.ctx().load_texture(format!("saved-{what}"), script_preview(text, 480, 104), egui::TextureOptions::LINEAR),
                         ));
                     }
@@ -283,6 +316,9 @@ pub(crate) fn signature_entries(ui: &mut egui::Ui, app: &mut crate::PdfCraftApp,
                         );
                     }
                 }
+                SavedSig::Image(image) => {
+                    image_preview(ui, preview_rect, image, &mut app.saved_signature_previews[i]);
+                }
                 SavedSig::Drawn(strokes) => {
                     let bounds = strokes
                         .iter()
@@ -317,7 +353,7 @@ pub(crate) fn signature_entries(ui: &mut egui::Ui, app: &mut crate::PdfCraftApp,
     command
 }
 
-/// Clicks with a Fill & Sign tool on one page. Returns `true` when the click was used.
+/// Preview and clicks with a Fill & Sign tool on one page.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn page_input(
     ui: &egui::Ui,
@@ -329,18 +365,48 @@ pub(crate) fn page_input(
     view: &mut DocView,
     signature: Option<&SavedSig>,
     initials: Option<&SavedSig>,
+    preview: &mut Option<(SavedSig, egui::TextureHandle)>,
     author: &str,
     today: (i64, u32, u32),
 ) -> Option<FillAction> {
     let pointer = ui.input(|i| i.pointer.hover_pos())?;
-    if !xf.rect.contains(pointer) {
-        return None;
-    }
-    ui.ctx().set_cursor_icon(if tool == FillTool::Text { egui::CursorIcon::Text } else { egui::CursorIcon::Crosshair });
-    if !resp.clicked() {
+    if !resp.contains_pointer() || !xf.rect.contains(pointer) {
         return None;
     }
     let at = to_user(xf, info, page, pointer);
+    let saved = match tool {
+        FillTool::Signature => signature,
+        FillTool::Initials => initials,
+        _ => None,
+    };
+    if let Some(SavedSig::Image(image)) = saved {
+        if let Some(rect) = image.rect(at, tool == FillTool::Initials) {
+            // Map each corner, rather than the bounding box, so page and view rotations
+            // turn the preview exactly as they turn the placed stamp.
+            let tex = image_texture(ui, image, preview);
+            let mut mesh = egui::Mesh::with_texture(tex);
+            let corners = [(rect[0], rect[3], 0.0, 0.0), (rect[2], rect[3], 1.0, 0.0), (rect[2], rect[1], 1.0, 1.0), (rect[0], rect[1], 0.0, 1.0)];
+            if let Some(p) = info.pages.get(page) {
+                for (x, y, u, v) in corners {
+                    let p = p.user_to_view(x as f32, y as f32);
+                    mesh.vertices.push(egui::epaint::Vertex {
+                        pos: xf.norm_to_screen(p[0] / xf.pw, p[1] / xf.ph),
+                        uv: pos2(u, v),
+                        color: Color32::WHITE,
+                    });
+                }
+                mesh.add_triangle(0, 1, 2);
+                mesh.add_triangle(0, 2, 3);
+                ui.painter().add(egui::Shape::mesh(mesh));
+                ui.ctx().set_cursor_icon(egui::CursorIcon::None);
+            }
+        }
+    } else {
+        ui.ctx().set_cursor_icon(if tool == FillTool::Text { egui::CursorIcon::Text } else { egui::CursorIcon::Crosshair });
+    }
+    if !resp.clicked() {
+        return None;
+    }
     match tool {
         FillTool::Text => {
             view.fill_text = Some(TypeBox { page, at: [at[0], at[1] + TEXT_SIZE * 0.6], text: String::new(), focus: true });
@@ -351,11 +417,11 @@ pub(crate) fn page_input(
             Some(FillAction::Edit(Box::new(typed(page, [at[0], at[1] + TEXT_SIZE * 0.6], &format!("{m}/{d}/{y}"), author))))
         }
         FillTool::Signature => match signature {
-            Some(s) => place(page, at, s, false, author).map(|e| FillAction::Edit(Box::new(e))),
+            Some(s) => place(page, at, s, false, author).map(|e| FillAction::Signature(Box::new(e))),
             None => Some(FillAction::CreateSignature),
         },
         FillTool::Initials => match initials {
-            Some(s) => place(page, at, s, true, author).map(|e| FillAction::Edit(Box::new(e))),
+            Some(s) => place(page, at, s, true, author).map(|e| FillAction::Signature(Box::new(e))),
             None => Some(FillAction::CreateInitials),
         },
         mark => {
@@ -371,6 +437,8 @@ pub(crate) fn page_input(
 #[derive(Clone, Debug, PartialEq)]
 pub enum FillAction {
     Edit(Box<Edit>),
+    /// Place once, then select the new signature or initials for adjustment.
+    Signature(Box<Edit>),
     /// No signature yet: open the signature pad.
     CreateSignature,
     /// No initials yet.
@@ -421,20 +489,42 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     None
 }
 
-/// The signature pad: draw with the pointer; returns the strokes (normalised) on Apply.
-pub(crate) fn signature_pad(ui: &mut egui::Ui, t: &Tokens, d: &mut SigDraft, preview: &mut Option<(String, egui::TextureHandle)>) -> (bool, bool) {
+/// The signature pad: type, draw or import an image. Returns Apply, Cancel and Browse.
+pub(crate) fn signature_pad(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    d: &mut SigDraft,
+    preview: &mut Option<(SavedSig, egui::TextureHandle)>,
+) -> (bool, bool, bool) {
     let what = if d.initials { tl!("initials") } else { tl!("signature") };
     let title = if d.editing { tl!("Change {what}") } else { tl!("Create {what}") };
     ui.label(egui::RichText::new(crate::i18n::fmt(title, &[("what", what)])).font(crate::theme::semibold(18.0)));
     ui.horizontal(|ui| {
-        if crate::widgets::pill_button(ui, tl!("Type"), !d.drawing).clicked() {
+        if crate::widgets::pill_button(ui, tl!("Type"), !d.drawing && !d.image_mode).clicked() {
             d.drawing = false;
+            d.image_mode = false;
         }
-        if crate::widgets::pill_button(ui, tl!("Draw"), d.drawing).clicked() {
+        if crate::widgets::pill_button(ui, tl!("Draw"), d.drawing && !d.image_mode).clicked() {
             d.drawing = true;
+            d.image_mode = false;
+        }
+        if crate::widgets::pill_button(ui, tl!("Image"), d.image_mode).clicked() {
+            d.image_mode = true;
         }
     });
     ui.add_space(6.0);
+    if d.image_mode {
+        ui.label(egui::RichText::new(tl!("Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.")).color(t.text_muted));
+        let browse = crate::widgets::ghost_button(ui, "folder", tl!("Browse…")).clicked();
+        let (rect, _) = ui.allocate_exact_size(vec2(460.0, 150.0), Sense::hover());
+        ui.painter().rect_filled(rect, CornerRadius::same(6), Color32::WHITE);
+        ui.painter().rect_stroke(rect, CornerRadius::same(6), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+        if let Some(image) = &d.image {
+            image_preview(ui, rect.shrink(8.0), image, preview);
+        }
+        let (apply, cancel) = pad_buttons(ui, d);
+        return (apply, cancel, browse);
+    }
     if !d.drawing {
         let l = ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Type your {what}."), &[("what", what)])).color(t.text_muted));
         ui.add(
@@ -448,14 +538,16 @@ pub(crate) fn signature_pad(ui: &mut egui::Ui, t: &Tokens, d: &mut SigDraft, pre
         let painter = ui.painter_at(rect);
         painter.rect_filled(rect, CornerRadius::same(6), Color32::WHITE);
         painter.rect_stroke(rect, CornerRadius::same(6), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-        if preview.as_ref().is_none_or(|(s, _)| *s != d.text) {
+        let key = SavedSig::Typed(d.text.clone());
+        if preview.as_ref().is_none_or(|(s, _)| *s != key) {
             let img = script_preview(&d.text, 920, 300);
-            *preview = Some((d.text.clone(), ui.ctx().load_texture("typed-signature", img, egui::TextureOptions::LINEAR)));
+            *preview = Some((key, ui.ctx().load_texture("typed-signature", img, egui::TextureOptions::LINEAR)));
         }
         if let Some((_, tex)) = preview {
             painter.image(tex.id(), rect.shrink(4.0), egui::Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
         }
-        return pad_buttons(ui, d);
+        let (apply, cancel) = pad_buttons(ui, d);
+        return (apply, cancel, false);
     }
     ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Draw your {what} below."), &[("what", what)])).color(t.text_muted));
     let strokes = &mut d.strokes;
@@ -481,7 +573,33 @@ pub(crate) fn signature_pad(ui: &mut egui::Ui, t: &Tokens, d: &mut SigDraft, pre
         let pts: Vec<Pos2> = s.iter().map(|p| pos2(rect.left() + p[0] * rect.width(), rect.bottom() - p[1] * rect.width())).collect();
         painter.add(egui::Shape::line(pts, Stroke::new(2.0, Color32::BLACK)));
     }
-    pad_buttons(ui, d)
+    let (apply, cancel) = pad_buttons(ui, d);
+    (apply, cancel, false)
+}
+
+fn image_texture(ui: &egui::Ui, image: &SignatureImage, cache: &mut Option<(SavedSig, egui::TextureHandle)>) -> egui::TextureId {
+    let key = SavedSig::Image(image.clone());
+    if cache.as_ref().is_some_and(|(s, _)| *s != key) {
+        *cache = None;
+    }
+    let (_, tex) = cache.get_or_insert_with(|| {
+        let pixels = egui::ColorImage::from_rgba_unmultiplied(image.size(), image.rgba());
+        (key, ui.ctx().load_texture("signature-image", pixels, egui::TextureOptions::LINEAR))
+    });
+    tex.id()
+}
+
+fn image_preview(ui: &egui::Ui, rect: egui::Rect, image: &SignatureImage, cache: &mut Option<(SavedSig, egui::TextureHandle)>) {
+    let tex = image_texture(ui, image, cache);
+    let [w, h] = image.size();
+    let size = vec2(w as f32, h as f32);
+    let size = size * (rect.width() / size.x).min(rect.height() / size.y);
+    ui.painter().image(
+        tex,
+        egui::Rect::from_center_size(rect.center(), size),
+        egui::Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)),
+        Color32::WHITE,
+    );
 }
 
 fn pad_buttons(ui: &mut egui::Ui, d: &mut SigDraft) -> (bool, bool) {
@@ -491,6 +609,7 @@ fn pad_buttons(ui: &mut egui::Ui, d: &mut SigDraft) -> (bool, bool) {
         if ui.button(tl!("Clear")).clicked() {
             d.strokes.clear();
             d.text.clear();
+            d.image = None;
         }
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
             let ready = d.ready();
@@ -505,6 +624,99 @@ fn pad_buttons(ui: &mut egui::Ui, d: &mut SigDraft) -> (bool, bool) {
     (apply, cancel)
 }
 
+#[cfg(target_arch = "wasm32")]
+#[derive(Clone, Default)]
+pub(crate) struct ImageInbox {
+    busy: std::sync::Arc<std::sync::atomic::AtomicBool>,
+    picked: std::sync::Arc<std::sync::Mutex<Option<PickedImage>>>,
+}
+
+#[cfg(target_arch = "wasm32")]
+struct PickedImage {
+    epoch: u64,
+    initials: bool,
+    bytes: Option<Result<Vec<u8>, String>>,
+}
+
+impl crate::PdfCraftApp {
+    /// Browse asynchronously, answering only into the dialog that asked for the image.
+    pub(crate) fn pick_signature_image(&mut self) {
+        let epoch = self.dialog_epoch();
+        let initials = self.signature_draft.initials;
+        let dialog = rfd::AsyncFileDialog::new().add_filter(tl!("Image"), &["png", "jpg", "jpeg"]);
+        #[cfg(not(target_arch = "wasm32"))]
+        self.ask_one(crate::pickers::Ask::File(dialog), None, move |app, path| {
+            if app.dialog_epoch() != epoch || app.dialog != Some(crate::Dialog::Signature) || app.signature_draft.initials != initials {
+                return;
+            }
+            let result =
+                std::fs::File::open(path).map_err(pdfcraft_engine::signature_image::SignatureImageError::from).and_then(SignatureImage::read);
+            app.use_signature_image(result.map_err(|e| e.to_string()));
+        });
+        #[cfg(target_arch = "wasm32")]
+        {
+            use std::sync::atomic::Ordering;
+            if self.signature_images.busy.swap(true, Ordering::SeqCst) {
+                self.notify_tr("Another file dialog is still open. Finish with it first.");
+                return;
+            }
+            let inbox = self.signature_images.clone();
+            let ctx = self.ctx.clone();
+            wasm_bindgen_futures::spawn_local(async move {
+                let bytes = if let Some(file) = dialog.pick_file().await {
+                    if file.inner().size() > pdfcraft_engine::signature_image::MAX_SIGNATURE_IMAGE_BYTES as f64 {
+                        Some(Err(pdfcraft_engine::signature_image::SignatureImageError::Size.to_string()))
+                    } else {
+                        // `pick_file` returns a readable handle. Read its Blob directly so a
+                        // rejected browser read is an error (rfd's read helper unwraps it).
+                        Some(match wasm_bindgen_futures::JsFuture::from(file.inner().array_buffer()).await {
+                            Ok(buffer) => {
+                                let bytes = js_sys::Uint8Array::new(&buffer);
+                                if bytes.length() as usize > pdfcraft_engine::signature_image::MAX_SIGNATURE_IMAGE_BYTES {
+                                    Err(pdfcraft_engine::signature_image::SignatureImageError::Size.to_string())
+                                } else {
+                                    Ok(bytes.to_vec())
+                                }
+                            }
+                            Err(error) => Err(format!("{error:?}")),
+                        })
+                    }
+                } else {
+                    None
+                };
+                *inbox.picked.lock().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(PickedImage { epoch, initials, bytes });
+                if let Some(ctx) = ctx {
+                    ctx.request_repaint();
+                }
+            });
+        }
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    pub(crate) fn process_signature_images(&mut self) {
+        let picked = self.signature_images.picked.lock().unwrap_or_else(std::sync::PoisonError::into_inner).take();
+        let Some(picked) = picked else { return };
+        self.signature_images.busy.store(false, std::sync::atomic::Ordering::SeqCst);
+        if self.dialog_epoch() != picked.epoch || self.dialog != Some(crate::Dialog::Signature) || self.signature_draft.initials != picked.initials {
+            return;
+        }
+        let Some(bytes) = picked.bytes else { return };
+        let result = bytes
+            .and_then(|bytes| pdfcraft_engine::guard(|| SignatureImage::from_bytes(&bytes)).map_err(|e| e.to_string())?.map_err(|e| e.to_string()));
+        self.use_signature_image(result);
+    }
+
+    fn use_signature_image(&mut self, result: Result<SignatureImage, String>) {
+        match result {
+            Ok(image) => {
+                self.signature_draft.image = Some(image);
+                self.toast = None;
+            }
+            Err(e) => self.notify_fmt("Couldn't import the signature image: {e}", &[("e", &e)]),
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     #[test]
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 2f70d40f..cf0e5d03 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -104,3 +104,5 @@
 	Fit to width scrolling	Plynulé posouvání s přizpůsobením šířce
 	Fit one full page	Celá jedna stránka
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Používá se, když PDF nepožaduje rozložení ani zvětšení. Plynulé posouvání mezi stránkami neskáče.
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Vyberte obrázek PNG nebo JPEG (nejvýše 4 MiB). Průhlednost bude zachována.
+	Couldn't import the signature image: {e}	Obrázek podpisu nelze importovat: {e}
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index f57ccb83..a3f96154 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1955,3 +1955,5 @@
 	Default page display	Presentación de página predeterminada
 	Default zoom	Zoom predeterminado
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Se usa cuando un PDF no pide una presentación ni un zoom. El desplazamiento continuo nunca salta de página en página.
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Elija una imagen PNG o JPEG (hasta 4 MiB). Se conserva la transparencia.
+	Couldn't import the signature image: {e}	No se pudo importar la imagen de la firma: {e}
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 5f75508f..047daeba 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1989,3 +1989,5 @@
 	{n} files	{n} fichiers
 	{n} files need attention	{n} fichiers demandent votre attention
 	{n} selected	{n} sélectionnés
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Choisissez une image PNG ou JPEG (jusqu’à 4 Mio). La transparence est conservée.
+	Couldn't import the signature image: {e}	Impossible d’importer l’image de la signature : {e}
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 3ecfdc00..14d72fd0 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1931,3 +1931,5 @@
 	Page display: {layout}	ページ表示：{layout}
 	Fit to width scrolling	幅に合わせてスクロール
 	Fit one full page	1ページずつ全体を表示
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG または JPEG 画像を選択してください（最大 4 MiB）。透明度は保持されます。
+	Couldn't import the signature image: {e}	署名画像を読み込めませんでした: {e}
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index d30e3181..5cf6f8bd 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -58,3 +58,5 @@
 	Enable Acrobat JavaScript	Ativar o Acrobat JavaScript
 	OK	OK
 	Auto	Automático
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Escolha uma imagem PNG ou JPEG (até 4 MiB). A transparência é preservada.
+	Couldn't import the signature image: {e}	Não foi possível importar a imagem da assinatura: {e}
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 6ad1c90e..e1f0200e 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2000,3 +2000,5 @@
 	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA 表单：字段与 XFA 数据保持同步，以便其他阅读器显示您填写的内容。
 @plural	{n} page|{n} pages	{n} 页
 @plural	{n} field|{n} fields	{n} 个字段
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	选择 PNG 或 JPEG 图像（最大 4 MiB）。透明度会保留。
+	Couldn't import the signature image: {e}	无法导入签名图像：{e}
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 3729710d..704be78f 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1924,3 +1924,5 @@
 	Page display: {layout}	頁面顯示：{layout}
 	Fit to width scrolling	符合寬度連續捲動
 	Fit one full page	單頁完整顯示
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	選擇 PNG 或 JPEG 圖像（最大 4 MiB）。透明度會保留。
+	Couldn't import the signature image: {e}	無法匯入簽名圖像：{e}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 400ce5df..bed9bb6f 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -493,8 +493,10 @@ pub struct PdfCraftApp {
     pub initials: Option<fill_sign::SavedSig>,
     /// The Create signature / initials dialog, and its typed preview.
     pub signature_draft: fill_sign::SigDraft,
-    pub(crate) signature_preview: Option<(String, egui::TextureHandle)>,
-    pub(crate) saved_signature_previews: [Option<(String, egui::TextureHandle)>; 2],
+    pub(crate) signature_preview: Option<(fill_sign::SavedSig, egui::TextureHandle)>,
+    pub(crate) saved_signature_previews: [Option<(fill_sign::SavedSig, egui::TextureHandle)>; 2],
+    #[cfg(target_arch = "wasm32")]
+    pub(crate) signature_images: fill_sign::ImageInbox,
     /// The Comment Properties dialog's state.
     pub comment_props: Option<comment_props::PropsDraft>,
     pub field_props: Option<prepare::FieldDraft>,
@@ -669,6 +671,8 @@ impl PdfCraftApp {
             signature_draft: Default::default(),
             signature_preview: None,
             saved_signature_previews: [None, None],
+            #[cfg(target_arch = "wasm32")]
+            signature_images: Default::default(),
             comment_props: None,
             field_props: None,
             redact_prefs: RedactPrefs::default(),
@@ -1074,6 +1078,7 @@ impl PdfCraftApp {
             // Drawn signatures keep their original form (older settings read the same).
             "signature": match &self.signature { Some(fill_sign::SavedSig::Drawn(s)) => Some(s), _ => None },
             "signature_text": match &self.signature { Some(fill_sign::SavedSig::Typed(t)) => Some(t), _ => None },
+            "signature_image": match &self.signature { Some(s @ fill_sign::SavedSig::Image(_)) => Some(s), _ => None },
             "initials": self.initials,
             // macOS Keychain and Windows store identities are read from their OS key stores each time.
             "digital_ids": self.digital_ids.iter().filter(|e| !e.path.starts_with("keychain:") && !e.path.starts_with("windows:")).collect::<Vec<_>>(),
@@ -1124,6 +1129,9 @@ impl PdfCraftApp {
         if let Some(t) = v["signature_text"].as_str().filter(|t| !t.trim().is_empty()) {
             self.signature = Some(fill_sign::SavedSig::Typed(t.to_string()));
         }
+        if let Ok(s @ fill_sign::SavedSig::Image(_)) = serde_json::from_value::<fill_sign::SavedSig>(v["signature_image"].clone()) {
+            self.signature = Some(s);
+        }
         if let Ok(i) = serde_json::from_value::<fill_sign::SavedSig>(v["initials"].clone()) {
             self.initials = Some(i);
         }
@@ -1463,6 +1471,8 @@ impl eframe::App for PdfCraftApp {
         if self.active.is_some() {
             self.combine_tab.focused = false;
         }
+        #[cfg(target_arch = "wasm32")]
+        self.process_signature_images();
         let dropped = ctx.input(|i| i.raw.dropped_files.clone());
         for f in dropped {
             // Files dropped on the Combine files tab join its list instead of opening.
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index c256e649..7ab81861 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -27,8 +27,16 @@ fn harness() -> Harness<'static, PdfCraftApp> {
 }
 
 fn at(h: &Harness<'static, PdfCraftApp>, x: f32, y: f32) -> Pos2 {
-    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
-    pos2(r.left() + x / 300.0 * r.width(), r.top() + (400.0 - y) / 400.0 * r.height())
+    let s = h.state();
+    let page = &s.session.get(s.views[0].id).unwrap().info.pages[0];
+    let xf = pdfcraft_ui_egui::canvas::PageXform {
+        rect: s.views[0].page_screen_rect(0).expect("on screen"),
+        rot: s.views[0].rotation,
+        pw: page.width,
+        ph: page.height,
+    };
+    let p = page.user_to_view(x, y);
+    xf.norm_to_screen(p[0] / xf.pw, p[1] / xf.ph)
 }
 
 fn click(h: &mut Harness<'static, PdfCraftApp>, x: f32, y: f32) {
@@ -48,12 +56,28 @@ fn items(h: &Harness<'static, PdfCraftApp>) -> Vec<(String, Option<String>)> {
     v
 }
 
+/// Page rasters arrive from the render worker independently of kittest's virtual frames.
+fn rendered_ink(h: &mut Harness<'static, PdfCraftApp>, x: f32, y: f32) -> image::RgbaImage {
+    for _ in 0..50 {
+        h.run_steps(2);
+        let p = at(h, x, y);
+        let pixels = h.render().unwrap();
+        if pixels.get_pixel(p.x as u32, p.y as u32).0[..3].iter().all(|v| *v < 60) {
+            return pixels;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    panic!("signature ink did not render at ({x}, {y})");
+}
+
 #[test]
 fn text_marks_and_date() {
     let mut h = harness();
     assert!(h.state_mut().execute("sign.fill.check"));
     assert!(matches!(h.state().quick_tool, QuickTool::Fill(_)));
     click(&mut h, 50.0, 350.0);
+    click(&mut h, 80.0, 350.0);
+    assert_eq!(h.state().quick_tool, QuickTool::Fill(FillTool::Check), "checkmarks stay repeatable");
     h.state_mut().execute("sign.fill.date");
     click(&mut h, 50.0, 300.0);
     h.state_mut().execute("sign.fill.text");
@@ -63,7 +87,7 @@ fn text_marks_and_date() {
     h.key_press(egui::Key::Enter);
     h.run_steps(4);
     let v = items(&h);
-    assert_eq!(v.len(), 3, "{v:?}");
+    assert_eq!(v.len(), 4, "{v:?}");
     assert!(v.iter().any(|(t, c)| t == "FreeText" && c.as_deref() == Some("Ada Lovelace")));
     assert!(v.iter().any(|(t, c)| t == "FreeText" && c.as_deref().is_some_and(|c| c.matches('/').count() == 2)), "a date: {v:?}");
     assert!(v.iter().any(|(t, _)| t == "Stamp"));
@@ -95,6 +119,8 @@ fn signing_draws_a_signature_once_and_places_it() {
     assert_eq!(h.state().dialog, None);
     click(&mut h, 60.0, 100.0);
     assert!(items(&h).iter().any(|(t, _)| t == "Ink"));
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)));
     // The signature is remembered (persisted with the app's settings).
     let saved = h.state().persist();
     let mut again = PdfCraftApp::new();
@@ -116,6 +142,7 @@ fn typed_signatures_and_initials() {
     assert_eq!(h.state().signature, Some(pdfcraft_ui_egui::fill_sign::SavedSig::Typed("Grace Hopper".into())));
     click(&mut h, 60.0, 100.0);
     assert!(items(&h).iter().any(|(t, _)| t == "Stamp"), "typed signatures are filled outlines");
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
     // Initials: their own pad (GH), then placed.
     assert!(h.state_mut().execute("sign.fill.initials"));
     h.run_steps(2);
@@ -147,6 +174,8 @@ fn changing_saved_signatures_and_initials_preserves_placed_marks() {
     // The quick toolbar exposes replacement without changing the normal placement action.
     h.get_by_label("Fill & Sign").click();
     h.run_steps(2);
+    h.get_by_label("Fill & Sign").click();
+    h.run_steps(2);
     h.get_by_label("Change signature").click();
     h.run_steps(2);
     assert_eq!(h.state().dialog, Some(Dialog::Signature));
@@ -165,6 +194,8 @@ fn changing_saved_signatures_and_initials_preserves_placed_marks() {
     click(&mut h, 40.0, 200.0);
     assert_eq!(items(&h).len(), 2);
 
+    h.get_by_label("Fill & Sign").click();
+    h.run_steps(2);
     h.get_by_label("Fill & Sign").click();
     h.run_steps(2);
     h.get_by_label("Change initials").click();
@@ -193,7 +224,7 @@ fn changing_drawn_signatures_can_be_cancelled_or_switched_to_type() {
     assert!(h.state_mut().execute("sign.fill.signature.change"));
     h.run_steps(2);
     assert!(h.state().signature_draft.drawing);
-    assert_eq!(h.state().signature_draft.saved(), drawn);
+    assert_eq!(h.state().signature_draft.saved(), Some(drawn.clone()));
     h.get_by_label("Clear").click();
     h.run_steps(2);
     assert!(h.state().signature_draft.strokes.is_empty());
@@ -204,7 +235,7 @@ fn changing_drawn_signatures_can_be_cancelled_or_switched_to_type() {
 
     assert!(h.state_mut().execute("sign.fill.signature.change"));
     h.run_steps(2);
-    assert_eq!(h.state().signature_draft.saved(), drawn);
+    assert_eq!(h.state().signature_draft.saved(), Some(drawn.clone()));
     h.get_all_by_label("Type").last().unwrap().click();
     h.run_steps(2);
     h.state_mut().signature_draft.text = "Grace Hopper".into();
@@ -276,3 +307,252 @@ fn long_typed_names_fit_the_placed_signature_and_keep_every_outline() {
     let a = &s.session.get(s.views[0].id).unwrap().info.annotations[0];
     assert!(a.rect[2] <= 190.001, "the full name fits on the page: {:?}", a.rect);
 }
+
+fn signature_file(test: &str) -> std::path::PathBuf {
+    let path = std::env::temp_dir().join(format!("pdfcraft-signature-{test}-{}.png", std::process::id()));
+    let image = image::RgbaImage::from_fn(120, 40, |x, y| {
+        if (10..110).contains(&x) && (15..25).contains(&y) || (10..20).contains(&x) && (5..15).contains(&y) {
+            image::Rgba([20, 30, 40, 255])
+        } else {
+            image::Rgba([0, 0, 0, 0])
+        }
+    });
+    image.save(&path).unwrap();
+    path
+}
+
+fn browse_image(h: &mut Harness<'static, PdfCraftApp>, path: &std::path::Path) {
+    h.state_mut().pick_override = Some(vec![path.to_string_lossy().into_owned()]);
+    h.get_by_label("Browse…").click();
+    h.run_steps(3);
+}
+
+#[test]
+fn image_signatures_and_initials_can_be_imported_placed_and_remembered() {
+    let path = signature_file("import");
+    let mut h = harness();
+    for (command, y, initials) in [("sign.fill.signature", 250.0, false), ("sign.fill.initials", 150.0, true)] {
+        h.state_mut().execute(command);
+        h.run_steps(2);
+        h.get_by_label("Image").click();
+        h.run_steps(2);
+        assert!(h.state().signature_draft.saved().is_none(), "Apply needs an image");
+        browse_image(&mut h, &path);
+        assert!(h.state().signature_draft.image.is_some());
+        if !initials && let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+            h.render().unwrap().save(format!("{dir}/image-signature-dialog.png")).unwrap();
+        }
+        assert_eq!(items(&h).len(), usize::from(initials), "importing doesn't edit the PDF");
+        h.get_by_label("Apply").click();
+        h.run_steps(3);
+        click(&mut h, 40.0, y);
+        assert_eq!(h.state().quick_tool, QuickTool::Select);
+        assert_eq!(h.state().views[0].comments.selected, Some((0, usize::from(initials))));
+    }
+    assert_eq!(items(&h).len(), 2);
+    let state = h.state();
+    let doc = state.session.get(state.views[0].id).unwrap();
+    for a in &doc.info.annotations {
+        assert_eq!(a.subtype, "Stamp");
+        assert!(((a.rect[2] - a.rect[0]) / (a.rect[3] - a.rect[1]) - 3.0).abs() < 0.001);
+        assert!(a.rect[2] - a.rect[0] <= 150.0);
+    }
+    assert_eq!(doc.can_undo(), Some("Add initials"));
+    let settings = state.persist();
+    assert!(!settings.contains(&path.to_string_lossy().to_string()), "only the image is saved, never its source path");
+    let mut again = PdfCraftApp::new();
+    again.restore(&settings);
+    assert_eq!(again.signature, state.signature);
+    assert_eq!(again.initials, state.initials);
+    let saved_image = state.signature.clone();
+    h.state_mut().execute("sign.fill.signature.change");
+    h.run_steps(2);
+    assert!(h.state().signature_draft.image_mode);
+    assert!(h.state().signature_draft.image.is_some());
+    h.get_by_label("Clear").click();
+    h.run_steps(2);
+    h.get_by_label("Cancel").click();
+    h.run_steps(3);
+    assert_eq!(h.state().signature, saved_image);
+    h.state_mut().execute("edit.undo");
+    h.run_steps(3);
+    assert_eq!(items(&h).len(), 1);
+    h.state_mut().execute("edit.redo");
+    h.run_steps(3);
+    assert_eq!(items(&h).len(), 2);
+    // Show the saved preview cards in the actual shell as well as the dialog.
+    h.state_mut().set_option("tool", "fill_sign").unwrap();
+    h.run_steps(3);
+    h.get_by_label("Use signature");
+    h.get_by_label("Use initials");
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        h.render().unwrap().save(format!("{dir}/image-signatures.png")).unwrap();
+    }
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation() {
+    let path = signature_file("pointer");
+    let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
+    let mut h = harness();
+    // A link under the placement point must not replace the image with a hand cursor.
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::AddLink {
+        page: 0,
+        rect: [30.0, 230.0, 60.0, 270.0],
+        action: pdfcraft_engine::LinkAction::Page(0),
+        style: pdfcraft_engine::LinkStyle::default(),
+    });
+    h.state_mut().signature = Some(SavedSig::Image(image));
+    h.state_mut().execute("sign.fill.signature");
+    // Exercise document rotation and view rotation separately and together.
+    let mut previous_document_rotation = 0;
+    for (document_rotation, view_rotation, zoom) in [(0, 0, "150"), (90, 0, "100"), (0, 90, "100"), (90, 90, "75"), (0, 180, "75"), (0, 270, "100")] {
+        let delta = document_rotation - previous_document_rotation;
+        if delta != 0 {
+            assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: delta }));
+        }
+        previous_document_rotation = document_rotation;
+        while h.state().views[0].rotation != view_rotation {
+            h.state_mut().views[0].rotate_view(true);
+        }
+        h.state_mut().set_option("zoom", zoom).unwrap();
+        h.run_steps(3);
+        for y in [250.0, 150.0] {
+            h.hover_at(at(&h, 40.0, y));
+            h.run_steps(2);
+            assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::None, "the image replaces the crosshair");
+            let ink = at(&h, 90.0, y);
+            let margin = at(&h, 42.0, y);
+            let upper_stroke = at(&h, 52.0, y + 8.0);
+            let lower_margin = at(&h, 52.0, y - 8.0);
+            let pixels = h.render().unwrap();
+            assert!(pixels.get_pixel(ink.x as u32, ink.y as u32).0[..3].iter().all(|v| *v < 60), "ink follows the pointer at the placed size");
+            assert!(pixels.get_pixel(margin.x as u32, margin.y as u32).0[..3].iter().all(|v| *v > 240), "alpha exposes the page");
+            assert!(
+                pixels.get_pixel(upper_stroke.x as u32, upper_stroke.y as u32).0[..3].iter().all(|v| *v < 60),
+                "the asymmetric image rotates with the page"
+            );
+            assert!(pixels.get_pixel(lower_margin.x as u32, lower_margin.y as u32).0[..3].iter().all(|v| *v > 240), "the image isn't flipped");
+            if y == 150.0 {
+                let old = at(&h, 90.0, 250.0);
+                assert!(pixels.get_pixel(old.x as u32, old.y as u32).0[..3].iter().all(|v| *v > 240), "moving the pointer removes the old preview");
+            }
+            if document_rotation == 0
+                && view_rotation == 0
+                && y == 250.0
+                && let Ok(dir) = std::env::var("PDFCRAFT_SHOTS")
+            {
+                pixels.save(format!("{dir}/image-signature-pointer.png")).unwrap();
+            }
+        }
+        assert!(items(&h).is_empty(), "hovering never adds a signature");
+        assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().info.links.len(), 1, "the original link remains");
+    }
+    h.hover_at(pos2(5.0, 5.0));
+    h.run_steps(2);
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::None, "restore the pointer off the page");
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat() {
+    let path = signature_file("resize");
+    let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
+    let mut h = harness();
+    h.state_mut().signature = Some(SavedSig::Image(image.clone()));
+    h.state_mut().initials = Some(SavedSig::Image(image));
+    h.state_mut().comment_prefs.pinned = true;
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 40.0, 250.0);
+    assert_eq!(h.state().quick_tool, QuickTool::Select, "signatures place once even when comment tools are pinned");
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)));
+    let placed = rendered_ink(&mut h, 90.0, 250.0);
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        placed.save(format!("{dir}/image-signature-selected.png")).unwrap();
+    }
+    // The bottom-right handle is ready without another selection click.
+    let corner = at(&h, 136.0, 234.0);
+    h.hover_at(corner);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::ResizeNwSe);
+    h.drag_at(corner);
+    h.run_steps(1);
+    let end = corner + egui::vec2(96.0, 32.0);
+    h.hover_at(end);
+    h.run_steps(2);
+    h.drop_at(end);
+    h.run_steps(3);
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert!(doc.info.annotations[0].rect.iter().zip([40.0, 218.0, 184.0, 266.0]).all(|(a, b)| (*a - b).abs() < 0.001));
+    assert_eq!(doc.can_undo(), Some("Resize comment"));
+    rendered_ink(&mut h, 160.0, 242.0);
+    h.state_mut().undo();
+    h.run_steps(2);
+    assert!(
+        h.state().session.get(h.state().views[0].id).unwrap().info.annotations[0]
+            .rect
+            .iter()
+            .zip([40.0, 234.0, 136.0, 266.0])
+            .all(|(a, b)| (*a - b).abs() < 0.001)
+    );
+    h.state_mut().redo();
+    h.run_steps(2);
+    click(&mut h, 40.0, 150.0);
+    assert_eq!(items(&h).len(), 1, "a later page click doesn't add another signature");
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 40.0, 150.0);
+    assert_eq!(items(&h).len(), 2, "selecting the saved signature again places another");
+    h.state_mut().execute("sign.fill.initials");
+    click(&mut h, 40.0, 100.0);
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 2)));
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn image_import_cancel_clear_and_errors_preserve_saved_signatures() {
+    let path = signature_file("cancel");
+    let mut h = harness();
+    let original = SavedSig::Typed("Ada Lovelace".into());
+    h.state_mut().signature = Some(original.clone());
+    h.state_mut().execute("sign.fill.signature.change");
+    h.run_steps(2);
+    h.get_by_label("Image").click();
+    h.run_steps(2);
+    h.state_mut().pick_override = Some(Vec::new());
+    h.get_by_label("Browse…").click();
+    h.run_steps(3);
+    assert!(h.state().signature_draft.image.is_none());
+    browse_image(&mut h, &path);
+    let loaded = h.state().signature_draft.image.clone();
+    std::fs::write(&path, b"broken PNG").unwrap();
+    browse_image(&mut h, &path);
+    assert_eq!(h.state().signature_draft.image, loaded, "an invalid replacement keeps the previous draft");
+    assert!(h.state().toast.as_ref().unwrap().0.contains("Couldn't import"));
+    h.get_by_label("Clear").click();
+    h.run_steps(2);
+    assert!(h.state().signature_draft.saved().is_none());
+    h.get_by_label("Cancel").click();
+    h.run_steps(3);
+    assert_eq!(h.state().signature, Some(original));
+    assert!(items(&h).is_empty());
+    // A picker answer from a closed dialog cannot populate a later draft.
+    h.state_mut().execute("sign.fill.signature.change");
+    h.run_steps(2);
+    h.get_by_label("Image").click();
+    h.run_steps(2);
+    assert_eq!(signature_file("cancel"), path, "replace the corrupt file with a valid image for the stale-answer check");
+    h.state_mut().pick_override = Some(vec![path.to_string_lossy().into_owned()]);
+    h.get_by_label("Browse…").click();
+    h.run_steps(1);
+    h.state_mut().dialog = None;
+    h.run_steps(3);
+    assert!(h.state().signature_draft.image.is_none());
+    // Malformed settings are ignored while legacy typed/drawn values still restore.
+    let mut again = PdfCraftApp::new();
+    again.restore(r#"{"signature_text":"Ada","signature_image":{"Image":"bm90IGFuIGltYWdl"},"initials":{"Image":"%%%"}}"#);
+    assert_eq!(again.signature, Some(SavedSig::Typed("Ada".into())));
+    assert!(again.initials.is_none());
+    std::fs::remove_file(path).unwrap();
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 1f9e8154..d610056b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5211,11 +5211,11 @@ title = "Fill & Sign: typed, drawn or image signature and initials"
 area = "F"
 tier = "P0"
 milestone = "M5"
-status = "partial"
+status = "shipped"
 commands = ["sign.fill.signature", "sign.fill.initials", "sign.fill.signature.change", "sign.fill.initials.change", "sign.fill.signature.remove", "sign.fill.initials.remove"]
-tools = ["fill_sign_add"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools"]
-notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded) or drawn, saved in settings; preview cards with add/change/remove controls in the panel and picker, also through ui.command; changes leave placed annotations untouched; long names fit within 150 pt with overhangs included in preview/PDF bounds; image signatures not yet"
+tools = ["fill_sign_add", "comment_edit"]
+evidence = ["crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save"]
+notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
 
 [[feature]]
 id = "form.fill-sign-flatten"
diff --git a/xtask/src/layers.rs b/xtask/src/layers.rs
index d66f08d4..5cb33439 100644
--- a/xtask/src/layers.rs
+++ b/xtask/src/layers.rs
@@ -202,11 +202,10 @@ pub fn check(crates: &[Crate]) -> Vec<Violation> {
                 }
                 match classify(&d.name) {
                     None => {}
-                    Some(Class::Testkit) => {
-                        if d.kind != DepKind::Dev && class != Class::Testkit {
-                            out.push(Violation::TestkitAsNormalDep { krate: c.name.clone(), dep: d.name.clone() });
-                        }
+                    Some(Class::Testkit) if d.kind != DepKind::Dev && class != Class::Testkit => {
+                        out.push(Violation::TestkitAsNormalDep { krate: c.name.clone(), dep: d.name.clone() });
                     }
+                    Some(Class::Testkit) => {}
                     Some(dc) => {
                         let to = dc.layer().unwrap_or(u8::MAX);
                         let ok = to < layer || (to == layer && sideways_allowed(&c.name, &d.name));

From dbe4b2dddbce77f8180ee5cc2bb99914805f5e43 Mon Sep 17 00:00:00 2001
From: Mawfyy <mawfyy12@gmail.com>
Date: Thu, 8 Oct 2026 15:46:22 -0500
Subject: [PATCH 010/149] =?UTF-8?q?Issue=20#290:=20File=20=E2=96=B8=20Open?=
 =?UTF-8?q?=20Recent=20lists=20the=20recent=20files=20(#323)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Issue #290: File ▸ Open Recent lists the recent files

The Home view kept a recent-files list but the File menu had no way to
reach it; Acrobat shows File ▸ Open Recent and the request asked for
exactly the menu wiring.

A new command file.open_recent renders as a submenu of the live list
right under Open… (disabled while the list is empty); each entry opens
its file or focuses the tab already showing it, which is now shared
with the Home view's list through the new open_recent() instead of a
second copy of that check. The command palette runs it as "open the
most recent file", or says there are none. Translations added to every
catalog (Japanese, Czech, Spanish, both Chinese and Brazilian
Portuguese are test-covered).

Test: commands.rs::the_open_recent_menu_lists_files_and_opens_one
(submenu lists a seeded recent file and clicking it opens a new active
tab on that path) and commands.rs::the_open_recent_menu_is_disabled
while_the_list_is_empty. Both failed before the change (no such menu).

Co-authored-by: Mawfyy <mawfy12@gmail.com>

* Build: cap cargo jobs and lighten the dev profile

On a 7.1 GiB machine the default one-job-per-core (12) with every
dependency at opt-level 2 plus full debuginfo swap-thrashes the box
frozen mid-build. jobs = 4 bounds peak memory to a few GiB and matches
GitHub runners (4 vCPUs), so CI is unaffected; dependencies drop to
opt-level 1 with debug = false, which halves their build cost and
keeps them fast enough for a usable debug app. Own crates keep their
opt-level and full debuginfo.

Verified: a from-scratch rebuild of all dependencies peaked at ~2 GiB
used with the machine responsive throughout; the perf.rs frame-budget
tests still pass at the lower dependency optimization.

Co-authored-by: Mawfyy <mawfy12@gmail.com>

* Keep the build configuration as on main; French for Open Recent

The jobs and dependency opt-level changes are a separate build-policy decision.
French is coverage-checked since #291; catalog checksums refreshed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* French for Open Recent again, and catalog checksums refreshed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mawfyy <mawfy12@gmail.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml                    | 14 ++++-----
 crates/engine/src/commands.rs       |  1 +
 crates/ui-egui/src/commands.rs      | 27 ++++++++++++++++++
 crates/ui-egui/src/home.rs          |  7 +----
 crates/ui-egui/src/i18n/cs.tsv      |  2 ++
 crates/ui-egui/src/i18n/es.tsv      |  2 ++
 crates/ui-egui/src/i18n/fr.tsv      |  2 ++
 crates/ui-egui/src/i18n/ja.tsv      |  2 ++
 crates/ui-egui/src/i18n/pt-br.tsv   |  2 ++
 crates/ui-egui/src/i18n/zh-hans.tsv |  2 ++
 crates/ui-egui/src/i18n/zh-hant.tsv |  2 ++
 crates/ui-egui/src/lib.rs           | 11 ++++++++
 crates/ui-egui/tests/commands.rs    | 44 +++++++++++++++++++++++++++++
 parity/acrobat-features.toml        |  6 ++--
 14 files changed, 108 insertions(+), 16 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index bfe6ccec..75aaceb2 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2d0c3c882f0d842230b32834150df3307111b3b91d3c1c403001c78b8f4202df"
+sha256 = "8792b00c7e9a12a247cbf6d4758d8583972f861010f4e4ed52949978e5a380e7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "bff6a243f40151a20a5082e02a1e7b588e46fca5f7b616ca618e57576b5218e3"
+sha256 = "9429421177790a0492b1513102823a9aa5dbd34c7a850a737792602d4d19b8d9"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "92cd3816ae6f0cf59244f4836cc95a3b12961c88d219dae593fd60dbc6eb8de0"
+sha256 = "9a655daa584e3a5d049dbaaa30229ae7a931984b0f1c7f0177fde2ccdd6804ca"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0cd7b7d0696323e281f7a23ef7511785b6a519c94ddb9d89c2468bcdc44bbc84"
+sha256 = "777a7f441950714a61d41e5a44405209aa85bfdd4b46e27090544eb9122d715f"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "de653ffb92e6b99e8d390e6c21f5f13ecef198e21be3045e159b86073fbe7f4e"
+sha256 = "cb3759b57445a3948a707aaf9423338053c7e7ad68f19f52583527dae3dfabee"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "415aa786c8afc8095be14ac9d74b864e968326699ce0130fede5616ccf9e70ad"
+sha256 = "b131025cb6c14135440968f08ab6334d70dd3b20271539471878d3825ecc9629"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d3a89359bdb7c8af830a49a1b574312c65f757e4f69cf221e06f27ea0c0e7373"
+sha256 = "c9879375eed52003bb16790e687808fe0d50dd9405390be383eab66cd513291c"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index ae68cecc..49b63273 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -149,6 +149,7 @@ const HELP: Option<&str> = Some("Help");
 /// Every command, in menu order.
 pub const COMMANDS: &[CommandSpec] = &[
     c("file.open", "Open…", FILE, Some(Shortcut::cmd("O")), Nothing, "folder-open"),
+    c("file.open_recent", "Open Recent", FILE, None, Nothing, "clock"),
     c("create.blank", "New blank PDF", FILE, None, Nothing, "file-plus-2"),
     c("measure.distance", "Measure distance", None, None, Annotate, "ruler"),
     c("measure.perimeter", "Measure perimeter", None, None, Annotate, "ruler"),
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 79953088..d26b0494 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -80,6 +80,11 @@ impl PdfCraftApp {
         let targets = active.map(|i| self.views[i].target_pages()).unwrap_or_default();
         match id {
             "file.open" => self.open_dialog(),
+            "file.open_recent" => match self.recent.first().map(|r| r.path.clone()) {
+                // The palette runs commands without a submenu: open the most recent file.
+                Some(p) => self.open_recent(&p),
+                None => self.notify_tr("No recent files"),
+            },
             "page.combine" => self.open_combine_tab(),
             "file.save" => {
                 self.save_active(SaveTarget::InPlace);
@@ -551,6 +556,28 @@ pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str
     for spec in commands::menu(menu) {
         let label = commands::current_label(spec, &app.session, app.active_ids().map(|(_, id)| id));
         let label = crate::i18n::menu_label(spec.id, &label);
+        // Open Recent is a submenu of the live recent list, not one action: disabled while the
+        // list is empty, otherwise each entry opens its file (or focuses the tab showing it).
+        if spec.id == "file.open_recent" {
+            if app.recent.is_empty() {
+                ui.add_enabled(false, egui::Button::new(label));
+                continue;
+            }
+            let mut open: Option<String> = None;
+            ui.menu_button(label, |ui| {
+                for r in &app.recent {
+                    if ui.button(&r.name).on_hover_text(&r.path).clicked() {
+                        open = Some(r.path.clone());
+                        ui.close();
+                    }
+                }
+            });
+            if let Some(p) = open {
+                app.open_recent(&p);
+                ui.close();
+            }
+            continue;
+        }
         let shortcut = spec.shortcut.map(|s| s.label(mac)).unwrap_or_default();
         let enabled = app.command_enabled(spec);
         let resp = ui.add_enabled(enabled, egui::Button::new(label).shortcut_text(shortcut));
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index e87a531e..4d1d95c1 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -130,12 +130,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
             }
             if let Some(p) = open {
-                if let Some(i) = app.views.iter().position(|v| app.session.get(v.id).and_then(|d| d.path.as_deref()) == Some(p.as_str())) {
-                    app.active = Some(i);
-                } else {
-                    #[cfg(not(target_arch = "wasm32"))]
-                    app.open_path(&p);
-                }
+                app.open_recent(&p);
             }
             ui.add_space(20.0);
             widgets::section_title(ui, tl!("Privacy"));
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index cf0e5d03..1f37708f 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -28,6 +28,8 @@
 	Enable Acrobat JavaScript	Povolit Acrobat JavaScript
 	OK	OK
 	Open…	Otevřít…
+	Open Recent	Otevřít nedávné soubory
+	No recent files	Žádné nedávné soubory
 	New blank PDF	Nový prázdný dokument PDF
 	Create PDF from file…	Vytvořit PDF ze souboru…
 	Create PDF from images…	Vytvořit PDF z obrázků…
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index a3f96154..f4a560c0 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -21,6 +21,8 @@
 	Identity	Identidad
 	Name on new comments	Nombre en los comentarios nuevos
 	Open…	Abrir…
+	Open Recent	Abrir recientes
+	No recent files	No hay archivos recientes
 	New blank PDF	Nuevo PDF en blanco
 	Create PDF from file…	Crear PDF a partir de un archivo…
 	Create PDF from images…	Crear PDF a partir de imágenes…
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 047daeba..28391f9a 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1991,3 +1991,5 @@
 	{n} selected	{n} sélectionnés
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Choisissez une image PNG ou JPEG (jusqu’à 4 Mio). La transparence est conservée.
 	Couldn't import the signature image: {e}	Impossible d’importer l’image de la signature : {e}
+	Open Recent	Ouvrir un fichier récent
+	No recent files	Aucun fichier récent
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 14d72fd0..342955dc 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -27,6 +27,8 @@
 	Identity	個人情報
 	Name on new comments	新しい注釈の作成者名
 	Open…	開く…
+	Open Recent	最近のファイルを開く
+	No recent files	最近のファイルがありません
 	New blank PDF	空白の PDF を作成
 	Create PDF from file…	ファイルから PDF を作成…
 	Create PDF from images…	画像から PDF を作成…
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 5cf6f8bd..0cbc9a88 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -20,6 +20,8 @@
 	Identity	Identidade
 	Name on new comments	Nome nos novos comentários
 	Open…	Abrir…
+	Open Recent	Abrir recentes
+	No recent files	Nenhum arquivo recente
 	New blank PDF	Novo PDF em branco
 	Create PDF from file…	Criar PDF a partir de arquivo…
 	Create PDF from images…	Criar PDF a partir de imagens…
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index e1f0200e..583acd5f 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -61,6 +61,8 @@
 	Identity	身份
 	Name on new comments	新注释的作者姓名
 	Open…	打开…
+	Open Recent	打开最近的文件
+	No recent files	没有最近的文件
 	Open	打开
 	Open file	打开文件
 	Home	主页
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 704be78f..adea61bb 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -20,6 +20,8 @@
 	Identity	個人資訊
 	Name on new comments	新註解的作者名稱
 	Open…	開啟…
+	Open Recent	開啟最近的檔案
+	No recent files	沒有最近的檔案
 	Open	開啟
 	Open file	開啟檔案
 	Home	首頁
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index bed9bb6f..a8c9d795 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -884,6 +884,17 @@ impl PdfCraftApp {
         }
     }
 
+    /// Open a file from a recent list: focus the tab already showing it, else open it (File ▸
+    /// Open Recent and the Home view's list share this).
+    pub fn open_recent(&mut self, path: &str) {
+        if let Some(i) = self.views.iter().position(|v| self.session.get(v.id).and_then(|d| d.path.as_deref()) == Some(path)) {
+            self.active = Some(i);
+        } else {
+            #[cfg(not(target_arch = "wasm32"))]
+            self.open_path(path);
+        }
+    }
+
     #[cfg(not(target_arch = "wasm32"))]
     pub fn open_path(&mut self, path: &str) {
         let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index d012eaed..28e4e01b 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -194,6 +194,50 @@ fn the_pages_menu_comes_from_the_registry() {
     assert_eq!(app.session.get(app.views[0].id).unwrap().info.pages.len(), 2);
 }
 
+#[test]
+fn the_open_recent_menu_lists_files_and_opens_one() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-recent-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("recent.pdf");
+    std::fs::write(&path, fixture(2)).unwrap();
+    let path = path.to_string_lossy().into_owned();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe({
+        let path = path.clone();
+        move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
+            app.recent.push(pdfcraft_ui_egui::RecentFile { name: "recent.pdf".into(), path, pages: 2, size: 0 });
+            app
+        }
+    });
+    h.run_steps(4);
+    h.get_by_label("Menu").click();
+    h.run_steps(2);
+    h.get_by_label("File ⏵").hover();
+    h.run_steps(3);
+    h.get_by_label("Open Recent ⏵").hover();
+    h.run_steps(3);
+    h.get_by_label_contains("recent.pdf").click();
+    h.run_steps(4);
+    let app = h.state();
+    assert_eq!(app.views.len(), 2, "the recent file opened in a new tab");
+    let active = app.active.unwrap();
+    assert_eq!(app.session.get(app.views[active].id).and_then(|d| d.path.as_deref()), Some(path.as_str()), "the active tab is the recent file");
+}
+
+#[test]
+fn the_open_recent_menu_is_disabled_while_the_list_is_empty() {
+    let mut h = harness();
+    h.get_by_label("Menu").click();
+    h.run_steps(2);
+    h.get_by_label("File ⏵").hover();
+    h.run_steps(3);
+    assert!(
+        h.query_by(|n| n.label().as_deref() == Some("Open Recent") && n.is_disabled()).is_some(),
+        "Open Recent is disabled while no file has been opened"
+    );
+}
+
 #[test]
 fn the_shortcuts_dialog_lists_the_real_bindings() {
     let mut h = harness();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index d610056b..1fe73ce2 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -656,10 +656,10 @@ area = "A"
 tier = "P1"
 milestone = "M3"
 status = "shipped"
-commands = []
+commands = ["file.open_recent"]
 tools = []
-evidence = ["crates/ui-egui/tests/ui.rs::persistence_round_trips_and_tolerates_garbage"]
-notes = "never reads other apps' lists"
+evidence = ["crates/ui-egui/tests/ui.rs::persistence_round_trips_and_tolerates_garbage", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_lists_files_and_opens_one", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_is_disabled_while_the_list_is_empty"]
+notes = "never reads other apps' lists; File ▸ Open Recent lists them (#290), an already-open file focuses its tab instead of reopening it"
 
 [[feature]]
 id = "core.usage-rights-preserve"

From 868bd727d19c8298a0d509d81d7388775376fa62 Mon Sep 17 00:00:00 2001
From: Oldrich333 <dvorak@thelunacare.com>
Date: Thu, 8 Oct 2026 22:55:25 +0200
Subject: [PATCH 011/149] M13: `pdfcraft-cli mcp --compact` lists 12 tools and
 finds the rest by search (#353)

`tools/list` returns all 132 tools (109,578 bytes, ~27k tokens), which an
agent pays on every session. With `--compact` (library:
`McpServer::with_compact(true)`) it returns the 10 core tools
(`mcp::COMPACT_CORE_TOOLS`) plus `tool_search` (query / category / name
with the full schema) and `tool_call` (runs any tool through the same
`Automation::call`): 12 tools, 7,697 bytes. `tools/call` by name keeps
working for every tool; without the flag nothing changes. Same shape as
`lightcraft-cli mcp --compact`; the meta tools are not called
`*_command` because "command" already means a registry command here.

Both meta tools reject unknown outer keys and report failures as
`isError` results; `tool_call` honours `--root` exactly like a direct
call. Tests: automation integration tests (compact list, discovery,
dispatch, errors, root confinement) and a CLI test that launches the
binary with and without `--compact`.

Co-authored-by: Oldrich333 <184516902+Oldrich333@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 README.md                              |   2 +
 apps/pdfcraft-cli/src/main.rs          |  12 +-
 apps/pdfcraft-cli/tests/mcp_compact.rs |  76 +++++++
 crates/automation/README.md            |   2 +
 crates/automation/src/mcp.rs           | 203 ++++++++++++++++++-
 crates/automation/tests/automation.rs  | 266 +++++++++++++++++++++++++
 6 files changed, 553 insertions(+), 8 deletions(-)
 create mode 100644 apps/pdfcraft-cli/tests/mcp_compact.rs

diff --git a/README.md b/README.md
index e08d5551..a80469bc 100644
--- a/README.md
+++ b/README.md
@@ -291,6 +291,8 @@ Every engine feature is reachable without the GUI, through one table of JSON-Sch
   { "mcpServers": { "pdfcraft": { "command": "pdfcraft-cli", "args": ["mcp", "--root", "/path/to/your/pdfs"] } } }
   ```
 
+  `--compact` shrinks the tool list the agent has to read: `tools/list` returns about ten core tools plus `tool_search` and `tool_call`, which find and run every other tool, so the list costs far fewer tokens. Every tool still works.
+
   `--root` confines every file the agent can read or write to one directory. Builds that should not include the server at all can use `cargo build -p pdfcraft-cli --no-default-features`.
 
 - **The Rust API** (`pdfcraft_automation::Automation::call`), for embedding.
diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index 011d8320..3c05c0c4 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -13,7 +13,8 @@
 //! pdfcraft-cli tools                                       automation tools and their JSON Schemas
 //! pdfcraft-cli run    <tool> [key=value …] [--root DIR] [--out image.png]
 //! pdfcraft-cli run    --script steps.json [--root DIR]      [{"tool": "doc_open", "args": {…}}, …]
-//! pdfcraft-cli mcp    [--root DIR]                          MCP server on stdin/stdout (opt-in)
+//! pdfcraft-cli mcp    [--root DIR] [--compact]              MCP server on stdin/stdout (opt-in)
+//!                                                            --compact lists a core set of tools plus tool_search and tool_call
 //! pdfcraft-cli ui     --control FILE <method> [key=value …] [--out shot.png]
 //!                                                            drive a running app started with --control FILE
 //! ```
@@ -579,8 +580,13 @@ fn run(args: &[String]) -> Result<(), CliError> {
 
 #[cfg(feature = "mcp")]
 fn mcp(args: &[String]) -> Result<(), CliError> {
-    let mut server = pdfcraft_automation::mcp::McpServer::new(automation(args)?);
-    eprintln!("pdfcraft-cli: MCP server on stdio (protocol {}); close stdin to stop", pdfcraft_automation::mcp::PROTOCOL_VERSIONS[0]);
+    let compact = args.iter().any(|a| a == "--compact");
+    let mut server = pdfcraft_automation::mcp::McpServer::new(automation(args)?).with_compact(compact);
+    eprintln!(
+        "pdfcraft-cli: MCP server on stdio (protocol {}{}); close stdin to stop",
+        pdfcraft_automation::mcp::PROTOCOL_VERSIONS[0],
+        if compact { ", compact tool list" } else { "" }
+    );
     server.serve(std::io::stdin().lock(), std::io::stdout().lock()).map_err(|e| CliError::Message(e.to_string()))
 }
 
diff --git a/apps/pdfcraft-cli/tests/mcp_compact.rs b/apps/pdfcraft-cli/tests/mcp_compact.rs
new file mode 100644
index 00000000..8c12152a
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/mcp_compact.rs
@@ -0,0 +1,76 @@
+//! `pdfcraft-cli mcp --compact`: the flag reaches the server, `--root` is still honoured, and plain `mcp` still lists every tool.
+#![cfg(feature = "mcp")]
+
+use std::io::Write as _;
+use std::process::{Command, Stdio};
+
+use serde_json::{Value, json};
+
+/// Run `pdfcraft-cli mcp <flags>` over an initialize request plus `requests` and return the replies to `requests`.
+fn session(flags: &[&str], requests: &[Value]) -> Vec<Value> {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_pdfcraft-cli"))
+        .arg("mcp")
+        .args(flags)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .unwrap();
+    let mut input = String::from("{\"jsonrpc\":\"2.0\",\"id\":0,\"method\":\"initialize\",\"params\":{}}\n");
+    for r in requests {
+        input.push_str(&r.to_string());
+        input.push('\n');
+    }
+    child.stdin.take().unwrap().write_all(input.as_bytes()).unwrap();
+    let out = child.wait_with_output().unwrap();
+    assert!(out.status.success());
+    String::from_utf8(out.stdout).unwrap().lines().skip(1).map(|l| serde_json::from_str(l).unwrap()).collect()
+}
+
+fn request(id: u64, method: &str, params: Value) -> Value {
+    json!({ "jsonrpc": "2.0", "id": id, "method": method, "params": params })
+}
+
+/// The `tools/list` tool names of `pdfcraft-cli mcp <flags>`.
+fn listed_tools(flags: &[&str]) -> Vec<String> {
+    let reply = session(flags, &[request(1, "tools/list", json!({}))]).remove(0);
+    reply["result"]["tools"].as_array().unwrap().iter().map(|t| t["name"].as_str().unwrap().to_string()).collect()
+}
+
+#[test]
+fn compact_flag_shortens_the_tool_list() {
+    let full = listed_tools(&[]);
+    let compact = listed_tools(&["--compact"]);
+    assert_eq!(compact.len(), 12, "{compact:?}");
+    assert!(compact.iter().any(|n| n == "tool_search") && compact.iter().any(|n| n == "tool_call"));
+    assert!(compact.iter().all(|n| full.contains(n) || n == "tool_search" || n == "tool_call"));
+    assert!(full.len() > 100 && !full.iter().any(|n| n == "tool_search"), "{} tools", full.len());
+    // The flag can sit on either side of --root.
+    assert_eq!(listed_tools(&["--root", ".", "--compact"]), compact);
+    assert_eq!(listed_tools(&["--compact", "--root", "."]), compact);
+}
+
+#[test]
+fn compact_flag_keeps_the_root() {
+    let root = std::env::temp_dir().join(format!("pdfcraft-cli-compact-root-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(&root).unwrap();
+    let outside = std::env::temp_dir().join(format!("pdfcraft-cli-compact-outside-{}.pdf", std::process::id()));
+    let outside = outside.to_string_lossy().into_owned();
+    let root_arg = root.to_string_lossy().into_owned();
+    let open_outside =
+        request(1, "tools/call", json!({ "name": "tool_call", "arguments": { "name": "doc_open", "arguments": { "path": outside } } }));
+    let text = |reply: &Value| reply["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+
+    // With the root, in either flag order, a path outside it is refused with the root's own message.
+    for flags in [vec!["--root", root_arg.as_str(), "--compact"], vec!["--compact", "--root", root_arg.as_str()]] {
+        let reply = session(&flags, std::slice::from_ref(&open_outside)).remove(0);
+        assert_eq!(reply["result"]["isError"], true, "{flags:?}: {reply}");
+        assert!(text(&reply).contains("is outside the allowed directory"), "{flags:?}: {}", text(&reply));
+    }
+    // Without a root the same call gets past that check (the file does not exist, so it fails for that reason instead).
+    let reply = session(&["--compact"], std::slice::from_ref(&open_outside)).remove(0);
+    assert_eq!(reply["result"]["isError"], true, "{reply}");
+    assert!(!text(&reply).contains("is outside the allowed directory"), "{}", text(&reply));
+    let _ = std::fs::remove_dir_all(&root);
+}
diff --git a/crates/automation/README.md b/crates/automation/README.md
index d1d60f07..5bc4ac11 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -30,6 +30,8 @@ mcp::McpServer::new(a).serve(stdin, stdout)?             // newline-delimited JS
 
 **Opt-in only.** Nothing starts it automatically, and it opens no port. It runs while `pdfcraft-cli mcp [--root DIR]` runs, normally launched by an agent from its MCP configuration. It stops when stdin closes. The CLI's `mcp` Cargo feature (on by default) compiles it out entirely when disabled.
 
+`pdfcraft-cli mcp --compact` (or `McpServer::with_compact(true)`) keeps `tools/list` short for agents with small context budgets. It lists only the core tools (`mcp::COMPACT_CORE_TOOLS`: open, info, save, close, render, text extract and find, combine, split, undo) plus two meta tools: `tool_search` (optional `query` and `category`, the name prefix; or `name` for one tool's full `input_schema`) and `tool_call` (`name` and `arguments`, run through the same `Automation::call`). `tools/call` by name keeps working for every tool, and the server instructions mention the meta tools. Without the flag nothing changes.
+
 Implemented: `initialize` (protocol 2025-06-18, 2025-03-26, 2024-11-05), `ping`, `tools/list` (with `readOnlyHint`/`destructiveHint` annotations), `tools/call` (JSON results also returned as `structuredContent`; images as `image/png`), and `resources/list`, `resources/templates/list` and `resources/read`. The resources expose the open documents read-only: `pdfcraft://doc/{doc}/info` (JSON), `…/text`, `…/page/{page}/text` and `…/page/{page}/image{?dpi}` (PNG, 1–600 dpi). Tool failures come back as `isError: true` results, so the agent can read and recover from them.
 
 ## Adding a tool
diff --git a/crates/automation/src/mcp.rs b/crates/automation/src/mcp.rs
index e746cf53..14519093 100644
--- a/crates/automation/src/mcp.rs
+++ b/crates/automation/src/mcp.rs
@@ -31,13 +31,34 @@ const INSTRUCTIONS: &str = "PdfCraft edits PDFs. Open a file with doc_open to ge
 (edit_undo) and stay in memory until doc_save. Page numbers are 1-based. Open documents are also \
 resources: pdfcraft://doc/{doc}/info, /text, /page/{page}/text and /page/{page}/image.";
 
+/// Appended to the instructions in compact mode.
+const COMPACT_INSTRUCTIONS: &str = " Only a core set of tools is listed. Every other tool is still available: find it with \
+tool_search (optional query and category, or name for its full input schema) and run it with tool_call.";
+
+/// The tools `tools/list` returns in compact mode, besides the two meta tools.
+pub const COMPACT_CORE_TOOLS: &[&str] =
+    &["doc_open", "doc_info", "doc_save", "doc_close", "page_render", "text_extract", "text_find", "doc_combine", "doc_split", "edit_undo"];
+
+/// Meta tools that exist only in compact mode.
+const TOOL_SEARCH: &str = "tool_search";
+const TOOL_CALL: &str = "tool_call";
+
 pub struct McpServer {
     automation: Automation,
+    compact: bool,
 }
 
 impl McpServer {
     pub fn new(automation: Automation) -> Self {
-        Self { automation }
+        Self { automation, compact: false }
+    }
+
+    /// In compact mode `tools/list` returns only [`COMPACT_CORE_TOOLS`] plus `tool_search` and
+    /// `tool_call`, which find and run any other tool. `tools/call` accepts every tool by name
+    /// either way. Off by default.
+    pub fn with_compact(mut self, on: bool) -> Self {
+        self.compact = on;
+        self
     }
 
     pub fn automation(&self) -> &Automation {
@@ -93,18 +114,35 @@ impl McpServer {
                     "protocolVersion": version,
                     "capabilities": { "tools": { "listChanged": false }, "resources": { "listChanged": false, "subscribe": false } },
                     "serverInfo": { "name": "pdfcraft", "title": "PdfCraft", "version": env!("CARGO_PKG_VERSION"), "websiteUrl": pdfcraft_engine::links::APP_PAGE },
-                    "instructions": INSTRUCTIONS,
+                    "instructions": if self.compact { format!("{INSTRUCTIONS}{COMPACT_INSTRUCTIONS}") } else { INSTRUCTIONS.to_string() },
                 }))
             }
             "ping" => Ok(json!({})),
-            "tools/list" => Ok(json!({ "tools": crate::tools().iter().map(tool_json).collect::<Vec<_>>() })),
+            "tools/list" => Ok(json!({ "tools": self.tool_list() })),
             "tools/call" => {
                 let name = params.get("name").and_then(Value::as_str).ok_or((INVALID_PARAMS, "tools/call needs a tool name".to_string()))?;
                 let args = params.get("arguments").cloned().unwrap_or(Value::Null);
+                if self.compact && name == TOOL_SEARCH {
+                    return Ok(match search_tools(&args) {
+                        Ok(found) => call_result(vec![Content::Json(found)]),
+                        Err(message) => tool_error(&message),
+                    });
+                }
+                if self.compact && name == TOOL_CALL {
+                    let (inner, inner_args) = match unwrap_tool_call(&args) {
+                        Ok(pair) => pair,
+                        Err(message) => return Ok(tool_error(&message)),
+                    };
+                    return Ok(match self.automation.call(&inner, &inner_args) {
+                        Ok(content) => call_result(content),
+                        Err(ToolError::UnknownTool(t)) => tool_error(&format!("unknown tool {t:?}; use tool_search to find the right name")),
+                        Err(e) => tool_error(&e.to_string()),
+                    });
+                }
                 match self.automation.call(name, &args) {
                     Ok(content) => Ok(call_result(content)),
                     Err(ToolError::UnknownTool(t)) => Err((INVALID_PARAMS, format!("unknown tool {t:?}"))),
-                    Err(e) => Ok(json!({ "content": [{ "type": "text", "text": e.to_string() }], "isError": true })),
+                    Err(e) => Ok(tool_error(&e.to_string())),
                 }
             }
             "resources/list" => Ok(json!({ "resources": self.resource_list() })),
@@ -118,6 +156,149 @@ impl McpServer {
     }
 }
 
+impl McpServer {
+    /// What `tools/list` returns: every tool, or in compact mode the core set and the meta tools.
+    fn tool_list(&self) -> Vec<Value> {
+        let all = crate::tools();
+        if !self.compact {
+            return all.iter().map(tool_json).collect();
+        }
+        let mut out: Vec<Value> = COMPACT_CORE_TOOLS.iter().filter_map(|n| all.iter().find(|t| t.name == *n)).map(tool_json).collect();
+        out.extend(meta_tools());
+        out
+    }
+}
+
+/// The two tools only compact mode lists.
+fn meta_tools() -> [Value; 2] {
+    [
+        json!({
+            "name": TOOL_SEARCH,
+            "title": "Find PdfCraft tools",
+            "description": "Search and list all PdfCraft automation tools, including the core tools, with a one-sentence description each. Filter by query \
+        (words matched against name, title and description) and/or category (the name prefix: doc, page, text, form, …). \
+        With name, return that one tool in full, including its input_schema. Run a tool with tool_call.",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "query": { "type": "string", "description": "Words to look for, all of which must match (case-insensitive)." },
+                    "category": { "type": "string", "description": "Tool name prefix, e.g. page, text, form, redact." },
+                    "name": { "type": "string", "description": "Exact tool name: return its description and input_schema." },
+                },
+                "required": [],
+                "additionalProperties": false,
+            },
+            "annotations": { "title": "Find PdfCraft tools", "readOnlyHint": true, "destructiveHint": false, "openWorldHint": false },
+        }),
+        json!({
+            "name": TOOL_CALL,
+            "title": "Run any PdfCraft tool",
+            "description": "Run any PdfCraft tool by name with its arguments, exactly as if it were called directly. \
+        Find names and argument schemas with tool_search. The result is the tool's own result.",
+            "inputSchema": {
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string", "description": "The tool to run, e.g. page_rotate." },
+                    "arguments": { "type": "object", "description": "The tool's arguments (see its input_schema from tool_search)." },
+                },
+                "required": ["name"],
+                "additionalProperties": false,
+            },
+            "annotations": { "title": "Run any PdfCraft tool", "readOnlyHint": false, "destructiveHint": true, "openWorldHint": false },
+        }),
+    ]
+}
+
+/// The category of a tool: its name up to the first underscore (`page_rotate` → `page`).
+fn category_of(name: &str) -> &str {
+    name.split('_').next().unwrap_or(name)
+}
+
+/// A description up to and including its first sentence.
+fn first_sentence(text: &str) -> &str {
+    // ASCII lowercasing keeps byte offsets, so positions found in `lower` are valid in `text`.
+    let lower = text.to_ascii_lowercase();
+    let mut from = 0;
+    while let Some(i) = lower.get(from..).and_then(|rest| rest.find(". ")).map(|i| i + from) {
+        // "e.g. " and "i.e. " are abbreviations, not the end of the sentence.
+        if !lower.get(..i).is_some_and(|before| before.ends_with("e.g") || before.ends_with("i.e")) {
+            return text.get(..=i).unwrap_or(text);
+        }
+        from = i + 2;
+    }
+    text
+}
+
+/// Reject keys other than `allowed`, as the tool table does for a tool's own arguments.
+fn check_keys(tool: &str, args: &Value, allowed: &[&str]) -> Result<(), String> {
+    match args.as_object().and_then(|o| o.keys().find(|k| !allowed.contains(&k.as_str()))) {
+        Some(k) => Err(format!("{tool}: unknown argument {k:?} (expected: {})", allowed.join(", "))),
+        None => Ok(()),
+    }
+}
+
+/// `tool_search`: filter the tool table by query and category, or describe one tool in full.
+fn search_tools(args: &Value) -> Result<Value, String> {
+    if !(args.is_object() || args.is_null()) {
+        return Err(format!("{TOOL_SEARCH} takes an object with optional query, category and name"));
+    }
+    check_keys(TOOL_SEARCH, args, &["query", "category", "name"])?;
+    let text = |key: &str| match args.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(s)) => Ok(Some(s.trim())),
+        Some(_) => Err(format!("{TOOL_SEARCH}: {key} must be a string")),
+    };
+    let (query, category, name) = (text("query")?, text("category")?, text("name")?);
+    let all = crate::tools();
+    if let Some(name) = name {
+        let t =
+            all.iter().find(|t| t.name == name).ok_or_else(|| format!("unknown tool {name:?}; call {TOOL_SEARCH} without name to list the tools"))?;
+        return Ok(json!({ "tool": {
+            "name": t.name, "title": t.title, "category": category_of(t.name), "description": t.description,
+            "read_only": t.read_only, "destructive": t.destructive, "input_schema": t.input_schema,
+        } }));
+    }
+    let category = category.map(|c| c.trim_end_matches('_').to_lowercase()).filter(|c| !c.is_empty());
+    let words: Vec<String> = query.map(|q| q.to_lowercase().split_whitespace().map(str::to_owned).collect()).unwrap_or_default();
+    let mut categories: Vec<&str> = all.iter().map(|t| category_of(t.name)).collect();
+    categories.sort_unstable();
+    categories.dedup();
+    let found: Vec<Value> = all
+        .iter()
+        .filter(|t| category.as_deref().is_none_or(|c| category_of(t.name) == c))
+        .filter(|t| {
+            let haystack = format!("{} {} {}", t.name, t.title, t.description).to_lowercase();
+            words.iter().all(|w| haystack.contains(w.as_str()))
+        })
+        .map(|t| json!({ "name": t.name, "category": category_of(t.name), "description": first_sentence(t.description), "read_only": t.read_only }))
+        .collect();
+    Ok(json!({ "count": found.len(), "tools": found, "categories": categories }))
+}
+
+/// `tool_call`: the tool name and its arguments from the meta tool's own arguments.
+fn unwrap_tool_call(args: &Value) -> Result<(String, Value), String> {
+    let Some(obj) = args.as_object() else { return Err(format!("{TOOL_CALL} needs an object with name and arguments")) };
+    check_keys(TOOL_CALL, args, &["name", "arguments"])?;
+    let name = obj
+        .get("name")
+        .and_then(Value::as_str)
+        .ok_or_else(|| format!("{TOOL_CALL} needs the name of the tool to run; find it with {TOOL_SEARCH}"))?;
+    if name == TOOL_CALL || name == TOOL_SEARCH {
+        return Err(format!("{TOOL_SEARCH} and {TOOL_CALL} are called directly, not through {TOOL_CALL}"));
+    }
+    let inner = match obj.get("arguments") {
+        None | Some(Value::Null) => Value::Null,
+        Some(v @ Value::Object(_)) => v.clone(),
+        Some(_) => return Err(format!("{TOOL_CALL}: arguments must be an object")),
+    };
+    Ok((name.to_owned(), inner))
+}
+
+/// A failed tool call, as the agent should read it.
+fn tool_error(message: &str) -> Value {
+    json!({ "content": [{ "type": "text", "text": message }], "isError": true })
+}
+
 /// The resource behind a `pdfcraft://` URI.
 #[derive(Debug, PartialEq)]
 enum Resource {
@@ -262,7 +443,19 @@ fn call_result(content: Vec<Content>) -> Value {
 
 #[cfg(test)]
 mod tests {
-    use super::{Resource, parse_uri};
+    use super::{Resource, first_sentence, parse_uri};
+
+    #[test]
+    fn first_sentence_skips_abbreviations() {
+        assert_eq!(first_sentence("Rotate pages. Undoable."), "Rotate pages.");
+        assert_eq!(first_sentence("Label pages (i.e. roman numerals). Undoable."), "Label pages (i.e. roman numerals).");
+        assert_eq!(first_sentence("Label pages (I.E. roman numerals, E.G. i, ii). Undoable."), "Label pages (I.E. roman numerals, E.G. i, ii).");
+        assert_eq!(first_sentence("Use a value, e.g. en-US, or none. Then more."), "Use a value, e.g. en-US, or none.");
+        assert_eq!(first_sentence("No full stop here"), "No full stop here");
+        assert_eq!(first_sentence("Only an abbreviation, e.g. this"), "Only an abbreviation, e.g. this");
+        assert_eq!(first_sentence(""), "");
+        assert_eq!(first_sentence("Zażółć gęślą, i.e. jaźń. Dalej."), "Zażółć gęślą, i.e. jaźń.");
+    }
 
     #[test]
     fn resource_uris_parse() {
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 2f4449a9..95407fd4 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -590,6 +590,272 @@ fn mcp_resources_expose_open_documents() {
     assert_eq!(rpc(&mut s, 7, "resources/read", json!({ "uri": "pdfcraft://doc/1/page/9/image" }))["error"]["code"], -32602);
 }
 
+/// A server in compact mode with `dir` as its root.
+#[cfg(feature = "mcp")]
+fn compact_server(dir: &Path) -> McpServer {
+    McpServer::new(auto(dir)).with_compact(true)
+}
+
+/// Run a tool through the compact server's `tool_call`.
+#[cfg(feature = "mcp")]
+fn via_tool_call(s: &mut McpServer, id: u64, tool: &str, arguments: Value) -> Value {
+    rpc(s, id, "tools/call", json!({ "name": "tool_call", "arguments": { "name": tool, "arguments": arguments } }))
+}
+
+#[cfg(feature = "mcp")]
+fn tool_names(reply: &Value) -> Vec<String> {
+    reply["result"]["tools"].as_array().unwrap().iter().map(|t| t["name"].as_str().unwrap().to_string()).collect()
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_default_lists_every_tool_and_has_no_meta_tools() {
+    let mut s = McpServer::new(Automation::new());
+    let names = tool_names(&rpc(&mut s, 1, "tools/list", json!({})));
+    assert_eq!(names.len(), tools().len());
+    assert!(!names.iter().any(|n| n == "tool_search" || n == "tool_call"));
+    assert!(!rpc(&mut s, 2, "initialize", json!({}))["result"]["instructions"].as_str().unwrap().contains("tool_search"));
+    // Without --compact the meta tools do not exist.
+    assert_eq!(rpc(&mut s, 3, "tools/call", json!({ "name": "tool_search" }))["error"]["code"], -32602);
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_compact_lists_the_core_tools_and_two_meta_tools() {
+    let mut s = McpServer::new(Automation::new()).with_compact(true);
+    let list = rpc(&mut s, 1, "tools/list", json!({}));
+    let mut expected: Vec<String> = pdfcraft_automation::mcp::COMPACT_CORE_TOOLS.iter().map(|n| n.to_string()).collect();
+    expected.extend(["tool_search".to_string(), "tool_call".to_string()]);
+    assert_eq!(tool_names(&list), expected);
+    let all: Vec<&str> = tools().iter().map(|t| t.name).collect();
+    for core in pdfcraft_automation::mcp::COMPACT_CORE_TOOLS {
+        assert!(all.contains(core), "core tool {core} is not in the tool table");
+    }
+    // Core tools are the real definitions, and the list is far smaller than the full one.
+    let full = rpc(&mut McpServer::new(Automation::new()), 2, "tools/list", json!({}));
+    let core_open = list["result"]["tools"][0].clone();
+    assert_eq!(Some(&core_open), full["result"]["tools"].as_array().unwrap().iter().find(|t| t["name"] == "doc_open"));
+    assert!(list.to_string().len() * 5 < full.to_string().len(), "compact {} vs full {}", list.to_string().len(), full.to_string().len());
+    for meta in &list["result"]["tools"].as_array().unwrap()[10..] {
+        assert_eq!(meta["inputSchema"]["type"], "object");
+    }
+    let instructions = rpc(&mut s, 3, "initialize", json!({}))["result"]["instructions"].as_str().unwrap().to_string();
+    assert!(instructions.contains("tool_search") && instructions.contains("tool_call"), "{instructions}");
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_compact_tool_search_filters_by_query_and_category() {
+    let mut s = McpServer::new(Automation::new()).with_compact(true);
+    let mut search = |args: Value| rpc(&mut s, 1, "tools/call", json!({ "name": "tool_search", "arguments": args }));
+
+    let everything = search(json!({}));
+    assert_eq!(everything["result"]["isError"], false);
+    assert_eq!(everything["result"]["structuredContent"]["count"], tools().len());
+    let first = &everything["result"]["structuredContent"]["tools"][0];
+    assert!(first["name"].is_string() && first["description"].is_string() && first["read_only"].is_boolean(), "{first}");
+
+    let rotate = search(json!({ "query": "ROTATE" }))["result"]["structuredContent"].clone();
+    let names: Vec<&str> = rotate["tools"].as_array().unwrap().iter().map(|t| t["name"].as_str().unwrap()).collect();
+    assert!(names.contains(&"page_rotate"), "{names:?}");
+    assert!(names.len() < tools().len());
+
+    let docs = search(json!({ "category": "doc" }))["result"]["structuredContent"].clone();
+    let expected = tools().iter().filter(|t| t.name.starts_with("doc_")).count();
+    assert!(expected > 0);
+    assert_eq!(docs["count"], expected);
+    assert!(docs["tools"].as_array().unwrap().iter().all(|t| t["name"].as_str().unwrap().starts_with("doc_") && t["category"] == "doc"));
+
+    let both = search(json!({ "category": "page", "query": "rotate" }))["result"]["structuredContent"].clone();
+    assert!(both["tools"].as_array().unwrap().iter().all(|t| t["name"].as_str().unwrap().starts_with("page_")));
+    assert!(both["tools"].as_array().unwrap().iter().any(|t| t["name"] == "page_rotate"));
+
+    // No match is an empty result that lists the categories, not an error.
+    let none = search(json!({ "category": "nonsense" }));
+    assert_eq!(none["result"]["isError"], false);
+    assert_eq!(none["result"]["structuredContent"]["count"], 0);
+    assert!(none["result"]["structuredContent"]["categories"].as_array().unwrap().iter().any(|c| c == "page"));
+
+    // One tool in full.
+    let one = search(json!({ "name": "page_rotate" }))["result"]["structuredContent"]["tool"].clone();
+    assert_eq!(one["name"], "page_rotate");
+    assert_eq!(one["input_schema"]["type"], "object");
+    let def = tools().into_iter().find(|t| t.name == "page_rotate").unwrap();
+    assert_eq!(one["input_schema"], def.input_schema);
+    assert_eq!(one["description"], def.description);
+
+    // Bad arguments are tool errors.
+    for bad in [json!({ "name": "no_such_tool" }), json!({ "query": 3 }), json!({ "category": ["doc"] }), json!("doc")] {
+        let r = search(bad.clone());
+        assert_eq!(r["result"]["isError"], true, "{bad}");
+        assert!(r["result"]["content"][0]["text"].as_str().is_some_and(|t| !t.is_empty()));
+    }
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_compact_tool_call_dispatches_to_any_tool() {
+    let dir = workdir("mcp-compact");
+    let mut s = compact_server(&dir);
+    let opened = via_tool_call(&mut s, 1, "doc_open", json!({ "path": "a.pdf" }));
+    assert_eq!(opened["result"]["isError"], false);
+    assert_eq!(opened["result"]["structuredContent"]["pages"], 3);
+
+    // A tool outside the core list, through the meta tool.
+    let deleted = via_tool_call(&mut s, 2, "page_delete", json!({ "doc": 1, "pages": [3] }));
+    assert_eq!(deleted["result"]["isError"], false, "{deleted}");
+    assert_eq!(deleted["result"]["structuredContent"]["pages"], 2);
+
+    // The same tool called by name directly still works, and sees the same session.
+    let listed = rpc(&mut s, 3, "tools/call", json!({ "name": "doc_list", "arguments": {} }));
+    assert_eq!(listed["result"]["isError"], false);
+    assert_eq!(listed["result"]["structuredContent"]["documents"][0]["pages"], 2);
+
+    // Images come back as images.
+    let png = via_tool_call(&mut s, 4, "page_render", json!({ "doc": 1, "page": 1, "dpi": 36 }));
+    assert_eq!(png["result"]["content"][0]["type"], "image");
+
+    // `arguments` may be left out for tools that need none.
+    assert_eq!(via_tool_call(&mut s, 5, "doc_list", Value::Null)["result"]["isError"], false);
+    let no_args = rpc(&mut s, 6, "tools/call", json!({ "name": "tool_call", "arguments": { "name": "doc_list" } }));
+    assert_eq!(no_args["result"]["isError"], false);
+
+    // The result equals what the direct call returns.
+    let direct = rpc(&mut s, 7, "tools/call", json!({ "name": "doc_info", "arguments": { "doc": 1 } }));
+    let wrapped = via_tool_call(&mut s, 8, "doc_info", json!({ "doc": 1 }));
+    assert_eq!(direct["result"], wrapped["result"]);
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_compact_tool_call_reports_errors_without_panicking() {
+    let dir = workdir("mcp-compact-errors");
+    let mut s = compact_server(&dir);
+    let text = |r: &Value| r["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+
+    let unknown = via_tool_call(&mut s, 1, "no_such_tool", json!({}));
+    assert_eq!(unknown["result"]["isError"], true);
+    assert!(text(&unknown).contains("no_such_tool") && text(&unknown).contains("tool_search"), "{}", text(&unknown));
+
+    // The tool's own validation errors pass through.
+    let missing = via_tool_call(&mut s, 2, "doc_open", json!({}));
+    assert_eq!(missing["result"]["isError"], true);
+    let outside = via_tool_call(&mut s, 3, "doc_open", json!({ "path": "/definitely/not/here.pdf" }));
+    assert_eq!(outside["result"]["isError"], true);
+    let wrong_type = via_tool_call(&mut s, 4, "page_delete", json!({ "doc": "one", "pages": "all" }));
+    assert_eq!(wrong_type["result"]["isError"], true);
+
+    // Malformed meta-tool arguments.
+    for args in [
+        json!({}),
+        json!({ "name": 7 }),
+        json!({ "name": "doc_list", "arguments": [1] }),
+        json!("doc_list"),
+        Value::Null,
+        json!({ "name": "tool_call" }),
+        json!({ "name": "tool_search" }),
+    ] {
+        let r = rpc(&mut s, 5, "tools/call", json!({ "name": "tool_call", "arguments": args }));
+        assert_eq!(r["result"]["isError"], true, "{args}");
+        assert!(!text(&r).is_empty());
+    }
+
+    // Direct calls keep the usual protocol error for an unknown tool, and the session survives all of it.
+    assert_eq!(rpc(&mut s, 6, "tools/call", json!({ "name": "nope" }))["error"]["code"], -32602);
+    assert_eq!(via_tool_call(&mut s, 7, "doc_open", json!({ "path": "a.pdf" }))["result"]["isError"], false);
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_compact_tool_search_summarizes_the_first_sentence() {
+    let mut s = McpServer::new(Automation::new()).with_compact(true);
+    let mut summary = |tool: &str| {
+        let found = rpc(
+            &mut s,
+            1,
+            "tools/call",
+            json!({ "name": "tool_search", "arguments": { "query": tool, "category": tool.split('_').next().unwrap() } }),
+        );
+        found["result"]["structuredContent"]["tools"].as_array().unwrap().iter().find(|t| t["name"] == tool).unwrap()["description"]
+            .as_str()
+            .unwrap()
+            .to_string()
+    };
+    // Abbreviations such as "e.g." do not end the summary.
+    assert_eq!(summary("page_number"), "Label a range of pages (e.g. i, ii, iii for front matter, or A-1, A-2 for an appendix).");
+    assert_eq!(
+        summary("accessibility_fix"),
+        "Apply the checker's automatic fix for a rule: primary-language (value: the language, e.g. en-US), title (value: the title; default the current title or file name; also shows it in the title bar) or tab-order (every page tabs in structure order)."
+    );
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_compact_meta_tools_reject_unknown_arguments() {
+    let dir = workdir("mcp-compact-keys");
+    let mut s = compact_server(&dir);
+    let list = rpc(&mut s, 1, "tools/list", json!({}));
+    let metas = &list["result"]["tools"].as_array().unwrap()[10..];
+    assert_eq!(metas.len(), 2);
+    for meta in metas {
+        assert_eq!(meta["inputSchema"]["additionalProperties"], false, "{}", meta["name"]);
+    }
+    let text = |r: &Value| r["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+
+    // A misspelled filter is an error, not an unfiltered listing.
+    let typo = rpc(&mut s, 2, "tools/call", json!({ "name": "tool_search", "arguments": { "qurey": "rotate" } }));
+    assert_eq!(typo["result"]["isError"], true, "{typo}");
+    assert!(text(&typo).contains("\"qurey\"") && text(&typo).contains("query"), "{}", text(&typo));
+    let extra = rpc(&mut s, 3, "tools/call", json!({ "name": "tool_search", "arguments": { "query": "rotate", "extra": 1 } }));
+    assert_eq!(extra["result"]["isError"], true, "{extra}");
+    assert!(text(&extra).contains("\"extra\""), "{}", text(&extra));
+
+    // tool_call rejects extra outer keys before running anything.
+    let misspelled =
+        rpc(&mut s, 4, "tools/call", json!({ "name": "tool_call", "arguments": { "name": "doc_open", "argumentz": { "path": "a.pdf" } } }));
+    assert_eq!(misspelled["result"]["isError"], true, "{misspelled}");
+    assert!(text(&misspelled).contains("\"argumentz\""), "{}", text(&misspelled));
+    let extra = rpc(&mut s, 5, "tools/call", json!({ "name": "tool_call", "arguments": { "name": "doc_list", "unexpected": "value" } }));
+    assert_eq!(extra["result"]["isError"], true, "{extra}");
+    assert!(text(&extra).contains("\"unexpected\""), "{}", text(&extra));
+    assert_eq!(rpc(&mut s, 6, "tools/call", json!({ "name": "doc_list", "arguments": {} }))["result"]["structuredContent"]["documents"], json!([]));
+
+    // Keys inside "arguments" are left to the target tool, which rejects its unknown ones itself.
+    let inner = via_tool_call(&mut s, 7, "doc_list", json!({ "unexpected": "value" }));
+    assert_eq!(inner["result"]["isError"], true, "{inner}");
+    assert!(text(&inner).contains("doc_list: unknown argument \"unexpected\""), "{}", text(&inner));
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_compact_tool_call_keeps_the_root_confinement() {
+    let root = workdir("mcp-compact-root");
+    let outside_dir = workdir("mcp-compact-outside");
+    let outside = outside_dir.join("a.pdf").to_string_lossy().into_owned();
+    let text = |r: &Value| r["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+
+    // Direct call and tool_call both refuse a real PDF outside the root, with the same words.
+    let mut confined = compact_server(&root);
+    let direct = rpc(&mut confined, 1, "tools/call", json!({ "name": "doc_open", "arguments": { "path": outside } }));
+    assert_eq!(direct["result"]["isError"], true, "{direct}");
+    assert!(text(&direct).contains("is outside the allowed directory"), "{}", text(&direct));
+    let wrapped = via_tool_call(&mut confined, 2, "doc_open", json!({ "path": outside }));
+    assert_eq!(wrapped["result"]["isError"], true, "{wrapped}");
+    assert_eq!(text(&wrapped), text(&direct));
+    // Nothing was opened.
+    let listed = rpc(&mut confined, 3, "tools/call", json!({ "name": "doc_list", "arguments": {} }));
+    assert_eq!(listed["result"]["structuredContent"]["documents"], json!([]));
+
+    // The same file opens through tool_call on a server without a root, so the refusal came from the root.
+    let mut open = McpServer::new(Automation::new()).with_compact(true);
+    let opened = via_tool_call(&mut open, 4, "doc_open", json!({ "path": outside }));
+    assert_eq!(opened["result"]["isError"], false, "{opened}");
+    assert_eq!(opened["result"]["structuredContent"]["pages"], 3);
+
+    // And a file inside the root still opens through the confined server.
+    assert_eq!(via_tool_call(&mut confined, 5, "doc_open", json!({ "path": "a.pdf" }))["result"]["isError"], false);
+}
+
 #[test]
 fn parallel_text_extraction_keeps_page_order_and_follows_edits() {
     let dir = workdir("parallel");

From 05c8ab3b3e683382779afb9357513ab30eb1a927 Mon Sep 17 00:00:00 2001
From: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>
Date: Fri, 9 Oct 2026 02:30:25 +0530
Subject: [PATCH 012/149] =?UTF-8?q?M14:=20Telugu=20(=E0=B0=A4=E0=B1=86?=
 =?UTF-8?q?=E0=B0=B2=E0=B1=81=E0=B0=97=E0=B1=81)=20interface=20language=20?=
 =?UTF-8?q?(#349)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M14: Telugu interface font

- The interface takes `Telu` faces from craft-fonts after the CJK and Arabic ones, on the web too
- Test: Telugu text has glyphs in every family and its conjuncts are shaped

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>

* M14: Telugu interface language

- Complete te catalog: 1,984 entries plus whole-phrase Undo/Redo; te and te_IN locales use it
- Undo and Redo labels use a catalog phrase when the language has one (Telugu puts the verb last)
- Tests, docs, attribution, parity and ROADMAP

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>

* Add my contributor name (chiranjeevi-max)

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>

* M14: catalog contexts for labels with two meanings

- tl_ctx! gives the signature pad's Type, the Action Wizard's Start and the comment menu's Edit their own context; Telugu translates them, other languages keep their current translation
- Preferences' All tools goes through the catalog in every language

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>

* M14: Telugu for the look-alike web address warnings

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>

* M14: Telugu for the image signature notices

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>

* Telugu for Open Recent (#323)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.md                       |    3 +-
 ATTRIBUTION.toml                     |   11 +
 ROADMAP.md                           |    2 +
 contributors/people.toml             |    5 +
 crates/fonts/README.md               |    4 +-
 crates/fonts/build.rs                |    9 +-
 crates/fonts/src/craft.rs            |    7 +
 crates/fonts/src/lib.rs              |    1 +
 crates/ui-egui/src/actions_ui.rs     |    2 +-
 crates/ui-egui/src/comments_panel.rs |    2 +-
 crates/ui-egui/src/fill_sign.rs      |    2 +-
 crates/ui-egui/src/i18n/mod.rs       |  109 +-
 crates/ui-egui/src/i18n/te.tsv       | 2009 ++++++++++++++++++++++++++
 crates/ui-egui/src/js_ui.rs          |    2 +-
 crates/ui-egui/src/lib.rs            |    8 +
 crates/ui-egui/src/theme.rs          |    9 +-
 crates/ui-egui/tests/fonts.rs        |   29 +
 docs/localization.md                 |   12 +-
 parity/acrobat-features.toml         |    4 +-
 19 files changed, 2204 insertions(+), 26 deletions(-)
 create mode 100644 crates/ui-egui/src/i18n/te.tsv

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 4e3221a9..1f0283e0 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (249)
+## In this repository (250)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -14,6 +14,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/pt-br.tsv` | Brazilian Portuguese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/es.tsv` | Spanish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/fr.tsv` | French interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ja.tsv` | Japanese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 75aaceb2..b70f6b79 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -76,6 +76,17 @@ kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
 sha256 = "b131025cb6c14135440968f08ab6334d70dd3b20271539471878d3825ecc9629"
 
+[[asset]]
+path = "crates/ui-egui/src/i18n/te.tsv"
+title = "Telugu interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "1c8ce042942ac9169458e79261fc1d0647d4a3734e548799bf19b98eb314b9a2"
+
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
 title = "Japanese interface translation catalog"
diff --git a/ROADMAP.md b/ROADMAP.md
index b2b1f3c2..20e8c3e4 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -132,6 +132,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (community, M14, Telugu):** Telugu (తెలుగు, `te`) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; `te` and `te_IN` locales follow it. Telugu text is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (M14, Simplified Chinese About):** The About tabs, contributor controls and statistics, and model table now have Simplified Chinese translations, along with multiline link-privacy and cut-and-stack guidance. Coverage checks include direct `i18n::t` calls, multiline literals and dynamic credit labels; UI control checks exercise the translated About tabs and tables. Chinese font delivery remains incomplete; overall ≈ 30–35% (unchanged).
 
 - **2026-10-09 (M14, #305):** Windows MSI rejects per-user installation overrides while allowing removal of legacy per-user installs and keeps its progress message visible. README documents unattended deployment without a desktop shortcut. Compiled x64 MSI checks pass; ARM64 install regressions added for CI. Overall estimate unchanged (about 30–35%).
diff --git a/contributors/people.toml b/contributors/people.toml
index 2fa78330..d2a02079 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -46,3 +46,8 @@ sync_github_name = false
 real_name = "Marlon Konrad"
 display_name = "Marlon Konrad"
 sync_github_name = false
+
+[people.chiranjeevi-max]
+real_name = "Chiranjeevi Uddanti"
+display_name = "Chiranjeevi U"
+sync_github_name = false
diff --git a/crates/fonts/README.md b/crates/fonts/README.md
index ad104547..6f3056dc 100644
--- a/crates/fonts/README.md
+++ b/crates/fonts/README.md
@@ -23,12 +23,14 @@ set). Without that variable `CRAFT_FONTS` is empty and everything below copes:
   in Chinese mode, so one line never mixes faces with different vertical metrics).
 - `ui_arabic_fonts`: the `Arab` faces for Arabic-script interface text (file names, document
   titles), in manifest order.
+- `ui_telugu_fonts`: the `Telu` faces for Telugu interface text (the Telugu catalog, file names,
+  document titles), in manifest order.
 - `document_japanese_font` / `japanese_glyph`: the face (Shippori Mincho, then BIZ UDMincho) whose
   outlines become the Type 3 fallback font for Japanese text written into PDFs. Without it,
   `japanese_glyph` returns `GlyphError::NoFont` and the editor reports a clear error.
 - `SHIPPORI_MINCHO`: Shippori Mincho's bytes, or `None`.
 
-wasm32 builds embed only BIZ UDPGothic Regular and any `Arab` face, to keep the web build small: the web build
+wasm32 builds embed only BIZ UDPGothic Regular and any `Arab` or `Telu` face, to keep the web build small: the web build
 currently has no Chinese face, so Chinese there still shows the replacement glyph.
 Font files are never
 committed here (`AGENTS.md` §1.4; team members: [craftrules `standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md), internal).
diff --git a/crates/fonts/build.rs b/crates/fonts/build.rs
index 5ea3f38e..511f3774 100644
--- a/crates/fonts/build.rs
+++ b/crates/fonts/build.rs
@@ -1,8 +1,8 @@
 //! Embeds the fonts of the optional craft-fonts build input (`CRAFT_FONTS_DIR`) as `CRAFT_FONTS`.
 //! The recipe is craft-fonts' `docs/integration.md`; unset, `CRAFT_FONTS` is empty. It only reads
 //! the local checkout (no network). On wasm32 it embeds only the UI faces (BIZ UDPGothic Regular
-//! and any `Arab` face), to keep the web build within hosting limits (Cloudflare Pages: 25 MiB
-//! per file).
+//! and any `Arab` or `Telu` face), to keep the web build within hosting limits (Cloudflare Pages:
+//! 25 MiB per file).
 
 use std::fmt::Write as _;
 use std::path::PathBuf;
@@ -41,7 +41,10 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
         };
         // Arabic interface faces are small, so the web build keeps them too.
         let arabic = scripts.split(',').any(|s| s.trim() == "Arab");
-        if wasm && !(*family == "BIZ UDPGothic" && *style == "Regular") && !arabic {
+        // Telugu faces too, for the Telugu interface.
+        let telugu = scripts.split(',').any(|s| s.trim() == "Telu");
+        let web_face = (*family == "BIZ UDPGothic" && *style == "Regular") || arabic || telugu;
+        if wasm && !web_face {
             continue;
         }
         let path = dir.join(file).canonicalize().map_err(|e| format!("{file}: {e}"))?;
diff --git a/crates/fonts/src/craft.rs b/crates/fonts/src/craft.rs
index 2b9e8b92..3d1a87f3 100644
--- a/crates/fonts/src/craft.rs
+++ b/crates/fonts/src/craft.rs
@@ -53,6 +53,13 @@ fn arabic<'a>(faces: impl IntoIterator<Item = &'a CraftFont>) -> Vec<&'a CraftFo
     faces.into_iter().filter(|f| f.covers("Arab")).collect()
 }
 
+/// The `Telu` craft-fonts faces for Telugu interface text (the Telugu catalog, file names,
+/// document titles), in manifest order. Empty when built without craft-fonts or when it has no
+/// Telugu face.
+pub fn ui_telugu_fonts() -> Vec<&'static CraftFont> {
+    CRAFT_FONTS.iter().filter(|f| f.covers("Telu")).collect()
+}
+
 /// Interface CJK faces in fallback order for the UI language: Simplified Chinese first when
 /// `prefer_hans`, otherwise Japanese first (the historical default).
 ///
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index 9c9c7821..2994052f 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -11,6 +11,7 @@ pub mod pdf;
 mod script;
 pub use craft::{
     CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_japanese_font, ui_arabic_fonts, ui_chinese_fonts, ui_cjk_fonts, ui_japanese_fonts,
+    ui_telugu_fonts,
 };
 pub use script::{GlyphError, GlyphOutline, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, script_outline};
 
diff --git a/crates/ui-egui/src/actions_ui.rs b/crates/ui-egui/src/actions_ui.rs
index a60f1e8d..d3e0bfea 100644
--- a/crates/ui-egui/src/actions_ui.rs
+++ b/crates/ui-egui/src/actions_ui.rs
@@ -259,7 +259,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool
             }
         }
         ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Start"), true).clicked() {
+            if widgets::pill_button(ui, tl_ctx!("action wizard", "Start"), true).clicked() {
                 close = true;
                 app.start_selected_action();
             }
diff --git a/crates/ui-egui/src/comments_panel.rs b/crates/ui-egui/src/comments_panel.rs
index 421f182c..7ecb4b59 100644
--- a/crates/ui-egui/src/comments_panel.rs
+++ b/crates/ui-egui/src/comments_panel.rs
@@ -411,7 +411,7 @@ fn card(
         .layout(Layout::top_down_justified(Align::Min))
         .show(|ui| {
             ui.set_min_width(160.0);
-            if ui.button(tl!("Edit")).clicked() {
+            if ui.button(tl_ctx!("comment menu", "Edit")).clicked() {
                 view.comments.editing = Some((a.page, a.index, a.contents.clone().unwrap_or_default()));
                 ui.close();
             }
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index 702cc9c4..fe53c3f7 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -500,7 +500,7 @@ pub(crate) fn signature_pad(
     let title = if d.editing { tl!("Change {what}") } else { tl!("Create {what}") };
     ui.label(egui::RichText::new(crate::i18n::fmt(title, &[("what", what)])).font(crate::theme::semibold(18.0)));
     ui.horizontal(|ui| {
-        if crate::widgets::pill_button(ui, tl!("Type"), !d.drawing && !d.image_mode).clicked() {
+        if crate::widgets::pill_button(ui, tl_ctx!("signature pad", "Type"), !d.drawing && !d.image_mode).clicked() {
             d.drawing = false;
             d.image_mode = false;
         }
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index d88bc99e..9b9c7209 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -17,7 +17,7 @@
 //!
 //! # Looking strings up
 //! - [`tl!`](crate::tl) / [`t`]: a plain string in the current language. [`tr`]: in a given one.
-//! - [`tr_ctx`]: when one English word needs different translations.
+//! - [`tr_ctx`] (`tl_ctx!` in UI code): when one English word needs different translations.
 //! - [`tr_id`]: a command-id keyed string with the English label as fallback (menu items), so a
 //!   translation survives rewording of the English text and can differ per command.
 //! - [`trn`]: plural-aware (`{n}` is filled in). [`fmt`]: fill `{name}` placeholders after [`tr`];
@@ -75,7 +75,7 @@ fn plural_fr(n: u64) -> usize {
 }
 
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 8] = [
+pub static LANGUAGES: [LangInfo; 9] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -90,6 +90,8 @@ pub static LANGUAGES: [LangInfo; 8] = [
     LangInfo { code: "es", name: "Español", source: include_str!("es.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
     // French; every `fr-*` locale (`fr-FR`, `fr-CA`, `fr-BE` ...) resolves here.
     LangInfo { code: "fr", name: "Français", source: include_str!("fr.tsv"), plural: plural_fr, catalog: OnceLock::new() },
+    // Telugu; every `te-*` locale (`te-IN`) resolves here.
+    LangInfo { code: "te", name: "తెలుగు", source: include_str!("te.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
 ];
 
 impl LangInfo {
@@ -343,11 +345,17 @@ pub fn action_label(text: &str) -> String {
     t(text).to_owned()
 }
 
-/// A command label such as "Undo Insert pages from a.pdf" in the current language.
+/// A command label such as "Undo Insert pages from a.pdf" in the current language. A catalog
+/// whose word order doesn't put the verb first translates "Undo {action}" and "Redo {action}"
+/// as whole phrases; otherwise the translated verb goes before the action.
 pub fn command_label(text: &str) -> String {
-    for prefix in ["Undo", "Redo"] {
+    for (prefix, template) in [("Undo", "Undo {action}"), ("Redo", "Redo {action}")] {
         if let Some(action) = text.strip_prefix(prefix).and_then(|tail| tail.strip_prefix(' ')) {
-            return format!("{} {}", t(prefix), action_label(action));
+            let action = action_label(action);
+            if has(current(), template) {
+                return fmt(t(template), &[("action", &action)]);
+            }
+            return format!("{} {action}", t(prefix));
         }
     }
     t(text).to_owned()
@@ -712,6 +720,97 @@ mod tests {
         }
     }
 
+    #[test]
+    fn telugu_is_registered() {
+        let te = Lang::from_code("te").expect("te registered");
+        assert_eq!(te.name(), "తెలుగు");
+        assert_eq!(normalize_pref("TE"), Some("te"));
+        assert_eq!(lang_from_tag("te_IN.UTF-8"), Some(te));
+        assert_eq!(first_supported("te-IN\r\nen-US"), Some(te));
+        assert_eq!(tr(te, "File"), "ఫైల్");
+        assert_eq!(tr(te, "Save as…"), "వేరే పేరుతో సేవ్ చేయి…");
+        assert_eq!(tr(te, "నివేదిక.pdf"), "నివేదిక.pdf");
+        assert_eq!(trn(te, 1, "{n} page", "{n} pages"), "1 పేజీ");
+        assert_eq!(trn(te, 3, "{n} page", "{n} pages"), "3 పేజీలు");
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", "te").unwrap();
+        assert_eq!(app.language, "te");
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, "te");
+    }
+
+    /// Telugu puts the verb last, so it translates "Undo {action}" as a whole phrase; a catalog
+    /// without that entry (Spanish) keeps the verb in front of the action.
+    #[test]
+    fn undo_and_redo_labels_use_the_catalog_phrase_when_there_is_one() {
+        let te = Lang::from_code("te").expect("te registered");
+        set_current(te);
+        assert_eq!(command_label("Undo"), "రద్దు చేయి");
+        assert_eq!(command_label("Undo Untranslated custom action"), "రద్దు చేయి: Untranslated custom action");
+        assert_eq!(command_label("Redo Untranslated custom action"), "మళ్లీ చేయి: Untranslated custom action");
+        let es = Lang::from_code("es").expect("es registered");
+        set_current(es);
+        assert_eq!(command_label("Undo Untranslated custom action"), format!("{} Untranslated custom action", tr(es, "Undo")));
+        set_current(Lang::EN);
+        assert_eq!(command_label("Undo Untranslated custom action"), "Undo Untranslated custom action");
+    }
+
+    /// A label that reads differently by use has its own contextual entry where a language needs
+    /// one; a language without it falls back to the plain translation.
+    #[test]
+    fn contextual_labels_fall_back_to_the_plain_translation() {
+        let te = Lang::from_code("te").expect("te registered");
+        assert_eq!(tr_ctx(te, "signature pad", "Type"), "టైప్ చేయి");
+        assert_eq!(tr(te, "Type"), "రకం");
+        let es = Lang::from_code("es").expect("es registered");
+        assert_eq!(tr_ctx(es, "signature pad", "Type"), tr(es, "Type"));
+    }
+
+    /// Telugu translates every registered command and every All tools group, section and item.
+    #[test]
+    fn telugu_covers_commands_and_catalogue() {
+        let te = Lang::from_code("te").expect("te registered");
+        for command in pdfcraft_engine::commands::COMMANDS {
+            assert!(has(te, command.label), "missing command: {}", command.label);
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            assert!(has(te, group.label), "missing group: {}", group.label);
+            for section in group.sections {
+                assert!(has(te, section.title), "missing section: {}", section.title);
+                for item in section.items {
+                    assert!(has(te, item.label), "missing item: {}", item.label);
+                }
+            }
+        }
+    }
+
+    /// With a craft-fonts Telugu face, every Telugu translation has glyphs: with all interface
+    /// faces (desktop) and with the Telugu face as the only craft-fonts face (the web build keeps
+    /// it; Telugu labels must not need a Japanese or Arabic face).
+    #[test]
+    fn telugu_labels_have_glyphs() {
+        let telugu: Vec<String> = pdfcraft_fonts::ui_telugu_fonts().iter().map(|f| f.name()).collect();
+        if telugu.is_empty() {
+            eprintln!("skipping Telugu glyph checks: build with CRAFT_FONTS_DIR and a Telugu face to run them");
+            return;
+        }
+        let te = Lang::from_code("te").expect("te registered");
+        let (entries, _) = parse_entries(te.0.source, te.0.plural_forms());
+        let labels: String = entries.iter().flat_map(|e| e.translation.chars()).chain(te.name().chars()).filter(|c| !c.is_control()).collect();
+        let mut telugu_only = crate::theme::font_definitions();
+        for family in telugu_only.families.values_mut() {
+            family.retain(|name| !pdfcraft_fonts::CRAFT_FONTS.iter().any(|face| face.name() == *name) || telugu.contains(name));
+        }
+        use egui::epaint::text::{Fonts, TextOptions};
+        for (build, defs) in [("all faces", crate::theme::font_definitions()), ("Telugu face only", telugu_only)] {
+            let mut fonts = Fonts::new(TextOptions::default(), defs);
+            for id in [egui::FontId::proportional(13.0), egui::FontId::monospace(13.0), crate::theme::medium(13.0), crate::theme::semibold(17.0)] {
+                assert!(fonts.has_glyphs(&id, &labels), "{build}: {id:?} lacks a Telugu label glyph");
+            }
+        }
+    }
+
     /// Czech covers every registered menu title and menu command label (#68), keeps ellipses, and
     /// only leaves untranslated what is deliberately the same in Czech.
     #[test]
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
new file mode 100644
index 00000000..2734a776
--- /dev/null
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -0,0 +1,2009 @@
+# Telugu (te) catalog. Format: see the header of ja.tsv
+# (context <TAB> source <TAB> translation; @id, @plural and other contexts; escapes \n \t \\).
+# Plural forms (see `plural_one_other` in i18n/mod.rs): one (1) | other.
+#
+# Clean-room: every entry was written from the plain meaning of the English label and the code
+# that shows it, using everyday Telugu computing vocabulary. No proprietary localisation resource,
+# string table or product UI (Acrobat's included) was consulted or copied; add entries the same
+# way.
+# Style: commands are plain imperatives (సేవ్ చేయి), titles and labels are nouns, sentences are
+# polite (…ఎంచుకోండి). Words Telugu users already say in English keep that form in Telugu script
+# (ఫైల్, పేజీ, జూమ్); a Telugu word is used where it is natural (పత్రం, సంతకం, వ్యాఖ్య).
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
+# the trailing "…" of dialog commands is kept.
+
+	Menu	మెనూ
+	File	ఫైల్
+	Edit	సవరణ
+comment menu	Edit	సవరించు
+	Pages	పేజీలు
+	View	వీక్షణ
+	Help	సహాయం
+	Preferences	ప్రాధాన్యతలు
+	Preferences…	ప్రాధాన్యతలు…
+	Interface language	ఇంటర్‌ఫేస్ భాష
+	Identity	గుర్తింపు
+	Name on new comments	కొత్త వ్యాఖ్యలపై చూపే పేరు
+	Open…	తెరువు…
+	New blank PDF	కొత్త ఖాళీ PDF
+	Create PDF from file…	ఫైల్ నుండి PDF సృష్టించు…
+	Create PDF from images…	చిత్రాల నుండి PDF సృష్టించు…
+	Create PDF from clipboard	క్లిప్‌బోర్డ్ నుండి PDF సృష్టించు
+	Combine files…	ఫైల్‌లను కలుపు…
+	Save	సేవ్ చేయి
+	Save as…	వేరే పేరుతో సేవ్ చేయి…
+	Close file	ఫైల్‌ను మూసివేయి
+	Close all	అన్నీ మూసివేయి
+	Revert	సేవ్ చేసిన స్థితికి మార్చు
+	Print…	ముద్రించు…
+	Document properties…	పత్ర లక్షణాలు…
+	Undo	రద్దు చేయి
+	Redo	మళ్లీ చేయి
+	Undo {action}	రద్దు చేయి: {action}
+	Redo {action}	మళ్లీ చేయి: {action}
+	Find…	కనుగొను…
+	Advanced search…	అధునాతన శోధన…
+	Copy pages	పేజీలను కాపీ చేయి
+	Cut pages	పేజీలను కత్తిరించు
+	Paste pages	పేజీలను అతికించు
+	Fit visible	కనిపించే భాగానికి సరిపోయేలా
+	Marquee zoom	ఎంచుకున్న ప్రాంతానికి జూమ్
+	Take a snapshot	స్నాప్‌షాట్ తీయి
+	Full screen mode	పూర్తి స్క్రీన్ మోడ్
+	Read mode	చదివే మోడ్
+	Switch light / dark theme	లేత / ముదురు థీమ్‌ల మధ్య మారు
+	Comments panel	వ్యాఖ్యల ప్యానెల్
+	Form fields panel	ఫారం ఫీల్డ్‌ల ప్యానెల్
+	Clear form	ఫారాన్ని క్లియర్ చేయి
+	Find tools and commands…	సాధనాలను, కమాండ్‌లను కనుగొను…
+	Zoom	జూమ్
+	Actual size	అసలు పరిమాణం
+	Zoom to page level	పేజీకి సరిపోయేలా జూమ్
+	Fit to width	వెడల్పుకు సరిపోయేలా
+	Display theme	ప్రదర్శన థీమ్
+	Side panels	సైడ్ ప్యానెల్‌లు
+	Enable Acrobat JavaScript	Acrobat JavaScriptను ప్రారంభించు
+	OK	సరే
+	Join our Discord	మా Discordలో చేరండి
+	Close	మూసివేయి
+	Next / previous match	తదుపరి / మునుపటి సరిపోలిక
+	Copy selected text	ఎంచుకున్న టెక్స్ట్‌ను కాపీ చేయి
+	Double-click	డబుల్-క్లిక్
+	Select a word	ఒక పదాన్ని ఎంచుకో
+	Clear selection / close find	ఎంపికను క్లియర్ చేయి / శోధనను మూసివేయి
+	Zoom in / out (also pinch or ⌘-scroll)	జూమ్ పెంచు / తగ్గించు (పించ్ లేదా ⌘-స్క్రోల్‌తో కూడా)
+	Rotate view	వీక్షణను తిప్పు
+	First / last page	మొదటి / చివరి పేజీ
+	Previous / next page	మునుపటి / తదుపరి పేజీ
+	Delete selected pages (Organize)	ఎంచుకున్న పేజీలను తొలగించు (పేజీల నిర్వహణలో)
+	Select all pages (Organize)	అన్ని పేజీలను ఎంచుకో (పేజీల నిర్వహణలో)
+	Home	హోమ్
+	Open	తెరువు
+	Open a PDF (⌘O)	PDFను తెరువు (⌘O)
+	Dark gray theme	ముదురు బూడిద రంగు థీమ్
+	Light theme	లేత థీమ్
+	All tools	అన్ని సాధనాలు
+	Read	చదవడం
+	Convert	మార్పిడి
+	E-Sign	ఇ-సంతకం
+	Print (⌘P)	ముద్రించు (⌘P)
+	Save (M4)	సేవ్ చేయి (M4)
+	Document properties (⌘D)	పత్ర లక్షణాలు (⌘D)
+	Find tools and commands	సాధనాలను, కమాండ్‌లను కనుగొను
+	Fit to height	ఎత్తుకు సరిపోయేలా
+	Zoom in	జూమ్ పెంచు
+	Zoom out	జూమ్ తగ్గించు
+	Rotate view clockwise	వీక్షణను సవ్యదిశలో తిప్పు
+	Rotate view counterclockwise	వీక్షణను అపసవ్యదిశలో తిప్పు
+	Page navigation	పేజీ నావిగేషన్
+	Previous view	మునుపటి వీక్షణ
+	Next view	తదుపరి వీక్షణ
+	Page display	పేజీ ప్రదర్శన
+	Continuous scrolling	నిరంతర స్క్రోలింగ్
+	Two-page view	రెండు పేజీల వీక్షణ
+	Single page	ఒకే పేజీ
+	Show cover page in two-page view	రెండు పేజీల వీక్షణలో కవర్ పేజీని చూపించు
+	Use system setting	సిస్టమ్ సెట్టింగ్‌ను ఉపయోగించు
+	Light gray	లేత బూడిద రంగు
+	Dark gray	ముదురు బూడిద రంగు
+	Comments	వ్యాఖ్యలు
+	Bookmarks	బుక్‌మార్క్‌లు
+	Fields	ఫీల్డ్‌లు
+	Layers	లేయర్‌లు
+	Attachments	జోడింపులు
+	Signatures	సంతకాలు
+	Accessibility Checker	యాక్సెసిబిలిటీ తనిఖీ సాధనం
+	Search	శోధన
+	Compare	పోల్చు
+	Page thumbnails	పేజీ థంబ్‌నెయిల్‌లు
+	Form fields	ఫారం ఫీల్డ్‌లు
+	Zoom out (⌘−)	జూమ్ తగ్గించు (⌘−)
+	Zoom in (⌘+)	జూమ్ పెంచు (⌘+)
+	Rotate view clockwise (⇧⌘+)	వీక్షణను సవ్యదిశలో తిప్పు (⇧⌘+)
+	Toggle fit page / fit width	పేజీకి సరిపోయేలా / వెడల్పుకు సరిపోయేలా మధ్య మారు
+	Next page	తదుపరి పేజీ
+	Previous page	మునుపటి పేజీ
+	Current page — type a page number or label (such as iv) and press Enter	ప్రస్తుత పేజీ — పేజీ సంఖ్యను లేదా లేబుల్‌ను (iv వంటిది) టైప్ చేసి Enter నొక్కండి
+	Welcome to PdfCraft	PdfCraftకు స్వాగతం
+	An open-source PDF workbench — local, private, and scriptable.	ఓపెన్-సోర్స్ PDF వర్క్‌బెంచ్ — మీ కంప్యూటర్‌లోనే నడుస్తుంది, గోప్యంగా ఉంటుంది, స్క్రిప్ట్‌లతో ఆటోమేట్ చేయవచ్చు.
+	Join the ArtCraft community	ArtCraft కమ్యూనిటీలో చేరండి
+	Get help, share feedback and follow development on Discord.	Discordలో సహాయం పొందండి, మీ అభిప్రాయాన్ని పంచుకోండి, అభివృద్ధిని అనుసరించండి.
+	Recommended tools	సిఫార్సు చేసిన సాధనాలు
+	Use now	ఇప్పుడే ఉపయోగించు
+	Open file	ఫైల్‌ను తెరువు
+	Recent	ఇటీవలి
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	PdfCraftలో మీరు తెరిచే ఫైల్‌లు ఇక్కడ కనిపిస్తాయి. PDFను తెరవడానికి దాన్ని ఎక్కడైనా లాగి వదలండి.
+	Privacy	గోప్యత
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft ఆఫ్‌లైన్‌లో పనిచేస్తుంది. టెలిమెట్రీ లేదు, ఖాతా అవసరం లేదు, మీరు ప్రొవైడర్‌ను జోడిస్తే తప్ప క్లౌడ్ ప్రాసెసింగ్ ఉండదు.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	స్క్రిప్ట్‌లు ఫైల్ లేదా నెట్‌వర్క్ యాక్సెస్ లేని శాండ్‌బాక్స్‌లో నడుస్తాయి. JavaScript ఆఫ్‌లో ఉన్నా, Acrobat ప్రామాణిక ఫార్మాట్, ధృవీకరణ, గణన ఫంక్షన్‌లు పనిచేస్తాయి.
+	Back to all tools	అన్ని సాధనాలకు తిరిగి వెళ్లు
+	Close panel	ప్యానెల్‌ను మూసివేయి
+	View less	తక్కువ చూపించు
+	View more	మరిన్ని చూపించు
+	Available	అందుబాటులో ఉంది
+	Ready	సిద్ధం
+	Search tools and commands…	సాధనాలు, కమాండ్‌లలో వెతుకు…
+	No matching tools	సరిపోలే సాధనాలు లేవు
+	Tool	సాధనం
+	Command	కమాండ్
+	Add a sticky note	స్టిక్కీ నోట్ జోడించు
+	Add a text box	టెక్స్ట్ బాక్స్ జోడించు
+	Highlight text	టెక్స్ట్‌ను హైలైట్ చేయి
+	Underline text	టెక్స్ట్‌కు అండర్‌లైన్ చేయి
+	Strikethrough text	టెక్స్ట్‌ను కొట్టివేయి
+	Squiggly underline text	టెక్స్ట్‌కు స్క్విగ్లీ అండర్‌లైన్ చేయి
+	Draw freehand	చేతితో గీయి
+	Draw a line	గీత గీయి
+	Draw an arrow	బాణం గీయి
+	Draw a rectangle	దీర్ఘచతురస్రం గీయి
+	Draw an oval	అండాకారం గీయి
+	Draw a polygon	పాలీగాన్ గీయి
+	Draw connected lines	కలిపిన గీతలు గీయి
+	Draw a cloud	క్లౌడ్ గీయి
+	Add a callout	కాల్‌అవుట్ జోడించు
+	Insert text	టెక్స్ట్‌ను చొప్పించు
+	Replace text	టెక్స్ట్‌ను భర్తీ చేయి
+	Attach a file	ఫైల్‌ను జోడించు
+	Erase drawings	డ్రాయింగ్‌లను చెరిపివేయి
+	Flatten comments	వ్యాఖ్యలను ఫ్లాటెన్ చేయి
+	Import comments…	వ్యాఖ్యలను దిగుమతి చేయి…
+	Add a stamp	స్టాంప్ జోడించు
+	Export all comments to data file…	అన్ని వ్యాఖ్యలను డేటా ఫైల్‌కు ఎగుమతి చేయి…
+	Hide all comments	అన్ని వ్యాఖ్యలను దాచు
+	Summarize comments	వ్యాఖ్యల సారాంశాన్ని సృష్టించు
+	Import form data…	ఫారం డేటాను దిగుమతి చేయి…
+	Export form data…	ఫారం డేటాను ఎగుమతి చేయి…
+	PDF/A…	PDF/A…
+	Action Wizard…	చర్యల విజార్డ్…
+	Prepare for distribution…	పంపిణీకి సిద్ధం చేయి…
+	Optimize scanned documents…	స్కాన్ చేసిన పత్రాలను ఆప్టిమైజ్ చేయి…
+	Compare files…	ఫైల్‌లను పోల్చు…
+	Detect form fields	ఫారం ఫీల్డ్‌లను గుర్తించు
+	Merge data files into spreadsheet…	డేటా ఫైల్‌లను స్ప్రెడ్‌షీట్‌లోకి విలీనం చేయి…
+	Flatten form fields	ఫారం ఫీల్డ్‌లను ఫ్లాటెన్ చేయి
+	Prepare a form	ఫారాన్ని సిద్ధం చేయి
+	Tab order: by rows	ట్యాబ్ క్రమం: అడ్డు వరుసల వారీగా
+	Tab order: by columns	ట్యాబ్ క్రమం: నిలువు వరుసల వారీగా
+	Tab order: by document structure	ట్యాబ్ క్రమం: పత్ర నిర్మాణం ప్రకారం
+	Add text	టెక్స్ట్ జోడించు
+	Edit text & images	టెక్స్ట్ & చిత్రాలను సవరించు
+	Add or edit links	లింక్‌లను జోడించు లేదా సవరించు
+	Create links from URLs	URLల నుండి లింక్‌లను సృష్టించు
+	Remove all links	అన్ని లింక్‌లను తీసివేయి
+	Add Bates numbering…	బేట్స్ నంబరింగ్ జోడించు…
+	Add image…	చిత్రాన్ని జోడించు…
+	Redact text and images	టెక్స్ట్‌ను, చిత్రాలను రెడాక్ట్ చేయి
+	Redact pages…	పేజీలను రెడాక్ట్ చేయి…
+	Find text and redact…	టెక్స్ట్‌ను కనుగొని రెడాక్ట్ చేయి…
+	Redaction properties…	రెడాక్షన్ లక్షణాలు…
+	Apply redactions…	రెడాక్షన్‌లను వర్తింపజేయి…
+	Clear redaction marks	రెడాక్షన్ గుర్తులను క్లియర్ చేయి
+	Remove hidden information…	దాచిన సమాచారాన్ని తీసివేయి…
+	Sanitize document…	పత్రాన్ని శుభ్రపరచు…
+	Field properties…	ఫీల్డ్ లక్షణాలు…
+	Add a text field	టెక్స్ట్ ఫీల్డ్ జోడించు
+	Add a checkbox	చెక్ బాక్స్ జోడించు
+	Add a radio button	రేడియో బటన్ జోడించు
+	Add a drop-down list	డ్రాప్‌డౌన్ జాబితా జోడించు
+	Add a list box	లిస్ట్ బాక్స్ జోడించు
+	Add a button	బటన్ జోడించు
+	Add an image field	చిత్ర ఫీల్డ్ జోడించు
+	Add a date field	తేదీ ఫీల్డ్ జోడించు
+	Add a digital signature field	డిజిటల్ సంతకం ఫీల్డ్ జోడించు
+	Digitally sign	డిజిటల్‌గా సంతకం చేయి
+	Certify (visible signature)	సర్టిఫై చేయి (కనిపించే సంతకం)
+	Certify (invisible signature)	సర్టిఫై చేయి (కనిపించని సంతకం)
+	Validate all signatures	అన్ని సంతకాలను ధృవీకరించు
+	Signatures panel	సంతకాల ప్యానెల్
+	Fill & Sign: add text	నింపడం & సంతకం: టెక్స్ట్ జోడించు
+	Fill & Sign: checkmark	నింపడం & సంతకం: టిక్ గుర్తు
+	Fill & Sign: cross	నింపడం & సంతకం: క్రాస్ గుర్తు
+	Fill & Sign: dot	నింపడం & సంతకం: చుక్క
+	Fill & Sign: line	నింపడం & సంతకం: గీత
+	Fill & Sign: date	నింపడం & సంతకం: తేదీ
+	Fill & Sign: sign	నింపడం & సంతకం: సంతకం చేయి
+	Fill & Sign: initials	నింపడం & సంతకం: పొడి అక్షరాలు
+	Export to image…	చిత్రంగా ఎగుమతి చేయి…
+	Reduce file size…	ఫైల్ పరిమాణాన్ని తగ్గించు…
+	Optimize PDF…	PDFను ఆప్టిమైజ్ చేయి…
+	Export to text…	టెక్స్ట్‌గా ఎగుమతి చేయి…
+	Export to Word…	Wordగా ఎగుమతి చేయి…
+	Export to HTML…	HTMLగా ఎగుమతి చేయి…
+	Export to RTF…	RTFగా ఎగుమతి చేయి…
+	JavaScript console…	JavaScript కన్సోల్…
+	Document JavaScripts…	పత్రంలోని JavaScriptలు…
+	Recognize text…	టెక్స్ట్‌ను గుర్తించు…
+	Recognize text in multiple files…	అనేక ఫైల్‌లలో టెక్స్ట్‌ను గుర్తించు…
+	Check for accessibility…	యాక్సెసిబిలిటీని తనిఖీ చేయి…
+	Open accessibility report	యాక్సెసిబిలిటీ నివేదికను తెరువు
+	Change reading options…	చదివే ఎంపికలను మార్చు…
+	Add alternate text…	ప్రత్యామ్నాయ టెక్స్ట్‌ను జోడించు…
+	Export all images…	అన్ని చిత్రాలను ఎగుమతి చేయి…
+	Add header & footer…	హెడర్ & ఫుటర్ జోడించు…
+	Update header & footer…	హెడర్ & ఫుటర్‌ను అప్‌డేట్ చేయి…
+	Remove header & footer	హెడర్ & ఫుటర్‌ను తీసివేయి
+	Add watermark…	వాటర్‌మార్క్ జోడించు…
+	Update watermark…	వాటర్‌మార్క్‌ను అప్‌డేట్ చేయి…
+	Remove watermark	వాటర్‌మార్క్‌ను తీసివేయి
+	Add background…	నేపథ్యాన్ని జోడించు…
+	Update background…	నేపథ్యాన్ని అప్‌డేట్ చేయి…
+	Remove background	నేపథ్యాన్ని తీసివేయి
+	Protect using password…	పాస్‌వర్డ్‌తో రక్షించు…
+	Remove security	భద్రతను తీసివేయి
+	Security properties…	భద్రతా లక్షణాలు…
+	Organize pages	పేజీలను నిర్వహించు
+	New bookmark	కొత్త బుక్‌మార్క్
+	Rotate pages clockwise	పేజీలను సవ్యదిశలో తిప్పు
+	Rotate pages counterclockwise	పేజీలను అపసవ్యదిశలో తిప్పు
+	Delete pages	పేజీలను తొలగించు
+	Insert blank page	ఖాళీ పేజీని చొప్పించు
+	Rotate pages…	పేజీలను తిప్పు…
+	Duplicate pages	పేజీలను నకలు చేయి
+	Crop pages	పేజీలను క్రాప్ చేయి
+	Set page boxes…	పేజీ బాక్స్‌లను సెట్ చేయి…
+	Insert pages from file…	ఫైల్ నుండి పేజీలను చొప్పించు…
+	Replace pages…	పేజీలను భర్తీ చేయి…
+	Extract pages…	పేజీలను వేరు తీయి…
+	Split document…	పత్రాన్ని విభజించు…
+	Number pages…	పేజీలకు సంఖ్యలు వేయి…
+	Keyboard shortcuts	కీబోర్డ్ షార్ట్‌కట్‌లు
+	Join the ArtCraft Discord	ArtCraft Discordలో చేరండి
+	PdfCraft web page	PdfCraft వెబ్ పేజీ
+	PdfCraft on GitHub	GitHubలో PdfCraft
+	ArtCraft website	ArtCraft వెబ్‌సైట్
+	Check for updates…	అప్‌డేట్‌ల కోసం తనిఖీ చేయి…
+	About PdfCraft	PdfCraft గురించి
+	Export a PDF	PDFను ఎగుమతి చేయి
+	Export to	ఎగుమతి ఫార్మాట్
+	Microsoft Word (.docx)	Microsoft Word పత్రం (.docx)
+	Spreadsheet (.xlsx)	స్ప్రెడ్‌షీట్ (.xlsx)
+	Presentation (.pptx)	ప్రెజెంటేషన్ (.pptx)
+	Image (PNG)	చిత్రం (PNG)
+	Export all images	అన్ని చిత్రాలను ఎగుమతి చేయి
+	HTML web page	HTML వెబ్ పేజీ
+	Rich Text Format (.rtf)	రిచ్ టెక్స్ట్ ఫార్మాట్ (.rtf)
+	Text (plain)	టెక్స్ట్ (సాదా)
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	నింపడం & సంతకం
+	Fill	నింపడం
+	Checkmark	టిక్ గుర్తు
+	Cross	క్రాస్ గుర్తు
+	Dot	చుక్క
+	Line	గీత
+	Date	తేదీ
+	Signature	సంతకం
+	Initials	పొడి అక్షరాలు
+	Edit a PDF	PDFను సవరించు
+	Modify page	పేజీ సవరణ
+	Rotate pages	పేజీలను తిప్పు
+	Insert pages	పేజీలను చొప్పించు
+	Extract pages	పేజీలను వేరు తీయి
+	Add content	కంటెంట్ జోడించడం
+	Text	టెక్స్ట్
+	Image	చిత్రం
+	Header and footer	హెడర్ మరియు ఫుటర్
+	Watermark	వాటర్‌మార్క్
+	Link	లింక్
+	Bates numbering	బేట్స్ నంబరింగ్
+	Background	నేపథ్యం
+	Attach file	ఫైల్‌ను జోడించు
+	Create a PDF	PDFను సృష్టించు
+	Create from	సృష్టించే మూలం
+	Single file	ఒకే ఫైల్
+	Multiple files	అనేక ఫైల్‌లు
+	Images	చిత్రాలు
+	Clipboard	క్లిప్‌బోర్డ్
+	Blank page	ఖాళీ పేజీ
+	Combine files	ఫైల్‌లను కలుపు
+	Combine	కలుపు
+	Add files to combine	కలపడానికి ఫైల్‌లను జోడించు
+	Page options	పేజీ ఎంపికలు
+	Page grid	పేజీ గ్రిడ్
+	Rotate	తిప్పు
+	Delete	తొలగించు
+	Extract	వేరు తీయి
+	Insert	చొప్పించు
+	Replace	భర్తీ చేయి
+	Split	విభజించు
+	More	మరిన్ని
+	Set page boxes	పేజీ బాక్స్‌లను సెట్ చేయి
+	Page labels	పేజీ లేబుల్‌లు
+	Page transitions	పేజీ ట్రాన్సిషన్‌లు
+	Add comments	వ్యాఖ్యలను జోడించు
+	Markup	మార్కప్
+	Sticky note	స్టిక్కీ నోట్
+	Underline	అండర్‌లైన్
+	Strikethrough	కొట్టివేత
+	Squiggly underline	స్క్విగ్లీ అండర్‌లైన్
+	Text box	టెక్స్ట్ బాక్స్
+	Drawing	డ్రాయింగ్
+	Rectangle	దీర్ఘచతురస్రం
+	Oval	అండాకారం
+	Arrow	బాణం
+	Cloud	క్లౌడ్
+	Stamp	స్టాంప్
+	Review	సమీక్ష
+	Comment list	వ్యాఖ్యల జాబితా
+	Scan & OCR	స్కాన్ & OCR
+	Recognize text	టెక్స్ట్‌ను గుర్తించు
+	In this file	ఈ ఫైల్‌లో
+	In multiple files	అనేక ఫైల్‌లలో
+	Enhance scanned file	స్కాన్ చేసిన ఫైల్‌ను మెరుగుపరచు
+	Correct recognized text	గుర్తించిన టెక్స్ట్‌ను సరిచేయి
+	Protect a PDF	PDFను రక్షించు
+	Protect	రక్షణ
+	Protect with password	పాస్‌వర్డ్‌తో రక్షించు
+	Remove hidden information	దాచిన సమాచారాన్ని తీసివేయి
+	Advanced options	అధునాతన ఎంపికలు
+	Encrypt with certificate	సర్టిఫికెట్‌తో ఎన్‌క్రిప్ట్ చేయి
+	Security properties	భద్రతా లక్షణాలు
+	Redact a PDF	PDFను రెడాక్ట్ చేయి
+	Redact	రెడాక్ట్ చేయి
+	Redact pages	పేజీలను రెడాక్ట్ చేయి
+	Find text and redact	టెక్స్ట్‌ను కనుగొని రెడాక్ట్ చేయి
+	Set properties	లక్షణాలను సెట్ చేయి
+	Sanitize document	పత్రాన్ని శుభ్రపరచు
+	Compress a PDF	PDFను కుదించు
+	Optimize	ఆప్టిమైజేషన్
+	Reduce file size	ఫైల్ పరిమాణాన్ని తగ్గించు
+	Advanced optimization	అధునాతన ఆప్టిమైజేషన్
+	Audit space usage	స్థల వినియోగాన్ని విశ్లేషించు
+	Field list	ఫీల్డ్ జాబితా
+	Field properties	ఫీల్డ్ లక్షణాలు
+	Tab order by rows	అడ్డు వరుసల వారీగా ట్యాబ్ క్రమం
+	Tab order by columns	నిలువు వరుసల వారీగా ట్యాబ్ క్రమం
+	Import data	డేటాను దిగుమతి చేయి
+	Export data	డేటాను ఎగుమతి చేయి
+	Add form components	ఫారం భాగాలను జోడించడం
+	Text field	టెక్స్ట్ ఫీల్డ్
+	Checkbox	చెక్ బాక్స్
+	Radio button	రేడియో బటన్
+	Drop-down list	డ్రాప్‌డౌన్ జాబితా
+	List box	లిస్ట్ బాక్స్
+	Button	బటన్
+	Image field	చిత్ర ఫీల్డ్
+	Date field	తేదీ ఫీల్డ్
+	Digital signature	డిజిటల్ సంతకం
+	Stamps	స్టాంప్‌లు
+	Stamp palette	స్టాంప్ ప్యాలెట్
+	Use a certificate	సర్టిఫికెట్‌ను ఉపయోగించు
+	Certificates	సర్టిఫికెట్‌లు
+	Timestamp	టైమ్‌స్టాంప్
+	Use print production	ప్రింట్ ప్రొడక్షన్‌ను ఉపయోగించు
+	Print production	ప్రింట్ ప్రొడక్షన్
+	Output preview	అవుట్‌పుట్ ప్రివ్యూ
+	Preflight	ప్రీఫ్లైట్
+	Convert colors	రంగులను మార్చు
+	Add printer marks	ప్రింటర్ గుర్తులను జోడించు
+	Fix hairlines	అతి సన్నని గీతలను సరిచేయి
+	Measure objects	ఆబ్జెక్ట్‌లను కొలుచు
+	Measure	కొలత
+	Measuring tool	కొలత సాధనం
+	Geospatial location	భౌగోళిక స్థానం
+	Compare files	ఫైల్‌లను పోల్చు
+	Select files to compare	పోల్చడానికి ఫైల్‌లను ఎంచుకో
+	Use guided actions	మార్గదర్శక చర్యలను ఉపయోగించు
+	Actions list	చర్యల జాబితా
+	Action Wizard	చర్యల విజార్డ్
+	Make accessible	యాక్సెసిబుల్‌గా మార్చు
+	Prepare for distribution	పంపిణీకి సిద్ధం చేయి
+	Optimize scanned documents	స్కాన్ చేసిన పత్రాలను ఆప్టిమైజ్ చేయి
+	Archive documents	పత్రాలను ఆర్కైవ్ చేయి
+	Prepare for accessibility	యాక్సెసిబిలిటీ కోసం సిద్ధం చేయి
+	Accessibility	యాక్సెసిబిలిటీ
+	Automatically tag PDF	PDFను స్వయంచాలకంగా ట్యాగ్ చేయి
+	Change reading options	చదివే ఎంపికలను మార్చు
+	Check for accessibility	యాక్సెసిబిలిటీని తనిఖీ చేయి
+	Add alternate text	ప్రత్యామ్నాయ టెక్స్ట్‌ను జోడించు
+	Fix reading order	చదివే క్రమాన్ని సరిచేయి
+	Apply PDF standards	PDF ప్రమాణాలను వర్తింపజేయి
+	Standards	ప్రమాణాలు
+	Save as PDF/A	PDF/Aగా సేవ్ చేయి
+	Save as PDF/X	PDF/Xగా సేవ్ చేయి
+	Save as PDF/UA	PDF/UAగా సేవ్ చేయి
+	Add search index	శోధన ఇండెక్స్‌ను జోడించు
+	Index	ఇండెక్స్
+	Manage embedded index	పొందుపరిచిన ఇండెక్స్‌ను నిర్వహించు
+	Use JavaScript	JavaScriptను ఉపయోగించు
+	JavaScript	JavaScript
+	Console	కన్సోల్
+	Document JavaScripts	పత్రంలోని JavaScriptలు
+	Document actions	పత్ర చర్యలు
+	AI assistant	AI సహాయకుడు
+	Bring your own model (off by default)	మీ సొంత మోడల్ (డిఫాల్ట్‌గా ఆఫ్)
+	Summarize	సారాంశం రూపొందించు
+	Ask about this document	ఈ పత్రం గురించి అడుగు
+	Translate	అనువదించు
+	pages	పేజీలు
+	Planned	ప్రణాళికలో ఉంది
+	Planned for milestone	ప్రణాళిక: మైల్‌స్టోన్
+	open to see what it will include	ఇందులో ఏమేమి ఉంటాయో చూడటానికి తెరవండి
+	Optional: needs an AI provider you configure	ఐచ్ఛికం: మీరు కాన్ఫిగర్ చేసే AI ప్రొవైడర్ అవసరం
+	Coming in milestone	రాబోతోంది: మైల్‌స్టోన్
+	Items marked Ready work today.	సిద్ధం అని గుర్తించిన అంశాలు ఇప్పటికే పని చేస్తాయి.
+	Preview	ప్రివ్యూ
+	Edit fields	ఫీల్డ్‌లను సవరించు
+	Try the form as people filling it in will see it	ఫారం నింపేవారికి కనిపించే విధంగానే దాన్ని ప్రయత్నించి చూడండి
+	Redact all	అన్నీ రెడాక్ట్ చేయి
+	Clear all	అన్నీ క్లియర్ చేయి
+	Rotate page	పేజీని తిప్పు
+	Delete page	పేజీని తొలగించు
+	Move page	పేజీని తరలించు
+	Move pages	పేజీలను తరలించు
+	Duplicate page	పేజీని నకలు చేయి
+	Replace page	పేజీని భర్తీ చేయి
+	Replace pages	పేజీలను భర్తీ చేయి
+	Crop page	పేజీని క్రాప్ చేయి
+	Cancel	రద్దు చేయి
+	Don't save	సేవ్ చేయవద్దు
+	Apply	వర్తింపజేయి
+	Run	అమలు చేయి
+	Clear	క్లియర్ చేయి
+	Sanitize	శుభ్రపరచు
+	Mark all	అన్నీ మార్క్ చేయి
+	Save changes to “{name}” before closing?	మూసివేయడానికి ముందు “{name}”లో చేసిన మార్పులను సేవ్ చేయాలా?
+	Your changes will be lost if you don't save them.	మీరు సేవ్ చేయకపోతే మీ మార్పులు పోతాయి.
+	Password required	పాస్‌వర్డ్ అవసరం
+	“{name}” is protected. Enter a password to open it.	“{name}” రక్షించబడింది. దీన్ని తెరవడానికి పాస్‌వర్డ్‌ను నమోదు చేయండి.
+	Password	పాస్‌వర్డ్
+	Incorrect password. Try again.	పాస్‌వర్డ్ తప్పు. మళ్లీ ప్రయత్నించండి.
+	Recognize Text	టెక్స్ట్‌ను గుర్తించు
+	Password protection will be applied when you save	మీరు సేవ్ చేసినప్పుడు పాస్‌వర్డ్ రక్షణ వర్తింపజేయబడుతుంది
+	Saved the print-ready PDF to {path}	ముద్రణకు సిద్ధమైన PDF {path}లో సేవ్ చేయబడింది
+	Could not save: {e}	సేవ్ చేయడం సాధ్యం కాలేదు: {e}
+	Earlier in tab order	ట్యాబ్ క్రమంలో ముందు
+	Later in tab order	ట్యాబ్ క్రమంలో తర్వాత
+	From:	కనిష్ఠం:
+	To:	గరిష్ఠం:
+	High Resolution	అధిక రిజల్యూషన్
+	Print	ముద్రించు
+	Verify to see what the document needs.	పత్రానికి ఏమి అవసరమో చూడటానికి ధృవీకరించండి.
+	Set Page Boxes	పేజీ బాక్స్‌లను సెట్ చేయి
+	Signature panel	సంతకాల ప్యానెల్
+	{month} {day}, {y}	{day} {month} {y}
+	The document's security settings don't allow filling in form fields	పత్రం భద్రతా సెట్టింగ్‌లు ఫారం ఫీల్డ్‌లను నింపడాన్ని అనుమతించవు
+	{name} is read-only	{name} చదవడానికి మాత్రమే
+	{name} has no action	{name}కు ఏ చర్యా లేదు
+	Previous month	మునుపటి నెల
+	Next month	తదుపరి నెల
+	January	జనవరి
+	February	ఫిబ్రవరి
+	March	మార్చి
+	April	ఏప్రిల్
+	May	మే
+	June	జూన్
+	July	జులై
+	August	ఆగస్టు
+	September	సెప్టెంబర్
+	October	అక్టోబర్
+	November	నవంబర్
+	December	డిసెంబర్
+	Done	పూర్తయింది
+	This certificate is in your list of trusted certificates.	ఈ సర్టిఫికెట్ మీ విశ్వసనీయ సర్టిఫికెట్‌ల జాబితాలో ఉంది.
+	This certificate is trusted through a certificate above it in the chain.	ఈ సర్టిఫికెట్, చైన్‌లో దీనికంటే పై స్థాయిలో ఉన్న సర్టిఫికెట్ ద్వారా విశ్వసనీయమైనది.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	ఈ సర్టిఫికెట్ విశ్వసనీయమైనది కాదు. దీనితో చేసిన సంతకాలు తెలియని గుర్తింపును చూపిస్తాయి.
+	Add to Trusted Certificates	విశ్వసనీయ సర్టిఫికెట్‌లకు జోడించు
+	Export…	ఎగుమతి చేయి…
+	PDF Optimizer	PDF ఆప్టిమైజర్
+	Discard Objects	విస్మరించాల్సిన ఆబ్జెక్ట్‌లు
+	Discard User Data	విస్మరించాల్సిన వినియోగదారు డేటా
+	Clean Up	చక్కదిద్దడం
+	Color Images	రంగు చిత్రాలు
+	Grayscale Images	గ్రేస్కేల్ చిత్రాలు
+	Bicubic downsampling to	బైక్యూబిక్ డౌన్‌శాంప్లింగ్, లక్ష్యం:
+	for images above	ఈ రిజల్యూషన్ మించిన చిత్రాలకు:
+	Compression	కుదింపు
+	ZIP	ZIP
+	Retain existing	ఉన్నదాన్నే ఉంచు
+	Minimum	కనిష్ఠం
+	Low	తక్కువ
+	High	ఎక్కువ
+	Maximum	గరిష్ఠం
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	ప్రతి చిత్రాన్ని పేజీలలో అది గీయబడిన పరిమాణంలో కొలుస్తారు; ఫలితం చిన్నదైతేనే చిత్రం భర్తీ చేయబడుతుంది.
+	Discard all links, actions and JavaScript	అన్ని లింక్‌లు, చర్యలు, JavaScriptను విస్మరించు
+	Discard alternate images	ప్రత్యామ్నాయ చిత్రాలను విస్మరించు
+	Discard embedded page thumbnails	పొందుపరిచిన పేజీ థంబ్‌నెయిల్‌లను విస్మరించు
+	Discard document tags	పత్రం ట్యాగ్‌లను విస్మరించు
+	Discard embedded print settings	పొందుపరిచిన ముద్రణ సెట్టింగ్‌లను విస్మరించు
+	Discard bookmarks	బుక్‌మార్క్‌లను విస్మరించు
+	Discard hidden layer content	దాచిన లేయర్ కంటెంట్‌ను విస్మరించు
+	Discard all comments, forms and multimedia	అన్ని వ్యాఖ్యలు, ఫారాలు, మల్టీమీడియాను విస్మరించు
+	Discard document information and metadata	పత్రం సమాచారం, మెటాడేటాను విస్మరించు
+	Discard all object data (file attachments)	మొత్తం ఆబ్జెక్ట్ డేటాను విస్మరించు (ఫైల్ జోడింపులు)
+	Discard private data of other applications	ఇతర అప్లికేషన్‌ల ప్రైవేట్ డేటాను విస్మరించు
+	Discard hidden text	దాచిన టెక్స్ట్‌ను విస్మరించు
+	Use Flate to encode streams that are not encoded	ఎన్‌కోడ్ చేయని స్ట్రీమ్‌లను Flateతో ఎన్‌కోడ్ చేయి
+	Remove invalid links and bookmarks	చెల్లని లింక్‌లు, బుక్‌మార్క్‌లను తీసివేయి
+	Remove unreferenced named destinations	ఎక్కడా సూచించని పేరున్న గమ్యాలను తీసివేయి
+	Compress document structure (object streams)	పత్రం నిర్మాణాన్ని కుదించు (ఆబ్జెక్ట్ స్ట్రీమ్‌లు)
+	Remove unused objects and merge identical ones	ఉపయోగించని ఆబ్జెక్ట్‌లను తీసివేసి, ఒకేలా ఉన్నవాటిని విలీనం చేయి
+	Audit space usage…	స్థల వినియోగాన్ని పరిశీలించు…
+	Space Audit	స్థల వినియోగ పరిశీలన
+	Bytes	బైట్‌లు
+	Content Streams	కంటెంట్ స్ట్రీమ్‌లు
+	X Object Forms	X ఆబ్జెక్ట్ ఫారాలు
+	Structure Info	నిర్మాణ సమాచారం
+	Thumbnails	థంబ్‌నెయిల్‌లు
+	Named Destinations	పేరున్న గమ్యాలు
+	Color Spaces	కలర్ స్పేస్‌లు
+	Shadings	షేడింగ్‌లు
+	Patterns (graphics objects)	ప్యాటర్న్‌లు (గ్రాఫిక్స్ ఆబ్జెక్ట్‌లు)
+	Extended Graphics States	విస్తరించిన గ్రాఫిక్స్ స్థితులు
+	Embedded Files	పొందుపరిచిన ఫైల్‌లు
+	Document Overhead	పత్రం ఓవర్‌హెడ్
+	Total	మొత్తం
+	Text Field Properties	టెక్స్ట్ ఫీల్డ్ లక్షణాలు
+	Check Box Properties	చెక్ బాక్స్ లక్షణాలు
+	Radio Button Properties	రేడియో బటన్ లక్షణాలు
+	Dropdown Properties	డ్రాప్‌డౌన్ లక్షణాలు
+	List Box Properties	లిస్ట్ బాక్స్ లక్షణాలు
+	Button Properties	బటన్ లక్షణాలు
+	Digital Signature Properties	డిజిటల్ సంతకం లక్షణాలు
+	Position	స్థానం
+	Options	ఎంపికలు
+	Validate	ధృవీకరణ
+	Calculate	గణన
+	Actions	చర్యలు
+	This field is locked. Unlock it to change its properties.	ఈ ఫీల్డ్ లాక్ చేయబడింది. దీని లక్షణాలను మార్చడానికి దీన్ని అన్‌లాక్ చేయండి.
+	Tooltip:	టూల్‌టిప్:
+	Common Properties	సాధారణ లక్షణాలు
+	Read Only	చదవడానికి మాత్రమే
+	Required	తప్పనిసరి
+	Font Size:	ఫాంట్ పరిమాణం:
+	Auto	ఆటో
+	Text Color:	టెక్స్ట్ రంగు:
+	Borders and Colors	అంచులు, రంగులు
+	Border Color:	అంచు రంగు:
+	Fill Color:	నింపు రంగు:
+	No color	రంగు లేదు
+	Beveled	బెవెల్డ్
+	Left:	ఎడమ:
+	Bottom:	కింద:
+	Width:	వెడల్పు:
+	Height:	ఎత్తు:
+	Points from the page's bottom-left corner.	పేజీ కింది ఎడమ మూల నుండి పాయింట్‌లలో కొలుస్తారు.
+	Alignment:	అమరిక:
+	Default Value:	డిఫాల్ట్ విలువ:
+	Multi-line	బహుళ పంక్తులు
+	Scroll long text	పొడవైన టెక్స్ట్‌ను స్క్రోల్ చేయి
+	Allow Rich Text Formatting	రిచ్ టెక్స్ట్ ఫార్మాటింగ్‌ను అనుమతించు
+	Limit of	గరిష్ఠంగా
+	characters	అక్షరాలు
+	Field is used for file selection	ఫీల్డ్ ఫైల్ ఎంపిక కోసం ఉపయోగించబడుతుంది
+	Check spelling	స్పెల్లింగ్‌ను తనిఖీ చేయి
+	Comb of	ప్రతి అక్షరానికి ఒక గడి, మొత్తం
+	Export Value: {on}	ఎగుమతి విలువ: {on}
+	Check box is checked by default	చెక్ బాక్స్ డిఫాల్ట్‌గా ఎంచుకోబడి ఉంటుంది
+	Button is checked by default	బటన్ డిఫాల్ట్‌గా ఎంచుకోబడి ఉంటుంది
+	Buttons with the same name and value are selected in unison	ఒకే పేరు, విలువ ఉన్న బటన్‌లు ఒకేసారి ఎంచుకోబడతాయి
+	Item:	అంశం:
+	Item List	అంశాల జాబితా
+	Up	పైకి
+	Delete {o}	{o}ను తొలగించు
+	Add the choices people pick from.	వినియోగదారులు ఎంచుకోవాల్సిన ఎంపికలను జోడించండి.
+	Default:	డిఫాల్ట్:
+	(none)	(ఏదీ లేదు)
+	Sort items	అంశాలను క్రమబద్ధీకరించు
+	Allow user to enter custom text	అనుకూల టెక్స్ట్ నమోదు చేయడానికి వినియోగదారులను అనుమతించు
+	Multiple selection	బహుళ ఎంపిక
+	Commit selected value immediately	ఎంచుకున్న విలువను వెంటనే వర్తింపజేయి
+	Number	సంఖ్య
+	Percentage	శాతం
+	Time	సమయం
+	Special	ప్రత్యేకం
+	Select format category:	ఫార్మాట్ వర్గాన్ని ఎంచుకోండి:
+	The value is shown as typed.	విలువ టైప్ చేసినట్లుగానే చూపబడుతుంది.
+	Decimal places:	దశాంశ స్థానాలు:
+	Separator style:	విభాజక శైలి:
+	Currency symbol:	కరెన్సీ చిహ్నం:
+	Before the number	సంఖ్యకు ముందు
+	Negative number style:	రుణ సంఖ్య శైలి:
+	Format:	ఫార్మాట్:
+	Custom:	అనుకూల:
+	Zip Code	జిప్ కోడ్
+	Zip Code + 4	జిప్ కోడ్ + 4
+	Phone Number	ఫోన్ నంబర్
+	Social Security Number	సోషల్ సెక్యూరిటీ నంబర్
+	Arbitrary Mask	అనుకూల మాస్క్
+	Mask:	మాస్క్:
+	9 digit, A letter, O letter or digit, X any character	9 అంకె, A అక్షరం, O అక్షరం లేదా అంకె, X ఏదైనా గుర్తు
+	Example: {sample}	ఉదాహరణ: {sample}
+	Field value is not validated	ఫీల్డ్ విలువ ధృవీకరించబడదు
+	Field value is in range:	ఫీల్డ్ విలువ ఈ పరిధిలో ఉండాలి:
+	Add an Action	చర్యను జోడించు
+	Select Trigger:	ట్రిగ్గర్‌ను ఎంచుకోండి:
+	Mouse Up	మౌస్ బటన్ విడిచినప్పుడు
+	Mouse Down	మౌస్ బటన్ నొక్కినప్పుడు
+	Mouse Enter	మౌస్ లోపలికి వచ్చినప్పుడు
+	Mouse Exit	మౌస్ బయటకు వెళ్లినప్పుడు
+	On Focus	ఫోకస్ పొందినప్పుడు
+	On Blur	ఫోకస్ కోల్పోయినప్పుడు
+	Select Action:	చర్యను ఎంచుకోండి:
+	Open a web link	వెబ్ లింక్‌ను తెరువు
+	Reset a form	ఫారాన్ని రీసెట్ చేయి
+	Execute a menu item	మెనూ అంశాన్ని అమలు చేయి
+	Show a field	ఫీల్డ్‌ను చూపించు
+	Hide a field	ఫీల్డ్‌ను దాచు
+	Submit a form	ఫారాన్ని సమర్పించు
+	Fields to reset (comma-separated; empty: all)	రీసెట్ చేయాల్సిన ఫీల్డ్‌లు (కామాలతో వేరు చేయండి; ఖాళీగా ఉంటే: అన్నీ)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage లేదా LastPage
+	Field names (comma-separated)	ఫీల్డ్ పేర్లు (కామాలతో వేరు చేయండి)
+	URL to submit to	ఫారాన్ని పంపాల్సిన URL
+	Script:	స్క్రిప్ట్:
+	Value:	విలువ:
+	No actions	చర్యలు లేవు
+	Value is not calculated	విలువ లెక్కించబడదు
+	Value is the	విలువ ఇలా లెక్కించబడుతుంది:
+	sum (+)	మొత్తం (+)
+	product (x)	గుణకారం (x)
+	average	సగటు
+	minimum	కనిష్ఠం
+	maximum	గరిష్ఠం
+	of the following fields:	కింది ఫీల్డ్‌లపై:
+	Simplified field notation:	సరళీకృత ఫీల్డ్ సూత్రం:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	ఫీల్డ్ పేర్లను + - * / గుర్తులు, బ్రాకెట్‌లతో రాయండి; పేర్లలోని ఖాళీల ముందు \\ పెట్టండి.
+	Format text	టెక్స్ట్ ఫార్మాటింగ్
+	Bold	బోల్డ్
+	Italic	ఇటాలిక్
+	Align left	ఎడమకు అమర్చు
+	Centre	మధ్యకు అమర్చు
+	Align right	కుడికి అమర్చు
+	Justify	రెండు వైపులా అమర్చు
+	Standard fonts; text outside Windows-1252 isn't supported yet.	ప్రామాణిక ఫాంట్‌లు; Windows-1252 పరిధికి బయటి టెక్స్ట్‌కు ఇంకా మద్దతు లేదు.
+	Edit image	చిత్ర సవరణ
+	Rotate counterclockwise	అపసవ్యదిశలో తిప్పు
+	Rotate clockwise	సవ్యదిశలో తిప్పు
+	Flip horizontal	అడ్డంగా తిరగేయి
+	Flip vertical	నిలువుగా తిరగేయి
+	Replace image	చిత్రాన్ని భర్తీ చేయి
+	Crop (% trimmed from each side)	క్రాప్ (ప్రతి వైపు నుండి తీసివేసే %)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	టెక్స్ట్ జోడించడానికి పేజీపై క్లిక్ చేయండి; ప్రతి క్లిక్ కొత్త బాక్స్‌ను ప్రారంభిస్తుంది, ✓ నొక్కితే ముగుస్తుంది. అంశాలను తరలించడానికి వాటిని లాగండి, పరిమాణం మార్చడానికి మూలను లాగండి, సవరించడానికి టెక్స్ట్‌పై డబుల్-క్లిక్ చేయండి.
+	Choose an image	చిత్రాన్ని ఎంచుకోండి
+	Export to Image	చిత్రంగా ఎగుమతి చేయి
+	Export to Text	టెక్స్ట్‌గా ఎగుమతి చేయి
+	Export All Images	అన్ని చిత్రాలను ఎగుమతి చేయి
+	Resolution	రిజల్యూషన్
+	Format	ఫార్మాట్
+	Quality	నాణ్యత
+	One {f} file per page, named after the document.	ప్రతి పేజీకి ఒక {f} ఫైల్, పత్రం పేరుతో.
+	Exclude images smaller than	ఇంతకంటే చిన్న చిత్రాలను మినహాయించు
+	No limit	పరిమితి లేదు
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	ప్రతి చిత్రం ఒక్కసారే, పత్రం పేరు, పేజీ సంఖ్యతో. JPEG చిత్రాలు మార్పు లేకుండా సేవ్ చేయబడతాయి; మిగతావి PNGగా.
+	Plain text in reading order; pages are separated by form feeds.	చదివే క్రమంలో సాదా టెక్స్ట్; పేజీల మధ్య ఫారమ్ ఫీడ్ అక్షరం ఉంటుంది.
+	Create {what}	{what} సృష్టించు
+	initials	పొడి అక్షరాలు
+	signature	సంతకం
+	Create Custom Stamp	అనుకూల స్టాంప్‌ను సృష్టించు
+	From {file}	{file} నుండి
+	Category:	వర్గం:
+	e.g. My stamps	ఉదా. నా స్టాంప్‌లు
+	Name:	పేరు:
+	Custom	అనుకూల
+	Delete stamp	స్టాంప్‌ను తొలగించు
+	Create custom stamp…	అనుకూల స్టాంప్‌ను సృష్టించు…
+	From a PDF page or an image	PDF పేజీ లేదా చిత్రం నుండి
+	Line spacing	పంక్తి అంతరం
+	Character spacing	అక్షర అంతరం
+	Horizontal scale	అడ్డు స్కేల్
+	Rotate Clockwise	సవ్యదిశలో తిప్పు
+	Rotate Counterclockwise	అపసవ్యదిశలో తిప్పు
+	Flip Horizontal	అడ్డంగా తిరగేయి
+	Flip Vertical	నిలువుగా తిరగేయి
+	Replace Image…	చిత్రాన్ని భర్తీ చేయి…
+	Save Image As…	చిత్రాన్ని ఫైల్‌గా సేవ్ చేయి…
+	Check for updates	అప్‌డేట్‌ల కోసం తనిఖీ చేయి
+	No check has run yet.	ఇంకా తనిఖీ జరగలేదు.
+	Checking for a newer version…	కొత్త వెర్షన్ కోసం తనిఖీ చేస్తోంది…
+	PdfCraft {v} is available.	PdfCraft {v} అందుబాటులో ఉంది.
+	You have version {c}. Download the new version from its release page.	మీ వద్ద వెర్షన్ {c} ఉంది. కొత్త వెర్షన్‌ను దాని విడుదల పేజీ నుండి డౌన్‌లోడ్ చేసుకోండి.
+	PdfCraft {c} is up to date.	PdfCraft {c} తాజా వెర్షన్.
+	Couldn't check for updates: {e}	అప్‌డేట్‌ల కోసం తనిఖీ చేయడం సాధ్యం కాలేదు: {e}
+	You have version {c}. All releases are listed at {page}.	మీ వద్ద వెర్షన్ {c} ఉంది. అన్ని విడుదలల జాబితా: {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	తాజా విడుదల గురించి GitHubను అడుగుతుంది. ఏదీ ఆటోమేటిక్‌గా డౌన్‌లోడ్ లేదా ఇన్‌స్టాల్ చేయబడదు.
+	Download	డౌన్‌లోడ్ చేయి
+	Later	తర్వాత
+	none	ఏదీ లేదు
+	Declared conformance: {shown}	ప్రకటించిన అనుగుణ్యత: {shown}
+	Output intent: {list}	అవుట్‌పుట్ ఇంటెంట్: {list}
+	Conformance level:	అనుగుణ్యత స్థాయి:
+	No problems found: the document conforms to {level}.	సమస్యలు ఏవీ కనుగొనబడలేదు: పత్రం {level}కు అనుగుణంగా ఉంది.
+	 (page {p})	 (పేజీ {p})
+	  · not fixable here	  · ఇక్కడ సరిచేయడం సాధ్యం కాదు
+	Verify	ధృవీకరించు
+	Box	బాక్స్
+	Units	యూనిట్‌లు
+	Set to zero	సున్నాకు సెట్ చేయి
+	Current page ({n})	ప్రస్తుత పేజీ ({n})
+	Subset	ఉపసమితి
+	Update	అప్‌డేట్ చేయి
+	Add	జోడించు
+	{verb} Header and Footer	హెడర్ మరియు ఫుటర్‌ను {verb}
+	{verb} Watermark	వాటర్‌మార్క్‌ను {verb}
+	{verb} Background	నేపథ్యాన్ని {verb}
+	Margins (in)	మార్జిన్‌లు (in)
+	Left Header Text	ఎడమ హెడర్ టెక్స్ట్
+	Center Header Text	మధ్య హెడర్ టెక్స్ట్
+	Right Header Text	కుడి హెడర్ టెక్స్ట్
+	Left Footer Text	ఎడమ ఫుటర్ టెక్స్ట్
+	Center Footer Text	మధ్య ఫుటర్ టెక్స్ట్
+	Right Footer Text	కుడి ఫుటర్ టెక్స్ట్
+	Insert Page Number	పేజీ సంఖ్యను చొప్పించు
+	Insert Date	తేదీని చొప్పించు
+	Start page number	ప్రారంభ పేజీ సంఖ్య
+	Source	మూలం
+	Fit to page	పేజీకి సరిపోయేలా
+	Rotation	భ్రమణం
+	Appear behind page	పేజీ వెనుక కనిపించేలా
+	Appear on top of page	పేజీ పైన కనిపించేలా
+	From colour	రంగు నుండి
+	Page Range Options	పేజీ పరిధి ఎంపికలు
+	Preview: page {p} of {n}	ప్రివ్యూ: {n}లో {p}వ పేజీ
+	Applies to 1 page	1 పేజీకి వర్తిస్తుంది
+	Applies to {n} pages	{n} పేజీలకు వర్తిస్తుంది
+	Replaces the existing one on those pages.	ఆ పేజీలలో ఇప్పటికే ఉన్నదాన్ని భర్తీ చేస్తుంది.
+	PDF or image	PDF లేదా చిత్రం
+	No file chosen	ఫైల్ ఏదీ ఎంచుకోలేదు
+	Page number	పేజీ సంఖ్య
+	Scale relative to target page	లక్ష్య పేజీకి సాపేక్షంగా స్కేల్
+	Link Properties	లింక్ లక్షణాలు
+	Create Link	లింక్‌ను సృష్టించు
+	Link Appearance	లింక్ రూపం
+	Link Type:	లింక్ రకం:
+	Visible Rectangle	కనిపించే దీర్ఘచతురస్రం
+	Invisible Rectangle	కనిపించని దీర్ఘచతురస్రం
+	Highlight Style:	హైలైట్ శైలి:
+	Invert	విలోమం
+	Outline	అవుట్‌లైన్
+	Inset	ఇన్‌సెట్
+	Line Thickness:	గీత మందం:
+	Thin	సన్నని
+	Thick	మందమైన
+	Line Style:	గీత శైలి:
+	Solid	సాలిడ్
+	Dashed	డ్యాష్డ్
+	Color:	రంగు:
+	Link Action	లింక్ చర్య
+	Open a web page	వెబ్ పేజీని తెరువు
+	Go to a page view	పేజీ వీక్షణకు వెళ్లు
+	Type the web address.	వెబ్ చిరునామాను టైప్ చేయండి.
+	This document has no signatures.	ఈ పత్రంలో సంతకాలు ఏవీ లేవు.
+	The Keychain's digital IDs couldn't be listed: {e}	Keychainలోని డిజిటల్ ఐడీలను జాబితా చేయడం సాధ్యం కాలేదు: {e}
+	Signed and saved to {path}	సంతకం చేసి {path}లో సేవ్ చేయబడింది
+	Couldn't open revision {n}: {e}	రివిజన్ {n}ను తెరవడం సాధ్యం కాలేదు: {e}
+	Couldn't open the signed version: {e}	సంతకం చేసిన వెర్షన్‌ను తెరవడం సాధ్యం కాలేదు: {e}
+	Sign with a Digital ID	డిజిటల్ ఐడీతో సంతకం చేయి
+	Choose the digital ID that you want to use for signing:	సంతకం చేయడానికి మీరు ఉపయోగించాలనుకుంటున్న డిజిటల్ ఐడీని ఎంచుకోండి:
+	Keychain  ·  	Keychain  ·  
+	Issued by: 	జారీ చేసినవారు: 
+	, Expires: 	, గడువు: 
+	No digital IDs yet.	ఇంకా డిజిటల్ ఐడీలు ఏవీ లేవు.
+	Configure New Digital ID	కొత్త డిజిటల్ ఐడీని కాన్ఫిగర్ చేయి
+	Continue	కొనసాగించు
+	Configure a Digital ID for Signing	సంతకం కోసం డిజిటల్ ఐడీని కాన్ఫిగర్ చేయి
+	Use a Digital ID from a file	ఫైల్‌లోని డిజిటల్ ఐడీని ఉపయోగించు
+	Create a new Digital ID (self-signed, saved to a password-protected file)	కొత్త డిజిటల్ ఐడీని సృష్టించు (స్వీయ-సంతకం చేసినది, పాస్‌వర్డ్‌తో రక్షించిన ఫైల్‌లో సేవ్ అవుతుంది)
+	Name	పేరు
+	Organizational Unit	సంస్థాగత విభాగం
+	Organization Name	సంస్థ పేరు
+	Email Address	ఇమెయిల్ చిరునామా
+	Country/Region	దేశం/ప్రాంతం
+	Key Algorithm	కీ అల్గారిథమ్
+	Confirm Password	పాస్‌వర్డ్ నిర్ధారణ
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	డిజిటల్ సంతకాల కోసం, 5 సంవత్సరాలు చెల్లుబాటు అవుతుంది. స్వీయ-సంతకం చేసిన ఐడీలను సాధారణంగా ఇతరులు విశ్వసించరు.
+	File (.p12, .pfx)	ఫైల్ (.p12, .pfx)
+	Digital ID	డిజిటల్ ఐడీ
+	Browse…	బ్రౌజ్ చేయి…
+	{verb} as "{name}"	"{name}"గా {verb}
+	Certify	సర్టిఫై చేయి
+	The signature will be invisible.	సంతకం కనిపించదు.
+	Distinguished name	విశిష్ట పేరు
+	Labels	లేబుల్‌లు
+	Permitted actions after certifying	సర్టిఫై చేసిన తర్వాత అనుమతించే చర్యలు
+	No changes allowed	మార్పులు ఏవీ అనుమతించబడవు
+	Annotations, form fill-in, and digital signatures	ఉల్లేఖనలు, ఫారం నింపడం మరియు డిజిటల్ సంతకాలు
+	Form fill-in and digital signatures	ఫారం నింపడం మరియు డిజిటల్ సంతకాలు
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	కీ macOS Keychainలో ఉంది; దాన్ని ఉపయోగించడానికి PdfCraftను అనుమతించమని Keychain అడగవచ్చు.
+	Digital ID password	డిజిటల్ ఐడీ పాస్‌వర్డ్
+	Back	వెనుకకు
+	Validate all	అన్నీ ధృవీకరించు
+	Sign this field…	ఈ ఫీల్డ్‌లో సంతకం చేయి…
+	Signature is valid:	సంతకం చెల్లుబాటు అవుతుంది:
+	Signature validity is UNKNOWN:	సంతకం చెల్లుబాటు తెలియదు:
+	Signature is INVALID:	సంతకం చెల్లదు:
+	Signature Details	సంతకం వివరాలు
+	Reason	కారణం
+	Signing time	సంతకం చేసిన సమయం
+	Algorithm	అల్గారిథమ్
+	Signer	సంతకం చేసినవారు
+	Issued by	జారీ చేసినవారు
+	Valid	చెల్లుబాటు
+	Field	ఫీల్డ్
+	Field: {field} on page {p}	ఫీల్డ్: {field}, {p}వ పేజీలో
+	Add to trusted certificates	విశ్వసనీయ సర్టిఫికెట్‌లకు జోడించు
+	View signed version	సంతకం చేసిన వెర్షన్‌ను చూడు
+	Show certificate…	సర్టిఫికెట్‌ను చూపించు…
+	Export certificate…	సర్టిఫికెట్‌ను ఎగుమతి చేయి…
+	Certificate Viewer	సర్టిఫికెట్ వీక్షణ
+	This dialog shows the details of a certificate and its chain.	ఈ డైలాగ్ ఒక సర్టిఫికెట్ వివరాలను, దాని సర్టిఫికెట్ చైన్‌ను చూపిస్తుంది.
+	Trust	విశ్వసనీయత
+	Issued to	జారీ పొందినవారు
+	Valid from	చెల్లుబాటు ప్రారంభం
+	Valid to	చెల్లుబాటు గడువు
+	Intended usage	ఉద్దేశించిన వినియోగం
+	Any	ఏదైనా
+	Version	వెర్షన్
+	Serial number	క్రమ సంఖ్య
+	Issuer	జారీదారు
+	Validity starts	చెల్లుబాటు ప్రారంభం
+	Validity ends	చెల్లుబాటు ముగింపు
+	Public key	పబ్లిక్ కీ
+	Key usage	కీ వినియోగం
+	Not present	లేదు
+	Self-signed	స్వీయ-సంతకం చేసినది
+	Edit Action	చర్యను సవరించు
+	New Action	కొత్త చర్య
+	Action name:	చర్య పేరు:
+	Description:	వివరణ:
+	Steps	దశలు
+	Add the steps this action runs, in order.	ఈ చర్య అమలు చేసే దశలను క్రమంలో జోడించండి.
+	Add Step	దశను జోడించు
+	An action with this name already exists.	ఈ పేరుతో ఒక చర్య ఇప్పటికే ఉంది.
+	New Action…	కొత్త చర్య…
+	Edit…	సవరించు…
+	Add watermark	వాటర్‌మార్క్ జోడించు
+	Add header	హెడర్ జోడించు
+	Add footer	ఫుటర్ జోడించు
+	Set document title	పత్రం శీర్షికను సెట్ చేయి
+	Run a JavaScript	JavaScriptను అమలు చేయి
+	Prepare for Distribution	పంపిణీ కోసం సిద్ధం చేయి
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	దాచిన సమాచారాన్ని తీసివేసి, వ్యాఖ్యలను, ఫారం ఫీల్డ్‌లను ఫ్లాటెన్ చేస్తుంది; దీంతో స్వీకర్తలకు పేజీలు మాత్రమే కనిపిస్తాయి.
+	Optimize Scanned Documents	స్కాన్ చేసిన పత్రాలను ఆప్టిమైజ్ చేయి
+	Make scans searchable, then make them smaller.	స్కాన్‌లను వెతకగలిగేలా చేసి, ఆపై వాటి పరిమాణాన్ని తగ్గిస్తుంది.
+	Add Page Numbers	పేజీ సంఖ్యలను జోడించు
+	Number every page in the footer.	ఫుటర్‌లో ప్రతి పేజీకి సంఖ్య వేస్తుంది.
+	Mark as Confidential	గోప్యమైనదిగా గుర్తించు
+	A diagonal CONFIDENTIAL watermark on every page.	ప్రతి పేజీపై ఏటవాలుగా ఉండే CONFIDENTIAL వాటర్‌మార్క్.
+	Sanitize Documents	పత్రాలను శుభ్రపరచు
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	దాచిన సమాచారం, మెటాడేటా, స్క్రిప్ట్‌లు, పొందుపరిచిన కంటెంట్‌ను తీసివేసి, ఫైల్‌లను తిరిగి రాస్తుంది.
+	Type text	టెక్స్ట్ టైప్ చేయండి
+	Text to insert	చొప్పించాల్సిన టెక్స్ట్
+	Replacement text	భర్తీ చేసే టెక్స్ట్
+	Edit text…	టెక్స్ట్‌ను సవరించు…
+	Add a sticky note here	ఇక్కడ స్టిక్కీ నోట్‌ను జోడించు
+	{kind} Properties	{kind} లక్షణాలు
+	Appearance	రూపం
+	General	సాధారణం
+	Review History	సమీక్ష చరిత్ర
+	This comment's appearance can't be changed yet.	ఈ వ్యాఖ్య రూపాన్ని ఇంకా మార్చడం సాధ్యం కాదు.
+	Icon	చిహ్నం
+	Thickness	మందం
+	Modified	సవరించిన తేదీ
+	No status has been set.	ఏ స్థితీ సెట్ చేయబడలేదు.
+	Compare Files	ఫైల్‌లను పోల్చు
+	Old file:	పాత ఫైల్:
+	Open the older version first	ముందుగా పాత వెర్షన్‌ను తెరవండి
+	New file:	కొత్త ఫైల్:
+	Text is compared word by word; the differences are shown on the new file.	టెక్స్ట్ పదం పదంగా పోల్చబడుతుంది; తేడాలు కొత్త ఫైల్‌పై చూపబడతాయి.
+	Compare this file with an older version: Compare files… in All tools.	ఈ ఫైల్‌ను పాత వెర్షన్‌తో పోల్చడానికి: అన్ని సాధనాలలో "ఫైల్‌లను పోల్చు…" ఉపయోగించండి.
+	No differences in the text.	టెక్స్ట్‌లో తేడాలు ఏవీ లేవు.
+	{n} {kind}	{kind}: {n}
+	Inserted	చొప్పింపు
+	Deleted	తొలగింపు
+	Replaced	భర్తీ
+	Visual	దృశ్య మార్పు
+	Mark as comments	వ్యాఖ్యలుగా గుర్తించు
+	Report…	నివేదిక…
+	{kind} · page {p}	{kind} · పేజీ {p}
+	Set Alternate Text	ప్రత్యామ్నాయ టెక్స్ట్‌ను సెట్ చేయి
+	This document has no tagged figures.	ఈ పత్రంలో ట్యాగ్ చేసిన చిత్రాలు ఏవీ లేవు.
+	 on page {p}	 ({p}వ పేజీలో)
+	Figure {i} of {n}{page}	{n}లో {i}వ చిత్రం{page}
+	No preview	ప్రివ్యూ లేదు
+	Alternate text	ప్రత్యామ్నాయ టెక్స్ట్
+	Describe the figure	చిత్రాన్ని వివరించండి
+	Decorative figure	అలంకరణ చిత్రం
+	Previous figure	మునుపటి చిత్రం
+	Next figure	తదుపరి చిత్రం
+	Save & Close	సేవ్ చేసి మూసివేయి
+	Accessibility Checker Options	యాక్సెసిబిలిటీ తనిఖీ సాధనం ఎంపికలు
+	Report Options	నివేదిక ఎంపికలు
+	Create accessibility report	యాక్సెసిబిలిటీ నివేదికను సృష్టించు
+	Page Range	పేజీ పరిధి
+	All pages in document	పత్రంలోని అన్ని పేజీలు
+	Checking Options ({on} of 32 in all categories)	తనిఖీ ఎంపికలు (అన్ని వర్గాలలో కలిపి 32లో {on})
+	Show this dialog when the Checker starts	తనిఖీ సాధనం ప్రారంభమైనప్పుడు ఈ డైలాగ్‌ను చూపించు
+	Select All	అన్నీ ఎంచుకో
+	Clear All	అన్నీ క్లియర్ చేయి
+	Start Checking	తనిఖీ ప్రారంభించు
+	This document hasn't been checked yet.	ఈ పత్రాన్ని ఇంకా తనిఖీ చేయలేదు.
+	No issues found	సమస్యలు ఏవీ కనుగొనబడలేదు
+	1 issue	1 సమస్య
+	{n} issues	{n} సమస్యలు
+	{label} (1 issue)	{label} (1 సమస్య)
+	{label} ({n} issues)	{label} ({n} సమస్యలు)
+	Check again	మళ్లీ తనిఖీ చేయి
+	Report	నివేదిక
+	Show the accessibility report	యాక్సెసిబిలిటీ నివేదికను చూపించు
+	Collapse	ముడుచు
+	Expand	విస్తరించు
+	{rule} - {status}	{rule}: {status}
+	Passed	ఉత్తీర్ణమైంది
+	Failed	విఫలమైంది
+	Needs manual check	మాన్యువల్ తనిఖీ అవసరం
+	Skipped	దాటవేయబడింది
+	Fix	సరిచేయి
+	Skip Rule	నియమాన్ని దాటవేయి
+	Explain	వివరించు
+	Check Again	మళ్లీ తనిఖీ చేయి
+	Show Report	నివేదికను చూపించు
+	Options…	ఎంపికలు…
+	Go to the page	ఆ పేజీకి వెళ్లు
+	Page Content	పేజీ కంటెంట్
+	Forms	ఫారాలు
+	Alternate Text	ప్రత్యామ్నాయ టెక్స్ట్
+	Tables	పట్టికలు
+	Lists	జాబితాలు
+	Headings	హెడింగ్‌లు
+	Accessibility permission flag	యాక్సెసిబిలిటీ అనుమతి ఫ్లాగ్
+	Accessibility permission flag is set	యాక్సెసిబిలిటీ అనుమతి ఫ్లాగ్ సెట్ చేయబడింది
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	సహాయక సాంకేతికతలు కంటెంట్‌ను చదవడానికి భద్రతా సెట్టింగ్‌లు అనుమతించాలి ("స్క్రీన్ రీడర్ పరికరాలకు టెక్స్ట్ యాక్సెస్‌ను అనుమతించు"). దీన్ని అనుమతించేలా పత్రం భద్రతను మార్చండి.
+	Image-only PDF	చిత్రాలు మాత్రమే ఉన్న PDF
+	Document is not image-only PDF	పత్రం చిత్రాలు మాత్రమే ఉన్న PDF కాదు
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	టెక్స్ట్ చిత్రాలు మాత్రమే ఉన్న పేజీలను బిగ్గరగా చదవడం లేదా వెతకడం సాధ్యం కాదు. టెక్స్ట్ లేయర్‌ను జోడించడానికి టెక్స్ట్‌ను గుర్తించండి (OCR).
+	Document is tagged PDF	పత్రం ట్యాగ్ చేసిన PDF
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	ట్యాగ్‌లు పత్రానికి సహాయక సాంకేతికత అనుసరించే తార్కిక నిర్మాణాన్ని ఇస్తాయి. పత్రాన్ని ట్యాగ్ చేయండి (PDFను స్వయంచాలకంగా ట్యాగ్ చేయి).
+	Logical Reading Order	తార్కిక చదివే క్రమం
+	Document structure provides a logical reading order	పత్రం నిర్మాణం తార్కిక చదివే క్రమాన్ని అందిస్తుంది
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	చూడగలిగే పాఠకుడు చదివే క్రమంలోనే ట్యాగ్‌లు చదవబడుతున్నాయో తనిఖీ చేయండి. దాన్ని సరిచేయడానికి చదివే క్రమం సాధనాన్ని లేదా ట్యాగ్‌ల ప్యానెల్‌ను ఉపయోగించండి.
+	Primary language	ప్రాథమిక భాష
+	Text language is specified	టెక్స్ట్ భాష పేర్కొనబడింది
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	స్క్రీన్ రీడర్‌లు పత్రం భాషను బట్టి తమ స్వరాన్ని ఎంచుకుంటాయి. దాన్ని పత్రం లక్షణాలు > అధునాతనం > భాషలో సెట్ చేయండి.
+	Document title is showing in title bar	టైటిల్ బార్‌లో పత్రం శీర్షిక కనిపిస్తోంది
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	విండో ఫైల్ పేరుకు బదులుగా అర్థవంతమైన శీర్షికను చూపించాలి. శీర్షికను సెట్ చేసి, ప్రారంభ వీక్షణ > చూపించు: పత్రం శీర్షికను ఎంచుకోండి.
+	Bookmarks are present in large documents	పెద్ద పత్రాలలో బుక్‌మార్క్‌లు ఉన్నాయి
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	20 కంటే ఎక్కువ పేజీలు ఉన్న పత్రాలలో నావిగేషన్ కోసం బుక్‌మార్క్‌లు అవసరం. ప్రధాన విభాగాలకు బుక్‌మార్క్‌లను జోడించండి.
+	Color contrast	రంగు కాంట్రాస్ట్
+	Document has appropriate color contrast	పత్రంలో తగిన రంగు కాంట్రాస్ట్ ఉంది
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	కంటిచూపు తక్కువగా ఉన్నవారు చదవగలిగేలా టెక్స్ట్‌కు దాని నేపథ్యంతో తగినంత కాంట్రాస్ట్ ఉండాలి. రంగులను కంటితో లేదా కాంట్రాస్ట్ సాధనంతో తనిఖీ చేయండి.
+	Tagged content	ట్యాగ్ చేసిన కంటెంట్
+	All page content is tagged	పేజీ కంటెంట్ మొత్తం ట్యాగ్ చేయబడింది
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	పేజీలోని ప్రతిదీ ట్యాగ్ చేయబడాలి లేదా ఆర్టిఫ్యాక్ట్‌గా (అలంకరణ, హెడర్‌లు, ఫుటర్‌లు) గుర్తించబడాలి. ట్యాగ్ చేయని కంటెంట్‌ను ట్యాగ్ చేయండి.
+	Tagged annotations	ట్యాగ్ చేసిన ఉల్లేఖనలు
+	All annotations are tagged	అన్ని ఉల్లేఖనలు ట్యాగ్ చేయబడ్డాయి
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	వ్యాఖ్యలు, లింక్‌లు మరియు ఫీల్డ్‌లు చదివి వినిపించబడాలంటే అవి ట్యాగ్ ట్రీలో ఉండాలి. ఉల్లేఖనలను ట్యాగ్ చేయండి.
+	Tab order	ట్యాబ్ క్రమం
+	Tab order is consistent with structure order	ట్యాబ్ క్రమం నిర్మాణ క్రమానికి అనుగుణంగా ఉంది
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	లింక్‌లు, వ్యాఖ్యలు లేదా ఫీల్డ్‌లు ఉన్న పేజీలలో Tab కీ నిర్మాణ క్రమాన్ని అనుసరించాలి. సరిచేసినప్పుడు ప్రతి పేజీ ట్యాబ్ క్రమం పత్రం నిర్మాణాన్ని ఉపయోగించు అనే ఎంపికకు సెట్ అవుతుంది.
+	Character encoding	అక్షర ఎన్‌కోడింగ్
+	Reliable character encoding is provided	నమ్మదగిన అక్షర ఎన్‌కోడింగ్ అందించబడింది
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	టెక్స్ట్‌ను చదవడానికి, కాపీ చేయడానికి వీలుగా ఫాంట్‌లు తమ అక్షరాలను యూనికోడ్‌కు మ్యాప్ చేయాలి. ఫాంట్‌లను సరిచేయండి లేదా PDFను మళ్లీ సృష్టించండి.
+	Tagged multimedia	ట్యాగ్ చేసిన మల్టీమీడియా
+	All multimedia objects are tagged	అన్ని మల్టీమీడియా ఆబ్జెక్ట్‌లు ట్యాగ్ చేయబడ్డాయి
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	వీడియో, ఆడియో మరియు రిచ్ మీడియా చదివి వినిపించబడాలంటే వాటిని ట్యాగ్ చేయాలి. మల్టీమీడియా ఉల్లేఖనలను ట్యాగ్ చేయండి.
+	Screen flicker	స్క్రీన్ ఫ్లికర్
+	Page will not cause screen flicker	పేజీ స్క్రీన్ ఫ్లికర్‌కు కారణం కాదు
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	ఫ్లాష్ అయ్యే యానిమేషన్ మూర్ఛలకు కారణం కావచ్చు. స్క్రిప్ట్‌లు, మీడియాలో ఫ్లికర్ ఉందేమో తనిఖీ చేయండి.
+	Scripts	స్క్రిప్ట్‌లు
+	No inaccessible scripts	యాక్సెసిబిలిటీకి అనుకూలం కాని స్క్రిప్ట్‌లు లేవు
+	Timed responses	సమయ పరిమితి ఉన్న ప్రతిస్పందనలు
+	Page does not require timed responses	పేజీకి సమయ పరిమితి ఉన్న ప్రతిస్పందనలు అవసరం లేదు
+	People may need more time to respond. Check that nothing has a time limit.	ప్రతిస్పందించడానికి కొంతమందికి ఎక్కువ సమయం పట్టవచ్చు. దేనికీ సమయ పరిమితి లేదని తనిఖీ చేయండి.
+	Navigation links	నావిగేషన్ లింక్‌లు
+	Navigation links are not repetitive	నావిగేషన్ లింక్‌లు పునరావృతం కావు
+	Repeated navigation links should be skippable. Check links that appear on every page.	పునరావృతమయ్యే నావిగేషన్ లింక్‌లను దాటవేయగలిగేలా ఉండాలి. ప్రతి పేజీలో కనిపించే లింక్‌లను తనిఖీ చేయండి.
+	Tagged form fields	ట్యాగ్ చేసిన ఫారం ఫీల్డ్‌లు
+	All form fields are tagged	అన్ని ఫారం ఫీల్డ్‌లు ట్యాగ్ చేయబడ్డాయి
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	ఫారం ఫీల్డ్‌లు చదివి వినిపించబడాలంటే అవి ట్యాగ్ ట్రీలో (Form ట్యాగ్‌లుగా) ఉండాలి. ఫారం ఫీల్డ్‌లను ట్యాగ్ చేయండి.
+	Field descriptions	ఫీల్డ్ వివరణలు
+	All form fields have description	అన్ని ఫారం ఫీల్డ్‌లకు వివరణ ఉంది
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	ప్రతి ఫీల్డ్‌కు ఏమి నమోదు చేయాలో చెప్పే టూల్‌టిప్ అవసరం. దాన్ని ఫీల్డ్ లక్షణాలు > సాధారణం > టూల్‌టిప్‌లో జోడించండి.
+	Figures alternate text	చిత్రాల ప్రత్యామ్నాయ టెక్స్ట్
+	Figures require alternate text	చిత్రాలకు ప్రత్యామ్నాయ టెక్స్ట్ అవసరం
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	చిత్రాలకు వాటిని వివరించే ప్రత్యామ్నాయ టెక్స్ట్ ఉండాలి, లేదా వాటిని అలంకరణగా గుర్తించాలి. ప్రతి చిత్రానికి ప్రత్యామ్నాయ టెక్స్ట్‌ను జోడించండి.
+	Nested alternate text	లోపలి ప్రత్యామ్నాయ టెక్స్ట్
+	Alternate text that will never be read	ఎప్పటికీ చదవబడని ప్రత్యామ్నాయ టెక్స్ట్
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	ఇప్పటికే ప్రత్యామ్నాయ టెక్స్ట్ ఉన్న ఎలిమెంట్ లోపలి ప్రత్యామ్నాయ టెక్స్ట్ ఎప్పటికీ చదవబడదు. లోపలి ప్రత్యామ్నాయ టెక్స్ట్‌ను తీసివేయండి.
+	Associated with content	కంటెంట్‌తో అనుబంధించబడింది
+	Alternate text must be associated with some content	ప్రత్యామ్నాయ టెక్స్ట్ ఏదో ఒక కంటెంట్‌తో అనుబంధించబడి ఉండాలి
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	పేజీ కంటెంట్ లేని ఎలిమెంట్‌పై ఉన్న ప్రత్యామ్నాయ టెక్స్ట్ ఎప్పటికీ అందుబాటులోకి రాదు. దాన్ని తీసివేయండి లేదా ఎలిమెంట్‌ను కంటెంట్‌కు అనుసంధానించండి.
+	Hides annotation	ఉల్లేఖనను దాచుతుంది
+	Alternate text should not hide annotation	ప్రత్యామ్నాయ టెక్స్ట్ ఉల్లేఖనను దాచకూడదు
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	లింక్ లేదా ఫీల్డ్ ఉన్న ఎలిమెంట్‌పై ఉన్న ప్రత్యామ్నాయ టెక్స్ట్ ఆ ఉల్లేఖనను సహాయక సాంకేతికత నుండి దాచుతుంది. ప్రత్యామ్నాయ టెక్స్ట్‌ను వేరే చోటికి తరలించండి.
+	Other elements alternate text	ఇతర ఎలిమెంట్‌ల ప్రత్యామ్నాయ టెక్స్ట్
+	Other elements that require alternate text	ప్రత్యామ్నాయ టెక్స్ట్ అవసరమైన ఇతర ఎలిమెంట్‌లు
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	సూత్రాలు, అలాంటి ఇతర టెక్స్ట్ కాని ఎలిమెంట్‌లకు ప్రత్యామ్నాయ టెక్స్ట్ అవసరం. వాటికి ప్రత్యామ్నాయ టెక్స్ట్‌ను జోడించండి.
+	Rows	వరుసలు
+	TR must be a child of Table, THead, TBody, or TFoot	TR తప్పనిసరిగా Table, THead, TBody లేదా TFoot లోపల నేరుగా ఉండాలి
+	Table cells belong in a row. Fix the table's tags.	పట్టిక గడులు ఒక వరుసలో ఉండాలి. పట్టిక ట్యాగ్‌లను సరిచేయండి.
+	Headers	హెడర్‌లు
+	Tables should have headers	పట్టికలకు హెడర్‌లు ఉండాలి
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	హెడర్ గడులు (TH) ప్రతి నిలువు వరుస లేదా అడ్డు వరుసలో ఏముందో వినేవారికి తెలియజేస్తాయి. హెడర్ గడులను గుర్తించండి.
+	Regularity	క్రమబద్ధత
+	Tables must contain the same number of columns in each row and rows in each column	పట్టికలలో ప్రతి అడ్డు వరుసలో ఒకే సంఖ్యలో నిలువు వరుసలు, ప్రతి నిలువు వరుసలో ఒకే సంఖ్యలో అడ్డు వరుసలు ఉండాలి
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	క్రమరహిత పట్టికలు గడుల మధ్య నావిగేషన్‌ను గందరగోళపరుస్తాయి. ప్రతి వరుసలో ఒకే సంఖ్యలో గడులు ఉండేలా చూడండి (విలీనం చేసిన గడుల వ్యాప్తిని కూడా లెక్కించి).
+	Summary	సారాంశం
+	Tables must have a summary	పట్టికలకు సారాంశం ఉండాలి
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	సారాంశం పట్టిక ఉద్దేశాన్ని, లేఅవుట్‌ను వివరిస్తుంది. ప్రతి పట్టికకు Summary ఆట్రిబ్యూట్‌ను జోడించండి.
+	List items	జాబితా అంశాలు
+	LI must be a child of L	LI తప్పనిసరిగా L లోపల నేరుగా ఉండాలి
+	List items belong in a list. Fix the list's tags.	జాబితా అంశాలు ఒక జాబితాలో ఉండాలి. జాబితా ట్యాగ్‌లను సరిచేయండి.
+	Lbl and LBody	Lbl మరియు LBody
+	Lbl and LBody must be children of LI	Lbl మరియు LBody తప్పనిసరిగా LI లోపల నేరుగా ఉండాలి
+	List labels and bodies belong in a list item. Fix the list's tags.	జాబితా లేబుల్‌లు, వాటి కంటెంట్ భాగాలు ఒక జాబితా అంశంలో ఉండాలి. జాబితా ట్యాగ్‌లను సరిచేయండి.
+	Appropriate nesting	సరైన స్థాయి క్రమం
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	హెడింగ్ స్థాయిలు మధ్యలో దాటవేయకూడదు (H1 తర్వాత నేరుగా H3 వంటివి). హెడింగ్‌లను మళ్లీ ట్యాగ్ చేయండి.
+	TH and TD	TH మరియు TD
+	TH and TD must be children of TR	TH మరియు TD తప్పనిసరిగా TR లోపల నేరుగా ఉండాలి
+	Mark Page Range	పేజీ పరిధిని గుర్తించు
+	Pages from	పేజీలు
+	Single word or phrase	ఒకే పదం లేదా పదబంధం
+	Text to find	కనుగొనాల్సిన టెక్స్ట్
+	Patterns	నమూనాలు
+	Phone Numbers	ఫోన్ నంబర్‌లు
+	Email Addresses	ఇమెయిల్ చిరునామాలు
+	Credit Cards	క్రెడిట్ కార్డ్‌లు
+	Social Security Numbers	సోషల్ సెక్యూరిటీ నంబర్‌లు
+	Dates	తేదీలు
+	Text in images isn't found; recognise text (OCR) first.	చిత్రాలలోని టెక్స్ట్ కనుగొనబడదు; ముందుగా టెక్స్ట్‌ను గుర్తించండి (OCR).
+	No matches.	సరిపోలికలు ఏవీ లేవు.
+	{n} match(es) marked for redaction.	రెడాక్షన్ కోసం గుర్తించిన సరిపోలికలు: {n}.
+	Redaction Tool Properties	రెడాక్షన్ సాధనం లక్షణాలు
+	Redacted area fill colour:	రెడాక్ట్ చేసిన ప్రాంతం నింపు రంగు:
+	Use overlay text	ఓవర్‌లే టెక్స్ట్‌ను ఉపయోగించు
+	Custom text:	అనుకూల టెక్స్ట్:
+	Font:	ఫాంట్:
+	Font size:	ఫాంట్ పరిమాణం:
+	Auto-size text to fit redaction region	రెడాక్షన్ ప్రాంతానికి సరిపోయేలా టెక్స్ట్ పరిమాణాన్ని స్వయంచాలకంగా మార్చు
+	Font colour:	ఫాంట్ రంగు:
+	Repeat overlay text	ఓవర్‌లే టెక్స్ట్‌ను పునరావృతం చేయి
+	Text alignment:	టెక్స్ట్ అమరిక:
+	Center	మధ్య
+	Apply redactions	రెడాక్షన్‌లను వర్తింపజేయి
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	మీరు 1 రెడాక్షన్ గుర్తును వర్తింపజేయబోతున్నారు. గుర్తు కింద ఉన్న టెక్స్ట్, చిత్రాలు, డ్రాయింగ్‌లు, అలాగే దానితో అతివ్యాప్తి చెందే వ్యాఖ్యలు, ఫారం ఫీల్డ్‌లు శాశ్వతంగా తీసివేయబడతాయి.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	మీరు {n} రెడాక్షన్ గుర్తులను వర్తింపజేయబోతున్నారు. గుర్తుల కింద ఉన్న టెక్స్ట్, చిత్రాలు, డ్రాయింగ్‌లు, అలాగే వాటితో అతివ్యాప్తి చెందే వ్యాఖ్యలు, ఫారం ఫీల్డ్‌లు శాశ్వతంగా తీసివేయబడతాయి.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	తర్వాత పత్రాన్ని సేవ్ చేయండి: సేవ్ చేసినప్పుడు ఫైల్ మొత్తం మళ్లీ రాయబడుతుంది, కాబట్టి తీసివేసిన కంటెంట్ ఆనవాలు కూడా అందులో మిగలదు.
+	Select the items to remove from this document.	ఈ పత్రం నుండి తీసివేయాల్సిన అంశాలను ఎంచుకోండి.
+	Metadata	మెటాడేటా
+	File attachments	ఫైల్ జోడింపులు
+	Comments and markups	వ్యాఖ్యలు మరియు మార్కప్‌లు
+	Hidden text	దాచిన టెక్స్ట్
+	Hidden layers	దాచిన లేయర్‌లు
+	Links, actions and JavaScripts	లింక్‌లు, చర్యలు మరియు JavaScriptలు
+	Private data of other applications	ఇతర అప్లికేషన్‌ల ప్రైవేట్ డేటా
+	None found	ఏవీ కనుగొనబడలేదు
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	ఫారం ఫీల్డ్‌లు ఫ్లాటెన్ చేయబడతాయి: వాటి విలువలు కనిపిస్తూనే ఉంటాయి. సేవ్ చేసినప్పుడు ఫైల్ మొత్తం మళ్లీ రాయబడుతుంది.
+	Remove	తీసివేయి
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	శుభ్రపరచడం వల్ల పత్రంలోని దాచిన సమాచారం తీసివేయబడుతుంది: మెటాడేటా, ఫైల్ జోడింపులు, వ్యాఖ్యలు, ఫారం ఫీల్డ్‌లు (ఫ్లాటెన్ చేయబడతాయి), దాచిన టెక్స్ట్, లేయర్‌లు, బుక్‌మార్క్‌లు, లింక్‌లు, చర్యలు, స్క్రిప్ట్‌లు మరియు అప్లికేషన్‌ల ప్రైవేట్ డేటా.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	తర్వాత పత్రాన్ని సేవ్ చేయండి; సేవ్ చేసినప్పుడు ఫైల్ మొత్తం మళ్లీ రాయబడుతుంది, కాబట్టి తీసివేసినదేదీ అందులో మిగలదు.
+	Printer:	ప్రింటర్:
+	Save as PDF	PDFగా సేవ్ చేయి
+	{name} (default)	{name} (డిఫాల్ట్)
+	Copies:	కాపీలు:
+	Collate	కాపీలను క్రమంలో అమర్చు
+	Print in grayscale	గ్రేస్కేల్‌లో ముద్రించు
+	Two-sided:	రెండు వైపులా ముద్రణ:
+	Off	ఆఫ్
+	Flip on long edge	పొడవైన అంచున తిరగేయి
+	Flip on short edge	పొట్టి అంచున తిరగేయి
+	Paper:	కాగితం:
+	Pages to Print	ముద్రించాల్సిన పేజీలు
+	More options:	మరిన్ని ఎంపికలు:
+	All pages in range	పరిధిలోని అన్ని పేజీలు
+	Odd pages only	బేసి పేజీలు మాత్రమే
+	Even pages only	సరి పేజీలు మాత్రమే
+	Reverse pages	పేజీలను వ్యతిరేక క్రమంలో ముద్రించు
+	Page Sizing & Handling	పేజీ పరిమాణం & నిర్వహణ
+	Size	పరిమాణం
+	Poster	పోస్టర్
+	Multiple	బహుళ పేజీలు
+	Booklet	బుక్‌లెట్
+	Fit	సరిపోయేలా
+	Shrink oversized pages	కాగితం కంటే పెద్దవైన పేజీలను కుదించు
+	Custom scale:	అనుకూల స్కేల్:
+	Tile scale:	టైల్ స్కేల్:
+	Overlap:	అతివ్యాప్తి:
+	Cut marks	కత్తిరింపు గుర్తులు
+	Pages per sheet:	ఒక్కో షీట్‌కు పేజీలు:
+	Page order:	పేజీ క్రమం:
+	Horizontal	అడ్డంగా
+	Horizontal reversed	అడ్డంగా, వ్యతిరేక దిశలో
+	Vertical	నిలువుగా
+	Vertical reversed	నిలువుగా, వ్యతిరేక దిశలో
+	Print page border	పేజీ అంచును ముద్రించు
+	Auto-rotate pages	పేజీలను స్వయంచాలకంగా తిప్పు
+	Booklet subset:	బుక్‌లెట్ వైపులు:
+	Both sides	రెండు వైపులా
+	Front side only	ముందు వైపు మాత్రమే
+	Back side only	వెనుక వైపు మాత్రమే
+	Binding:	బైండింగ్:
+	Left	ఎడమ
+	Right	కుడి
+	Orientation:	దిశ:
+	Auto portrait/landscape	ఆటో నిలువు/అడ్డం
+	Portrait	నిలువు
+	Landscape	అడ్డం
+	Comments & Forms	వ్యాఖ్యలు & ఫారాలు
+	Document	పత్రం
+	Document and markups	పత్రం మరియు మార్కప్‌లు
+	Document and stamps	పత్రం మరియు స్టాంప్‌లు
+	Form fields only	ఫారం ఫీల్డ్‌లు మాత్రమే
+	Previous sheet	మునుపటి షీట్
+	Next sheet	తదుపరి షీట్
+	No sheets	షీట్‌లు లేవు
+	Sheet {s} of {n}	{n}లో {s}వ షీట్
+	Removed 1 hidden item. Save to remove them from the file.	1 దాచిన అంశం తీసివేయబడింది. ఫైల్ నుండి దాన్ని తీసివేయడానికి సేవ్ చేయండి.
+	Removed {n} hidden items. Save to remove them from the file.	{n} దాచిన అంశాలు తీసివేయబడ్డాయి. ఫైల్ నుండి వాటిని తీసివేయడానికి సేవ్ చేయండి.
+	Document sanitized. Save to finish: saving rewrites the whole file.	పత్రం శుభ్రపరచబడింది. పూర్తి చేయడానికి సేవ్ చేయండి: సేవ్ చేసినప్పుడు ఫైల్ మొత్తం మళ్లీ రాయబడుతుంది.
+	Applied 1 redaction mark. Save to remove the content from the file.	1 రెడాక్షన్ గుర్తు వర్తింపజేయబడింది. కంటెంట్‌ను ఫైల్ నుండి తీసివేయడానికి సేవ్ చేయండి.
+	Applied {n} redaction marks. Save to remove the content from the file.	{n} రెడాక్షన్ గుర్తులు వర్తింపజేయబడ్డాయి. కంటెంట్‌ను ఫైల్ నుండి తీసివేయడానికి సేవ్ చేయండి.
+	JavaScript Console	JavaScript కన్సోల్
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript ఆఫ్ చేయబడింది (ప్రాధాన్యతలు > JavaScript).
+	Output appears here.	అవుట్‌పుట్ ఇక్కడ కనిపిస్తుంది.
+	Script Name:	స్క్రిప్ట్ పేరు:
+	This document has no document-level scripts.	ఈ పత్రంలో పత్రం-స్థాయి స్క్రిప్ట్‌లు ఏవీ లేవు.
+	No form fields were detected	ఫారం ఫీల్డ్‌లు ఏవీ గుర్తించబడలేదు
+	Detected 1 form field	1 ఫారం ఫీల్డ్ గుర్తించబడింది
+	Detected {n} form fields	{n} ఫారం ఫీల్డ్‌లు గుర్తించబడ్డాయి
+	{field}: {e}	{field}: {e}
+	Current page	ప్రస్తుత పేజీ
+	Document language	పత్రం భాష
+	Output	అవుట్‌పుట్
+	Searchable Image (Exact)	వెతకగలిగే చిత్రం (యథాతథం)
+	Adds invisible text over each word; the page image is not changed	ప్రతి పదంపై కనిపించని టెక్స్ట్‌ను జోడిస్తుంది; పేజీ చిత్రం మారదు
+	Downsample to	ఈ రిజల్యూషన్‌కు తగ్గించు
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	టెక్స్ట్ గుర్తింపు ఇన్‌స్టాల్ చేయబడలేదు: దానికి అవసరమైన మోడల్‌లు లేవు (`cargo xtask models`ను అమలు చేయండి, లేదా PRINTCRAFT_MODELSను సెట్ చేయండి).
+	Settings	సెట్టింగ్‌లు
+	Optional	ఐచ్ఛికం
+	Planned · {m}	ప్రణాళికలో ఉంది · {m}
+	Planned for milestone {m} — open to see what it will include	మైల్‌స్టోన్ {m}కి ప్రణాళిక చేయబడింది — ఇందులో ఏమేమి ఉంటాయో చూడటానికి తెరవండి
+	Coming in milestone {m}. Items marked Ready work today.	మైల్‌స్టోన్ {m}లో వస్తుంది. సిద్ధం అని గుర్తించిన అంశాలు ఇప్పటికే పని చేస్తాయి.
+	1 mark	1 గుర్తు
+	{n} marks	{n} గుర్తులు
+	Dynamic	డైనమిక్
+	Sign Here	ఇక్కడ సంతకం చేయండి
+	Standard Business	ప్రామాణిక వ్యాపారం
+	Choose a stamp, then click on the page to place it.	ఒక స్టాంప్‌ను ఎంచుకుని, దాన్ని ఉంచడానికి పేజీపై క్లిక్ చేయండి.
+	Note	గమనిక
+	Polyline	పాలీలైన్
+	Attachment	జోడింపు
+	Callout	కాల్‌అవుట్
+	Typewriter	టైప్‌రైటర్
+	Checked	టిక్ చేసినవి
+	Unchecked	టిక్ చేయనివి
+	Marked	టిక్ చేయబడింది
+	Locked	లాక్ చేయబడింది
+	Search comments	వ్యాఖ్యలను వెతుకు
+	Add a comment	వ్యాఖ్యను జోడించండి
+	No comments yet.	ఇంకా వ్యాఖ్యలు ఏవీ లేవు.
+	Pick a tool in the quick bar, or type above.	త్వరిత బార్‌లో ఒక సాధనాన్ని ఎంచుకోండి, లేదా పైన టైప్ చేయండి.
+	No comments match.	ఏ వ్యాఖ్యలూ సరిపోలలేదు.
+	Unknown author	తెలియని రచయిత
+	No colour	రంగు లేదు
+	Remove checkmark	టిక్ గుర్తును తీసివేయి
+	Mark with checkmark	టిక్ గుర్తుతో గుర్తించు
+	Reply	ప్రత్యుత్తరం ఇవ్వు
+	Add a reply	ప్రత్యుత్తరాన్ని జోడించండి
+	Post	పోస్ట్ చేయి
+	Page {label}	పేజీ {label}
+	{kind} — click to show it on the page	{kind} — పేజీపై చూపించడానికి క్లిక్ చేయండి
+	Set status	స్థితిని సెట్ చేయి
+	Copy text	టెక్స్ట్‌ను కాపీ చేయి
+	Properties…	లక్షణాలు…
+	Make Current Properties Default	ప్రస్తుత లక్షణాలను డిఫాల్ట్‌గా చేయి
+	More options	మరిన్ని ఎంపికలు
+	Sort by	క్రమపరిచే విధానం
+	Author	రచయిత
+	Type	రకం
+signature pad	Type	టైప్ చేయి
+	Colour	రంగు
+	Show all comments	అన్ని వ్యాఖ్యలను చూపించు
+	Create PDF comment summary…	PDF వ్యాఖ్యల సారాంశాన్ని సృష్టించు…
+	Export all to data file…	అన్నింటినీ డేటా ఫైల్‌కు ఎగుమతి చేయి…
+	Filter comments	వ్యాఖ్యలను ఫిల్టర్ చేయి
+	Status	స్థితి
+	Accepted	ఆమోదించబడింది
+	Rejected	తిరస్కరించబడింది
+	Cancelled	రద్దు చేయబడింది
+	Completed	పూర్తయింది
+	Show all	అన్నీ చూపించు
+	Yellow	పసుపు
+	Orange	నారింజ రంగు
+	Red	ఎరుపు
+	Pink	గులాబీ రంగు
+	Purple	ఊదా
+	Blue	నీలం
+	Light blue	లేత నీలం
+	Green	ఆకుపచ్చ
+	Gray	బూడిద రంగు
+	Black	నలుపు
+	Bookmark options	బుక్‌మార్క్ ఎంపికలు
+	Expand all bookmarks	అన్ని బుక్‌మార్క్‌లను విస్తరించు
+	Expand top-level bookmarks	పై స్థాయి బుక్‌మార్క్‌లను విస్తరించు
+	Collapse all bookmarks	అన్ని బుక్‌మార్క్‌లను ముడుచు
+	New bookmark (⌘B)	కొత్త బుక్‌మార్క్ (⌘B)
+	This document has no bookmarks.	ఈ పత్రంలో బుక్‌మార్క్‌లు లేవు.
+	This document has no layers.	ఈ పత్రంలో లేయర్‌లు లేవు.
+	This document has no attachments.	ఈ పత్రంలో జోడింపులు లేవు.
+	Hide layer	లేయర్‌ను దాచు
+	Show layer	లేయర్‌ను చూపించు
+	on page {label}	పేజీ {label}లో
+	Save attachment…	జోడింపును సేవ్ చేయి…
+	Open in a new tab	కొత్త ట్యాబ్‌లో తెరువు
+	This document has no pages.	ఈ పత్రంలో పేజీలు లేవు.
+	Find text	టెక్స్ట్‌ను కనుగొను
+	No matches	సరిపోలికలు లేవు
+	Searching… {s}/{p}	వెతుకుతోంది… {s}/{p}
+	{c} of {n}{more}	{n}{more}లో {c}
+	Previous (⇧⌘G)	మునుపటి (⇧⌘G)
+	Next (⌘G)	తదుపరి (⌘G)
+	Find options	కనుగొనే ఎంపికలు
+	Whole words only	పూర్తి పదాలు మాత్రమే
+	Case-sensitive	పెద్ద/చిన్న అక్షరాల తేడాతో
+	Close (Esc)	మూసివేయి (Esc)
+	Align	అమరిక
+	Top	పైన
+	Bottom	కింద
+	Center horizontally	అడ్డంగా మధ్యలో ఉంచు
+	Center vertically	నిలువుగా మధ్యలో ఉంచు
+	Distribute	సమాన అంతరం
+	Horizontally	అడ్డంగా
+	Vertically	నిలువుగా
+	Set Fields to Same Size	ఫీల్డ్‌లను ఒకే పరిమాణానికి మార్చు
+	Height	ఎత్తు
+	Width	వెడల్పు
+	Both	రెండూ
+	Duplicate…	నకలు చేయి…
+	All pages	అన్ని పేజీలు
+	Odd pages	బేసి పేజీలు
+	Even pages	సరి పేజీలు
+	Landscape pages	అడ్డం పేజీలు
+	Portrait pages	నిలువు పేజీలు
+	Move earlier	ముందు స్థానానికి తరలించు
+	Move later	తర్వాతి స్థానానికి తరలించు
+	Back to the document	పత్రానికి తిరిగి వెళ్లు
+	Protect Using Password	పాస్‌వర్డ్ రక్షణ
+	Requires user to enter a password for:	వినియోగదారు దీని కోసం పాస్‌వర్డ్ నమోదు చేయాల్సి ఉంటుంది:
+	Viewing	చూడటం
+	Editing	సవరించడం
+	Type Password	పాస్‌వర్డ్ టైప్ చేయండి
+	Re-type Password	పాస్‌వర్డ్‌ను మళ్లీ టైప్ చేయండి
+	Strength: {s}	బలం: {s}
+	Strong	బలమైనది
+	Medium	మధ్యస్థం
+	Weak	బలహీనమైనది
+	Advanced Options {chevron}	అధునాతన ఎంపికలు {chevron}
+	Compatibility	అనుకూలత
+	Acrobat X and later (256-bit AES)	Acrobat X, తర్వాతి వెర్షన్‌లు (256-బిట్ AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0, తర్వాతి వెర్షన్‌లు (128-బిట్ AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0, తర్వాతి వెర్షన్‌లు (128-బిట్ RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0, తర్వాతి వెర్షన్‌లు (40-బిట్ RC4)
+	Encrypt	ఎన్‌క్రిప్ట్ చేయాల్సినవి
+	All document contents	పత్రంలోని మొత్తం కంటెంట్
+	All document contents except metadata	మెటాడేటా తప్ప పత్రంలోని మొత్తం కంటెంట్
+	Printing allowed	ముద్రణకు అనుమతి
+	Low Resolution (150 dpi)	తక్కువ రిజల్యూషన్ (150 dpi)
+	Changes allowed	మార్పులకు అనుమతి
+	Inserting, deleting, and rotating pages	పేజీలను చొప్పించడం, తొలగించడం, తిప్పడం
+	Filling in form fields and signing existing signature fields	ఫారం ఫీల్డ్‌లను నింపడం, ఇప్పటికే ఉన్న సంతకం ఫీల్డ్‌లలో సంతకం చేయడం
+	Commenting, filling in form fields, and signing existing signature fields	వ్యాఖ్యలు జోడించడం, ఫారం ఫీల్డ్‌లను నింపడం, ఇప్పటికే ఉన్న సంతకం ఫీల్డ్‌లలో సంతకం చేయడం
+	Any except extracting pages	పేజీలను వేరు తీయడం తప్ప ఏదైనా
+	Enable copying of text, images, and other content	టెక్స్ట్, చిత్రాలు, ఇతర కంటెంట్‌ను కాపీ చేయడాన్ని అనుమతించు
+	Enable text access for screen reader devices for the visually impaired	దృష్టి లోపం ఉన్నవారి కోసం స్క్రీన్ రీడర్ పరికరాలకు టెక్స్ట్ యాక్సెస్‌ను అనుమతించు
+	Type a password.	పాస్‌వర్డ్‌ను టైప్ చేయండి.
+	The passwords don't match.	పాస్‌వర్డ్‌లు సరిపోలడం లేదు.
+	This compatibility level supports only plain ASCII passwords.	ఈ అనుకూలత స్థాయి సాధారణ ASCII పాస్‌వర్డ్‌లకు మాత్రమే మద్దతు ఇస్తుంది.
+	Anyone opening the document will need this password. It's applied when you save.	పత్రాన్ని తెరిచే ప్రతి ఒక్కరికీ ఈ పాస్‌వర్డ్ అవసరం. మీరు సేవ్ చేసినప్పుడు ఇది వర్తిస్తుంది.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	పత్రం పాస్‌వర్డ్ లేకుండానే తెరుచుకుంటుంది; పరిమితులను మార్చడానికి ఈ పాస్‌వర్డ్ అవసరం. మీరు సేవ్ చేసినప్పుడు ఇది వర్తిస్తుంది.
+	Recover unsaved documents?	సేవ్ చేయని పత్రాలను పునరుద్ధరించాలా?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft సక్రమంగా మూసివేయబడలేదు. ఈ పత్రాలలో ఆటోసేవ్ అయిన మార్పులు ఉన్నాయి:
+	just now	ఇప్పుడే
+	{n} min ago	{n} నిమి. క్రితం
+	{n} h ago	{n} గం. క్రితం
+	 · password-protected	 · పాస్‌వర్డ్‌తో రక్షించబడింది
+	Recover	పునరుద్ధరించు
+	Discard	విస్మరించు
+	Version {v}	వెర్షన్ {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Rustలో రాసిన క్లీన్-రూమ్, ఓపెన్-సోర్స్ PDF అప్లికేషన్. MIT OR Apache-2.0.
+	Part of	దీనిలో భాగం:
+	Summarize Options	సారాంశ ఎంపికలు
+	Choose a layout:	లేఅవుట్‌ను ఎంచుకోండి:
+	Comments only	వ్యాఖ్యలు మాత్రమే
+	Sort comments by:	వ్యాఖ్యలను క్రమపరిచే విధానం:
+	Create PDF Comment Summary	PDF వ్యాఖ్యల సారాంశాన్ని సృష్టించు
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	“{name}”ను గతంలో సేవ్ చేసిన వెర్షన్‌కు తిరిగి మార్చాలా? అప్పటి నుండి చేసిన మార్పులు పోతాయి, వాటిని తర్వాత తిరిగి పొందలేరు.
+	Number pages	పేజీలకు సంఖ్యలు వేయి
+	Style	శైలి
+	None (prefix only)	ఏదీ లేదు (ప్రిఫిక్స్ మాత్రమే)
+	Prefix	ప్రిఫిక్స్
+	Start	ప్రారంభం
+action wizard	Start	ప్రారంభించు
+	Labels: {preview}. Later pages keep their labels.	లేబుల్‌లు: {preview}. తర్వాతి పేజీలు వాటి లేబుల్‌లను అలాగే ఉంచుకుంటాయి.
+	Even and Odd Pages	సరి, బేసి పేజీలు
+	Even Pages Only	సరి పేజీలు మాత్రమే
+	Odd Pages Only	బేసి పేజీలు మాత్రమే
+	Landscape and Portrait Pages	అడ్డం, నిలువు పేజీలు
+	Landscape Pages	అడ్డం పేజీలు
+	Portrait Pages	నిలువు పేజీలు
+	Duplicate Field	ఫీల్డ్ నకలు
+	Duplicate "{name}" onto:	"{name}" నకళ్లను ఉంచాల్సిన పేజీలు:
+	1 page selected.	1 పేజీ ఎంచుకోబడింది.
+	{n} pages selected.	{n} పేజీలు ఎంచుకోబడ్డాయి.
+	Delete pages after extracting	వేరు తీసిన తర్వాత పేజీలను తొలగించు
+	Extract pages as separate files	పేజీలను వేర్వేరు ఫైల్‌లుగా వేరు తీయి
+	Rotate Pages	పేజీలను తిప్పడం
+	Direction:	దిశ:
+	Clockwise 90 degrees	సవ్యదిశలో 90 డిగ్రీలు
+	Counterclockwise 90 degrees	అపసవ్యదిశలో 90 డిగ్రీలు
+	180 degrees	180 డిగ్రీలు
+	Pages:	పేజీలు:
+	All	అన్నీ
+	Selection	ఎంచుకున్నవి
+	From	పరిధి
+	Rotate:	తిప్పాల్సినవి:
+	Repairs	మరమ్మతులు
+	Repair log	మరమ్మతుల లాగ్
+	Split document	పత్రం విభజన
+	Number of pages	పేజీల సంఖ్య
+	Pages per file	ప్రతి ఫైల్‌కు పేజీలు
+	File size	ఫైల్ పరిమాణం
+	At most	గరిష్ఠంగా
+	Top-level bookmarks ({n})	పై స్థాయి బుక్‌మార్క్‌లు ({n})
+	Before each selected page (select pages in Organize)	ఎంచుకున్న ప్రతి పేజీకి ముందు (పేజీల నిర్వహణలో పేజీలను ఎంచుకోండి)
+	Creates 1 file from {n} pages.	{n} పేజీల నుండి 1 ఫైల్ సృష్టించబడుతుంది.
+	Creates {f} files from {n} pages.	{n} పేజీల నుండి {f} ఫైల్‌లు సృష్టించబడతాయి.
+	Each file holds as many of the {n} pages as fit.	ప్రతి ఫైల్‌లో {n} పేజీలలో సరిపోయినన్ని పేజీలు ఉంటాయి.
+	Replace Pages	పేజీల భర్తీ
+	Original: replace pages	అసలు: భర్తీ చేయాల్సిన పేజీలు
+	to	నుండి
+	to {n}	నుండి {n}
+	Replacement: pages of {name}	భర్తీ: {name}లోని పేజీలు
+	of {name}	(మొత్తం {name})
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	పేజీ కంటెంట్ మాత్రమే మారుతుంది: అసలు పేజీలలోని లింక్‌లు, వ్యాఖ్యలు, ఫారం ఫీల్డ్‌లు, బుక్‌మార్క్‌లు అలాగే ఉంటాయి.
+	The replacement file doesn't have that many pages.	భర్తీ ఫైల్‌లో అవసరమైనన్ని పేజీలు లేవు.
+	Tagged PDF	ట్యాగ్ చేసిన PDF
+	Document Properties	పత్రం లక్షణాలు
+	Description	వివరణ
+	Initial View	ప్రారంభ వీక్షణ
+	Security	భద్రత
+	Fonts	ఫాంట్‌లు
+	Advanced	అధునాతనం
+	Title	శీర్షిక
+	Subject	విషయం
+	Keywords	కీలక పదాలు
+	Application	అప్లికేషన్
+	PDF producer	PDF తయారీ సాధనం
+	Layout and Magnification	లేఅవుట్, జూమ్ స్థాయి
+	Navigation tab	నావిగేషన్ ట్యాబ్
+	Page Only	పేజీ మాత్రమే
+	Bookmarks Panel and Page	బుక్‌మార్క్‌ల ప్యానెల్, పేజీ
+	Pages Panel and Page	పేజీల ప్యానెల్, పేజీ
+	Attachments Panel and Page	జోడింపుల ప్యానెల్, పేజీ
+	Layers Panel and Page	లేయర్‌ల ప్యానెల్, పేజీ
+	Page layout	పేజీ లేఅవుట్
+	Default	డిఫాల్ట్
+	Single Page	ఒకే పేజీ
+	Single Page Continuous	ఒకే పేజీ, నిరంతర స్క్రోలింగ్
+	Two-Up (Facing)	రెండు పేజీలు (ఎదురెదురుగా)
+	Two-Up Continuous (Facing)	రెండు పేజీలు, నిరంతర స్క్రోలింగ్ (ఎదురెదురుగా)
+	Two-Up (Cover Page)	రెండు పేజీలు (కవర్ పేజీ)
+	Two-Up Continuous (Cover Page)	రెండు పేజీలు, నిరంతర స్క్రోలింగ్ (కవర్ పేజీ)
+	Magnification	జూమ్ స్థాయి
+	Actual Size	అసలు పరిమాణం
+	Fit Page	పేజీకి సరిపోయేలా
+	Fit Width	వెడల్పుకు సరిపోయేలా
+	Fit Height	ఎత్తుకు సరిపోయేలా
+	Fit Visible	కనిపించే భాగానికి సరిపోయేలా
+	Open to page	తెరిచే పేజీ
+	of {pages}	(మొత్తం {pages})
+	Window Options	విండో ఎంపికలు
+	Resize window to initial page	విండోను ప్రారంభ పేజీకి సరిపోయేలా పరిమాణం మార్చు
+	Center window on screen	విండోను స్క్రీన్ మధ్యలో ఉంచు
+	Open in Full Screen mode	పూర్తి స్క్రీన్ మోడ్‌లో తెరువు
+	Show:	చూపించు:
+	File Name	ఫైల్ పేరు
+	Document Title	పత్రం శీర్షిక
+	User Interface Options	వినియోగదారు ఇంటర్‌ఫేస్ ఎంపికలు
+	Hide menu bar	మెనూ బార్‌ను దాచు
+	Hide toolbars	టూల్‌బార్‌లను దాచు
+	Hide window controls	విండో నియంత్రణలను దాచు
+	Security method	భద్రతా పద్ధతి
+	No security	భద్రత లేదు
+	Restrictions	పరిమితులు
+	None — everything is allowed	ఏవీ లేవు — అన్నీ అనుమతించబడ్డాయి
+	Password security	పాస్‌వర్డ్ భద్రత
+	Encryption	ఎన్‌క్రిప్షన్
+	Opened with	తెరవడానికి ఉపయోగించినది
+	— (protection is applied when you save)	— (సేవ్ చేసినప్పుడు రక్షణ వర్తిస్తుంది)
+	Owner password (no restrictions apply)	యజమాని పాస్‌వర్డ్ (పరిమితులు ఏవీ వర్తించవు)
+	User password	వినియోగదారు పాస్‌వర్డ్
+	Change settings…	సెట్టింగ్‌లను మార్చు…
+	Printing	ముద్రణ
+	Not allowed	అనుమతించబడలేదు
+	Allowed	అనుమతించబడింది
+	High resolution	అధిక రిజల్యూషన్
+	Low resolution	తక్కువ రిజల్యూషన్
+	Changing the document	పత్రాన్ని మార్చడం
+	Document assembly	పత్రం కూర్పు
+	Content copying	కంటెంట్ కాపీ చేయడం
+	Content copying for accessibility	యాక్సెసిబిలిటీ కోసం కంటెంట్ కాపీ చేయడం
+	Commenting	వ్యాఖ్యలు జోడించడం
+	Filling of form fields	ఫారం ఫీల్డ్‌లను నింపడం
+	No fonts are referenced by the pages.	పేజీలలో ఫాంట్‌లు ఏవీ ఉపయోగించబడలేదు.
+	PDF version	PDF వెర్షన్
+	Location	స్థానం
+	Page size	పేజీ పరిమాణం
+	Yes	అవును
+	No	కాదు
+	Revisions	రివిజన్‌లు
+	View revision {n}	రివిజన్ {n} చూడు
+	Open the file as it was saved then	ఆ సమయంలో సేవ్ చేసిన విధంగా ఫైల్‌ను తెరువు
+	Binding	బైండింగ్
+	Left Edge	ఎడమ అంచు
+	Right Edge	కుడి అంచు
+	Language	భాష
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	{place} సేవ్ చేయబడింది: {before} → {after} ({pct}% తగ్గింది){detail}
+	Couldn't save the image: {e}	చిత్రాన్ని సేవ్ చేయడం సాధ్యం కాలేదు: {e}
+	Adding images arrives on the web with file pickers for images	చిత్రాలను జోడించడం, చిత్రాల కోసం ఫైల్ పికర్‌లతో పాటు వెబ్‌లో వస్తుంది
+	Replacing images on page {p} arrives on the web with image pickers ({i})	{p}వ పేజీలోని చిత్రాలను భర్తీ చేయడం, చిత్రాల పికర్‌లతో పాటు వెబ్‌లో వస్తుంది ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: చిత్రాలను ఎంచుకోవడం, చిత్రాల కోసం ఫైల్ పికర్‌లతో పాటు వెబ్‌లో వస్తుంది
+	Replacing images arrives on the web with image file pickers	చిత్రాలను భర్తీ చేయడం, చిత్ర ఫైల్ పికర్‌లతో పాటు వెబ్‌లో వస్తుంది
+	Couldn't create a PDF: {e}	PDFను సృష్టించడం సాధ్యం కాలేదు: {e}
+	The clipboard has no image or text	క్లిప్‌బోర్డ్‌లో చిత్రం గానీ టెక్స్ట్ గానీ లేదు
+	On the web, open or drop an image to convert it	వెబ్‌లో అయితే, చిత్రాన్ని మార్చడానికి దాన్ని తెరవండి లేదా ఇక్కడ డ్రాప్ చేయండి
+	Couldn't optimize the file: {e}	ఫైల్‌ను ఆప్టిమైజ్ చేయడం సాధ్యం కాలేదు: {e}
+	Couldn't write {path}: {e}	{path}ను రాయడం సాధ్యం కాలేదు: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	ఈ ఫారం {u}కు సమర్పించమని అడుగుతోంది; PdfCraft ఫారం డేటాను పంపదు. మీరు నింపిన వివరాలను ఉంచుకోవడానికి పత్రాన్ని సేవ్ చేయండి.
+	{s} actions run in the JavaScript engine (M6)	{s} చర్యలు JavaScript ఇంజిన్‌లో అమలవుతాయి (M6)
+	{name}: the {other} action isn't supported yet	{name}: {other} చర్యకు ఇంకా మద్దతు లేదు
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} ఫారాన్ని {url}కు సమర్పిస్తుంది; PdfCraft ఫారం డేటాను పంపదు. మీరు నింపిన వివరాలను ఉంచుకోవడానికి పత్రాన్ని సేవ్ చేయండి.
+	Export stopped: {e}	ఎగుమతి ఆగిపోయింది: {e}
+	Exported 1 image	1 చిత్రం ఎగుమతి చేయబడింది
+	Exported {n} images	{n} చిత్రాలు ఎగుమతి చేయబడ్డాయి
+	 ({s} not exported: {first})	 ({s} ఎగుమతి కాలేదు: {first})
+	Exported the text of 1 page	1 పేజీ టెక్స్ట్ ఎగుమతి చేయబడింది
+	Exported the text of {n} pages	{n} పేజీల టెక్స్ట్ ఎగుమతి చేయబడింది
+	{msg} to {dir}	{dir} ఫోల్డర్‌లోకి {msg}
+	Exporting… {d} of {t}	ఎగుమతి అవుతోంది… {t}లో {d}
+	Choose a folder for the exported files	ఎగుమతి చేసిన ఫైల్‌ల కోసం ఒక ఫోల్డర్‌ను ఎంచుకోండి
+	New {tool} comments will look like this one	{tool}: కొత్త వ్యాఖ్యలు ఇలాగే కనిపిస్తాయి
+	This document can't be checked: it couldn't be read for editing	ఈ పత్రాన్ని తనిఖీ చేయడం సాధ్యం కాదు: సవరణ కోసం దీన్ని చదవడం సాధ్యం కాలేదు
+	The checker found no problems in this document.	తనిఖీ సాధనం ఈ పత్రంలో ఎటువంటి సమస్యలనూ కనుగొనలేదు.
+	The checker found 1 problem which may prevent the document from being fully accessible.	పత్రం పూర్తి యాక్సెసిబిలిటీకి ఆటంకం కలిగించే అవకాశం ఉన్న 1 సమస్యను తనిఖీ సాధనం కనుగొంది.
+	The checker found {n} problems which may prevent the document from being fully accessible.	పత్రం పూర్తి యాక్సెసిబిలిటీకి ఆటంకం కలిగించే అవకాశం ఉన్న {n} సమస్యలను తనిఖీ సాధనం కనుగొంది.
+	The text is the same	టెక్స్ట్ ఒకేలా ఉంది
+	1 difference found	1 తేడా కనుగొనబడింది
+	{n} differences found	{n} తేడాలు కనుగొనబడ్డాయి
+	Added 1 comment	1 వ్యాఖ్య జోడించబడింది
+	Added {n} comments	{n} వ్యాఖ్యలు జోడించబడ్డాయి
+	Choose a folder for the results	ఫలితాల కోసం ఒక ఫోల్డర్‌ను ఎంచుకోండి
+	Files for {name}	{name} కోసం ఫైల్‌లు
+	An action is already running	ఇప్పటికే ఒక చర్య అమలవుతోంది
+	Running action… file {d} of {t}	చర్య అమలవుతోంది… {t}లో {d}వ ఫైల్
+	No unlinked web addresses were found in the text	టెక్స్ట్‌లో లింక్ లేని వెబ్ చిరునామాలు ఏవీ కనుగొనబడలేదు
+	Created 1 link	1 లింక్ సృష్టించబడింది
+	Created {n} links	{n} లింక్‌లు సృష్టించబడ్డాయి
+	Text recognition is already running	టెక్స్ట్ గుర్తింపు ఇప్పటికే అమలవుతోంది
+	Recognizing text… file {d} of {t}	టెక్స్ట్‌ను గుర్తిస్తోంది… {t}లో {d}వ ఫైల్
+	Recognizing text… page {d} of {t}	టెక్స్ట్‌ను గుర్తిస్తోంది… {t}లో {d}వ పేజీ
+	Recognized 1 word	1 పదం గుర్తించబడింది
+	Recognized {n} words	{n} పదాలు గుర్తించబడ్డాయి
+	{words} on {pages}	{words} ({pages})
+	; 1 page already had text	; 1 పేజీలో ఇప్పటికే టెక్స్ట్ ఉంది
+	; {n} pages already had text	; {n} పేజీలలో ఇప్పటికే టెక్స్ట్ ఉంది
+	Recognized {w} words in 1 file	1 ఫైల్‌లో {w} పదాలు గుర్తించబడ్డాయి
+	Recognized {w} words in {n} files	{n} ఫైల్‌లలో {w} పదాలు గుర్తించబడ్డాయి
+	; failed: {list}	; విఫలమైనవి: {list}
+	1 file done	1 ఫైల్ పూర్తయింది
+	{n} files done	{n} ఫైల్‌లు పూర్తయ్యాయి
+	The selected area has been copied ({w} × {h} pixels)	ఎంచుకున్న భాగం కాపీ చేయబడింది ({w} × {h} పిక్సెల్‌లు)
+	Couldn't take the snapshot: {e}	స్నాప్‌షాట్ తీయడం సాధ్యం కాలేదు: {e}
+	Couldn't recover {name}: {e}	{name}ను పునరుద్ధరించడం సాధ్యం కాలేదు: {e}
+	The document now conforms to {level}; save it to keep the changes	పత్రం ఇప్పుడు {level}కు అనుగుణంగా ఉంది; మార్పులను ఉంచుకోవడానికి దాన్ని సేవ్ చేయండి
+	Fixed what could be fixed; 1 problem remains	సరిచేయగలిగినవన్నీ సరిచేయబడ్డాయి; 1 సమస్య మిగిలి ఉంది
+	Fixed what could be fixed; {n} problems remain	సరిచేయగలిగినవన్నీ సరిచేయబడ్డాయి; {n} సమస్యలు మిగిలి ఉన్నాయి
+	Custom stamps arrive on the web with file pickers for images	అనుకూల స్టాంప్‌లు, చిత్రాల కోసం ఫైల్ పికర్‌లతో పాటు వెబ్‌లో వస్తాయి
+	{file} is too large for a stamp (at most {n} MB)	స్టాంప్‌కు {file} చాలా పెద్దది (గరిష్ఠంగా {n} MB)
+	Sent to {printer}	{printer}కు పంపబడింది
+	Sent to {printer}: {msg}	{printer}కు పంపబడింది: {msg}
+	Choose a folder for the searchable files	వెతకగలిగే ఫైల్‌ల కోసం ఒక ఫోల్డర్‌ను ఎంచుకోండి
+	Files are combined in this order. Leave Pages empty to take every page.	ఫైల్‌లు ఈ క్రమంలో కలపబడతాయి. అన్ని పేజీలను తీసుకోవడానికి పేజీలు ఫీల్డ్‌ను ఖాళీగా వదలండి.
+	Pages of {name} to combine, e.g. 1-3, 6	కలపాల్సిన {name} పేజీలు, ఉదా. 1-3, 6
+	Remove {name}	{name}ను తీసివేయి
+	Add files…	ఫైల్‌లను జోడించు…
+	Add at least two files	కనీసం రెండు ఫైల్‌లను జోడించండి
+	Couldn't add {name}: {e}	{name}ను జోడించడం సాధ్యం కాలేదు: {e}
+	Couldn't combine files: {e}	ఫైల్‌లను కలపడం సాధ్యం కాలేదు: {e}
+	Export comments	వ్యాఖ్యలను ఎగుమతి చేయి
+	Export form data	ఫారం డేటాను ఎగుమతి చేయి
+	Comment and form data	వ్యాఖ్య మరియు ఫారం డేటా
+	Export	ఎగుమతి చేయి
+	Select data files to merge	విలీనం చేయడానికి డేటా ఫైల్‌లను ఎంచుకోండి
+	Form data and PDF forms	ఫారం డేటా మరియు PDF ఫారాలు
+	Save the spreadsheet	స్ప్రెడ్‌షీట్‌ను సేవ్ చేయి
+	Save the accessibility report	యాక్సెసిబిలిటీ నివేదికను సేవ్ చేయి
+	Save image	చిత్రాన్ని సేవ్ చేయి
+	Export certificate	సర్టిఫికెట్‌ను ఎగుమతి చేయి
+	Choose a folder for the extracted pages	వేరు తీసిన పేజీల కోసం ఒక ఫోల్డర్‌ను ఎంచుకోండి
+	Choose a folder for the split files	విభజించిన ఫైల్‌ల కోసం ఒక ఫోల్డర్‌ను ఎంచుకోండి
+	Couldn't use {name}: {e}	{name}ను ఉపయోగించడం సాధ్యం కాలేదు: {e}
+	Couldn't extract pages: {e}	పేజీలను వేరు తీయడం సాధ్యం కాలేదు: {e}
+	Couldn't write {name}: {e}	{name}ను రాయడం సాధ్యం కాలేదు: {e}
+	Wrote 1 file to {dir}	{dir}లో 1 ఫైల్ సేవ్ చేయబడింది
+	Wrote {n} files to {dir}	{dir}లో {n} ఫైల్‌లు సేవ్ చేయబడ్డాయి
+	No pages match those choices	ఆ ఎంపికలకు సరిపోయే పేజీలు ఏవీ లేవు
+	Couldn't split: {e}	విభజించడం సాధ్యం కాలేదు: {e}
+	Couldn't summarize comments: {e}	వ్యాఖ్యల సారాంశాన్ని రూపొందించడం సాధ్యం కాలేదు: {e}
+	Couldn't open the result: {e}	ఫలితాన్ని తెరవడం సాధ్యం కాలేదు: {e}
+	Importing data arrives on the web with file pickers for data files	డేటాను దిగుమతి చేయడం, డేటా ఫైల్‌ల కోసం ఫైల్ పికర్‌లతో పాటు వెబ్‌లో వస్తుంది
+	Exported to {path}	{path}కు ఎగుమతి చేయబడింది
+	Merging data files needs the desktop app	డేటా ఫైల్‌లను విలీనం చేయడానికి డెస్క్‌టాప్ యాప్ అవసరం
+	Merged 1 file into {path}	1 ఫైల్ {path}లో విలీనం చేయబడింది
+	Merged {n} files into {path}	{n} ఫైల్‌లు {path}లో విలీనం చేయబడ్డాయి
+	Combined {n} files	{n} ఫైల్‌లు కలపబడ్డాయి
+	Extracted 1 page	1 పేజీ వేరు తీయబడింది
+	Extracted {n} pages	{n} పేజీలు వేరు తీయబడ్డాయి
+	Created a comment summary	వ్యాఖ్యల సారాంశం సృష్టించబడింది
+	Couldn't open {name}: {e}	{name}ను తెరవడం సాధ్యం కాలేదు: {e}
+	Couldn't read {name}: {e}	{name}ను చదవడం సాధ్యం కాలేదు: {e}
+	Couldn't save: {e}	సేవ్ చేయడం సాధ్యం కాలేదు: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	వెబ్‌లో జోడింపులను డౌన్‌లోడ్ చేయడం M3.10లో వస్తుంది ({n} బైట్‌లు సిద్ధంగా ఉన్నాయి)
+	`{command}` {when}	`{command}` కమాండ్ {when}
+	ships in milestone {m}	మైల్‌స్టోన్ {m}లో వస్తుంది
+	needs an AI provider (off by default)	పని చేయడానికి AI ప్రొవైడర్ అవసరం (డిఫాల్ట్‌గా ఆఫ్‌లో ఉంటుంది)
+	is available	అందుబాటులో ఉంది
+	is not available yet	ఇంకా అందుబాటులో లేదు
+	{label} failed: {e}	{label} చర్య విఫలమైంది: {e}
+	Undid {label}	రద్దు చేయబడింది: {label}
+	Redid {label}	మళ్లీ చేయబడింది: {label}
+	A document needs at least one page: copy instead	పత్రంలో కనీసం ఒక పేజీ ఉండాలి: బదులుగా కాపీ చేయండి
+	Cut {what}	కత్తిరించబడింది: {what}
+	Copied {what}	కాపీ చేయబడింది: {what}
+	1 page	1 పేజీ
+	{n} pages	{n} పేజీలు
+	Copy or cut pages first	ముందుగా పేజీలను కాపీ చేయండి లేదా కత్తిరించండి
+	Couldn't save {name}: {e}	{name}ను సేవ్ చేయడం సాధ్యం కాలేదు: {e}
+	Saved {name}	{name} సేవ్ చేయబడింది
+	Saved, but reopening failed: {e}	సేవ్ చేయబడింది, కానీ మళ్లీ తెరవడం విఫలమైంది: {e}
+	Downloaded {name}	{name} డౌన్‌లోడ్ చేయబడింది
+	Couldn't download {name}: {e}	{name}ను డౌన్‌లోడ్ చేయడం సాధ్యం కాలేదు: {e}
+	Reverted to the last saved version	చివరిగా సేవ్ చేసిన వెర్షన్‌కు మార్చబడింది
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	అది పని చేయలేదు: అంతర్గత లోపం దాన్ని ఆపివేసింది ({m}). మీ పత్రాలు మారలేదు.
+	Nothing to undo	రద్దు చేయడానికి ఏమీ లేదు
+	Nothing to redo	మళ్లీ చేయడానికి ఏమీ లేదు
+	This document has no form fields you can fill in	ఈ పత్రంలో మీరు నింపగలిగే ఫారం ఫీల్డ్‌లు లేవు
+	This document has no comments to flatten	ఈ పత్రంలో ఫ్లాటెన్ చేయడానికి వ్యాఖ్యలు లేవు
+	This document has no form fields to flatten	ఈ పత్రంలో ఫ్లాటెన్ చేయడానికి ఫారం ఫీల్డ్‌లు లేవు
+	There are no redaction marks (mark text, areas or pages first)	రెడాక్షన్ గుర్తులు ఏవీ లేవు (ముందుగా టెక్స్ట్, ప్రాంతాలు లేదా పేజీలను గుర్తించండి)
+	This document has no {kind} to change	ఈ పత్రంలో మార్చడానికి {kind} లేదు
+	header or footer	హెడర్ లేదా ఫుటర్
+	watermark	వాటర్‌మార్క్
+	background	నేపథ్యం
+	This document isn't password-protected	ఈ పత్రం పాస్‌వర్డ్‌తో రక్షించబడలేదు
+	Only the document's owner can change its security (open it with the permissions password)	పత్రం యజమాని మాత్రమే దాని భద్రతను మార్చగలరు (అనుమతుల పాస్‌వర్డ్‌తో దాన్ని తెరవండి)
+	The document's security settings don't allow this change	పత్రం భద్రతా సెట్టింగ్‌లు ఈ మార్పును అనుమతించవు
+	Open a document first	ముందుగా ఒక పత్రాన్ని తెరవండి
+	Security will be removed when you save	మీరు సేవ్ చేసినప్పుడు భద్రత తీసివేయబడుతుంది
+	Click text or an image to edit it	సవరించడానికి టెక్స్ట్ లేదా చిత్రంపై క్లిక్ చేయండి
+	Drag a rectangle to create a link; double-click a link to edit it	లింక్‌ను సృష్టించడానికి దీర్ఘచతురస్రాన్ని లాగండి; లింక్‌ను సవరించడానికి దానిపై డబుల్-క్లిక్ చేయండి
+	There are no redaction marks to apply	వర్తింపజేయడానికి రెడాక్షన్ గుర్తులు ఏవీ లేవు
+	Drag to draw the area where the signature should appear.	సంతకం కనిపించాల్సిన ప్రాంతాన్ని గీయడానికి లాగండి.
+	Couldn't fit the visible content: {e}	కనిపించే కంటెంట్‌కు సరిపోయేలా చేయడం సాధ్యం కాలేదు: {e}
+	Drag a rectangle around the area to copy	కాపీ చేయాల్సిన ప్రాంతం చుట్టూ దీర్ఘచతురస్రాన్ని లాగండి
+	Click on the page to add a {tool}, or drag to set its size	{tool} జోడించడానికి పేజీపై క్లిక్ చేయండి, లేదా దాని పరిమాణాన్ని సెట్ చేయడానికి లాగండి
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	పేజీని క్రాప్ చేయడానికి దానిపై దీర్ఘచతురస్రాన్ని లాగండి; పేజీ బాక్స్‌లను సెట్ చేయడానికి పేజీపై డబుల్-క్లిక్ చేయండి
+	Keep tool selected: on	సాధనాన్ని ఎంపికలోనే ఉంచు: ఆన్
+	Keep tool selected	సాధనాన్ని ఎంపికలోనే ఉంచు
+	Opacity	అపారదర్శకత
+	Line thickness	గీత మందం
+	What word or phrase would you like to search for?	మీరు ఏ పదం లేదా పదబంధం కోసం వెతకాలనుకుంటున్నారు?
+	Searching… {s} of {p} pages	వెతుకుతోంది… {p} పేజీలలో {s}
+	 (searching… {s} of {p} pages)	 (వెతుకుతోంది… {p} పేజీలలో {s})
+	1 instance	1 ఫలితం
+	{n} instances	{n} ఫలితాలు
+	Go to this result	ఈ ఫలితానికి వెళ్లు
+	Highlight	హైలైట్
+	Draw	గీయి
+	Polygon	పాలీగాన్
+	Connected lines	కలిపిన గీతలు
+	Eraser	ఎరేజర్
+	Sign	సంతకం చేయి
+	Certified by {by}	{by} ద్వారా సర్టిఫై చేయబడింది
+	At least one signature is invalid.	కనీసం ఒక సంతకం చెల్లదు.
+	Signed and all signatures are valid.	సంతకం చేయబడింది, అన్ని సంతకాలు చెల్లుబాటు అవుతాయి.
+	At least one signature has problems.	కనీసం ఒక సంతకంలో సమస్యలు ఉన్నాయి.
+	This document is secured. Some changes are restricted by its security settings.	ఈ పత్రం రక్షించబడింది. దీని భద్రతా సెట్టింగ్‌లు కొన్ని మార్పులను పరిమితం చేస్తాయి.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	ఇది డైనమిక్ XFA ఫారం, దీన్ని ప్రదర్శించడానికి PdfCraftలో ఇంకా మద్దతు లేదు. మీరు చూస్తున్నది ఫైల్‌లోని ప్లేస్‌హోల్డర్ పేజీ.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	ఈ ఫారంలో XFA డేటా కూడా ఉంది, దాన్ని చదవడానికి PdfCraftలో ఇంకా మద్దతు లేదు. మీరు దీని ఫీల్డ్‌లను నింపవచ్చు, కానీ Acrobat బదులుగా XFA విలువలను చూపించవచ్చు.
+	This document contains {n} interactive form fields.	ఈ పత్రంలో {n} ఇంటరాక్టివ్ ఫారం ఫీల్డ్‌లు ఉన్నాయి.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	ఈ ఫైల్ పాడైంది, దాన్ని సరిచేయడం జరిగింది. సేవ్ చేస్తే సరిచేసిన వెర్షన్ ఉంచబడుతుంది.
+	Dismiss	మూసివేయి
+	Hide field highlights	ఫీల్డ్ హైలైట్‌లను దాచు
+	Highlight fields	ఫీల్డ్‌లను హైలైట్ చేయి
+	Security settings	భద్రతా సెట్టింగ్‌లు
+	Details	వివరాలు
+	Select (V)	ఎంచుకో (V)
+	Hand (H)	హ్యాండ్ సాధనం (H)
+	Delete pages (Delete)	పేజీలను తొలగించు (Delete)
+	Insert a blank page after the selection	ఎంపిక తర్వాత ఖాళీ పేజీని చొప్పించు
+	Insert pages from a file…	ఫైల్ నుండి పేజీలను చొప్పించు…
+	Extract pages to a new document	పేజీలను కొత్త పత్రంలోకి వేరు తీయి
+	Split into files…	ఫైల్‌లుగా విభజించు…
+	Select pages	పేజీలను ఎంచుకో
+	Cut	కత్తిరించు
+	Copy	కాపీ చేయి
+	Paste after	ఎంపిక తర్వాత అతికించు
+	Rename	పేరు మార్చు
+	Set to current page ({n})	ప్రస్తుత పేజీకి సెట్ చేయి ({n})
+	Move up	పైకి తరలించు
+	Move down	కిందికి తరలించు
+	Indent	లోపలికి జరుపు
+	Outdent	బయటికి జరుపు
+	This document has no form fields.	ఈ పత్రంలో ఫారం ఫీల్డ్‌లు లేవు.
+	Tab order: move a field with its arrows.	ట్యాబ్ క్రమం: ఫీల్డ్‌ను దాని బాణాలతో తరలించండి.
+	Unplaced	ఏ పేజీలోనూ లేనివి
+	Has JavaScript actions (run in M6)	JavaScript చర్యలు ఉన్నాయి (M6లో అమలవుతాయి)
+	Page	పేజీ
+	None	ఏదీ లేదు
+	Delete selected fields	ఎంచుకున్న ఫీల్డ్‌లను తొలగించు
+	Diagnostic details	డయాగ్నస్టిక్ వివరాలు
+	The operation failed.	చర్య విఫలమైంది.
+	no such document	అటువంటి పత్రం లేదు
+	nothing to undo	రద్దు చేయడానికి ఏమీ లేదు
+	nothing to redo	మళ్లీ చేయడానికి ఏమీ లేదు
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	ఈ పత్రంపై సంతకం చేయబడింది: దీన్ని పూర్తిగా మళ్లీ రాస్తే దాని సంతకాలు చెల్లకుండా పోతాయి (బదులుగా దీన్ని ఇంక్రిమెంటల్‌గా సేవ్ చేయండి)
+	the document is protected by a password	పత్రం పాస్‌వర్డ్‌తో రక్షించబడింది
+	the password is incorrect	పాస్‌వర్డ్ తప్పు
+	the document has no page tree	పత్రంలో పేజీ ట్రీ లేదు
+	a document must keep at least one page	పత్రంలో కనీసం ఒక పేజీ ఉండాలి
+	a bookmark cannot be moved inside itself	బుక్‌మార్క్‌ను దాని లోపలికే తరలించడం సాధ్యం కాదు
+	the title must not be empty	శీర్షిక ఖాళీగా ఉండకూడదు
+	the document has no form fields	పత్రంలో ఫారం ఫీల్డ్‌లు లేవు
+	there are no redaction marks to apply	వర్తింపజేయడానికి రెడాక్షన్ గుర్తులు ఏవీ లేవు
+	there are no pages to print	ముద్రించడానికి పేజీలు ఏవీ లేవు
+	the document has no tags	పత్రంలో ట్యాగ్‌లు లేవు
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	టెక్స్ట్ గుర్తింపు మోడల్‌లు ఇన్‌స్టాల్ చేయబడలేదు (`cargo xtask models` అమలు చేయండి, లేదా PRINTCRAFT_MODELS సెట్ చేయండి)
+	the image is empty	చిత్రం ఖాళీగా ఉంది
+	this file isn't XFDF, FDF, XML or text form data	ఈ ఫైల్ XFDF, FDF, XML లేదా టెక్స్ట్ ఫారం డేటా కాదు
+	nothing in the file matches this document	ఫైల్‌లోని ఏదీ ఈ పత్రంతో సరిపోలడం లేదు
+	This page couldn't be displayed.\n{e}	ఈ పేజీని ప్రదర్శించడం సాధ్యం కాలేదు.\n{e}
+	Go to page {p}	పేజీ {p}కి వెళ్లు
+	{s} action	{s} చర్య
+	Page {p} of {n}	{n}లో {p}వ పేజీ
+	1 page selected	1 పేజీ ఎంచుకోబడింది
+	{n} pages selected	{n} పేజీలు ఎంచుకోబడ్డాయి
+	{name} — unsaved changes	{name} — సేవ్ చేయని మార్పులు
+	{kind} field	{kind} ఫీల్డ్
+	Select a file for the stamp	స్టాంప్ కోసం ఒక ఫైల్‌ను ఎంచుకోండి
+	JavaScript, e.g. getField("total").value	JavaScript, ఉదా. getField("total").value
+	Font: Helvetica	ఫాంట్: Helvetica
+	e.g. en-US	ఉదా. en-US
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	రెండరింగ్: hayro (తాత్కాలికంగా) · UI: egui · ఐకాన్‌లు: Lucide (ISC) · ఫాంట్‌లు: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	చెక్ బాక్స్
+	Radio	రేడియో బటన్
+	PushButton	పుష్ బటన్
+	Combo	డ్రాప్‌డౌన్
+	List	లిస్ట్ బాక్స్
+	Unknown	తెలియని
+	The document has no XMP metadata	పత్రంలో XMP మెటాడేటా లేదు
+	The title in the metadata and the document information differ	మెటాడేటాలోని శీర్షిక, పత్రం సమాచారంలోని శీర్షిక వేర్వేరుగా ఉన్నాయి
+	The document is encrypted	పత్రం ఎన్‌క్రిప్ట్ చేయబడింది
+	Device colour is used, but there is no PDF/A output intent	పరికరంపై ఆధారపడే రంగు ఉపయోగించబడింది, కానీ PDF/A అవుట్‌పుట్ ఇంటెంట్ లేదు
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	DeviceCMYK ఉపయోగించబడింది: దీనికి CMYK అవుట్‌పుట్ ఇంటెంట్ అవసరం (ఇది స్వయంచాలకంగా జోడించబడదు)
+	The document has additional actions (/AA)	పత్రంలో అదనపు చర్యలు (/AA) ఉన్నాయి
+	The document has document-level JavaScript	పత్రంలో పత్రం స్థాయి JavaScript ఉంది
+	The form asks viewers to make appearances (NeedAppearances)	ఫీల్డ్ రూపాలను సృష్టించమని ఫారం వ్యూయర్ యాప్‌లను అడుగుతోంది (NeedAppearances)
+	A form field has additional actions	ఒక ఫారం ఫీల్డ్‌కు అదనపు చర్యలు ఉన్నాయి
+	A stream uses LZW compression	ఒక స్ట్రీమ్ LZW కుదింపును ఉపయోగిస్తోంది
+	A stream refers to an external file	ఒక స్ట్రీమ్ బయటి ఫైల్‌ను సూచిస్తోంది
+	An image asks to be interpolated	ఒక చిత్రం ఇంటర్‌పోలేట్ చేయమని కోరుతోంది
+	An image has alternates or OPI information	ఒక చిత్రానికి ప్రత్యామ్నాయ చిత్రాలు లేదా OPI సమాచారం ఉంది
+	PostScript XObjects aren't allowed	PostScript XObjectలు అనుమతించబడవు
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	పొందుపరిచిన ఫైల్‌లు కూడా PDF/A ఫైల్‌లే అయి ఉండాలి (ఇతర ఫైల్‌ల కోసం PDF/A-3 ఉపయోగించండి)
+	An embedded file has no AFRelationship	ఒక పొందుపరిచిన ఫైల్‌కు AFRelationship లేదు
+	Select Icon	ఐకాన్‌ను ఎంచుకోండి
+	Choose images	చిత్రాలను ఎంచుకోండి
+	{dpi} pixels/inch	{dpi} పిక్సెల్‌లు/అంగుళం
+	Type your {what}.	మీ {what} టైప్ చేయండి.
+	Draw your {what} below.	కింద మీ {what} గీయండి.
+	Your name	మీ పేరు
+	Images and text (converted to PDF)	చిత్రాలు, టెక్స్ట్ (PDFగా మార్చబడతాయి)
+	Images and text	చిత్రాలు, టెక్స్ట్
+	Check Box Style:	చెక్ బాక్స్ శైలి:
+	Button Style:	బటన్ శైలి:
+	Check	టిక్ గుర్తు
+	Circle	వృత్తం
+	Diamond	వజ్రాకారం
+	Square	చతురస్రం
+	Star	నక్షత్రం
+	{month} {y}	{month} {y}
+	Change {key}	{key} మార్చు
+	Insert pages from {name}	{name} నుండి పేజీలను చొప్పించు
+	Fill in {name}	{name}ను నింపు
+	Set the image of {name}	{name} చిత్రాన్ని సెట్ చేయి
+	Edit script of {name}	{name} స్క్రిప్ట్‌ను సవరించు
+	Import {name}	{name}ను దిగుమతి చేయి
+	Add bookmark	బుక్‌మార్క్ జోడించు
+	Rename bookmark	బుక్‌మార్క్ పేరు మార్చు
+	Delete bookmark	బుక్‌మార్క్‌ను తొలగించు
+	Move bookmark	బుక్‌మార్క్‌ను తరలించు
+	Set bookmark destination	బుక్‌మార్క్ గమ్యాన్ని సెట్ చేయి
+	Add stamp	స్టాంప్ జోడించు
+	Delete comment	వ్యాఖ్యను తొలగించు
+	Edit comment	వ్యాఖ్యను సవరించు
+	Erase	చెరిపివేయి
+	Lock comment	వ్యాఖ్యను లాక్ చేయి
+	Unlock comment	వ్యాఖ్యను అన్‌లాక్ చేయి
+	Move comment	వ్యాఖ్యను తరలించు
+	Resize comment	వ్యాఖ్య పరిమాణం మార్చు
+	Change comment properties	వ్యాఖ్య లక్షణాలను మార్చు
+	Add field	ఫీల్డ్ జోడించు
+	Change field properties	ఫీల్డ్ లక్షణాలను మార్చు
+	Delete field	ఫీల్డ్‌ను తొలగించు
+	Duplicate field	ఫీల్డ్‌ను నకలు చేయి
+	Set tab order	ట్యాబ్ క్రమాన్ని సెట్ చేయి
+	Change initial view	ప్రారంభ వీక్షణను మార్చు
+	Set alternate text	ప్రత్యామ్నాయ టెక్స్ట్‌ను సెట్ చేయి
+	Mark figure as decorative	చిత్రాన్ని అలంకరణగా గుర్తించు
+	Run JavaScript	JavaScript అమలు చేయి
+	Delete document JavaScript	పత్రం స్థాయి JavaScriptను తొలగించు
+	Edit document JavaScript	పత్రం స్థాయి JavaScriptను సవరించు
+	Edit text	టెక్స్ట్‌ను సవరించు
+	Move image	చిత్రాన్ని తరలించు
+	Rotate image	చిత్రాన్ని తిప్పు
+	Flip image	చిత్రాన్ని తిరగేయి
+	Delete image	చిత్రాన్ని తొలగించు
+	Add header & footer	హెడర్ & ఫుటర్ జోడించు
+	Update header & footer	హెడర్ & ఫుటర్‌ను అప్‌డేట్ చేయి
+	Update watermark	వాటర్‌మార్క్‌ను అప్‌డేట్ చేయి
+	Add background	నేపథ్యం జోడించు
+	Update background	నేపథ్యాన్ని అప్‌డేట్ చేయి
+	Add image	చిత్రం జోడించు
+	Edit content	కంటెంట్‌ను సవరించు
+	Delete content	కంటెంట్‌ను తొలగించు
+	Remove redaction marks	రెడాక్షన్ గుర్తులను తీసివేయి
+	Add link	లింక్ జోడించు
+	Change link properties	లింక్ లక్షణాలను మార్చు
+	Delete link	లింక్‌ను తొలగించు
+	Create link	లింక్ సృష్టించు
+	Flatten	ఫ్లాటెన్ చేయి
+	Add sticky note	స్టిక్కీ నోట్ జోడించు
+	Add highlight	హైలైట్ జోడించు
+	Add underline	అండర్‌లైన్ జోడించు
+	Add strikethrough	కొట్టివేత జోడించు
+	Add squiggly underline	స్క్విగ్లీ అండర్‌లైన్ జోడించు
+	Add rectangle	దీర్ఘచతురస్రం జోడించు
+	Add oval	అండాకారం జోడించు
+	Add arrow	బాణం జోడించు
+	Add line	గీత జోడించు
+	Add drawing	డ్రాయింగ్ జోడించు
+	Add text box	టెక్స్ట్ బాక్స్ జోడించు
+	Add checkmark	టిక్ గుర్తు జోడించు
+	Add cross	క్రాస్ గుర్తు జోడించు
+	Add dot	చుక్క జోడించు
+	Add signature	సంతకం జోడించు
+	Add redaction mark	రెడాక్షన్ గుర్తు జోడించు
+	Add cloud	క్లౌడ్ జోడించు
+	Add polygon	పాలీగాన్ జోడించు
+	Add connected lines	కలిపిన గీతలు జోడించు
+	Add callout	కాల్‌అవుట్ జోడించు
+	Add inserted text	చొప్పించిన టెక్స్ట్ జోడించు
+	Add file attachment	ఫైల్ జోడింపు జోడించు
+	Set status Accepted	స్థితిని సెట్ చేయి: ఆమోదించబడింది
+	Set status Rejected	స్థితిని సెట్ చేయి: తిరస్కరించబడింది
+	Set status Cancelled	స్థితిని సెట్ చేయి: రద్దు చేయబడింది
+	Set status Completed	స్థితిని సెట్ చేయి: పూర్తయింది
+	Set status None	స్థితిని సెట్ చేయి: ఏదీ లేదు
+	Set status Unmarked	స్థితిని సెట్ చేయి: గుర్తు లేదు
+	Save as PDF/A-1b	PDF/A-1bగా సేవ్ చేయి
+	Save as PDF/A-2b	PDF/A-2bగా సేవ్ చేయి
+	Save as PDF/A-3b	PDF/A-3bగా సేవ్ చేయి
+	Fill & Sign: change signature	నింపడం & సంతకం: సంతకాన్ని మార్చు
+	Fill & Sign: change initials	నింపడం & సంతకం: పొడి అక్షరాలను మార్చు
+	Fill & Sign: remove saved signature	నింపడం & సంతకం: సేవ్ చేసిన సంతకాన్ని తీసివేయి
+	Fill & Sign: remove saved initials	నింపడం & సంతకం: సేవ్ చేసిన పొడి అక్షరాలను తీసివేయి
+	Change signature	సంతకాన్ని మార్చు
+	Change initials	పొడి అక్షరాలను మార్చు
+	Measure distance	దూరాన్ని కొలుచు
+	Measure perimeter	చుట్టుకొలతను కొలుచు
+	Measure area	వైశాల్యాన్ని కొలుచు
+	Set measurement scale	కొలత స్కేల్‌ను సెట్ చేయి
+	Measurement information	కొలత సమాచారం
+	Measurement snapping	కొలత స్నాపింగ్
+	Export measurements as CSV	కొలతలను CSVగా ఎగుమతి చేయి
+	Distance	దూరం
+	Perimeter	చుట్టుకొలత
+	Area	వైశాల్యం
+	Drawing scale	డ్రాయింగ్ స్కేల్
+	Snapping	స్నాపింగ్
+	Export measurements	కొలతలను ఎగుమతి చేయి
+	Open a PDF to measure it.	కొలవడానికి ఒక PDFను తెరవండి.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	శీర్షాలను క్లిక్ చేయండి. Enter నొక్కితే లేదా డబుల్-క్లిక్ చేస్తే చుట్టుకొలత లేదా వైశాల్యం పూర్తవుతుంది. వైశాల్యాన్ని మూసివేయడానికి మొదటి బిందువును క్లిక్ చేయండి.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift నొక్కితే కోణం 45 డిగ్రీలకు పరిమితమవుతుంది. Backspace ఒక శీర్షాన్ని తీసివేస్తుంది. Escape రద్దు చేస్తుంది.
+	Angle	కోణం
+	Click the first point to begin.	ప్రారంభించడానికి మొదటి బిందువును క్లిక్ చేయండి.
+	Snap to drawing	డ్రాయింగ్‌కు స్నాప్ చేయి
+	Endpoints	అంత్య బిందువులు
+	Midpoints	మధ్య బిందువులు
+	Intersections	ఖండన బిందువులు
+	Paths	పాత్‌లు
+	Sensitivity	సున్నితత్వం
+	Unit	యూనిట్
+	Decimals	దశాంశ స్థానాలు
+	Calibrate from two points	రెండు బిందువుల నుండి క్యాలిబ్రేట్ చేయి
+	Entire page	మొత్తం పేజీ
+	Viewport rectangle in page points (x, y, width, height)	పేజీ పాయింట్‌లలో వ్యూపోర్ట్ దీర్ఘచతురస్రం (x, y, వెడల్పు, ఎత్తు)
+	Viewport	వ్యూపోర్ట్
+	Apply scale	స్కేల్ వర్తింపజేయి
+	Saved measurements	సేవ్ చేసిన కొలతలు
+	Saved measurements.	కొలతలు సేవ్ చేయబడ్డాయి.
+	Endpoint	అంత్య బిందువు
+	Midpoint	మధ్య బిందువు
+	Intersection	ఖండన బిందువు
+	Path	పాత్
+	This drawing exceeds the snapping limit; only the first paths are used.	ఈ డ్రాయింగ్ స్నాపింగ్ పరిమితిని మించిపోయింది; మొదటి పాత్‌లు మాత్రమే ఉపయోగించబడతాయి.
+	Some page content couldn't be read; snapping uses the rest.	కొంత పేజీ కంటెంట్‌ను చదవడం సాధ్యం కాలేదు; మిగిలిన దానితో స్నాపింగ్ పనిచేస్తుంది.
+	Unsupported measurements	మద్దతు లేని కొలతలు
+	Label	లేబుల్
+	{n} measurements use an unsupported format and are left out.	{n} కొలతలు మద్దతు లేని ఫార్మాట్‌లో ఉన్నందున వదిలివేయబడ్డాయి.
+	This area has too many overlapping paths; intersection snapping is limited.	ఈ ప్రాంతంలో ఒకదానిపై ఒకటి ఉన్న పాత్‌లు చాలా ఎక్కువగా ఉన్నాయి; ఖండన స్నాపింగ్ పరిమితంగా ఉంటుంది.
+	This measurement needs at least {n} points.	ఈ కొలతకు కనీసం {n} బిందువులు అవసరం.
+	Change {what}	{what} మార్చు
+	Cut and stack	కత్తిరించి పేర్చడం
+	Default workspace mode	డిఫాల్ట్ వర్క్‌స్పేస్ మోడ్
+	Documents and view	పత్రాలు, వీక్షణ
+	Open email app	ఇమెయిల్ యాప్‌ను తెరువు
+	Open link	లింక్‌ను తెరువు
+	Open this web page?	ఈ వెబ్ పేజీని తెరవాలా?
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	స్క్రిప్ట్‌లు ఫైల్ లేదా నెట్‌వర్క్ యాక్సెస్ లేని శాండ్‌బాక్స్‌లో అమలవుతాయి. వెబ్ పేజీని తెరవమని అడిగే స్క్రిప్ట్‌కు ముందుగా మీ అనుమతి అవసరం. JavaScript ఆఫ్‌లో ఉన్నా, Acrobat ప్రామాణిక ఫార్మాట్, ధృవీకరణ, గణన ఫంక్షన్‌లు పని చేస్తూనే ఉంటాయి.
+	Sign yourself	స్వయంగా సంతకం చేయడం
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	టెక్స్ట్ గుర్తింపు ఇన్‌స్టాల్ కాలేదు: దాని మోడల్‌లు లేవు (`cargo xtask models` అమలు చేయండి, లేదా PDFCRAFT_MODELS సెట్ చేయండి).
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	PDFలను తెరిచేటప్పుడు ఉపయోగించబడుతుంది. ప్రారంభించేటప్పుడు లేదా కంట్రోల్ ద్వారా స్పష్టంగా ఇచ్చిన మోడ్‌కు ఆ సెషన్‌లో ప్రాధాన్యత ఉంటుంది.
+	Write this email?	ఈ ఇమెయిల్ రాయాలా?
+	{who} in this document wants to open this address in your browser:	ఈ పత్రంలోని {who} ఈ చిరునామాను మీ బ్రౌజర్‌లో తెరవాలనుకుంటోంది:
+	{who} in this document wants to open your email app with this address:	ఈ పత్రంలోని {who} ఈ చిరునామాతో మీ ఇమెయిల్ యాప్‌ను తెరవాలనుకుంటోంది:
+	Create PDF from images	చిత్రాల నుండి PDF సృష్టించు
+	Selected image files: {count}	ఎంచుకున్న చిత్ర ఫైల్‌లు: {count}
+	Use image resolution	చిత్రం రిజల్యూషన్‌ను ఉపయోగించు
+	Use each image's embedded DPI; use 72 DPI when it is absent.	ప్రతి చిత్రంలో పొందుపరిచిన DPI ఉపయోగించబడుతుంది; అది లేనప్పుడు 72 DPI ఉపయోగించబడుతుంది.
+	Use 72 DPI (one point per pixel)	72 DPI ఉపయోగించు (ఒక్కో పిక్సెల్‌కు ఒక పాయింట్)
+	Use custom DPI	అనుకూల DPI ఉపయోగించు
+	DPI sets the printed page size without resampling the image.	DPI చిత్రాన్ని రీసాంపుల్ చేయకుండా ముద్రిత పేజీ పరిమాణాన్ని నిర్ణయిస్తుంది.
+	Create	సృష్టించు
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	దాని టెంప్లేట్ నుండి అమర్చబడిన డైనమిక్ XFA ఫారం: {pages}, {fields}.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA ఫారం: దీని ఫీల్డ్‌లు, XFA డేటా ఎప్పుడూ ఒకేలా ఉంచబడతాయి, కాబట్టి మీరు నింపినది ఇతర వ్యూయర్‌లలో కూడా కనిపిస్తుంది.
+@plural	{n} page|{n} pages	{n} పేజీ|{n} పేజీలు
+@plural	{n} field|{n} fields	{n} ఫీల్డ్|{n} ఫీల్డ్‌లు
+	Switch to two-page view first to show the cover page	కవర్ పేజీని చూపించడానికి ముందుగా రెండు పేజీల వీక్షణకు మారండి
+	Page display: {layout}	పేజీ ప్రదర్శన: {layout}
+	Fit to width scrolling	వెడల్పుకు సరిపోయేలా స్క్రోలింగ్
+	Fit one full page	ఒక పూర్తి పేజీ సరిపోయేలా
+	Default page display	డిఫాల్ట్ పేజీ ప్రదర్శన
+	Default zoom	డిఫాల్ట్ జూమ్
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF ఏ లేఅవుట్‌ను గానీ జూమ్‌ను గానీ కోరనప్పుడు ఉపయోగించబడుతుంది. నిరంతర స్క్రోలింగ్ పేజీల మధ్య ఎప్పుడూ స్నాప్ అవ్వదు.
+	About	పరిచయం
+	Contributors	సహకారులు
+	Models	మోడల్‌లు
+	Show	చూపించు
+	Username	వినియోగదారు పేరు
+	Display name	ప్రదర్శించే పేరు
+	Real name	అసలు పేరు
+	Sort	క్రమపరిచే విధానం
+	Name (A–Z)	పేరు (A–Z)
+	Merged PRs	విలీనం చేసిన PRలు
+	PRs	PRలు
+	Commits	కమిట్‌లు
+	Lines added	జోడించిన పంక్తులు
+	Lines deleted	తొలగించిన పంక్తులు
+	Line delta	పంక్తుల నికర మార్పు
+	Binary assets added	జోడించిన బైనరీ ఫైల్‌లు
+	Binary assets removed	తీసివేసిన బైనరీ ఫైల్‌లు
+	First commit	మొదటి కమిట్
+	Last commit	చివరి కమిట్
+	+LOC	+పంక్తులు
+	−LOC	−పంక్తులు
+	ΔLOC	Δపంక్తులు
+	+Bin	+బైనరీ
+	−Bin	−బైనరీ
+	First	మొదటి
+	Last	చివరి
+	Reverse the order	వ్యతిరేక క్రమానికి మార్చు
+	Grab bag	జాబితా
+	Table	పట్టిక
+	{n} contributors · {c} commits	సహకారులు: {n} · కమిట్‌లు: {c}
+	No contributor data was built into this copy.	ఈ కాపీలో సహకారుల డేటా ఏదీ చేర్చబడలేదు.
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: PRలు {prs}, కమిట్‌లు {commits}, పంక్తులు +{added} / −{deleted} (Δ {delta}), బైనరీ ఫైల్‌లు +{bin_added} / −{bin_deleted}, {first} – {last}
+	No model credits were built into this copy.	ఈ కాపీలో మోడల్‌ల సహకార వివరాలు ఏవీ చేర్చబడలేదు.
+	Company	సంస్థ
+	Model	మోడల్
+	% of all commits	మొత్తం కమిట్‌లలో %
+	Lines +/−	పంక్తులు +/−
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	ఈ పత్రాన్ని మీరు విశ్వసిస్తేనే కొనసాగించండి. ఒక చిరునామా పత్రంలోని సమాచారాన్ని, ఉదాహరణకు దాని ఫారంలో మీరు టైప్ చేసినదాన్ని, తనతో పాటు తీసుకెళ్లగలదు.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	ఒక వైపు మాత్రమే ముద్రించండి. షీట్‌ల క్రమం మారకుండా ఉంచి, గుర్తుల వద్ద కత్తిరించండి, ఆపై కుప్పలను ఎడమ నుండి కుడికి, పై నుండి కిందికి ఒకదానిపై ఒకటి పేర్చండి.
+	Windows store  ·  	Windows స్టోర్  ·  
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	కీ Windows సర్టిఫికెట్ స్టోర్‌లో ఉంది; దాన్ని ఉపయోగించడానికి PdfCraftను అనుమతించమని Windows అడగవచ్చు.
+	Selected pages	ఎంచుకున్న పేజీలు
+	Set layer visibility	లేయర్‌లను చూపించు లేదా దాచు
+	Files are combined from top to bottom. Leave Pages empty to take every page.	ఫైల్‌లు పై నుండి కిందికి కలపబడతాయి. అన్ని పేజీలను తీసుకోవడానికి పేజీలు ఫీల్డ్‌ను ఖాళీగా వదలండి.
+	Unlock…	అన్‌లాక్ చేయి…
+	Select a password-protected file first	ముందుగా పాస్‌వర్డ్‌తో రక్షించిన ఫైల్‌ను ఎంచుకోండి
+	Enter the permissions password to allow combining	కలపడాన్ని అనుమతించడానికి అనుమతుల పాస్‌వర్డ్‌ను నమోదు చేయండి
+	Enter the password that opens it	దీన్ని తెరిచే పాస్‌వర్డ్‌ను నమోదు చేయండి
+	Unlock {name}	{name}ను అన్‌లాక్ చేయి
+	Unlock {n} files	{n} ఫైల్‌లను అన్‌లాక్ చేయి
+	The same password is tried on each file.	ప్రతి ఫైల్‌పై ఒకే పాస్‌వర్డ్ ప్రయత్నించబడుతుంది.
+	Hide password	పాస్‌వర్డ్‌ను దాచు
+	Show password	పాస్‌వర్డ్‌ను చూపించు
+	Wrong password	పాస్‌వర్డ్ తప్పు
+	The password is only used to read the file; it isn't saved.	పాస్‌వర్డ్ ఫైల్‌ను చదవడానికి మాత్రమే ఉపయోగించబడుతుంది; అది సేవ్ చేయబడదు.
+	Unlock	అన్‌లాక్ చేయి
+	Opened, but its security settings don't allow combining. Enter the permissions password.	తెరవబడింది, కానీ దీని భద్రతా సెట్టింగ్‌లు కలపడాన్ని అనుమతించవు. అనుమతుల పాస్‌వర్డ్‌ను నమోదు చేయండి.
+	Unlocked: the combined file won't be password-protected	అన్‌లాక్ చేయబడింది: కలిపిన ఫైల్ పాస్‌వర్డ్‌తో రక్షించబడదు
+	Unlocked {n} of {m} files	{m} ఫైల్‌లలో అన్‌లాక్ చేయబడినవి: {n}
+	Drop PDFs or folders here, or choose them.	PDFలను లేదా ఫోల్డర్‌లను ఇక్కడ లాగి వదలండి, లేదా వాటిని ఎంచుకోండి.
+	Add folder…	ఫోల్డర్‌ను జోడించు…
+	Add folder and subfolders…	ఫోల్డర్‌ను, దాని ఉప ఫోల్డర్‌లను జోడించు…
+	More ways to add files	ఫైల్‌లను జోడించడానికి మరిన్ని మార్గాలు
+	Every PDF in the folder	ఫోల్డర్‌లోని ప్రతి PDF
+	Every PDF in the folder and the folders inside it	ఫోల్డర్‌లోని, దాని లోపలి ఫోల్డర్‌లలోని ప్రతి PDF
+	Add folder	ఫోల్డర్‌ను జోడించు
+	Add folder and subfolders	ఫోల్డర్‌ను, దాని ఉప ఫోల్డర్‌లను జోడించు
+	No PDFs found in {folder}	{folder}లో PDFలు ఏవీ కనుగొనబడలేదు
+	Added the first {n} PDFs in {folder}	{folder}లోని మొదటి {n} PDFలు జోడించబడ్డాయి
+	Click to sort, drag to move the column. Drag its edge to resize it.	క్రమపరచడానికి క్లిక్ చేయండి, నిలువు వరుసను తరలించడానికి లాగండి. పరిమాణం మార్చడానికి దాని అంచును లాగండి.
+	Reset columns	నిలువు వరుసలను రీసెట్ చేయి
+	Remove {n} files	{n} ఫైల్‌లను తీసివేయి
+	{n} selected	ఎంచుకున్నవి: {n}
+	sorted ascending	ఆరోహణ క్రమంలో అమర్చబడింది
+	sorted descending	అవరోహణ క్రమంలో అమర్చబడింది
+	Protected: the combined file won't keep its security settings	రక్షించబడింది: కలిపిన ఫైల్‌లో దీని భద్రతా సెట్టింగ్‌లు ఉండవు
+	Add open documents	తెరిచిన పత్రాలను జోడించు
+	All open documents	తెరిచిన అన్ని పత్రాలు
+	No documents are open	పత్రాలు ఏవీ తెరిచి లేవు
+	Select a file first	ముందుగా ఒక ఫైల్‌ను ఎంచుకోండి
+	1 file	1 ఫైల్
+	{n} files	{n} ఫైల్‌లు
+	1 file needs attention	1 ఫైల్‌లో సమస్య ఉంది
+	{n} files need attention	{n} ఫైల్‌లలో సమస్యలు ఉన్నాయి
+	{name} can't be combined: {why}	{name}ను కలపడం సాధ్యం కాదు: {why}
+	Check the pages of {name}: {why}	{name} పేజీలను తనిఖీ చేయండి: {why}
+	Add the PDFs to combine	కలపాల్సిన PDFలను జోడించండి
+	File name	ఫైల్ పేరు
+	Warnings	హెచ్చరికలు
+	Drag to reorder	క్రమం మార్చడానికి లాగండి
+	{k} of {n}	{n}లో {k}
+	? of {n}	{n}లో ?
+	Added more than once	ఒకటి కంటే ఎక్కువసార్లు జోడించబడింది
+	yesterday	నిన్న
+	{n} days ago	{n} రోజుల క్రితం
+	No pages selected	పేజీలు ఏవీ ఎంచుకోబడలేదు
+	Password-protected	పాస్‌వర్డ్‌తో రక్షించబడింది
+	Its security settings don't allow copying pages	దీని భద్రతా సెట్టింగ్‌లు పేజీలను కాపీ చేయడాన్ని అనుమతించవు
+	Can't be read: {e}	చదవడం సాధ్యం కాదు: {e}
+	Includes unsaved changes	సేవ్ చేయని మార్పులు ఉన్నాయి
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	ఈ వెబ్ చిరునామాలో వేర్వేరు లిపుల అక్షరాలు కలిసి ఉన్నాయి. వేరే సైట్ పేరును అనుకరించడానికి ఇది తరచూ వాడే పద్ధతి.
+	This web address uses letters from another alphabet, which can look like familiar ones.	ఈ వెబ్ చిరునామాలో వేరే లిపి అక్షరాలు ఉన్నాయి. అవి మీకు తెలిసిన అక్షరాల్లాగే కనిపించవచ్చు.
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG లేదా JPEG చిత్రాన్ని ఎంచుకోండి (గరిష్ఠంగా 4 MiB). పారదర్శకత అలాగే ఉంటుంది.
+	Couldn't import the signature image: {e}	సంతకం చిత్రాన్ని దిగుమతి చేయడం సాధ్యం కాలేదు: {e}
+	Open Recent	ఇటీవలివి తెరువు
+	No recent files	ఇటీవలి ఫైళ్లు లేవు
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index 30121855..53665e29 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -257,7 +257,7 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     ui.horizontal(|ui| {
         ui.label(tl!("Default workspace mode"));
         for (mode, label) in [
-            (crate::Mode::AllTools, "All Tools"),
+            (crate::Mode::AllTools, "All tools"),
             (crate::Mode::Read, "Read"),
             (crate::Mode::Edit, "Edit"),
             (crate::Mode::Convert, "Convert"),
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index a8c9d795..b8269816 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -14,6 +14,14 @@ macro_rules! tl {
     };
 }
 
+/// [`tl!`] for a label whose meaning depends on where it appears ("Type" is a column and a
+/// button): a catalog can translate it under `context`, otherwise the plain translation is used.
+macro_rules! tl_ctx {
+    ($context:expr, $s:expr) => {
+        $crate::i18n::tr_ctx($crate::i18n::current(), $context, $s)
+    };
+}
+
 mod a11y_ui;
 mod actions_ui;
 pub mod canvas;
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index fabb0b37..5b74b642 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -159,8 +159,8 @@ pub fn installed_font_definitions(prefer_hans: bool) -> FontDefinitions {
 }
 
 /// The interface fonts: Inter (and JetBrains Mono for code) first, then egui's defaults, then
-/// the CJK and Arabic faces of the optional craft-fonts build input as the last fallback in
-/// every family. Without craft-fonts there is no Japanese, Chinese or Arabic face here.
+/// the CJK, Arabic and Telugu faces of the optional craft-fonts build input as the last fallback
+/// in every family. Without craft-fonts there is no Japanese, Chinese, Arabic or Telugu face here.
 pub fn font_definitions() -> FontDefinitions {
     font_definitions_for(false)
 }
@@ -191,8 +191,9 @@ pub fn font_definitions_for(prefer_hans: bool) -> FontDefinitions {
             fonts.families.entry(family).or_default().push(name.clone());
         }
     }
-    // Arabic-script faces (file names, document titles) after the CJK ones; the ranges don't overlap.
-    for face in pdfcraft_fonts::ui_arabic_fonts() {
+    // Arabic-script faces (file names, document titles) and Telugu faces (the Telugu interface,
+    // file names) after the CJK ones; the ranges don't overlap.
+    for face in pdfcraft_fonts::ui_arabic_fonts().into_iter().chain(pdfcraft_fonts::ui_telugu_fonts()) {
         let name = face.name();
         if !fonts.font_data.contains_key(&name) {
             add(&mut fonts, &name, face.bytes);
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index d6e7e2b7..42c78e2a 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -7,6 +7,7 @@ use pdfcraft_ui_egui::theme;
 const JAPANESE: &str = "日本語の文字";
 const CHINESE: &str = "简体中文欢迎";
 const ARABIC: &str = "واحد اثنين";
+const TELUGU: &str = "తెలుగు ఫైల్";
 
 fn families() -> Vec<FontId> {
     vec![FontId::proportional(13.0), FontId::monospace(13.0), theme::medium(13.0), theme::semibold(17.0)]
@@ -95,6 +96,34 @@ fn arabic_ui_text_uses_craft_fonts() {
     }
 }
 
+/// Built with a craft-fonts Telugu face, Telugu text has real glyphs in every family, from a
+/// face placed after the app's own fonts, and is shaped: the conjunct క్ష is narrower than క్
+/// and ష held apart by a zero-width non-joiner.
+#[test]
+fn telugu_ui_text_uses_craft_fonts() {
+    let telugu: Vec<String> = pdfcraft_fonts::CRAFT_FONTS.iter().filter(|f| f.covers("Telu")).map(|f| f.name()).collect();
+    if telugu.is_empty() {
+        eprintln!("skipping telugu_ui_text_uses_craft_fonts: no Telu face bundled (set CRAFT_FONTS_DIR with a Telugu face to run it)");
+        return;
+    }
+    let defs = theme::font_definitions();
+    for family in [FontFamily::Proportional, FontFamily::Monospace] {
+        let stack = &defs.families[&family];
+        let first_te = stack.iter().position(|n| telugu.contains(n)).expect("a Telu face is a fallback");
+        let own = stack.iter().position(|n| n == "Inter" || n == "JetBrainsMono").expect("the app's own font");
+        assert!(own < first_te, "{family:?}: {stack:?}");
+    }
+    let mut fonts = Fonts::new(TextOptions::default(), defs);
+    for id in families() {
+        assert!(fonts.has_glyphs(&id, TELUGU), "{id:?} lacks {TELUGU}");
+    }
+    let joined = layout_widths(&mut fonts, "క్ష");
+    let apart = layout_widths(&mut fonts, "క్\u{200c}ష");
+    for (j, a) in joined.iter().zip(&apart) {
+        assert!(j < a, "క్ష is one conjunct, narrower than క్‌ష: {j} vs {a}");
+    }
+}
+
 /// On a machine with a suitable installed font, the installed definitions end every family
 /// with it and Arabic text has glyphs; the embedded-only definitions never name it.
 #[test]
diff --git a/docs/localization.md b/docs/localization.md
index 582c830a..61e0d4ea 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,8 +1,8 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Čeština**, **Português (Brasil)**, **Español** or **Français**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Čeština**, **Português (Brasil)**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
@@ -10,11 +10,11 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `es`, `fr`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `es` or `fr`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Spanish and French translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Czech, Brazilian Portuguese, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`).
+Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Czech, Brazilian Portuguese, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 
 There is no right-to-left interface language yet. File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
 
@@ -25,7 +25,7 @@ Simplified Chinese and French coverage tests, following PhotoCraft's complete-ca
 PdfCraft uses the same system as PhotoCraft (`crates/ui-egui/src/i18n/`):
 
 - Strings in the code stay in English and serve as lookup keys. At draw time, `tl!("Save")` returns the text in the current language, and falls back to English when there is no entry.
-- Each language has a catalog, `crates/ui-egui/src/i18n/<code>.tsv`, with one entry per line: `context<TAB>English<TAB>translation`. An empty context marks a plain string. `@id` keys an entry by command id (for example `file.saveAs`), so one menu item can read differently from another with the same English label. `@plural` holds plural forms. Any other context disambiguates an English word with several meanings (`tr_ctx`). The header of `ja.tsv` documents the format and escapes.
+- Each language has a catalog, `crates/ui-egui/src/i18n/<code>.tsv`, with one entry per line: `context<TAB>English<TAB>translation`. An empty context marks a plain string. `@id` keys an entry by command id (for example `file.saveAs`), so one menu item can read differently from another with the same English label. `@plural` holds plural forms. Any other context disambiguates an English word with several meanings (`tl_ctx!` in UI code, for example the signature pad's "Type" button against the "Type" column). The header of `ja.tsv` documents the format and escapes.
 - Placeholders (`{name}`) must appear in both columns. A trailing `…` must be kept. `i18n::fmt` fills placeholders in one pass, so a value such as a file name containing `{n}` is inserted as written.
 - Catalogs are validated strictly: unknown escapes, unknown `@` contexts, placeholder or ellipsis mismatches, wrong plural form counts and duplicates are errors. The tests require the bundled catalogs to have none; at run time a bad line is skipped (and logged) and that string shows in English.
 - Catalogs are assets: each `.tsv` has an `ATTRIBUTION.toml` entry with `kind = "translation"` and its SHA-256, checked by `cargo xtask assets`.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 1fe73ce2..fa57670f 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9806,8 +9806,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values"]
-notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/Spanish/French and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|es|fr and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, Spanish and French cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese font delivery, a full localization audit."
+evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs"]
+notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/Spanish/French/Telugu and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|es|fr|te and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, Spanish and French cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"

From 69fa2ea9f848097058549d3762f05f43afae0460 Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Thu, 8 Oct 2026 14:07:00 -0700
Subject: [PATCH 013/149] Platform: one save-staging helper for automation and
 the desktop app (#356)

Follow-up to #319, from review. create_staging, staging_suffixes and
STAGING_ATTEMPTS were copied in pdfcraft-automation and pdfcraft-ui-egui,
which are both L7 and can't depend on each other. They now live once in
the new pdfcraft-platform crate (L7, std only), which layers.rs already
reserved with both sideways edges.

A pure move: the body is unchanged apart from a StagingName parameter
that keeps each caller's existing file name (.{name}.{suffix}.pdfcraft-tmp
for automation, .{name}.pdfcraft-{suffix}.tmp for the desktop save). The
doc comment on staging_suffixes now says the suffix is SipHash keyed from
the OS random source: enough that a name can't be planted in advance, but
not a CSPRNG.

New tests in the platform crate pin both name forms, the 128-byte stem
cut, the 16-name limit and refusal when no suffix is left. The callers'
planted-file, link, folder and failed-rename tests stay where they are.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                     |   6 ++
 Cargo.toml                     |   1 +
 crates/automation/Cargo.toml   |   1 +
 crates/automation/src/lib.rs   |  45 +-----------
 crates/platform/Cargo.toml     |  11 +++
 crates/platform/README.md      |   7 ++
 crates/platform/src/lib.rs     |   6 ++
 crates/platform/src/staging.rs | 129 +++++++++++++++++++++++++++++++++
 crates/ui-egui/Cargo.toml      |   1 +
 crates/ui-egui/src/editing.rs  |  50 +------------
 10 files changed, 170 insertions(+), 87 deletions(-)
 create mode 100644 crates/platform/Cargo.toml
 create mode 100644 crates/platform/README.md
 create mode 100644 crates/platform/src/lib.rs
 create mode 100644 crates/platform/src/staging.rs

diff --git a/Cargo.lock b/Cargo.lock
index e229f2c6..6c6e75c2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3488,6 +3488,7 @@ dependencies = [
  "image",
  "pdfcraft-engine",
  "pdfcraft-organize",
+ "pdfcraft-platform",
  "pdfcraft-render",
  "pdfcraft-xfa",
  "png 0.18.1",
@@ -3703,6 +3704,10 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "pdfcraft-platform"
+version = "0.4.0"
+
 [[package]]
 name = "pdfcraft-preflight"
 version = "0.4.0"
@@ -3792,6 +3797,7 @@ dependencies = [
  "pdfcraft-engine",
  "pdfcraft-fonts",
  "pdfcraft-model",
+ "pdfcraft-platform",
  "pdfcraft-render",
  "pdfcraft-xfa",
  "png 0.18.1",
diff --git a/Cargo.toml b/Cargo.toml
index 8a1c3b65..37f8fe30 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -40,6 +40,7 @@ pdfcraft-forms = { path = "crates/forms", version = "0.4.0" }
 pdfcraft-xfa = { path = "crates/xfa", version = "0.4.0" }
 pdfcraft-render = { path = "crates/render", version = "0.4.0" }
 pdfcraft-engine = { path = "crates/engine", version = "0.4.0" }
+pdfcraft-platform = { path = "crates/platform", version = "0.4.0" }
 pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.4.0" }
 pdfcraft-automation = { path = "crates/automation", version = "0.4.0", default-features = false }
 
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index 556e9da0..7383970b 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -12,6 +12,7 @@ workspace = true
 pdfcraft-engine = { workspace = true }
 pdfcraft-render = { workspace = true }
 pdfcraft-organize = { workspace = true }
+pdfcraft-platform = { workspace = true }
 serde_json = { workspace = true }
 png = "0.18"
 base64 = { version = "0.22", optional = true }
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 35dbadf7..e1219951 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -29,6 +29,7 @@ use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use pdfcraft_engine::{DocId, Document, Edit, Session, commands};
+use pdfcraft_platform::staging::{StagingName, create_staging, staging_suffixes};
 use pdfcraft_render::{PageRenderer, PageText, RenderConfig, RenderRequest, RequestKind};
 use serde_json::{Value, json};
 
@@ -1750,7 +1751,8 @@ fn write_atomic_with(path: &Path, bytes: &[u8], suffixes: impl IntoIterator<Item
     let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or(Path::new("."));
     let name = path.file_name().ok_or_else(|| failed(format!("{}: not a file path", path.display())))?;
     std::fs::create_dir_all(dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-    let (tmp, file) = create_staging(dir, &name.to_string_lossy(), suffixes).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+    let (tmp, file) =
+        create_staging(dir, &name.to_string_lossy(), StagingName::SuffixThenTag, suffixes).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
     // Closed at the end of the block, before the rename.
     let written = {
         let mut file = file;
@@ -1766,49 +1768,10 @@ fn write_atomic_with(path: &Path, bytes: &[u8], suffixes: impl IntoIterator<Item
     })
 }
 
-/// How many staging names [`create_staging`] tries. A random 64-bit name is only taken if someone
-/// put a file there on purpose, so running out means refusing, not trying harder.
-const STAGING_ATTEMPTS: usize = 16;
-
-/// Create a new, empty staging file in `dir` for the file `name`, one name per suffix. It is
-/// opened with `create_new`, which fails if anything already has the name (a file, a hard link,
-/// a symbolic link even when dangling, a folder), on Windows as everywhere else; such a name is
-/// skipped, never opened, so a file planted at the staging path can't receive or redirect the
-/// write.
-fn create_staging(dir: &Path, name: &str, suffixes: impl IntoIterator<Item = u64>) -> std::io::Result<(PathBuf, std::fs::File)> {
-    // At most 128 bytes of the target's name, cut between characters, so the staging name fits
-    // the 255-byte (Linux, macOS) and 255-unit (Windows) limits however long that name is.
-    let mut stem = String::new();
-    for c in name.chars() {
-        if stem.len() + c.len_utf8() > 128 {
-            break;
-        }
-        stem.push(c);
-    }
-    for suffix in suffixes.into_iter().take(STAGING_ATTEMPTS) {
-        let tmp = dir.join(format!(".{stem}.{suffix:016x}.pdfcraft-tmp"));
-        match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
-            Ok(file) => return Ok((tmp, file)),
-            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
-            // Windows reports a folder at the name as "access denied"; it is taken all the same.
-            Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied && tmp.symlink_metadata().is_ok() => {}
-            Err(e) => return Err(e),
-        }
-    }
-    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "every temporary file name tried is taken"))
-}
-
-/// Unpredictable staging-name suffixes, so a name can't be planted in advance. `RandomState` is
-/// keyed from the operating system's random source.
-fn staging_suffixes() -> impl Iterator<Item = u64> {
-    use std::hash::BuildHasher;
-    let state = std::hash::RandomState::new();
-    (0u64..).map(move |i| state.hash_one(i))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
+    use pdfcraft_platform::staging::STAGING_ATTEMPTS;
 
     #[test]
     fn dot_dot_resolves_by_name_and_never_climbs_above_the_start() {
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
new file mode 100644
index 00000000..54e7030a
--- /dev/null
+++ b/crates/platform/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "pdfcraft-platform"
+description = "Operating-system services shared by the PdfCraft desktop app and automation tools"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
diff --git a/crates/platform/README.md b/crates/platform/README.md
new file mode 100644
index 00000000..6b23752b
--- /dev/null
+++ b/crates/platform/README.md
@@ -0,0 +1,7 @@
+# pdfcraft-platform
+
+Layer L7 holds operating-system services that both the desktop app (`pdfcraft-ui-egui`) and the automation tools (`pdfcraft-automation`) need. Those two crates sit on the same layer and can't depend on each other, so a helper they share lives here instead of being copied into each (`xtask/src/layers.rs` allows both edges). It uses only the standard library and has no UI dependencies.
+
+`staging` creates the temporary file an atomic save writes before renaming it over the target. The file is opened with `create_new`, so anything already at the name (a file, a hard link, a symbolic link even when dangling, a folder) is skipped and never written through. On Windows a folder at the name fails with "access denied" rather than "already exists", and is skipped only when something is actually there. Names carry an unpredictable 64-bit suffix from `staging_suffixes` (the standard library's keyed hash, currently SipHash-1-3, keyed from the operating system's random source), which stops a name being planted in advance but is not a CSPRNG; fixed suffixes are only for tests. At most 16 names are tried, and then the save is refused. The target's name is cut to 128 bytes on a character boundary so the staging name fits every system's limit. Each caller keeps its own name form (`.{name}.{suffix}.pdfcraft-tmp` for automation, `.{name}.pdfcraft-{suffix}.tmp` for the desktop save). Writing, closing the file before the rename, renaming and removing the staging file on failure stay with the caller.
+
+Synthetic tests pin both name forms, the 128-byte cut, the attempt limit and refusal when no name is left. The planted-file, link, folder and failed-rename tests stay with each caller, where they exercise the whole save.
diff --git a/crates/platform/src/lib.rs b/crates/platform/src/lib.rs
new file mode 100644
index 00000000..799eb566
--- /dev/null
+++ b/crates/platform/src/lib.rs
@@ -0,0 +1,6 @@
+//! pdfcraft-platform — L7 operating-system services shared by the desktop app (`ui-egui`) and the
+//! automation tools (`automation`), which sit on the same layer and can't depend on each other.
+
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+pub mod staging;
diff --git a/crates/platform/src/staging.rs b/crates/platform/src/staging.rs
new file mode 100644
index 00000000..64172611
--- /dev/null
+++ b/crates/platform/src/staging.rs
@@ -0,0 +1,129 @@
+//! Staging files for atomic saves: a new, unpredictably named file beside the target, written and
+//! then renamed over it. Writing, closing, renaming and cleaning up stay with the caller.
+
+use std::path::{Path, PathBuf};
+
+/// How many staging names [`create_staging`] tries. A random 64-bit name is only taken if someone
+/// put a file there on purpose, so running out means refusing, not trying harder.
+pub const STAGING_ATTEMPTS: usize = 16;
+
+/// Where the suffix goes in a staging name. Each caller keeps the form it has always used.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum StagingName {
+    /// `.{name}.{suffix}.pdfcraft-tmp`, used by the automation tools.
+    SuffixThenTag,
+    /// `.{name}.pdfcraft-{suffix}.tmp`, used by the desktop app's save.
+    TagThenSuffix,
+}
+
+/// Create a new, empty staging file in `dir` for the file `name`, one name per suffix. It is
+/// opened with `create_new`, which fails if anything already has the name (a file, a hard link,
+/// a symbolic link even when dangling, a folder), on Windows as everywhere else; such a name is
+/// skipped, never opened, so a file planted at the staging path can't receive or redirect the
+/// write. Pass [`staging_suffixes`]: fixed suffixes are for tests, and a predictable name can be
+/// taken in advance to refuse every save.
+pub fn create_staging(
+    dir: &Path,
+    name: &str,
+    form: StagingName,
+    suffixes: impl IntoIterator<Item = u64>,
+) -> std::io::Result<(PathBuf, std::fs::File)> {
+    // At most 128 bytes of the target's name, cut between characters, so the staging name fits
+    // the 255-byte (Linux, macOS) and 255-unit (Windows) limits however long that name is.
+    let mut stem = String::new();
+    for c in name.chars() {
+        if stem.len() + c.len_utf8() > 128 {
+            break;
+        }
+        stem.push(c);
+    }
+    for suffix in suffixes.into_iter().take(STAGING_ATTEMPTS) {
+        let tmp = dir.join(match form {
+            StagingName::SuffixThenTag => format!(".{stem}.{suffix:016x}.pdfcraft-tmp"),
+            StagingName::TagThenSuffix => format!(".{stem}.pdfcraft-{suffix:016x}.tmp"),
+        });
+        match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
+            Ok(file) => return Ok((tmp, file)),
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
+            // Windows reports a folder at the name as "access denied"; it is taken all the same.
+            Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied && tmp.symlink_metadata().is_ok() => {}
+            Err(e) => return Err(e),
+        }
+    }
+    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "every temporary file name tried is taken"))
+}
+
+/// Unpredictable staging-name suffixes, so a name can't be planted in advance. Each is the
+/// standard library's keyed hash of a counter (`RandomState::hash_one`, currently SipHash-1-3),
+/// keyed from the operating system's random source. That is all a staging name needs, but it is
+/// not a CSPRNG: don't use these where a value must stay secret or unguessable after it has been
+/// seen, such as a token or a key.
+pub fn staging_suffixes() -> impl Iterator<Item = u64> {
+    use std::hash::BuildHasher;
+    let state = std::hash::RandomState::new();
+    (0u64..).map(move |i| state.hash_one(i))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A fresh, empty folder for one test.
+    fn test_dir(test: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-platform-staging-{}-{test}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    fn file_name(p: &Path) -> String {
+        p.file_name().unwrap().to_string_lossy().into_owned()
+    }
+
+    /// The callers' tests plant files at these exact names; if a name changed, those tests would
+    /// plant where nothing writes and pass without testing anything.
+    #[test]
+    fn each_form_keeps_its_exact_name() {
+        let dir = test_dir("forms");
+        let (tools, _) = create_staging(&dir, "out.pdf", StagingName::SuffixThenTag, [0xab]).unwrap();
+        assert_eq!(file_name(&tools), ".out.pdf.00000000000000ab.pdfcraft-tmp");
+        let (desktop, _) = create_staging(&dir, "out.pdf", StagingName::TagThenSuffix, [0xab]).unwrap();
+        assert_eq!(file_name(&desktop), ".out.pdf.pdfcraft-00000000000000ab.tmp");
+        assert_eq!(std::fs::read(&tools).unwrap(), b"", "a new, empty file");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_long_name_is_cut_to_128_bytes_between_characters() {
+        let dir = test_dir("long");
+        // One byte, then four-byte characters: the 128-byte limit falls inside the 32nd one.
+        let name = format!("a{}.pdf", "\u{1F600}".repeat(40));
+        let (tmp, _) = create_staging(&dir, &name, StagingName::SuffixThenTag, [1]).unwrap();
+        assert_eq!(file_name(&tmp), format!(".a{}.0000000000000001.pdfcraft-tmp", "\u{1F600}".repeat(31)));
+        // One-byte characters: exactly 128 of them are kept.
+        let (tmp, _) = create_staging(&dir, &"x".repeat(200), StagingName::SuffixThenTag, [2]).unwrap();
+        assert_eq!(file_name(&tmp), format!(".{}.0000000000000002.pdfcraft-tmp", "x".repeat(128)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn running_out_of_suffixes_refuses_and_creates_nothing() {
+        let dir = test_dir("empty");
+        let e = create_staging(&dir, "out.pdf", StagingName::TagThenSuffix, []).unwrap_err();
+        assert_eq!(e.kind(), std::io::ErrorKind::AlreadyExists);
+        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 0);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn only_the_first_sixteen_names_are_tried() {
+        let dir = test_dir("cap");
+        let name = |s: u64| dir.join(format!(".out.pdf.{s:016x}.pdfcraft-tmp"));
+        for s in 1..=STAGING_ATTEMPTS as u64 {
+            std::fs::write(name(s), "PLANTED").unwrap();
+        }
+        assert!(create_staging(&dir, "out.pdf", StagingName::SuffixThenTag, 1..).is_err());
+        assert!(!name(STAGING_ATTEMPTS as u64 + 1).exists(), "a 17th name was tried");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 8f817457..6a0b9fca 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -12,6 +12,7 @@ workspace = true
 pdfcraft-fonts = { workspace = true }
 pdfcraft-engine = { workspace = true }
 pdfcraft-render = { workspace = true }
+pdfcraft-platform = { workspace = true }
 egui = { workspace = true }
 egui_extras = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "persistence", "links"] }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index e8a9b8ee..4025a24b 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -2,6 +2,7 @@
 //! "save changes?" prompt when closing a tab or quitting with unsaved edits.
 
 use pdfcraft_engine::Edit;
+use pdfcraft_platform::staging::{StagingName, create_staging, staging_suffixes};
 
 use crate::PdfCraftApp;
 
@@ -527,7 +528,7 @@ fn write_atomically_with(path: &str, bytes: &[u8], suffixes: impl IntoIterator<I
     let target = std::path::Path::new(path);
     let dir = target.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(std::path::Path::new("."));
     let name = target.file_name().and_then(|n| n.to_str()).unwrap_or("save");
-    let (tmp, f) = create_staging(dir, name, suffixes)?;
+    let (tmp, f) = create_staging(dir, name, StagingName::TagThenSuffix, suffixes)?;
     let result = (|| {
         // Closed at the end of the block, before the rename.
         {
@@ -543,50 +544,6 @@ fn write_atomically_with(path: &str, bytes: &[u8], suffixes: impl IntoIterator<I
     result
 }
 
-/// How many staging names [`create_staging`] tries. A random 64-bit name is only taken if someone
-/// put a file there on purpose, so running out means refusing, not trying harder.
-const STAGING_ATTEMPTS: usize = 16;
-
-/// Create a new, empty staging file in `dir` for the file `name`, one name per suffix. It is
-/// opened with `create_new`, which fails if anything already has the name (a file, a hard link,
-/// a symbolic link even when dangling, a folder), on Windows as everywhere else; such a name is
-/// skipped, never opened, so a file planted at the staging path can't receive or redirect the
-/// save.
-fn create_staging(
-    dir: &std::path::Path,
-    name: &str,
-    suffixes: impl IntoIterator<Item = u64>,
-) -> std::io::Result<(std::path::PathBuf, std::fs::File)> {
-    // At most 128 bytes of the target's name, cut between characters, so the staging name fits
-    // the 255-byte (Linux, macOS) and 255-unit (Windows) limits however long that name is.
-    let mut stem = String::new();
-    for c in name.chars() {
-        if stem.len() + c.len_utf8() > 128 {
-            break;
-        }
-        stem.push(c);
-    }
-    for suffix in suffixes.into_iter().take(STAGING_ATTEMPTS) {
-        let tmp = dir.join(format!(".{stem}.pdfcraft-{suffix:016x}.tmp"));
-        match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
-            Ok(file) => return Ok((tmp, file)),
-            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
-            // Windows reports a folder at the name as "access denied"; it is taken all the same.
-            Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied && tmp.symlink_metadata().is_ok() => {}
-            Err(e) => return Err(e),
-        }
-    }
-    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "every temporary file name tried is taken"))
-}
-
-/// Unpredictable staging-name suffixes, so a name can't be planted in advance. `RandomState` is
-/// keyed from the operating system's random source.
-fn staging_suffixes() -> impl Iterator<Item = u64> {
-    use std::hash::BuildHasher;
-    let state = std::hash::RandomState::new();
-    (0u64..).map(move |i| state.hash_one(i))
-}
-
 #[cfg(not(target_arch = "wasm32"))]
 fn short_name(path: &str) -> String {
     std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string())
@@ -668,7 +625,8 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
 
 #[cfg(test)]
 mod tests {
-    use super::{STAGING_ATTEMPTS, staging_suffixes, write_atomically, write_atomically_with};
+    use super::{write_atomically, write_atomically_with};
+    use pdfcraft_platform::staging::{STAGING_ATTEMPTS, staging_suffixes};
     use std::path::{Path, PathBuf};
 
     /// A fresh, empty folder for one staging test.

From b5edb59d84e89f5f36217b791f32bf7792707d02 Mon Sep 17 00:00:00 2001
From: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>
Date: Fri, 9 Oct 2026 02:41:51 +0530
Subject: [PATCH 014/149] Clippy: as_chunks in the signature image test
 (follow-up to #335) (#360)

Signed-off-by: Chiranjeevi U <244287281+chiranjeevi-max@users.noreply.github.com>
---
 crates/engine/src/signature_image.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index 264c9c73..2f9f5445 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -152,7 +152,7 @@ mod tests {
         let image = SignatureImage::from_bytes(&jpeg.into_inner()).unwrap();
         assert_eq!(image.size(), [60, 20]);
         assert!(image.bytes().starts_with(b"\x89PNG\r\n\x1a\n"));
-        assert!(image.rgba().chunks_exact(4).all(|p| p[3] == 255));
+        assert!(image.rgba().as_chunks::<4>().0.iter().all(|p| p[3] == 255));
     }
 
     #[test]

From acb8e96affe2bf85881a4c20537f452832dd19ff Mon Sep 17 00:00:00 2001
From: Devon Llewellyn <139090831+remesis@users.noreply.github.com>
Date: Thu, 8 Oct 2026 17:17:05 -0400
Subject: [PATCH 015/149] Update image signatures live during resize and
 movement (#355)

* M5.7: update image signatures live during resize and movement

* M5.7: preserve image signature proportions when resizing corners

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                            |   4 +-
 crates/annot/README.md                |   1 +
 crates/annot/src/lib.rs               |  15 ++
 crates/automation/README.md           |   2 +
 crates/automation/src/comments.rs     |  30 ++-
 crates/automation/src/lib.rs          |   1 +
 crates/automation/src/tools.rs        |   2 +
 crates/automation/tests/automation.rs |  63 +++++++
 crates/engine/src/lib.rs              |   2 +-
 crates/engine/src/signature_image.rs  |  97 +++++++++-
 crates/ui-egui/src/canvas.rs          |  27 +++
 crates/ui-egui/src/comments.rs        | 106 +++++++++--
 crates/ui-egui/src/editing.rs         |   1 +
 crates/ui-egui/src/fill_sign.rs       |  20 +-
 crates/ui-egui/src/lib.rs             |   1 +
 crates/ui-egui/src/signature_drag.rs  | 141 ++++++++++++++
 crates/ui-egui/tests/fill_sign.rs     | 253 +++++++++++++++++++++++++-
 parity/acrobat-features.toml          |   6 +-
 18 files changed, 730 insertions(+), 42 deletions(-)
 create mode 100644 crates/ui-egui/src/signature_drag.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 20e8c3e4..be04ea2f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -94,7 +94,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
-| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews and selection for resizing. Missing: custom stamps, replace-text proposals, summary layouts with the page |
+| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M6 | Forms + JavaScript | 160–320 | 45% | 95–185 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 17% | 210–420 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M8 | Security + redaction | 100–180 | 66% | 35–65 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize. Missing: certificate security, redaction codes and pattern locales, DCT re-encoding |
@@ -125,6 +125,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 ## Log
 
+- **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
+- **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, signature placement):** Image signatures and initials preview at the pointer at their actual page size, including zoom and document/view rotation. A successful placement switches to Select with the new annotation selected; stamp resize handles use the existing engine edit, automation tool and undo history while preserving the appearance. Synthetic rendered UI and automation tests verify positioning, one placement per selection, resizing, undo/redo and save/reopen. Milestone and overall effort estimates unchanged.
 - **2026-10-08 (M5.7, image signatures):** Fill & Sign imports local PNG/JPEG signatures and initials through the Image tab, with previews, local persistence and undoable placement. The shared engine validates bounded images and preserves transparency and orientation; `fill_sign_add` accepts an image path. Synthetic UI and automation tests cover cancellation, invalid input, settings, undo/redo and save/reopen rendering. Overall effort estimate unchanged (about 30–35%).
 
diff --git a/crates/annot/README.md b/crates/annot/README.md
index beb0e058..c98cb6d2 100644
--- a/crates/annot/README.md
+++ b/crates/annot/README.md
@@ -23,6 +23,7 @@ set_review_state(&mut doc, page, index, ReviewState::Accepted, "Ada", &meta)?;
 move_annotation(&mut doc, page, index, dx, dy, &meta)?;
 set_style(&mut doc, page, index, Some(rgb), Some(0.5), Some(2.0), &meta)?;
 delete_annotation(&mut doc, page, index)?;
+signature_image(&doc, page, index)?; // embedded image XObject of Fill & Sign signature/initials
 ```
 
 A comment is addressed by `(page, index in /Annots)`, the same pair
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index 77bdc292..d735603c 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -662,6 +662,21 @@ fn annot_dict(doc: &Document, r: ObjRef) -> Dict {
     doc.get(r).as_dict().cloned().unwrap_or_default()
 }
 
+/// The embedded image of a Fill & Sign image signature or initials (0-based target).
+/// Other stamps have appearances that can't be represented by this image alone.
+pub fn signature_image(doc: &Document, page: usize, index: usize) -> Result<Option<ObjRef>, AnnotError> {
+    let p = page_ref(doc, page)?;
+    let list = annots(doc, p);
+    let entry = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    let obj = doc.resolve(entry);
+    let Some(d) = obj.as_dict() else { return Ok(None) };
+    Ok((d.name(b"Subtype") == Some(b"Stamp")
+        && matches!(d.name(b"Name"), Some(b"PCCustomSignature" | b"PCCustomInitials"))
+        && matches!(d.get(b"PCPictureImage"), Some(Object::Bool(true))))
+    .then(|| d.reference(b"PCPicture"))
+    .flatten())
+}
+
 // ── building ────────────────────────────────────────────────────────────────────────────────
 
 /// Annotation flags (§12.5.3).
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 5bc4ac11..21dbc3f5 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -23,6 +23,8 @@ mcp::McpServer::new(a).serve(stdin, stdout)?             // newline-delimited JS
 - Pages and positions are **1-based**. Rectangles are PDF points with the origin at the top-left of the displayed page.
 - Unknown arguments are rejected, so typos fail loudly.
 - Tools that change a document return its summary (`doc`, `pages`, `dirty`, `undo`, `redo`, …).
+- `comment_image_preview` returns JSON and a PNG: `layer: "background"` (the default) gives the page without the selected image signature/initials; `layer: "image"` gives its embedded image with alpha. The metadata supplies its displayed rectangle, document rotation and annotation opacity. Each result can be saved with the CLI's `--out`. Cache the background and transform the image for live movement/resizing; `comment_edit` commits the final geometry in one undo step. Previewing never changes the document.
+- For proportional image signature resizing, use the embedded image layer's width/height ratio rather than a previously stretched annotation rectangle. The GUI preserves this ratio at corners with the opposite corner anchored; edge midpoint handles change only their own axis. `comment_edit` accepts the resulting rectangle.
 - `doc_close` refuses to drop unsaved changes unless `discard_changes: true`. `doc_save` writes atomically, incrementally in place, and in full for a new path.
 - With a root set, every read and write path must resolve inside it (symlinks and `..` included). Relative paths resolve inside the root, and `..` is resolved by name before the check. Every path outside the root gets the same refusal (`<path> is outside the allowed directory <root>`), whether or not it exists, so a confined agent can't probe the rest of the disk; on Windows another network share or device path (`\\host\share`, `\\?\UNC\…`, `\\.\…`) is refused without being contacted. "Not found" and other filesystem errors are reported only for paths inside the root. Tools that write several files into a folder name them after the document or input file, with separators, colons and control characters replaced by `_`, so a name can't lead them out of the folder. The root itself must be a folder.
 
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index 22485246..4d97e321 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -7,7 +7,7 @@ use pdfcraft_engine::{Edit, Markup, NOTE_SIZE, NewAnnotation, NoteIcon, ReviewSt
 use pdfcraft_render::{Annotation, PageInfo};
 use serde_json::{Value, json};
 
-use crate::{Args, Automation, Result, ToolError, failed};
+use crate::{Args, Automation, Content, DEFAULT_DPI, MAX_DPI, Result, ToolError, encode_png, failed};
 
 /// Author used when a tool call names none.
 pub(crate) const DEFAULT_AUTHOR: &str = "PdfCraft";
@@ -86,6 +86,34 @@ impl Args<'_> {
 }
 
 impl Automation {
+    /// One of the read-only layers the GUI uses to drag/resize an embedded image signature.
+    pub(crate) fn comment_image_preview(&self, a: &Args) -> Result<Vec<Content>> {
+        let (page, index) = self.comment_target(a)?;
+        let dpi = a.opt_num("dpi")?.unwrap_or(DEFAULT_DPI);
+        if !(1.0..=MAX_DPI).contains(&dpi) {
+            return Err(ToolError::InvalidArgs(format!("dpi must be between 1 and {MAX_DPI}")));
+        }
+        let doc = self.doc(a)?;
+        let preview = doc.image_signature_preview(page, index).map_err(failed)?.ok_or_else(|| failed("choose an image signature or initials"))?;
+        let annotation = doc.info.annotations.iter().find(|c| c.page == page && c.index == index).ok_or_else(|| failed("no such comment"))?;
+        let info = doc.info.pages.get(page).ok_or_else(|| failed("no such page"))?;
+        let [w, h] = preview.image.size();
+        let layer = a.opt_str("layer")?.unwrap_or("background");
+        let image = match layer {
+            "image" => Content::Png { data: preview.image.bytes().as_ref().clone(), width: w as u32, height: h as u32 },
+            "background" => {
+                let out = preview.render_background((dpi / 72.0) as f32).map_err(failed)?;
+                Content::Png { data: encode_png(out.width, out.height, &out.rgba)?, width: out.width, height: out.height }
+            }
+            _ => return Err(ToolError::InvalidArgs("layer must be background or image".into())),
+        };
+        Ok(vec![
+            Content::Json(json!({ "page": page + 1, "index": index + 1, "rect": rect_to_view(info, annotation.rect), "rotation": info.rotation,
+                "layer": layer, "opacity": preview.opacity, "dpi": dpi })),
+            image,
+        ])
+    }
+
     /// Comments of a document, optionally only of one 0-based page.
     fn comments(&self, a: &Args) -> Result<Vec<Annotation>> {
         let doc = self.doc(a)?;
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index e1219951..4f072b42 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -155,6 +155,7 @@ impl Automation {
                 self.apply(&a, edit)?
             }
             "page_render" => return self.page_render(&a).map(|c| vec![c]),
+            "comment_image_preview" => return self.comment_image_preview(&a),
             "text_extract" => self.text_extract(&a)?,
             "text_find" => self.text_find(&a)?,
             "page_rotate" => {
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index deae3b4b..6096c646 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -629,6 +629,8 @@ pub fn tools() -> Vec<ToolDef> {
             })),
             &["doc"],
         )),
+        t("comment_image_preview", "Preview image signature layers", "Return a PNG of the page without the selected image signature/initials (layer=background, default), or its embedded image with alpha (layer=image). Includes the displayed rectangle, document rotation and annotation opacity. Cache these layers for live placement/resizing; commit once with comment_edit. Does not change the document or undo history.")
+            .ro().with(schema(comment_ref(json!({ "layer": { "type": "string", "enum": ["background", "image"], "default": "background" }, "dpi": { "type": "number", "minimum": 1, "maximum": 600, "default": 96 } })), &["doc"])),
         t("comment_delete", "Delete a comment", "Delete a comment with its pop-up and replies. Undoable.").destructive().with(schema(comment_ref(json!({})), &["doc"])),
         t(
             "doc_protect",
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 95407fd4..3ea77ab3 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1432,6 +1432,69 @@ fn image_signatures_through_tools_preserve_transparency_and_survive_save() {
     assert_eq!(ok(&mut a, "comment_list", json!({ "doc": doc }))["count"], 2, "errors leave the PDF intact");
 }
 
+#[test]
+fn image_signature_preview_layers_are_read_only_and_survive_encrypted_save() {
+    let dir = workdir("signature-preview");
+    let mut png = Vec::new();
+    {
+        let mut encoder = png::Encoder::new(&mut png, 120, 40);
+        encoder.set_color(png::ColorType::Rgba);
+        encoder.set_depth(png::BitDepth::Eight);
+        let rgba: Vec<u8> = (0..40)
+            .flat_map(|y| (0..120).flat_map(move |x| if (40..80).contains(&x) && (10..30).contains(&y) { [20, 40, 60, 128] } else { [0, 0, 0, 0] }))
+            .collect();
+        encoder.write_header().unwrap().write_image_data(&rgba).unwrap();
+    }
+    std::fs::write(dir.join("signature.png"), png).unwrap();
+    std::fs::write(dir.join("form.pdf"), fixture(1)).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "form.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "page_rotate", json!({ "doc": doc, "pages": [1], "degrees": 90 }));
+    ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": 1, "type": "initials", "at": [20, 40], "path": "signature.png" }));
+    let background = a.call("page_render", &json!({ "doc": doc, "page": 1, "dpi": 72 })).unwrap();
+    let Content::Png { data: expected, .. } = &background[0] else { panic!() };
+    let expected = image::load_from_memory(expected).unwrap().to_rgba8();
+    ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": 1, "type": "signature", "at": [120, 100], "path": "signature.png" }));
+    ok(&mut a, "comment_edit", json!({ "doc": doc, "page": 1, "index": 2, "opacity": 0.5 }));
+    ok(&mut a, "doc_protect", json!({ "doc": doc, "open_password": "preview-test" }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "signed.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "signed.pdf", "password": "preview-test" }))["doc"].as_u64().unwrap();
+    for doc in [doc, reopened] {
+        let before = ok(&mut a, "doc_info", json!({ "doc": doc }));
+        let d = a.session().docs().iter().find(|d| d.id.0 == doc).unwrap();
+        let generation = d.edit_generation();
+        let bytes = d.bytes.clone();
+        let output = a.call("comment_image_preview", &json!({ "doc": doc, "page": 1, "index": 2, "dpi": 72 })).unwrap();
+        let [Content::Json(meta), Content::Png { data: background, .. }] = output.as_slice() else { panic!("labeled background layer") };
+        let image = a.call("comment_image_preview", &json!({ "doc": doc, "page": 1, "index": 2, "layer": "image" })).unwrap();
+        let [Content::Json(image_meta), Content::Png { data: signature, width, height }] = image.as_slice() else { panic!("labeled image layer") };
+        assert_eq!(meta["layer"], "background");
+        assert_eq!(image_meta["layer"], "image");
+        assert_eq!(meta["rotation"], 90);
+        assert_eq!(meta["opacity"], 0.5);
+        assert_eq!((*width, *height), (120, 40));
+        assert_eq!(image::load_from_memory(background).unwrap().to_rgba8(), expected, "page text and the other signature remain");
+        let signature = image::load_from_memory(signature).unwrap().to_rgba8();
+        assert_eq!(signature.get_pixel(5, 20).0[3], 0);
+        assert_eq!(signature.get_pixel(60, 20).0, [20, 40, 60, 128], "embedded alpha and colour survive reopen");
+        assert_eq!(ok(&mut a, "doc_info", json!({ "doc": doc })), before);
+        let d = a.session().docs().iter().find(|d| d.id.0 == doc).unwrap();
+        assert_eq!(d.edit_generation(), generation);
+        assert!(std::sync::Arc::ptr_eq(&bytes, &d.bytes));
+        assert!(d.image_signature_preview(0, 1).unwrap().unwrap().render_background(f32::NAN).is_err());
+        assert!(d.image_signature_preview(0, 999).is_err());
+    }
+    assert!(tools().iter().find(|t| t.name == "comment_image_preview").unwrap().read_only);
+    for dpi in [0, 601] {
+        assert!(matches!(
+            a.call("comment_image_preview", &json!({ "doc": reopened, "page": 1, "index": 2, "dpi": dpi })),
+            Err(ToolError::InvalidArgs(_))
+        ));
+    }
+    ok(&mut a, "fill_sign_add", json!({ "doc": reopened, "page": 1, "type": "check", "at": [10, 10] }));
+    assert!(a.call("comment_image_preview", &json!({ "doc": reopened, "page": 1, "index": 3 })).is_err());
+}
+
 #[test]
 fn creating_and_reducing_through_tools() {
     let dir = workdir("create");
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index ca97c80f..a92a6848 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -23,7 +23,7 @@ pub mod ocr;
 pub mod signature_image;
 pub mod xfa;
 
-pub use signature_image::SignatureImage;
+pub use signature_image::{ImageSignaturePreview, SignatureImage};
 
 pub use pdfcraft_organize::{BoxSpec, PageBox, SplitBy, split_ranges};
 
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index 2f9f5445..2af4a5f2 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -5,7 +5,64 @@ use std::sync::Arc;
 
 use image::{DynamicImage, ImageDecoder, ImageFormat, ImageReader, Limits};
 
-use crate::{Edit, MarkFile};
+use crate::{Document, Edit, MarkFile, guard};
+
+/// Read-only layers for interactive movement: the page without this signature, and its image.
+/// Preparing them never changes the working bytes, dirty flag or undo history.
+pub struct ImageSignaturePreview {
+    pub image: SignatureImage,
+    pub opacity: f32,
+    page: usize,
+    bytes: Arc<Vec<u8>>,
+    config: pdfcraft_render::RenderConfig,
+}
+
+impl ImageSignaturePreview {
+    /// One background worker; the UI reuses its page texture throughout a gesture.
+    pub fn renderer(&self) -> pdfcraft_render::RenderPool {
+        pdfcraft_render::RenderPool::new(self.bytes.clone(), 1, self.config.clone())
+    }
+
+    /// Synchronous counterpart for automation, with the renderer's normal pixel limits.
+    pub fn render_background(&self, scale: f32) -> Result<pdfcraft_render::RenderedPage, String> {
+        if !scale.is_finite() || scale <= 0.0 {
+            return Err("preview scale must be finite and positive".into());
+        }
+        guard(|| {
+            let mut renderer = pdfcraft_render::PageRenderer::new(self.bytes.clone(), self.config.clone());
+            let out = renderer.render(pdfcraft_render::RenderRequest { page: self.page, scale, ..Default::default() });
+            if let Some(e) = &out.error {
+                return Err(e.clone());
+            }
+            Ok(out)
+        })?
+    }
+}
+
+impl Document {
+    /// Prepare the actual embedded signature, including alpha, and an independent background.
+    /// A cheap COS clone excludes only this annotation; other page content remains visible.
+    pub fn image_signature_preview(&self, page: usize, index: usize) -> Result<Option<ImageSignaturePreview>, String> {
+        guard(|| {
+            let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+            let Some(picture) = pdfcraft_annot::signature_image(&editor.cos, page, index).map_err(|e| e.to_string())? else { return Ok(None) };
+            let obj = editor.cos.get(picture);
+            let pdfcraft_cos::Object::Stream(s) = &*obj else { return Err("the signature image is damaged".into()) };
+            let (w, h) = (s.dict.int(b"Width").unwrap_or(0), s.dict.int(b"Height").unwrap_or(0));
+            if w <= 0 || h <= 0 || w > 4096 || h > 4096 || w.saturating_mul(h) > MAX_PIXELS as i64 {
+                return Err(SignatureImageError::Size.to_string());
+            }
+            let (_, bytes) = pdfcraft_create::image_file(&editor.cos, picture)?;
+            let image = SignatureImage::from_bytes(&bytes).map_err(|e| e.to_string())?;
+            let opacity =
+                pdfcraft_annot::props(&editor.cos, page, index).map(|p| p.opacity).filter(|v| v.is_finite()).unwrap_or(1.0).clamp(0.0, 1.0) as f32;
+            let mut cos = editor.cos.clone();
+            pdfcraft_annot::delete_annotation(&mut cos, page, index).map_err(|e| e.to_string())?;
+            let bytes = Arc::new(pdfcraft_cos::write_incremental(&cos, &pdfcraft_cos::SaveOptions::default()).map_err(|e| e.to_string())?);
+            Ok(Some(ImageSignaturePreview { image, opacity, page, bytes, config: self.config.clone() }))
+        })?
+    }
+}
 
 /// Saved signatures live in settings, so both source and normalized PNG are bounded.
 pub const MAX_SIGNATURE_IMAGE_BYTES: usize = 4 << 20;
@@ -183,4 +240,42 @@ mod tests {
         let a = &session.get(id).unwrap().info.annotations[0];
         assert_eq!(a.rect, [20.0, 99.75, 170.0, 100.25]);
     }
+
+    #[test]
+    fn embedded_signature_preview_preserves_alpha_without_editing_the_document() {
+        let image = SignatureImage::from_bytes(&png(120, 40)).unwrap();
+        let mut session = crate::Session::new();
+        let blank = session.create_blank(300.0, 400.0, 1).unwrap();
+        let id = session.open_new("form.pdf", blank).unwrap();
+        session.apply(id, image.edit(0, [20.0, 100.0], false, "Ada").unwrap()).unwrap();
+        let doc = session.get(id).unwrap();
+        let bytes = doc.bytes.clone();
+        let generation = doc.edit_generation();
+        let preview = doc.image_signature_preview(0, 0).unwrap().unwrap();
+        assert_eq!(preview.image.rgba(), image.rgba());
+        let background = preview.render_background(1.0).unwrap();
+        assert!(background.rgba.chunks_exact(4).all(|p| p == [255, 255, 255, 255]));
+        assert!(Arc::ptr_eq(&bytes, &doc.bytes));
+        assert_eq!(doc.edit_generation(), generation);
+        assert_eq!(doc.can_undo(), Some("Add signature"));
+        assert!(doc.image_signature_preview(0, 1).is_err());
+        assert!(preview.render_background(0.0).is_err());
+    }
+
+    #[test]
+    fn oversized_embedded_signature_preview_is_rejected_before_decoding() {
+        let image = SignatureImage::from_bytes(&png(120, 40)).unwrap();
+        let mut session = crate::Session::new();
+        let blank = session.create_blank(300.0, 400.0, 1).unwrap();
+        let id = session.open_new("form.pdf", blank).unwrap();
+        session.apply(id, image.edit(0, [20.0, 100.0], false, "Ada").unwrap()).unwrap();
+        let doc = session.doc_mut(id).unwrap();
+        let cos = &mut doc.editor.as_mut().unwrap().cos;
+        let picture = pdfcraft_annot::signature_image(cos, 0, 0).unwrap().unwrap();
+        let pdfcraft_cos::Object::Stream(mut stream) = (*cos.get(picture)).clone() else { panic!() };
+        stream.dict.set(b"Width".to_vec(), pdfcraft_cos::Object::Int(i64::MAX));
+        cos.set(picture, pdfcraft_cos::Object::Stream(stream));
+        let error = doc.image_signature_preview(0, 0).err().unwrap();
+        assert!(error.contains("4 megapixels"), "{error}");
+    }
 }
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 37ac3a34..42313e86 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -277,6 +277,7 @@ pub struct DocView {
     pub fill_text: Option<crate::fill_sign::TypeBox>,
     /// A queued Fill & Sign signature: select it after its edit succeeds, then leave placement.
     pub(crate) fill_signature_page: Option<usize>,
+    pub(crate) signature_drag: crate::signature_drag::SignatureDrag,
     /// A non-edit action requested by the organize toolbar, handled by the app.
     pub pending_action: Option<ViewAction>,
 }
@@ -384,6 +385,7 @@ impl DocView {
             marquee_done: None,
             fill_text: None,
             fill_signature_page: None,
+            signature_drag: Default::default(),
         }
     }
 
@@ -866,6 +868,7 @@ impl DocView {
             } else {
                 let tex = ctx.load_texture(format!("page-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
                 self.pages.insert(page, PageTex { tag: r.request.tag, tex });
+                self.signature_drag.page_received(page);
                 self.waiting_since.remove(&page);
             }
         }
@@ -957,6 +960,26 @@ pub struct PageXform {
 }
 
 impl PageXform {
+    /// Draw an image in PDF user space, preserving orientation through both page rotations.
+    pub(crate) fn paint_user_image(
+        &self,
+        painter: &egui::Painter,
+        tex: egui::TextureId,
+        info: &DocInfo,
+        page: usize,
+        rect: [f64; 4],
+        color: Color32,
+    ) {
+        let Some(p) = info.pages.get(page) else { return };
+        let mut mesh = egui::Mesh::with_texture(tex);
+        for (x, y, u, v) in [(rect[0], rect[3], 0.0, 0.0), (rect[2], rect[3], 1.0, 0.0), (rect[2], rect[1], 1.0, 1.0), (rect[0], rect[1], 0.0, 1.0)] {
+            let p = p.user_to_view(x as f32, y as f32);
+            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(p[0] / self.pw, p[1] / self.ph), uv: pos2(u, v), color });
+        }
+        mesh.add_triangle(0, 1, 2);
+        mesh.add_triangle(0, 2, 3);
+        painter.add(egui::Shape::mesh(mesh));
+    }
     pub fn norm_to_screen(&self, u: f32, v: f32) -> Pos2 {
         let (a, b) = match self.rot {
             90 => (1.0 - v, u),
@@ -1578,6 +1601,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             let on_link = tool == QuickTool::Link && can_modify && crate::link_ui::page_input(ui, &resp, &xf, i, info, &doc_links, view);
             let consumed = on_edit_text || on_link || on_content || boxing || on_field || comments::page_input(ui, &resp, &pcx, view);
 
+            let preview_target = (tool == QuickTool::Select && !comments_hidden).then_some(view.comments.selected).flatten();
+            view.signature_drag.prepare(ui.ctx(), doc, preview_target, scale);
+            view.signature_drag.paint(painter, &pcx, &view.comments, view.pending_edit.as_ref());
+
             // Text layer: find matches, selection, I-beam and drag-to-select.
             let to_screen = |g: [f32; 4]| xf.view_rect(g);
             if let Some(text) = view.texts.get(&i).cloned() {
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index 6cec279a..37438d05 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -335,7 +335,7 @@ pub enum Gesture {
     /// Moving a comment, from the press position on screen.
     Move { page: usize, index: usize, from: Pos2 },
     /// Resizing a comment by one of its handles: (dx, dy) ∈ {-1, 0, 1}² says which sides move.
-    Resize { page: usize, index: usize, handle: (i8, i8), from: Pos2 },
+    Resize { page: usize, index: usize, handle: (i8, i8), from: Pos2, aspect_ratio: Option<f32> },
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -371,6 +371,8 @@ pub struct CommentView {
     /// The selected comment: (page, index in `/Annots`).
     pub selected: Option<(usize, usize)>,
     pub gesture: Option<Gesture>,
+    /// Escape ends egui's drag too; ignore its synthetic release until the mouse is up.
+    cancelled_drag: bool,
     pub composer: Option<Composer>,
     /// Reply being typed under the selected card.
     pub reply: String,
@@ -474,9 +476,40 @@ impl PageCx<'_> {
         self.comments().filter(|a| self.screen_rects(a).iter().any(|r| r.expand(3.0).contains(p))).last()
     }
 
-    fn get(&self, index: usize) -> Option<&Annotation> {
+    pub(crate) fn get(&self, index: usize) -> Option<&Annotation> {
         self.comments().find(|a| a.index == index)
     }
+
+    pub(crate) fn rect_to_user(&self, r: Rect) -> [f64; 4] {
+        let (a, b) = (self.to_user(r.left_top()), self.to_user(r.right_bottom()));
+        [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
+    }
+
+    /// The same geometry drives the live image, its handles, and the edit on release.
+    pub(crate) fn adjusted_rect(&self, a: &Annotation, gesture: Option<&Gesture>, pointer: Option<Pos2>, pending: Option<&Edit>) -> Rect {
+        let r = self.screen_rect(a);
+        if let Some(Edit::ResizeAnnotation { page, index, rect }) = pending
+            && (*page, *index) == (self.page, a.index)
+        {
+            return self.xf.user_rect(self.info, self.page, rect.map(|v| v as f32));
+        }
+        if let Some(Edit::MoveAnnotation { page, index, dx, dy }) = pending
+            && (*page, *index) == (self.page, a.index)
+        {
+            return self.xf.user_rect(
+                self.info,
+                self.page,
+                [a.rect[0] + *dx as f32, a.rect[1] + *dy as f32, a.rect[2] + *dx as f32, a.rect[3] + *dy as f32],
+            );
+        }
+        match (gesture, pointer) {
+            (Some(Gesture::Move { page, index, from }), Some(p)) if (*page, *index) == (self.page, a.index) => r.translate(p - *from),
+            (Some(Gesture::Resize { page, index, handle, from, aspect_ratio }), Some(p)) if (*page, *index) == (self.page, a.index) => {
+                resized(r, *handle, p - *from, *aspect_ratio)
+            }
+            _ => r,
+        }
+    }
 }
 
 fn is_markup(subtype: &str) -> bool {
@@ -505,7 +538,17 @@ fn handle_pos(r: Rect, (hx, hy): (i8, i8)) -> Pos2 {
     pos2(x, y)
 }
 
-fn resized(r: Rect, (hx, hy): (i8, i8), d: egui::Vec2) -> Rect {
+fn resized(r: Rect, (hx, hy): (i8, i8), d: egui::Vec2, aspect_ratio: Option<f32>) -> Rect {
+    if hx != 0
+        && hy != 0
+        && let Some(ratio) = aspect_ratio.filter(|v| v.is_finite() && *v > 0.0)
+    {
+        // As in content_ui, the larger requested dimension drives proportional corner resizing.
+        // Keep the opposite corner fixed and prevent crossing it from flipping the image.
+        let width = (r.width() + f32::from(hx) * d.x).max((r.height() + f32::from(hy) * d.y) * ratio).max(4.0).max(4.0 * ratio);
+        let anchor = handle_pos(r, (-hx, -hy));
+        return Rect::from_two_pos(anchor, anchor + vec2(f32::from(hx) * width, f32::from(hy) * width / ratio));
+    }
     let mut r = r;
     match hx {
         -1 => r.min.x += d.x,
@@ -529,6 +572,14 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
     let pressed_here = origin.is_some_and(|o| page_rect.contains(o));
     let over_page = pointer.is_some_and(|p| page_rect.contains(p));
     let cv = &mut view.comments;
+    if cv.gesture.is_some() && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
+        cv.gesture = None;
+        cv.cancelled_drag = true;
+        return true;
+    }
+    if cv.cancelled_drag {
+        return true;
+    }
     if resp.secondary_clicked()
         && let Some(p) = pointer.filter(|p| page_rect.contains(*p))
     {
@@ -757,7 +808,12 @@ fn select_input(
         && let Some(o) = origin
     {
         if let (Some(h), Some(a)) = (handle_at(o), selected) {
-            cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o });
+            let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).and_then(|ratio| {
+                let p = cx.info.pages.get(cx.page)?;
+                let rotation = u32::from(p.rotation) + u32::from(cx.xf.rot);
+                Some(if rotation % 180 == 0 { ratio } else { ratio.recip() })
+            });
+            cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o, aspect_ratio });
             consumed = true;
         } else if let Some(a) = cx.hit(o)
             && !is_markup(&a.subtype)
@@ -785,12 +841,11 @@ fn select_input(
                     view.pending_edit = Some(Edit::MoveAnnotation { page, index, dx, dy });
                 }
             }
-            Some(Gesture::Resize { page, index, handle, from }) if page == cx.page => {
+            Some(Gesture::Resize { page, index, handle, from, aspect_ratio }) if page == cx.page => {
                 cv.gesture = None;
                 if let Some(a) = cx.get(index) {
-                    let r = resized(cx.screen_rect(a), handle, p - from);
-                    let (u0, u1) = (cx.to_user(r.left_top()), cx.to_user(r.right_bottom()));
-                    let rect = [u0[0].min(u1[0]), u0[1].min(u1[1]), u0[0].max(u1[0]), u0[1].max(u1[1])];
+                    let r = resized(cx.screen_rect(a), handle, p - from, aspect_ratio);
+                    let rect = cx.rect_to_user(r);
                     if r.width() >= 4.0 && r.height() >= 4.0 {
                         view.pending_edit = Some(Edit::ResizeAnnotation { page, index, rect });
                     }
@@ -878,14 +933,11 @@ pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>
             }
             return paint_gesture(painter, cx, view);
         }
-        let mut r = cx.screen_rect(a).expand(2.0);
-        if let (Some(p), Some(g)) = (pointer, &cv.gesture) {
-            match g {
-                Gesture::Move { page, index: gi, from } if *page == cx.page && *gi == index => r = r.translate(p - *from),
-                Gesture::Resize { page, index: gi, handle, from } if *page == cx.page && *gi == index => r = resized(r, *handle, p - *from),
-                _ => {}
-            }
+        if view.signature_drag.contains(page, index) && matches!(cv.gesture, Some(Gesture::Move { page: p, index: i, .. }) if (p, i) == (page, index))
+        {
+            return paint_gesture(painter, cx, view);
         }
+        let r = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, view.pending_edit.as_ref()).expand(2.0);
         painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Middle);
         if cx.allowed && resizable(a) {
             for h in HANDLES {
@@ -1129,6 +1181,9 @@ pub fn text_box_rect(at: [f64; 2], text: &str, size: f64) -> [f64; 4] {
 
 /// Delete / Escape handling for comments (only while no text field has focus).
 pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView, tool: &mut QuickTool, allowed: bool) {
+    if !ctx.input(|i| i.pointer.any_down()) {
+        view.comments.cancelled_drag = false;
+    }
     if ctx.egui_wants_keyboard_input() {
         return;
     }
@@ -1315,6 +1370,27 @@ pub fn status_badge(state: &str) -> Option<(&'static str, &'static str, Color32)
 mod tests {
     use super::*;
 
+    #[test]
+    fn proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
+        for (hx, hy) in [(-1, -1), (1, -1), (-1, 1), (1, 1)] {
+            for (dx, dy) in [(24.0, 0.0), (0.0, 16.0), (-48.0, -20.0), (-200.0, -200.0)] {
+                let out = resized(r, (hx, hy), vec2(f32::from(hx) * dx, f32::from(hy) * dy), Some(3.0));
+                assert_eq!(handle_pos(out, (-hx, -hy)), handle_pos(r, (-hx, -hy)));
+                assert!((out.width() / out.height() - 3.0).abs() < 0.001);
+                assert!(out.width() >= 4.0 && out.height() >= 4.0);
+            }
+        }
+        for handle in [(0, -1), (1, 0), (0, 1), (-1, 0)] {
+            let out = resized(r, handle, vec2(24.0, 16.0), Some(3.0));
+            assert_eq!(out, resized(r, handle, vec2(24.0, 16.0), None));
+            assert_eq!(if handle.0 == 0 { out.width() } else { out.height() }, if handle.0 == 0 { r.width() } else { r.height() });
+        }
+        // Ordinary comment corners keep their existing independent width/height behavior.
+        let free = resized(r, (1, 1), vec2(24.0, 0.0), None);
+        assert_eq!(free.size(), vec2(120.0, 32.0));
+    }
+
     #[test]
     fn tools_round_trip_through_their_commands() {
         for t in ALL {
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 4025a24b..a1f08844 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -37,6 +37,7 @@ impl PdfCraftApp {
                 let Some(doc) = self.session.get(id) else { return true };
                 let info = &doc.info;
                 let view = &mut self.views[i];
+                view.signature_drag.committed(&edit, doc.edit_generation());
                 match comment_page(&edit) {
                     // Comment edits change one page: keep every other raster.
                     Some(page) => view.page_changed(page),
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index fe53c3f7..ecd4eb6f 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -381,25 +381,9 @@ pub(crate) fn page_input(
     };
     if let Some(SavedSig::Image(image)) = saved {
         if let Some(rect) = image.rect(at, tool == FillTool::Initials) {
-            // Map each corner, rather than the bounding box, so page and view rotations
-            // turn the preview exactly as they turn the placed stamp.
             let tex = image_texture(ui, image, preview);
-            let mut mesh = egui::Mesh::with_texture(tex);
-            let corners = [(rect[0], rect[3], 0.0, 0.0), (rect[2], rect[3], 1.0, 0.0), (rect[2], rect[1], 1.0, 1.0), (rect[0], rect[1], 0.0, 1.0)];
-            if let Some(p) = info.pages.get(page) {
-                for (x, y, u, v) in corners {
-                    let p = p.user_to_view(x as f32, y as f32);
-                    mesh.vertices.push(egui::epaint::Vertex {
-                        pos: xf.norm_to_screen(p[0] / xf.pw, p[1] / xf.ph),
-                        uv: pos2(u, v),
-                        color: Color32::WHITE,
-                    });
-                }
-                mesh.add_triangle(0, 1, 2);
-                mesh.add_triangle(0, 2, 3);
-                ui.painter().add(egui::Shape::mesh(mesh));
-                ui.ctx().set_cursor_icon(egui::CursorIcon::None);
-            }
+            xf.paint_user_image(ui.painter(), tex, info, page, rect, Color32::WHITE);
+            ui.ctx().set_cursor_icon(egui::CursorIcon::None);
         }
     } else {
         ui.ctx().set_cursor_icon(if tool == FillTool::Text { egui::CursorIcon::Text } else { egui::CursorIcon::Crosshair });
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index b8269816..f1e857f5 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -76,6 +76,7 @@ mod panels;
 mod pickers;
 pub mod prepare;
 mod print_ui;
+mod signature_drag;
 pub use print_ui::{Handling as PrintHandling, PrintDraft, Which as PrintWhich};
 mod redact_ui;
 pub use redact_ui::{HiddenDraft, PagesDraft as RedactPagesDraft, RedactPrefs, SearchDraft as RedactSearchDraft};
diff --git a/crates/ui-egui/src/signature_drag.rs b/crates/ui-egui/src/signature_drag.rs
new file mode 100644
index 00000000..e566ba3c
--- /dev/null
+++ b/crates/ui-egui/src/signature_drag.rs
@@ -0,0 +1,141 @@
+//! Cached page/image layers: a signature follows each pointer frame without editing the PDF.
+
+use egui::{ColorImage, TextureHandle, TextureOptions};
+use pdfcraft_engine::{Document, Edit};
+use pdfcraft_render::{RenderPool, RenderRequest};
+
+use crate::QuickTool;
+use crate::comments::{CommentView, Gesture, PageCx};
+
+#[derive(Default)]
+pub(crate) struct SignatureDrag {
+    key: Option<(u64, usize, usize)>,
+    aspect_ratio: Option<f32>,
+    layers: Option<Layers>,
+}
+
+struct Layers {
+    image: TextureHandle,
+    opacity: f32,
+    renderer: RenderPool,
+    background: Option<TextureHandle>,
+    tag: Option<u64>,
+    received_tag: Option<u64>,
+    /// Keep the final position visible until the normal page raster catches up.
+    settling: bool,
+}
+
+impl SignatureDrag {
+    pub fn prepare(&mut self, ctx: &egui::Context, doc: &Document, selected: Option<(usize, usize)>, scale: f32) {
+        let key = selected.map(|(p, i)| (doc.edit_generation(), p, i));
+        if self.key != key {
+            self.key = key;
+            self.aspect_ratio = None;
+            self.layers = None;
+            if let Some((_, page, index)) = key
+                && doc.info.annotations.iter().any(|a| a.page == page && a.index == index && a.subtype == "Stamp" && !a.locked)
+                && let Ok(Some(preview)) = doc.image_signature_preview(page, index)
+            {
+                let [width, height] = preview.image.size();
+                self.aspect_ratio = Some(width as f32 / height as f32);
+                self.layers = Some(Layers {
+                    opacity: preview.opacity,
+                    image: ctx.load_texture(
+                        "signature-drag-image",
+                        ColorImage::from_rgba_unmultiplied(preview.image.size(), preview.image.rgba()),
+                        TextureOptions::LINEAR,
+                    ),
+                    renderer: preview.renderer(),
+                    background: None,
+                    tag: None,
+                    received_tag: None,
+                    settling: false,
+                });
+            }
+        }
+        let (Some((_, page, _)), Some(layers)) = (self.key, self.layers.as_mut()) else { return };
+        // The image stays sharp at every zoom; bound the extra background raster to 2048².
+        let Some(p) = doc.info.pages.get(page) else { return };
+        let scale = scale.min(2048.0 / p.width.max(p.height).max(1.0));
+        let tag = (scale * 1000.0) as u64;
+        if layers.tag != Some(tag) {
+            layers.renderer.set_queue(vec![RenderRequest { page, scale, tag, ..Default::default() }]);
+            layers.tag = Some(tag);
+        }
+        if let Some(out) = layers.renderer.try_recv()
+            && out.request.tag == tag
+        {
+            if out.error.is_none() {
+                layers.received_tag = Some(tag);
+                layers.background = Some(ctx.load_texture(
+                    "signature-drag-background",
+                    ColorImage::from_rgba_premultiplied([out.width as usize, out.height as usize], &out.rgba),
+                    TextureOptions::LINEAR,
+                ));
+            } else {
+                // Leave the ordinary page raster usable if an unsupported PDF can't preview.
+                self.layers = None;
+                return;
+            }
+        }
+        if layers.received_tag != Some(tag) {
+            ctx.request_repaint_after(std::time::Duration::from_millis(16));
+        }
+    }
+
+    pub fn contains(&self, page: usize, index: usize) -> bool {
+        self.key.is_some_and(|(_, p, i)| (p, i) == (page, index)) && self.layers.is_some()
+    }
+
+    /// Use the embedded image's proportions, even after an edge handle stretched its rectangle.
+    pub fn aspect_ratio(&self, page: usize, index: usize) -> Option<f32> {
+        self.key.filter(|(_, p, i)| (*p, *i) == (page, index)).and(self.aspect_ratio)
+    }
+
+    /// Movement/resizing only change this signature's geometry, so its background is reusable.
+    pub fn committed(&mut self, edit: &Edit, generation: u64) {
+        if let Edit::MoveAnnotation { page, index, .. } | Edit::ResizeAnnotation { page, index, .. } = edit
+            && self.contains(*page, *index)
+        {
+            self.key = Some((generation, *page, *index));
+            if let Some(layers) = &mut self.layers {
+                layers.settling = true;
+            }
+        } else {
+            *self = Self::default();
+        }
+    }
+
+    pub fn page_received(&mut self, page: usize) {
+        if self.key.is_some_and(|(_, p, _)| p == page)
+            && let Some(layers) = &mut self.layers
+        {
+            layers.settling = false;
+        }
+    }
+
+    pub fn paint(&self, painter: &egui::Painter, cx: &PageCx<'_>, cv: &CommentView, pending: Option<&Edit>) {
+        let (Some((_, page, index)), Some(layers)) = (self.key, &self.layers) else { return };
+        if page != cx.page || cx.tool != QuickTool::Select || cx.hidden {
+            return;
+        }
+        let dragging = matches!(cv.gesture, Some(Gesture::Move { page: p, index: i, .. } | Gesture::Resize { page: p, index: i, .. }) if (p, i) == (page, index));
+        let released = matches!(pending, Some(Edit::MoveAnnotation { page: p, index: i, .. } | Edit::ResizeAnnotation { page: p, index: i, .. }) if (*p, *i) == (page, index));
+        if !(dragging || released || layers.settling) {
+            return;
+        }
+        let (Some(background), Some(a)) = (&layers.background, cx.get(index)) else { return };
+        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), painter.ctx().input(|i| i.pointer.hover_pos()), pending);
+        let rect = cx.rect_to_user(rect);
+        let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
+        cx.xf.paint_image(&painter, background.id(), 0.0, 0.0, 1.0, 1.0);
+        cx.xf.paint_user_image(
+            &painter,
+            layers.image.id(),
+            cx.info,
+            page,
+            rect,
+            egui::Color32::from_white_alpha((layers.opacity * 255.0).round() as u8),
+        );
+    }
+}
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 7ab81861..54fa780d 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -14,9 +14,14 @@ trailer << /Root 1 0 R >>
 %%EOF";
 
 fn harness() -> Harness<'static, PdfCraftApp> {
-    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+    harness_bytes(FIXTURE)
+}
+
+fn harness_bytes(fixture: &[u8]) -> Harness<'static, PdfCraftApp> {
+    let fixture = fixture.to_vec();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
-        app.open_bytes("form.pdf", None, FIXTURE.to_vec()).unwrap();
+        app.open_bytes("form.pdf", None, fixture.clone()).unwrap();
         app.set_option("left", "closed").unwrap();
         app.set_option("zoom", "150").unwrap();
         app.set_option("author", "Ada").unwrap();
@@ -510,6 +515,250 @@ fn image_signature_placement_selects_resize_handles_and_requires_reselecting_to_
     std::fs::remove_file(path).unwrap();
 }
 
+fn assert_rect(actual: [f32; 4], expected: [f32; 4]) {
+    assert!(actual.iter().zip(expected).all(|(a, b)| (*a - b).abs() < 0.001), "{actual:?} != {expected:?}");
+}
+
+fn pixel_at(h: &Harness<'static, PdfCraftApp>, pixels: &image::RgbaImage, x: f32, y: f32) -> [u8; 4] {
+    let p = at(h, x, y);
+    pixels.get_pixel(p.x.round() as u32, p.y.round() as u32).0
+}
+
+fn has_blue_near(pixels: &image::RgbaImage, p: Pos2) -> bool {
+    (-5..=5).any(|dy| {
+        (-5..=5).any(|dx| {
+            let v = pixels.get_pixel((p.x as i32 + dx) as u32, (p.y as i32 + dy) as u32).0;
+            i32::from(v[2]) > i32::from(v[0]) + 40 && i32::from(v[2]) > i32::from(v[1]) + 35
+        })
+    })
+}
+
+#[test]
+fn image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles() {
+    // Original synthetic page content; a white patch over the old image would fail this test.
+    const GREEN_PAGE: &[u8] = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n4 0 obj << /Length 36 >> stream\n0.8 1 0.7 rg 0 0 300 400 re f\nendstream\nendobj\ntrailer << /Root 1 0 R >>\n%%EOF";
+    let mut h = harness_bytes(GREEN_PAGE);
+    let path = signature_file("live");
+    let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
+    h.state_mut().signature = Some(SavedSig::Image(image));
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 40.0, 250.0);
+    rendered_ink(&mut h, 90.0, 250.0);
+    let generation = h.state().session.get(h.state().views[0].id).unwrap().edit_generation();
+    let corner = at(&h, 136.0, 234.0);
+    h.drag_at(corner);
+    h.run_steps(1);
+    let end = at(&h, 184.0, 228.0);
+    h.hover_at(end);
+    // Wait only for the one-time background preparation. Later pointer frames are immediate.
+    rendered_ink(&mut h, 160.0, 242.0);
+    let end = at(&h, 220.0, 236.0);
+    h.hover_at(end);
+    h.run_steps(2);
+    let resized = h.render().unwrap();
+    assert!(pixel_at(&h, &resized, 200.0, 236.0)[..3].iter().all(|v| *v < 60), "ink resizes before release");
+    let assert_green = |v: [u8; 4]| {
+        assert!(v[1] > 230 && i32::from(v[1]) > i32::from(v[0]) + 10 && i32::from(v[1]) > i32::from(v[2]) + 10, "page content is preserved: {v:?}")
+    };
+    assert_green(pixel_at(&h, &resized, 90.0, 250.0));
+    assert!(has_blue_near(&resized, at(&h, 220.0, 266.0)), "resizing keeps its handles visible");
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert_eq!(doc.edit_generation(), generation, "pointer frames never edit the document");
+    assert_eq!(doc.can_undo(), Some("Add signature"));
+    assert_rect(doc.info.annotations[0].rect, [40.0, 234.0, 136.0, 266.0]);
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        resized.save(format!("{dir}/image-signature-live-resize.png")).unwrap();
+    }
+    h.drop_at(end);
+    h.run_steps(3);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Resize comment"));
+
+    let start = at(&h, 130.0, 236.0);
+    h.drag_at(start);
+    h.run_steps(1);
+    for (x, y) in [(140.0, 180.0), (150.0, 140.0)] {
+        h.hover_at(at(&h, x, y));
+        h.run_steps(2);
+        let moving = h.render().unwrap();
+        assert!(pixel_at(&h, &moving, x, y)[..3].iter().all(|v| *v < 60), "ink follows each pointer position");
+        assert_green(pixel_at(&h, &moving, 130.0, 236.0));
+        assert_green(pixel_at(&h, &moving, x - 85.0, y));
+        for (hx, hy) in [
+            (x - 90.0, y + 30.0),
+            (x, y + 30.0),
+            (x + 90.0, y + 30.0),
+            (x + 90.0, y),
+            (x + 90.0, y - 30.0),
+            (x, y - 30.0),
+            (x - 90.0, y - 30.0),
+            (x - 90.0, y),
+        ] {
+            assert!(!has_blue_near(&moving, at(&h, hx, hy)), "moving hides the frame and all eight handles");
+        }
+        assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Resize comment"));
+        if y == 140.0
+            && let Ok(dir) = std::env::var("PDFCRAFT_SHOTS")
+        {
+            moving.save(format!("{dir}/image-signature-live-move.png")).unwrap();
+        }
+    }
+    let end = at(&h, 150.0, 140.0);
+    h.drop_at(end);
+    h.run_steps(2);
+    let released = h.render().unwrap();
+    assert!(has_blue_near(&released, at(&h, 240.0, 170.0)), "the frame returns immediately on release");
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Move comment"));
+    assert_eq!(doc.edit_generation(), generation + 2, "one edit for each completed gesture");
+    assert_rect(doc.info.annotations[0].rect, [60.0, 110.0, 240.0, 170.0]);
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)));
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        released.save(format!("{dir}/image-signature-move-released.png")).unwrap();
+    }
+    h.state_mut().undo();
+    h.state_mut().undo();
+    h.run_steps(3);
+    assert_rect(h.state().session.get(h.state().views[0].id).unwrap().info.annotations[0].rect, [40.0, 234.0, 136.0, 266.0]);
+    rendered_ink(&mut h, 90.0, 250.0);
+    click(&mut h, 90.0, 250.0);
+    h.drag_at(at(&h, 90.0, 250.0));
+    h.run_steps(1);
+    h.hover_at(at(&h, 150.0, 180.0));
+    rendered_ink(&mut h, 150.0, 180.0);
+    assert_eq!(
+        h.state().session.get(h.state().views[0].id).unwrap().can_undo(),
+        Some("Add signature"),
+        "moving preview is still read-only before Escape"
+    );
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().views[0].comments.gesture.is_none(), "Escape must cancel before releasing the mouse");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Add signature"), "Escape must not commit");
+    h.drop_at(at(&h, 150.0, 180.0));
+    h.run_steps(2);
+    assert!(h.state().views[0].comments.gesture.is_none());
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Add signature"), "Escape cancels without an undo step");
+    assert_rect(doc.info.annotations[0].rect, [40.0, 234.0, 136.0, 266.0]);
+    let cancelled = h.render().unwrap();
+    assert_green(pixel_at(&h, &cancelled, 150.0, 180.0));
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn embedded_image_signature_live_gestures_follow_document_and_view_rotation() {
+    let path = signature_file("live-rotations");
+    let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
+    for (document_rotation, view_rotation) in [(90, 0), (0, 90), (90, 270)] {
+        let mut h = harness();
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: document_rotation });
+        while h.state().views[0].rotation != view_rotation {
+            h.state_mut().views[0].rotate_view(true);
+        }
+        h.state_mut().set_option("zoom", "100").unwrap();
+        h.state_mut().signature = Some(SavedSig::Image(image.clone()));
+        h.state_mut().execute("sign.fill.signature");
+        h.run_steps(3);
+        click(&mut h, 40.0, 250.0);
+        rendered_ink(&mut h, 90.0, 250.0);
+        // Future placements may use a different signature: drag the PDF's embedded image.
+        h.state_mut().signature = None;
+        h.drag_at(at(&h, 136.0, 234.0));
+        h.run_steps(1);
+        let end = at(&h, 184.0, 228.0);
+        h.hover_at(end);
+        rendered_ink(&mut h, 160.0, 242.0);
+        let pixels = h.render().unwrap();
+        assert!(pixel_at(&h, &pixels, 58.0, 254.0)[..3].iter().all(|v| *v < 60), "asymmetric ink rotates during resize");
+        assert!(pixel_at(&h, &pixels, 58.0, 230.0)[..3].iter().all(|v| *v > 240), "alpha isn't flipped");
+        h.drop_at(end);
+        h.run_steps(3);
+        h.drag_at(at(&h, 112.0, 242.0));
+        h.run_steps(1);
+        h.hover_at(at(&h, 132.0, 142.0));
+        h.run_steps(2);
+        let pixels = h.render().unwrap();
+        assert!(pixel_at(&h, &pixels, 132.0, 142.0)[..3].iter().all(|v| *v < 60), "image moves before release");
+        assert!(pixel_at(&h, &pixels, 160.0, 242.0)[..3].iter().all(|v| *v > 240), "old ink is removed during movement");
+        assert!(!has_blue_near(&pixels, at(&h, 204.0, 166.0)));
+        h.drop_at(at(&h, 132.0, 142.0));
+        h.run_steps(2);
+        assert!(has_blue_near(&h.render().unwrap(), at(&h, 204.0, 166.0)));
+    }
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen() {
+    let path = signature_file("aspect");
+    let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
+    let mut h = harness();
+    h.state_mut().signature = Some(SavedSig::Image(image));
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 70.0, 210.0);
+    // Side handles stretch just their own axis; pointer movement along the other axis is ignored.
+    for (from, to, expected) in
+        [([166.0, 210.0], [214.0, 216.0], [70.0, 194.0, 214.0, 226.0]), ([142.0, 194.0], [150.0, 170.0], [70.0, 170.0, 214.0, 226.0])]
+    {
+        h.drag_at(at(&h, from[0], from[1]));
+        h.run_steps(1);
+        let end = at(&h, to[0], to[1]);
+        h.hover_at(end);
+        h.run_steps(2);
+        h.drop_at(end);
+        h.run_steps(3);
+        assert_rect(h.state().session.get(h.state().views[0].id).unwrap().info.annotations[0].rect, expected);
+    }
+    let bytes = h.state().session.get(h.state().views[0].id).unwrap().bytes.clone();
+    // Reopened PDFs have no saved signature setting: each corner must use the embedded 3:1 image,
+    // rather than the stretched 144:56 annotation rectangle.
+    for (hx, hy) in [(-1.0, -1.0), (1.0, -1.0), (-1.0, 1.0), (1.0, 1.0)] {
+        let mut h = harness_bytes(&bytes);
+        assert!(h.state().signature.is_none());
+        h.state_mut().views[0].comments.selected = Some((0, 0));
+        h.run_steps(3);
+        rendered_ink(&mut h, 142.0, 198.0);
+        let generation = h.state().session.get(h.state().views[0].id).unwrap().edit_generation();
+        let (x, y) = (if hx < 0.0 { 70.0 } else { 214.0 }, if hy < 0.0 { 170.0 } else { 226.0 });
+        h.drag_at(at(&h, x, y));
+        h.run_steps(1);
+        let end = at(&h, x + hx * 10.0, y + hy * 10.0);
+        h.hover_at(end);
+        let expected = [
+            if hx < 0.0 { 16.0 } else { 70.0 },
+            if hy < 0.0 { 160.0 } else { 170.0 },
+            if hx < 0.0 { 214.0 } else { 268.0 },
+            if hy < 0.0 { 226.0 } else { 236.0 },
+        ];
+        let ink_x = expected[0] + 198.0 * if hx < 0.0 { 0.15 } else { 0.85 };
+        let pixels = rendered_ink(&mut h, ink_x, (expected[1] + expected[3]) / 2.0);
+        assert!(has_blue_near(&pixels, at(&h, if hx < 0.0 { expected[0] } else { expected[2] }, if hy < 0.0 { expected[1] } else { expected[3] })));
+        let doc = h.state().session.get(h.state().views[0].id).unwrap();
+        assert_eq!(doc.edit_generation(), generation, "corner previews remain read-only");
+        assert_rect(doc.info.annotations[0].rect, [70.0, 170.0, 214.0, 226.0]);
+        if hx > 0.0
+            && hy < 0.0
+            && let Ok(dir) = std::env::var("PDFCRAFT_SHOTS")
+        {
+            pixels.save(format!("{dir}/image-signature-aspect-corner.png")).unwrap();
+        }
+        h.drop_at(end);
+        h.run_steps(3);
+        let doc = h.state().session.get(h.state().views[0].id).unwrap();
+        assert_rect(doc.info.annotations[0].rect, expected);
+        assert_eq!(doc.edit_generation(), generation + 1);
+        assert_eq!(doc.can_undo(), Some("Resize comment"));
+        assert!(((expected[2] - expected[0]) / (expected[3] - expected[1]) - 3.0).abs() < 0.001);
+        h.state_mut().undo();
+        h.run_steps(3);
+        assert_rect(h.state().session.get(h.state().views[0].id).unwrap().info.annotations[0].rect, [70.0, 170.0, 214.0, 226.0]);
+        h.state_mut().redo();
+        h.run_steps(3);
+        assert_rect(h.state().session.get(h.state().views[0].id).unwrap().info.annotations[0].rect, expected);
+    }
+    std::fs::remove_file(path).unwrap();
+}
+
 #[test]
 fn image_import_cancel_clear_and_errors_preserve_saved_signatures() {
     let path = signature_file("cancel");
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index fa57670f..b6b0ea73 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5213,9 +5213,9 @@ tier = "P0"
 milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.signature", "sign.fill.initials", "sign.fill.signature.change", "sign.fill.initials.change", "sign.fill.signature.remove", "sign.fill.initials.remove"]
-tools = ["fill_sign_add", "comment_edit"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save"]
-notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
+tools = ["fill_sign_add", "comment_edit", "comment_image_preview"]
+evidence = ["crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save"]
+notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
 
 [[feature]]
 id = "form.fill-sign-flatten"

From 2f42c743b903f59950111fdf496ecbe9195c0c23 Mon Sep 17 00:00:00 2001
From: MarekSpodBiedry <73122968+MarekSpodBiedry@users.noreply.github.com>
Date: Thu, 8 Oct 2026 23:29:59 +0200
Subject: [PATCH 016/149] Issue #157: the Windows portable zip keeps settings,
 logs and recovery beside pdfcraft.exe (#325)

* Issue #157: the Windows portable zip keeps settings, logs and recovery beside pdfcraft.exe

The portable zip had no portable.txt, and the app had no portable mode: it always wrote %APPDATA%\PdfCraft and %LOCALAPPDATA%\PdfCraft. Now portable.txt (or PdfCraft.portable) beside the executable puts the settings, log files, crash recovery and new digital IDs in PdfCraftData next to it, as PhotoCraft does, and the zip ships portable.txt. An unwritable PdfCraftData falls back to the per-user folders and says so.

* Issue #157: update ATTRIBUTION.toml SHA-256 for the translation catalogs this PR changes

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                    |  14 +--
 README.md                           |   4 +
 apps/pdfcraft/src/main.rs           |  21 +++-
 crates/ui-egui/src/i18n/cs.tsv      |   1 +
 crates/ui-egui/src/i18n/es.tsv      |   1 +
 crates/ui-egui/src/i18n/fr.tsv      |   1 +
 crates/ui-egui/src/i18n/ja.tsv      |   1 +
 crates/ui-egui/src/i18n/pt-br.tsv   |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv |   1 +
 crates/ui-egui/src/i18n/zh-hant.tsv |   1 +
 crates/ui-egui/src/lib.rs           |   1 +
 crates/ui-egui/src/portable.rs      | 171 ++++++++++++++++++++++++++++
 crates/ui-egui/src/recovery.rs      |   6 +-
 crates/ui-egui/src/sign_ui.rs       |   3 +-
 docs/development.md                 |   9 +-
 docs/releasing.md                   |   6 +-
 packaging/windows/package.ps1       |   6 +-
 packaging/windows/portable.txt      |   9 ++
 18 files changed, 239 insertions(+), 18 deletions(-)
 create mode 100644 crates/ui-egui/src/portable.rs
 create mode 100644 packaging/windows/portable.txt

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index b70f6b79..4cc867d7 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8792b00c7e9a12a247cbf6d4758d8583972f861010f4e4ed52949978e5a380e7"
+sha256 = "e14c411ac69fd96279de51aaaa9589b8810e2970c3c212585bf47104f7c2cbd7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9429421177790a0492b1513102823a9aa5dbd34c7a850a737792602d4d19b8d9"
+sha256 = "27715eb6c29938938a39880f5ab6f3b0aa60ba6d0940609af1bfb96f1fd124de"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9a655daa584e3a5d049dbaaa30229ae7a931984b0f1c7f0177fde2ccdd6804ca"
+sha256 = "3bc4e3c1d1a50c50d6be907f62e1fa2fd85ea719f1b65af21eeadcbbc7db5e44"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "777a7f441950714a61d41e5a44405209aa85bfdd4b46e27090544eb9122d715f"
+sha256 = "3a46800299b34558642676d0d67ff31619d8e9bbeb2ba83e713a108f544f2d82"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cb3759b57445a3948a707aaf9423338053c7e7ad68f19f52583527dae3dfabee"
+sha256 = "dad2013f25795cafc93d89c9ff4c0cc510ba844628b27469fe9b38c2fce5e0ea"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b131025cb6c14135440968f08ab6334d70dd3b20271539471878d3825ecc9629"
+sha256 = "c41079a024a360951e0f935b14b6d18a16c8478daac21bc7a1c57eb73b6b3590"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "c9879375eed52003bb16790e687808fe0d50dd9405390be383eab66cd513291c"
+sha256 = "f42c77a513e83f4d48e1792bcba8dfe60b7453daf1b240d0a7ffb6d276ce98e3"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/README.md b/README.md
index a80469bc..24db83c6 100644
--- a/README.md
+++ b/README.md
@@ -420,6 +420,10 @@ The honest assessment by area, what's lacking and where we're going are in **[RO
 
 Installers and executables are code-signed.
 
+The portable zip runs from any folder, a USB stick included. Its `portable.txt` keeps the settings,
+logs and crash recovery in a `PdfCraftData` folder next to `pdfcraft.exe`, so nothing is written to
+`%APPDATA%`; delete that file to use the normal per-user folders.
+
 The MSI installs for all users and requires administrator privileges. For unattended deployment
 without a desktop shortcut, run from an elevated terminal:
 
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 9bbf2f5a..bf3b4883 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -39,16 +39,24 @@ const APP_ICON_PNG: &[u8] = include_bytes!("../../../assets/app-icon/hicolor/256
 /// The app was called PrintCraft before; settings saved then are under this key.
 const LEGACY_STORAGE_KEY: &str = "printcraft";
 
-/// The settings folder: `app.ron` and the `logs` folder (docs/development.md). eframe would
-/// otherwise derive it from the app id; keep it under "PdfCraft".
+/// The settings folder: `app.ron` and the `logs` folder (docs/development.md). In portable mode
+/// it is `PdfCraftData` beside the executable (#157). eframe would otherwise derive it from the
+/// app id; keep it under "PdfCraft".
 fn settings_dir() -> Option<std::path::PathBuf> {
+    if let Some(dir) = pdfcraft_ui_egui::portable::data_dir() {
+        return Some(dir.to_path_buf());
+    }
     eframe::storage_dir("PdfCraft")
 }
 
 /// Move the settings and crash-recovery folders of the app's former name, PrintCraft, to the new
 /// name once, so an upgrade keeps recent files, preferences and unsaved work. Best effort: a
-/// folder is left alone when the new one already exists or the move fails.
+/// folder is left alone when the new one already exists or the move fails. A portable copy leaves
+/// the per-user folders alone.
 fn migrate_legacy_folders() {
+    if pdfcraft_ui_egui::portable::data_dir().is_some() {
+        return;
+    }
     let mut moves = vec![(eframe::storage_dir("PrintCraft"), settings_dir())];
     // Recovery lives in the settings folder except on Windows, where it is under %LOCALAPPDATA%.
     if cfg!(windows) {
@@ -173,6 +181,13 @@ fn main() -> eframe::Result {
             if let Some(dir) = pdfcraft_ui_egui::RecoveryStore::default_dir() {
                 app.enable_recovery(pdfcraft_ui_egui::RecoveryStore::new(dir));
             }
+            // A portable marker whose data folder can't be written (#157): say where settings went.
+            if let Some(w) = &pdfcraft_ui_egui::portable::current().unwritable {
+                app.notify_fmt(
+                    "Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.",
+                    &[("folder", &w.folder.display().to_string()), ("error", &w.error)],
+                );
+            }
             if create_images {
                 if let Err(e) = app.begin_image_import_paths(&files) {
                     app.notify(e);
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 1f37708f..704645f6 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -108,3 +108,4 @@
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Používá se, když PDF nepožaduje rozložení ani zvětšení. Plynulé posouvání mezi stránkami neskáče.
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Vyberte obrázek PNG nebo JPEG (nejvýše 4 MiB). Průhlednost bude zachována.
 	Couldn't import the signature image: {e}	Obrázek podpisu nelze importovat: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Přenosný režim je vypnutý: do složky {folder} nelze zapisovat ({error}). Nastavení se místo toho ukládá do vaší uživatelské složky.
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index f4a560c0..334c552a 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1619,6 +1619,7 @@
 	Created a comment summary	Se ha creado un resumen de comentarios
 	Couldn't open {name}: {e}	No se pudo abrir {name}: {e}
 	Couldn't read {name}: {e}	No se pudo leer {name}: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	El modo portátil está desactivado: no se puede escribir en {folder} ({error}). La configuración se guarda en tu carpeta de usuario.
 	Couldn't save: {e}	No se pudo guardar: {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	La descarga de archivos adjuntos en la versión web llegará con M3.10 ({n} bytes listos)
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 28391f9a..01ef070d 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1560,6 +1560,7 @@
 	Created a comment summary	Un résumé des commentaires a été créé
 	Couldn't open {name}: {e}	Impossible d'ouvrir {name} : {e}
 	Couldn't read {name}: {e}	Impossible de lire {name} : {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Le mode portable est désactivé : impossible d'écrire dans {folder} ({error}). Les réglages sont conservés dans votre dossier utilisateur.
 	Couldn't save: {e}	Impossible d'enregistrer : {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Le téléchargement des pièces jointes sur le web arrivera avec M3.10 ({n} octets prêts)
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 342955dc..0e2fb086 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1625,6 +1625,7 @@
 	Created a comment summary	注釈の一覧を作成しました
 	Couldn't open {name}: {e}	{name} を開けませんでした: {e}
 	Couldn't read {name}: {e}	{name} を読み取れませんでした: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	ポータブルモードは無効です: {folder} に書き込めません ({error})。設定は代わりにユーザーフォルダーに保存されます。
 	Couldn't save: {e}	保存できませんでした: {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Web 版の添付ファイルのダウンロードは M3.10 で対応予定です（{n} バイト準備済み）
 	`{command}` {when}	`{command}`: {when}
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 0cbc9a88..7637345c 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -62,3 +62,4 @@
 	Auto	Automático
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Escolha uma imagem PNG ou JPEG (até 4 MiB). A transparência é preservada.
 	Couldn't import the signature image: {e}	Não foi possível importar a imagem da assinatura: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	O modo portátil está desativado: não é possível gravar em {folder} ({error}). As configurações ficam na sua pasta de usuário.
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 583acd5f..e7b99f87 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -1576,6 +1576,7 @@
 	Created a comment summary	已创建注释摘要
 	Couldn't open {name}: {e}	无法打开{name}：{e}
 	Couldn't read {name}: {e}	无法读取{name}：{e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	便携模式已关闭：无法写入{folder}（{error}）。设置改为保存在你的用户文件夹中。
 	Couldn't save: {e}	无法保存：{e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Web 端附件下载将于 M3.10 到来（{n} 字节已就绪）
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index adea61bb..d1762eb7 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1534,6 +1534,7 @@
 	Created a comment summary	已建立註解摘要
 	Couldn't open {name}: {e}	無法開啟{name}：{e}
 	Couldn't read {name}: {e}	無法讀取{name}：{e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	可攜模式已關閉：無法寫入{folder}（{error}）。設定改為儲存在你的使用者資料夾中。
 	Couldn't save: {e}	無法儲存：{e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Web 端附件下載將於 M3.10 到來（{n} 位元組已就緒）
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index f1e857f5..9e29b3c0 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -84,6 +84,7 @@ pub mod i18n;
 
 /// The longest author name kept (Preferences ▸ Identity, restored settings).
 pub(crate) const MAX_AUTHOR_CHARS: usize = 200;
+pub mod portable;
 mod protect;
 mod recovery;
 #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/ui-egui/src/portable.rs b/crates/ui-egui/src/portable.rs
new file mode 100644
index 00000000..fefa268e
--- /dev/null
+++ b/crates/ui-egui/src/portable.rs
@@ -0,0 +1,171 @@
+//! Portable mode (#157): a marker file beside the executable ([`MARKERS`]) keeps the settings,
+//! log files, crash-recovery autosaves and new digital IDs in `<exe dir>/PdfCraftData`, so a
+//! portable copy (on a USB stick, say) writes nothing to `%APPDATA%` or `%LOCALAPPDATA%`. The
+//! Windows portable zip ships with `portable.txt`; the MSI doesn't. PhotoCraft uses the same
+//! scheme (`photocraft/apps/photocraft/src/app_dirs.rs`).
+//!
+//! If that folder can't be written (read-only medium, Program Files), portable mode stays off, the
+//! per-user folders are used and the app says why.
+
+use std::path::{Path, PathBuf};
+use std::sync::OnceLock;
+
+/// Files beside the executable that switch on portable mode (either one; contents are ignored).
+pub const MARKERS: [&str; 2] = ["portable.txt", "PdfCraft.portable"];
+/// The data folder created beside the executable in portable mode.
+pub const DATA_DIR: &str = "PdfCraftData";
+
+/// The outcome of looking for a portable marker.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Portable {
+    /// `<exe dir>/PdfCraftData` when portable mode is on, `None` otherwise.
+    pub dir: Option<PathBuf>,
+    /// Set when a marker was found but its data folder can't be written.
+    pub unwritable: Option<Unwritable>,
+}
+
+/// A marker was found, but the data folder beside it can't be created or written.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Unwritable {
+    pub marker: PathBuf,
+    pub folder: PathBuf,
+    /// The operating system's error text.
+    pub error: String,
+}
+
+impl std::fmt::Display for Unwritable {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "portable mode is off: {} was found, but {} can't be written ({}); settings are kept in the user folder instead",
+            self.marker.display(),
+            self.folder.display(),
+            self.error
+        )
+    }
+}
+
+/// Portable mode for this process, resolved once (the check probes the disk).
+pub fn current() -> &'static Portable {
+    static CURRENT: OnceLock<Portable> = OnceLock::new();
+    CURRENT.get_or_init(|| {
+        let exe = std::env::current_exe().ok();
+        let portable = resolve(exe.as_deref().and_then(Path::parent));
+        if let Some(dir) = &portable.dir {
+            log::info!("portable mode: settings are kept in {}", dir.display());
+        }
+        if let Some(unwritable) = &portable.unwritable {
+            log::warn!("{unwritable}");
+        }
+        portable
+    })
+}
+
+/// The portable data folder, when portable mode is on.
+pub fn data_dir() -> Option<&'static Path> {
+    current().dir.as_deref()
+}
+
+/// Look for a marker in `exe_dir` and, when one is there, create its data folder beside it.
+pub fn resolve(exe_dir: Option<&Path>) -> Portable {
+    let Some((exe_dir, marker)) = exe_dir.and_then(|d| find_marker(d).map(|m| (d, m))) else {
+        return Portable::default();
+    };
+    let folder = exe_dir.join(DATA_DIR);
+    match ensure_writable(&folder) {
+        Ok(()) => Portable { dir: Some(folder), unwritable: None },
+        Err(e) => Portable { dir: None, unwritable: Some(Unwritable { marker, folder, error: e.to_string() }) },
+    }
+}
+
+/// The first marker file in `exe_dir`, if any. A folder with a marker's name is not a marker.
+pub fn find_marker(exe_dir: &Path) -> Option<PathBuf> {
+    MARKERS.iter().map(|m| exe_dir.join(m)).find(|p| p.is_file())
+}
+
+/// Create `dir` and prove a file can be written in it (a folder can exist yet be read-only).
+fn ensure_writable(dir: &Path) -> std::io::Result<()> {
+    std::fs::create_dir_all(dir)?;
+    let probe = dir.join(".write-test");
+    std::fs::write(&probe, b"")?;
+    // A leftover probe is harmless; don't fail portable mode over it.
+    let _ = std::fs::remove_file(&probe);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    fn temp(tag: &str) -> PathBuf {
+        static N: AtomicUsize = AtomicUsize::new(0);
+        let d = std::env::temp_dir().join(format!("pdfcraft-portable-{tag}-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[test]
+    fn no_marker_leaves_portable_mode_off() {
+        let exe = temp("off");
+        assert_eq!(resolve(Some(&exe)), Portable::default());
+        assert!(!exe.join(DATA_DIR).exists(), "no data folder without a marker");
+        let _ = std::fs::remove_dir_all(&exe);
+    }
+
+    #[test]
+    fn either_marker_keeps_the_data_beside_the_exe() {
+        for marker in MARKERS {
+            let exe = temp("on");
+            std::fs::write(exe.join(marker), b"").unwrap();
+            let p = resolve(Some(&exe));
+            assert_eq!(p.unwritable, None, "{marker}");
+            let dir = p.dir.unwrap();
+            assert_eq!(dir, exe.join(DATA_DIR));
+            assert!(dir.is_dir(), "the data folder is created");
+            assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 0, "the write probe is removed");
+            let _ = std::fs::remove_dir_all(&exe);
+        }
+    }
+
+    #[test]
+    fn an_existing_data_folder_is_reused() {
+        let exe = temp("reuse");
+        std::fs::write(exe.join("portable.txt"), b"PdfCraft portable mode").unwrap();
+        std::fs::create_dir_all(exe.join(DATA_DIR)).unwrap();
+        std::fs::write(exe.join(DATA_DIR).join("app.ron"), b"()").unwrap();
+        assert_eq!(resolve(Some(&exe)).dir, Some(exe.join(DATA_DIR)));
+        assert_eq!(std::fs::read(exe.join(DATA_DIR).join("app.ron")).unwrap(), b"()", "existing settings are kept");
+        let _ = std::fs::remove_dir_all(&exe);
+    }
+
+    #[test]
+    fn a_marker_folder_is_not_a_marker() {
+        let exe = temp("dir-marker");
+        std::fs::create_dir_all(exe.join("portable.txt")).unwrap();
+        assert_eq!(resolve(Some(&exe)), Portable::default());
+        let _ = std::fs::remove_dir_all(&exe);
+    }
+
+    #[test]
+    fn unwritable_data_folder_turns_portable_mode_off_and_says_why() {
+        let exe = temp("unwritable");
+        std::fs::write(exe.join("portable.txt"), b"").unwrap();
+        // A file where the data folder should go: it can't be created, on every platform.
+        std::fs::write(exe.join(DATA_DIR), b"in the way").unwrap();
+        let p = resolve(Some(&exe));
+        assert_eq!(p.dir, None);
+        let unwritable = p.unwritable.unwrap();
+        assert_eq!(unwritable.marker, exe.join("portable.txt"));
+        assert_eq!(unwritable.folder, exe.join(DATA_DIR));
+        let message = unwritable.to_string();
+        assert!(message.contains("portable mode is off") && message.contains("can't be written"), "{message}");
+        let _ = std::fs::remove_dir_all(&exe);
+    }
+
+    #[test]
+    fn no_exe_dir_leaves_portable_mode_off() {
+        assert_eq!(resolve(None), Portable::default());
+    }
+}
diff --git a/crates/ui-egui/src/recovery.rs b/crates/ui-egui/src/recovery.rs
index 8c2217e7..df6b8bdd 100644
--- a/crates/ui-egui/src/recovery.rs
+++ b/crates/ui-egui/src/recovery.rs
@@ -40,10 +40,14 @@ impl RecoveryStore {
         Self { dir: dir.into() }
     }
 
-    /// The platform's per-user data folder: `~/Library/Application Support/PdfCraft/Recovery`
+    /// `Recovery` in the portable data folder in portable mode ([`crate::portable`]), otherwise
+    /// the platform's per-user data folder: `~/Library/Application Support/PdfCraft/Recovery`
     /// (macOS), `%LOCALAPPDATA%\PdfCraft\Recovery` (Windows), or
     /// `$XDG_DATA_HOME/pdfcraft/recovery` / `~/.local/share/pdfcraft/recovery` (others).
     pub fn default_dir() -> Option<PathBuf> {
+        if let Some(dir) = crate::portable::data_dir() {
+            return Some(dir.join("Recovery"));
+        }
         let env = |k: &str| std::env::var_os(k).filter(|v| !v.is_empty()).map(PathBuf::from);
         if cfg!(target_os = "macos") {
             env("HOME").map(|h| h.join("Library/Application Support/PdfCraft/Recovery"))
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/sign_ui.rs
index a43ff478..a7dc7fb4 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/sign_ui.rs
@@ -157,7 +157,8 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, p
     }
 }
 
-/// Where new digital IDs are saved: next to the recovery folder (`…/PdfCraft/Digital IDs`).
+/// Where new digital IDs are saved: next to the recovery folder (`…/PdfCraft/Digital IDs`, or
+/// `PdfCraftData/Digital IDs` in portable mode).
 fn id_dir() -> Option<PathBuf> {
     crate::recovery::RecoveryStore::default_dir().and_then(|d| d.parent().map(|p| p.join("Digital IDs")))
 }
diff --git a/docs/development.md b/docs/development.md
index adcfd973..aa46e0cd 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -8,9 +8,12 @@ collects what the desktop app reads from its environment and where it writes its
 The desktop app writes its `log` records to standard error and to `logs/pdfcraft.log` in its
 settings folder, next to `app.ron`: Linux and FreeBSD `~/.local/share/pdfcraft/logs/` (or
 `$XDG_DATA_HOME/pdfcraft/logs/`), macOS `~/Library/Application Support/PdfCraft/logs/`, Windows
-`%APPDATA%\PdfCraft\data\logs\`. A start from a desktop menu, Finder or the Start menu has no
-terminal, so this file is what to attach to a bug report: a failed autosave, a page that would not
-render, a render worker that could not start and the report of an internal error all land there.
+`%APPDATA%\PdfCraft\data\logs\`. In portable mode (a `portable.txt` file next to the executable, as
+the Windows portable zip ships) the settings folder is `PdfCraftData\` beside the executable, and
+crash recovery and new digital IDs go there too. A start from a desktop menu, Finder or the Start
+menu has no terminal, so this file is what to attach to a bug report: a failed autosave, a page that
+would not render, a render worker that could not start and the report of an internal error all land
+there.
 Each launch moves the previous log to `pdfcraft.1.log` (and that one to `pdfcraft.2.log`), so the
 log of a run that crashed survives the next start. The file stops growing at 16 MiB. `--version`
 writes no file.
diff --git a/docs/releasing.md b/docs/releasing.md
index 1b561644..ec5e3b1d 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -113,8 +113,10 @@ neither the MSI nor the portable zip needs the Visual C++ redistributable.
   child process before signing, so the MSI isn't held open when signtool runs. The ARM64 install
   smoke test checks that both all-users shortcuts point at the installed `pdfcraft.exe` and are
   removed on uninstall, and that `INSTALLDESKTOPSHORTCUT=0` skips the desktop one.
-- The portable zip holds both executables, the README, the licences, and the OFL licence of each
-  embedded craft-fonts family.
+- The portable zip holds both executables, the README, the licences, the OFL licence of each
+  embedded craft-fonts family, and `portable.txt`. That marker beside `pdfcraft.exe` keeps the
+  settings, logs, crash recovery and new digital IDs in `PdfCraftData\` next to the exe instead of
+  `%APPDATA%` and `%LOCALAPPDATA%` (`crates/ui-egui/src/portable.rs`).
 - **Signing:** `packaging/windows/sign.ps1` signs both executables and the MSI with `signtool`
   (SHA-256, RFC 3161 timestamp), from a `.pfx` (`WINDOWS_CERTIFICATE`) or Azure Trusted Signing
   (`AZURE_*`), whichever is configured. It is the one place to change when signing changes.
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index f6fc6a47..14588668 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -5,7 +5,7 @@
 .DESCRIPTION
   Produces, in $env:DIST (default: dist/release):
     pdfcraft-<version>-windows-<arch>.msi            per-machine installer (WiX v5)
-    pdfcraft-<version>-windows-<arch>-portable.zip   pdfcraft.exe + pdfcraft-cli.exe
+    pdfcraft-<version>-windows-<arch>-portable.zip   pdfcraft.exe + pdfcraft-cli.exe + portable.txt
 
   The binaries link the C runtime statically (+crt-static), so neither the MSI nor the portable
   zip needs the Visual C++ redistributable. Signing is delegated to sign.ps1 (skipped with a
@@ -122,6 +122,10 @@ if ($env:CRAFT_FONTS_DIR) {
     if (Test-Path $ofl) { Copy-Item $ofl (Join-Path $Portable "OFL-$($_.Name).txt") }
   }
 }
+# portable.txt beside pdfcraft.exe switches on portable mode: settings, logs, recovery files and new
+# digital IDs go to PdfCraftData\ next to the exe instead of %APPDATA% (#157; see
+# crates/ui-egui/src/portable.rs).
+Copy-Item (Join-Path $PSScriptRoot 'portable.txt') $Portable
 $Zip = Join-Path $Dist "pdfcraft-$Version-windows-$Arch-portable.zip"
 Remove-Item -Force $Zip -ErrorAction SilentlyContinue
 Compress-Archive -Path $Portable -DestinationPath $Zip
diff --git a/packaging/windows/portable.txt b/packaging/windows/portable.txt
new file mode 100644
index 00000000..9586f930
--- /dev/null
+++ b/packaging/windows/portable.txt
@@ -0,0 +1,9 @@
+PdfCraft portable mode
+
+While this file sits next to pdfcraft.exe, PdfCraft keeps its settings, log files, crash-recovery
+autosaves and new digital IDs in the PdfCraftData folder beside it, and writes nothing to
+%APPDATA% or %LOCALAPPDATA%. Copy the whole folder to move PdfCraft with its settings.
+
+Delete this file to use the normal per-user folders (%APPDATA%\PdfCraft and
+%LOCALAPPDATA%\PdfCraft) instead. If PdfCraftData can't be written (for example on a read-only
+drive), PdfCraft says so and uses the per-user folders instead.

From f88a59f762ae3e69b98027dc2f262c4069823078 Mon Sep 17 00:00:00 2001
From: Sameh Elhawary <basio20044@gmail.com>
Date: Fri, 9 Oct 2026 00:42:13 +0300
Subject: [PATCH 017/149] M10.2: Create PDF from multiple files, edited as
 pages in the Organize grid (#361)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M10.2: create PDF from multiple files

Create a PDF ▸ Multiple files takes PDFs, images and .txt files, lets the
user reorder them, and makes one combined PDF (a bookmark and an optional
page range per file) or one PDF per file in a chosen folder, never
overwriting what is there.

- create: source_kind() tells PDFs, images and text apart (moved from the shell)
- engine: Session::convert_to_pdf, shared by Open, the dialog and the tool
- automation: doc_create_multiple (combine or separate)
- ui: Multiple files dialog reusing the Combine files list; translations
- parity entry and ROADMAP updated; catalog hashes refreshed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M10.2: multiple files open in the page grid; insert files at any gap

Create a PDF ▸ Multiple files now opens the picked files as one unsaved
document in the Organize page grid instead of a file-list dialog: pages
are removed and reordered there, and Save pages writes what is shown.

- grid: a "+" at every gap inserts files right there; Save pages button
- insert from file: several files in order, images and text converted,
  inserted pages selected
- the file-list dialog is removed; one PDF per file stays in the
  doc_create_multiple tool
- translations, catalog hashes, parity notes and ROADMAP updated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: insert files by dropping them on the page grid

On desktop, PDFs, images and .txt files dropped on the Organize page grid
are inserted at the gap under the pointer, in order, and selected; a
dropped file still opens as a document everywhere else.

winit does not report the pointer while files are dragged over the
window on every platform, so a drop waits (up to a second) for the
pointer to show up and otherwise appends at the end.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: files dragged over the page grid follow the pointer (macOS)

winit sends no pointer moves while files are dragged over the window, so
egui kept the place the pointer entered at: the insertion bar froze there
and the files were inserted there. During a file drag the pointer is now
read from AppKit (safe objc2 calls, crates already in the tree) and fed
to egui, so the bar and a "+" badge follow the pointer and the files go
where they are released.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                         |  16 +--
 Cargo.lock                               |   3 +
 ROADMAP.md                               |   4 +-
 crates/automation/src/lib.rs             |  67 ++++++++++++
 crates/automation/src/tools.rs           |  13 +++
 crates/automation/tests/automation.rs    |  56 ++++++++++
 crates/create/src/lib.rs                 |  39 +++++++
 crates/create/src/tests.rs               |  15 +++
 crates/engine/src/catalog.rs             |   2 +-
 crates/engine/src/commands.rs            |   1 +
 crates/engine/src/lib.rs                 |  22 +++-
 crates/engine/src/tests.rs               |  40 +++++++
 crates/ui-egui/Cargo.toml                |   7 ++
 crates/ui-egui/src/canvas.rs             |  90 +++++++++++++++-
 crates/ui-egui/src/commands.rs           |   1 +
 crates/ui-egui/src/create_multiple_ui.rs |  50 +++++++++
 crates/ui-egui/src/create_ui.rs          |  28 +----
 crates/ui-egui/src/drag_pointer.rs       |  25 +++++
 crates/ui-egui/src/editing.rs            |   4 +
 crates/ui-egui/src/files.rs              |  77 +++++++++++---
 crates/ui-egui/src/i18n/cs.tsv           |   1 +
 crates/ui-egui/src/i18n/es.tsv           |  11 ++
 crates/ui-egui/src/i18n/fr.tsv           |  11 ++
 crates/ui-egui/src/i18n/ja.tsv           |  11 ++
 crates/ui-egui/src/i18n/pt-br.tsv        |   1 +
 crates/ui-egui/src/i18n/te.tsv           |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv      |  11 ++
 crates/ui-egui/src/i18n/zh-hant.tsv      |  11 ++
 crates/ui-egui/src/lib.rs                |  81 +++++++++++++++
 crates/ui-egui/tests/commands.rs         |   1 +
 crates/ui-egui/tests/create.rs           |  60 +++++++++++
 crates/ui-egui/tests/editing.rs          | 127 +++++++++++++++++++++++
 parity/acrobat-features.toml             |  24 ++---
 33 files changed, 846 insertions(+), 65 deletions(-)
 create mode 100644 crates/ui-egui/src/create_multiple_ui.rs
 create mode 100644 crates/ui-egui/src/drag_pointer.rs

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 4cc867d7..930a4449 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e14c411ac69fd96279de51aaaa9589b8810e2970c3c212585bf47104f7c2cbd7"
+sha256 = "b2f1f0417e41ab934c7b979b2fd2b3b69cab52a193d035122a58a4d00f2c0566"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "27715eb6c29938938a39880f5ab6f3b0aa60ba6d0940609af1bfb96f1fd124de"
+sha256 = "448db933a78de5e51dfae62d9a34293da0ead418ecafeec94bf08c50510f41d8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3bc4e3c1d1a50c50d6be907f62e1fa2fd85ea719f1b65af21eeadcbbc7db5e44"
+sha256 = "6accf0a44ae93cab6fde939458c0dd651687ce36760270bd3646b94668db1cda"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3a46800299b34558642676d0d67ff31619d8e9bbeb2ba83e713a108f544f2d82"
+sha256 = "56159c856872ae5a6a521b02cf6dc682702ece1dff27a8cee0bd5fad24d3e627"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "dad2013f25795cafc93d89c9ff4c0cc510ba844628b27469fe9b38c2fce5e0ea"
+sha256 = "e275641e7a20916219762730e18160edba7c4d0ac7fd963338ee1fb95ec1c355"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "c41079a024a360951e0f935b14b6d18a16c8478daac21bc7a1c57eb73b6b3590"
+sha256 = "8ef5004a37a5998f789d62d708a7d1973ea5b0e3a606319449597d2908423853"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1c8ce042942ac9169458e79261fc1d0647d4a3734e548799bf19b98eb314b9a2"
+sha256 = "ac7789cda9148a2b75c4e5156de9bdd6ddbcc5b6405f25abf06fcf8d861c6853"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f42c77a513e83f4d48e1792bcba8dfe60b7453daf1b240d0a7ffb6d276ce98e3"
+sha256 = "69dc55fca4e7c03b7442e86ab0274b2840e8185f5ad1382a1d54929fb6b8924c"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/Cargo.lock b/Cargo.lock
index 6c6e75c2..d34be389 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3793,6 +3793,9 @@ dependencies = [
  "image",
  "js-sys",
  "log",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
  "pdfcraft-cos",
  "pdfcraft-engine",
  "pdfcraft-fonts",
diff --git a/ROADMAP.md b/ROADMAP.md
index be04ea2f..99dcfad5 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -99,7 +99,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 17% | 210–420 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M8 | Security + redaction | 100–180 | 66% | 35–65 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize. Missing: certificate security, redaction codes and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 55% | 70–125 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL. Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
-| M10 | OCR, create, export, print | 200–350 | 33% | 130–235 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, CUPS spooler, print-ready PDF). Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print. Missing: OCR languages beyond Latin, editable-text OCR output, Office export/import, Windows/web printing |
+| M10 | OCR, create, export, print | 200–350 | 33% | 130–235 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, CUPS spooler, print-ready PDF). Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; Create PDF from multiple files (PDFs, images and text, edited as pages in the grid). Missing: OCR languages beyond Latin, editable-text OCR output, Office export/import, Windows/web printing |
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 165–290 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 23% | 155–295 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 33–66 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
@@ -127,6 +127,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
+- **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature placement):** Image signatures and initials preview at the pointer at their actual page size, including zoom and document/view rotation. A successful placement switches to Select with the new annotation selected; stamp resize handles use the existing engine edit, automation tool and undo history while preserving the appearance. Synthetic rendered UI and automation tests verify positioning, one placement per selection, resizing, undo/redo and save/reopen. Milestone and overall effort estimates unchanged.
 - **2026-10-08 (M5.7, image signatures):** Fill & Sign imports local PNG/JPEG signatures and initials through the Image tab, with previews, local persistence and undoable placement. The shared engine validates bounded images and preserves transparency and orientation; `fill_sign_add` accepts an image path. Synthetic UI and automation tests cover cancellation, invalid input, settings, undo/redo and save/reopen rendering. Overall effort estimate unchanged (about 30–35%).
 
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 4f072b42..9ddff4bf 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -202,6 +202,7 @@ impl Automation {
             "page_insert_file" => self.insert_file(&a)?,
             "page_extract" => self.page_extract(&a)?,
             "doc_combine" => self.doc_combine(&a)?,
+            "doc_create_multiple" => self.doc_create_multiple(&a)?,
             "doc_split" => self.doc_split(&a)?,
             "edit_undo" => {
                 let id = self.doc(&a)?.id;
@@ -1142,6 +1143,63 @@ impl Automation {
         Ok(result)
     }
 
+    fn doc_create_multiple(&mut self, a: &Args) -> Result<Value> {
+        let paths = a.strs("paths")?;
+        if paths.is_empty() || paths.len() > pdfcraft_engine::MAX_CREATE_FILES {
+            return Err(ToolError::InvalidArgs(format!("paths must list 1 to {} files", pdfcraft_engine::MAX_CREATE_FILES)));
+        }
+        let separate = match a.opt_str("mode")? {
+            None | Some("combine") => false,
+            Some("separate") => true,
+            Some(m) => return Err(ToolError::InvalidArgs(format!("mode must be \"combine\" or \"separate\", not {m:?}"))),
+        };
+        if separate {
+            return self.create_separate(a, &paths);
+        }
+        let ranges: Vec<Option<String>> = match a.get("pages") {
+            None | Some(Value::Null) => vec![None; paths.len()],
+            Some(Value::Array(v)) if v.len() == paths.len() => v.iter().map(|x| x.as_str().map(str::to_owned)).collect(),
+            Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
+        };
+        let mut sources = Vec::new();
+        for (p, range) in paths.into_iter().zip(ranges) {
+            let path = self.resolve(p, false)?;
+            let bytes = std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?;
+            let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+            let (_, pdf) = self.session.convert_to_pdf(&name, &Arc::new(bytes)).map_err(failed)?;
+            let title = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+            sources.push((title, pdf, range));
+        }
+        let bytes = self.session.combine_ranges(&sources).map_err(failed)?;
+        self.deliver(a, "Combined", bytes)
+    }
+
+    /// One PDF per file, written into `out_dir`; a file that fails doesn't stop the others.
+    fn create_separate(&mut self, a: &Args, paths: &[&str]) -> Result<Value> {
+        let dir = self.resolve(a.str("out_dir").map_err(|_| ToolError::InvalidArgs("mode \"separate\" needs out_dir".into()))?, true)?;
+        std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+        let mut out = Vec::new();
+        for &p in paths {
+            let converted = self.resolve(p, false).map_err(|e| e.to_string()).and_then(|src| {
+                let bytes = std::fs::read(&src).map_err(|e| format!("{}: {e}", src.display()))?;
+                let name = src.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                let stem = src.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document".into());
+                let (kind, pdf) = self.session.convert_to_pdf(&name, &Arc::new(bytes)).map_err(|e| e.to_string())?;
+                Ok((kind, stem, pdf))
+            });
+            out.push(match converted {
+                Ok((pdfcraft_engine::SourceKind::Pdf, ..)) => json!({ "path": p, "skipped": "already a PDF" }),
+                Ok((_, stem, pdf)) => {
+                    let target = unused(&dir, &stem);
+                    write_atomic(&target, &pdf)?;
+                    json!({ "path": p, "output": target.to_string_lossy(), "bytes": pdf.len() })
+                }
+                Err(e) => json!({ "path": p, "error": e }),
+            });
+        }
+        Ok(json!({ "files": out }))
+    }
+
     fn page_extract(&mut self, a: &Args) -> Result<Value> {
         let doc = self.doc(a)?;
         let (id, name) = (doc.id, format!("{} (extract)", doc.name));
@@ -1736,6 +1794,15 @@ fn child(dir: &Path, name: &str) -> PathBuf {
     dir.join(safe)
 }
 
+/// `<stem>.pdf` in `dir`, or `<stem> (2).pdf` and so on when that name is taken.
+fn unused(dir: &Path, stem: &str) -> PathBuf {
+    let first = child(dir, &format!("{stem}.pdf"));
+    if !first.exists() {
+        return first;
+    }
+    (2..10_000u32).map(|n| child(dir, &format!("{stem} ({n}).pdf"))).find(|p| !p.exists()).unwrap_or(first)
+}
+
 /// Write via a temporary file in the same directory, then rename over the target.
 fn write_atomic(path: &Path, bytes: &[u8]) -> Result<()> {
     write_atomic_with(path, bytes, staging_suffixes())
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 6096c646..3d47c83c 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -197,6 +197,19 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["paths"],
             )),
+        t("doc_create_multiple", "Create PDF from multiple files", "Convert several files (PDFs, PNG/JPEG/JPEG 2000/TIFF/GIF/BMP images, .txt files) to PDF in one run. mode \"combine\" (default) joins them, in order, into one PDF with a bookmark per file; pages optionally chooses each file's pages, in step with paths (a range such as \"1-3, 6\" or null). mode \"separate\" writes one PDF per file into out_dir (files that are already PDFs are skipped; existing files are never overwritten) and reports each file's result.")
+            .cmd("create.multiple")
+            .with(schema(
+                json!({
+                    "paths": { "type": "array", "items": { "type": "string" }, "minItems": 1, "maxItems": pdfcraft_engine::MAX_CREATE_FILES },
+                    "mode": { "type": "string", "enum": ["combine", "separate"] },
+                    "pages": { "type": "array", "items": { "type": ["string", "null"] } },
+                    "out": save_out.clone(),
+                    "open": open.clone(),
+                    "out_dir": { "type": "string", "description": "Folder for mode \"separate\"." },
+                }),
+                &["paths"],
+            )),
         t("doc_split", "Split a document", "Split into several files written to out_dir: every N pages, before given pages, at top-level bookmarks (bookmarks: true; files named after them), or by file size (max_mb). Files are <name>-partK.pdf.")
             .cmd("page.split")
             .with(schema(
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 3ea77ab3..38f3a1d2 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1510,6 +1510,62 @@ fn creating_and_reducing_through_tools() {
     assert!(matches!(a.call("doc_create", &json!({ "from": "images", "paths": ["notes.txt"] })), Err(ToolError::Failed(_))));
 }
 
+#[test]
+fn creating_from_multiple_files_through_tools() {
+    let dir = workdir("create-multiple");
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 4, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.set_depth(png::BitDepth::Eight);
+        enc.write_header().unwrap().write_image_data(&[100; 4 * 2 * 3]).unwrap();
+    }
+    std::fs::write(dir.join("scan.png"), png).unwrap();
+    std::fs::write(dir.join("notes.txt"), "hello").unwrap();
+    std::fs::write(dir.join("report.docx"), b"PK\x03\x04").unwrap();
+    let mut a = auto(&dir);
+
+    // Combine: every file converted, in the order given, with a bookmark per file.
+    let made = ok(
+        &mut a,
+        "doc_create_multiple",
+        json!({ "paths": ["notes.txt", "a.pdf", "scan.png"], "pages": [null, "3", null], "out": "all.pdf", "open": true }),
+    );
+    let doc = made["document"]["doc"].as_u64().unwrap();
+    assert_eq!(page_text(&mut a, doc), ["hello", "Page 3", ""]);
+    let titles: Vec<String> = ok(&mut a, "bookmark_list", json!({ "doc": doc }))["bookmarks"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|b| b["title"].as_str().unwrap().to_string())
+        .collect();
+    assert_eq!(titles, ["notes", "a", "scan"]);
+    assert!(dir.join("all.pdf").is_file());
+    // A file that can't be converted fails the whole combine, naming it.
+    let err = a.call("doc_create_multiple", &json!({ "paths": ["a.pdf", "report.docx"] })).unwrap_err();
+    assert!(matches!(&err, ToolError::Failed(m) if m.contains("report.docx") && m.contains("can't be converted")), "{err}");
+    assert!(matches!(a.call("doc_create_multiple", &json!({ "paths": [] })), Err(ToolError::InvalidArgs(_))));
+    assert!(matches!(a.call("doc_create_multiple", &json!({ "paths": ["a.pdf"], "mode": "zip" })), Err(ToolError::InvalidArgs(_))));
+    assert!(matches!(a.call("doc_create_multiple", &json!({ "paths": ["a.pdf"], "mode": "separate" })), Err(ToolError::InvalidArgs(_))));
+
+    // Separate: one PDF per file; PDFs are skipped, a bad file doesn't stop the rest, and an
+    // existing file is never overwritten.
+    std::fs::create_dir_all(dir.join("out")).unwrap();
+    std::fs::write(dir.join("out/notes.pdf"), b"mine").unwrap();
+    let args = json!({ "paths": ["notes.txt", "report.docx", "a.pdf", "scan.png", "missing.txt"], "mode": "separate", "out_dir": "out" });
+    let made = ok(&mut a, "doc_create_multiple", args);
+    let files = made["files"].as_array().unwrap();
+    assert!(files[0]["output"].as_str().unwrap().ends_with("notes (2).pdf"), "{files:?}");
+    assert!(files[1]["error"].as_str().unwrap().contains("can't be converted"));
+    assert_eq!(files[2]["skipped"], "already a PDF");
+    assert!(files[3]["output"].as_str().unwrap().ends_with("scan.pdf"));
+    assert!(files[4]["error"].is_string());
+    assert_eq!(std::fs::read(dir.join("out/notes.pdf")).unwrap(), b"mine");
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "out/notes (2).pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(page_text(&mut a, reopened), ["hello"]);
+    assert!(!dir.join("out/a.pdf").exists());
+}
+
 #[test]
 fn creating_images_with_dpi_through_tools() {
     let dir = workdir("image-dpi");
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index 267e7af2..ad213c08 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -374,6 +374,45 @@ fn tiff_pages(name: &str, bytes: &[u8]) -> Result<Vec<Embedded>, CreateError> {
     Ok(out)
 }
 
+/// What a file picked for Create is, by its bytes (and, for text, its name).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SourceKind {
+    Pdf,
+    Image,
+    Text,
+}
+
+/// File extensions Create converts to PDF (images and plain text).
+pub const CONVERTIBLE: [&str; 12] = ["png", "jpg", "jpeg", "tif", "tiff", "gif", "bmp", "jp2", "j2k", "jpx", "txt", "text"];
+
+fn is_image(bytes: &[u8]) -> bool {
+    bytes.starts_with(&[0xFF, 0xD8])
+        || bytes.starts_with(b"\x89PNG\r\n\x1a\n")
+        || bytes.starts_with(b"II*\0")
+        || bytes.starts_with(b"MM\0*")
+        || bytes.starts_with(b"GIF8")
+        // JPEG 2000: a JP2 file or a raw codestream.
+        || bytes.starts_with(JP2_SIGNATURE)
+        || bytes.starts_with(&[0xFF, 0x4F, 0xFF, 0x51])
+        // BMP: "BM" and a known header size (so text starting with "BM" stays text).
+        || (bytes.starts_with(b"BM")
+            && bytes.get(14..18).and_then(|h| <[u8; 4]>::try_from(h).ok()).is_some_and(|h| matches!(u32::from_le_bytes(h), 12 | 40 | 52 | 56 | 108 | 124)))
+}
+
+/// Whether `bytes` named `name` is a PDF, an image Create can embed, or plain text (a `.txt` or
+/// `.text` file). `None` for anything else.
+pub fn source_kind(name: &str, bytes: &[u8]) -> Option<SourceKind> {
+    let head = bytes.get(..bytes.len().min(1024)).unwrap_or_default();
+    if head.windows(5).any(|w| w == b"%PDF-") {
+        return Some(SourceKind::Pdf);
+    }
+    if is_image(bytes) {
+        return Some(SourceKind::Image);
+    }
+    let lower = name.to_ascii_lowercase();
+    (lower.ends_with(".txt") || lower.ends_with(".text")).then_some(SourceKind::Text)
+}
+
 /// Detect the image format from its bytes; a TIFF may hold several pages.
 fn embed(name: &str, bytes: &[u8]) -> Result<Vec<Embedded>, CreateError> {
     if bytes.starts_with(&[0xFF, 0xD8]) {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index f4dd33b9..9edc3fac 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -258,3 +258,18 @@ fn jpeg_2000_images_are_embedded_as_is() {
     let doc = reopen(&from_images(&[("raw.j2k".into(), siz)]).unwrap());
     assert_eq!(media(&pages(&doc)[0])[2], 64.0);
 }
+
+#[test]
+fn source_kind_tells_pdfs_images_and_text_apart() {
+    assert_eq!(source_kind("a.bin", b"%PDF-1.7\n"), Some(SourceKind::Pdf));
+    assert_eq!(source_kind("a.txt", b"junk before\n%PDF-1.4"), Some(SourceKind::Pdf), "a header after leading junk");
+    assert_eq!(source_kind("a", &png_bytes(false)), Some(SourceKind::Image));
+    assert_eq!(source_kind("a.txt", &jpeg_bytes()), Some(SourceKind::Image), "bytes win over the name");
+    assert_eq!(source_kind("notes.TXT", b"hello"), Some(SourceKind::Text));
+    assert_eq!(source_kind("notes.text", b""), Some(SourceKind::Text));
+    // Text that merely starts like a BMP stays text; a truncated BMP header is not an image.
+    assert_eq!(source_kind("b.txt", b"BMW drivers"), Some(SourceKind::Text));
+    assert_eq!(source_kind("b.bmp", b"BM"), None);
+    assert_eq!(source_kind("a.docx", b"PK\x03\x04"), None);
+    assert_eq!(source_kind("", b""), None);
+}
diff --git a/crates/engine/src/catalog.rs b/crates/engine/src/catalog.rs
index 9e774127..c553675c 100644
--- a/crates/engine/src/catalog.rs
+++ b/crates/engine/src/catalog.rs
@@ -149,7 +149,7 @@ pub static TOOL_GROUPS: &[ToolGroup] = &[
             title: "Create from",
             items: &[
                 item("Single file", "file-input", "create.file", Ready),
-                item("Multiple files", "files", "create.multiple", Planned("M10")),
+                item("Multiple files", "files", "create.multiple", Ready),
                 item("Images", "image", "create.images", Ready),
                 item("Clipboard", "copy-plus", "create.clipboard", Ready),
                 item("Blank page", "file-plus-2", "create.blank", Ready),
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 49b63273..331652e4 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -162,6 +162,7 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("page.cut", "Cut pages", None, None, Assembly, "scissors"),
     c("page.paste", "Paste pages", None, None, Assembly, "clipboard-paste"),
     c("create.file", "Create PDF from file…", FILE, None, Nothing, "file-input"),
+    c("create.multiple", "Create PDF from multiple files…", FILE, None, Nothing, "files"),
     c("create.images", "Create PDF from images…", FILE, None, Nothing, "image"),
     c("create.clipboard", "Create PDF from clipboard", FILE, None, Nothing, "copy-plus"),
     c("page.combine", "Combine files…", FILE, None, Nothing, "files"),
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index a92a6848..98a46934 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -32,7 +32,7 @@ pub use pdfcraft_organize::LabelStyle;
 pub use pdfcraft_organize::view::{InitialView, Layout as InitialLayout, Magnification, Navigation};
 
 pub use pdfcraft_cos::Algorithm;
-pub use pdfcraft_create::ImageResolution;
+pub use pdfcraft_create::{CONVERTIBLE, ImageResolution, SourceKind, source_kind};
 pub use pdfcraft_edit::{
     Added, AddedImage, AddedText, Align as TextAlign, Background, Content as AddedContent, Family as FontFamily, HeaderFooter, MarkKind, Watermark,
 };
@@ -1735,6 +1735,9 @@ pub fn guard<T>(f: impl FnOnce() -> T) -> Result<T, String> {
     })
 }
 
+/// The most files Create ▸ Multiple files takes in one run.
+pub const MAX_CREATE_FILES: usize = 1000;
+
 /// Parse another PDF to copy pages from.
 fn open_source(name: &str, bytes: &Arc<Vec<u8>>) -> Result<pdfcraft_cos::Document, EditError> {
     open_source_with(name, bytes, None)
@@ -2541,6 +2544,23 @@ impl Session {
         self.write_new(&pdfcraft_create::from_text(title, text, pdfcraft_create::LETTER, 11.0)?)
     }
 
+    /// Convert a file Create understands (an image or plain text) to PDF bytes; a PDF is checked
+    /// (it must open and allow copying pages) and returned as it is.
+    pub fn convert_to_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<(SourceKind, Arc<Vec<u8>>), EditError> {
+        let Some(kind) = source_kind(name, bytes) else {
+            return Err(EditError::Source(format!("{name}: this file type can't be converted; use a PDF, an image or a .txt file")));
+        };
+        let title = name.rsplit_once('.').map_or(name, |(s, _)| s);
+        // Image decoders read untrusted bytes: a panic in one must not take the app down.
+        let created = guard(|| match kind {
+            SourceKind::Pdf => open_source(name, bytes).map(|_| bytes.clone()),
+            SourceKind::Image => self.create_from_images(&[(name.to_string(), bytes.to_vec())]),
+            SourceKind::Text => self.create_from_text(title, &String::from_utf8_lossy(bytes)),
+        })
+        .map_err(|_| EditError::Source(format!("{name}: the file could not be read")))?;
+        Ok((kind, created?))
+    }
+
     /// Reduce File Size: Acrobat's defaults (images above 225 ppi to 150 ppi, JPEG medium
     /// quality; thumbnails dropped), identical resources merged, unused objects dropped, objects
     /// packed into compressed object streams. Returns the bytes and how many objects were
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 07f6b9af..9759a72d 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -297,6 +297,46 @@ fn combine_extract_split_and_insert_from_file() {
     assert!(matches!(bad, Err(EditError::Source(_))));
 }
 
+/// A minimal baseline JPEG (headers only; the data is embedded as is).
+fn jpeg_bytes() -> Vec<u8> {
+    let mut v = vec![0xFF, 0xD8];
+    v.extend_from_slice(&[0xFF, 0xE0, 0, 16, b'J', b'F', b'I', b'F', 0, 1, 1, 1, 0x01, 0x2C, 0x01, 0x2C, 0, 0]);
+    v.extend_from_slice(&[0xFF, 0xC0, 0, 17, 8, 0, 2, 0, 3, 3, 1, 0x11, 0, 2, 0x11, 1, 3, 0x11, 1]);
+    v.extend_from_slice(&[0xFF, 0xD9]);
+    v
+}
+
+#[test]
+fn mixed_files_convert_and_combine_in_order() {
+    let mut s = Session::new();
+    let pdf = Arc::new(fixture(2));
+    let (kind, same) = s.convert_to_pdf("a.pdf", &pdf).unwrap();
+    assert_eq!(kind, SourceKind::Pdf);
+    assert!(Arc::ptr_eq(&same, &pdf), "a PDF is passed through untouched");
+    let (kind, image) = s.convert_to_pdf("scan.jpg", &Arc::new(jpeg_bytes())).unwrap();
+    assert_eq!(kind, SourceKind::Image);
+    let (kind, text) = s.convert_to_pdf("notes.txt", &Arc::new(b"hello".to_vec())).unwrap();
+    assert_eq!(kind, SourceKind::Text);
+    let combined = s.combine_ranges(&[("notes".into(), text, None), ("a".into(), pdf, Some("2".into())), ("scan".into(), image, None)]).unwrap();
+    let id = s.open_new("Combined.pdf", combined).unwrap();
+    assert_eq!(page_texts(&s, id), ["hello", "Page 2", ""]);
+    assert_eq!(outline_titles(&s.get(id).unwrap().info.outline), ["notes→1", "a→2", "scan→3"]);
+}
+
+#[test]
+fn files_that_cannot_be_converted_are_refused_clearly() {
+    let s = Session::new();
+    let err = s.convert_to_pdf("report.docx", &Arc::new(b"PK\x03\x04".to_vec())).unwrap_err();
+    assert_eq!(err, EditError::Source("report.docx: this file type can't be converted; use a PDF, an image or a .txt file".into()));
+    assert!(matches!(s.convert_to_pdf("empty", &Arc::new(Vec::new())), Err(EditError::Source(_))));
+    // Damaged inputs of a known type fail with an error, not a panic.
+    assert!(s.convert_to_pdf("bad.png", &Arc::new(b"\x89PNG\r\n\x1a\nnope".to_vec())).is_err());
+    assert!(s.convert_to_pdf("bad.jpg", &Arc::new(vec![0xFF, 0xD8, 0xFF])).is_err());
+    assert!(s.convert_to_pdf("bad.pdf", &Arc::new(b"%PDF-1.7 nope".to_vec())).is_err());
+    let err = s.convert_to_pdf("locked.pdf", &protected("pw", "o", -1)).unwrap_err();
+    assert_eq!(err, EditError::Source("locked.pdf: it is password-protected".into()));
+}
+
 fn protected(user: &str, owner: &str, permissions: i32) -> Arc<Vec<u8>> {
     let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(2))).unwrap();
     doc.set_encryption(&pdfcraft_cos::NewEncryption {
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 6a0b9fca..f255d70e 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -36,6 +36,13 @@ pollster = "1.0"
 # Checks that an installed fallback font parses and has the glyphs; the same skrifa egui uses.
 skrifa = "0.44"
 
+[target.'cfg(target_os = "macos")'.dependencies]
+# Where the pointer is while files are dragged over the window (winit doesn't say): safe AppKit
+# calls only. All three are already in the tree through arboard and rfd.
+objc2 = "0.6"
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSEvent", "NSScreen"] }
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "NSArray", "NSGeometry"] }
+
 [target.'cfg(windows)'.dependencies]
 # Auto interface language: the Windows display language, without starting a process.
 sys-locale = "0.3"
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 42313e86..875528a8 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -280,12 +280,22 @@ pub struct DocView {
     pub(crate) signature_drag: crate::signature_drag::SignatureDrag,
     /// A non-edit action requested by the organize toolbar, handled by the app.
     pub pending_action: Option<ViewAction>,
+    /// The grid gap the next inserted files go to (set by a "+" between pages); otherwise they
+    /// go after the selection.
+    pub insert_at: Option<usize>,
+    /// The page-grid gap under the pointer this frame (where dropped files go), when it can
+    /// take pages.
+    pub grid_gap: Option<usize>,
 }
 
 /// Organize-toolbar actions that need the app (file pickers, new tabs, dialogs).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum ViewAction {
     InsertFromFile,
+    /// Insert files at a gap of the page grid (0 = before the first page).
+    InsertFromFileAt(usize),
+    /// Save the document as the grid shows it.
+    Save,
     Extract,
     Split,
     /// Copy the selected pages (Cut also deletes them).
@@ -370,6 +380,8 @@ impl DocView {
             image_selection: None,
             block_drag: None,
             pending_action: None,
+            insert_at: None,
+            grid_gap: None,
             comments: Default::default(),
             measure: Default::default(),
             forms: Default::default(),
@@ -1173,7 +1185,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     // No dialog, close prompt or palette over the page: only then does page input count.
     let unobstructed = app.dialog.is_none() && app.close_request.is_none() && !app.palette_open;
     if view.organize {
-        organize_grid(view, info, &doc.renderer, doc.allows_assembly(), unobstructed, ui, &t);
+        organize_grid(view, info, &doc.renderer, doc.allows_assembly(), doc.dirty, unobstructed, ui, &t);
         return;
     }
 
@@ -2484,7 +2496,7 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
 }
 
 /// The organize toolbar: page operations on the selection (Acrobat's Organize Pages bar).
-fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, ui: &mut egui::Ui, t: &Tokens) {
+fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, ui: &mut egui::Ui, t: &Tokens) {
     let targets = view.target_pages();
     let n = info.pages.len();
     let (first, last) = (targets.first().copied().unwrap_or(0), targets.last().copied().unwrap_or(0));
@@ -2558,6 +2570,11 @@ fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, ui: &mut
                 if widgets::ghost_button(ui, "x", tl!("Close")).on_hover_text(tl!("Back to the document")).clicked() {
                     view.organize = false;
                 }
+                // What the grid shows is what is saved.
+                let save = ui.add_enabled_ui(dirty, |ui| widgets::pill_button(ui, tl!("Save pages"), true)).inner;
+                if save.on_hover_text(tl!("Save these pages as one PDF")).on_disabled_hover_text(tl!("No changes to save")).clicked() {
+                    view.pending_action = Some(ViewAction::Save);
+                }
             });
         });
     });
@@ -2598,11 +2615,36 @@ fn drop_gap(cells: &[(usize, Rect)], p: Pos2) -> Option<usize> {
     Some(if p.x < r.center().x { *i } else { i + 1 })
 }
 
-fn organize_grid(view: &mut DocView, info: &DocInfo, pool: &RenderPool, editable: bool, auto_scroll_enabled: bool, ui: &mut egui::Ui, t: &Tokens) {
+/// A "+" on a gap of the page grid: insert files there. Returns whether it was clicked.
+fn gap_button(ui: &mut egui::Ui, gap: usize, at: Pos2, height: f32, label: String, t: &Tokens) -> bool {
+    let resp = ui.interact(Rect::from_center_size(at, Vec2::splat(22.0)), ui.id().with(("org-gap", gap)), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label.clone()));
+    let hot = resp.hovered();
+    if hot {
+        ui.painter().line_segment([pos2(at.x, at.y - height / 2.0), pos2(at.x, at.y + height / 2.0)], Stroke::new(3.0, t.accent));
+    }
+    ui.painter().circle(at, 9.0, if hot { t.accent } else { t.chrome }, Stroke::new(1.0, if hot { t.accent } else { t.border }));
+    let ink = Stroke::new(1.5, if hot { Color32::WHITE } else { t.text_muted });
+    ui.painter().line_segment([at - vec2(4.0, 0.0), at + vec2(4.0, 0.0)], ink);
+    ui.painter().line_segment([at - vec2(0.0, 4.0), at + vec2(0.0, 4.0)], ink);
+    resp.on_hover_text(label).clicked()
+}
+
+#[allow(clippy::too_many_arguments)]
+fn organize_grid(
+    view: &mut DocView,
+    info: &DocInfo,
+    pool: &RenderPool,
+    editable: bool,
+    dirty: bool,
+    auto_scroll_enabled: bool,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+) {
     let ppp = ui.ctx().pixels_per_point();
     let cell = vec2(190.0, 250.0);
     let mut open_page = None;
-    organize_toolbar(view, info, editable, ui, t);
+    organize_toolbar(view, info, editable, dirty, ui, t);
     let viewport = ui.available_rect_before_wrap();
     view.viewport_screen = viewport;
     let auto_delta = if auto_scroll_enabled {
@@ -2696,6 +2738,25 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, pool: &RenderPool, editable
                 });
             }
         }
+        // Between pages (and at both ends): insert files right there.
+        if editable && !middle_gesture && view.org_drag.is_none() {
+            let mid = |r: &Rect| r.top() + 16.0 + (cell.y - 56.0) / 2.0;
+            for (i, c) in &cells {
+                let label = info
+                    .pages
+                    .get(*i)
+                    .map(|p| crate::i18n::fmt(tl!("Insert a file before page {label}"), &[("label", &p.label)]))
+                    .unwrap_or_default();
+                if gap_button(ui, *i, pos2(c.left(), mid(c)), cell.y - 56.0, label, t) {
+                    view.pending_action = Some(ViewAction::InsertFromFileAt(*i));
+                }
+            }
+            if let Some((i, c)) = cells.last()
+                && gap_button(ui, i + 1, pos2(c.right(), mid(c)), cell.y - 56.0, tl!("Insert a file at the end").to_string(), t)
+            {
+                view.pending_action = Some(ViewAction::InsertFromFileAt(i + 1));
+            }
+        }
         // While dragging: the gap the pages would go to, drawn as a bar.
         if let (Some(pages), Some(p)) = (view.org_drag.clone(), ui.input(|i| i.pointer.hover_pos())) {
             if let Some(gap) = drop_gap(&cells, p) {
@@ -2730,6 +2791,27 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, pool: &RenderPool, editable
             view.org_drag = None;
         }
     });
+    // Files dragged in from outside go to the gap under the pointer. Some platforms don't say
+    // where the pointer is until the files are dropped; then the whole grid is the target.
+    let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| viewport.contains(*p));
+    view.grid_gap = pointer.filter(|_| editable && view.org_drag.is_none()).and_then(|p| drop_gap(&cells, p));
+    if editable && ui.input(|i| !i.raw.hovered_files.is_empty()) {
+        let painter = ui.painter().with_clip_rect(viewport);
+        painter.rect_stroke(viewport.shrink(2.0), CornerRadius::same(6), Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
+        if let Some(gap) = view.grid_gap {
+            let at = cells.iter().find(|(i, _)| *i == gap).map(|(_, r)| (r.left() + 3.0, r.y_range()));
+            if let Some((x, row)) = at.or(cells.last().map(|(_, r)| (r.right() - 3.0, r.y_range()))) {
+                painter.line_segment([pos2(x, row.min + 10.0), pos2(x, row.max - 10.0)], Stroke::new(3.0, t.accent));
+            }
+        }
+        // A "+" that follows the pointer.
+        if let Some(p) = pointer {
+            let at = p + vec2(16.0, 16.0);
+            painter.circle_filled(at, 9.0, t.accent);
+            painter.line_segment([at - vec2(4.0, 0.0), at + vec2(4.0, 0.0)], Stroke::new(1.5, Color32::WHITE));
+            painter.line_segment([at - vec2(0.0, 4.0), at + vec2(0.0, 4.0)], Stroke::new(1.5, Color32::WHITE));
+        }
+    }
     view.auto_scroll.paint(ui, viewport);
     let s = THUMB_W * ppp / info.pages.iter().map(|p| p.width).fold(1.0, f32::max);
     let queue: Vec<RenderRequest> = (0..info.pages.len())
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index d26b0494..86d3a74c 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -476,6 +476,7 @@ impl PdfCraftApp {
             }
             "create.blank" => self.create_blank(),
             "create.file" => self.open_dialog(),
+            "create.multiple" => self.create_multiple_dialog(),
             "create.images" => self.create_from_images_dialog(),
             "create.clipboard" => self.create_from_clipboard(),
             "optimize.reduce" => self.reduce_file_size(),
diff --git a/crates/ui-egui/src/create_multiple_ui.rs b/crates/ui-egui/src/create_multiple_ui.rs
new file mode 100644
index 00000000..f297306b
--- /dev/null
+++ b/crates/ui-egui/src/create_multiple_ui.rs
@@ -0,0 +1,50 @@
+//! Create a PDF ▸ Multiple files: the picked PDFs, images and text files become one new,
+//! unsaved document, shown in the page grid: remove pages, insert more files between pages,
+//! reorder, then save what the grid shows.
+
+use std::sync::Arc;
+
+use crate::PdfCraftApp;
+
+fn stem(name: &str) -> &str {
+    name.rsplit_once('.').map_or(name, |(s, _)| s)
+}
+
+impl PdfCraftApp {
+    /// Convert the picked files, join them in the order picked, and open the result in the page
+    /// grid. A file that can't be converted is left out (and named in a notice).
+    pub(crate) fn stage_create_multiple(&mut self, files: Vec<(String, Vec<u8>)>) {
+        let max = pdfcraft_engine::MAX_CREATE_FILES;
+        let too_many = files.len() > max;
+        let (mut sources, mut refused) = (Vec::new(), Vec::new());
+        for (name, bytes) in files.into_iter().take(max) {
+            match self.session.convert_to_pdf(&name, &Arc::new(bytes)) {
+                Ok((_, pdf)) => sources.push((stem(&name).to_string(), pdf, None)),
+                Err(_) => refused.push(name),
+            }
+        }
+        if sources.is_empty() {
+            self.notify_tr("None of those files can be made into a PDF; use PDFs, images or .txt files");
+            return;
+        }
+        let bytes = match self.session.combine_ranges(&sources) {
+            Ok(bytes) => bytes,
+            Err(e) => return self.notify_fmt("Couldn't create a PDF: {e}", &[("e", &e.to_string())]),
+        };
+        let n = sources.len().to_string();
+        let message = if !refused.is_empty() {
+            crate::i18n::fmt(tl!("Created a PDF from {n} files; left out: {names}"), &[("n", &n), ("names", &refused.join(", "))])
+        } else if too_many {
+            crate::i18n::fmt(tl!("Created a PDF from the first {n} files"), &[("n", &n)])
+        } else {
+            crate::i18n::fmt(tl!("Created a PDF from {n} files"), &[("n", &n)])
+        };
+        let before = self.views.len();
+        self.open_created("Combined.pdf", bytes, &message);
+        if self.views.len() > before
+            && let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
+        {
+            view.organize = true;
+        }
+    }
+}
diff --git a/crates/ui-egui/src/create_ui.rs b/crates/ui-egui/src/create_ui.rs
index 48c8a1cb..9e2c30b5 100644
--- a/crates/ui-egui/src/create_ui.rs
+++ b/crates/ui-egui/src/create_ui.rs
@@ -41,20 +41,7 @@ pub(crate) fn image_import_body(ui: &mut egui::Ui, app: &mut PdfCraftApp) -> (bo
 }
 
 /// File types Open accepts besides PDF (converted on open).
-pub const CONVERTIBLE: [&str; 12] = ["png", "jpg", "jpeg", "tif", "tiff", "gif", "bmp", "jp2", "j2k", "jpx", "txt", "text"];
-
-fn is_image(bytes: &[u8]) -> bool {
-    bytes.starts_with(&[0xFF, 0xD8])
-        || bytes.starts_with(b"\x89PNG\r\n\x1a\n")
-        || bytes.starts_with(b"II*\0")
-        || bytes.starts_with(b"MM\0*")
-        || bytes.starts_with(b"GIF8")
-        // JPEG 2000: a JP2 file or a raw codestream.
-        || bytes.starts_with(&[0, 0, 0, 0x0C, b'j', b'P', b' ', b' '])
-        || bytes.starts_with(&[0xFF, 0x4F, 0xFF, 0x51])
-        // BMP: "BM" and a known header size (so text starting with "BM" stays text).
-        || (bytes.starts_with(b"BM") && bytes.get(14..18).is_some_and(|h| matches!(u32::from_le_bytes([h[0], h[1], h[2], h[3]]), 12 | 40 | 52 | 56 | 108 | 124)))
-}
+pub use pdfcraft_engine::CONVERTIBLE;
 
 /// What Create ▸ Clipboard found on the clipboard.
 #[derive(Clone, Debug, PartialEq)]
@@ -101,18 +88,11 @@ impl PdfCraftApp {
     /// Convert a non-PDF file (image, text) into a new tab. Returns `None` when `bytes` is not
     /// something Create understands (the caller then tries to open it as a PDF).
     pub(crate) fn open_converted(&mut self, name: &str, bytes: &[u8]) -> Option<Result<(), String>> {
-        let head = &bytes[..bytes.len().min(1024)];
-        if head.windows(5).any(|w| w == b"%PDF-") {
+        use pdfcraft_engine::SourceKind;
+        if !matches!(pdfcraft_engine::source_kind(name, bytes), Some(SourceKind::Image | SourceKind::Text)) {
             return None;
         }
-        let created = if is_image(bytes) {
-            self.session.create_from_images(&[(name.to_string(), bytes.to_vec())])
-        } else if name.to_ascii_lowercase().ends_with(".txt") {
-            let text = String::from_utf8_lossy(bytes);
-            self.session.create_from_text(stem(name), &text)
-        } else {
-            return None;
-        };
+        let created = self.session.convert_to_pdf(name, &Arc::new(bytes.to_vec())).map(|(_, pdf)| pdf);
         Some(self.open_created_bytes(&format!("{}.pdf", stem(name)), created.map_err(|e| e.to_string())))
     }
 
diff --git a/crates/ui-egui/src/drag_pointer.rs b/crates/ui-egui/src/drag_pointer.rs
new file mode 100644
index 00000000..898d319f
--- /dev/null
+++ b/crates/ui-egui/src/drag_pointer.rs
@@ -0,0 +1,25 @@
+//! Where the pointer is while files are dragged over the window. The windowing layer reports
+//! that a file hovers, but not where, and sends no pointer moves until the drag ends; the
+//! system has to be asked.
+
+/// The pointer in this window's coordinates (egui points), when the system can tell.
+#[cfg(target_os = "macos")]
+pub(crate) fn in_window(ctx: &egui::Context) -> Option<egui::Pos2> {
+    use objc2_app_kit::{NSEvent, NSScreen};
+    // AppKit's screen list is only for the main thread (where egui runs).
+    let mtm = objc2::MainThreadMarker::new()?;
+    // Screen coordinates start at the bottom-left of the first screen; windows at their top-left.
+    let top = NSScreen::screens(mtm).firstObject()?.frame().size.height;
+    let pointer = NSEvent::mouseLocation();
+    let inner = ctx.input(|i| i.viewport().inner_rect)?;
+    // egui's points are the system's, divided by the zoom factor.
+    let zoom = ctx.zoom_factor().max(0.01) as f64;
+    let (x, y) = (pointer.x / zoom, (top - pointer.y) / zoom);
+    let pos = egui::pos2(x as f32 - inner.min.x, y as f32 - inner.min.y);
+    (pos.x.is_finite() && pos.y.is_finite()).then_some(pos)
+}
+
+#[cfg(not(target_os = "macos"))]
+pub(crate) fn in_window(_ctx: &egui::Context) -> Option<egui::Pos2> {
+    None
+}
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index a1f08844..a28a5485 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -123,6 +123,10 @@ impl PdfCraftApp {
         }
         match self.views.get_mut(i).and_then(|v| v.pending_action.take()) {
             Some(crate::canvas::ViewAction::InsertFromFile) => self.insert_from_file_dialog(),
+            Some(crate::canvas::ViewAction::InsertFromFileAt(at)) => self.insert_from_file_at(Some(at)),
+            Some(crate::canvas::ViewAction::Save) => {
+                self.save_active(SaveTarget::InPlace);
+            }
             Some(crate::canvas::ViewAction::Extract) => self.dialog = Some(crate::Dialog::Extract),
             Some(crate::canvas::ViewAction::Split) => self.dialog = Some(crate::Dialog::Split),
             Some(crate::canvas::ViewAction::CopyPages { cut }) => self.copy_pages(cut),
diff --git a/crates/ui-egui/src/files.rs b/crates/ui-egui/src/files.rs
index 9d4e10f4..c14dd6ac 100644
--- a/crates/ui-egui/src/files.rs
+++ b/crates/ui-egui/src/files.rs
@@ -17,6 +17,18 @@ pub enum FilePurpose {
     ReplacePages,
     /// Scan & OCR ▸ Recognize text in multiple files.
     Ocr,
+    /// Create a PDF ▸ Multiple files (PDFs, images and text).
+    CreateMultiple,
+}
+
+/// The picker for `purpose`: PDFs, and for Create and Insert also what they convert.
+fn files_picker(purpose: FilePurpose) -> rfd::AsyncFileDialog {
+    let dialog = rfd::AsyncFileDialog::new();
+    if !matches!(purpose, FilePurpose::CreateMultiple | FilePurpose::InsertPages) {
+        return dialog.add_filter("PDF", &["pdf"]);
+    }
+    let all: Vec<&str> = std::iter::once("pdf").chain(pdfcraft_engine::CONVERTIBLE).collect();
+    dialog.add_filter(tl!("PDF, images and text"), &all).add_filter("PDF", &["pdf"])
 }
 
 /// The Replace Pages dialog: the chosen file and the ranges (1-based, inclusive).
@@ -130,23 +142,37 @@ impl PdfCraftApp {
         self.pick_files(FilePurpose::Combine, true);
     }
 
+    /// Create a PDF ▸ Multiple files: ask for the files to convert.
+    pub fn create_multiple_dialog(&mut self) {
+        self.pick_files(FilePurpose::CreateMultiple, true);
+    }
+
     /// Scan & OCR ▸ Recognize text ▸ In multiple files: ask for the PDFs.
     pub fn ocr_files_dialog(&mut self) {
         self.pick_files(FilePurpose::Ocr, true);
     }
 
-    /// Ask for a PDF whose pages to insert after the selection (Organize ▸ Insert from file).
+    /// Ask for files whose pages to insert after the selection (Organize ▸ Insert from file).
     pub fn insert_from_file_dialog(&mut self) {
-        if self.active.is_none() {
+        self.insert_from_file_at(None);
+    }
+
+    /// Ask for files to insert at grid gap `at` (0 = before the first page), or after the
+    /// selection.
+    pub(crate) fn insert_from_file_at(&mut self, at: Option<usize>) {
+        let Some(i) = self.active else {
             self.notify_tr("Open a document first");
             return;
+        };
+        if let Some(v) = self.views.get_mut(i) {
+            v.insert_at = at;
         }
-        self.pick_files(FilePurpose::InsertPages, false);
+        self.pick_files(FilePurpose::InsertPages, true);
     }
 
     fn pick_files(&mut self, purpose: FilePurpose, multiple: bool) {
         #[cfg(not(target_arch = "wasm32"))]
-        self.pick(crate::pickers::PickFor::Files(purpose), rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]), multiple);
+        self.pick(crate::pickers::PickFor::Files(purpose), files_picker(purpose), multiple);
         #[cfg(target_arch = "wasm32")]
         {
             let requests = self.requests.clone();
@@ -155,7 +181,7 @@ impl PdfCraftApp {
             // the browser has finished reading the file (#167).
             let request = self.file_request(purpose, Vec::new());
             wasm_bindgen_futures::spawn_local(async move {
-                let dialog = rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]);
+                let dialog = files_picker(purpose);
                 let handles = if multiple { dialog.pick_files().await.unwrap_or_default() } else { dialog.pick_file().await.into_iter().collect() };
                 let mut files = Vec::new();
                 for h in handles {
@@ -286,17 +312,14 @@ impl PdfCraftApp {
     pub fn use_files(&mut self, purpose: FilePurpose, files: Vec<(String, Vec<u8>)>) {
         match purpose {
             FilePurpose::Combine => self.stage_combine(files),
-            FilePurpose::InsertPages => {
-                for (name, bytes) in files {
-                    self.insert_pages_from(&name, bytes);
-                }
-            }
+            FilePurpose::InsertPages => self.insert_files(files),
             FilePurpose::ReplacePages => {
                 if let Some((name, bytes)) = files.into_iter().next() {
                     self.start_replace(name, bytes);
                 }
             }
             FilePurpose::Ocr => self.ocr_files(files),
+            FilePurpose::CreateMultiple => self.stage_create_multiple(files),
         }
     }
 
@@ -326,11 +349,37 @@ impl PdfCraftApp {
         self.dialog = Some(crate::Dialog::ReplacePages);
     }
 
-    /// Insert all pages of a PDF after the organize selection (or the current page).
+    /// Insert all pages of a file after the organize selection (or the current page).
     pub fn insert_pages_from(&mut self, name: &str, bytes: Vec<u8>) {
-        let Some(i) = self.active else { return };
-        let at = self.views[i].target_pages().last().map(|p| p + 1).unwrap_or(0);
-        self.apply_edit(Edit::InsertPagesFrom { name: name.to_string(), bytes: Arc::new(bytes), pages: None, at });
+        self.insert_files(vec![(name.to_string(), bytes)]);
+    }
+
+    /// Insert the pages of `files` (PDFs, images, text), in order, at the gap a "+" in the page
+    /// grid chose, or else after the selection (or the current page); then select them.
+    pub fn insert_files(&mut self, files: Vec<(String, Vec<u8>)>) {
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return };
+        let (id, chosen) = (view.id, view.insert_at.take());
+        let after = view.target_pages().last().map_or(0, |p| p + 1);
+        let count = self.session.get(id).map_or(0, |d| d.info.pages.len());
+        let start = chosen.unwrap_or(after).min(count);
+        let mut at = start;
+        for (name, bytes) in files {
+            let converted =
+                self.session.convert_to_pdf(&name, &Arc::new(bytes)).and_then(|(_, pdf)| Ok((self.session.page_count_of(&name, &pdf)?, pdf)));
+            match converted {
+                Ok((pages, bytes)) => {
+                    if self.apply_edit(Edit::InsertPagesFrom { name, bytes, pages: None, at }) {
+                        at = at.saturating_add(pages);
+                    }
+                }
+                Err(e) => self.notify_error(e),
+            }
+        }
+        if at > start
+            && let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
+        {
+            view.select_pages(&(start..at).collect::<Vec<_>>());
+        }
     }
 
     /// Copy the selected pages (or the current page) into a new unsaved document tab.
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 704645f6..c1e69d9f 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -33,6 +33,7 @@
 	New blank PDF	Nový prázdný dokument PDF
 	Create PDF from file…	Vytvořit PDF ze souboru…
 	Create PDF from images…	Vytvořit PDF z obrázků…
+	Create PDF from multiple files…	Vytvořit PDF z více souborů…
 	Create PDF from clipboard	Vytvořit PDF ze schránky
 	Combine files…	Sloučit soubory…
 	Save	Uložit
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 334c552a..abdcd16e 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -26,6 +26,7 @@
 	New blank PDF	Nuevo PDF en blanco
 	Create PDF from file…	Crear PDF a partir de un archivo…
 	Create PDF from images…	Crear PDF a partir de imágenes…
+	Create PDF from multiple files…	Crear PDF a partir de varios archivos…
 	Create PDF from clipboard	Crear PDF a partir del portapapeles
 	Combine files…	Combinar archivos…
 	Save	Guardar
@@ -1958,5 +1959,15 @@
 	Default page display	Presentación de página predeterminada
 	Default zoom	Zoom predeterminado
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Se usa cuando un PDF no pide una presentación ni un zoom. El desplazamiento continuo nunca salta de página en página.
+	Created a PDF from {n} files	Se creó un PDF a partir de {n} archivos
+	PDF, images and text	PDF, imágenes y texto
+	Insert a file before page {label}	Insertar un archivo antes de la página {label}
+	Insert a file at the end	Insertar un archivo al final
+	Save pages	Guardar páginas
+	Save these pages as one PDF	Guardar estas páginas en un solo PDF
+	No changes to save	No hay cambios que guardar
+	Created a PDF from {n} files; left out: {names}	Se creó un PDF a partir de {n} archivos; omitidos: {names}
+	Created a PDF from the first {n} files	Se creó un PDF a partir de los primeros {n} archivos
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Ninguno de esos archivos se puede convertir en PDF; use archivos PDF, imágenes o .txt
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Elija una imagen PNG o JPEG (hasta 4 MiB). Se conserva la transparencia.
 	Couldn't import the signature image: {e}	No se pudo importar la imagen de la firma: {e}
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 01ef070d..a787eb26 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -24,6 +24,7 @@
 	New blank PDF	Nouveau PDF vierge
 	Create PDF from file…	Créer un PDF à partir d'un fichier…
 	Create PDF from images…	Créer un PDF à partir d'images…
+	Create PDF from multiple files…	Créer un PDF à partir de plusieurs fichiers…
 	Create PDF from clipboard	Créer un PDF à partir du presse-papiers
 	Combine files…	Combiner des fichiers…
 	Save	Enregistrer
@@ -1934,6 +1935,16 @@
 	Lines +/−	Lignes +/−
 	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login} : {prs} PR, {commits} commits, +{added} / −{deleted} lignes (Δ {delta}), +{bin_added} / −{bin_deleted} fichiers binaires, {first} – {last}
 	Set layer visibility	Définir la visibilité des calques
+	Created a PDF from {n} files	PDF créé à partir de {n} fichiers
+	PDF, images and text	PDF, images et texte
+	Insert a file before page {label}	Insérer un fichier avant la page {label}
+	Insert a file at the end	Insérer un fichier à la fin
+	Save pages	Enregistrer les pages
+	Save these pages as one PDF	Enregistrer ces pages dans un seul PDF
+	No changes to save	Aucune modification à enregistrer
+	Created a PDF from {n} files; left out: {names}	PDF créé à partir de {n} fichiers ; ignorés : {names}
+	Created a PDF from the first {n} files	PDF créé à partir des {n} premiers fichiers
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Aucun de ces fichiers ne peut être converti en PDF ; utilisez des PDF, des images ou des fichiers .txt
 
 # Combine files tab
 	1 file	1 fichier
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 0e2fb086..6eef7ae1 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -32,6 +32,7 @@
 	New blank PDF	空白の PDF を作成
 	Create PDF from file…	ファイルから PDF を作成…
 	Create PDF from images…	画像から PDF を作成…
+	Create PDF from multiple files…	複数のファイルから PDF を作成…
 	Create PDF from clipboard	クリップボードから PDF を作成
 	Combine files…	ファイルを結合…
 	Save	保存
@@ -1934,5 +1935,15 @@
 	Page display: {layout}	ページ表示：{layout}
 	Fit to width scrolling	幅に合わせてスクロール
 	Fit one full page	1ページずつ全体を表示
+	Created a PDF from {n} files	{n} 個のファイルから PDF を作成しました
+	PDF, images and text	PDF、画像、テキスト
+	Insert a file before page {label}	ページ {label} の前にファイルを挿入
+	Insert a file at the end	最後にファイルを挿入
+	Save pages	ページを保存
+	Save these pages as one PDF	これらのページを 1 つの PDF として保存
+	No changes to save	保存する変更はありません
+	Created a PDF from {n} files; left out: {names}	{n} 個のファイルから PDF を作成しました。除外: {names}
+	Created a PDF from the first {n} files	最初の {n} 個のファイルから PDF を作成しました
+	None of those files can be made into a PDF; use PDFs, images or .txt files	これらのファイルは PDF にできません。PDF、画像、.txt ファイルを使用してください
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG または JPEG 画像を選択してください（最大 4 MiB）。透明度は保持されます。
 	Couldn't import the signature image: {e}	署名画像を読み込めませんでした: {e}
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 7637345c..56b0deb9 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -25,6 +25,7 @@
 	New blank PDF	Novo PDF em branco
 	Create PDF from file…	Criar PDF a partir de arquivo…
 	Create PDF from images…	Criar PDF a partir de imagens…
+	Create PDF from multiple files…	Criar PDF a partir de vários arquivos…
 	Create PDF from clipboard	Criar PDF a partir da área de transferência
 	Combine files…	Combinar arquivos…
 	Save	Salvar
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 2734a776..f78afde6 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -27,6 +27,7 @@ comment menu	Edit	సవరించు
 	Open…	తెరువు…
 	New blank PDF	కొత్త ఖాళీ PDF
 	Create PDF from file…	ఫైల్ నుండి PDF సృష్టించు…
+	Create PDF from multiple files…	అనేక ఫైల్‌ల నుండి PDF సృష్టించు…
 	Create PDF from images…	చిత్రాల నుండి PDF సృష్టించు…
 	Create PDF from clipboard	క్లిప్‌బోర్డ్ నుండి PDF సృష్టించు
 	Combine files…	ఫైల్‌లను కలుపు…
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index e7b99f87..508aaf57 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -69,6 +69,7 @@
 	New blank PDF	新建空白 PDF
 	Create PDF from file…	从文件创建 PDF…
 	Create PDF from images…	从图像创建 PDF…
+	Create PDF from multiple files…	从多个文件创建 PDF…
 	Create PDF from clipboard	从剪贴板创建 PDF
 	Combine files…	合并文件…
 	Save	保存
@@ -2003,5 +2004,15 @@
 	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA 表单：字段与 XFA 数据保持同步，以便其他阅读器显示您填写的内容。
 @plural	{n} page|{n} pages	{n} 页
 @plural	{n} field|{n} fields	{n} 个字段
+	Created a PDF from {n} files	已从 {n} 个文件创建 PDF
+	PDF, images and text	PDF、图像和文本
+	Insert a file before page {label}	在第 {label} 页之前插入文件
+	Insert a file at the end	在末尾插入文件
+	Save pages	保存页面
+	Save these pages as one PDF	将这些页面保存为一个 PDF
+	No changes to save	没有要保存的更改
+	Created a PDF from {n} files; left out: {names}	已从 {n} 个文件创建 PDF；已忽略：{names}
+	Created a PDF from the first {n} files	已从前 {n} 个文件创建 PDF
+	None of those files can be made into a PDF; use PDFs, images or .txt files	这些文件都无法转换为 PDF；请使用 PDF、图像或 .txt 文件
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	选择 PNG 或 JPEG 图像（最大 4 MiB）。透明度会保留。
 	Couldn't import the signature image: {e}	无法导入签名图像：{e}
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index d1762eb7..39a21471 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -28,6 +28,7 @@
 	New blank PDF	新增空白 PDF
 	Create PDF from file…	從檔案建立 PDF…
 	Create PDF from images…	從圖片建立 PDF…
+	Create PDF from multiple files…	從多個檔案建立 PDF…
 	Create PDF from clipboard	從剪貼簿建立 PDF
 	Combine files…	合併檔案…
 	Save	儲存
@@ -1927,5 +1928,15 @@
 	Page display: {layout}	頁面顯示：{layout}
 	Fit to width scrolling	符合寬度連續捲動
 	Fit one full page	單頁完整顯示
+	Created a PDF from {n} files	已從 {n} 個檔案建立 PDF
+	PDF, images and text	PDF、圖片和文字
+	Insert a file before page {label}	在第 {label} 頁之前插入檔案
+	Insert a file at the end	在結尾插入檔案
+	Save pages	儲存頁面
+	Save these pages as one PDF	將這些頁面儲存為一個 PDF
+	No changes to save	沒有要儲存的變更
+	Created a PDF from {n} files; left out: {names}	已從 {n} 個檔案建立 PDF；已略過：{names}
+	Created a PDF from the first {n} files	已從前 {n} 個檔案建立 PDF
+	None of those files can be made into a PDF; use PDFs, images or .txt files	這些檔案都無法轉換為 PDF；請使用 PDF、圖片或 .txt 檔案
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	選擇 PNG 或 JPEG 圖像（最大 4 MiB）。透明度會保留。
 	Couldn't import the signature image: {e}	無法匯入簽名圖像：{e}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 9e29b3c0..32cecb17 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -34,9 +34,11 @@ pub mod comments;
 mod comments_panel;
 mod compare_ui;
 pub mod control;
+mod create_multiple_ui;
 mod create_ui;
 mod credits;
 mod crop;
+mod drag_pointer;
 mod export_ui;
 mod js_ui;
 mod marks_ui;
@@ -188,6 +190,14 @@ pub enum QuickTool {
     Snapshot,
 }
 
+/// Files dropped on a document's page grid.
+struct GridDrop {
+    doc: pdfcraft_engine::DocId,
+    files: Vec<(String, Vec<u8>)>,
+    /// When to stop waiting for the pointer (egui time, seconds).
+    deadline: f64,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Dialog {
     CreateImages,
@@ -449,6 +459,8 @@ pub struct PdfCraftApp {
     pub optimize_draft: OptimizeDraft,
     /// Pages copied or cut in Organize Pages, ready to paste (into any document).
     pub page_clipboard: Option<PageClip>,
+    /// Files dropped on the page grid, waiting for the pointer to say which gap they go to.
+    grid_drop: Option<GridDrop>,
     /// The last snapshot (width, height, RGBA); `system_clipboard` also puts it on the
     /// system clipboard (tests turn that off).
     pub last_snapshot: Option<(u32, u32, Vec<u8>)>,
@@ -648,6 +660,7 @@ impl PdfCraftApp {
             stamp_draft: Default::default(),
             optimize_draft: OptimizeDraft::default(),
             page_clipboard: None,
+            grid_drop: None,
             last_snapshot: None,
             system_clipboard: true,
             attach_override: None,
@@ -819,6 +832,56 @@ impl PdfCraftApp {
         }
     }
 
+    /// The document whose page grid is showing and may take pages, if any.
+    fn grid_target(&self) -> Option<pdfcraft_engine::DocId> {
+        let view = self.active.and_then(|i| self.views.get(i)).filter(|v| v.organize)?;
+        (self.dialog.is_none() && self.session.get(view.id)?.allows_assembly()).then_some(view.id)
+    }
+
+    /// Files dropped while the page grid shows are inserted into it rather than opened: they
+    /// are kept until [`Self::finish_grid_drop`] knows the gap. Returns the files not taken.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn drop_on_grid(&mut self, dropped: Vec<egui::DroppedFileHandle>, ctx: &egui::Context) -> Vec<egui::DroppedFileHandle> {
+        let Some(id) = self.grid_target().filter(|_| !dropped.is_empty()) else { return dropped };
+        let mut files = Vec::new();
+        for f in dropped.iter().take(pdfcraft_engine::MAX_CREATE_FILES) {
+            let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
+            let bytes = if f.path().is_absolute() { std::fs::read(f.path()).map_err(|e| e.to_string()) } else { f.bytes() };
+            match bytes {
+                Ok(b) => files.push((name, b)),
+                Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e)]),
+            }
+        }
+        if !files.is_empty() {
+            // Where there is no telling where the pointer is during the drag, its place arrives
+            // with the first move after the drop.
+            ctx.request_repaint();
+            self.grid_drop = Some(GridDrop { doc: id, files, deadline: ctx.input(|i| i.time) + 1.0 });
+        }
+        Vec::new()
+    }
+
+    /// Insert files dropped on the page grid at the gap under the pointer, or at the end when
+    /// the pointer hasn't shown up in time.
+    fn finish_grid_drop(&mut self, ctx: &egui::Context) {
+        let Some(GridDrop { doc: id, deadline, .. }) = &self.grid_drop else { return };
+        let (id, deadline) = (*id, *deadline);
+        if self.grid_target() != Some(id) {
+            self.grid_drop = None;
+            return self.notify_tr("The document changed while you were choosing a file, so nothing was changed.");
+        }
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return };
+        let gap = match view.grid_gap {
+            Some(gap) => gap,
+            None if ctx.input(|i| i.time) >= deadline => usize::MAX,
+            None => return ctx.request_repaint(),
+        };
+        view.insert_at = Some(gap);
+        if let Some(drop) = self.grid_drop.take() {
+            self.insert_files(drop.files);
+        }
+    }
+
     /// Browsers read dropped files asynchronously; the bytes land in `inbox` and open next frame.
     #[cfg(target_arch = "wasm32")]
     fn open_dropped(&mut self, f: egui::DroppedFileHandle, ctx: &egui::Context) {
@@ -1461,6 +1524,19 @@ impl PdfCraftApp {
 }
 
 impl eframe::App for PdfCraftApp {
+    /// While files are dragged over the window the system sends no pointer moves, so egui
+    /// would keep the place the pointer entered at: tell it where the pointer really is, so the
+    /// page grid can show (and use) the gap under it.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        if raw.hovered_files.is_empty() && raw.dropped_files.is_empty() {
+            return;
+        }
+        if let Some(pos) = drag_pointer::in_window(ctx) {
+            raw.events.push(egui::Event::PointerMoved(pos));
+        }
+        ctx.request_repaint();
+    }
+
     fn save(&mut self, storage: &mut dyn eframe::Storage) {
         storage.set_string("pdfcraft", self.persist());
     }
@@ -1488,6 +1564,9 @@ impl eframe::App for PdfCraftApp {
             }
         }
         self.sync_theme(ctx);
+        // Before taking this frame's drop: the grid must be drawn once with the pointer where
+        // the files were let go before the gap is read.
+        self.finish_grid_drop(ctx);
         // Showing a document hides the Combine files tab.
         if self.active.is_some() {
             self.combine_tab.focused = false;
@@ -1495,6 +1574,8 @@ impl eframe::App for PdfCraftApp {
         #[cfg(target_arch = "wasm32")]
         self.process_signature_images();
         let dropped = ctx.input(|i| i.raw.dropped_files.clone());
+        #[cfg(not(target_arch = "wasm32"))]
+        let dropped = self.drop_on_grid(dropped, ctx);
         for f in dropped {
             // Files dropped on the Combine files tab join its list instead of opening.
             if self.combine_showing() {
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index 28e4e01b..55058b4f 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -51,6 +51,7 @@ const PICKERS: &[&str] = &[
     "file.save_as",
     "create.file",
     "create.images",
+    "create.multiple",
     "page.replace",
     "create.clipboard",
     "a11y.report",
diff --git a/crates/ui-egui/tests/create.rs b/crates/ui-egui/tests/create.rs
index 11d39352..85d66854 100644
--- a/crates/ui-egui/tests/create.rs
+++ b/crates/ui-egui/tests/create.rs
@@ -132,3 +132,63 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
     assert!(std::fs::read(&out).unwrap().starts_with(b"%PDF-"));
     assert_eq!(h.state().dialog, None);
 }
+
+fn mixed_files(app: &PdfCraftApp) -> Vec<(String, Vec<u8>)> {
+    let pdf = app.session.create_from_text("a", "from a pdf").unwrap();
+    vec![
+        ("notes.txt".into(), b"from text".to_vec()),
+        ("report.docx".into(), b"PK\x03\x04".to_vec()),
+        ("a.pdf".into(), pdf.to_vec()),
+        ("photo.png".into(), png()),
+    ]
+}
+
+#[test]
+fn multiple_files_open_as_one_document_in_the_page_grid() {
+    use egui_kittest::{Harness, kittest::Queryable};
+    let path = std::env::temp_dir().join(format!("pdfcraft-create-multiple-{}.pdf", std::process::id()));
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 720.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let files = mixed_files(&app);
+        app.use_files(pdfcraft_ui_egui::FilePurpose::CreateMultiple, files);
+        app
+    });
+    h.run_steps(4);
+    {
+        let app = h.state();
+        assert_eq!(app.views.len(), 1);
+        assert!(app.views[0].organize, "the pages are shown as a grid");
+        let doc = app.session.get(app.views[0].id).unwrap();
+        assert_eq!(doc.name, "Combined.pdf");
+        assert!(doc.dirty && doc.path.is_none(), "unsaved until the user saves it");
+        assert_eq!(doc.info.pages.len(), 3, "the Word file can't be converted and is left out");
+        assert_eq!(doc.info.outline.iter().map(|o| o.title.as_str()).collect::<Vec<_>>(), ["notes", "a", "photo"]);
+    }
+    h.get_by_label_contains("left out: report.docx");
+    h.get_by_label("Insert a file before page 2");
+    if let Ok(path) = std::env::var("PDFCRAFT_CREATE_MULTIPLE_SHOT") {
+        h.run_steps(20);
+        h.render().unwrap().save(path).unwrap();
+    }
+    // Remove the middle page and save what is left.
+    h.get_by_label("Page 2").click();
+    h.run_steps(2);
+    h.get_by_label("Delete pages (Delete)").click();
+    h.run_steps(3);
+    h.state_mut().save_override = Some(path.to_string_lossy().into_owned());
+    h.get_by_label("Save pages").click();
+    h.run_steps(4);
+    let app = h.state();
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert!(!doc.dirty && doc.info.pages.len() == 2);
+    assert!(std::fs::read(&path).unwrap().starts_with(b"%PDF-"));
+}
+
+#[test]
+fn multiple_files_that_cannot_be_converted_open_nothing() {
+    let mut app = PdfCraftApp::new();
+    app.use_files(pdfcraft_ui_egui::FilePurpose::CreateMultiple, vec![("report.docx".into(), b"PK\x03\x04".to_vec())]);
+    assert!(app.views.is_empty());
+    assert!(app.toast.is_some());
+}
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 3aed0f6c..10734782 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -1001,6 +1001,132 @@ fn inserting_a_file_goes_after_the_selection_and_undoes() {
     assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2"]);
 }
 
+#[test]
+fn plus_between_pages_inserts_picked_files_there_in_order() {
+    let dir = temp_path("insert-gap");
+    std::fs::create_dir_all(&dir).unwrap();
+    let (extra, note) = (dir.join("extra.pdf"), dir.join("note.txt"));
+    std::fs::write(&extra, fixture(2)).unwrap();
+    std::fs::write(&note, "a note").unwrap();
+    let mut h = organize(3);
+    // Page 3 is selected, yet the files go where the "+" is: between pages 1 and 2.
+    h.get_by_label("Page 3").click();
+    h.run_steps(2);
+    h.state_mut().pick_override = Some(vec![extra.to_string_lossy().into_owned(), note.to_string_lossy().into_owned()]);
+    h.get_by_label("Insert a file before page 2").click();
+    h.run_steps(4);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 1", "Page 2", "a note", "Page 2", "Page 3"]);
+    assert_eq!(picked(&h), [1, 2, 3], "the inserted pages are selected");
+    // Each file is one undo step.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2", "Page 3"]);
+    // Both ends.
+    h.state_mut().pick_override = Some(vec![note.to_string_lossy().into_owned()]);
+    h.get_by_label("Insert a file before page 1").click();
+    h.run_steps(4);
+    h.get_by_label("Insert a file at the end").click();
+    h.run_steps(4);
+    assert_eq!(texts_of(h.state(), 0), ["a note", "Page 1", "Page 2", "Page 3", "a note"]);
+    // The toolbar button still inserts after the selection, not at the last "+" used.
+    h.get_by_label("Page 2").click();
+    h.run_steps(2);
+    h.get_by_label("Insert pages from a file…").click();
+    h.run_steps(4);
+    assert_eq!(texts_of(h.state(), 0), ["a note", "Page 1", "a note", "Page 2", "Page 3", "a note"]);
+    // A file that can't be converted changes nothing.
+    let before = texts_of(h.state(), 0);
+    h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::InsertPages, vec![("report.docx".into(), b"PK\x03\x04".to_vec())]);
+    h.run_steps(2);
+    assert_eq!(texts_of(h.state(), 0), before);
+}
+
+/// A file dropped on the window, as the windowing layer hands it over.
+#[derive(Debug)]
+struct Dropped(&'static str, Vec<u8>);
+
+impl egui::DroppedFile for Dropped {
+    fn path(&self) -> &std::path::Path {
+        std::path::Path::new(self.0)
+    }
+    fn bytes(&self) -> Result<Vec<u8>, String> {
+        Ok(self.1.clone())
+    }
+}
+
+fn drop_files(h: &mut Harness<'static, PdfCraftApp>, files: Vec<Dropped>) {
+    for f in files {
+        h.input_mut().dropped_files.push(std::sync::Arc::new(f));
+    }
+}
+
+#[test]
+fn files_dropped_between_pages_are_inserted_there() {
+    let mut h = organize(3);
+    // Over the gap between pages 1 and 2.
+    let gap = h.get_by_label("Insert a file before page 2").rect().center();
+    h.hover_at(gap + egui::vec2(0.0, 40.0));
+    h.run_steps(2);
+    drop_files(&mut h, vec![Dropped("extra.pdf", fixture(2)), Dropped("note.txt", b"a note".to_vec())]);
+    h.run_steps(4);
+    assert_eq!(h.state().views.len(), 1, "dropped files are not opened as documents");
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 1", "Page 2", "a note", "Page 2", "Page 3"]);
+    assert_eq!(picked(&h), [1, 2, 3], "the inserted pages are selected");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2", "Page 3"]);
+    // Right of the last page: the end.
+    let last = h.get_by_label("Page 3").rect();
+    h.hover_at(last.center() + egui::vec2(last.width() * 0.4, 0.0));
+    h.run_steps(2);
+    drop_files(&mut h, vec![Dropped("note.txt", b"a note".to_vec())]);
+    h.run_steps(4);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2", "Page 3", "a note"]);
+}
+
+#[test]
+fn files_dropped_before_the_pointer_is_known_wait_for_it() {
+    // Some platforms don't report the pointer while files are dragged over the window.
+    let mut h = organize(2);
+    drop_files(&mut h, vec![Dropped("note.txt", b"a note".to_vec())]);
+    h.run_steps(1);
+    assert_eq!(texts_of(h.state(), 0).len(), 2, "not placed yet");
+    let gap = h.get_by_label("Insert a file before page 2").rect().center();
+    h.hover_at(gap + egui::vec2(0.0, 40.0));
+    h.run_steps(3);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "a note", "Page 2"]);
+}
+
+#[test]
+fn files_dropped_outside_the_page_grid_still_open_as_documents() {
+    let mut h = harness(2, |_| {});
+    drop_files(&mut h, vec![Dropped("other.pdf", fixture(1))]);
+    h.run_steps(3);
+    assert_eq!(h.state().views.len(), 2);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2"]);
+}
+
+#[test]
+fn save_pages_writes_what_the_grid_shows() {
+    let path = temp_path("grid-save.pdf");
+    let mut h = organize(3);
+    h.get_by_label("Page 2").click();
+    h.run_steps(2);
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    h.state_mut().save_override = Some(path.to_string_lossy().into_owned());
+    h.get_by_label("Save pages").click();
+    h.run_steps(4);
+    assert!(!dirty(&h));
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("saved.pdf", None, std::fs::read(&path).unwrap()).unwrap();
+    assert_eq!(texts_of(&app, 0), ["Page 1", "Page 3"]);
+}
+
 #[test]
 fn split_dialog_writes_one_file_per_part() {
     let dir = temp_path("split-count");
@@ -1104,6 +1230,7 @@ fn restricted_documents_show_a_notice_and_block_page_changes() {
     h.key_press(Key::Delete);
     h.run_steps(3);
     assert_eq!(texts_of(h.state(), 0).len(), 2, "page changes are blocked");
+    assert_eq!(h.query_all_by_label_contains("Insert a file").count(), 0, "nothing to insert into");
     assert!(!dirty(&h));
     h.get_by_label("Security settings").click();
     h.run_steps(3);
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index b6b0ea73..22b37a2a 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2638,8 +2638,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.insert"]
 tools = ["page_insert_file"]
-evidence = ["crates/organize/src/tests.rs::inserting_pages_from_another_file_is_an_incremental_edit", "crates/ui-egui/tests/editing.rs::inserting_a_file_goes_after_the_selection_and_undoes"]
-notes = ""
+evidence = ["crates/organize/src/tests.rs::inserting_pages_from_another_file_is_an_incremental_edit", "crates/ui-egui/tests/editing.rs::inserting_a_file_goes_after_the_selection_and_undoes", "crates/ui-egui/tests/editing.rs::plus_between_pages_inserts_picked_files_there_in_order"]
+notes = "After the selection (toolbar, File menu) or at any gap of the page grid (a + between pages and at both ends); several files at once, in order; images and .txt files are converted first; the inserted pages end up selected. The page_insert_file tool takes PDFs only. Missing: choosing which pages of the file to insert in the app."
 
 [[feature]]
 id = "organize.insert-from-clipboard"
@@ -2683,11 +2683,11 @@ title = "Insert by dropping files onto the page grid"
 area = "D"
 tier = "P1"
 milestone = "M4"
-status = "planned"
-commands = []
+status = "partial"
+commands = ["page.organize"]
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::files_dropped_between_pages_are_inserted_there", "crates/ui-egui/tests/editing.rs::files_dropped_before_the_pointer_is_known_wait_for_it", "crates/ui-egui/tests/editing.rs::files_dropped_outside_the_page_grid_still_open_as_documents"]
+notes = "Desktop: PDFs, images and .txt files dropped on the Organize page grid are inserted at the gap under the pointer, in order, and selected (elsewhere a dropped file still opens as a document). While the files hover, a bar at the gap and a + badge follow the pointer; on macOS the pointer is read from AppKit, because the windowing layer sends no moves during a file drag. Missing: on Windows and Linux there is no live position, so the grid is only outlined and the files go to the gap the pointer is at right after the drop (or the end after a second); the web build (dropped files open as documents). Covered by simulated drop events; a real drag from Finder is not in the automated tests."
 
 [[feature]]
 id = "organize.extract-pages"
@@ -6798,12 +6798,12 @@ id = "create.create-multiple"
 title = "Convert many files to PDF in one run"
 area = "J"
 tier = "P1"
-milestone = "M13"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+milestone = "M10"
+status = "shipped"
+commands = ["create.multiple"]
+tools = ["doc_create_multiple"]
+evidence = ["crates/engine/src/tests.rs::mixed_files_convert_and_combine_in_order", "crates/engine/src/tests.rs::files_that_cannot_be_converted_are_refused_clearly", "crates/automation/tests/automation.rs::creating_from_multiple_files_through_tools", "crates/ui-egui/tests/create.rs::multiple_files_open_as_one_document_in_the_page_grid", "crates/ui-egui/tests/editing.rs::plus_between_pages_inserts_picked_files_there_in_order", "crates/ui-egui/tests/editing.rs::save_pages_writes_what_the_grid_shows"]
+notes = "Create ▸ Multiple files: the picked PDFs, images (PNG, JPEG, JPEG 2000, TIFF, GIF, BMP) and .txt files open as one unsaved document in the page grid, in the order picked (a bookmark per file); there pages are removed, reordered, more files inserted at any gap (a + button, or dropped there), and Save pages writes what is shown. One PDF per file is offered by the doc_create_multiple tool only (mode separate), not in the app. Missing: Office, HTML and Markdown inputs, PDF Portfolio output, per-file image resolution choice, progress and cancel for large batches (conversion runs on the UI thread). The combined file has combine's limits: untagged, no page labels or document info carried over, and its per-file bookmarks are not updated when pages are later moved between files."
 
 [[feature]]
 id = "create.image-conversion-options"

From 620e8a2d7b7fb3aab82306da1f0fbe688510aa3b Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 06:45:33 +0900
Subject: [PATCH 018/149] Add my contributor name (cyfung1031) (#364)

Adds my own entry to contributors/people.toml, as described in
docs/contributors.md ("Credit yourself").

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 contributors/people.toml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/contributors/people.toml b/contributors/people.toml
index d2a02079..b3fb1e04 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -51,3 +51,8 @@ sync_github_name = false
 real_name = "Chiranjeevi Uddanti"
 display_name = "Chiranjeevi U"
 sync_github_name = false
+
+[people.cyfung1031]
+real_name = "Chester Fung"
+display_name = "Chester Fung"
+sync_github_name = true

From a747f2521ffeeadca3ca331957a073584ad3ab55 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 07:17:34 +0900
Subject: [PATCH 019/149] M2.6: W/W* clip after whichever path-painting
 operator ends the path (#362)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ISO 32000-2 §8.5.4: W and W* mark the current path to become the clip
once the path-painting operator that ends it has painted it with the old
clip, and n is only one such operator. The vendored interpreter applied
the clip in n alone. After S, s, f, F, f*, B, B*, b or b* it was never
applied, so everything painted afterwards ignored it, and it stayed
pending until some later, unrelated n (even after Q) clipped content
that should show. Issue #260's test file uses `W* S` on pages 3, 5 and
9: a shading meant for a circle flooded page 3, an image meant for a
rounded rectangle and nested clips on 5 and 9 spilled out.

Every painting operator now applies a pending clip after painting and
clears it (apply_pending_clip, shared with n). The now unused
Context::clip getter is removed.

Test: raster::tests::clipping_path_applies_after_any_painting_operator.
W and W* with each of n, S, s, f, F, f*, B, B*, b, b*: the later red fill
stays inside the square, and a stroking operator's outer half still
shows outside it (painted under the old clip). A clip used by S doesn't
linger for a later n, inside or after q/Q. On main it fails at `W S`.
MuPDF, Poppler and PDFium agree on every case. Page 3 of #260's file now
differs from PDFium by 0.84/255 on average (was 164). Vendored patch
(16).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/render/src/raster.rs                  | 51 ++++++++++++++++++++
 vendor/README.md                             |  2 +-
 vendor/hayro-interpret/src/context.rs        |  4 --
 vendor/hayro-interpret/src/interpret/mod.rs  | 12 +----
 vendor/hayro-interpret/src/interpret/path.rs | 15 ++++++
 5 files changed, 69 insertions(+), 15 deletions(-)

diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 5cedcf8a..9f311e76 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1482,4 +1482,55 @@ trailer << /Root 1 0 R >>
         assert_eq!(px(25, 50), vec![255, 0, 0, 255], "inside the mask");
         assert_eq!(px(75, 50), vec![255, 255, 255, 255], "outside the mask");
     }
+
+    /// ISO 32000-2 §8.5.4: `W` / `W*` clip with the current path once whichever path-painting
+    /// operator ends it has painted it, `S`, `f` or `B` as much as `n`. The vendored interpreter
+    /// applied the clip only on `n`: after `re W* S` everything later painted outside the clip,
+    /// and the forgotten clip stayed pending, so a later `re n` (even after `Q`) clipped
+    /// content that should show. MuPDF, Poppler and PDFium clip in every case below.
+    #[test]
+    fn clipping_path_applies_after_any_painting_operator() {
+        let render = |content: &str| {
+            let pdf = format!(
+                "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+                content.len()
+            );
+            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 });
+            assert!(p.error.is_none(), "{content}: {:?}", p.error);
+            p
+        };
+        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+        let red = vec![255, 0, 0, 255];
+        // The clip is the square x 20..60, y 20..60 (device rows 40..80); then the page is filled red.
+        for op in ["n", "S", "s", "f", "F", "f*", "B", "B*", "b", "b*"] {
+            for clip in ["W", "W*"] {
+                let p = render(&format!("q 0 0 1 RG 4 w 0.8 g 20 20 40 40 re {clip} {op} 1 0 0 rg 0 0 100 100 re f Q"));
+                assert_eq!(px(&p, 40, 60), red, "{clip} {op}: inside the clip");
+                assert_ne!(px(&p, 5, 5), red, "{clip} {op}: outside the clip");
+                assert_ne!(px(&p, 95, 95), red, "{clip} {op}: outside the clip");
+                // The operator that ends the path paints under the old clip: the outer half of
+                // the 4 pt stroke (x 18..20) shows outside the new one.
+                let stroked = !["n", "f", "F", "f*"].contains(&op);
+                let edge = if stroked { vec![0, 0, 255, 255] } else { vec![255, 255, 255, 255] };
+                assert_eq!(px(&p, 18, 60), edge, "{clip} {op}: just outside the clip");
+            }
+        }
+        // A clip is used once: it doesn't linger for a later `n`, inside or outside `q`/`Q`.
+        for content in [
+            "q 0 0 1 RG 70 70 10 10 re W S Q q 10 10 20 20 re n 1 0 0 rg 0 0 100 100 re f Q",
+            "q 0 0 1 RG 0 0 100 100 re W S 10 10 20 20 re n 1 0 0 rg 0 0 100 100 re f Q",
+        ] {
+            let p = render(content);
+            assert!([(5, 5), (50, 50), (95, 95)].iter().all(|(x, y)| px(&p, *x, *y) == red), "{content}: no stray clip");
+        }
+    }
 }
diff --git a/vendor/README.md b/vendor/README.md
index 862f5744..9225714e 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -7,7 +7,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n` | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator` |
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second |
diff --git a/vendor/hayro-interpret/src/context.rs b/vendor/hayro-interpret/src/context.rs
index 5a2f2ab8..c5cea5cf 100644
--- a/vendor/hayro-interpret/src/context.rs
+++ b/vendor/hayro-interpret/src/context.rs
@@ -274,10 +274,6 @@ impl<'a> Context<'a> {
         &mut self.last_point
     }
 
-    pub(crate) fn clip(&self) -> &Option<FillRule> {
-        &self.clip
-    }
-
     pub(crate) fn clip_mut(&mut self) -> &mut Option<FillRule> {
         &mut self.clip
     }
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index 52201206..a9615411 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -5,7 +5,7 @@ use crate::convert::{convert_line_cap, convert_line_join};
 use crate::device::Device;
 use crate::font::{Font, FontData, FontQuery, StandardFont};
 use crate::interpret::path::{
-    close_path, fill_path, fill_path_impl, fill_stroke_path, stroke_path,
+    apply_pending_clip, close_path, fill_path, fill_path_impl, fill_stroke_path, stroke_path,
 };
 use crate::interpret::state::{TextStateFont, handle_gs};
 use crate::interpret::text::TextRenderingMode;
@@ -479,15 +479,7 @@ pub fn interpret<'a>(
                 stroke_path(context, device);
             }
             TypedInstruction::EndPath(_) => {
-                if let Some(clip) = *context.clip()
-                    && !context.path().elements().is_empty()
-                {
-                    let clip_path = context.get().ctm * context.path().clone();
-                    context.push_clip_path(clip_path, clip, device);
-
-                    *(context.clip_mut()) = None;
-                }
-
+                apply_pending_clip(context, device);
                 context.path_mut().truncate(0);
             }
             TypedInstruction::NonStrokeColor(c) => {
diff --git a/vendor/hayro-interpret/src/interpret/path.rs b/vendor/hayro-interpret/src/interpret/path.rs
index e1e7d96a..838ea099 100644
--- a/vendor/hayro-interpret/src/interpret/path.rs
+++ b/vendor/hayro-interpret/src/interpret/path.rs
@@ -12,12 +12,14 @@ pub(crate) fn fill_path<'a>(
     fill_rule: FillRule,
 ) {
     fill_path_impl(context, device, fill_rule, None);
+    apply_pending_clip(context, device);
 
     context.path_mut().truncate(0);
 }
 
 pub(crate) fn stroke_path<'a>(context: &mut Context<'a>, device: &mut impl Device<'a>) {
     stroke_path_impl(context, device, None);
+    apply_pending_clip(context, device);
 
     context.path_mut().truncate(0);
 }
@@ -29,10 +31,23 @@ pub(crate) fn fill_stroke_path<'a>(
 ) {
     fill_path_impl(context, device, fill_rule, None);
     stroke_path_impl(context, device, None);
+    apply_pending_clip(context, device);
 
     context.path_mut().truncate(0);
 }
 
+/// PdfCraft patch: a clip set by `W` / `W*` takes effect once the path-painting operator that
+/// ends the path has painted it, whichever operator that is (ISO 32000-2 §8.5.4). Upstream
+/// applied it only on `n`, and otherwise left it pending for some later, unrelated `n`.
+pub(crate) fn apply_pending_clip<'a>(context: &mut Context<'a>, device: &mut impl Device<'a>) {
+    if let Some(rule) = context.clip_mut().take()
+        && !context.path().elements().is_empty()
+    {
+        let clip_path = context.get().ctm * context.path().clone();
+        context.push_clip_path(clip_path, rule, device);
+    }
+}
+
 pub(crate) fn close_path(context: &mut Context<'_>) {
     // This is necessary to prevent artifacts (see for example issue 157),
     // but it does cause some weird lines (maybe conflation artifacts) in

From 23bac79756d636453cf17e7526f978b8a1eebbcf Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 07:23:45 +0900
Subject: [PATCH 020/149] View: page rasters map texel for texel onto the
 screen (sharp text at any zoom) (#363)

#260 (page 9) reports text that looks softer than in Acrobat once zoomed.
The page was rendered at the zoom's device scale rounded to 1/64
(render_scale, to spare re-renders on tiny fit-width changes), and the
texture was stretched onto the page's layout rectangle, whose corner
usually isn't on a whole physical pixel. Every line and glyph went
through linear resampling: at 87 % on a 2x display the raster was 0.32 %
too small for its rectangle, and #260's page 9 lost 7.9 % sharpness
against a direct render (1.7 % at 137 %; 0 at 150 %, which happens to
quantize exactly).

The page now renders at the exact device scale (tags resolve 1/65536 of
a scale step instead of 1/1000), each page rectangle starts on a whole
physical pixel, and a raster at the current scale is drawn at its own
pixel size from there, whole page or tile. A raster from an older scale
(mid-zoom) and the low-resolution backdrop under tiles still stretch, as
before. With the fix, page 9 on screen matches a direct render exactly
(mean difference 0.00/255 at 87 % and 137 %, was 6.30 and 2.66).

Test: view.rs::page_raster_maps_one_to_one_onto_screen_pixels renders a
page of 0.5 pt lines at 87 % with 1 and 2 pixels per point and compares
the screen with the page rendered directly at the exact scale. On main:
mean difference 69.5/255, max 216. Now: under 1, max under 16.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/src/canvas.rs | 48 +++++++++++++++++++----
 crates/ui-egui/tests/view.rs | 75 ++++++++++++++++++++++++++++++++++++
 2 files changed, 116 insertions(+), 7 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 875528a8..1480ca21 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -951,11 +951,24 @@ impl DocView {
     }
 
     fn render_scale(&self, ppp: f32) -> f32 {
-        // Quantize so tiny fit-width changes don't trigger re-renders.
-        ((self.zoom * PT * ppp) * 64.0).round() / 64.0
+        // Exactly the device scale: a raster at any other scale is resampled on screen, which
+        // blurs every line and glyph (#260).
+        self.zoom * PT * ppp
     }
 }
 
+/// The request tag for a raster at `scale`: equal tags mean the same scale (to 1/65536).
+fn scale_tag(scale: f32) -> u64 {
+    (f64::from(scale) * 65536.0).round() as u64
+}
+
+/// `r` moved so its corner lies on a whole physical pixel, so that a raster drawn from there
+/// maps texel for texel onto the screen.
+fn snap_to_pixels(r: Rect, ppp: f32) -> Rect {
+    let snap = |v: f32| (v * ppp).round() / ppp;
+    Rect::from_min_size(pos2(snap(r.min.x), snap(r.min.y)), r.size())
+}
+
 /// Maps between a page's coordinate spaces and the screen, including view rotation.
 ///
 /// *View space* is the page as rendered (points, y down, the document's own `/Rotate` applied);
@@ -1041,6 +1054,15 @@ impl PageXform {
         Rect::from_two_pos(self.norm_to_screen(a.0, a.1), self.norm_to_screen(b.0, b.1))
     }
 
+    /// This transform resized to a raster of `px` device pixels (width, height before the view
+    /// rotation), so each of its texels covers one screen pixel. The rectangle's corner must
+    /// already be on a whole pixel ([`snap_to_pixels`]).
+    fn texel_aligned(&self, px: [usize; 2], ppp: f32) -> PageXform {
+        let (w, h) = (px[0] as f32 / ppp, px[1] as f32 / ppp);
+        let size = if self.rot % 180 == 90 { vec2(h, w) } else { vec2(w, h) };
+        PageXform { rect: Rect::from_min_size(self.rect.min, size), ..*self }
+    }
+
     /// Draw a texture covering the normalised page region, rotated with the view.
     pub fn paint_image(&self, painter: &egui::Painter, tex: egui::TextureId, u0: f32, v0: f32, u1: f32, v1: f32) {
         let mut mesh = egui::Mesh::with_texture(tex);
@@ -1278,7 +1300,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     }
     let ppp = ui.ctx().pixels_per_point();
     let scale = view.render_scale(ppp);
-    let tag = (scale * 1000.0) as u64;
+    let tag = scale_tag(scale);
     let hand = app.quick_tool == QuickTool::Hand;
     let tool = app.quick_tool;
     // Text selection runs for the Select tool and for the markup tools (highlight…).
@@ -1380,7 +1402,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         let mut current_overlap = -1.0f32;
         let pointer = ui.input(|i| i.pointer.hover_pos());
         for &i in &visible_pages {
-            let r = rects[i].translate(origin.to_vec2());
+            let r = snap_to_pixels(rects[i].translate(origin.to_vec2()), ppp);
             if !r.intersects(visible.expand(400.0)) {
                 continue;
             }
@@ -1423,13 +1445,18 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 // Whole-page raster: sharp when small, a low-res backdrop when tiled.
                 let (want_scale, want_tag) = if tiled {
                     let bs = BASE_SIDE / pw_pt.max(ph_pt);
-                    (bs, (bs * 1000.0) as u64)
+                    (bs, scale_tag(bs))
                 } else {
                     (scale, tag)
                 };
                 match view.pages.get(&i) {
                     Some(p) => {
-                        xf.paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
+                        if !tiled && p.tag == want_tag {
+                            xf.texel_aligned(p.tex.size(), ppp).paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
+                        } else {
+                            // A backdrop, or a raster at an older scale until the new one arrives.
+                            xf.paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
+                        }
                         if p.tag != want_tag {
                             wanted.push((i, want_scale, want_tag, None));
                         }
@@ -1463,7 +1490,14 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             match view.tiles.get(&(i, tx, ty)) {
                                 Some((ttag, tex)) if *ttag == tag => {
                                     let (fw, fh) = (dw as f32, dh as f32);
-                                    xf.paint_image(painter, tex.id(), x as f32 / fw, y as f32 / fh, (x + w) as f32 / fw, (y + h) as f32 / fh);
+                                    xf.texel_aligned([dw as usize, dh as usize], ppp).paint_image(
+                                        painter,
+                                        tex.id(),
+                                        x as f32 / fw,
+                                        y as f32 / fh,
+                                        (x + w) as f32 / fw,
+                                        (y + h) as f32 / fh,
+                                    );
                                 }
                                 _ => wanted.push((i, scale, tag, Some(Tile { x, y, w, h }))),
                             }
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index b51ba6bd..52ff900c 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -567,3 +567,78 @@ fn required_fields_get_a_red_border_when_highlighting() {
     let px = *img.get_pixel((at.x * ppp) as u32, (at.y * ppp) as u32);
     assert!(px[0] > 180 && px[1] < 100 && px[2] < 100, "a red border: {px:?}");
 }
+
+/// The page raster is shown texel for texel. At a zoom whose device scale isn't on the old 1/64
+/// grid (87 % at 1 px per point: 1.16, rendered at 1.15625) the page was rendered at the
+/// quantized scale and stretched onto a rectangle that didn't start on a whole pixel, so every
+/// line and glyph was resampled and looked soft (#260, page 9).
+#[test]
+fn page_raster_maps_one_to_one_onto_screen_pixels() {
+    let _gpu = gpu();
+    // Fine vertical and horizontal lines (0.5 pt every 1.7 pt) fill most of a 300×400 pt page.
+    let mut content = String::from("0 g\n");
+    for i in 0..140 {
+        let v = 30.0 + 1.7 * i as f32;
+        content.push_str(&format!("{v} 40 0.5 320 re 30 {v} 240 0.5 re\n"));
+    }
+    content.push_str("f\n");
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 400] /Contents 4 0 R >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    )
+    .into_bytes();
+    for ppp in [1.0, 2.0] {
+        let bytes = pdf.clone();
+        let mut h = Harness::builder().with_size(egui::vec2(1000.0, 800.0)).with_pixels_per_point(ppp).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.open_bytes("lines.pdf", None, bytes.clone()).expect("opens");
+            app.set_option("left", "closed").unwrap();
+            app.set_option("panel", "none").unwrap();
+            app.set_option("zoom", "87").unwrap();
+            app
+        });
+        let (mean, worst) = compare_page_with_raster(&mut h, &pdf, 0.87);
+        assert!(mean < 1.0 && worst < 16, "{ppp} px/pt: the page on screen differs from its raster: mean {mean:.2}, max {worst}");
+    }
+}
+
+/// Mean and largest difference between page 1 on screen and the page rendered directly at the
+/// view's exact device scale, over the lined area of `page_raster_maps_one_to_one_onto_screen_pixels`.
+fn compare_page_with_raster(h: &mut Harness<'static, PdfCraftApp>, pdf: &[u8], zoom: f32) -> (f64, u8) {
+    for _ in 0..100 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let ppp = h.ctx.pixels_per_point();
+    let r = rect(h, 0).expect("page 1");
+    let img = h.render().expect("renders");
+    let scale = zoom * 96.0 / 72.0 * ppp;
+    let mut renderer = pdfcraft_render::PageRenderer::new(std::sync::Arc::new(pdf.to_vec()), pdfcraft_render::RenderConfig::default());
+    let page = renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Pixels, tile: None, scale, tag: 0 });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    // Compare the lined area (page x 40..270 pt, y 60..330 pt from the top), screen against raster.
+    let (ox, oy) = ((r.min.x * ppp).round() as i64, (r.min.y * ppp).round() as i64);
+    let (mut sum, mut worst, mut n) = (0u64, 0u8, 0u64);
+    for py in (60.0 * scale) as u32..(330.0 * scale) as u32 {
+        for px in (40.0 * scale) as u32..(270.0 * scale) as u32 {
+            let want = page.rgba[((py * page.width + px) * 4) as usize];
+            let got = img.get_pixel((ox + px as i64) as u32, (oy + py as i64) as u32)[0];
+            let d = want.abs_diff(got);
+            sum += u64::from(d);
+            worst = worst.max(d);
+            n += 1;
+        }
+    }
+    (sum as f64 / n as f64, worst)
+}

From 2a35a1a76faf251b0c8687f7a6df792de97fbe6c Mon Sep 17 00:00:00 2001
From: mlkonrad <marlonk@gmail.com>
Date: Fri, 9 Oct 2026 01:46:34 +0300
Subject: [PATCH 021/149] M11: Optimize PDF and Reduce File Size run in the
 background with a progress bar (#370)

* M11: Optimize PDF and Reduce File Size run in the background with a progress bar

Advanced optimization and Reduce File Size did all their work on the UI
thread, so on a large file the window stopped repainting until they were
done and looked as if it had crashed.

- pdfcraft-optimize: optimize_with_progress reports each image and the
  clean-up; returning false stops with OptimizeError::Cancelled.
- engine: Session::optimize_job captures a copy of the document and the
  choices; OptimizeJob::run reports each OptimizeStage (removing user data,
  images, cleaning up, merging, writing), stops on request with
  EditError::Cancelled and turns a panic into an error so a worker always
  reports back. optimized_bytes is the job run in place.
- ui: both commands run the job on a worker thread (inline in tests and on
  the web), like OCR and Export. A card at the bottom centre shows the
  stage ("Optimizing... image 14 of 40"), a bar that eases towards the
  fraction with a light sweeping across it, the percentage and Cancel;
  notices stack above it. A second run is refused while one is going. The
  control channel's state includes the progress.

The headless doc_optimize and doc_reduce tools stay synchronous. New
strings are translated for es, fr, ja, zh-hans, zh-hant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Clippy: as_chunks in the signature image background test (follow-up to #355)

#360 switched the image test to as_chunks; #355 added another chunks_exact(4)
in the background test, which clippy's chunks_exact_to_as_chunks rejects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Optimize: report a failed worker spawn instead of waiting forever

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                     |  12 +-
 crates/engine/src/lib.rs             |  20 +--
 crates/engine/src/optimizer.rs       | 104 ++++++++++++
 crates/engine/src/signature_image.rs |   2 +-
 crates/engine/src/tests.rs           |  33 ++++
 crates/optimize/README.md            |   6 +-
 crates/optimize/src/images.rs        |  19 ++-
 crates/optimize/src/lib.rs           |  22 ++-
 crates/optimize/tests/optimize.rs    |  39 +++++
 crates/ui-egui/src/control.rs        |   1 +
 crates/ui-egui/src/create_ui.rs      |  10 +-
 crates/ui-egui/src/i18n/es.tsv       |   9 ++
 crates/ui-egui/src/i18n/fr.tsv       |   9 ++
 crates/ui-egui/src/i18n/ja.tsv       |   9 ++
 crates/ui-egui/src/i18n/te.tsv       |   9 ++
 crates/ui-egui/src/i18n/zh-hans.tsv  |   9 ++
 crates/ui-egui/src/i18n/zh-hant.tsv  |   9 ++
 crates/ui-egui/src/lib.rs            |  16 ++
 crates/ui-egui/src/optimize_ui.rs    | 233 ++++++++++++++++++++++++---
 crates/ui-egui/src/widgets.rs        |  86 +++++++++-
 crates/ui-egui/tests/create.rs       |  35 +++-
 parity/acrobat-features.toml         |   6 +-
 22 files changed, 636 insertions(+), 62 deletions(-)
 create mode 100644 crates/engine/src/optimizer.rs

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 930a4449..8971d853 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b2f1f0417e41ab934c7b979b2fd2b3b69cab52a193d035122a58a4d00f2c0566"
+sha256 = "b2afa2c39b397f44feed8aa3ebbaf8103c8d69c8e75a9671e01cf08140c85a4b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "448db933a78de5e51dfae62d9a34293da0ead418ecafeec94bf08c50510f41d8"
+sha256 = "6d61957b3b6208ceb5d313638c610e81eca6ee186a4fe03ece08b4f87f39fd0c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e275641e7a20916219762730e18160edba7c4d0ac7fd963338ee1fb95ec1c355"
+sha256 = "47ea331f7cf88a7e8584d358999d03af8b4250904a40d450f3d23bb151ce5c78"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8ef5004a37a5998f789d62d708a7d1973ea5b0e3a606319449597d2908423853"
+sha256 = "a4f02e370ce90fc5917915ebaa79ffe82a679e5e2b25087b7a6646430de1e457"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ac7789cda9148a2b75c4e5156de9bdd6ddbcc5b6405f25abf06fcf8d861c6853"
+sha256 = "f862797c038b3c5e2d91d387356ebe2b38d90a0e25f4a2154ae73182af575f59"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "69dc55fca4e7c03b7442e86ab0274b2840e8185f5ad1382a1d54929fb6b8924c"
+sha256 = "38eae66397d61c9ed13bef9c393f612df08936b3ac066a3e8af3a6aea36d7b5e"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 98a46934..68de16b0 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -20,6 +20,7 @@ pub mod export;
 pub mod js;
 pub mod links;
 pub mod ocr;
+pub mod optimizer;
 pub mod signature_image;
 pub mod xfa;
 
@@ -1836,6 +1837,8 @@ pub enum EditError {
     Sign(String),
     #[error("{0}")]
     Optimize(String),
+    #[error("cancelled")]
+    Cancelled,
     #[error("{0} isn't possible in a signed document: it would rewrite the file and invalidate the signatures")]
     SignedRewrite(String),
     #[error("this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)")]
@@ -2572,21 +2575,10 @@ impl Session {
 
     /// Optimize PDF ▸ Advanced optimization: `settings` for images and objects, plus Remove
     /// Hidden Information's `discard` categories (user data). A full rewrite: signed documents
-    /// are refused. The open document is not changed.
+    /// are refused. The open document is not changed. This is [`Self::optimize_job`] run in
+    /// place, without progress.
     pub fn optimized_bytes(&self, id: DocId, settings: &optimize::Settings, discard: &[Hidden]) -> Result<(Arc<Vec<u8>>, OptimizeReport), EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        if doc.is_signed() {
-            return Err(EditError::Signed);
-        }
-        let editor = doc.editor.as_ref().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
-        let mut cos = editor.cos.clone();
-        let discarded = if discard.is_empty() { Vec::new() } else { pdfcraft_redact::sanitize::remove_hidden(&mut cos, discard)? };
-        let report = optimize::optimize(&mut cos, settings).map_err(|e| EditError::Optimize(e.to_string()))?;
-        let all: Vec<pdfcraft_cos::ObjRef> = cos.object_numbers().into_iter().map(|n| pdfcraft_cos::ObjRef::new(n, cos.generation(n))).collect();
-        let merged = pdfcraft_organize::dedupe_resources(&mut cos, &all, false);
-        let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
-        let bytes = write_full(&cos, &opts).map_err(|e| EditError::Write(e.to_string()))?;
-        Ok((Arc::new(bytes), OptimizeReport { optimize: report, merged, discarded }))
+        self.optimize_job(id, settings, discard)?.run(|_| true)
     }
 
     /// Export comments and/or form data: XFDF and FDF carry either or both; XML, CSV and text
diff --git a/crates/engine/src/optimizer.rs b/crates/engine/src/optimizer.rs
new file mode 100644
index 00000000..569dd81b
--- /dev/null
+++ b/crates/engine/src/optimizer.rs
@@ -0,0 +1,104 @@
+//! Optimize PDF ▸ Advanced optimization as a job that reports its progress.
+//!
+//! Optimizing a large file takes a while (every image is decoded, resampled and re-encoded), so
+//! it is split like OCR: [`Session::optimize_job`] captures a copy of the document and the
+//! choices, and [`OptimizeJob::run`] works anywhere (the UI runs it on a worker thread),
+//! reporting each [`OptimizeStage`] and stopping when asked to.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::{SaveOptions, write_full};
+
+use crate::{DocId, EditError, Hidden, OptimizeReport, Session, guard, optimize};
+
+/// Where an optimization is.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum OptimizeStage {
+    /// Removing the user data chosen under Discard User Data.
+    #[default]
+    Discarding,
+    /// About to process image `done` (0-based) of `total`.
+    Images { done: usize, total: usize },
+    /// Discarding objects and compressing unencoded streams.
+    CleaningUp,
+    /// Merging identical fonts and images.
+    Merging,
+    /// Writing the compressed copy.
+    Writing,
+}
+
+impl OptimizeStage {
+    /// How far along the whole run is, from 0 to 1. Images take most of the time; the rest are
+    /// small fixed steps.
+    pub fn fraction(self) -> f32 {
+        match self {
+            OptimizeStage::Discarding => 0.0,
+            OptimizeStage::Images { done, total } => 0.05 + 0.75 * if total == 0 { 1.0 } else { done.min(total) as f32 / total as f32 },
+            OptimizeStage::CleaningUp => 0.8,
+            OptimizeStage::Merging => 0.85,
+            OptimizeStage::Writing => 0.9,
+        }
+    }
+}
+
+/// The optimized copy's bytes and what was done.
+pub type Optimized = (Arc<Vec<u8>>, OptimizeReport);
+
+/// What an optimization needs, independent of the session.
+pub struct OptimizeJob {
+    cos: pdfcraft_cos::Document,
+    settings: optimize::Settings,
+    discard: Vec<Hidden>,
+    opts: SaveOptions,
+}
+
+impl Session {
+    /// Capture what optimizing document `id` with `settings` and the Remove Hidden Information
+    /// `discard` categories needs. A full rewrite: signed documents are refused.
+    pub fn optimize_job(&self, id: DocId, settings: &optimize::Settings, discard: &[Hidden]) -> Result<OptimizeJob, EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        if doc.is_signed() {
+            return Err(EditError::Signed);
+        }
+        let editor = doc.editor.as_ref().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
+        Ok(OptimizeJob {
+            cos: editor.cos.clone(),
+            settings: settings.clone(),
+            discard: discard.to_vec(),
+            opts: SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() },
+        })
+    }
+}
+
+impl OptimizeJob {
+    /// Optimize and write the copy. `progress` is called as each stage starts and before each
+    /// image; returning `false` stops with [`EditError::Cancelled`]. A panic is returned as an
+    /// error, so a worker thread always reports back.
+    pub fn run(self, mut progress: impl FnMut(OptimizeStage) -> bool) -> Result<Optimized, EditError> {
+        guard(move || self.work(&mut progress)).map_err(EditError::Optimize)?
+    }
+
+    fn work(self, progress: &mut dyn FnMut(OptimizeStage) -> bool) -> Result<Optimized, EditError> {
+        let OptimizeJob { mut cos, settings, discard, opts } = self;
+        let mut step = |stage| if progress(stage) { Ok(()) } else { Err(EditError::Cancelled) };
+        step(OptimizeStage::Discarding)?;
+        let discarded = if discard.is_empty() { Vec::new() } else { pdfcraft_redact::sanitize::remove_hidden(&mut cos, &discard)? };
+        let report = optimize::optimize_with_progress(&mut cos, &settings, &mut |s| {
+            step(match s {
+                optimize::Stage::Images { done, total } => OptimizeStage::Images { done, total },
+                optimize::Stage::CleanUp => OptimizeStage::CleaningUp,
+            })
+            .is_ok()
+        })
+        .map_err(|e| match e {
+            optimize::OptimizeError::Cancelled => EditError::Cancelled,
+            e => EditError::Optimize(e.to_string()),
+        })?;
+        step(OptimizeStage::Merging)?;
+        let all: Vec<pdfcraft_cos::ObjRef> = cos.object_numbers().into_iter().map(|n| pdfcraft_cos::ObjRef::new(n, cos.generation(n))).collect();
+        let merged = pdfcraft_organize::dedupe_resources(&mut cos, &all, false);
+        step(OptimizeStage::Writing)?;
+        let bytes = write_full(&cos, &opts).map_err(|e| EditError::Write(e.to_string()))?;
+        Ok((Arc::new(bytes), OptimizeReport { optimize: report, merged, discarded }))
+    }
+}
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index 2af4a5f2..3a2d5109 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -254,7 +254,7 @@ mod tests {
         let preview = doc.image_signature_preview(0, 0).unwrap().unwrap();
         assert_eq!(preview.image.rgba(), image.rgba());
         let background = preview.render_background(1.0).unwrap();
-        assert!(background.rgba.chunks_exact(4).all(|p| p == [255, 255, 255, 255]));
+        assert!(background.rgba.as_chunks::<4>().0.iter().all(|p| *p == [255, 255, 255, 255]));
         assert!(Arc::ptr_eq(&bytes, &doc.bytes));
         assert_eq!(doc.edit_generation(), generation);
         assert_eq!(doc.can_undo(), Some("Add signature"));
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 9759a72d..6a03dc54 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -987,6 +987,39 @@ fn create_and_reduce() {
     assert_eq!(page_texts(&s3, r), ["Page 1", "Page 1"]);
 }
 
+#[test]
+fn an_optimize_job_reports_its_stages_and_can_be_cancelled() {
+    use crate::optimizer::OptimizeStage;
+    let (s, id) = session_with(2);
+    let settings = optimize::Settings::default();
+    let mut stages = Vec::new();
+    let (bytes, _) = s
+        .optimize_job(id, &settings, &[])
+        .unwrap()
+        .run(|st| {
+            stages.push(st);
+            true
+        })
+        .unwrap();
+    assert!(bytes.starts_with(b"%PDF-"));
+    assert_eq!(stages.first(), Some(&OptimizeStage::Discarding));
+    assert_eq!(&stages[stages.len() - 3..], [OptimizeStage::CleaningUp, OptimizeStage::Merging, OptimizeStage::Writing]);
+    let fractions: Vec<f32> = stages.iter().map(|st| st.fraction()).collect();
+    assert!(fractions.windows(2).all(|w| w[0] <= w[1]), "the bar never goes back: {fractions:?}");
+    assert!(fractions.iter().all(|f| (0.0..=1.0).contains(f)));
+    assert_eq!(
+        OptimizeStage::Images { done: 0, total: 0 }.fraction(),
+        OptimizeStage::Images { done: 5, total: 5 }.fraction(),
+        "no images: no division by zero"
+    );
+
+    // Cancelled at the merge: nothing is written, the open document is untouched.
+    let before = s.get(id).unwrap().bytes.clone();
+    let r = s.optimize_job(id, &settings, &[]).unwrap().run(|st| st != OptimizeStage::Merging);
+    assert!(matches!(r, Err(EditError::Cancelled)), "{r:?}");
+    assert_eq!(s.get(id).unwrap().bytes, before);
+}
+
 #[test]
 fn flattening_keeps_the_look_and_drops_the_objects() {
     let mut s = Session::new().with_clock(|| 1_700_000_000);
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 6b1adb38..87d06128 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -5,6 +5,8 @@ Advanced optimization).
 
 ```rust
 let report = optimize(&mut doc, &Settings::default())?;   // Reduce File Size's choices
+// Or with progress: called before each image and the clean-up; `false` cancels.
+let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going)?;
 ```
 
 - **Images:** the effective resolution of each image is measured where pages draw it (the CTM
@@ -17,5 +19,7 @@ let report = optimize(&mut doc, &Settings::default())?;   // Reduce File Size's
 - **Clean up:** Flate for streams with no filter.
 
 The engine runs Remove Hidden Information (`pdfcraft-redact`) for the user-data categories,
-then this, then merges identical objects and writes a full, compressed save. JPEG decoding and
+then this, then merges identical objects and writes a full, compressed save
+(`pdfcraft_engine::optimizer::OptimizeJob`, which the UI runs on a worker thread with a
+progress bar). JPEG decoding and
 encoding and resampling come from the `image` crate.
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 69e16ba3..4f079e14 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -5,7 +5,7 @@ use std::collections::{HashMap, HashSet};
 use pdfcraft_content::Matrix;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
 
-use crate::{Compression, ImageSettings, OptimizeError, Report, Settings};
+use crate::{Compression, ImageSettings, OptimizeError, Report, Settings, Stage};
 
 /// Images with more pixels than this are left alone (memory).
 const MAX_PIXELS: u64 = 80_000_000;
@@ -292,7 +292,13 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
     (after < before).then_some((new, smask))
 }
 
-pub(crate) fn run(doc: &mut Document, pages: &[ObjRef], settings: &Settings, report: &mut Report) -> Result<(), OptimizeError> {
+pub(crate) fn run(
+    doc: &mut Document,
+    pages: &[ObjRef],
+    settings: &Settings,
+    report: &mut Report,
+    progress: &mut dyn FnMut(Stage) -> bool,
+) -> Result<(), OptimizeError> {
     let ppi = effective_resolutions(doc, pages);
     // Soft masks are processed with their image, not on their own.
     let masks: HashSet<ObjRef> = ppi
@@ -304,7 +310,11 @@ pub(crate) fn run(doc: &mut Document, pages: &[ObjRef], settings: &Settings, rep
         .collect();
     let mut refs: Vec<(ObjRef, f64)> = ppi.into_iter().filter(|(r, _)| !masks.contains(r)).collect();
     refs.sort_by_key(|(r, _)| r.num);
-    for (r, ppi) in refs {
+    let total = refs.len();
+    for (done, (r, ppi)) in refs.into_iter().enumerate() {
+        if !progress(Stage::Images { done, total }) {
+            return Err(OptimizeError::Cancelled);
+        }
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
@@ -324,5 +334,8 @@ pub(crate) fn run(doc: &mut Document, pages: &[ObjRef], settings: &Settings, rep
             doc.set(mr, Object::Stream(m));
         }
     }
+    if !progress(Stage::Images { done: total, total }) {
+        return Err(OptimizeError::Cancelled);
+    }
     Ok(())
 }
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 89b90a0a..7f241b68 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -33,6 +33,17 @@ pub enum OptimizeError {
     NoPages,
     #[error(transparent)]
     Cos(#[from] pdfcraft_cos::CosError),
+    #[error("the optimization was cancelled")]
+    Cancelled,
+}
+
+/// Where an optimization is, reported to [`optimize_with_progress`]'s callback.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Stage {
+    /// About to process image `done` (0-based) of `total`; `done == total` once all are done.
+    Images { done: usize, total: usize },
+    /// Discarding objects, cleaning up links and compressing unencoded streams.
+    CleanUp,
 }
 
 /// How resampled (or recompressed) images are stored.
@@ -118,9 +129,18 @@ pub struct Report {
 
 /// Optimize `doc` in place.
 pub fn optimize(doc: &mut Document, settings: &Settings) -> Result<Report, OptimizeError> {
+    optimize_with_progress(doc, settings, &mut |_| true)
+}
+
+/// [`optimize`], calling `progress` before each image and before the clean-up. Returning `false`
+/// stops with [`OptimizeError::Cancelled`]; `doc` is then partly optimized and should be dropped.
+pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress: &mut dyn FnMut(Stage) -> bool) -> Result<Report, OptimizeError> {
     let mut report = Report::default();
     let pages = pdfcraft_annot::page_refs(doc).map_err(|_| OptimizeError::NoPages)?;
-    images::run(doc, &pages, settings, &mut report)?;
+    images::run(doc, &pages, settings, &mut report, progress)?;
+    if !progress(Stage::CleanUp) {
+        return Err(OptimizeError::Cancelled);
+    }
     if settings.discard_thumbnails {
         for p in &pages {
             if doc.get(*p).as_dict().is_some_and(|d| d.contains(b"Thumb")) {
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 1b9b969a..9e698756 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -265,3 +265,42 @@ fn invalid_links_and_unreferenced_destinations_go() {
     let off = Settings { remove_invalid_links: false, remove_unreferenced_dests: false, ..Settings::default() };
     assert_eq!(optimize(&mut again, &off).unwrap().invalid_links, 0);
 }
+
+#[test]
+fn progress_is_reported_per_image_and_a_refusal_cancels() {
+    use pdfcraft_optimize::{OptimizeError, Stage, optimize_with_progress};
+    let build = || {
+        let mut doc = Document::new_empty();
+        let a = image(&mut doc, 300, 300, 3, false, None);
+        let b = image(&mut doc, 300, 300, 1, false, None);
+        let c = image(&mut doc, 300, 300, 3, true, None);
+        page(&mut doc, &[("A", a), ("B", b), ("C", c)], "q 72 0 0 72 0 0 cm /A Do Q q 72 0 0 72 100 0 cm /B Do Q q 72 0 0 72 200 0 cm /C Do Q");
+        doc
+    };
+    let mut seen = Vec::new();
+    let report = optimize_with_progress(&mut build(), &Settings::default(), &mut |s| {
+        seen.push(s);
+        true
+    })
+    .unwrap();
+    assert_eq!(report.images, 3);
+    assert_eq!(
+        seen,
+        [
+            Stage::Images { done: 0, total: 3 },
+            Stage::Images { done: 1, total: 3 },
+            Stage::Images { done: 2, total: 3 },
+            Stage::Images { done: 3, total: 3 },
+            Stage::CleanUp
+        ]
+    );
+
+    // Stopping after the first image.
+    let mut calls = 0;
+    let r = optimize_with_progress(&mut build(), &Settings::default(), &mut |_| {
+        calls += 1;
+        calls < 2
+    });
+    assert!(matches!(r, Err(OptimizeError::Cancelled)), "{r:?}");
+    assert_eq!(calls, 2, "nothing runs after the refusal");
+}
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index f3295c6e..b80135ff 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -594,6 +594,7 @@ impl Host for crate::PdfCraftApp {
             "theme_preference": self.theme_preference,
             "language": self.language,
             "notice": self.toast.as_ref().map(|t| t.0.clone()),
+            "progress": self.progress_notice.as_ref().map(|p| json!({ "label": p.label, "fraction": p.fraction })),
             "password_prompt": self.password_prompt.is_some(),
             "close_prompt": self.close_request.is_some(),
         })
diff --git a/crates/ui-egui/src/create_ui.rs b/crates/ui-egui/src/create_ui.rs
index 9e2c30b5..56e82d88 100644
--- a/crates/ui-egui/src/create_ui.rs
+++ b/crates/ui-egui/src/create_ui.rs
@@ -221,15 +221,9 @@ impl PdfCraftApp {
     }
 
     /// Reduce File Size: write a compacted copy with images downsampled (the open document is
-    /// unchanged).
+    /// unchanged). It runs in the background with a progress bar, like the PDF Optimizer.
     pub(crate) fn reduce_file_size(&mut self) {
-        // What's typed in a form field is part of the document (#166).
-        if !self.commit_form_typing() {
-            return;
-        }
-        let Some((_, id)) = self.active_ids() else { return };
-        let result = self.session.reduced_bytes(id).map(|(b, _)| (b, String::new()));
-        self.save_optimized(id, "reduced", result);
+        self.start_optimize(crate::optimize_ui::OptimizeKind::Reduce, &pdfcraft_engine::optimize::Settings::default(), &[]);
     }
 
     /// Save an optimized copy (Reduce File Size, Optimize PDF) next to the original, reporting
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index abdcd16e..657d73f8 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1502,6 +1502,15 @@
 	Created 1 link	Se ha creado 1 enlace
 	Created {n} links	Se han creado {n} enlaces
 	Text recognition is already running	El reconocimiento de texto ya está en ejecución
+	Optimizing… removing user data	Optimizando… eliminando datos de usuario
+	Optimizing… image {d} of {t}	Optimizando… imagen {d} de {t}
+	Optimizing… cleaning up	Optimizando… limpiando
+	Optimizing… merging identical objects	Optimizando… combinando objetos idénticos
+	Optimizing… writing the copy	Optimizando… escribiendo la copia
+	Cancelling…	Cancelando…
+	Optimization is already running	La optimización ya está en ejecución
+	Optimization cancelled	Optimización cancelada
+	Couldn't optimize the file	No se pudo optimizar el archivo
 	Recognizing text… file {d} of {t}	Reconociendo texto… archivo {d} de {t}
 	Recognizing text… page {d} of {t}	Reconociendo texto… página {d} de {t}
 	Recognized 1 word	Se ha reconocido 1 palabra
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index a787eb26..b99824aa 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1499,6 +1499,15 @@
 	Created 1 link	1 lien créé
 	Created {n} links	{n} liens créés
 	Text recognition is already running	La reconnaissance de texte est déjà en cours
+	Optimizing… removing user data	Optimisation… suppression des données utilisateur
+	Optimizing… image {d} of {t}	Optimisation… image {d} sur {t}
+	Optimizing… cleaning up	Optimisation… nettoyage
+	Optimizing… merging identical objects	Optimisation… fusion des objets identiques
+	Optimizing… writing the copy	Optimisation… écriture de la copie
+	Cancelling…	Annulation…
+	Optimization is already running	L'optimisation est déjà en cours
+	Optimization cancelled	Optimisation annulée
+	Couldn't optimize the file	Impossible d'optimiser le fichier
 	Recognizing text… file {d} of {t}	Reconnaissance du texte… fichier {d} sur {t}
 	Recognizing text… page {d} of {t}	Reconnaissance du texte… page {d} sur {t}
 	Recognized 1 word	1 mot reconnu
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 6eef7ae1..b81e8855 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1508,6 +1508,15 @@
 	Created 1 link	リンクを 1 件作成しました
 	Created {n} links	リンクを {n} 件作成しました
 	Text recognition is already running	テキスト認識はすでに実行中です
+	Optimizing… removing user data	最適化中… ユーザーデータを削除しています
+	Optimizing… image {d} of {t}	最適化中… 画像 {d} / {t}
+	Optimizing… cleaning up	最適化中… クリーンアップしています
+	Optimizing… merging identical objects	最適化中… 同一オブジェクトを統合しています
+	Optimizing… writing the copy	最適化中… コピーを書き込んでいます
+	Cancelling…	キャンセルしています…
+	Optimization is already running	最適化はすでに実行中です
+	Optimization cancelled	最適化をキャンセルしました
+	Couldn't optimize the file	ファイルを最適化できませんでした
 	Recognizing text… file {d} of {t}	テキストを認識中… ファイル {d} / {t}
 	Recognizing text… page {d} of {t}	テキストを認識中… ページ {d} / {t}
 	Recognized 1 word	1 語を認識しました
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index f78afde6..17d7fda3 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -1504,6 +1504,15 @@ action wizard	Start	ప్రారంభించు
 	Created 1 link	1 లింక్ సృష్టించబడింది
 	Created {n} links	{n} లింక్‌లు సృష్టించబడ్డాయి
 	Text recognition is already running	టెక్స్ట్ గుర్తింపు ఇప్పటికే అమలవుతోంది
+	Optimizing… removing user data	ఆప్టిమైజ్ చేస్తోంది… వినియోగదారు డేటాను తీసివేస్తోంది
+	Optimizing… image {d} of {t}	ఆప్టిమైజ్ చేస్తోంది… {t}లో {d}వ చిత్రం
+	Optimizing… cleaning up	ఆప్టిమైజ్ చేస్తోంది… చక్కదిద్దుతోంది
+	Optimizing… merging identical objects	ఆప్టిమైజ్ చేస్తోంది… ఒకేలా ఉన్న ఆబ్జెక్ట్‌లను విలీనం చేస్తోంది
+	Optimizing… writing the copy	ఆప్టిమైజ్ చేస్తోంది… కాపీని రాస్తోంది
+	Cancelling…	రద్దు చేస్తోంది…
+	Optimization is already running	ఆప్టిమైజేషన్ ఇప్పటికే అమలవుతోంది
+	Optimization cancelled	ఆప్టిమైజేషన్ రద్దు చేయబడింది
+	Couldn't optimize the file	ఫైల్‌ను ఆప్టిమైజ్ చేయడం సాధ్యం కాలేదు
 	Recognizing text… file {d} of {t}	టెక్స్ట్‌ను గుర్తిస్తోంది… {t}లో {d}వ ఫైల్
 	Recognizing text… page {d} of {t}	టెక్స్ట్‌ను గుర్తిస్తోంది… {t}లో {d}వ పేజీ
 	Recognized 1 word	1 పదం గుర్తించబడింది
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 508aaf57..4f0487f6 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -1459,6 +1459,15 @@
 	Created 1 link	已创建 1 个链接
 	Created {n} links	已创建{n}个链接
 	Text recognition is already running	文本识别已在运行
+	Optimizing… removing user data	正在优化…删除用户数据
+	Optimizing… image {d} of {t}	正在优化…第{d}张图像，共{t}张
+	Optimizing… cleaning up	正在优化…清理
+	Optimizing… merging identical objects	正在优化…合并相同对象
+	Optimizing… writing the copy	正在优化…写入副本
+	Cancelling…	正在取消…
+	Optimization is already running	优化已在运行
+	Optimization cancelled	已取消优化
+	Couldn't optimize the file	无法优化文件
 	Recognizing text… file {d} of {t}	正在识别文本…第{d}个文件，共{t}个
 	Recognizing text… page {d} of {t}	正在识别文本…第{d}页，共{t}页
 	Recognized 1 word	识别了 1 个单词
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 39a21471..8c041d92 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1417,6 +1417,15 @@
 	Created 1 link	已建立 1 個連結
 	Created {n} links	已建立{n}個連結
 	Text recognition is already running	文字識別已在執行
+	Optimizing… removing user data	正在最佳化…移除使用者資料
+	Optimizing… image {d} of {t}	正在最佳化…第{d}張圖片，共{t}張
+	Optimizing… cleaning up	正在最佳化…清理
+	Optimizing… merging identical objects	正在最佳化…合併相同物件
+	Optimizing… writing the copy	正在最佳化…寫入副本
+	Cancelling…	正在取消…
+	Optimization is already running	最佳化已在執行
+	Optimization cancelled	已取消最佳化
+	Couldn't optimize the file	無法最佳化檔案
 	Recognizing text… file {d} of {t}	正在辨識文字…第{d}個檔案，共{t}個
 	Recognizing text… page {d} of {t}	正在辨識文字…第{d}頁，共{t}頁
 	Recognized 1 word	辨識了 1 個單詞
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 32cecb17..a80d6629 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -457,6 +457,10 @@ pub struct PdfCraftApp {
     pub stamp_draft: stamps_ui::StampDraft,
     /// PDF Optimizer choices.
     pub optimize_draft: OptimizeDraft,
+    /// The running optimization (Optimize PDF ▸ Advanced optimization).
+    pub optimize_run: Option<optimize_ui::OptimizeRun>,
+    /// A background job's progress card (see [`widgets::progress_notice`]).
+    pub progress_notice: Option<widgets::ProgressNotice>,
     /// Pages copied or cut in Organize Pages, ready to paste (into any document).
     pub page_clipboard: Option<PageClip>,
     /// Files dropped on the page grid, waiting for the pointer to say which gap they go to.
@@ -659,6 +663,8 @@ impl PdfCraftApp {
             custom_stamps: Vec::new(),
             stamp_draft: Default::default(),
             optimize_draft: OptimizeDraft::default(),
+            optimize_run: None,
+            progress_notice: None,
             page_clipboard: None,
             grid_drop: None,
             last_snapshot: None,
@@ -1108,6 +1114,13 @@ impl PdfCraftApp {
         }
     }
 
+    /// Draw the running job's progress card and pass a Cancel click on to the job.
+    fn show_progress(&mut self, ctx: &egui::Context) {
+        if widgets::progress_notice(self, ctx) {
+            self.cancel_optimize();
+        }
+    }
+
     fn sync_theme(&mut self, ctx: &egui::Context) {
         let kind = self.theme_preference.resolve(ctx.system_theme(), self.theme);
         if kind != self.theme {
@@ -1636,6 +1649,7 @@ impl eframe::App for PdfCraftApp {
         }
         self.poll_export();
         self.poll_ocr();
+        self.poll_optimize();
         self.poll_action();
         self.process_file_requests();
         #[cfg(not(target_arch = "wasm32"))]
@@ -1680,6 +1694,7 @@ impl eframe::App for PdfCraftApp {
             );
             dialogs::show(self, &ctx);
             // Notices too: a refused field value or a failed save must be seen in full screen.
+            self.show_progress(&ctx);
             widgets::toast(self, &ctx);
             return;
         }
@@ -1703,6 +1718,7 @@ impl eframe::App for PdfCraftApp {
         self.process_pending_edits();
         palette::show(self, &ctx);
         dialogs::show(self, &ctx);
+        self.show_progress(&ctx);
         widgets::toast(self, &ctx);
     }
 }
diff --git a/crates/ui-egui/src/optimize_ui.rs b/crates/ui-egui/src/optimize_ui.rs
index a607cfb1..ba65f465 100644
--- a/crates/ui-egui/src/optimize_ui.rs
+++ b/crates/ui-egui/src/optimize_ui.rs
@@ -1,9 +1,16 @@
 //! Optimize PDF ▸ Advanced optimization (Acrobat's PDF Optimizer): Images, Discard Objects,
 //! Discard User Data and Clean Up panels. The result is saved as a copy, like Reduce File Size.
+//!
+//! The optimization (this dialog's, or Reduce File Size's fixed choices) runs on a worker thread
+//! and shows its progress in a notice with a bar and a Cancel button; the copy is saved once it
+//! is done.
+
+use std::sync::{Arc, Mutex};
 
 use egui::{Align, Layout};
-use pdfcraft_engine::Hidden;
 use pdfcraft_engine::optimize::{Compression, ImageSettings, QUALITIES, Settings};
+use pdfcraft_engine::optimizer::{OptimizeStage, Optimized};
+use pdfcraft_engine::{DocId, EditError, Hidden, OptimizeReport};
 
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, widgets};
@@ -32,6 +39,73 @@ impl Default for OptimizeDraft {
     }
 }
 
+/// Progress of a background optimization: the stage, the result once finished, and a cancel
+/// request.
+#[derive(Default)]
+pub struct OptimizeProgress {
+    pub stage: OptimizeStage,
+    pub result: Option<Result<Optimized, EditError>>,
+    pub cancel: bool,
+}
+
+/// Which command started an optimization: they save under different names, and only the
+/// Optimizer's notice lists what it did.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum OptimizeKind {
+    /// Reduce File Size (Acrobat's defaults).
+    Reduce,
+    /// Optimize PDF ▸ Advanced optimization (the dialog's choices).
+    Advanced,
+}
+
+impl OptimizeKind {
+    /// The suffix of the saved copy's name ("notes (reduced).pdf").
+    fn suffix(self) -> &'static str {
+        match self {
+            OptimizeKind::Reduce => "reduced",
+            OptimizeKind::Advanced => "optimized",
+        }
+    }
+}
+
+pub struct OptimizeRun {
+    pub doc: DocId,
+    pub kind: OptimizeKind,
+    pub progress: Arc<Mutex<OptimizeProgress>>,
+}
+
+/// The notice's text for a stage.
+fn stage_label(stage: OptimizeStage) -> String {
+    match stage {
+        OptimizeStage::Discarding => tl!("Optimizing… removing user data").to_string(),
+        OptimizeStage::Images { done, total } => crate::i18n::fmt(
+            tl!("Optimizing… image {d} of {t}"),
+            &[("d", &(done + 1).min(total.max(1)).to_string()), ("t", &total.max(1).to_string())],
+        ),
+        OptimizeStage::CleaningUp => tl!("Optimizing… cleaning up").to_string(),
+        OptimizeStage::Merging => tl!("Optimizing… merging identical objects").to_string(),
+        OptimizeStage::Writing => tl!("Optimizing… writing the copy").to_string(),
+    }
+}
+
+/// What the saved notice adds after the size: images optimized and items discarded.
+fn summary(r: &OptimizeReport) -> String {
+    let o = &r.optimize;
+    let mut parts = Vec::new();
+    if o.images_resampled + o.images_recompressed > 0 {
+        parts.push(format!(
+            "{} image{} optimized",
+            o.images_resampled + o.images_recompressed,
+            if o.images_resampled + o.images_recompressed == 1 { "" } else { "s" }
+        ));
+    }
+    let discarded: usize = r.discarded.iter().map(|(_, n)| n).sum();
+    if discarded > 0 {
+        parts.push(format!("{discarded} item{} discarded", if discarded == 1 { "" } else { "s" }));
+    }
+    if parts.is_empty() { String::new() } else { format!("; {}", parts.join(", ")) }
+}
+
 fn image_row(ui: &mut egui::Ui, id: &str, title: &str, s: &mut ImageSettings) {
     ui.label(egui::RichText::new(tl!(title)).font(theme::semibold(13.0)));
     ui.horizontal(|ui| {
@@ -188,30 +262,153 @@ pub(crate) fn audit_body(ui: &mut egui::Ui, rows: &[pdfcraft_engine::optimize::S
 }
 
 impl PdfCraftApp {
-    /// Optimize PDF with the dialog's choices and save the copy.
+    /// Optimize PDF with the dialog's choices on a worker thread; the copy is saved when done.
     pub fn optimize_with_draft(&mut self) {
+        let (settings, discard) = (self.optimize_draft.settings.clone(), self.optimize_draft.discard.clone());
+        self.start_optimize(OptimizeKind::Advanced, &settings, &discard);
+    }
+
+    /// Run an optimization of the active document on a worker thread (inline in tests and on
+    /// the web), showing its progress; the copy is saved when it is done.
+    pub(crate) fn start_optimize(&mut self, kind: OptimizeKind, settings: &Settings, discard: &[Hidden]) {
         // What's typed in a form field is part of the document (#166).
         if !self.commit_form_typing() {
             return;
         }
         let Some((_, id)) = self.active_ids() else { return };
-        let d = self.optimize_draft.clone();
-        let result = self.session.optimized_bytes(id, &d.settings, &d.discard).map(|(b, r)| {
-            let o = &r.optimize;
-            let mut parts = Vec::new();
-            if o.images_resampled + o.images_recompressed > 0 {
-                parts.push(format!(
-                    "{} image{} optimized",
-                    o.images_resampled + o.images_recompressed,
-                    if o.images_resampled + o.images_recompressed == 1 { "" } else { "s" }
-                ));
+        if self.optimize_run.is_some() {
+            self.notify_tr("Optimization is already running");
+            return;
+        }
+        let job = match self.session.optimize_job(id, settings, discard) {
+            Ok(job) => job,
+            Err(e) => return self.save_optimized(id, kind.suffix(), Err(e)),
+        };
+        let progress = Arc::new(Mutex::new(OptimizeProgress::default()));
+        let p = progress.clone();
+        let work = move || {
+            let result = job.run(|stage| {
+                let Ok(mut s) = p.lock() else { return false };
+                s.stage = stage;
+                !s.cancel
+            });
+            if let Ok(mut s) = p.lock() {
+                s.result = Some(result);
             }
-            let discarded: usize = r.discarded.iter().map(|(_, n)| n).sum();
-            if discarded > 0 {
-                parts.push(format!("{discarded} item{} discarded", if discarded == 1 { "" } else { "s" }));
+        };
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.run_inline {
+            work();
+        } else if let Err(e) = std::thread::Builder::new().name("pdfcraft-optimize".into()).spawn(work) {
+            // No worker: report the failure instead of waiting for a result that never comes.
+            if let Ok(mut s) = progress.lock() {
+                s.result = Some(Err(EditError::Optimize(e.to_string())));
             }
-            (b, if parts.is_empty() { String::new() } else { format!("; {}", parts.join(", ")) })
-        });
-        self.save_optimized(id, "optimized", result);
+        }
+        #[cfg(target_arch = "wasm32")]
+        work();
+        self.optimize_run = Some(OptimizeRun { doc: id, kind, progress });
+        self.poll_optimize();
+    }
+
+    /// Stop a running optimization (nothing is saved).
+    pub fn cancel_optimize(&mut self) {
+        if let Some(r) = &self.optimize_run
+            && let Ok(mut s) = r.progress.lock()
+        {
+            s.cancel = true;
+        }
+    }
+
+    /// Show progress; save the copy once the worker is done.
+    pub(crate) fn poll_optimize(&mut self) {
+        let Some(run) = self.optimize_run.as_ref() else { return };
+        let (doc, kind, progress) = (run.doc, run.kind, run.progress.clone());
+        let Ok(mut s) = progress.lock() else {
+            // The worker panicked while holding the lock: it will never report back.
+            self.optimize_run = None;
+            self.progress_notice = None;
+            self.notify_tr("Couldn't optimize the file");
+            return;
+        };
+        let Some(result) = s.result.take() else {
+            let cancelling = s.cancel;
+            let stage = s.stage;
+            drop(s);
+            let label = if cancelling { tl!("Cancelling…").to_string() } else { stage_label(stage) };
+            self.progress_notice = Some(crate::widgets::ProgressNotice { label, fraction: stage.fraction(), cancellable: !cancelling });
+            if let Some(ctx) = &self.ctx {
+                ctx.request_repaint_after(std::time::Duration::from_millis(50));
+            }
+            return;
+        };
+        drop(s);
+        self.optimize_run = None;
+        self.progress_notice = None;
+        match result {
+            Err(EditError::Cancelled) => self.notify_tr("Optimization cancelled"),
+            result => {
+                let result = result.map(|(b, r)| {
+                    let detail = if kind == OptimizeKind::Advanced { summary(&r) } else { String::new() };
+                    (b, detail)
+                });
+                self.save_optimized(doc, kind.suffix(), result);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use egui_kittest::Harness;
+    use egui_kittest::kittest::Queryable;
+
+    use super::*;
+
+    #[test]
+    fn the_progress_card_shows_the_stage_and_cancels() {
+        let progress = Arc::new(Mutex::new(OptimizeProgress { stage: OptimizeStage::Images { done: 3, total: 10 }, ..Default::default() }));
+        let p = progress.clone();
+        let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("notes.txt", None, b"hello".to_vec()).unwrap();
+            let (_, doc) = app.active_ids().unwrap();
+            app.optimize_run = Some(OptimizeRun { doc, kind: OptimizeKind::Advanced, progress: p });
+            app.notify("Saved notes.pdf");
+            app
+        });
+        // 1.5 s (kittest steps a quarter second): the bar has eased in, the toast still shows.
+        h.run_steps(6);
+        if let Ok(path) = std::env::var("PDFCRAFT_OPTIMIZE_PROGRESS_SHOT") {
+            h.render().unwrap().save(path).unwrap();
+        }
+        h.get_by_label("Optimizing… image 4 of 10");
+        let shown = h.state().progress_notice.clone().unwrap();
+        assert!((shown.fraction - 0.275).abs() < 1e-4, "{shown:?}");
+        assert!(shown.cancellable);
+
+        h.get_by_label("Cancel").click();
+        h.run_steps(2);
+        assert!(progress.lock().unwrap().cancel, "the worker is asked to stop");
+        h.get_by_label("Cancelling…");
+        assert!(h.query_by_label("Cancel").is_none(), "Cancel is not offered twice");
+
+        // The worker stops and reports back.
+        progress.lock().unwrap().result = Some(Err(EditError::Cancelled));
+        h.run_steps(2);
+        assert!(h.state().optimize_run.is_none() && h.state().progress_notice.is_none());
+        assert_eq!(h.state().toast.as_ref().map(|t| t.0.as_str()), Some("Optimization cancelled"));
+    }
+
+    #[test]
+    fn a_second_run_is_refused_while_one_is_going() {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("notes.txt", None, b"hello".to_vec()).unwrap();
+        let (_, doc) = app.active_ids().unwrap();
+        app.optimize_run = Some(OptimizeRun { doc, kind: OptimizeKind::Reduce, progress: Arc::default() });
+        app.optimize_with_draft();
+        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("Optimization is already running"));
     }
 }
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 9f5d41f2..6278a010 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -92,10 +92,13 @@ pub fn toast(app: &mut PdfCraftApp, ctx: &egui::Context) {
     }
     let t = Tokens::get(ctx);
     let screen = ctx.content_rect();
+    // Above the progress notice while a job runs.
+    let card = if app.progress_notice.is_some() { ctx.data(|d| d.get_temp::<f32>(egui::Id::new(PROGRESS_HEIGHT))).unwrap_or(0.0) } else { 0.0 };
+    let lift = if card > 0.0 { 28.0 + card + 10.0 } else { 28.0 };
     egui::Area::new(egui::Id::new("toast"))
         .order(egui::Order::Tooltip)
         .pivot(Align2::CENTER_BOTTOM)
-        .fixed_pos(screen.center_bottom() - vec2(0.0, 28.0))
+        .fixed_pos(screen.center_bottom() - vec2(0.0, lift))
         .show(ctx, |ui| {
             egui::Frame::NONE
                 .fill(if t.dark() { Color32::from_rgb(0xEC, 0xEC, 0xEF) } else { Color32::from_rgb(0x2A, 0x2A, 0x2F) })
@@ -108,6 +111,87 @@ pub fn toast(app: &mut PdfCraftApp, ctx: &egui::Context) {
     ctx.request_repaint_after(std::time::Duration::from_millis(100));
 }
 
+/// A background job's progress, shown at the bottom centre until the job is done.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ProgressNotice {
+    /// What is happening ("Optimizing… image 3 of 40").
+    pub label: String,
+    /// From 0 to 1.
+    pub fraction: f32,
+    /// Show a Cancel button.
+    pub cancellable: bool,
+}
+
+/// Where the progress notice keeps its height this frame, for placing the toast above it.
+const PROGRESS_HEIGHT: &str = "progress-notice-height";
+
+/// Draw [`PdfCraftApp::progress_notice`]: the label, a bar that eases towards the fraction with
+/// a light sweeping across it, the percentage and Cancel. Returns true when Cancel was clicked.
+pub fn progress_notice(app: &PdfCraftApp, ctx: &egui::Context) -> bool {
+    let Some(p) = &app.progress_notice else { return false };
+    let t = Tokens::get(ctx);
+    let screen = ctx.content_rect();
+    // The same inverted card as the toast.
+    let (fill, text) = if t.dark() {
+        (Color32::from_rgb(0xEC, 0xEC, 0xEF), Color32::from_rgb(0x22, 0x22, 0x26))
+    } else {
+        (Color32::from_rgb(0x2A, 0x2A, 0x2F), Color32::WHITE)
+    };
+    let fraction = if p.fraction.is_finite() { p.fraction.clamp(0.0, 1.0) } else { 0.0 };
+    let shown = ctx.animate_value_with_time(egui::Id::new("progress-notice-bar"), fraction, 0.3);
+    let now = ctx.input(|i| i.time);
+    let mut cancel = false;
+    let area = egui::Area::new(egui::Id::new("progress-notice"))
+        .order(egui::Order::Tooltip)
+        .pivot(Align2::CENTER_BOTTOM)
+        .fixed_pos(screen.center_bottom() - vec2(0.0, 28.0))
+        .show(ctx, |ui| {
+            egui::Frame::NONE.fill(fill).corner_radius(CornerRadius::same(10)).inner_margin(egui::Margin::symmetric(16, 12)).show(ui, |ui| {
+                let width = 340.0_f32.min(screen.width() - 64.0).max(160.0);
+                ui.set_width(width);
+                ui.horizontal(|ui| {
+                    ui.label(egui::RichText::new(&p.label).color(text));
+                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                        ui.label(egui::RichText::new(format!("{:.0}%", shown * 100.0)).font(theme::medium(12.0)).color(text.gamma_multiply(0.7)));
+                    });
+                });
+                ui.add_space(6.0);
+                let (track, resp) = ui.allocate_exact_size(vec2(width, 6.0), Sense::hover());
+                // The label above names the job; the bar carries the percentage.
+                resp.widget_info(|| {
+                    let mut info = egui::WidgetInfo::new(egui::WidgetType::ProgressIndicator);
+                    info.value = Some(f64::from(fraction) * 100.0);
+                    info
+                });
+                let painter = ui.painter();
+                painter.rect_filled(track, CornerRadius::same(3), text.gamma_multiply(0.18));
+                let done = Rect::from_min_size(track.min, vec2(track.width() * shown, track.height()));
+                if done.width() > 0.5 {
+                    painter.rect_filled(done, CornerRadius::same(3), t.accent);
+                    // A soft light sweeping along the filled part says the job is alive between
+                    // updates.
+                    let band = 48.0;
+                    let x = done.left() - band + ((now * 160.0) % f64::from(done.width() + band)) as f32;
+                    let clip = painter.with_clip_rect(done);
+                    for (i, a) in [0.10_f32, 0.22, 0.10].into_iter().enumerate() {
+                        let r = Rect::from_min_size(egui::pos2(x + i as f32 * band / 3.0, done.top()), vec2(band / 3.0, done.height()));
+                        clip.rect_filled(r, CornerRadius::ZERO, Color32::WHITE.gamma_multiply(a));
+                    }
+                }
+                if p.cancellable {
+                    ui.add_space(4.0);
+                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                        let b = egui::Button::new(egui::RichText::new(tl!("Cancel")).font(theme::medium(12.5)).color(text)).frame(false);
+                        cancel = ui.add(b).clicked();
+                    });
+                }
+            });
+        });
+    ctx.data_mut(|d| d.insert_temp(egui::Id::new(PROGRESS_HEIGHT), area.response.rect.height()));
+    ctx.request_repaint_after(std::time::Duration::from_millis(33));
+    cancel
+}
+
 /// The ArtCraft wordmark (Storyteller's brand, docs/brand/; not open source), sized to `height`.
 pub fn artcraft_logo(ui: &mut egui::Ui, height: f32) -> Response {
     let dark = ui.visuals().dark_mode;
diff --git a/crates/ui-egui/tests/create.rs b/crates/ui-egui/tests/create.rs
index 85d66854..9f5390bd 100644
--- a/crates/ui-egui/tests/create.rs
+++ b/crates/ui-egui/tests/create.rs
@@ -70,16 +70,30 @@ fn opening_images_and_text_converts_them_to_new_pdfs() {
 
 #[test]
 fn reduce_file_size_writes_a_compact_copy() {
+    use egui_kittest::Harness;
     let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-{}", std::process::id()));
     std::fs::create_dir_all(&dir).unwrap();
     let out = dir.join("reduced.pdf");
-    let mut app = PdfCraftApp::new();
-    app.open_bytes("notes.txt", None, "lorem ipsum ".repeat(500).into_bytes()).unwrap();
-    app.save_override = Some(out.to_string_lossy().into_owned());
-    assert!(app.execute("optimize.reduce"));
+    let out2 = out.clone();
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("notes.txt", None, "lorem ipsum ".repeat(500).into_bytes()).unwrap();
+        app.save_override = Some(out2.to_string_lossy().into_owned());
+        app
+    });
+    h.run_steps(2);
+    assert!(h.state_mut().execute("optimize.reduce"));
+    // It runs on a worker thread like the PDF Optimizer, with the progress card meanwhile.
+    let start = std::time::Instant::now();
+    while (h.state().optimize_run.is_some() || !out.exists()) && start.elapsed() < std::time::Duration::from_secs(30) {
+        h.run_steps(1);
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    h.run_steps(1);
+    assert!(h.state().optimize_run.is_none() && h.state().progress_notice.is_none(), "the run finished");
     let bytes = std::fs::read(&out).unwrap();
     assert!(bytes.starts_with(b"%PDF-"));
-    assert!(app.session.docs()[0].dirty, "the open document is unchanged");
+    assert!(h.state().session.docs()[0].dirty, "the open document is unchanged");
 }
 
 #[test]
@@ -128,7 +142,16 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
         assert!(d.settings.discard_tags && d.discard == vec![pdfcraft_engine::Hidden::Metadata]);
     }
     h.get_by_label("OK").click();
-    h.run_steps(3);
+    // The click is handled next frame. The optimization then runs on a worker thread and the
+    // copy is saved when it is done.
+    h.run_steps(1);
+    let start = std::time::Instant::now();
+    while (h.state().optimize_run.is_some() || !out.exists()) && start.elapsed() < std::time::Duration::from_secs(30) {
+        h.run_steps(1);
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    h.run_steps(2);
+    assert!(h.state().progress_notice.is_none(), "the progress card is gone");
     assert!(std::fs::read(&out).unwrap().starts_with(b"%PDF-"));
     assert_eq!(h.state().dialog, None);
 }
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 22b37a2a..5528a4ea 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7107,7 +7107,7 @@ status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
 evidence = ["crates/ui-egui/tests/create.rs::reduce_file_size_writes_a_compact_copy", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/automation.rs::optimizing_through_tools"]
-notes = "images above 225 ppi to 150 ppi JPEG medium, thumbnails dropped, resources merged, object streams"
+notes = "images above 225 ppi to 150 ppi JPEG medium, thumbnails dropped, resources merged, object streams; runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"
@@ -7130,8 +7130,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/ui-egui/tests/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/automation.rs::optimizing_through_tools"]
-notes = "Images, Discard Objects, Discard User Data, Clean Up; no Fonts or Transparency panels, no space audit"
+evidence = ["crates/ui-egui/tests/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/ui-egui/src/optimize_ui.rs::the_progress_card_shows_the_stage_and_cancels", "crates/engine/src/tests.rs::an_optimize_job_reports_its_stages_and_can_be_cancelled"]
+notes = "Images, Discard Objects, Discard User Data, Clean Up; runs in the background with a progress bar (per image) and Cancel; no Fonts or Transparency panels, no space audit"
 
 [[feature]]
 id = "optimize.downsample-images"

From 4a5022225828dd695b4d3378afc9b2209762a08e Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 07:49:26 +0900
Subject: [PATCH 022/149] Forms: round required-field border on radio buttons;
 Highlight fields is remembered (#372)

* Forms: round required-field border on radio buttons; Highlight fields is remembered

#260 (page 8) compares PdfCraft with Acrobat, which outlines required
checkboxes and radio buttons in red. Adobe's documentation says that
border shows "when the Highlight Existing Fields button is selected",
which PdfCraft already did (View: Highlight fields). Two differences
remained:

- The red border was a rectangle for every widget, so a round radio
  button got a square around its corners; Acrobat's follows the button.
  Radio buttons now get a round border and tint.
- Acrobat keeps Highlight existing fields as a preference, while
  PdfCraft forgot it for every document. The choice is now remembered
  for the next document and the next session (ViewDefaults and
  settings). It still defaults to off, and red borders still appear
  only while fields are highlighted.

Tests (view.rs): required_radio_buttons_get_a_round_red_border (the
widget's corner, outside the circle, is not red; on main it is) and
field_highlighting_is_remembered (a second document and a restored
session open highlighted; on main the second document didn't). The
form.highlight-fields parity entry cites both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* view.rs: the field-highlight tests sit with the others (no merge conflict with #363)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/src/canvas.rs | 28 +++++++++++----
 crates/ui-egui/src/lib.rs    |  4 +++
 crates/ui-egui/tests/view.rs | 67 ++++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml |  4 +--
 4 files changed, 95 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 1480ca21..a54dff08 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -109,11 +109,14 @@ pub struct ViewDefaults {
     pub fit: Fit,
     /// The zoom with [`Fit::None`] (1.0 = 100%).
     pub zoom: f32,
+    /// Highlight existing fields: a preference in Acrobat, so it carries over to the next
+    /// document and the next session.
+    pub highlight_fields: bool,
 }
 
 impl Default for ViewDefaults {
     fn default() -> Self {
-        Self { layout: PageLayout::Continuous, fit: Fit::Width, zoom: 1.0 }
+        Self { layout: PageLayout::Continuous, fit: Fit::Width, zoom: 1.0, highlight_fields: false }
     }
 }
 
@@ -340,7 +343,7 @@ impl DocView {
             rotation: 0,
             current: 0,
             organize: false,
-            highlight_fields: false,
+            highlight_fields: defaults.highlight_fields,
             page_input: "1".into(),
             notice_dismissed: false,
             cover: false,
@@ -1202,6 +1205,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         Some(Notice::Repairs) => app.dialog = Some(crate::Dialog::Properties(crate::PropsTab::Advanced)),
         Some(Notice::Security) => app.dialog = Some(crate::Dialog::Properties(crate::PropsTab::Security)),
         Some(Notice::Signatures) => app.right = Some(RightPanel::Signatures),
+        Some(Notice::FieldHighlights(on)) => app.view_defaults.highlight_fields = on,
         None => {}
     }
     // No dialog, close prompt or palette over the page: only then does page input count.
@@ -1739,17 +1743,25 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             }
 
             // Form-field highlight (Acrobat's "Highlight existing fields"); required fields get a
-            // red border.
+            // red border. Radio buttons are round, and so is theirs (as in Acrobat).
             if view.highlight_fields {
                 for f in form.iter() {
                     let required = f.has(pdfcraft_engine::field_flags::REQUIRED);
+                    let round = f.kind == pdfcraft_engine::FormFieldKind::Radio;
                     for w in f.widgets.iter().filter(|w| w.page == Some(i) && !w.hidden) {
                         let r = w.rect;
                         let sr = xf.user_rect(info, i, [r[0] as f32, r[1] as f32, r[2] as f32, r[3] as f32]);
-                        painter.rect_filled(sr, CornerRadius::same(1), Color32::from_rgba_unmultiplied(0x6E, 0x8E, 0xF5, 48));
+                        let tint = Color32::from_rgba_unmultiplied(0x6E, 0x8E, 0xF5, 48);
                         let (width, color) =
                             if required { (2.0, Color32::from_rgb(0xE3, 0x22, 0x22)) } else { (1.0, Color32::from_rgb(0x6E, 0x8E, 0xF5)) };
-                        painter.rect_stroke(sr, CornerRadius::same(1), Stroke::new(width, color), egui::StrokeKind::Inside);
+                        if round {
+                            let radius = sr.width().min(sr.height()) / 2.0;
+                            painter.circle_filled(sr.center(), radius, tint);
+                            painter.circle_stroke(sr.center(), radius - width / 2.0, Stroke::new(width, color));
+                        } else {
+                            painter.rect_filled(sr, CornerRadius::same(1), tint);
+                            painter.rect_stroke(sr, CornerRadius::same(1), Stroke::new(width, color), egui::StrokeKind::Inside);
+                        }
                     }
                 }
             }
@@ -2275,6 +2287,8 @@ enum Notice {
     Security,
     Signatures,
     Repairs,
+    /// Highlight fields was turned on or off.
+    FieldHighlights(bool),
 }
 
 /// The notice bar above the pages: the signature status first (Acrobat's signature bar), then
@@ -2310,6 +2324,7 @@ fn notices(
     }
     let mut open_security = false;
     let mut open_repairs = false;
+    let mut toggled = None;
     let msg = if secured {
         Some(("lock", tl!("This document is secured. Some changes are restricted by its security settings.").to_string(), false))
     } else if let Some(x) = xfa {
@@ -2362,6 +2377,7 @@ fn notices(
                     let label = if view.highlight_fields { tl!("Hide field highlights") } else { tl!("Highlight fields") };
                     if crate::widgets::pill_button(ui, label, view.highlight_fields).clicked() {
                         view.highlight_fields = !view.highlight_fields;
+                        toggled = Some(Notice::FieldHighlights(view.highlight_fields));
                     }
                 }
                 if secured && crate::widgets::pill_button(ui, tl!("Security settings"), false).clicked() {
@@ -2376,7 +2392,7 @@ fn notices(
     if open_repairs {
         return Some(Notice::Repairs);
     }
-    open_security.then_some(Notice::Security)
+    open_security.then_some(Notice::Security).or(toggled)
 }
 
 /// The floating quick-action bar at the left edge of the document area.
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index a80d6629..1137e689 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -1170,6 +1170,7 @@ impl PdfCraftApp {
             "default_mode": self.default_mode,
             "default_layout": self.view_defaults.layout.as_str(),
             "default_zoom": self.view_defaults.zoom_name(),
+            "highlight_fields": self.view_defaults.highlight_fields,
             "language": self.language,
             "author": self.comment_prefs.author,
             // Drawn signatures keep their original form (older settings read the same).
@@ -1207,6 +1208,9 @@ impl PdfCraftApp {
         if let Some(layout) = v["default_layout"].as_str().and_then(canvas::PageLayout::try_parse) {
             self.view_defaults.layout = layout;
         }
+        if let Some(on) = v["highlight_fields"].as_bool() {
+            self.view_defaults.highlight_fields = on;
+        }
         if let Some(defaults) = v["default_zoom"].as_str().and_then(|zoom| self.view_defaults.with_zoom(zoom)) {
             self.view_defaults = defaults;
         }
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index 52ff900c..aedeff82 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -513,6 +513,73 @@ fn highlight_fields_tints_the_field_area() {
     assert_ne!(before, after, "the field area is tinted when highlighting is on");
 }
 
+/// A required radio group (`/Ff` 32768 radio + 2 required) with two 40 pt round buttons.
+const RADIOS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Annots [5 0 R 6 0 R] >> endobj
+4 0 obj << /FT /Btn /Ff 32770 /T (choice) /V /Off /Kids [5 0 R 6 0 R] >> endobj
+5 0 obj << /Type /Annot /Subtype /Widget /Parent 4 0 R /Rect [50 300 90 340] /AS /Off /P 3 0 R >> endobj
+6 0 obj << /Type /Annot /Subtype /Widget /Parent 4 0 R /Rect [150 300 190 340] /AS /Off /P 3 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// #260 (page 8): with fields highlighted, a required radio button gets a round red border, as
+/// Acrobat draws it, not a square one around its corners.
+#[test]
+fn required_radio_buttons_get_a_round_red_border() {
+    let _gpu = gpu();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("radios.pdf", None, RADIOS.to_vec()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("panel", "none").unwrap();
+        app.set_option("fields", "on").unwrap();
+        app
+    });
+    for _ in 0..100 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let r = rect(&h, 0).expect("page 1");
+    let ppp = h.ctx.pixels_per_point();
+    let img = h.render().expect("renders");
+    // The first button spans x 50..90, y 300..340 on the 300×400 pt page (y up).
+    let at = |x: f32, y: f32| {
+        let p = egui::pos2(r.min.x + r.width() * (x / 300.0), r.min.y + r.height() * (1.0 - y / 400.0));
+        *img.get_pixel((p.x * ppp) as u32, (p.y * ppp) as u32)
+    };
+    let red = |p: image::Rgba<u8>| p[0] > 180 && p[1] < 100 && p[2] < 100;
+    // Fit width puts about 4 px in a point: 0.2 to 0.3 pt from an edge is inside a 2 px border.
+    assert!(red(at(50.2, 320.0)), "the left of the circle is red: {:?}", at(50.2, 320.0));
+    assert!(!red(at(50.3, 339.7)), "the widget's corner, outside the circle, is not: {:?}", at(50.3, 339.7));
+}
+
+/// Acrobat's Highlight existing fields is a preference, not a per-document choice: turned on
+/// once, the next document (and the next session) opens with fields highlighted.
+#[test]
+fn field_highlighting_is_remembered() {
+    use egui_kittest::kittest::Queryable;
+    let mut h = form_harness();
+    h.state_mut().set_option("panel", "none").unwrap();
+    h.run_steps(4);
+    assert!(!h.state().views[0].highlight_fields, "off by default");
+    h.get_by_label("Highlight fields").click();
+    h.run_steps(4);
+    assert!(h.state().views[0].highlight_fields);
+    h.state_mut().open_bytes("radios.pdf", None, RADIOS.to_vec()).expect("opens");
+    h.run_steps(4);
+    assert!(h.state().views[1].highlight_fields, "the next document opens highlighted");
+    let saved = h.state().persist();
+    let mut next = PdfCraftApp::new();
+    next.restore(&saved);
+    next.open_bytes("form.pdf", None, FORM.to_vec()).expect("opens");
+    assert!(next.views[0].highlight_fields, "and so does the next session");
+}
+
 #[test]
 fn fonts_tab_lists_fonts_and_embedding() {
     use egui_kittest::kittest::Queryable;
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 5528a4ea..1c9f0454 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4302,8 +4302,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/view.rs::highlight_fields_tints_the_field_area"]
-notes = ""
+evidence = ["crates/ui-egui/tests/view.rs::highlight_fields_tints_the_field_area", "crates/ui-egui/tests/view.rs::required_radio_buttons_get_a_round_red_border", "crates/ui-egui/tests/view.rs::field_highlighting_is_remembered"]
+notes = "remembered for the next document and session; required fields get a red border (round for radio buttons); the tint is drawn over the field, where Acrobat paints the highlight colour behind it"
 
 [[feature]]
 id = "form.field-appearance-display"

From 5ef27ff6783ae3943d56d75577551947b916bb1e Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 07:58:17 +0900
Subject: [PATCH 023/149] M5: ink strokes are drawn as smooth curves through
 their points (#374)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#260 (page 7) compares PdfCraft with Acrobat, which draws an Ink
annotation's /InkList as a smooth curve through the points;
pdfcraft-annot drew straight segments between them (as MuPDF, Poppler
and PDFium do). A stroke of three or more points is now drawn as a
Catmull-Rom spline through every point, written as cubic Béziers: the
curve leaves each point parallel to the chord between its neighbours,
and an end uses itself as the missing neighbour. Two points stay a
line and one point a dot. This is the appearance PdfCraft writes for
its own ink, signatures drawn with Fill & Sign included, and, with the
display-only appearances for comments that have none, how ink without
/AP is shown.

A curve can swing beyond its points, so a new ink annotation's /Rect
now also covers the curve's control points (the curve stays within
them); before, only the points plus the line-width margin.

Test: annot tests::ink_strokes_are_smooth_curves_through_their_points
checks the exact curve for a three-point stroke, a line for two points,
a dot for one, and a /Rect that holds a stroke whose curve rises above
its highest point (22 on main, 23.667 now). The comment.pencil parity
entry cites it.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/annot/src/appearance.rs | 30 +++++++++++++++++++++++++-----
 crates/annot/src/lib.rs        |  8 +++++++-
 crates/annot/src/tests.rs      | 22 ++++++++++++++++++++++
 parity/acrobat-features.toml   |  4 ++--
 4 files changed, 56 insertions(+), 8 deletions(-)

diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index ecb8549b..6045743f 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -45,6 +45,27 @@ fn line_end(c: &mut String, kind: &[u8], tip: (f64, f64), from: (f64, f64), w: f
     c.push_str(&format!("{} {} m {} {} l {} {} l {op}\n", n(a.0), n(a.1), n(tip.0), n(tip.1), n(b.0), n(b.1)));
 }
 
+/// The cubic Bézier segments (first control point, second control point, end) of a smooth curve
+/// through every point of `pts`, from the first: a Catmull-Rom spline, so the curve leaves each
+/// point parallel to the chord between its neighbours (an end uses itself as the missing
+/// neighbour). Ink is drawn so, as Acrobat draws it, rather than as straight segments. The curve
+/// stays within its points and these control points.
+pub(crate) fn smooth_segments(pts: &[(f64, f64)]) -> Vec<[(f64, f64); 3]> {
+    let Some(&last) = pts.last() else { return Vec::new() };
+    let at = |i: usize| pts.get(i).copied().unwrap_or(last);
+    (0..pts.len().saturating_sub(1))
+        .map(|i| {
+            let (p0, p1, p2, p3) = (at(i.saturating_sub(1)), at(i), at(i + 1), at(i + 2));
+            [(p1.0 + (p2.0 - p0.0) / 6.0, p1.1 + (p2.1 - p0.1) / 6.0), (p2.0 - (p3.0 - p1.0) / 6.0, p2.1 - (p3.1 - p1.1) / 6.0), p2]
+        })
+        .collect()
+}
+
+/// `c` operators for [`smooth_segments`] (the path already starts at the first point).
+fn smooth_curve(pts: &[(f64, f64)]) -> String {
+    smooth_segments(pts).iter().map(|[a, b, e]| format!("{} {} {} {} {} {} c\n", n(a.0), n(a.1), n(b.0), n(b.1), n(e.0), n(e.1))).collect()
+}
+
 /// A closed cloudy outline through `pts` (§12.5.4 `/BE /S /C`): each edge becomes a row of
 /// half-circle bumps of about `r`, bulging outwards.
 pub fn cloud_path(pts: &[(f64, f64)], r: f64) -> String {
@@ -396,11 +417,10 @@ pub fn build(d: &Dict) -> Option<Stream> {
                 let pts: Vec<(f64, f64)> = pts.as_chunks::<2>().0.iter().map(|p| (p[0], p[1])).collect();
                 let Some(first) = pts.first() else { continue };
                 c.push_str(&format!("{} {} m\n", n(first.0), n(first.1)));
-                if pts.len() == 1 {
-                    c.push_str(&format!("{} {} l\n", n(first.0 + 0.01), n(first.1)));
-                }
-                for p in &pts[1..] {
-                    c.push_str(&format!("{} {} l\n", n(p.0), n(p.1)));
+                match pts.as_slice() {
+                    [_] => c.push_str(&format!("{} {} l\n", n(first.0 + 0.01), n(first.1))),
+                    [_, end] => c.push_str(&format!("{} {} l\n", n(end.0), n(end.1))),
+                    _ => c.push_str(&smooth_curve(&pts)),
                 }
                 c.push_str("S\n");
             }
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index d735603c..b570c0e7 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -766,7 +766,13 @@ fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
             if strokes.iter().all(|s| s.is_empty()) || !strokes.iter().flatten().all(|p| finite(p)) {
                 return Err(bad("drawing (no points)"));
             }
-            grow(bounds(strokes.iter().flatten().copied()).unwrap_or_default(), half + 1.0)
+            // Strokes of three or more points are drawn as curves, which stay within their
+            // points and control points.
+            let controls = strokes.iter().filter(|s| s.len() > 2).flat_map(|s| {
+                let pts: Vec<(f64, f64)> = s.iter().map(|p| (p[0], p[1])).collect();
+                appearance::smooth_segments(&pts).into_iter().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]])
+            });
+            grow(bounds(strokes.iter().flatten().copied().chain(controls)).unwrap_or_default(), half + 1.0)
         }
         Shape::Polygon { vertices, cloud } => {
             let b = bounds(vertices.iter().copied())
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index afcee4bb..55541988 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -141,6 +141,28 @@ fn every_tool_creates_a_drawable_comment() {
     assert_eq!(all[1].reference(b"Popup"), entries[2].as_ref());
 }
 
+/// #260 (page 7): Acrobat draws an Ink annotation as a smooth curve through its `/InkList`
+/// points, where PdfCraft drew straight segments between them. Three or more points now make a
+/// Catmull-Rom spline through every point (as cubic Béziers); two points stay a line, one a dot.
+#[test]
+fn ink_strokes_are_smooth_curves_through_their_points() {
+    let mut doc = fixture();
+    let strokes = vec![vec![[0.0, 0.0], [10.0, 10.0], [20.0, 0.0]], vec![[30.0, 0.0], [40.0, 10.0]], vec![[50.0, 50.0]]];
+    let i = add_annotation(&mut doc, &new(0, Shape::Ink { strokes }), &meta("ink")).unwrap();
+    let ap = ap_content(&doc, &list(&doc, 0)[i]);
+    // Tangents at each point run parallel to the chord between its neighbours (the ends use
+    // their own point): (0,0)→(10,10) leaves along (10,10) and arrives along (20,0).
+    assert!(ap.contains("0 0 m\n1.667 1.667 6.667 10 10 10 c\n13.333 10 18.333 1.667 20 0 c\nS\n"), "{ap}");
+    assert!(ap.contains("30 0 m\n40 10 l\nS\n"), "{ap}");
+    assert!(ap.contains("50 50 m\n50.01 50 l\nS\n"), "{ap}");
+    // /Rect holds the whole curve: rising to (20, 20) and dropping to (21, 0), it swings above
+    // y 20 (its control point is at y 21.667), beyond the points' own bounds plus the margin.
+    let rise = Shape::Ink { strokes: vec![vec![[0.0, 0.0], [10.0, 10.0], [20.0, 20.0], [21.0, 0.0]]] };
+    let j = add_annotation(&mut doc, &new(0, rise), &meta("rise")).unwrap();
+    let top = rect(&list(&doc, 0)[j])[3];
+    assert!(top >= 21.667 + 2.0 - 0.01, "/Rect top {top}");
+}
+
 #[test]
 fn indirect_annots_array_is_updated_in_place() {
     let mut doc = fixture();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 1c9f0454..b765ac0c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -3602,8 +3602,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.ink"]
 tools = ["comment_add"]
-evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging"]
-notes = "one ink annotation per stroke"
+evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging", "crates/annot/src/tests.rs::ink_strokes_are_smooth_curves_through_their_points"]
+notes = "one ink annotation per stroke; strokes are drawn as smooth curves through their points, as in Acrobat"
 
 [[feature]]
 id = "comment.eraser"

From dcf81b45071d6a56dfdd96dcb8b1b5199f8793d8 Mon Sep 17 00:00:00 2001
From: sanyamsingh001 <sanyamsingh001@duck.com>
Date: Thu, 8 Oct 2026 23:10:13 +0000
Subject: [PATCH 024/149] UI-POLISH: fix toast wrapping and Linux shortcut hint
 (#376)

Keep notices within the viewport and let short feedback recover its natural
width. Format the toolbar shortcut for the current platform.

Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/src/widgets.rs | 55 +++++++++++++++++++++++++++++++++--
 1 file changed, 53 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 6278a010..dc06ff1c 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -64,7 +64,8 @@ pub fn search_box(ui: &mut egui::Ui, placeholder: &str, width: f32) -> Response
     ui.painter().rect(rect, CornerRadius::same(16), fill, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     icons::paint(ui, Rect::from_min_size(rect.min + vec2(10.0, 8.0), vec2(16.0, 16.0)), "search", 15.0, t.text_muted);
     ui.painter().text(rect.left_center() + vec2(34.0, 0.0), Align2::LEFT_CENTER, placeholder, theme::regular(13.0), t.text_faint);
-    ui.painter().text(rect.right_center() - vec2(12.0, 0.0), Align2::RIGHT_CENTER, "⌘K", theme::regular(11.5), t.text_faint);
+    let shortcut = ui.ctx().format_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, egui::Key::K));
+    ui.painter().text(rect.right_center() - vec2(12.0, 0.0), Align2::RIGHT_CENTER, shortcut, theme::regular(11.5), t.text_faint);
     resp.on_hover_cursor(egui::CursorIcon::Text)
 }
 
@@ -105,7 +106,15 @@ pub fn toast(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 .corner_radius(CornerRadius::same(8))
                 .inner_margin(egui::Margin::symmetric(16, 10))
                 .show(ui, |ui| {
-                    ui.label(egui::RichText::new(msg).color(if t.dark() { Color32::from_rgb(0x22, 0x22, 0x26) } else { Color32::WHITE }));
+                    // An Area remembers its previous content width. A short notice
+                    // must not force the next validation message into a narrow column.
+                    // Allow natural short labels; wrap longer ones within the viewport,
+                    // including the frame's 32 points and 16-point outside margins.
+                    ui.set_max_width((screen.width() - 64.0).clamp(1.0, 560.0));
+                    ui.add(
+                        egui::Label::new(egui::RichText::new(msg).color(if t.dark() { Color32::from_rgb(0x22, 0x22, 0x26) } else { Color32::WHITE }))
+                            .wrap(),
+                    );
                 });
         });
     ctx.request_repaint_after(std::time::Duration::from_millis(100));
@@ -273,3 +282,45 @@ pub fn icon_pill(ui: &mut egui::Ui, icon: &str, label: &str, primary: bool) -> R
     ui.painter().text(rect.left_center() + vec2(34.0, 0.0), Align2::LEFT_CENTER, label, font, text);
     resp
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::Pos2;
+
+    fn toast_rect(app: &mut PdfCraftApp, ctx: &egui::Context, width: f32, now: &mut f64) -> Rect {
+        // Let the Area settle after a notice/viewport change, without advancing to
+        // expiry. No native rendering or renderer worker is needed for this layout.
+        for _ in 0..3 {
+            *now += 0.016;
+            let output = ctx.run_ui(
+                egui::RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(width, 900.0))), time: Some(*now), ..Default::default() },
+                |ui| toast(app, ui.ctx()),
+            );
+            output.drop_without_applying_deltas();
+        }
+        ctx.memory(|memory| memory.area_rect(egui::Id::new("toast")).unwrap())
+    }
+
+    #[test]
+    fn toast_width_adapts_to_long_notices_and_narrow_viewports() {
+        let ctx = egui::Context::default();
+        let mut app = PdfCraftApp::new();
+        let mut now = 1.0;
+        app.notify("Saved");
+        let short = toast_rect(&mut app, &ctx, 1280.0, &mut now);
+        assert!(short.width() < 160.0, "short notices retain their natural width: {short:?}");
+        app.notify("Fill in name failed: The value entered is not valid for the field [ name ]");
+        let long = toast_rect(&mut app, &ctx, 1280.0, &mut now);
+        assert!(long.width() > 300.0, "a previous short Area must not squeeze validation feedback: {long:?}");
+        assert!(long.height() < 85.0, "ordinary feedback must not become a seven-line column: {long:?}");
+        for width in [320.0, 180.0] {
+            let rect = toast_rect(&mut app, &ctx, width, &mut now);
+            assert!(rect.width() <= width - 32.0 + 1.0, "frame and viewport margins must fit: {rect:?}");
+            assert!(rect.left() >= 15.0 && rect.right() <= width - 15.0, "notice remains horizontally on screen: {rect:?}");
+        }
+        app.notify("Saved");
+        let again = toast_rect(&mut app, &ctx, 1280.0, &mut now);
+        assert!((again.width() - short.width()).abs() < 1.0, "long notices must not impose a permanent minimum width");
+    }
+}

From 4995da0653b605f00c6ba1bbd1abe0a9f087e1e7 Mon Sep 17 00:00:00 2001
From: Maksim Popov <51298369+MaksPV@users.noreply.github.com>
Date: Fri, 9 Oct 2026 02:24:51 +0300
Subject: [PATCH 025/149] i18n: add Russian (ru) interface translation (#375)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* i18n: add Russian (ru) interface translation

- Add ru.tsv catalog (~1950 entries, clean-room translations following PhotoCraft terminology: Слой, Образцы, Обработка контуров, Монтажная область, Обводка, Заливка)
- Register ru in LANGUAGES with plural_russian (one/few/many with 11-14 exception)
- Add Russian tests: registration, command/catalogue coverage, UI literals, history/diagnostics, plural forms
- Add ATTRIBUTION.toml entry for ru.tsv
- Update docs/localization.md, ROADMAP.md with Russian language
- All i18n tests pass, cargo fmt and clippy clean

* ru: translate labels added on main since the catalog was written; Russian in the Latin-font coverage test

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ru: '>' in the JavaScript-off hint, as the other catalogs (Inter has no ▸)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml               |   11 +
 ROADMAP.md                     |    4 +-
 crates/ui-egui/src/i18n/mod.rs |  127 +-
 crates/ui-egui/src/i18n/ru.tsv | 1977 ++++++++++++++++++++++++++++++++
 crates/ui-egui/tests/fonts.rs  |    5 +-
 docs/localization.md           |    8 +-
 6 files changed, 2123 insertions(+), 9 deletions(-)
 create mode 100644 crates/ui-egui/src/i18n/ru.tsv

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 8971d853..64fc7a96 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -87,6 +87,17 @@ kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
 sha256 = "f862797c038b3c5e2d91d387356ebe2b38d90a0e25f4a2154ae73182af575f59"
 
+[[asset]]
+path = "crates/ui-egui/src/i18n/ru.tsv"
+title = "Russian interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "3c5adb79844f784648b3d6bb0056026d498a683ac67b0746df118b1faaf69aa1"
+
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
 title = "Japanese interface translation catalog"
diff --git a/ROADMAP.md b/ROADMAP.md
index 99dcfad5..34478b73 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -79,7 +79,7 @@ The gaps that matter most, in priority order. Agents: prefer these over adding P
 3. **Measure fidelity against Acrobat.** Build a side-by-side harness (render, text, form behaviour) over synthetic fixtures (`plan/acrobat/`, clean-room rules apply). Until then, parity numbers count features, not quality.
 4. **Editing existing content (M7).** Fonts, subsets, reflow and CJK. The most visible gap for Pro users.
 5. **Pro workflows.** Signatures with timestamps and LTV (M9), OCR beyond Latin (M10), Office import/export (M10), preflight and PDF/A/X/UA (M11), XFA (M12).
-6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, Spanish, Japanese and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
+6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, Spanish, Japanese, Russian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
 
 Decided against for now (owner, 2026-10-05): self-installing updates and an update check at start. Help ▸ Check for updates is manual only.
 
@@ -103,7 +103,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 165–290 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 23% | 155–295 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 33–66 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Spanish and French catalogs have ≈1,800 entries each; Simplified Chinese and French coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog. Missing: more catalogs filled in, installers, performance budgets |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Spanish and French catalogs have ≈1,800 entries each; Simplified Chinese and French coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog. Missing: more catalogs filled in, installers, performance budgets |
 | | **Total (original plan sizing)** | **2,085–3,840** | **≈ 35%** | **≈ 1,350–2,500 at the planned rate; ≈ 600–1,100 at the measured rate** | |
 
 **Overall progress: about 30–35% of the effort (51.0% of features shipped).** The viewer and the core are far ahead of the editing features, because the viewer was built first so progress could be seen; rendering itself is still borrowed from `hayro`. See [Honest assessment](#honest-assessment-2026-10-05).
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 9b9c7209..c6bd7ced 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -74,8 +74,20 @@ fn plural_fr(n: u64) -> usize {
     usize::from(n > 1)
 }
 
+/// Russian: 1 (but not 11) is `one`, 2–4 (but not 12–14) `few`, everything else `many`.
+fn plural_russian(n: u64) -> usize {
+    match n % 100 {
+        11..=14 => 2,
+        _ => match n % 10 {
+            1 => 0,
+            2..=4 => 1,
+            _ => 2,
+        },
+    }
+}
+
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 9] = [
+pub static LANGUAGES: [LangInfo; 10] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -90,6 +102,8 @@ pub static LANGUAGES: [LangInfo; 9] = [
     LangInfo { code: "es", name: "Español", source: include_str!("es.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
     // French; every `fr-*` locale (`fr-FR`, `fr-CA`, `fr-BE` ...) resolves here.
     LangInfo { code: "fr", name: "Français", source: include_str!("fr.tsv"), plural: plural_fr, catalog: OnceLock::new() },
+    // Russian; every `ru-*` locale (`ru-RU`, `ru-BY`, `ru-KZ` ...) resolves here.
+    LangInfo { code: "ru", name: "Русский", source: include_str!("ru.tsv"), plural: plural_russian, catalog: OnceLock::new() },
     // Telugu; every `te-*` locale (`te-IN`) resolves here.
     LangInfo { code: "te", name: "తెలుగు", source: include_str!("te.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
 ];
@@ -1098,6 +1112,117 @@ mod tests {
         set_current(Lang::EN);
     }
 
+    #[test]
+    fn russian_is_registered() {
+        let ru = Lang::from_code("ru").expect("ru registered");
+        assert_eq!(ru.name(), "Русский");
+        assert_eq!(normalize_pref("RU"), Some("ru"));
+        assert_eq!(lang_from_tag("ru_RU.UTF-8"), Some(ru));
+        assert_eq!(lang_from_tag("ru-BY"), Some(ru));
+        assert_eq!(first_supported("ru-RU\r\nen-US"), Some(ru));
+        assert_eq!(tr(ru, "File"), "Файл");
+        assert_eq!(tr(ru, "Save as…"), "Сохранить как…");
+        assert_eq!(tr(ru, "Bookmarks"), "Закладки");
+        assert_eq!(tr(ru, "Layers"), "Слои");
+        assert_eq!(tr(ru, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
+        // one (1), few (2-4), many (0, 5+), with 11-14 exception
+        assert_eq!((0..=3).map(|n| (ru.0.plural)(n)).collect::<Vec<_>>(), [2, 0, 1, 1]);
+        assert_eq!(trn(ru, 0, "{n} page", "{n} pages"), "0 страниц");
+        assert_eq!(trn(ru, 1, "{n} page", "{n} pages"), "1 страница");
+        assert_eq!(trn(ru, 2, "{n} page", "{n} pages"), "2 страницы");
+        assert_eq!(trn(ru, 5, "{n} page", "{n} pages"), "5 страниц");
+        assert_eq!(trn(ru, 11, "{n} page", "{n} pages"), "11 страниц");
+        assert_eq!(trn(ru, 21, "{n} page", "{n} pages"), "21 страница");
+        assert_eq!(trn(ru, 22, "{n} page", "{n} pages"), "22 страницы");
+        assert_eq!(trn(ru, 1, "{n} field", "{n} fields"), "1 поле");
+        assert_eq!(trn(ru, 2, "{n} field", "{n} fields"), "2 поля");
+        assert_eq!(trn(ru, 5, "{n} field", "{n} fields"), "5 полей");
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", "ru").unwrap();
+        assert_eq!(app.language, "ru");
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, "ru");
+    }
+
+    /// Russian translates every registered command and every All tools group, section and item.
+    #[test]
+    fn russian_covers_commands_and_catalogue() {
+        let ru = Lang::from_code("ru").expect("ru registered");
+        for command in pdfcraft_engine::commands::COMMANDS {
+            assert!(has(ru, command.label), "missing command: {}", command.label);
+            if let Some(menu) = command.menu {
+                assert!(has(ru, menu), "missing menu: {menu}");
+            }
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            assert!(has(ru, group.label), "missing group: {}", group.label);
+            for section in group.sections {
+                assert!(has(ru, section.title), "missing section: {}", section.title);
+                for item in section.items {
+                    assert!(has(ru, item.label), "missing item: {}", item.label);
+                }
+            }
+        }
+    }
+
+    /// New tl!("literal") labels must not silently fall back to English.
+    #[test]
+    fn russian_covers_ui_literals() {
+        let ru = Lang::from_code("ru").expect("ru registered");
+        let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+        let mut literals = std::collections::BTreeSet::new();
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(dir).expect("UI source directory") {
+                let path = entry.expect("UI source entry").path();
+                if path.is_dir() {
+                    if path.file_name().is_some_and(|name| name != "i18n") {
+                        stack.push(path);
+                    }
+                } else if path.extension().is_some_and(|ext| ext == "rs") {
+                    let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n");
+                    let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+                    while let Some((_, after)) = rest.split_once("tl!(\"") {
+                        let mut escaped = false;
+                        let end = after
+                            .char_indices()
+                            .find_map(|(i, c)| {
+                                if c == '"' && !escaped {
+                                    return Some(i);
+                                }
+                                escaped = c == '\\' && !escaped;
+                                None
+                            })
+                            .expect("closed tl! literal");
+                        let (raw, tail) = after.split_at(end);
+                        if tail.starts_with("\")") {
+                            let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
+                            literals.insert(label);
+                        }
+                        rest = tail.strip_prefix('"').expect("closing quote");
+                    }
+                }
+            }
+        }
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(ru, label)).collect();
+        assert!(missing.is_empty(), "untranslated Russian UI literals: {missing:#?}");
+    }
+
+    #[test]
+    fn russian_history_and_diagnostics_preserve_user_values() {
+        let ru = Lang::from_code("ru").expect("ru registered");
+        set_current(ru);
+        assert_eq!(command_label("Undo Insert pages from Rapport {n}.pdf"), "Отменить Вставить страницы из Rapport {n}.pdf");
+        assert_eq!(command_label("Redo Fill in Contact {key}"), "Повторить Заполнить Contact {key}");
+        assert_eq!(action_label("Change Title"), "Изменить заголовок");
+        assert_eq!(action_label("Custom action {n}"), "Custom action {n}");
+        assert_eq!(fmt(t("This page couldn't be displayed.\n{e}"), &[("e", "OS error {n}")]), "Не удалось отобразить эту страницу.\nOS error {n}");
+        assert_eq!(fmt(t("{n} pages selected"), &[("n", "3")]), "Выбрано 3 страницы");
+        assert_eq!(tr(ru, "CheckBox"), "Флажок");
+        set_current(Lang::EN);
+    }
+
     /// Every bundled catalog is well-formed and consistent with its sources.
     #[test]
     fn bundled_catalogs_are_consistent() {
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
new file mode 100644
index 00000000..d2138710
--- /dev/null
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -0,0 +1,1977 @@
+# Russian (ru) catalog. Format: see the header of ja.tsv
+# (context <TAB> source <TAB> translation; @id, @plural and other contexts; escapes \n \t \\).
+# Plural forms (see `plural_russian` in i18n/mod.rs): one (1) | few (2-4) | many (0, 5+).
+#
+# Clean-room: every entry was written from the plain meaning of the English label using ordinary
+# Russian computing vocabulary. No proprietary localisation resource, string table or product UI
+# (Acrobat's included) was consulted or copied; add entries the same way.
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
+# the trailing "…" of dialog commands is kept.
+
+	Menu	Меню
+	File	Файл
+	Edit	Редактирование
+	Pages	Страницы
+	View	Просмотр
+	Help	Справка
+	Preferences	Настройки
+	Preferences…	Настройки…
+	Interface language	Язык интерфейса
+	Identity	Идентификация
+	Name on new comments	Имя в новых комментариях
+	Open…	Открыть…
+	Open Recent	Открыть недавние
+	No recent files	Нет недавних файлов
+	New blank PDF	Новый пустой PDF
+	Create PDF from file…	Создать PDF из файла…
+	Create PDF from images…	Создать PDF из изображений…
+	Create PDF from clipboard	Создать PDF из буфера обмена
+	Combine files…	Объединить файлы…
+	Save	Сохранить
+	Save as…	Сохранить как…
+	Close file	Закрыть файл
+	Close all	Закрыть все
+	Revert	Восстановить
+	Print…	Печать…
+	Document properties…	Свойства документа…
+	Undo	Отменить
+	Redo	Повторить
+	Find…	Найти…
+	Advanced search…	Расширенный поиск…
+	Copy pages	Копировать страницы
+	Cut pages	Вырезать страницы
+	Paste pages	Вставить страницы
+	Fit visible	По видимой области
+	Marquee zoom	Масштаб выделением
+	Take a snapshot	Сделать снимок
+	Full screen mode	Полноэкранный режим
+	Read mode	Режим чтения
+	Switch light / dark theme	Переключить светлую / тёмную тему
+	Comments panel	Панель комментариев
+	Form fields panel	Панель полей формы
+	Clear form	Очистить форму
+	Find tools and commands…	Найти инструменты и команды…
+	Zoom	Масштаб
+	Actual size	Фактический размер
+	Zoom to page level	Масштаб страницы
+	Fit to width	По ширине
+	Display theme	Тема оформления
+	Side panels	Боковые панели
+	Enable Acrobat JavaScript	Включить Acrobat JavaScript
+	OK	OK
+	Join our Discord	Присоединяйтесь к нашему Discord
+	Close	Закрыть
+	Next / previous match	Следующее / предыдущее совпадение
+	Copy selected text	Копировать выделенный текст
+	Double-click	Двойной щелчок
+	Select a word	Выделить слово
+	Clear selection / close find	Снять выделение / закрыть поиск
+	Zoom in / out (also pinch or ⌘-scroll)	Масштаб (также щипок или ⌘-прокрутка)
+	Rotate view	Повернуть вид
+	First / last page	Первая / последняя страница
+	Previous / next page	Предыдущая / следующая страница
+	Delete selected pages (Organize)	Удалить выделенные страницы (Организация)
+	Select all pages (Organize)	Выделить все страницы (Организация)
+	Home	Главная
+	Open	Открыть
+	Open a PDF (⌘O)	Открыть PDF (⌘O)
+	Dark gray theme	Тёмно-серая тема
+	Light theme	Светлая тема
+	All tools	Все инструменты
+	Read	Чтение
+	Convert	Конвертация
+	E-Sign	Электронная подпись
+	Print (⌘P)	Печать (⌘P)
+	Save (M4)	Сохранить (M4)
+	Document properties (⌘D)	Свойства документа (⌘D)
+	Find tools and commands	Найти инструменты и команды
+	Fit to height	По высоте
+	Zoom in	Увеличить
+	Zoom out	Уменьшить
+	Rotate view clockwise	Повернуть вид по часовой стрелке
+	Rotate view counterclockwise	Повернуть вид против часовой стрелки
+	Page navigation	Навигация по страницам
+	Previous view	Предыдущий вид
+	Next view	Следующий вид
+	Page display	Отображение страниц
+	Continuous scrolling	Непрерывная прокрутка
+	Two-page view	Двухстраничный вид
+	Single page	Одна страница
+	Show cover page in two-page view	Показывать титульную страницу в двухстраничном виде
+	Use system setting	Использовать системные настройки
+	Light gray	Светло-серый
+	Dark gray	Тёмно-серый
+	Comments	Комментарии
+	Bookmarks	Закладки
+	Fields	Поля
+	Layers	Слои
+	Attachments	Вложения
+	Signatures	Подписи
+	Accessibility Checker	Проверка доступности
+	Search	Поиск
+	Compare	Сравнить
+	Page thumbnails	Миниатюры страниц
+	Form fields	Поля формы
+	Zoom out (⌘−)	Уменьшить (⌘−)
+	Zoom in (⌘+)	Увеличить (⌘+)
+	Rotate view clockwise (⇧⌘+)	Повернуть вид по часовой стрелке (⇧⌘+)
+	Toggle fit page / fit width	Переключить по странице / по ширине
+	Next page	Следующая страница
+	Previous page	Предыдущая страница
+	Current page — type a page number or label (such as iv) and press Enter	Текущая страница — введите номер или метку страницы (например, iv) и нажмите Enter
+	Welcome to PdfCraft	Добро пожаловать в PdfCraft
+	An open-source PDF workbench — local, private, and scriptable.	Открытый PDF-редактор — локальный, приватный и программируемый.
+	Join the ArtCraft community	Присоединяйтесь к сообществу ArtCraft
+	Get help, share feedback and follow development on Discord.	Получайте помощь, делитесь отзывами и следите за разработкой в Discord.
+	Recommended tools	Рекомендуемые инструменты
+	Use now	Использовать сейчас
+	Open file	Открыть файл
+	Recent	Недавние
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	Файлы, которые вы открываете в PdfCraft, появляются здесь. Перетащите PDF в любое место, чтобы открыть.
+	Privacy	Конфиденциальность
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft работает офлайн. Без телеметрии, аккаунтов и облачной обработки, если вы не добавите провайдера.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Скрипты выполняются в песочнице без доступа к файлам и сети. При отключённом JavaScript стандартные функции Acrobat форматирования, проверки и вычислений всё равно работают.
+	Back to all tools	Назад ко всем инструментам
+	Close panel	Закрыть панель
+	View less	Показать меньше
+	View more	Показать больше
+	Available	Доступно
+	Ready	Готово
+	Search tools and commands…	Поиск инструментов и команд…
+	No matching tools	Нет подходящих инструментов
+	Tool	Инструмент
+	Command	Команда
+	Add a sticky note	Добавить стикер
+	Add a text box	Добавить текстовое поле
+	Highlight text	Выделить текст
+	Underline text	Подчеркнуть текст
+	Strikethrough text	Зачеркнуть текст
+	Squiggly underline text	Волнистое подчеркивание
+	Draw freehand	Рисовать от руки
+	Draw a line	Нарисовать линию
+	Draw an arrow	Нарисовать стрелку
+	Draw a rectangle	Нарисовать прямоугольник
+	Draw an oval	Нарисовать овал
+	Draw a polygon	Нарисовать многоугольник
+	Draw connected lines	Нарисовать соединенные линии
+	Draw a cloud	Нарисовать облако
+	Add a callout	Добавить выноску
+	Insert text	Вставить текст
+	Replace text	Заменить текст
+	Attach a file	Прикрепить файл
+	Erase drawings	Стереть рисунки
+	Flatten comments	Расплющить комментарии
+	Import comments…	Импортировать комментарии…
+	Add a stamp	Добавить штамп
+	Export all comments to data file…	Экспортировать все комментарии в файл данных…
+	Hide all comments	Скрыть все комментарии
+	Summarize comments	Суммировать комментарии
+	Import form data…	Импортировать данные формы…
+	Export form data…	Экспортировать данные формы…
+	PDF/A…	PDF/A…
+	Action Wizard…	Мастер действий…
+	Prepare for distribution…	Подготовить к распространению…
+	Optimize scanned documents…	Оптимизировать отсканированные документы…
+	Compare files…	Сравнить файлы…
+	Detect form fields	Определить поля формы
+	Merge data files into spreadsheet…	Объединить файлы данных в электронную таблицу…
+	Flatten form fields	Расплющить поля формы
+	Prepare a form	Подготовить форму
+	Tab order: by rows	Порядок табуляции: по строкам
+	Tab order: by columns	Порядок табуляции: по столбцам
+	Tab order: by document structure	Порядок табуляции: по структуре документа
+	Add text	Добавить текст
+	Edit text & images	Редактировать текст и изображения
+	Add or edit links	Добавить или изменить ссылки
+	Create links from URLs	Создать ссылки из URL
+	Remove all links	Удалить все ссылки
+	Add Bates numbering…	Добавить нумерацию Бейтса…
+	Add image…	Добавить изображение…
+	Redact text and images	Скрыть текст и изображения
+	Redact pages…	Скрыть страницы…
+	Find text and redact…	Найти текст и скрыть…
+	Redaction properties…	Свойства сокрытия…
+	Apply redactions…	Применить сокрытия…
+	Clear redaction marks	Очистить метки сокрытия
+	Remove hidden information…	Удалить скрытую информацию…
+	Sanitize document…	Очистить документ…
+	Field properties…	Свойства поля…
+	Add a text field	Добавить текстовое поле
+	Add a checkbox	Добавить флажок
+	Add a radio button	Добавить переключатель
+	Add a drop-down list	Добавить раскрывающийся список
+	Add a list box	Добавить список
+	Add a button	Добавить кнопку
+	Add an image field	Добавить поле изображения
+	Add a date field	Добавить поле даты
+	Add a digital signature field	Добавить поле цифровой подписи
+	Digitally sign	Подписать цифровой подписью
+	Certify (visible signature)	Сертификат (видимая подпись)
+	Certify (invisible signature)	Сертификат (невидимая подпись)
+	Validate all signatures	Проверить все подписи
+	Signatures panel	Панель подписей
+	Fill & Sign: add text	Заполнить и подписать: добавить текст
+	Fill & Sign: checkmark	Заполнить и подписать: галочка
+	Fill & Sign: cross	Заполнить и подписать: крестик
+	Fill & Sign: dot	Заполнить и подписать: точка
+	Fill & Sign: line	Заполнить и подписать: линия
+	Fill & Sign: date	Заполнить и подписать: дата
+	Fill & Sign: sign	Заполнить и подписать: подпись
+	Fill & Sign: initials	Заполнить и подписать: инициалы
+	Export to image…	Экспортировать в изображение…
+	Reduce file size…	Уменьшить размер файла…
+	Optimize PDF…	Оптимизировать PDF…
+	Export to text…	Экспортировать в текст…
+	Export to Word…	Экспортировать в Word…
+	Export to HTML…	Экспортировать в HTML…
+	Export to RTF…	Экспортировать в RTF…
+	JavaScript console…	Консоль JavaScript…
+	Document JavaScripts…	Скрипты документа…
+	Recognize text…	Распознать текст…
+	Recognize text in multiple files…	Распознать текст в нескольких файлах…
+	Check for accessibility…	Проверить доступность…
+	Open accessibility report	Открыть отчёт о доступности
+	Change reading options…	Изменить параметры чтения…
+	Add alternate text…	Добавить альтернативный текст…
+	Export all images…	Экспортировать все изображения…
+	Add header & footer…	Добавить колонтитулы…
+	Update header & footer…	Обновить колонтитулы…
+	Remove header & footer	Удалить колонтитулы
+	Add watermark…	Добавить водяной знак…
+	Update watermark…	Обновить водяной знак…
+	Remove watermark	Удалить водяной знак
+	Add background…	Добавить фон…
+	Update background…	Обновить фон…
+	Remove background	Удалить фон
+	Protect using password…	Защитить паролем…
+	Remove security	Удалить защиту
+	Security properties…	Свойства безопасности…
+	Organize pages	Организовать страницы
+	New bookmark	Новая закладка
+	Rotate pages clockwise	Повернуть страницы по часовой стрелке
+	Rotate pages counterclockwise	Повернуть страницы против часовой стрелки
+	Delete pages	Удалить страницы
+	Insert blank page	Вставить пустую страницу
+	Rotate pages…	Повернуть страницы…
+	Duplicate pages	Дублировать страницы
+	Crop pages	Обрезать страницы
+	Set page boxes…	Задать поля страницы…
+	Insert pages from file…	Вставить страницы из файла…
+	Replace pages…	Заменить страницы…
+	Extract pages…	Извлечь страницы…
+	Split document…	Разделить документ…
+	Number pages…	Пронумеровать страницы…
+	Keyboard shortcuts	Горячие клавиши
+	Join the ArtCraft Discord	Присоединяйтесь к Discord ArtCraft
+	PdfCraft web page	Веб-страница PdfCraft
+	PdfCraft on GitHub	PdfCraft на GitHub
+	ArtCraft website	Веб-сайт ArtCraft
+	Check for updates…	Проверить обновления…
+	About PdfCraft	О программе PdfCraft
+	Export a PDF	Экспортировать PDF
+	Export to	Экспортировать в
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Spreadsheet (.xlsx)	Электронная таблица (.xlsx)
+	Presentation (.pptx)	Презентация (.pptx)
+	Image (PNG)	Изображение (PNG)
+	Export all images	Экспортировать все изображения
+	HTML web page	Веб-страница HTML
+	Rich Text Format (.rtf)	Rich Text Format (.rtf)
+	Text (plain)	Текст (обычный)
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	Заполнить и подписать
+	Fill	Заполнить
+	Checkmark	Галочка
+	Cross	Крестик
+	Dot	Точка
+	Line	Линия
+	Date	Дата
+	Signature	Подпись
+	Initials	Инициалы
+	Edit a PDF	Редактировать PDF
+	Modify page	Изменить страницу
+	Rotate pages	Повернуть страницы
+	Insert pages	Вставить страницы
+	Extract pages	Извлечь страницы
+	Add content	Добавить содержимое
+	Text	Текст
+	Image	Изображение
+	Header and footer	Колонтитулы
+	Watermark	Водяной знак
+	Link	Ссылка
+	Bates numbering	Нумерация Бейтса
+	Background	Фон
+	Attach file	Прикрепить файл
+	Create a PDF	Создать PDF
+	Create from	Создать из
+	Single file	Один файл
+	Multiple files	Несколько файлов
+	Images	Изображения
+	Clipboard	Буфер обмена
+	Blank page	Пустая страница
+	Combine files	Объединить файлы
+	Combine	Объединить
+	Add files to combine	Добавить файлы для объединения
+	Page options	Параметры страниц
+	Page grid	Сетка страниц
+	Rotate	Повернуть
+	Delete	Удалить
+	Extract	Извлечь
+	Insert	Вставить
+	Replace	Заменить
+	Split	Разделить
+	More	Ещё
+	Set page boxes	Задать поля страниц
+	Page labels	Метки страниц
+	Page transitions	Переходы страниц
+	Add comments	Добавить комментарии
+	Markup	Разметка
+	Sticky note	Стикер
+	Underline	Подчеркивание
+	Strikethrough	Зачеркивание
+	Squiggly underline	Волнистое подчеркивание
+	Text box	Текстовое поле
+	Drawing	Рисование
+	Rectangle	Прямоугольник
+	Oval	Овал
+	Arrow	Стрелка
+	Cloud	Облако
+	Stamp	Штамп
+	Review	Проверка
+	Comment list	Список комментариев
+	Scan & OCR	Сканирование и OCR
+	Recognize text	Распознать текст
+	In this file	В этом файле
+	In multiple files	В нескольких файлах
+	Enhance scanned file	Улучшить отсканированный файл
+	Correct recognized text	Исправить распознанный текст
+	Protect a PDF	Защитить PDF
+	Protect	Защитить
+	Protect with password	Защитить паролем
+	Remove hidden information	Удалить скрытую информацию
+	Advanced options	Дополнительные параметры
+	Encrypt with certificate	Шифровать сертификатом
+	Security properties	Свойства безопасности
+	Redact a PDF	Скрыть в PDF
+	Redact	Скрыть
+	Redact pages	Скрыть страницы
+	Find text and redact	Найти текст и скрыть
+	Set properties	Задать свойства
+	Sanitize document	Очистить документ
+	Compress a PDF	Сжать PDF
+	Optimize	Оптимизировать
+	Reduce file size	Уменьшить размер файла
+	Advanced optimization	Расширенная оптимизация
+	Audit space usage	Анализ использования места
+	Field list	Список полей
+	Field properties	Свойства поля
+	Tab order by rows	Порядок табуляции по строкам
+	Tab order by columns	Порядок табуляции по столбцам
+	Import data	Импортировать данные
+	Export data	Экспортировать данные
+	Add form components	Добавить компоненты формы
+	Text field	Текстовое поле
+	Checkbox	Флажок
+	Radio button	Переключатель
+	Drop-down list	Раскрывающийся список
+	List box	Список
+	Button	Кнопка
+	Image field	Поле изображения
+	Date field	Поле даты
+	Digital signature	Цифровая подпись
+	Stamps	Штампы
+	Stamp palette	Палитра штампов
+	Use a certificate	Использовать сертификат
+	Certificates	Сертификаты
+	Timestamp	Метка времени
+	Use print production	Использовать подготовку к печати
+	Print production	Подготовка к печати
+	Output preview	Предварительный просмотр вывода
+	Preflight	Проверка перед печатью
+	Convert colors	Преобразовать цвета
+	Add printer marks	Добавить печатные метки
+	Fix hairlines	Исправить тонкие линии
+	Measure objects	Измерить объекты
+	Measure	Измерить
+	Measuring tool	Инструмент измерения
+	Geospatial location	Геопространственное положение
+	Compare files	Сравнить файлы
+	Select files to compare	Выбрать файлы для сравнения
+	Use guided actions	Использовать пошаговые действия
+	Actions list	Список действий
+	Action Wizard	Мастер действий
+	Make accessible	Сделать доступным
+	Prepare for distribution	Подготовить к распространению
+	Optimize scanned documents	Оптимизировать отсканированные документы
+	Archive documents	Архивировать документы
+	Prepare for accessibility	Подготовить к проверке доступности
+	Accessibility	Доступность
+	Automatically tag PDF	Автоматически разметить PDF
+	Change reading options	Изменить параметры чтения
+	Check for accessibility	Проверить доступности
+	Add alternate text	Добавить альтернативный текст
+	Fix reading order	Исправить порядок чтения
+	Apply PDF standards	Применить стандарты PDF
+	Standards	Стандарты
+	Save as PDF/A	Сохранить как PDF/A
+	Save as PDF/X	Сохранить как PDF/X
+	Save as PDF/UA	Сохранить как PDF/UA
+	Add search index	Добавить поисковый индекс
+	Index	Индекс
+	Manage embedded index	Управлять встроенным индексом
+	Use JavaScript	Использовать JavaScript
+	JavaScript	JavaScript
+	Console	Консоль
+	Document JavaScripts	Скрипты документа
+	Document actions	Действия документа
+	AI assistant	AI-ассистент
+	Bring your own model (off by default)	Использовать свою модель (по умолчанию выключено)
+	Summarize	Суммировать
+	Ask about this document	Спросить об этом документе
+	Translate	Перевести
+	pages	страниц
+	Planned	Запланировано
+	Planned for milestone	Запланировано на этап
+	open to see what it will include	откройте, чтобы увидеть содержимое
+	Optional: needs an AI provider you configure	Опционально: нужен настраиваемый AI-провайдер
+	Coming in milestone	Появится на этапе
+	Items marked Ready work today.	Пункты с пометкой «Готово» работают сегодня.
+	Preview	Предварительный просмотр
+	Edit fields	Редактировать поля
+	Try the form as people filling it in will see it	Попробовать форму, как её увидят заполняющие
+	Redact all	Скрыть все
+	Clear all	Очистить все
+	Rotate page	Повернуть страницу
+	Delete page	Удалить страницу
+	Move page	Переместить страницу
+	Move pages	Переместить страницы
+	Duplicate page	Дублировать страницу
+	Replace page	Заменить страницу
+	Replace pages	Заменить страницы
+	Crop page	Обрезать страницу
+	Cancel	Отмена
+	Don't save	Не сохранять
+	Apply	Применить
+	Run	Запустить
+	Clear	Очистить
+	Sanitize	Очистить
+	Mark all	Отметить все
+	Save changes to “{name}” before closing?	Сохранить изменения в «{name}» перед закрытием?
+	Your changes will be lost if you don't save them.	Если не сохранить, изменения будут потеряны.
+	Password required	Требуется пароль
+	“{name}” is protected. Enter a password to open it.	«{name}» защищён. Введите пароль для открытия.
+	Password	Пароль
+	Incorrect password. Try again.	Неверный пароль. Попробуйте снова.
+	Recognize Text	Распознать текст
+	Password protection will be applied when you save	Защита паролем будет применена при сохранении
+	Saved the print-ready PDF to {path}	Сохранён PDF, готовый к печати, в {path}
+	Could not save: {e}	Не удалось сохранить: {e}
+	Earlier in tab order	Раньше в порядке табуляции
+	Later in tab order	Позже в порядке табуляции
+	From:	От:
+	To:	До:
+	High Resolution	Высокое разрешение
+	Print	Печать
+	Verify to see what the document needs.	Проверьте, что нужно документу.
+	Set Page Boxes	Задать поля страницы
+	Signature panel	Панель подписей
+	{month} {day}, {y}	{day} {month} {y}
+	The document's security settings don't allow filling in form fields	Настройки безопасности документа не позволяют заполнять поля формы
+	{name} is read-only	«{name}» доступен только для чтения
+	{name} has no action	«{name}» не имеет действия
+	Previous month	Предыдущий месяц
+	Next month	Следующий месяц
+	January	Январь
+	February	Февраль
+	March	Март
+	April	Апрель
+	May	Май
+	June	Июнь
+	July	Июль
+	August	Август
+	September	Сентябрь
+	October	Октябрь
+	November	Ноябрь
+	December	Декабрь
+	Done	Готово
+	This certificate is in your list of trusted certificates.	Этот сертификат находится в вашем списке доверенных сертификатов.
+	This certificate is trusted through a certificate above it in the chain.	Этот сертификат доверен через сертификат выше в цепочке.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Этот сертификат не доверен. Подписи, сделанные им, показывают неизвестную идентичность.
+	Add to Trusted Certificates	Добавить в доверенные сертификаты
+	Export…	Экспортировать…
+	PDF Optimizer	Оптимизатор PDF
+	Discard Objects	Удалить объекты
+	Discard User Data	Удалить пользовательские данные
+	Clean Up	Очистить
+	Color Images	Цветные изображения
+	Grayscale Images	Изображения в оттенках серого
+	Bicubic downsampling to	Бикубическое уменьшение до
+	for images above	для изображений выше
+	Compression	Сжатие
+	ZIP	ZIP
+	Retain existing	Сохранить существующее
+	Minimum	Минимальное
+	Low	Низкое
+	High	Высокое
+	Maximum	Максимальное
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Каждое изображение измеряется там, где страницы его рисуют; изображение заменяется только если результат меньше.
+	Discard all links, actions and JavaScript	Удалить все ссылки, действия и JavaScript
+	Discard alternate images	Удалить альтернативные изображения
+	Discard embedded page thumbnails	Удалить встроенные миниатюры страниц
+	Discard document tags	Удалить теги документа
+	Discard embedded print settings	Удалить встроенные настройки печати
+	Discard bookmarks	Удалить закладки
+	Discard hidden layer content	Удалить скрытое содержимое слоёв
+	Discard all comments, forms and multimedia	Удалить все комментарии, формы и мультимедиа
+	Discard document information and metadata	Удалить информацию и метаданные документа
+	Discard all object data (file attachments)	Удалить все данные объектов (вложенные файлы)
+	Discard private data of other applications	Удалить личные данные других приложений
+	Discard hidden text	Удалить скрытый текст
+	Use Flate to encode streams that are not encoded	Использовать Flate для кодирования некодированных потоков
+	Remove invalid links and bookmarks	Удалить недействительные ссылки и закладки
+	Remove unreferenced named destinations	Удалить неиспользуемые именованные места назначения
+	Compress document structure (object streams)	Сжать структуру документа (потоки объектов)
+	Remove unused objects and merge identical ones	Удалить неиспользуемые объекты и объединить одинаковые
+	Audit space usage…	Анализ использования места…
+	Space Audit	Анализ места
+	Bytes	Байты
+	Content Streams	Потоки содержимого
+	X Object Forms	Формы X Object
+	Structure Info	Информация о структуре
+	Thumbnails	Миниатюры
+	Named Destinations	Именованные места назначения
+	Color Spaces	Цветовые пространства
+	Shadings	Теневые
+	Patterns (graphics objects)	Узоры (графические объекты)
+	Extended Graphics States	Расширенные графические состояния
+	Embedded Files	Встроенные файлы
+	Document Overhead	Накладные расходы документа
+	Total	Итого
+	Text Field Properties	Свойства текстового поля
+	Check Box Properties	Свойства флажка
+	Radio Button Properties	Свойства переключателя
+	Dropdown Properties	Свойства раскрывающегося списка
+	List Box Properties	Свойства списка
+	Button Properties	Свойства кнопки
+	Digital Signature Properties	Свойства цифровой подписи
+	Position	Положение
+	Options	Параметры
+	Validate	Проверить
+	Calculate	Вычислить
+	Actions	Действия
+	This field is locked. Unlock it to change its properties.	Это поле заблокировано. Разблокируйте его, чтобы изменить свойства.
+	Tooltip:	Подсказка:
+	Common Properties	Общие свойства
+	Read Only	Только для чтения
+	Required	Обязательное
+	Font Size:	Размер шрифта:
+	Auto	Авто
+	Text Color:	Цвет текста:
+	Borders and Colors	Границы и цвета
+	Border Color:	Цвет границы:
+	Fill Color:	Цвет заливки:
+	No color	Без цвета
+	Beveled	Скошенный
+	Left:	Слева:
+	Bottom:	Снизу:
+	Width:	Ширина:
+	Height:	Высота:
+	Points from the page's bottom-left corner.	Точки от левого нижнего угла страницы.
+	Alignment:	Выравнивание:
+	Default Value:	Значение по умолчанию:
+	Multi-line	Многострочное
+	Scroll long text	Прокрутка длинного текста
+	Allow Rich Text Formatting	Разрешить форматированный текст
+	Limit of	Ограничение
+	characters	символов
+	Field is used for file selection	Поле используется для выбора файла
+	Check spelling	Проверить орфографию
+	Comb of	Шахматка из
+	Export Value: {on}	Значение экспорта: {on}
+	Check box is checked by default	Флажок отмечен по умолчанию
+	Button is checked by default	Кнопка отмечена по умолчанию
+	Buttons with the same name and value are selected in unison	Кнопки с одинаковыми именем и значением отмечаются синхронно
+	Item:	Пункт:
+	Item List	Список пунктов
+	Up	Вверх
+	Delete {o}	Удалить {o}
+	Add the choices people pick from.	Добавьте варианты, из которых люди выбирают.
+	Default:	По умолчанию:
+	(none)	(нет)
+	Sort items	Сортировать пункты
+	Allow user to enter custom text	Разрешить ввод произвольного текста
+	Multiple selection	Множественный выбор
+	Commit selected value immediately	Применить выбранное значение сразу
+	Number	Число
+	Percentage	Процент
+	Time	Время
+	Special	Специальный
+	Select format category:	Выберите категорию формата:
+	The value is shown as typed.	Значение отображается как введённое.
+	Decimal places:	Десятичные знаки:
+	Separator style:	Стиль разделителя:
+	Currency symbol:	Символ валюты:
+	Before the number	Перед числом
+	Negative number style:	Стиль отрицательного числа:
+	Format:	Формат:
+	Custom:	Свой:
+	Zip Code	Почтовый индекс
+	Zip Code + 4	Почтовый индекс + 4
+	Phone Number	Номер телефона
+	Social Security Number	Номер социального страхования
+	Arbitrary Mask	Произвольная маска
+	Mask:	Маска:
+	9 digit, A letter, O letter or digit, X any character	9 — цифра, A — буква, O — буква или цифра, X — любой символ
+	Example: {sample}	Пример: {sample}
+	Field value is not validated	Значение поля не проверяется
+	Field value is in range:	Значение поля в диапазоне:
+	Add an Action	Добавить действие
+	Select Trigger:	Выберите триггер:
+	Mouse Up	Отпускание кнопки мыши
+	Mouse Down	Нажатие кнопки мыши
+	Mouse Enter	Наведение мыши
+	Mouse Exit	Уход мыши
+	On Focus	При фокусе
+	On Blur	При потере фокуса
+	Select Action:	Выберите действие:
+	Open a web link	Открыть веб-ссылку
+	Reset a form	Сбросить форму
+	Execute a menu item	Выполнить пункт меню
+	Show a field	Показать поле
+	Hide a field	Скрыть поле
+	Submit a form	Отправить форму
+	Fields to reset (comma-separated; empty: all)	Поля для сброса (через запятую; пусто: все)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage или LastPage
+	Field names (comma-separated)	Имена полей (через запятую)
+	URL to submit to	URL для отправки
+	Script:	Скрипт:
+	Value:	Значение:
+	No actions	Нет действий
+	Value is not calculated	Значение не вычисляется
+	Value is the	Значение — это
+	sum (+)	сумма (+)
+	product (x)	произведение (x)
+	average	среднее
+	minimum	минимум
+	maximum	максимум
+	of the following fields:	из следующих полей:
+	Simplified field notation:	Упрощённая запись полей:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Имена полей с + - * / и скобками; ставьте \\ перед пробелами в именах.
+	Format text	Форматировать текст
+	Bold	Полужирный
+	Italic	Курсив
+	Align left	Выровнять влево
+	Centre	По центру
+	Align right	Выровнять вправо
+	Justify	По ширине
+	Standard fonts; text outside Windows-1252 isn't supported yet.	Стандартные шрифты; текст вне Windows-1252 пока не поддерживается.
+	Edit image	Редактировать изображение
+	Rotate counterclockwise	Повернуть против часовой стрелки
+	Rotate clockwise	Повернуть по часовой стрелке
+	Flip horizontal	Отразить по горизонтали
+	Flip vertical	Отразить по вертикали
+	Replace image	Заменить изображение
+	Crop (% trimmed from each side)	Обрезать (% с каждой стороны)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Щёлкните на странице, чтобы добавить текст; каждый щелчок создаёт новое поле, ✓ завершает. Перетаскивайте элементы для перемещения, угол — для размера, двойной щелчок по тексту — для редактирования.
+	Choose an image	Выберите изображение
+	Export to Image	Экспортировать в изображение
+	Export to Text	Экспортировать в текст
+	Export All Images	Экспортировать все изображения
+	Resolution	Разрешение
+	Format	Формат
+	Quality	Качество
+	One {f} file per page, named after the document.	Один файл {f} на страницу, по имени документа.
+	Exclude images smaller than	Исключить изображения меньше
+	No limit	Без ограничений
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Каждое изображение один раз, по имени документа и страницы. JPEG сохраняются без изменений, остальные — как PNG.
+	Plain text in reading order; pages are separated by form feeds.	Обычный текст в порядке чтения; страницы разделены переводами формата.
+	Create {what}	Создать {what}
+	initials	инициалы
+	signature	подпись
+	Create Custom Stamp	Создать свой штамп
+	From {file}	Из {file}
+	Category:	Категория:
+	e.g. My stamps	например, Мои штампы
+	Name:	Имя:
+	Custom	Свой
+	Delete stamp	Удалить штамп
+	Create custom stamp…	Создать свой штамп…
+	From a PDF page or an image	Из страницы PDF или изображения
+	Line spacing	Межстрочный интервал
+	Character spacing	Межсимвольный интервал
+	Horizontal scale	Горизонтальный масштаб
+	Rotate Clockwise	Повернуть по часовой стрелке
+	Rotate Counterclockwise	Повернуть против часовой стрелки
+	Flip Horizontal	Отразить по горизонтали
+	Flip Vertical	Отразить по вертикали
+	Replace Image…	Заменить изображение…
+	Save Image As…	Сохранить изображение как…
+	Check for updates	Проверить обновления
+	No check has run yet.	Проверка ещё не выполнялась.
+	Checking for a newer version…	Проверка новой версии…
+	PdfCraft {v} is available.	Доступна PdfCraft {v}.
+	You have version {c}. Download the new version from its release page.	У вас версия {c}. Скачайте новую версию со страницы релизов.
+	PdfCraft {c} is up to date.	У вас последняя версия PdfCraft {c}.
+	Couldn't check for updates: {e}	Не удалось проверить обновления: {e}
+	You have version {c}. All releases are listed at {page}.	У вас версия {c}. Все релизы перечислены на {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Запрашивает у GitHub последний релиз. Ничего не скачивается и не устанавливается автоматически.
+	Download	Скачать
+	Later	Позже
+	none	нет
+	Declared conformance: {shown}	Заявленное соответствие: {shown}
+	Output intent: {list}	Выходное намерение: {list}
+	Conformance level:	Уровень соответствия:
+	No problems found: the document conforms to {level}.	Проблем не найдено: документ соответствует {level}.
+	 (page {p})	 (стр. {p})
+	  · not fixable here	  · не исправить здесь
+	Verify	Проверить
+	Box	Поле
+	Units	Единицы
+	Set to zero	Установить в ноль
+	Current page ({n})	Текущая страница ({n})
+	Subset	Подмножество
+	Update	Обновить
+	Add	Добавить
+	{verb} Header and Footer	{verb} колонтитулы
+	{verb} Watermark	{verb} водяной знак
+	{verb} Background	{verb} фон
+	Margins (in)	Поля (дюймы)
+	Left Header Text	Текст левого колонтитула
+	Center Header Text	Текст центрального колонтитула
+	Right Header Text	Текст правого колонтитула
+	Left Footer Text	Текст нижнего левого колонтитула
+	Center Footer Text	Текст нижнего центрального колонтитула
+	Right Footer Text	Текст нижнего правого колонтитула
+	Insert Page Number	Вставить номер страницы
+	Insert Date	Вставить дату
+	Start page number	Начальный номер страницы
+	Source	Источник
+	Fit to page	По странице
+	Rotation	Поворот
+	Appear behind page	Позади страницы
+	Appear on top of page	Поверх страницы
+	From colour	Из цвета
+	Page Range Options	Параметры диапазона страниц
+	Preview: page {p} of {n}	Предпросмотр: стр. {p} из {n}
+	Applies to 1 page	Применяется к 1 странице
+	Applies to {n} pages	Применяется к {n} страницам
+	Replaces the existing one on those pages.	Заменяет существующий на этих страницах.
+	PDF or image	PDF или изображение
+	No file chosen	Файл не выбран
+	Page number	Номер страницы
+	Scale relative to target page	Масштаб относительно целевой страницы
+	Link Properties	Свойства ссылки
+	Create Link	Создать ссылку
+	Link Appearance	Внешний вид ссылки
+	Link Type:	Тип ссылки:
+	Visible Rectangle	Видимый прямоугольник
+	Invisible Rectangle	Невидимый прямоугольник
+	Highlight Style:	Стиль выделения:
+	Invert	Инверсия
+	Outline	Контур
+	Inset	Внутри
+	Line Thickness:	Толщина линии:
+	Thin	Тонкая
+	Thick	Толстая
+	Line Style:	Стиль линии:
+	Solid	Сплошная
+	Dashed	Пунктирная
+	Color:	Цвет:
+	Link Action	Действие ссылки
+	Open a web page	Открыть веб-страницу
+	Go to a page view	Перейти к виду страницы
+	Type the web address.	Введите веб-адрес.
+	This document has no signatures.	В этом документе нет подписей.
+	The Keychain's digital IDs couldn't be listed: {e}	Не удалось перечислить цифровые идентификаторы Keychain: {e}
+	Signed and saved to {path}	Подписано и сохранено в {path}
+	Couldn't open revision {n}: {e}	Не удалось открыть ревизию {n}: {e}
+	Couldn't open the signed version: {e}	Не удалось открыть подписанную версию: {e}
+	Sign with a Digital ID	Подписать цифровым идентификатором
+	Choose the digital ID that you want to use for signing:	Выберите цифровой идентификатор для подписи:
+	Keychain  ·  	Keychain  ·
+	Windows store  ·  	Хранилище Windows  ·
+	Issued by: 	Выдан:
+	, Expires: 	, Истекает:
+	No digital IDs yet.	Нет цифровых идентификаторов.
+	Configure New Digital ID	Настроить новый цифровой идентификатор
+	Continue	Продолжить
+	Configure a Digital ID for Signing	Настроить цифровой идентификатор для подписи
+	Use a Digital ID from a file	Использовать цифровой идентификатор из файла
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Создать новый цифровой идентификатор (самоподписанный, в файле с паролем)
+	Name	Имя
+	Organizational Unit	Организационное подразделение
+	Organization Name	Название организации
+	Email Address	Адрес электронной почты
+	Country/Region	Страна/регион
+	Key Algorithm	Алгоритм ключа
+	Confirm Password	Подтвердите пароль
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Действителен 5 лет, для цифровых подписей. Самоподписанные идентификаторы обычно не доверяют другие.
+	File (.p12, .pfx)	Файл (.p12, .pfx)
+	Digital ID	Цифровой идентификатор
+	Browse…	Обзор…
+	{verb} as "{name}"	{verb} как «{name}»
+	Certify	Сертифицировать
+	The signature will be invisible.	Подпись будет невидимой.
+	Distinguished name	Уникальное имя
+	Labels	Метки
+	Permitted actions after certifying	Разрешённые действия после сертификации
+	No changes allowed	Изменения не разрешены
+	Annotations, form fill-in, and digital signatures	Аннотации, заполнение форм и цифровые подписи
+	Form fill-in and digital signatures	Заполнение форм и цифровые подписи
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	Ключ находится в Keychain macOS, который может запросить разрешение на использование PdfCraft.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	Ключ находится в хранилище сертификатов Windows, которое может запросить разрешение на использование PdfCraft.
+	Digital ID password	Пароль цифрового идентификатора
+	Back	Назад
+	Validate all	Проверить все
+	Sign this field…	Подписать это поле…
+	Signature is valid:	Подпись действительна:
+	Signature validity is UNKNOWN:	Действительность подписи НЕИЗВЕСТНА:
+	Signature is INVALID:	Подпись НЕДЕЙСТВИТЕЛЬНА:
+	Signature Details	Сведения о подписи
+	Reason	Причина
+	Signing time	Время подписания
+	Algorithm	Алгоритм
+	Signer	Подписант
+	Issued by	Выдан
+	Valid	Действителен
+	Field	Поле
+	Field: {field} on page {p}	Поле: {field} на стр. {p}
+	Add to trusted certificates	Добавить в доверенные сертификаты
+	View signed version	Просмотреть подписанную версию
+	Show certificate…	Показать сертификат…
+	Export certificate…	Экспортировать сертификат…
+	Certificate Viewer	Просмотрщик сертификатов
+	This dialog shows the details of a certificate and its chain.	Этот диалог показывает сведения о сертификате и его цепочке.
+	Trust	Доверие
+	Issued to	Выдан для
+	Valid from	Действителен с
+	Valid to	Действителен до
+	Intended usage	Назначение
+	Any	Любое
+	Version	Версия
+	Serial number	Серийный номер
+	Issuer	Издатель
+	Validity starts	Действительность начинается
+	Validity ends	Действительность заканчивается
+	Public key	Открытый ключ
+	Key usage	Использование ключа
+	Not present	Отсутствует
+	Self-signed	Самоподписанный
+	Edit Action	Редактировать действие
+	New Action	Новое действие
+	Action name:	Название действия:
+	Description:	Описание:
+	Steps	Шаги
+	Add the steps this action runs, in order.	Добавьте шаги, которые выполняет это действие, по порядку.
+	Add Step	Добавить шаг
+	An action with this name already exists.	Действие с таким названием уже существует.
+	New Action…	Новое действие…
+	Edit…	Редактировать…
+	Add watermark	Добавить водяной знак
+	Add header	Добавить колонтитул
+	Add footer	Добавить нижний колонтитул
+	Set document title	Задать название документа
+	Run a JavaScript	Запустить JavaScript
+	Prepare for Distribution	Подготовить к распространению
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Удалить скрытую информацию и расплющить комментарии и поля формы, чтобы получатели видели только страницы.
+	Optimize Scanned Documents	Оптимизировать отсканированные документы
+	Make scans searchable, then make them smaller.	Сделать сканы доступными для поиска, затем уменьшить их.
+	Add Page Numbers	Добавить номера страниц
+	Number every page in the footer.	Пронумеровать каждую страницу в нижнем колонтитуле.
+	Mark as Confidential	Пометить как конфиденциальный
+	A diagonal CONFIDENTIAL watermark on every page.	Диагональный водяной знак CONFIDENTIAL на каждой странице.
+	Sanitize Documents	Очистить документы
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Удалить скрытую информацию, метаданные, скрипты и встроенное содержимое, и перезаписать файлы.
+	Type text	Ввести текст
+	Text to insert	Текст для вставки
+	Replacement text	Замещающий текст
+	Edit text…	Редактировать текст…
+	Add a sticky note here	Добавить стикер здесь
+	{kind} Properties	Свойства: {kind}
+	Appearance	Внешний вид
+	General	Общие
+	Review History	История проверок
+	This comment's appearance can't be changed yet.	Внешний вид этого комментария пока нельзя изменить.
+	Icon	Значок
+	Thickness	Толщина
+	Modified	Изменено
+	No status has been set.	Статус не установлен.
+	Compare Files	Сравнить файлы
+	Old file:	Старый файл:
+	Open the older version first	Сначала откройте более старую версию
+	New file:	Новый файл:
+	Text is compared word by word; the differences are shown on the new file.	Текст сравнивается пословно; различия показаны в новом файле.
+	Compare this file with an older version: Compare files… in All tools.	Сравните этот файл с более старой версией: Сравнить файлы… во Всех инструментах.
+	No differences in the text.	В тексте нет различий.
+	{n} {kind}	{n} {kind}
+	Inserted	Вставлено
+	Deleted	Удалено
+	Replaced	Заменено
+	Visual	Визуально
+	Mark as comments	Отметить как комментарии
+	Report…	Отчёт…
+	{kind} · page {p}	{kind} · стр. {p}
+	Set Alternate Text	Задать альтернативный текст
+	This document has no tagged figures.	В этом документе нет размеченных фигур.
+	 on page {p}	 на стр. {p}
+	Figure {i} of {n}{page}	Фигура {i} из {n}{page}
+	No preview	Нет предпросмотра
+	Alternate text	Альтернативный текст
+	Describe the figure	Опишите фигура
+	Decorative figure	Декоративная фигура
+	Previous figure	Предыдущая фигура
+	Next figure	Следующая фигура
+	Save & Close	Сохранить и закрыть
+	Accessibility Checker Options	Параметры проверки доступности
+	Report Options	Параметры отчёта
+	Create accessibility report	Создать отчёт о доступности
+	Page Range	Диапазон страниц
+	All pages in document	Все страницы документа
+	Checking Options ({on} of 32 in all categories)	Параметры проверки ({on} из 32 по всем категориям)
+	Show this dialog when the Checker starts	Показывать этот диалог при запуске проверки
+	Select All	Выбрать все
+	Clear All	Очистить все
+	Start Checking	Начать проверку
+	This document hasn't been checked yet.	Этот документ ещё не проверялся.
+	No issues found	Проблем не найдено
+	1 issue	1 проблема
+	{n} issues	{n} проблем
+	{label} (1 issue)	{label} (1 проблема)
+	{label} ({n} issues)	{label} ({n} проблем)
+	Check again	Проверить снова
+	Report	Отчёт
+	Show the accessibility report	Показать отчёт о доступности
+	Collapse	Свернуть
+	Expand	Развернуть
+	{rule} - {status}	{rule} - {status}
+	Passed	Пройдено
+	Failed	Не пройдено
+	Needs manual check	Требует ручной проверки
+	Skipped	Пропущено
+	Fix	Исправить
+	Skip Rule	Пропустить правило
+	Explain	Объяснить
+	Check Again	Проверить снова
+	Show Report	Показать отчёт
+	Options…	Параметры…
+	Go to the page	Перейти на страницу
+	Page Content	Содержимое страницы
+	Forms	Формы
+	Alternate Text	Альтернативный текст
+	Tables	Таблицы
+	Lists	Списки
+	Headings	Заголовки
+	Accessibility permission flag	Флаг разрешения доступности
+	Accessibility permission flag is set	Флаг разрешения доступности установлен
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Настройки безопасности должны позволять вспомогательным технологиям читать содержимое («Разрешить доступ к тексту для устройств чтения с экрана»). Измените безопасность документа, чтобы разрешить это.
+	Image-only PDF	PDF только с изображениями
+	Document is not image-only PDF	Документ не является PDF только с изображениями
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Страницы, которые являются только изображениями текста, нельзя озвучить или искать. Распознайте текст (OCR), чтобы добавить текстовый слой.
+	Document is tagged PDF	Документ является размеченным PDF
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	Теги придают документу логическую структуру, которой следуют вспомогательные технологии. Разметьте документ (Автоматически разметить PDF).
+	Logical Reading Order	Логический порядок чтения
+	Document structure provides a logical reading order	Структура документа обеспечивает логический порядок чтения
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Проверьте, что теги читаются в порядке, который ожидает зрячий читатель. Используйте инструмент «Порядок чтения» или панель «Теги» для исправления.
+	Primary language	Основной язык
+	Text language is specified	Язык текста указан
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	Программы чтения с экрана выбирают голос по языку документа. Укажите его в Свойства документа > Дополнительно > Язык.
+	Document title is showing in title bar	Название документа отображается в заголовке окна
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Окно должно показывать осмысленный заголовок вместо имени файла. Задайте название и Начальный вид > Показать: Название документа.
+	Bookmarks are present in large documents	Закладки присутствуют в больших документах
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	Документам более 20 страниц нужны закладки для навигации. Добавьте закладки для основных разделов.
+	Color contrast	Цветовой контраст
+	Document has appropriate color contrast	Документ имеет достаточный цветовой контраст
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	Текст должен достаточно контрастировать с фоном для людей со слабым зрением. Проверьте цвета глазами или с помощью инструмента контраста.
+	Tagged content	Размеченное содержимое
+	All page content is tagged	Всё содержимое страницы размечено
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Всё на странице должно быть размечено или помечено как артефакт (украшение, колонтитулы). Разметьте неразмеченное содержимое.
+	Tagged annotations	Размеченные аннотации
+	All annotations are tagged	Все аннотации размечены
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Комментарии, ссылки и поля должны быть в дереве тегов, чтобы озвучиваться. Разметьте аннотации.
+	Tab order	Порядок табуляции
+	Tab order is consistent with structure order	Порядок табуляции соответствует порядку структуры
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Страницы со ссылками, комментариями или полями должны табулировать в порядке структуры. Исправление устанавливает порядок табуляции страницы на «По структуре документа».
+	Character encoding	Кодировка символов
+	Reliable character encoding is provided	Обеспечена надёжная кодировка символов
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	Шрифты должны сопоставлять символы с Unicode, чтобы текст можно было читать и копировать. Исправьте шрифты или пересоздайте PDF.
+	Tagged multimedia	Размеченное мультимедиа
+	All multimedia objects are tagged	Все объекты мультимедиа размечены
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	Видео, звук и богатые медиа должны быть размечены, чтобы озвучиваться. Разметьте мультимедиа-аннотации.
+	Screen flicker	Мерцание экрана
+	Page will not cause screen flicker	Страница не вызовет мерцания экрана
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	Анимация, которая мигает, может вызвать припадки. Проверьте скрипты и медиа на мерцание.
+	Scripts	Скрипты
+	No inaccessible scripts	Нет недоступных скриптов
+	Timed responses	Ответы с ограничением времени
+	Page does not require timed responses	Страница не требует ответов с ограничением времени
+	People may need more time to respond. Check that nothing has a time limit.	Людям может понадобиться больше времени для ответа. Проверьте, что ничего не имеет ограничения времени.
+	Navigation links	Навигационные ссылки
+	Navigation links are not repetitive	Навигационные ссылки не повторяются
+	Repeated navigation links should be skippable. Check links that appear on every page.	Повторяющиеся навигационные ссылки должны пропускаться. Проверьте ссылки, которые появляются на каждой странице.
+	Tagged form fields	Размеченные поля формы
+	All form fields are tagged	Все поля формы размечены
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Поля формы должны быть в дереве тегов (теги Form), чтобы озвучиваться. Разметьте поля формы.
+	Field descriptions	Описания полей
+	All form fields have description	Все поля формы имеют описание
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Каждому полю нужна подсказка, которая говорит, что вводить. Добавьте её в Свойства поля > Общие > Подсказка.
+	Figures alternate text	Альтернативный текст фигур
+	Figures require alternate text	Фигурам нужен альтернативный текст
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	Изображениям нужен альтернативный текст, описывающий их, или их нужно пометить как декоративные. Добавьте альтернативный текст к каждой фигуре.
+	Nested alternate text	Вложенный альтернативный текст
+	Alternate text that will never be read	Альтернативный текст, который никогда не будет прочитан
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Альтернативный текст внутри элемента, который уже имеет альтернативный текст, никогда не читается. Удалите внутренний альтернативный текст.
+	Associated with content	Связан с содержимым
+	Alternate text must be associated with some content	Альтернативный текст должен быть связан с каким-либо содержимым
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Альтернативный текст на элементе без содержимого страницы никогда не достигается. Удалите его или присоедините элемент к содержимому.
+	Hides annotation	Скрывает аннотацию
+	Alternate text should not hide annotation	Альтернативный текст не должен скрывать аннотацию
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Альтернативный текст на элементе, который содержит ссылку или поле, скрывает эту аннотацию от вспомогательных технологий. Переместите альтернативный текст.
+	Other elements alternate text	Альтернативный текст других элементов
+	Other elements that require alternate text	Другие элементы, которым нужен альтернативный текст
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Формулы и подобные нетекстовые элементы нуждаются в альтернативном тексте. Добавьте им альтернативный текст.
+	Rows	Строки
+	TR must be a child of Table, THead, TBody, or TFoot	TR должен быть потомком Table, THead, TBody или TFoot
+	Table cells belong in a row. Fix the table's tags.	Ячейки таблицы принадлежат строке. Исправьте теги таблицы.
+	Headers	Заголовки
+	Tables should have headers	Таблицы должны иметь заголовки
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	Ячейки заголовков (TH) сообщают слушателям, что содержит каждый столбец или строка. Пометьте ячейки заголовков.
+	Regularity	Регулярность
+	Tables must contain the same number of columns in each row and rows in each column	Таблицы должны содержать одинаковое число столбцов в каждой строке и строк в каждом столбце
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	Нерегулярные таблицы запутывают навигацию по ячейкам. Дайте каждой строке одинаковое число ячеек (с учётом диапазонов).
+	Summary	Сводка
+	Tables must have a summary	Таблицы должны иметь сводку
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Сводка описывает назначение и структуру таблицы. Добавьте атрибут Summary к каждой таблице.
+	List items	Элементы списка
+	LI must be a child of L	LI должен быть потомком L
+	List items belong in a list. Fix the list's tags.	Элементы списка принадлежат списку. Исправьте теги списка.
+	Lbl and LBody	Lbl и LBody
+	Lbl and LBody must be children of LI	Lbl и LBody должны быть потомками LI
+	List labels and bodies belong in a list item. Fix the list's tags.	Метки и тела списков принадлежат элементу списка. Исправьте теги списка.
+	Appropriate nesting	Соответствующее вложение
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	Уровни заголовков не должны пропускать (H1, за которым следует H3). Переразметьте заголовки.
+	TH and TD	TH и TD
+	TH and TD must be children of TR	TH и TD должны быть потомками TR
+	Mark Page Range	Отметить диапазон страниц
+	Pages from	Страницы с
+	Single word or phrase	Одно слово или фраза
+	Text to find	Текст для поиска
+	Patterns	Шаблоны
+	Phone Numbers	Номера телефонов
+	Email Addresses	Адреса электронной почты
+	Credit Cards	Кредитные карты
+	Social Security Numbers	Номера социального страхования
+	Dates	Даты
+	Text in images isn't found; recognise text (OCR) first.	Текст в изображениях не находится; сначала распознайте текст (OCR).
+	No matches.	Совпадений нет.
+	{n} match(es) marked for redaction.	Отмечено для сокрытия: {n} совпад.
+	Redaction Tool Properties	Свойства инструмента сокрытия
+	Redacted area fill colour:	Цвет заливки скрытой области:
+	Use overlay text	Использовать текст поверх
+	Custom text:	Свой текст:
+	Font:	Шрифт:
+	Font size:	Размер шрифта:
+	Auto-size text to fit redaction region	Автоподбор размера текста по области сокрытия
+	Font colour:	Цвет шрифта:
+	Repeat overlay text	Повторять текст поверх
+	Text alignment:	Выравнивание текста:
+	Center	По центру
+	Apply redactions	Применить сокрытия
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Вы собираетесь применить 1 метку сокрытия. Текст, изображения и рисунки под метками, а также комментарии и поля формы, которые с ними пересекаются, удаляются безвозвратно.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Вы собираетесь применить {n} меток сокрытия. Текст, изображения и рисунки под метками, а также комментарии и поля формы, которые с ними пересекаются, удаляются безвозвратно.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	Сохраните документ после этого: сохранение перезаписывает весь файл, чтобы не осталось следов удалённого содержимого.
+	Select the items to remove from this document.	Выберите элементы для удаления из этого документа.
+	Metadata	Метаданные
+	File attachments	Вложенные файлы
+	Comments and markups	Комментарии и разметка
+	Hidden text	Скрытый текст
+	Hidden layers	Скрытые слои
+	Links, actions and JavaScripts	Ссылки, действия и JavaScript
+	Private data of other applications	Личные данные других приложения
+	None found	Ничего не найдено
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Поля формы расплющены: их значения остаются видимыми. Сохранение перезаписывает весь файл.
+	Remove	Удалить
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	Очистка удаляет скрытую информацию из документа: метаданные, вложенные файлы, комментарии, поля формы (расплющенные), скрытый текст и слои, закладки, ссылки, действия и скрипты, а также личные данные приложений.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	Сохраните документ после этого; сохранение перезаписывает весь файл, чтобы ничего удалённого не осталось.
+	Printer:	Принтер:
+	Save as PDF	Сохранить как PDF
+	{name} (default)	{name} (по умолчанию)
+	Copies:	Копии:
+	Collate	Собирать в тетради
+	Print in grayscale	Печать в оттенках серого
+	Two-sided:	Двусторонняя:
+	Off	Выкл
+	Flip on long edge	Переворот по длинной стороне
+	Flip on short edge	Переворот по короткой стороне
+	Paper:	Бумага:
+	Pages to Print	Страницы для печати
+	More options:	Дополнительные параметры:
+	All pages in range	Все страницы в диапазоне
+	Odd pages only	Только нечётные страницы
+	Even pages only	Только чётные страницы
+	Reverse pages	Страницы в обратном порядке
+	Page Sizing & Handling	Размер и обработка страниц
+	Size	Размер
+	Poster	Постер
+	Multiple	Несколько
+	Booklet	Брошюра
+	Fit	По размеру
+	Shrink oversized pages	Уменьшать страницы больше формата
+	Custom scale:	Свой масштаб:
+	Tile scale:	Масштаб плитки:
+	Overlap:	Перекрытие:
+	Cut marks	Метки реза
+	Pages per sheet:	Страниц на листе:
+	Page order:	Порядок страниц:
+	Horizontal	По горизонтали
+	Horizontal reversed	По горизонтали в обратном порядке
+	Vertical	По вертикали
+	Vertical reversed	По вертикали в обратном порядке
+	Print page border	Печатать границу страницы
+	Auto-rotate pages	Автоповорот страниц
+	Booklet subset:	Подмножество брошюры:
+	Both sides	Обе стороны
+	Front side only	Только лицевая сторона
+	Back side only	Только оборотная сторона
+	Binding:	Переплёт:
+	Left	Слева
+	Right	Справа
+	Orientation:	Ориентация:
+	Auto portrait/landscape	Авто книжная/альбомная
+	Portrait	Книжная
+	Landscape	Альбомная
+	Comments & Forms	Комментарии и формы
+	Document	Документ
+	Document and markups	Документ и разметка
+	Document and stamps	Документ и штампы
+	Form fields only	Только поля формы
+	Previous sheet	Предыдущий лист
+	Next sheet	Следующий лист
+	No sheets	Нет листов
+	Sheet {s} of {n}	Лист {s} из {n}
+	Removed 1 hidden item. Save to remove them from the file.	Удалён 1 скрытый элемент. Сохраните, чтобы удалить их из файла.
+	Removed {n} hidden items. Save to remove them from the file.	Удалено {n} скрытых элементов. Сохраните, чтобы удалить их из файла.
+	Document sanitized. Save to finish: saving rewrites the whole file.	Документ очищен. Сохраните для завершения: сохранение перезаписывает весь файл.
+	Applied 1 redaction mark. Save to remove the content from the file.	Применена 1 метка сокрытия. Сохраните, чтобы удалить содержимое из файла.
+	Applied {n} redaction marks. Save to remove the content from the file.	Применено {n} меток сокрытия. Сохраните, чтобы удалить содержимое из файла.
+	JavaScript Console	Консоль JavaScript
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript выключен (Настройки > JavaScript).
+	Output appears here.	Вывод появляется здесь.
+	Script Name:	Название скрипта:
+	This document has no document-level scripts.	В этом документе нет скриптов уровня документа.
+	No form fields were detected	Поля формы не обнаружены
+	Detected 1 form field	Обнаружено 1 поле формы
+	Detected {n} form fields	Обнаружено {n} полей формы
+	{field}: {e}	{field}: {e}
+	Current page	Текущая страница
+	Selected pages	Выделенные страницы
+	Document language	Язык документа
+	Output	Вывод
+	Searchable Image (Exact)	Доступное для поиска изображение (точное)
+	Adds invisible text over each word; the page image is not changed	Добавляет невидимый текст над каждым словом; изображение страницы не меняется
+	Downsample to	Уменьшить до
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Распознавание текста не установлено: отсутствуют модели (запустите `cargo xtask models` или задайте PRINTCRAFT_MODELS).
+	Settings	Настройки
+	Optional	Опционально
+	Planned · {m}	Запланировано · {m}
+	Planned for milestone {m} — open to see what it will include	Запланировано на этап {m} — откройте, чтобы увидеть содержимое
+	Coming in milestone {m}. Items marked Ready work today.	Появится на этапе {m}. Пункты с пометкой «Готово» работают сегодня.
+	1 mark	1 метка
+	{n} marks	{n} меток
+	Dynamic	Динамический
+	Sign Here	Подпишите здесь
+	Standard Business	Стандартный бизнес
+	Choose a stamp, then click on the page to place it.	Выберите штамп, затем щёлкните на странице, чтобы разместить его.
+	Note	Заметка
+	Polyline	Полилиния
+	Attachment	Вложение
+	Callout	Выноска
+	Typewriter	Печатная машинка
+	Checked	Отмечено
+	Unchecked	Не отмечено
+	Marked	Отмечено
+	Locked	Заблокировано
+	Search comments	Поиск по комментариям
+	Add a comment	Добавить комментарий
+	No comments yet.	Комментариев пока нет.
+	Pick a tool in the quick bar, or type above.	Выберите инструмент на быстрой панели или введите выше.
+	No comments match.	Комментарии не найдены.
+	Unknown author	Неизвестный автор
+	No colour	Без цвета
+	Remove checkmark	Убрать галочка
+	Mark with checkmark	Отметить галочкой
+	Reply	Ответить
+	Add a reply	Добавить ответ
+	Post	Опубликовать
+	Page {label}	Стр. {label}
+	{kind} — click to show it on the page	{kind} — щёлкните, чтобы показать на странице
+	Set status	Задать статус
+	Copy text	Копировать текст
+	Properties…	Свойства…
+	Make Current Properties Default	Сделать текущие свойства по умолчанию
+	More options	Ещё
+	Sort by	Сортировать по
+	Author	Автор
+	Type	Тип
+	Colour	Цвет
+	Show all comments	Показать все комментарии
+	Create PDF comment summary…	Создать сводку комментариев в PDF…
+	Export all to data file…	Экспортировать все в файл данных…
+	Filter comments	Фильтровать комментарии
+	Status	Статус
+	Accepted	Принято
+	Rejected	Отклонено
+	Cancelled	Отменено
+	Completed	Завершено
+	Show all	Показать все
+	Yellow	Жёлтый
+	Orange	Оранжевый
+	Red	Красный
+	Pink	Розовый
+	Purple	Фиолетовый
+	Blue	Синий
+	Light blue	Голубой
+	Green	Зелёный
+	Gray	Серый
+	Black	Чёрный
+	Bookmark options	Параметры закладок
+	Expand all bookmarks	Развернуть все закладки
+	Expand top-level bookmarks	Развернуть закладки верхнего уровня
+	Collapse all bookmarks	Свернуть все закладки
+	New bookmark (⌘B)	Новая закладка (⌘B)
+	This document has no bookmarks.	В этом документе нет закладки.
+	This document has no layers.	В этом документе нет слоёв.
+	This document has no attachments.	В этом документе нет вложений.
+	Hide layer	Скрыть слой
+	Show layer	Показать слой
+	Set layer visibility	Задать видимость слоя
+	on page {label}	на стр. {label}
+	Save attachment…	Сохранить вложение…
+	Open in a new tab	Открыть в новой вкладке
+	This document has no pages.	В этом документе нет страниц.
+	Find text	Найти текст
+	No matches	Совпадений нет
+	Searching… {s}/{p}	Поиск… {s}/{p}
+	{c} of {n}{more}	{c} из {n}{more}
+	Previous (⇧⌘G)	Предыдущее (⇧⌘G)
+	Next (⌘G)	Следующее (⌘G)
+	Find options	Параметры поиска
+	Whole words only	Только целые слова
+	Case-sensitive	С учётом регистра
+	Close (Esc)	Закрыть (Esc)
+	Align	Выровнять
+	Top	Верх
+	Bottom	Низ
+	Center horizontally	По центру горизонтально
+	Center vertically	По центру вертикально
+	Distribute	Распределить
+	Horizontally	По горизонтали
+	Vertically	По вертикали
+	Set Fields to Same Size	Установить полям одинаковый размер
+	Height	Высота
+	Width	Ширина
+	Both	Оба
+	Duplicate…	Дублировать…
+	All pages	Все страницы
+	Odd pages	Нечётные страницы
+	Even pages	Чётные страницы
+	Landscape pages	Альбомные страницы
+	Portrait pages	Книжные страницы
+	Move earlier	Переместить раньше
+	Move later	Переместить позже
+	Back to the document	Вернуться к документу
+	Protect Using Password	Защитить паролем
+	Requires user to enter a password for:	Требует от пользователя ввести пароль для:
+	Viewing	Просмотра
+	Editing	Редактирования
+	Type Password	Введите пароль
+	Re-type Password	Повторите пароль
+	Strength: {s}	Надёжность: {s}
+	Strong	Высокая
+	Medium	Средняя
+	Weak	Низкая
+	Advanced Options {chevron}	Дополнительные параметры {chevron}
+	Compatibility	Совместимость
+	Acrobat X and later (256-bit AES)	Acrobat X и новее (256-битный AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 и новее (128-битный AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 и новее (128-битный RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 и новее (40-битный RC4)
+	Encrypt	Шифровать
+	All document contents	Всё содержимое документа
+	All document contents except metadata	Всё содержимое документа, кроме метаданных
+	Printing allowed	Печать разрешена
+	Low Resolution (150 dpi)	Низкое разрешение (150 dpi)
+	Changes allowed	Изменения разрешены
+	Inserting, deleting, and rotating pages	Вставка, удаление и поворот страниц
+	Filling in form fields and signing existing signature fields	Заполнение полей формы и подписание существующих полей подписей
+	Commenting, filling in form fields, and signing existing signature fields	Комментирование, заполнение полей формы и подписание существующих полей подписей
+	Any except extracting pages	Любые, кроме извлечения страниц
+	Enable copying of text, images, and other content	Разрешить копирование текста, изображений и другого содержимого
+	Enable text access for screen reader devices for the visually impaired	Разрешить доступ к тексту для устройств чтения с экрана для слабовидящих
+	Type a password.	Введите пароль.
+	The passwords don't match.	Пароли не совпадают.
+	This compatibility level supports only plain ASCII passwords.	Этот уровень совместимости поддерживает только пароли в обычном ASCII.
+	Anyone opening the document will need this password. It's applied when you save.	Любой, кто открывает документ, будет нуждаться в этом пароле. Он применяется при сохранении.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	Документ открывается без пароля; этот пароль нужен для изменения ограничений. Он применяется при сохранении.
+	Recover unsaved documents?	Восстановить несохранённые документы?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft завершился некорректно. В этих документах были изменения, сохранённые автоматически:
+	just now	только что
+	{n} min ago	{n} мин назад
+	{n} h ago	{n} ч назад
+	 · password-protected	  · защищён паролем
+	Recover	Восстановить
+	Discard	Отклонить
+	Version {v}	Версия {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Открытое PDF-приложение с чистой комнатой, написанное на Rust. MIT OR Apache-2.0.
+	Part of	Часть
+	Summarize Options	Параметры суммирования
+	Choose a layout:	Выберите макет:
+	Comments only	Только комментарии
+	Sort comments by:	Сортировать комментарии по:
+	Create PDF Comment Summary	Создать сводку комментариев в PDF
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Вернуть к ранее сохранённой версии «{name}»? Изменения с тех пор нельзя будет отменить.
+	Number pages	Пронумеровать страницы
+	Style	Стиль
+	None (prefix only)	Нет (только префикс)
+	Prefix	Префикс
+	Start	Начало
+	Labels: {preview}. Later pages keep their labels.	Метки: {preview}. Последующие страницы сохраняют свои метки.
+	Even and Odd Pages	Чётные и нечётные страницы
+	Even Pages Only	Только чётные страницы
+	Odd Pages Only	Только нечётные страницы
+	Landscape and Portrait Pages	Альбомные и книжные страницы
+	Landscape Pages	Альбомные страницы
+	Portrait Pages	Книжные страницы
+	Duplicate Field	Дублировать поле
+	Duplicate "{name}" onto:	Дублировать «{name}» на:
+	1 page selected.	Выделена 1 страница.
+	{n} pages selected.	Выбрано {n} страницы.
+	Delete pages after extracting	Удалить страницы после извлечения
+	Extract pages as separate files	Извлечь страницы как отдельные файлы
+	Rotate Pages	Повернуть страницы
+	Direction:	Направление:
+	Clockwise 90 degrees	По часовой стрелке 90 градусов
+	Counterclockwise 90 degrees	против часовой стрелке 90 градусов
+	180 degrees	180 градусов
+	Pages:	Страницы:
+	All	Все
+	Selection	Выделение
+	From	С
+	Rotate:	Повернуть:
+	Repairs	Исправления
+	Repair log	Журнал исправлений
+	Split document	Разделить документ
+	Number of pages	Количество страниц
+	Pages per file	Страниц на файл
+	File size	Размер файла
+	At most	Не более
+	Top-level bookmarks ({n})	Закладки верхнего уровня ({n})
+	Before each selected page (select pages in Organize)	Перед каждой выделенной страницей (выделите страницы в Организации)
+	Creates 1 file from {n} pages.	Создаёт 1 файл из {n} страниц.
+	Creates {f} files from {n} pages.	Создаёт {f} файлов из {n} страниц.
+	Each file holds as many of the {n} pages as fit.	Каждый файл содержит столько из {n} страниц, сколько помещается.
+	Replace Pages	Заменить страницы
+	Original: replace pages	Оригинал: заменить страницы
+	to	до
+	to {n}	до {n}
+	Replacement: pages of {name}	Замена: страницы из {name}
+	of {name}	из {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Меняется только содержимое страницы: ссылки, комментарии, поля формы и закладки на исходных страницы остаются.
+	The replacement file doesn't have that many pages.	В заменяющем файле нет столько страниц.
+	Tagged PDF	Размеченный PDF
+	Document Properties	Свойства документа
+	Description	Описание
+	Initial View	Начальный вид
+	Security	Безопасность
+	Fonts	Шрифты
+	Advanced	Дополнительно
+	Title	заголовок
+	Subject	Тема
+	Keywords	Ключевые слова
+	Application	Приложение
+	PDF producer	Производитель PDF
+	Layout and Magnification	Макет и масштаб
+	Navigation tab	Вкладка навигации
+	Page Only	Только страница
+	Bookmarks Panel and Page	Панель закладок и страница
+	Pages Panel and Page	Панель страниц и страница
+	Attachments Panel and Page	Панель вложений и страница
+	Layers Panel and Page	Панель слоёв и страница
+	Page layout	Макет страницы
+	Default	По умолчанию
+	Single Page	Одна страница
+	Single Page Continuous	Одна страница, непрерывная
+	Two-Up (Facing)	Две страницы (развёрнутые)
+	Two-Up Continuous (Facing)	Две страницы, непрерывные (развёрнутые)
+	Two-Up (Cover Page)	Две страницы (титульная)
+	Two-Up Continuous (Cover Page)	Две страницы, непрерывные (титульная)
+	Magnification	Масштаб
+	Actual Size	Фактический размер
+	Fit Page	По странице
+	Fit Width	По ширине
+	Fit Height	По высоте
+	Fit Visible	По видимой области
+	Open to page	Открыть на странице
+	of {pages}	из {pages}
+	Window Options	Параметры окна
+	Resize window to initial page	Изменять размер окна по начальной странице
+	Center window on screen	Центрировать окно на экране
+	Open in Full Screen mode	Открывать в полноэкранном режиме
+	Show:	Показать:
+	File Name	Имя файла
+	Document Title	Название документа
+	User Interface Options	Параметры пользовательского интерфейса
+	Hide menu bar	Скрыть строку меню
+	Hide toolbars	Скрыть панели инструментов
+	Hide window controls	Скрыть элементы управления окном
+	Security method	Метод безопасности
+	No security	Без безопасности
+	Restrictions	Ограничения
+	None — everything is allowed	Нет — всё разрешено
+	Password security	Безопасность паролем
+	Encryption	Шифрование
+	Opened with	Открыто с
+	— (protection is applied when you save)	— (защита применяется при сохранении)
+	Owner password (no restrictions apply)	Пароль владельца (ограничения не применяются)
+	User password	Пароль пользователя
+	Change settings…	Изменить настройки…
+	Printing	Печать
+	Not allowed	Не разрешено
+	Allowed	Разрешено
+	High resolution	Высокое разрешение
+	Low resolution	Низкое разрешение
+	Changing the document	Изменение документа
+	Document assembly	Сборка документа
+	Content copying	Копирование содержимого
+	Content copying for accessibility	Копирование содержимого для доступности
+	Commenting	Комментирование
+	Filling of form fields	Заполнение полей формы
+	No fonts are referenced by the pages.	Страницы не ссылаются на шрифты.
+	PDF version	Версия PDF
+	Location	Местоположение
+	Page size	Размер страницы
+	Yes	Да
+	No	Нет
+	Revisions	Ревизии
+	View revision {n}	Просмотреть ревизию {n}
+	Open the file as it was saved then	Открыть файл, как он был сохранён тогда
+	Binding	Переплёт
+	Left Edge	Левый край
+	Right Edge	Правый край
+	Language	Язык
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Сохранено {place}: {before} → {after} (на {pct}% меньше){detail}
+	Couldn't save the image: {e}	Не удалось сохранить изображение: {e}
+	Adding images arrives on the web with file pickers for images	Добавление изображений появится в веб-версии с выбором файлов изображений
+	Replacing images on page {p} arrives on the web with image pickers ({i})	Замена изображений на стр. {p} появится в веб-версии с выбором изображений ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: выбор изображений появится в веб-версии с выбором файлов изображений
+	Replacing images arrives on the web with image file pickers	Замена изображений появится в веб-версии с выбором файлов изображений
+	Couldn't create a PDF: {e}	Не удалось создать PDF: {e}
+	The clipboard has no image or text	В буфере обмена нет изображения или текста
+	On the web, open or drop an image to convert it	В веб-версии откройте или перетащите изображение для конвертации
+	Couldn't optimize the file: {e}	Не удалось оптимизировать файл: {e}
+	Couldn't write {path}: {e}	Не удалось записать {path}: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Форма просит отправить данные на {u}; PdfCraft не отправляет данные форм. Сохраните документ, чтобы сохранить введённые данные.
+	{s} actions run in the JavaScript engine (M6)	{s} действий выполняется в движке JavaScript (M6)
+	{name}: the {other} action isn't supported yet	{name}: действие {other} пока не поддерживается
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} отправляет форму на {url}; PdfCraft не отправляет данные форм. Сохраните документ, чтобы сохранить введённые данные.
+	Export stopped: {e}	Экспорт остановлен: {e}
+	Exported 1 image	Экспортировано 1 изображение
+	Exported {n} images	Экспортировано {n} изображений
+	 ({s} not exported: {first})	 ({s} не экспортировано: {first})
+	Exported the text of 1 page	Экспортирован текст 1 страницы
+	Exported the text of {n} pages	Экспортирован текст {n} страниц
+	{msg} to {dir}	{msg} в {dir}
+	Exporting… {d} of {t}	Экспорт… {d} из {t}
+	Choose a folder for the exported files	Выберите папку для экспортированных файлов
+	New {tool} comments will look like this one	Новые комментарии {tool} будут выглядеть как этот
+	This document can't be checked: it couldn't be read for editing	Этот документ нельзя проверить: его не удалось прочитать для редактирования
+	The checker found no problems in this document.	Проверка не нашла проблем в этом документе.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Проверка нашла 1 проблему, которая может помешать полной доступности документа.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Проверка нашла {n} проблем, которые могут помешать полной доступности документа.
+	The text is the same	Текст одинаков
+	1 difference found	Найдено 1 отличие
+	{n} differences found	Найдено {n} отличий
+	Added 1 comment	Добавлен 1 комментарий
+	Added {n} comments	Добавлено {n} комментариев
+	Choose a folder for the results	Выберите папку для результатов
+	Files for {name}	Файлы для {name}
+	An action is already running	Действие уже выполняется
+	Running action… file {d} of {t}	Выполняется действие… файл {d} из {t}
+	No unlinked web addresses were found in the text	В тексте не найдено несвязанных веб-адресов
+	Created 1 link	Создана 1 ссылка
+	Created {n} links	Создано {n} ссылок
+	Text recognition is already running	Распознавание текста уже выполняется
+	Recognizing text… file {d} of {t}	Распознавание текста… файл {d} из {t}
+	Recognizing text… page {d} of {t}	Распознавание текста… стр. {d} из {t}
+	Recognized 1 word	Распознано 1 слово
+	Recognized {n} words	Распознано {n} слов
+	{words} on {pages}	{words} на {pages}
+	; 1 page already had text	; 1 страница уже имела текст
+	; {n} pages already had text	; {n} страниц уже имели текст
+	Recognized {w} words in 1 file	Распознано {w} слов в 1 файле
+	Recognized {w} words in {n} files	Распознано {w} слов в {n} файлах
+	; failed: {list}	; не удалось: {list}
+	1 file done	Обработан 1 файл
+	{n} files done	Обработано {n} файлов
+	The selected area has been copied ({w} × {h} pixels)	Выделенная область скопирована ({w} × {h} пикселей)
+	Couldn't take the snapshot: {e}	Не удалось сделать снимок: {e}
+	Couldn't recover {name}: {e}	Не удалось восстановить {name}: {e}
+	The document now conforms to {level}; save it to keep the changes	Теперь документ соответствует {level}; сохраните, чтобы сохранить изменения
+	Fixed what could be fixed; 1 problem remains	Исправлено всё, что можно; осталась 1 проблема
+	Fixed what could be fixed; {n} problems remain	Исправлено всё, что можно; осталось {n} проблем
+	Custom stamps arrive on the web with file pickers for images	Свои штампы появятся в веб-версии с выбором файлов изображений
+	{file} is too large for a stamp (at most {n} MB)	{file} слишком велик для штампа (не более {n} МБ)
+	Sent to {printer}	Отправлено на {printer}
+	Sent to {printer}: {msg}	Отправлено на {printer}: {msg}
+	Choose a folder for the searchable files	Выберите папку для доступных для поиска файлов
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Файлы объединяются сверху вниз. Оставьте «Страницы» пустыми, чтобы взять все страницы.
+	Unlock…	Разблокировать…
+	Select a password-protected file first	Сначала выберите файл, защищённый паролем
+	Enter the permissions password to allow combining	Введите пароль разрешений, чтобы разрешить объединение
+	Enter the password that opens it	Введите пароль для открытия
+	Unlock {name}	Разблокировать {name}
+	Unlock {n} files	Разблокировать {n} файлов
+	The same password is tried on each file.	Один и тот же пароль пробуется на каждом файле.
+	Hide password	Скрыть пароль
+	Show password	Показать пароль
+	Wrong password	Неверный пароль
+	The password is only used to read the file; it isn't saved.	Пароль используется только для чтения файла; он не сохраняется.
+	Unlock	Разблокировать
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Открыто, но настройки безопасности не разрешают объединение. Введите пароль разрешений.
+	Unlocked: the combined file won't be password-protected	Разблокировано: объединённый файл не будет защищён паролем
+	Unlocked {n} of {m} files	Разблокировано {n} из {m} файлов
+	Drop PDFs or folders here, or choose them.	Перетащите PDF или папки сюда или выберите их.
+	Add folder…	Добавить папку…
+	Add folder and subfolders…	Добавить папку и вложенные папки…
+	More ways to add files	Больше способов добавить файлы
+	Every PDF in the folder	Каждый PDF в папке
+	Every PDF in the folder and the folders inside it	Каждый PDF в папке и вложенных папках
+	Add folder	Добавить папку
+	Add folder and subfolders	Добавить папку и вложенные папки
+	No PDFs found in {folder}	В {folder} не найдено PDF
+	Added the first {n} PDFs in {folder}	Добавлены первые {n} PDF из {folder}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Щёлкните для сортировки, перетащите, чтобы переместить столбец. Перетащите край, чтобы изменить размер.
+	Reset columns	Сбросить столбцы
+	Remove {n} files	Удалить {n} файлов
+	{n} selected	Выбрано: {n}
+	sorted ascending	отсортировано по возрастанию
+	sorted descending	отсортировано по убыванию
+	Protected: the combined file won't keep its security settings	Защищено: объединённый файл не сохранит настройки безопасности
+	Add open documents	Добавить открытые документы
+	All open documents	Все открытые документы
+	No documents are open	Нет открытых документов
+	Select a file first	Сначала выберите файл
+	1 file	1 файл
+	{n} files	{n} файлов
+	1 file needs attention	1 файл требует внимания
+	{n} files need attention	{n} файлов требуют внимания
+	{name} can't be combined: {why}	{name} нельзя объединить: {why}
+	Check the pages of {name}: {why}	Проверьте страницы {name}: {why}
+	Add the PDFs to combine	Добавить PDF для объединения
+	File name	Имя файла
+	Warnings	Предупреждения
+	Drag to reorder	Перетащить для изменения порядка
+	{k} of {n}	{k} из {n}
+	? of {n}	? из {n}
+	Added more than once	Добавлено более одного раза
+	yesterday	вчера
+	{n} days ago	{n} дней назад
+	No pages selected	Страницы не выбраны
+	Password-protected	Защищён паролем
+	Its security settings don't allow copying pages	Его настройки безопасности не разрешают копировать страницы
+	Can't be read: {e}	Нельзя прочитать: {e}
+	Includes unsaved changes	Включает несохранённые изменения
+	Pages of {name} to combine, e.g. 1-3, 6	Страницы {name} для объединения, например 1-3, 6
+	Remove {name}	Удалить {name}
+	Add files…	Добавить файлы…
+	Add at least two files	Добавить не менее двух файлов
+	Couldn't add {name}: {e}	Не удалось добавить {name}: {e}
+	Couldn't combine files: {e}	Не удалось объединить файлы: {e}
+	Export comments	Экспортировать комментарии
+	Export form data	Экспортировать данные формы
+	Comment and form data	Комментарии и данные формы
+	Export	Экспортировать
+	Select data files to merge	Выберите файлы данных для объединения
+	Form data and PDF forms	Данные формы и формы PDF
+	Save the spreadsheet	Сохранить электронную таблицу
+	Save the accessibility report	Сохранить отчёт о доступности
+	Save image	Сохранить изображение
+	Export certificate	Экспортировать сертификат
+	Choose a folder for the extracted pages	Выберите папку для извлечённых страниц
+	Choose a folder for the split files	Выберите папку для разделённых файлов
+	Couldn't use {name}: {e}	Не удалось использовать {name}: {e}
+	Couldn't extract pages: {e}	Не удалось извлечь страницы: {e}
+	Couldn't write {name}: {e}	Не удалось записать {name}: {e}
+	Wrote 1 file to {dir}	Записан 1 файл в {dir}
+	Wrote {n} files to {dir}	Записано {n} файлов в {dir}
+	No pages match those choices	Страницы не соответствуют этим выбору
+	Couldn't split: {e}	Не удалось разделить: {e}
+	Couldn't summarize comments: {e}	Не удалось суммировать комментарии: {e}
+	Couldn't open the result: {e}	Не удалось открыть результат: {e}
+	Importing data arrives on the web with file pickers for data files	Импорт данных появится в веб-версии с выбором файлов данных
+	Exported to {path}	Экспортировано в {path}
+	Merging data files needs the desktop app	Объединение файлов данных требует настольное приложение
+	Merged 1 file into {path}	Объединён 1 файл в {path}
+	Merged {n} files into {path}	Объединено {n} файлов в {path}
+	Combined {n} files	Объединено {n} файлов
+	Extracted 1 page	Извлечена 1 страница
+	Extracted {n} pages	Извлечено {n} страниц
+	Created a comment summary	Создана сводка комментариев
+	Couldn't open {name}: {e}	Не удалось открыть {name}: {e}
+	Couldn't read {name}: {e}	Не удалось прочитать {name}: {e}
+	Couldn't save: {e}	Не удалось сохранить: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Скачивание вложений в веб-версии появится с M3.10 ({n} байт .ready)
+	`{command}` {when}	`{command}` {when}
+	ships in milestone {m}	появится на этапе {m}
+	needs an AI provider (off by default)	нужен AI-провайдер (по умолчанию выключено)
+	is available	доступно
+	is not available yet	пока недоступно
+	{label} failed: {e}	{label} не удалось: {e}
+	Undid {label}	Отменили: {label}
+	Redid {label}	Повторили: {label}
+	A document needs at least one page: copy instead	Документу нужна хотя бы одна страница: копируйте вместо этого
+	Cut {what}	Вырезано: {what}
+	Copied {what}	Скопировано: {what}
+	1 page	1 страница
+	{n} pages	{n} страниц
+	Copy or cut pages first	Сначала скопируйте или вырежьте страницы
+	Couldn't save {name}: {e}	Не удалось сохранить {name}: {e}
+	Saved {name}	Сохранено: {name}
+	Saved, but reopening failed: {e}	Сохранено, но повторное открытие не удалось: {e}
+	Downloaded {name}	Скачано: {name}
+	Couldn't download {name}: {e}	Не удалось скачать {name}: {e}
+	Reverted to the last saved version	Восстановлено к последней сохранённой версии
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Это не сработало: внутренняя ошибка остановила его ({m}). Ваши документы не изменены.
+	Nothing to undo	Нечего отменить
+	Nothing to redo	Нечего повторить
+	This document has no form fields you can fill in	В этом документе нет полей формы, которые можно заполнить
+	This document has no comments to flatten	В этом документе нет комментариев для расплющивания
+	This document has no form fields to flatten	В этом документе нет полей формы для расплющивания
+	There are no redaction marks (mark text, areas or pages first)	Нет меток сокрытия (сначала отметьте текст, области или страницы)
+	This document has no {kind} to change	В этом документе нет {kind} для изменения
+	header or footer	колонтитул
+	watermark	водяной знак
+	background	фон
+	This document isn't password-protected	Этот документ не защищён паролем
+	Only the document's owner can change its security (open it with the permissions password)	Только владелец документа может изменить его безопасность (откройте его с паролем разрешений)
+	The document's security settings don't allow this change	Настройки безопасности документа не разрешают это изменение
+	Open a document first	Сначала откройте документ
+	Security will be removed when you save	Безопасность будет удалена при сохранении
+	Click text or an image to edit it	Щёлкните текст или изображение, чтобы редактировать
+	Drag a rectangle to create a link; double-click a link to edit it	Перетащите прямоугольник, чтобы создать ссылку; двойной щелчок по ссылке — для редактирования
+	There are no redaction marks to apply	Нет меток сокрытия для применения
+	Drag to draw the area where the signature should appear.	Перетащите, чтобы нарисовать область, где должна появиться подпись.
+	Couldn't fit the visible content: {e}	Не удалось вместить видимое содержимое: {e}
+	Drag a rectangle around the area to copy	Перетащите прямоугольник вокруг области для копирования
+	Click on the page to add a {tool}, or drag to set its size	Щёлкните на странице, чтобы добавить {tool}, или перетащите, чтобы задать размер
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Перетащите прямоугольник на странице, чтобы обрезать её; двойной щелчок по странице — для «Задать поля страницы»
+	Keep tool selected: on	Оставлять инструмент выбранным: вкл
+	Keep tool selected	Оставлять инструмент выбранным
+	Opacity	Непрозрачность
+	Line thickness	Толщина линии
+	What word or phrase would you like to search for?	Какое слово или фразу вы хотите найти?
+	Searching… {s} of {p} pages	Поиск… {s} из {p} страниц
+	 (searching… {s} of {p} pages)	 (поиск… {s} из {p} страниц)
+	1 instance	1 вхождение
+	{n} instances	{n} вхождений
+	Go to this result	Перейти к этому результату
+	Highlight	Выделить
+	Draw	Рисовать
+	Polygon	Многоугольник
+	Connected lines	Соединённые линии
+	Eraser	Ластик
+	Sign	Подписать
+	Certified by {by}	Сертифицировано: {by}
+	At least one signature is invalid.	Хотя бы одна подпись недействительна.
+	Signed and all signatures are valid.	Подписано и все подписи действительны.
+	At least one signature has problems.	Хотя бы одна подпись имеет проблемы.
+	This document is secured. Some changes are restricted by its security settings.	Этот документ защищён. Некоторые изменения ограничены его настройками безопасности.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Это динамическая форма XFA, которую PdfCraft пока не может отобразить. То, что вы видите, — заглушка страницы файла.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Эта форма также содержит данные XFA, которые PdfCraft пока не читает. Вы можете заполнить её поля, но Acrobat может показать значения XFA вместо них.
+	This document contains {n} interactive form fields.	Этот документ содержит {n} интерактивных полей формы.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Этот файл был повреждён и восстановлен. Сохранение сохраняет восстановленную версию.
+	Dismiss	Закрыть
+	Hide field highlights	Скрыть выделение полей
+	Highlight fields	Выделять поля
+	Security settings	Настройки безопасности
+	Details	Подробности
+	Select (V)	Выделение (V)
+	Hand (H)	Рука (H)
+	Delete pages (Delete)	Удалить страницы (Delete)
+	Insert a blank page after the selection	Вставить пустую страницу после выделения
+	Insert pages from a file…	Вставить страницы из файла…
+	Extract pages to a new document	Извлечь страницы в новый документ
+	Split into files…	Разделить на файлы…
+	Select pages	Выделить страницы
+	Cut	Вырезать
+	Copy	Копировать
+	Paste after	Вставить после
+	Rename	Переименовать
+	Set to current page ({n})	Установить текущей страницей ({n})
+	Move up	Переместить вверх
+	Move down	Переместить вdownarrow
+	Indent	Отступ
+	Outdent	Убрать отступ
+	This document has no form fields.	В этом документе нет полей формы.
+	Tab order: move a field with its arrows.	Порядок табуляции: переместите поле с помощью стрелок.
+	Unplaced	Не размещено
+	Has JavaScript actions (run in M6)	Имеет действия JavaScript (выполняются в M6)
+	Page	Страница
+	None	Нет
+	Delete selected fields	Удалить выделенные поля
+	Diagnostic details	Диагностические подробности
+	The operation failed.	Операция не удалась.
+	no such document	нет такого документа
+	nothing to undo	нечего отменить
+	nothing to redo	нечего повторить
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	этот документ подписан: перезапись сделает его подписи недействительными (сохраняйте инкрементально)
+	the document is protected by a password	документ защищён паролем
+	the password is incorrect	пароль неверен
+	the document has no page tree	у документа нет дерева страниц
+	a document must keep at least one page	документ должен содержать хотя бы одну страницу
+	a bookmark cannot be moved inside itself	закладку нельзя переместить внутрь самой себя
+	the title must not be empty	название не должно быть пустым
+	the document has no form fields	в документе нет полей формы
+	there are no redaction marks to apply	нет меток сокрытия для применения
+	there are no pages to print	нет страниц для печати
+	the document has no tags	у документа нет тегов
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	модели распознавания текста не установлены (запустите `cargo xtask models` или задайте PRINTCRAFT_MODELS)
+	the image is empty	изображение пустое
+	this file isn't XFDF, FDF, XML or text form data	этот файл не является XFDF, FDF, XML или текстовыми данными формы
+	nothing in the file matches this document	ничего в файле не соответствует этому документу
+	This page couldn't be displayed.\n{e}	Не удалось отобразить эту страницу.\n{e}
+	Go to page {p}	Перейти на стр. {p}
+	{s} action	{s} действие
+	Page {p} of {n}	Стр. {p} из {n}
+	1 page selected	Выделена 1 страница
+	{n} pages selected	Выбрано {n} страницы
+	{name} — unsaved changes	{name} — несохранённые изменения
+	{kind} field	Поле: {kind}
+	Select a file for the stamp	Выберите файл для штампа
+	JavaScript, e.g. getField("total").value	JavaScript, например getField("total").value
+	Font: Helvetica	Шрифт: Helvetica
+	e.g. en-US	например, en-US
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Рендеринг: hayro (bootstrap) · UI: egui · Иконки: Lucide (ISC) · Шрифты: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	Флажок
+	Radio	Переключатель
+	PushButton	Кнопка
+	Combo	Комбинированный
+	List	Список
+	Unknown	Неизвестно
+	The document has no XMP metadata	У документа нет метаданных XMP
+	The title in the metadata and the document information differ	Название в метаданных и информация документа различаются
+	The document is encrypted	Документ зашифрован
+	Device colour is used, but there is no PDF/A output intent	Используется цвет устройства, но нет выходного намерения PDF/A
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	Используется DeviceCMYK: нужно выходное намерение CMYK (не добавляется автоматически)
+	The document has additional actions (/AA)	У документа есть дополнительные действия (/AA)
+	The document has document-level JavaScript	У документа есть JavaScript уровня документа
+	The form asks viewers to make appearances (NeedAppearances)	Форма просит зрителей создать внешний вид (NeedAppearances)
+	A form field has additional actions	У поля формы есть дополнительные действия
+	A stream uses LZW compression	Поток использует сжатие LZW
+	A stream refers to an external file	Поток ссылается на внешний файл
+	An image asks to be interpolated	Изображение просит интерполяции
+	An image has alternates or OPI information	У изображения есть альтернативы или информация OPI
+	PostScript XObjects aren't allowed	PostScript XObjects не разрешены
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	Встроенные файлы сами должны быть PDF/A (для других используйте PDF/A-3)
+	An embedded file has no AFRelationship	У встроенного файла нет AFRelationship
+	Select Icon	Выбрать значок
+	Choose images	Выбрать изображения
+	{dpi} pixels/inch	{dpi} пикселей/дюйм
+	Type your {what}.	Введите: {what}.
+	Draw your {what} below.	Нарисуйте: {what} ниже.
+	Your name	Ваше имя
+	Images and text (converted to PDF)	Изображения и текст (конвертированные в PDF)
+	Images and text	Изображения и текст
+	Check Box Style:	Стиль флажка:
+	Button Style:	Стиль кнопки:
+	Check	Галочка
+	Circle	Круг
+	Diamond	Ромб
+	Square	Квадрат
+	Star	Звезда
+	{month} {y}	{month} {y}
+	Change {key}	Изменить {key}
+	Insert pages from {name}	Вставить страницы из {name}
+	Fill in {name}	Заполнить {name}
+	Set the image of {name}	Задать изображение: {name}
+	Edit script of {name}	Редактировать скрипт: {name}
+	Import {name}	Импорт: {name}
+	Add bookmark	Добавить закладку
+	Rename bookmark	Переименовать закладку
+	Delete bookmark	Удалить закладку
+	Move bookmark	Переместить закладку
+	Set bookmark destination	Задать место назначения закладки
+	Add stamp	Добавить штамп
+	Delete comment	Удалить комментарий
+	Edit comment	Редактировать комментарий
+	Erase	Стереть
+	Lock comment	Заблокировать комментарий
+	Unlock comment	Разблокировать комментарий
+	Move comment	Переместить комментарий
+	Resize comment	Изменить размер комментария
+	Change comment properties	Изменить свойства комментария
+	Add field	Добавить поле
+	Change field properties	Изменить свойства поля
+	Delete field	Удалить поле
+	Duplicate field	Дублировать поле
+	Set tab order	Задать порядок табуляции
+	Change initial view	Изменить начальный вид
+	Set alternate text	Задать альтернативный текст
+	Mark figure as decorative	Пометить фигуру как декоративную
+	Run JavaScript	Запустить JavaScript
+	Delete document JavaScript	Удалить JavaScript документа
+	Edit document JavaScript	Редактировать JavaScript документа
+	Edit text	Редактировать текст
+	Move image	Переместить изображение
+	Rotate image	Повернуть изображение
+	Flip image	Отразить изображение
+	Delete image	Удалить изображение
+	Add header & footer	Добавить колонтитулы
+	Update header & footer	Обновить колонтитулы
+	Update watermark	Обновить водяной знак
+	Add background	Добавить фон
+	Update background	Обновить фон
+	Add image	Добавить изображение
+	Edit content	Редактировать содержимое
+	Delete content	Удалить содержимое
+	Remove redaction marks	Удалить метки сокрытия
+	Add link	Добавить ссылку
+	Change link properties	Изменить свойства ссылки
+	Delete link	Удалить ссылку
+	Create link	Создать ссылку
+	Flatten	Расплющить
+	Add sticky note	Добавить стикер
+	Add highlight	Добавить выделение
+	Add underline	Добавить подчеркивание
+	Add strikethrough	Добавить зачеркивание
+	Add squiggly underline	Добавить волнистое подчеркивание
+	Add rectangle	Добавить прямоугольник
+	Add oval	Добавить овал
+	Add arrow	Добавить стрелку
+	Add line	Добавить линию
+	Add drawing	Добавить рисунок
+	Add text box	Добавить текстовое поле
+	Add checkmark	Добавить галочку
+	Add cross	Добавить крестик
+	Add dot	Добавить точку
+	Add signature	Добавить подпись
+	Add redaction mark	Добавить метку сокрытия
+	Add cloud	Добавить облако
+	Add polygon	Добавить многоугольник
+	Add connected lines	Добавить соединенные линии
+	Add callout	Добавить выноску
+	Add inserted text	Добавить вставленный текст
+	Add file attachment	Добавить вложенный файл
+	Set status Accepted	Задать статус «Принято»
+	Set status Rejected	Задать статус «Отклонено»
+	Set status Cancelled	Задать статус «Отменено»
+	Set status Completed	Задать статус «Завершено»
+	Set status None	Задать статус «Нет»
+	Set status Unmarked	Задать статус «Не отмечено»
+	Save as PDF/A-1b	Сохранить как PDF/A-1b
+	Save as PDF/A-2b	Сохранить как PDF/A-2b
+	Save as PDF/A-3b	Сохранить как PDF/A-3b
+	Fill & Sign: change signature	Заполнить и подписать: изменить подпись
+	Fill & Sign: change initials	Заполнить и подписать: изменить инициалы
+	Fill & Sign: remove saved signature	Заполнить и подписать: удалить сохранённую подпись
+	Fill & Sign: remove saved initials	Заполнить и подписать: удалить сохранённые инициалы
+	Change signature	Изменить подпись
+	Change initials	Изменить инициалы
+	Measure distance	Измерить расстояние
+	Measure perimeter	Измерить периметр
+	Measure area	Измерить площадь
+	Set measurement scale	Задать масштаб измерения
+	Measurement information	Информация об измерениях
+	Measurement snapping	Привязка измерений
+	Export measurements as CSV	Экспортировать измерения в CSV
+	Distance	Расстояние
+	Perimeter	Периметр
+	Area	Площадь
+	Drawing scale	Масштаб чертежа
+	Snapping	Привязка
+	Export measurements	Экспортировать измерения
+	Open a PDF to measure it.	Откройте PDF для измерения.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Щёлкайте вершины. Enter или двойной щелчок завершает периметр или площадь. Щёлкните первую точку, чтобы замкнуть площадь.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift ограничивает до 45 градусов. Backspace удаляет вершину. Escape отменяет.
+	Angle	Угол
+	Click the first point to begin.	Щёлкните первую точку, чтобы начать.
+	Snap to drawing	Привязка к чертежу
+	Endpoints	Конечные точки
+	Midpoints	Середины отрезков
+	Intersections	Пересечения
+	Paths	Контуры
+	Sensitivity	Чувствительность
+	Unit	Единица
+	Decimals	Десятичные знаки
+	Calibrate from two points	Калибровать по двум точкам
+	Entire page	Вся страница
+	Viewport rectangle in page points (x, y, width, height)	Прямоугольник области просмотра в точках страницы (x, y, ширина, высота)
+	Viewport	Область просмотра
+	Apply scale	Применить масштаб
+	Saved measurements	Сохранённые измерения
+	Saved measurements.	Сохранённые измерения.
+	Endpoint	Конечная точка
+	Midpoint	Середина отрезка
+	Intersection	Пересечение
+	Path	Контур
+	This drawing exceeds the snapping limit; only the first paths are used.	Этот чертеж превышает предел привязки; используются только первые контуры.
+	Some page content couldn't be read; snapping uses the rest.	Некоторое содержимое страницы не удалось прочитать; привязка использует остальное.
+	Unsupported measurements	Неподдерживаемые измерения
+	Label	Метка
+	{n} measurements use an unsupported format and are left out.	{n} измерений используют неподдерживаемый формат и исключаются.
+	This area has too many overlapping paths; intersection snapping is limited.	В этой области слишком много перекрывающихся контуров; привязка к пересечениям ограничена.
+	This measurement needs at least {n} points.	Для этого измерения нужно не менее {n} точек.
+	Change {what}	Изменить: {what}
+	Cut and stack	Вырезать и наложить
+	Default workspace mode	Режим рабочей среды по умолчанию
+	Documents and view	Документы и вид
+	Open email app	Открыть почтовое приложение
+	Open link	Открыть ссылку
+	Open this web page?	Открыть эту веб-страницу?
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Скрипты выполняются в песочнице без доступа к файлам и сети. Скрипт, который просит открыть веб-страницу, сначала нуждается в вашем разрешении. При отключённом JavaScript стандартные функции Acrobat форматирования, проверки и вычислений всё равно работают.
+	Sign yourself	Подписать самим собой
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Распознавание текста не установлено: отсутствуют модели (запустите `cargo xtask models` или задайте PDFCRAFT_MODELS).
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Используется при открытии PDF. Явный запуск или режим управления имеет приоритет для сессии.
+	Write this email?	Написать это письмо?
+	{who} in this document wants to open this address in your browser:	{who} в этом документе хочет открыть этот адрес в вашем браузере:
+	{who} in this document wants to open your email app with this address:	{who} в этом документе хочет открыть ваше почтовое приложение с этим адресом:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Этот веб-адрес смешивает буквы из разных алфавитов, распространённый способ имитировать имя другого сайта.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Этот веб-адрес использует буквы из другого алфавита, которые могут выглядеть как знакомые.
+	Create PDF from images	Создать PDF из изображений
+	Selected image files: {count}	Выбраны файлы изображений: {count}
+	Use image resolution	Использовать разрешение изображения
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Использовать встроенное DPI каждого изображения; 72 DPI при его отсутствии.
+	Use 72 DPI (one point per pixel)	Использовать 72 DPI (одна точка на пиксель)
+	Use custom DPI	Использовать своё DPI
+	DPI sets the printed page size without resampling the image.	DPI задаёт размер печатной страницы без передискретизации изображения.
+	Create	Создать
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Динамическая форма XFA, сверстанная по шаблону: {pages}, {fields}.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Форма XFA: её поля и данные XFA синхронизированы, поэтому другие просмотрщики показывают то, что вы заполняете.
+	Switch to two-page view first to show the cover page	Сначала переключитесь в двухстраничный вид, чтобы показать титульную страницу
+	Page display: {layout}	Отображение страниц: {layout}
+	Fit to width scrolling	По ширине с прокруткой
+	Fit one full page	По одной полной странице
+	Default page display	Отображение страниц по умолчанию
+	Default zoom	Масштаб по умолчанию
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Используется, когда PDF не запрашивает макет или масштаб. Непрерывная прокрутка никогда не привязывается между страницами.
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Выберите изображение PNG или JPEG (до 4 МиБ). Прозрачность сохраняется.
+	Couldn't import the signature image: {e}	Не удалось импортировать изображение подписи: {e}
+
+@plural	{n} page|{n} pages	{n} страница|{n} страницы|{n} страниц
+@plural	{n} field|{n} fields	{n} поле|{n} поля|{n} полей
+	Create PDF from multiple files…	Создать PDF из нескольких файлов…
+	Optimizing… removing user data	Оптимизация… удаление пользовательских данных
+	Optimizing… image {d} of {t}	Оптимизация… изображение {d} из {t}
+	Optimizing… cleaning up	Оптимизация… очистка
+	Optimizing… merging identical objects	Оптимизация… объединение одинаковых объектов
+	Optimizing… writing the copy	Оптимизация… запись копии
+	Cancelling…	Отмена…
+	Created a PDF from {n} files	PDF создан из файлов: {n}
+	PDF, images and text	PDF, изображения и текст
+	Insert a file before page {label}	Вставить файл перед страницей {label}
+	Insert a file at the end	Вставить файл в конец
+	Save pages	Сохранить страницы
+	Save these pages as one PDF	Сохранить эти страницы в один PDF
+	No changes to save	Нет изменений для сохранения
+	Created a PDF from {n} files; left out: {names}	PDF создан из файлов: {n}; пропущены: {names}
+	Created a PDF from the first {n} files	PDF создан из первых файлов: {n}
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index 42c78e2a..60c3f3c2 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -162,11 +162,11 @@ fn ui_fonts_work_without_craft_fonts() {
     theme::install_fonts(&ctx);
 }
 
-/// Latin-script catalogs (Czech, Brazilian Portuguese, Spanish, French) are drawn entirely by the app's own faces
+/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, Spanish, French, Russian) are drawn entirely by the app's own faces
 /// (Inter, JetBrains Mono): no letter falls through to egui's defaults or a CJK fallback. (egui's
 /// `has_glyphs` can't answer this: with only the primary face it is also the replacement face.)
 #[test]
-fn primary_ui_fonts_cover_latin_catalogs() {
+fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
     use skrifa::MetadataProvider as _;
     let defs = theme::font_definitions();
     for (code, catalog) in [
@@ -174,6 +174,7 @@ fn primary_ui_fonts_cover_latin_catalogs() {
         ("pt-br", include_str!("../src/i18n/pt-br.tsv")),
         ("es", include_str!("../src/i18n/es.tsv")),
         ("fr", include_str!("../src/i18n/fr.tsv")),
+        ("ru", include_str!("../src/i18n/ru.tsv")),
     ] {
         let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜ¿¡«»…");
         for line in catalog.lines().filter(|l| !l.starts_with('#')) {
diff --git a/docs/localization.md b/docs/localization.md
index 61e0d4ea..d8cff091 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,6 +1,6 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Čeština**, **Português (Brasil)**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Čeština**, **Português (Brasil)**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
 **Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
@@ -10,11 +10,11 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `cs`, `pt-br`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `cs`, `pt-br`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Czech, Brazilian Portuguese, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
+Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Czech, Brazilian Portuguese, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 
 There is no right-to-left interface language yet. File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
 

From 3b8a274f529c707446819443138e65a84df55b2f Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 08:39:26 +0900
Subject: [PATCH 026/149] M2.6: non-embedded Japanese CID fonts draw in a
 craft-fonts face (#368)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#260 (page 2): text in a Japanese CID font that the PDF doesn't embed
(HeiseiMin-W3 with UniJIS-UCS2-H, Adobe-Japan1) drew nothing, while
MuPDF, Poppler, PDFium and Acrobat draw it in a Mincho face. hayro asks
its font resolver for a substitute with the CID collection in the
query, but the renderer never installed one, so hayro's default
answered with a Latin standard-14 font that has no Japanese glyphs.
Release builds have embedded Japanese faces from craft-fonts all along;
the renderer just didn't use them.

RenderConfig::settings now installs a resolver: for an Adobe-Japan1
fallback query it returns a craft-fonts face (Shippori Mincho for
Mincho names, BIZ UDPGothic Regular or Bold for Gothic names, the
descriptor's serif flag otherwise); every other query keeps hayro's
default. hayro already maps such fonts through the Adobe-Japan1-UCS2
CMap to Unicode and the face's cmap. Without craft-fonts nothing
changes. Other CJK collections are untouched: the pinned craft-fonts
has only Japanese faces, and its later Chinese face is Noto CJK, which
AGENTS.md §1.1 rules out. pdfcraft-render now depends on pdfcraft-fonts
(L3 to L2).

Tests: raster::tests::non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face
(with CRAFT_FONTS_DIR: 日本 in HeiseiMin-W3 and HeiseiKakuGo-W5 now
draws; it drew 0 dark pixels before; skips without craft-fonts, as the
Linux CI job has them) and raster::tests::japanese_font_names_pick_mincho_or_gothic.
The parity entry view.render-cid-fonts cites the test and notes what is
still missing.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                   |   1 +
 crates/render/Cargo.toml     |   1 +
 crates/render/src/raster.rs  | 111 ++++++++++++++++++++++++++++++++++-
 parity/acrobat-features.toml |   4 +-
 4 files changed, 114 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d34be389..10531cb1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3750,6 +3750,7 @@ dependencies = [
  "kurbo 0.13.1",
  "log",
  "lopdf",
+ "pdfcraft-fonts",
  "thiserror 2.0.21",
 ]
 
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index 49d10378..2a5b974d 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -9,6 +9,7 @@ license.workspace = true
 workspace = true
 
 [dependencies]
+pdfcraft-fonts = { workspace = true }
 hayro = { workspace = true }
 hayro-syntax = { workspace = true }
 lopdf = { workspace = true }
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 9f311e76..ea691bbe 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -14,6 +14,8 @@ use std::sync::{Arc, Mutex};
 use std::thread::JoinHandle;
 
 use hayro::hayro_interpret::InterpreterSettings;
+use hayro::hayro_interpret::font::{FontData, FontQuery};
+use hayro::hayro_interpret::hayro_cmap::CidFamily;
 use hayro::hayro_syntax::Pdf;
 use hayro::vello_cpu::color::palette::css::WHITE;
 use hayro::{RenderCache, RenderSettings, render};
@@ -50,7 +52,54 @@ pub struct RenderConfig {
 
 impl RenderConfig {
     fn settings(&self) -> InterpreterSettings {
-        InterpreterSettings { ocg_overrides: self.layers.clone(), hide_comments: self.hide_comments, ..InterpreterSettings::default() }
+        let standard = InterpreterSettings::default().font_resolver;
+        InterpreterSettings {
+            ocg_overrides: self.layers.clone(),
+            hide_comments: self.hide_comments,
+            font_resolver: Arc::new(move |query| japanese_fallback(query).or_else(|| standard(query))),
+            ..InterpreterSettings::default()
+        }
+    }
+}
+
+/// A Japanese face from craft-fonts for a CID font of the Adobe-Japan1 collection that the PDF
+/// doesn't embed (`HeiseiMin-W3`, `KozGoPro-Medium`, …). hayro's own substitutes for fonts that
+/// aren't embedded are the Latin standard 14, so such text drew nothing. `None` for every other
+/// font, and when PdfCraft was built without craft-fonts. Only Japanese: the pinned craft-fonts
+/// has no other CJK faces, and its later Chinese face is Noto CJK, which AGENTS.md §1.1 rules out.
+fn japanese_fallback(query: &FontQuery) -> Option<(FontData, u32)> {
+    let FontQuery::Fallback(f) = query else { return None };
+    if f.character_collection.as_ref()?.family != CidFamily::AdobeJapan1 {
+        return None;
+    }
+    let face = match japanese_face(f.post_script_name.as_deref().unwrap_or_default(), f.is_serif, f.is_bold || f.font_weight >= 600) {
+        JapaneseFace::Mincho => pdfcraft_fonts::document_japanese_font(),
+        JapaneseFace::Gothic { bold } => {
+            let faces = pdfcraft_fonts::ui_japanese_fonts();
+            let style = if bold { "Bold" } else { "Regular" };
+            faces.iter().find(|c| c.family == "BIZ UDPGothic" && c.style == style).or(faces.first()).copied()
+        }
+    }?;
+    Some((Arc::new(face.bytes), 0))
+}
+
+#[derive(Debug, PartialEq)]
+enum JapaneseFace {
+    Mincho,
+    Gothic { bold: bool },
+}
+
+/// Which kind of Japanese face stands in for the font named `name`: Mincho names (`HeiseiMin`,
+/// `KozMin`, `Ryumin`, `MS-Mincho`) a serif Mincho; Gothic names (`…Gothic…`, `HeiseiKakuGo`,
+/// `KozGo`, `…Maru…`) a sans Gothic; any other name by the font descriptor's serif flag.
+fn japanese_face(name: &str, serif: bool, bold: bool) -> JapaneseFace {
+    let name = name.to_ascii_lowercase();
+    if name.contains("min") {
+        JapaneseFace::Mincho
+    } else if ["goth", "kakugo", "kozgo", "kaku", "maru"].iter().any(|k| name.contains(k)) || !serif {
+        JapaneseFace::Gothic { bold }
+    } else {
+        JapaneseFace::Mincho
     }
 }
 
@@ -1459,6 +1508,66 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// A Japanese CID font that isn't embedded (Adobe-Japan1, as `HeiseiMin-W3` with
+    /// `UniJIS-UCS2-H` in #260's test file) drew nothing: hayro's substitutes for fonts that
+    /// aren't embedded are Latin-only. With craft-fonts (the build input release builds embed),
+    /// such text now draws in a Japanese face; without it, nothing changes.
+    #[test]
+    fn non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face() {
+        let pdf = |base_font: &str| {
+            let content = "BT /F1 40 Tf 5 15 Td <65E5672C> Tj ET";
+            format!(
+                "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /UniJIS-UCS2-H /DescendantFonts [6 0 R] >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 2 >>
+  /FontDescriptor 7 0 R /DW 1000 >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+                content.len()
+            )
+        };
+        for base_font in ["HeiseiMin-W3", "HeiseiKakuGo-W5"] {
+            let mut r = PageRenderer::new(Arc::new(pdf(base_font).into_bytes()), RenderConfig::default());
+            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 });
+            assert!(p.error.is_none(), "{base_font}: {:?}", p.error);
+            let inked = p.rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+            if pdfcraft_fonts::document_japanese_font().is_none() {
+                eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+                continue;
+            }
+            // 日本 at 40 pt covers a few hundred dark pixels; a blank or missing-glyph run doesn't.
+            assert!(inked > 300, "{base_font}: 日本 is drawn ({inked} dark pixels)");
+        }
+    }
+
+    #[test]
+    fn japanese_font_names_pick_mincho_or_gothic() {
+        use super::JapaneseFace::{Gothic, Mincho};
+        for (name, serif, bold, face) in [
+            ("HeiseiMin-W3", false, false, Mincho),
+            ("KozMinPro-Regular", false, false, Mincho),
+            ("Ryumin-Light", false, false, Mincho),
+            ("MS-PMincho", false, false, Mincho),
+            ("HiraMinProN-W3", false, false, Mincho),
+            ("HeiseiKakuGo-W5", true, false, Gothic { bold: false }),
+            ("KozGoPro-Bold", true, true, Gothic { bold: true }),
+            ("GothicBBB-Medium", true, false, Gothic { bold: false }),
+            ("MS-Gothic", false, false, Gothic { bold: false }),
+            ("HiraKakuProN-W6", false, true, Gothic { bold: true }),
+            ("Unknown-Japanese", true, false, Mincho),
+            ("Unknown-Japanese", false, false, Gothic { bold: false }),
+        ] {
+            assert_eq!(super::japanese_face(name, serif, bold), face, "{name}");
+        }
+    }
+
     /// An alpha soft mask whose transparency group has no /CS (as Chrome writes gradient text)
     /// must still mask. Regression test for the vendored hayro-interpret patch.
     #[test]
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index b765ac0c..5998819e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -746,8 +746,8 @@ milestone = "M2"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::huge_cid_width_ranges_terminate"]
-notes = "CID-to-Unicode tables are M2.4"
+evidence = ["crates/render/src/raster.rs::huge_cid_width_ranges_terminate", "crates/render/src/raster.rs::non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face"]
+notes = "CID-to-Unicode tables are M2.4; a non-embedded Adobe-Japan1 font is drawn in a craft-fonts Japanese face (Mincho or Gothic by name) when built with craft-fonts; non-embedded GB1, CNS1 and Korea1 fonts still draw nothing (no allowed face)"
 
 [[feature]]
 id = "view.render-image-codecs"

From 07b95409bff78ad8607d085a26cb6dfdeb2ca50a Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 08:43:58 +0900
Subject: [PATCH 027/149] Comments without an appearance stream are drawn
 (display only, never saved) (#371)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M5: comments without an appearance stream are drawn (display only, never saved)

#260 (page 7): a FreeText box with /DA and an orange /C background, a
Text note and an Ink stroke, all without /AP, were not drawn; Acrobat,
MuPDF, PDFium and Poppler draw them. The renderer only draws /AP (plus
the Highlight fallback of #274), and pdfcraft-annot, which already
draws all of these for PdfCraft's own comments, can't be used from the
renderer (both are L3).

pdfcraft_annot::with_missing_appearances returns a copy of the document
in which every annotation without /AP /N that appearance::build can
draw (FreeText, Ink, Text, FileAttachment, stamps, shapes, lines,
markup, …) has the appearance build draws from its dictionary; links,
form fields and pop-ups are left alone, as is anything build declines.
The engine keeps that copy, written as an in-memory incremental update,
in a new Document::display: the page view's render pool, page_render
and page images (export_source) read it. Document::bytes, what Save,
signatures and the inspector use, is unchanged. display is rebuilt
wherever the renderer was (open, refresh, scoped refresh) and is bytes
itself when nothing is missing or the document can't be edited.

Tests: annot tests::comments_without_appearances_get_one_for_display_only
(FreeText, Ink and Text get /AP /N in the copy, an existing /AP is kept,
Link, Widget and an unknown subtype aren't touched, the original is
untouched, none means no copy) and engine
tests::comments_without_appearances_are_drawn_but_not_saved (the page
view draws the FreeText background and the Ink stroke, before and after
an edit; the working bytes stay the opened file; Save writes no /AP).
On main the page view shows white where the FreeText box is. Parity:
view.render-annotation-appearances cites the test and notes what's left
(Link borders without /AP, printing).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Test the Ink stroke on its apex row: Ink is now a curve through its points (#374)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/annot/src/lib.rs      | 24 +++++++++++++
 crates/annot/src/tests.rs    | 56 ++++++++++++++++++++++++++++++
 crates/automation/src/lib.rs |  4 +--
 crates/engine/src/export.rs  |  2 +-
 crates/engine/src/lib.rs     | 32 ++++++++++++-----
 crates/engine/src/tests.rs   | 66 ++++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml |  4 +--
 7 files changed, 175 insertions(+), 13 deletions(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index b570c0e7..2abfdce5 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -1094,6 +1094,30 @@ pub fn set_appearance(doc: &mut Document, r: ObjRef) -> Result<(), AnnotError> {
     Ok(())
 }
 
+/// A copy of `doc` in which every annotation without a normal appearance (`/AP /N`) has the one
+/// [`appearance::build`] draws from its dictionary, for displaying the document (`None` when no
+/// annotation needs one). Many files carry comments without appearances (FreeText, Ink, notes,
+/// stamps, …) that viewers draw from the dictionary. `doc` is not changed: saving writes the file
+/// as it was. Links, form fields and pop-ups keep their own handling.
+pub fn with_missing_appearances(doc: &Document) -> Option<Document> {
+    let mut copy: Option<Document> = None;
+    for page in page_refs(doc).ok()? {
+        for r in annots(doc, page).iter().filter_map(Object::as_ref) {
+            let d = annot_dict(doc, r);
+            if matches!(d.name(b"Subtype"), None | Some(b"Link" | b"Widget" | b"Popup")) {
+                continue;
+            }
+            let has_normal = d.get(b"AP").is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N")));
+            if has_normal || appearance::build(&d).is_none() {
+                continue;
+            }
+            // Fails only when `r` isn't a dictionary, which `build` above has just ruled out.
+            set_appearance(copy.get_or_insert_with(|| doc.clone()), r).ok();
+        }
+    }
+    copy
+}
+
 /// Format a number for content streams and DA strings.
 pub(crate) fn n(v: f64) -> String {
     let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index 55541988..3664e7ca 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -679,3 +679,59 @@ fn the_eraser_cuts_strokes_and_removes_empty_drawings() {
     erase_ink(&mut doc, 0, i, &all[21..], 8.0, &meta("e")).unwrap();
     assert!(!list(&doc, 0).iter().any(|d| d.name(b"Subtype") == Some(b"Ink")));
 }
+
+/// A one-page document from object bodies (object 1 is the catalog, 3 the page).
+fn document_of(objs: &[&[u8]]) -> Document {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).expect("opens")
+}
+
+#[test]
+fn comments_without_appearances_get_one_for_display_only() {
+    let doc = document_of(&[
+        b"<< /Type /Catalog /Pages 2 0 R >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>",
+        b"<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R] >>",
+        b"<< /Type /Annot /Subtype /FreeText /Rect [48 582 285 632] /Contents (FreeText annotation with valid /DA string.) /DA (/Helv 10 Tf 0 0 1 rg) /Border [0 0 1] /C [.85 .47 .02] >>",
+        b"<< /Type /Annot /Subtype /Ink /Rect [70 392 275 472] /InkList [[80 402 120 452 160 412 210 462 260 417]] /Border [0 0 2] /C [.49 .18 .07] >>",
+        b"<< /Type /Annot /Subtype /Text /Rect [400 717 420 737] /C [1 1 0] /Contents (A note) >>",
+        b"<< /Type /Annot /Subtype /Square /Rect [10 10 50 50] /C [1 0 0] /AP << /N 11 0 R >> >>",
+        b"<< /Type /Annot /Subtype /Link /Rect [48 717 308 741] /Border [0 0 1] /C [0 0 1] >>",
+        b"<< /Type /Annot /Subtype /Widget /FT /Tx /T (f) /Rect [10 100 100 120] >>",
+        b"<< /Type /Annot /Subtype /Sound /Rect [10 200 30 220] >>",
+        b"<< /Type /XObject /Subtype /Form /BBox [10 10 50 50] /Length 0 >>\nstream\n\nendstream",
+    ]);
+    let display = with_missing_appearances(&doc).expect("three comments need an appearance");
+    let has_ap = |doc: &Document| list(doc, 0).iter().map(|d| d.get(b"AP").is_some()).collect::<Vec<_>>();
+    assert_eq!(has_ap(&doc), [false, false, false, true, false, false, false], "the document itself is untouched");
+    assert_eq!(has_ap(&display), [true, true, true, true, false, false, false], "FreeText, Ink and Text get one; the rest don't");
+    let shown = list(&display, 0);
+    let free_text = ap_content(&display, &shown[0]);
+    assert!(free_text.contains("re f") && free_text.contains("Tj"), "background box and text: {free_text}");
+    assert_eq!(shown[3].get(b"AP"), list(&doc, 0)[3].get(b"AP"), "an existing appearance is kept");
+    // The display copy survives a save and reopen (what the renderer reads).
+    assert_eq!(has_ap(&reopen(&display)), [true, true, true, true, false, false, false]);
+    // Nothing to add: no copy.
+    let complete = document_of(&[
+        b"<< /Type /Catalog /Pages 2 0 R >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>",
+        b"<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >>",
+        b"<< /Type /Annot /Subtype /Link /Rect [48 717 308 741] >>",
+        b"<< /Type /Annot /Subtype /Square /Rect [10 10 50 50] /C [1 0 0] /AP << /N 6 0 R >> >>",
+        b"<< /Type /XObject /Subtype /Form /BBox [10 10 50 50] /Length 0 >>\nstream\n\nendstream",
+    ]);
+    assert!(with_missing_appearances(&complete).is_none());
+}
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 9ddff4bf..bda8922c 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -1343,10 +1343,10 @@ impl Automation {
         let doc = self.session.get(id).ok_or_else(|| failed("no such document"))?;
         let fresh = || {
             let config = RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() };
-            (doc.bytes.clone(), PageRenderer::new(doc.bytes.clone(), config))
+            (doc.display.clone(), PageRenderer::new(doc.display.clone(), config))
         };
         let entry = self.renderers.entry(id).or_insert_with(fresh);
-        if !Arc::ptr_eq(&entry.0, &doc.bytes) {
+        if !Arc::ptr_eq(&entry.0, &doc.display) {
             *entry = fresh();
         }
         Ok(&mut entry.1)
diff --git a/crates/engine/src/export.rs b/crates/engine/src/export.rs
index ca90c009..5360531a 100644
--- a/crates/engine/src/export.rs
+++ b/crates/engine/src/export.rs
@@ -25,7 +25,7 @@ pub struct ExportSource {
 impl Document {
     /// The current state, for exporting on another thread.
     pub fn export_source(&self) -> ExportSource {
-        ExportSource { bytes: self.bytes.clone(), config: self.config.clone(), pages: self.info.pages.len() }
+        ExportSource { bytes: self.display.clone(), config: self.config.clone(), pages: self.info.pages.len() }
     }
 }
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 68de16b0..2dca9559 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -194,8 +194,11 @@ pub struct Document {
     pub id: DocId,
     pub name: String,
     pub path: Option<String>,
-    /// The working file: what Save writes and what is displayed.
+    /// The working file: what Save writes.
     pub bytes: Arc<Vec<u8>>,
+    /// What is displayed (the page view, `page_render`, page images): `bytes`, plus appearances
+    /// drawn for display only for comments that have none ([`display_bytes`]). Never saved.
+    pub display: Arc<Vec<u8>>,
     pub info: DocInfo,
     pub renderer: RenderPool,
     /// The password the document was opened with (needed to read attachments, etc.).
@@ -474,6 +477,15 @@ impl Document {
     }
 }
 
+/// What is displayed: the working file, plus (in memory only, never saved) the appearances
+/// PdfCraft draws for comments that have none ([`pdfcraft_annot::with_missing_appearances`]).
+/// The working file is unchanged, and so is everything that reads it (saving, signatures, …).
+fn display_bytes(editor: Option<&Editor>, bytes: &Arc<Vec<u8>>) -> Arc<Vec<u8>> {
+    let Some(display) = editor.and_then(|e| pdfcraft_annot::with_missing_appearances(&e.cos)) else { return bytes.clone() };
+    // Writing fails only as saving the document would; the page then shows as it always did.
+    write_incremental(&display, &SaveOptions::default()).map(Arc::new).unwrap_or_else(|_| bytes.clone())
+}
+
 fn render_threads() -> usize {
     std::thread::available_parallelism().map(|n| n.get()).unwrap_or(4).clamp(2, 8) - 1
 }
@@ -482,7 +494,7 @@ fn render_threads() -> usize {
 fn use_layer_choices(doc: &mut Document) {
     let overrides: Vec<(i32, i32, bool)> = doc.info.layers.iter().map(|l| (l.id.0 as i32, l.id.1 as i32, l.visible)).collect();
     doc.config.layers = Arc::new(overrides);
-    doc.renderer = RenderPool::new(doc.bytes.clone(), render_threads(), doc.config.clone());
+    doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
 }
 
 /// Apply a set-layer-visibility action to `layers`, one change at a time, so a toggle flips the
@@ -2171,7 +2183,6 @@ impl Session {
         xfa: Option<XfaLayout>,
     ) -> Result<DocId, OpenError> {
         let config = RenderConfig { password: render_password.as_deref().map(Arc::from), ..Default::default() };
-        let renderer = RenderPool::new(bytes.clone(), render_threads(), config.clone());
         let (editor, read_only_reason) = match cos {
             Ok(Ok(cos)) => {
                 let keys = Keys { render: render_password.clone(), reopen: password.map(str::to_owned) };
@@ -2180,6 +2191,8 @@ impl Session {
             Ok(Err(e)) => (None, Some(e.to_string())),
             Err(_) => (None, Some("the document structure could not be read for editing".into())),
         };
+        let display = display_bytes(editor.as_ref(), &bytes);
+        let renderer = RenderPool::new(display.clone(), render_threads(), config.clone());
         let mut form = editor.as_ref().map(|e| pdfcraft_forms::fields(&e.cos)).unwrap_or_default();
         if let Some(e) = editor.as_ref() {
             xfa::mark_script_buttons(&e.cos, &mut form);
@@ -2196,6 +2209,7 @@ impl Session {
             name,
             path,
             bytes,
+            display,
             info,
             renderer,
             password: render_password,
@@ -2414,8 +2428,9 @@ impl Session {
         if !doc.signatures.is_empty() {
             doc.signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
         }
-        doc.bytes = bytes.clone();
-        doc.renderer = RenderPool::new(bytes, render_threads(), doc.config.clone());
+        doc.display = display_bytes(Some(editor), &bytes);
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.bytes = bytes;
         Ok(())
     }
 
@@ -2450,8 +2465,9 @@ impl Session {
         doc.added = pdfcraft_edit::list_added(&editor.cos);
         doc.links = pdfcraft_annot::links::list(&editor.cos);
         doc.signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
-        doc.bytes = bytes.clone();
-        doc.renderer = RenderPool::new(bytes, render_threads(), doc.config.clone());
+        doc.display = display_bytes(Some(editor), &bytes);
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.bytes = bytes;
         Ok(())
     }
 
@@ -2839,7 +2855,7 @@ impl Session {
             return false;
         }
         doc.config.hide_comments = hide;
-        doc.renderer = RenderPool::new(doc.bytes.clone(), render_threads(), doc.config.clone());
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
         doc.generation += 1;
         true
     }
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 6a03dc54..a5815229 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -2042,3 +2042,69 @@ fn runaway_xfa_calculations_at_open_end_quickly_with_a_report() {
     assert!(started.elapsed() < std::time::Duration::from_secs(2));
     assert!(s.take_js_output(id).errors.is_empty());
 }
+
+/// The page view's raster of `page` at 1 px/pt (the document's own render pool).
+fn shown(s: &Session, id: DocId, page: usize) -> pdfcraft_render::RenderedPage {
+    let doc = s.get(id).unwrap();
+    doc.renderer.set_queue(vec![pdfcraft_render::RenderRequest { page, scale: 1.0, ..Default::default() }]);
+    let start = std::time::Instant::now();
+    loop {
+        if let Some(p) = doc.renderer.try_recv() {
+            assert!(p.error.is_none(), "{:?}", p.error);
+            return p;
+        }
+        assert!(start.elapsed() < std::time::Duration::from_secs(20), "no render");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+}
+
+/// #260 (page 7): comments without an appearance stream, here a FreeText box (`/C` background,
+/// blue `/DA` text) and an Ink stroke, weren't drawn. The page view now draws them from
+/// appearances made for display only; the working file and what Save writes stay as they were.
+#[test]
+fn comments_without_appearances_are_drawn_but_not_saved() {
+    let objs: Vec<&[u8]> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
+        b"<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >>",
+        b"<< /Type /Annot /Subtype /FreeText /Rect [20 200 180 260] /Contents (Box) /DA (/Helv 10 Tf 0 0 1 rg) /Border [0 0 1] /C [.85 .47 .02] >>",
+        b"<< /Type /Annot /Subtype /Ink /Rect [20 20 180 120] /InkList [[30 30 100 110 170 30]] /Border [0 0 4] /C [0 .6 0] >>",
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        bytes.extend_from_slice(o);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let original = Arc::new(bytes);
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("comments.pdf", None, original.clone(), None).expect("opens");
+    let check = |s: &Session| {
+        let p = shown(s, id, 0);
+        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+        // y down: the FreeText box spans rows 40..100, the Ink apex is at (100, 190).
+        assert_eq!(px(100, 90), vec![217, 120, 5, 255], "the FreeText background");
+        // On the apex row: Ink is drawn as a curve through its points (#374), level at the apex.
+        assert_eq!(px(100, 190), vec![0, 153, 0, 255], "the Ink stroke");
+    };
+    check(&s);
+    let doc = s.get(id).unwrap();
+    assert!(Arc::ptr_eq(&doc.bytes, &original), "the working file is the file as opened");
+    assert!(!Arc::ptr_eq(&doc.display, &doc.bytes) && Arc::ptr_eq(&doc.export_source().bytes, &doc.display), "page images show it too");
+    // After an edit (a scoped refresh) they are still drawn, and Save writes no appearances.
+    s.apply(id, rect_comment(0, [150.0, 270.0, 190.0, 290.0])).unwrap();
+    check(&s);
+    let saved = s.save_bytes(id).unwrap();
+    let reopened = pdfcraft_cos::Document::open(saved).unwrap();
+    for r in [pdfcraft_cos::ObjRef::new(4, 0), pdfcraft_cos::ObjRef::new(5, 0)] {
+        assert!(reopened.get(r).as_dict().is_some_and(|d| !d.contains(b"AP")), "{r:?} is saved without /AP");
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 5998819e..c790b121 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -770,8 +770,8 @@ milestone = "M2"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::widget_appearance_states", "crates/render/src/raster.rs::highlights_without_an_appearance_are_drawn"]
-notes = "a Highlight without /AP is drawn from /QuadPoints, /C and /CA; other comment types without /AP are not drawn yet"
+evidence = ["crates/render/src/raster.rs::widget_appearance_states", "crates/render/src/raster.rs::highlights_without_an_appearance_are_drawn", "crates/engine/src/tests.rs::comments_without_appearances_are_drawn_but_not_saved"]
+notes = "comments without /AP (FreeText, Ink, notes, stamps, shapes, markup) are drawn from their dictionaries in the page view, page_render and page images, never saved (a read-only document still gets the renderer's Highlight fallback only); Link borders without /AP and printing are not covered yet"
 
 [[feature]]
 id = "view.render-error-isolation"

From 31f36318688e60c98a863b1252168985456d3df1 Mon Sep 17 00:00:00 2001
From: Amitabh Thakur <amitabhthakur@users.noreply.github.com>
Date: Fri, 9 Oct 2026 01:59:24 +0200
Subject: [PATCH 028/149] Home: pin folders and list their newest PDFs (#383)

* Home: pin folders and list their newest PDFs

File > Pin folder to Home... (or "Pin a folder..." on Home) pins up to 8
folders. Each lists its newest PDFs with how long ago and size, opens one
with a click, and can be unpinned. Folders are read on a worker thread and
listed again every few seconds while Home shows, so new scans appear by
themselves; an unreadable folder (moved, offline synced drive) stays pinned
and says so. A folder is described by where it is ("iCloud Drive",
"OneDrive - Contoso", "Documents > Work") instead of its full path.

Cloud drives work through their local synced folder; nothing goes through a
provider API. Settings keep absolute paths only, deduplicated and capped.

Tests: crates/ui-egui/tests/folders.rs (8) and folders_ui unit tests (4).
Command label translated in every catalog; Home strings in fr, es, ja,
zh-hans and zh-hant; catalog hashes updated in ATTRIBUTION.toml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Add my contributor name (amitabhthakur)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Home pinned folders: Russian strings; regenerate ATTRIBUTION.md

The Russian catalog (#375) landed while this branch was open: its coverage
tests need the new command label and Home strings. ATTRIBUTION.md is
regenerated (cargo xtask assets --write), which also adds the ru.tsv row
that #375 left out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.md                      |   3 +-
 ATTRIBUTION.toml                    |  18 +-
 ROADMAP.md                          |   2 +
 contributors/people.toml            |   3 +
 crates/engine/src/commands.rs       |   1 +
 crates/ui-egui/src/combine_ui.rs    |   2 +-
 crates/ui-egui/src/commands.rs      |   1 +
 crates/ui-egui/src/folders_ui.rs    | 476 ++++++++++++++++++++++++++++
 crates/ui-egui/src/home.rs          |   9 +-
 crates/ui-egui/src/i18n/cs.tsv      |   1 +
 crates/ui-egui/src/i18n/es.tsv      |  18 ++
 crates/ui-egui/src/i18n/fr.tsv      |  18 ++
 crates/ui-egui/src/i18n/ja.tsv      |  18 ++
 crates/ui-egui/src/i18n/pt-br.tsv   |   1 +
 crates/ui-egui/src/i18n/ru.tsv      |  18 ++
 crates/ui-egui/src/i18n/te.tsv      |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv |  18 ++
 crates/ui-egui/src/i18n/zh-hant.tsv |  18 ++
 crates/ui-egui/src/lib.rs           |   8 +-
 crates/ui-egui/tests/folders.rs     | 210 ++++++++++++
 parity/acrobat-features.toml        |   8 +-
 21 files changed, 835 insertions(+), 17 deletions(-)
 create mode 100644 crates/ui-egui/src/folders_ui.rs
 create mode 100644 crates/ui-egui/tests/folders.rs

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 1f0283e0..0f56341b 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (250)
+## In this repository (251)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -15,6 +15,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/es.tsv` | Spanish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/fr.tsv` | French interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/ru.tsv` | Russian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ja.tsv` | Japanese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 64fc7a96..5b7db4b3 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b2afa2c39b397f44feed8aa3ebbaf8103c8d69c8e75a9671e01cf08140c85a4b"
+sha256 = "741e71280fc40ccf711fd8c2d7cf9ad66ceb4305827b2a82b462c2a27af25d92"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6d61957b3b6208ceb5d313638c610e81eca6ee186a4fe03ece08b4f87f39fd0c"
+sha256 = "7e64066dd8d5a872899a1bd19916ee4b3a57effffe54a55d6e0a5777798fc97d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6accf0a44ae93cab6fde939458c0dd651687ce36760270bd3646b94668db1cda"
+sha256 = "1facd561cbfbfa4f2cc81c783f4ed7675871a3d63724e8b2c0fb9e29550ea4f3"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "56159c856872ae5a6a521b02cf6dc682702ece1dff27a8cee0bd5fad24d3e627"
+sha256 = "c041497ad777eb4616a204a2fbe78c6bfc38150632450d83d8498f1c573b74eb"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "47ea331f7cf88a7e8584d358999d03af8b4250904a40d450f3d23bb151ce5c78"
+sha256 = "e7c4d57500dea64165fe9a356bab10ed1e288bf3a8b1d6ab8377ee642e0fd109"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "a4f02e370ce90fc5917915ebaa79ffe82a679e5e2b25087b7a6646430de1e457"
+sha256 = "4a8508d6fd385dff2d9214e41719824639c0608e5807c46d32ad2933e679f6e1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f862797c038b3c5e2d91d387356ebe2b38d90a0e25f4a2154ae73182af575f59"
+sha256 = "b2a4bb2fc0eb247cada87f14c8186abf72cd36b7269d173503fcb65383a9439e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3c5adb79844f784648b3d6bb0056026d498a683ac67b0746df118b1faaf69aa1"
+sha256 = "d9419953763bcb55a017196d72d28e8e47eb5e9197fd508e348bc047fcb433db"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "38eae66397d61c9ed13bef9c393f612df08936b3ac066a3e8af3a6aea36d7b5e"
+sha256 = "f8af4c1a71747533dc4b609c495c19c47f9ad6aefe1f470dfcb6440a43f3e55f"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index 34478b73..e61995ad 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -136,6 +136,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (community, Home pinned folders):** Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (community, M14, Telugu):** Telugu (తెలుగు, `te`) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; `te` and `te_IN` locales follow it. Telugu text is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (M14, Simplified Chinese About):** The About tabs, contributor controls and statistics, and model table now have Simplified Chinese translations, along with multiline link-privacy and cut-and-stack guidance. Coverage checks include direct `i18n::t` calls, multiline literals and dynamic credit labels; UI control checks exercise the translated About tabs and tables. Chinese font delivery remains incomplete; overall ≈ 30–35% (unchanged).
diff --git a/contributors/people.toml b/contributors/people.toml
index b3fb1e04..00beb658 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -56,3 +56,6 @@ sync_github_name = false
 real_name = "Chester Fung"
 display_name = "Chester Fung"
 sync_github_name = true
+
+[people.amitabhthakur]
+sync_github_name = true
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 331652e4..e94691a7 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -150,6 +150,7 @@ const HELP: Option<&str> = Some("Help");
 pub const COMMANDS: &[CommandSpec] = &[
     c("file.open", "Open…", FILE, Some(Shortcut::cmd("O")), Nothing, "folder-open"),
     c("file.open_recent", "Open Recent", FILE, None, Nothing, "clock"),
+    c("file.pin_folder", "Pin folder to Home…", FILE, None, Nothing, "folder-plus"),
     c("create.blank", "New blank PDF", FILE, None, Nothing, "file-plus-2"),
     c("measure.distance", "Measure distance", None, None, Annotate, "ruler"),
     c("measure.perimeter", "Measure perimeter", None, None, Annotate, "ruler"),
diff --git a/crates/ui-egui/src/combine_ui.rs b/crates/ui-egui/src/combine_ui.rs
index 780d3c5e..0fd087cd 100644
--- a/crates/ui-egui/src/combine_ui.rs
+++ b/crates/ui-egui/src/combine_ui.rs
@@ -1102,7 +1102,7 @@ fn grip(ui: &egui::Ui, rect: Rect, colour: Color32) {
 }
 
 /// How long ago `time` was ("5 min ago"); a date after a week. Relative times need no time zone.
-fn ago(time: SystemTime) -> String {
+pub(crate) fn ago(time: SystemTime) -> String {
     let secs = SystemTime::now().duration_since(time).map(|d| d.as_secs()).unwrap_or(0);
     let (mins, hours, days) = (secs / 60, secs / 3600, secs / 86_400);
     match () {
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 86d3a74c..b3a86651 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -85,6 +85,7 @@ impl PdfCraftApp {
                 Some(p) => self.open_recent(&p),
                 None => self.notify_tr("No recent files"),
             },
+            "file.pin_folder" => self.pin_folder_dialog(),
             "page.combine" => self.open_combine_tab(),
             "file.save" => {
                 self.save_active(SaveTarget::InPlace);
diff --git a/crates/ui-egui/src/folders_ui.rs b/crates/ui-egui/src/folders_ui.rs
new file mode 100644
index 00000000..f5cd90b5
--- /dev/null
+++ b/crates/ui-egui/src/folders_ui.rs
@@ -0,0 +1,476 @@
+//! Pinned folders on the Home view: the newest PDFs in folders the user chose (where a scanner
+//! saves, or a cloud-synced folder such as iCloud Drive, OneDrive or Dropbox), one click away.
+//!
+//! Local only: a pinned folder is read through the file system like any other path, never
+//! through a storage provider's API, and nothing about it leaves the machine. Folders are
+//! listed on a worker thread and at most every few seconds while Home shows, so a slow, huge or
+//! offline synced folder never blocks the frame.
+
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::SystemTime;
+
+use crate::PdfCraftApp;
+
+/// At most this many folders can be pinned.
+pub const MAX_PINNED: usize = 8;
+/// Home shows this many of a folder's newest PDFs until "Show more" is clicked.
+pub const SHOWN: usize = 8;
+/// A folder's listing keeps at most this many PDFs (its newest).
+pub const MAX_LISTED: usize = 100;
+/// Directory entries read per folder, so a huge folder can't stall the scan.
+const MAX_ENTRIES: usize = 20_000;
+/// While Home shows, the folders are listed again at most this often (seconds).
+const RESCAN_SECS: f64 = 5.0;
+/// Longest folder path accepted, from the picker or from settings.
+const MAX_PATH_CHARS: usize = 4096;
+
+/// A PDF in a pinned folder.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct FolderFile {
+    pub name: String,
+    pub path: String,
+    pub size: u64,
+    pub modified: Option<SystemTime>,
+}
+
+/// What a pinned folder held when it was last listed.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct FolderListing {
+    pub folder: String,
+    /// Newest first (files without a modified time last), at most [`MAX_LISTED`].
+    pub files: Vec<FolderFile>,
+    /// How many PDFs the folder holds; can be more than `files.len()`.
+    pub total: usize,
+    /// The folder couldn't be read: moved or deleted, no permission, or its drive or cloud sync
+    /// is offline. It stays pinned and is listed again later.
+    pub unavailable: bool,
+}
+
+/// The pinned folders and their latest listings.
+#[derive(Debug, Default)]
+pub struct PinnedFolders {
+    /// Absolute paths, in the order they were pinned.
+    pub folders: Vec<String>,
+    /// The latest finished listing of each folder.
+    pub listings: Vec<FolderListing>,
+    /// Folders whose "Show more" is open.
+    pub expanded: Vec<String>,
+    /// A listing in progress: the worker fills the slot.
+    scan: Option<Arc<Mutex<Option<Vec<FolderListing>>>>>,
+    /// When (egui time) the last listing started.
+    last_scan: Option<f64>,
+    /// The folders changed since the last listing started: list them on the next frame.
+    stale: bool,
+}
+
+impl PinnedFolders {
+    /// The latest listing of `folder`, if one has finished since it was pinned.
+    pub fn listing(&self, folder: &str) -> Option<&FolderListing> {
+        self.listings.iter().find(|l| l.folder == folder)
+    }
+
+    /// Restore pinned folders from settings: absolute paths only, without duplicates, at most
+    /// [`MAX_PINNED`]. Settings are untrusted, so anything else is ignored. A folder that is
+    /// missing right now is kept (a synced drive may be offline) and shown as unavailable.
+    pub(crate) fn restore(&mut self, value: &serde_json::Value) {
+        let Some(items) = value.as_array() else { return };
+        let mut folders = Vec::new();
+        for folder in items.iter().filter_map(serde_json::Value::as_str).filter_map(clean) {
+            if folders.len() >= MAX_PINNED {
+                break;
+            }
+            if !folders.contains(&folder) {
+                folders.push(folder);
+            }
+        }
+        self.folders = folders;
+        self.listings.clear();
+        self.expanded.clear();
+        self.stale = true;
+    }
+}
+
+/// `path` as a folder to pin: trimmed, without a trailing separator, and absolute; `None` if it
+/// can't be one.
+fn clean(path: &str) -> Option<String> {
+    let path = path.trim();
+    if path.is_empty() || path.chars().count() > MAX_PATH_CHARS || path.contains('\0') {
+        return None;
+    }
+    let trimmed = path.trim_end_matches(['/', '\\']);
+    // The file system root ("/") keeps its separator, as does a Windows drive root ("C:\").
+    let path = if trimmed.is_empty() || trimmed.ends_with(':') { path } else { trimmed };
+    std::path::Path::new(path).is_absolute().then(|| path.to_string())
+}
+
+/// The PDFs directly inside `folder` (not its subfolders, and not hidden files), newest first.
+pub fn list(folder: &str) -> FolderListing {
+    let mut files = Vec::new();
+    let Ok(entries) = std::fs::read_dir(folder) else {
+        return FolderListing { folder: folder.to_string(), files, total: 0, unavailable: true };
+    };
+    for entry in entries.flatten().take(MAX_ENTRIES) {
+        let name = entry.file_name().to_string_lossy().into_owned();
+        let path = entry.path();
+        if name.starts_with('.') || !path.extension().is_some_and(|e| e.eq_ignore_ascii_case("pdf")) {
+            continue;
+        }
+        // Follows links, like opening the file does.
+        let Ok(meta) = std::fs::metadata(&path) else { continue };
+        if meta.is_file() {
+            files.push(FolderFile { name, path: path.to_string_lossy().into_owned(), size: meta.len(), modified: meta.modified().ok() });
+        }
+    }
+    let total = files.len();
+    // Newest first; `None` sorts before any time, so files without one come last.
+    files.sort_by(|a, b| b.modified.cmp(&a.modified).then_with(|| a.name.cmp(&b.name)));
+    files.truncate(MAX_LISTED);
+    FolderListing { folder: folder.to_string(), files, total, unavailable: false }
+}
+
+/// The last part of `folder`'s path, for headings and messages.
+pub fn folder_name(folder: &str) -> String {
+    std::path::Path::new(folder).file_name().map_or_else(|| folder.to_string(), |n| n.to_string_lossy().into_owned())
+}
+
+/// Where `folder` is, in words, so two folders with the same name can be told apart without a
+/// long path: "iCloud Drive", "OneDrive · Contoso", "Documents › Work", or the parent path with
+/// the home folder as "~". The full path is shown on hover.
+pub fn location(folder: &str) -> String {
+    let home = std::env::var_os(if cfg!(windows) { "USERPROFILE" } else { "HOME" }).map(std::path::PathBuf::from);
+    location_in(folder, home.as_deref())
+}
+
+/// [`location`] with the home folder given (tests).
+pub fn location_in(folder: &str, home: Option<&std::path::Path>) -> String {
+    use std::path::Path;
+    let parent = Path::new(folder).parent().unwrap_or_else(|| Path::new(folder));
+    let Some(rel) = home.and_then(|h| parent.strip_prefix(h).ok()) else {
+        return parent.to_string_lossy().into_owned();
+    };
+    let parts: Vec<String> = rel.components().map(|c| c.as_os_str().to_string_lossy().into_owned()).collect();
+    let (place, rest) = match parts.iter().map(String::as_str).collect::<Vec<_>>().as_slice() {
+        [] => return "~".to_string(),
+        // macOS keeps iCloud Drive and File Provider cloud drives under ~/Library.
+        ["Library", "Mobile Documents", "com~apple~CloudDocs", ..] => ("iCloud Drive".to_string(), 3),
+        ["Library", "CloudStorage", drive, ..] => (cloud_drive(drive), 3),
+        _ => (String::new(), 0),
+    };
+    let rest: Vec<&str> = parts.iter().skip(rest).map(String::as_str).collect();
+    match (place.is_empty(), rest.is_empty()) {
+        (true, _) => rest.join(" › "),
+        (false, true) => place,
+        (false, false) => format!("{place} › {}", rest.join(" › ")),
+    }
+}
+
+/// A `~/Library/CloudStorage` folder name ("OneDrive-Contoso", "GoogleDrive-me@example.com",
+/// "Dropbox") as the drive's name and, shortened, its account.
+fn cloud_drive(folder: &str) -> String {
+    let (provider, account) = folder.split_once('-').unwrap_or((folder, ""));
+    let (provider, account) = match (provider, account.split_once('-')) {
+        ("OneDrive", Some(("SharedLibraries", org))) => ("SharePoint", org),
+        ("GoogleDrive", _) => ("Google Drive", account),
+        _ => (provider, account),
+    };
+    // Business accounts are named after the organisation with its spaces removed, which can be
+    // very long: its first part is enough to tell accounts apart.
+    let account = account.split('-').next().unwrap_or(account);
+    let account: String = if account.chars().count() > 32 { account.chars().take(31).chain(['…']).collect() } else { account.to_string() };
+    if account.is_empty() { provider.to_string() } else { format!("{provider} · {account}") }
+}
+
+impl PdfCraftApp {
+    /// File ▸ Pin folder to Home…: choose a folder whose newest PDFs Home lists.
+    pub fn pin_folder_dialog(&mut self) {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let dialog = rfd::AsyncFileDialog::new().set_title(tl!("Pin a folder to Home").to_string());
+            self.ask_one(crate::pickers::Ask::Folder(dialog), None, |app, dir| {
+                app.pin_folder(&dir.to_string_lossy());
+            });
+        }
+        #[cfg(target_arch = "wasm32")]
+        self.notify_tr("Pinned folders need the desktop app");
+    }
+
+    /// Pin `folder` (an absolute path) to Home. Returns false, after telling the user, when it
+    /// can't be pinned. Pinning a folder again changes nothing.
+    pub fn pin_folder(&mut self, folder: &str) -> bool {
+        let Some(folder) = clean(folder) else {
+            self.notify_tr("Choose a folder on this computer to pin");
+            return false;
+        };
+        let name = folder_name(&folder);
+        if self.pinned.folders.contains(&folder) {
+            self.notify_fmt("{folder} is already pinned to Home", &[("folder", &name)]);
+            return true;
+        }
+        if self.pinned.folders.len() >= MAX_PINNED {
+            self.notify_fmt("You can pin up to {n} folders. Unpin one first.", &[("n", &MAX_PINNED.to_string())]);
+            return false;
+        }
+        self.pinned.folders.push(folder);
+        self.pinned.stale = true;
+        self.notify_fmt("Pinned {folder} to Home", &[("folder", &name)]);
+        true
+    }
+
+    /// Remove `folder` from Home. Its files are not touched.
+    pub fn unpin_folder(&mut self, folder: &str) {
+        self.pinned.folders.retain(|f| f != folder);
+        self.pinned.listings.retain(|l| l.folder != folder);
+        self.pinned.expanded.retain(|f| f != folder);
+    }
+
+    /// List the pinned folders again if the last listing is older than a few seconds or the
+    /// folders changed (called while Home shows; `now` is egui time). The listing runs on a
+    /// worker thread, inline in tests ([`PdfCraftApp::run_inline`]).
+    pub fn refresh_pinned(&mut self, now: f64) {
+        self.poll_pinned();
+        if self.pinned.scan.is_some() {
+            return;
+        }
+        if self.pinned.folders.is_empty() {
+            self.pinned.listings.clear();
+            return;
+        }
+        // `now < last` means the clock restarted (a new context in tests): list again.
+        let due = self.pinned.stale || self.pinned.last_scan.is_none_or(|last| now < last || now - last >= RESCAN_SECS);
+        if !due {
+            return;
+        }
+        self.pinned.stale = false;
+        self.pinned.last_scan = Some(now);
+        let folders = self.pinned.folders.clone();
+        let slot = Arc::new(Mutex::new(None));
+        let out = slot.clone();
+        let ctx = self.ctx.clone();
+        let work = move || {
+            let listings: Vec<FolderListing> = folders.iter().map(|f| list(f)).collect();
+            *out.lock().unwrap_or_else(PoisonError::into_inner) = Some(listings);
+            if let Some(ctx) = ctx {
+                ctx.request_repaint();
+            }
+        };
+        if self.run_inline {
+            work();
+        } else if std::thread::Builder::new().name("pdfcraft-folders".into()).spawn(work).is_err() {
+            // No worker: try again when the next listing is due.
+            return;
+        }
+        self.pinned.scan = Some(slot);
+        self.poll_pinned();
+    }
+
+    /// Take a finished listing, if there is one.
+    fn poll_pinned(&mut self) {
+        let Some(slot) = &self.pinned.scan else { return };
+        let done = slot.lock().unwrap_or_else(PoisonError::into_inner).take();
+        match done {
+            Some(listings) => {
+                self.pinned.scan = None;
+                // A folder unpinned while it was being listed stays gone.
+                let folders = &self.pinned.folders;
+                self.pinned.listings = listings.into_iter().filter(|l| folders.contains(&l.folder)).collect();
+            }
+            // The worker ended without a result (it panicked): list again when due.
+            None if Arc::strong_count(slot) == 1 => self.pinned.scan = None,
+            None => {}
+        }
+    }
+}
+
+/// The Home view's Folders section (desktop only: the web build has no folders to read).
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn section(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    use egui::{Align2, CornerRadius, Rect, Sense, vec2};
+
+    use crate::theme::{self, Tokens};
+    use crate::{icons, widgets};
+
+    let t = Tokens::get(ui.ctx());
+    app.refresh_pinned(ui.input(|i| i.time));
+    let mut pin = false;
+    ui.horizontal(|ui| {
+        ui.label(egui::RichText::new(tl!("Folders")).font(theme::semibold(17.0)));
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            pin = widgets::ghost_button(ui, "folder-plus", tl!("Pin a folder…")).clicked();
+        });
+    });
+    ui.add_space(4.0);
+    if app.pinned.folders.is_empty() {
+        ui.label(
+            egui::RichText::new(tl!("Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them."))
+                .color(t.text_muted),
+        );
+    }
+    let mut open = None;
+    let mut unpin = None;
+    let mut toggle = None;
+    for folder in &app.pinned.folders {
+        let name = folder_name(folder);
+        ui.add_space(6.0);
+        ui.horizontal(|ui| {
+            let (icon, _) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::hover());
+            icons::paint(ui, icon, "folder", 20.0, t.icon);
+            ui.label(egui::RichText::new(crate::bidi::visual(&name)).font(theme::semibold(14.0))).on_hover_text(folder);
+            ui.add_space(4.0);
+            // Leave room for Unpin: a long location is cut short, never the button.
+            let room = (ui.available_width() - 110.0).max(0.0);
+            ui.scope(|ui| {
+                ui.set_max_width(room);
+                let place = egui::RichText::new(crate::bidi::visual(&location(folder))).font(theme::regular(12.0)).color(t.text_faint);
+                ui.add(egui::Label::new(place).truncate()).on_hover_text(folder);
+            });
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                let resp = widgets::ghost_button(ui, "x", tl!("Unpin"));
+                // Every folder has an Unpin button: say which one it is.
+                let label = crate::i18n::fmt(tl!("Unpin {folder}"), &[("folder", &name)]);
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &label));
+                if resp.clicked() {
+                    unpin = Some(folder.clone());
+                }
+            });
+        });
+        let note = |ui: &mut egui::Ui, text: &str| {
+            ui.add_space(2.0);
+            ui.label(egui::RichText::new(text).color(t.text_muted));
+        };
+        let Some(listing) = app.pinned.listing(folder) else {
+            note(ui, tl!("Looking for PDFs…"));
+            continue;
+        };
+        if listing.unavailable {
+            note(ui, tl!("This folder isn't available right now. It may have moved, or its drive or cloud sync is offline."));
+            continue;
+        }
+        if listing.files.is_empty() {
+            note(ui, tl!("No PDFs in this folder yet"));
+            continue;
+        }
+        let expanded = app.pinned.expanded.contains(folder);
+        let shown = if expanded { listing.files.len() } else { listing.files.len().min(SHOWN) };
+        for f in listing.files.iter().take(shown) {
+            let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 38.0), Sense::click());
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &f.name));
+            if resp.hovered() {
+                ui.painter().rect_filled(rect, CornerRadius::same(8), t.hover);
+            }
+            icons::paint(
+                ui,
+                Rect::from_min_size(rect.min + vec2(32.0, 9.0), vec2(20.0, 20.0)),
+                "file-text",
+                18.0,
+                egui::Color32::from_rgb(0xE0, 0x3E, 0x3E),
+            );
+            ui.painter().text(rect.min + vec2(62.0, 19.0), Align2::LEFT_CENTER, crate::bidi::visual(&f.name), theme::medium(13.0), t.text);
+            let size = crate::panels::human_size(usize::try_from(f.size).unwrap_or(usize::MAX));
+            let when = f.modified.map(crate::combine_ui::ago).unwrap_or_default();
+            let detail = if when.is_empty() { size } else { format!("{when}  ·  {size}") };
+            ui.painter().text(rect.right_center() - vec2(12.0, 0.0), Align2::RIGHT_CENTER, detail, theme::regular(12.0), t.text_muted);
+            if resp.on_hover_text(&f.path).clicked() {
+                open = Some(f.path.clone());
+            }
+        }
+        let more = listing.files.len().saturating_sub(shown);
+        let capped = listing.total > listing.files.len();
+        if more > 0 || (expanded && (listing.files.len() > SHOWN || capped)) {
+            ui.horizontal(|ui| {
+                ui.add_space(30.0);
+                let label = if expanded { tl!("Show less").to_string() } else { crate::i18n::fmt(tl!("Show {n} more"), &[("n", &more.to_string())]) };
+                if (more > 0 || listing.files.len() > SHOWN) && ui.link(label).clicked() {
+                    toggle = Some(folder.clone());
+                }
+                if expanded && capped {
+                    let n = listing.files.len().to_string();
+                    let text = crate::i18n::fmt(tl!("The newest {n} of {total} PDFs"), &[("n", &n), ("total", &listing.total.to_string())]);
+                    ui.label(egui::RichText::new(text).color(t.text_faint));
+                }
+            });
+        }
+    }
+    if pin {
+        app.pin_folder_dialog();
+    }
+    if let Some(folder) = unpin {
+        app.unpin_folder(&folder);
+    }
+    if let Some(folder) = toggle {
+        if app.pinned.expanded.contains(&folder) {
+            app.pinned.expanded.retain(|f| *f != folder);
+        } else {
+            app.pinned.expanded.push(folder);
+        }
+    }
+    if let Some(path) = open {
+        app.open_recent(&path);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn folders_from_settings_must_be_absolute_unique_and_few() {
+        let mut p = PinnedFolders::default();
+        let root = if cfg!(windows) { "C:\\" } else { "/" };
+        let a = format!("{root}scans");
+        let many: Vec<String> = (0..20).map(|i| format!("{root}f{i}")).collect();
+        let mut items = vec![
+            serde_json::json!(5),
+            serde_json::json!("relative/folder"),
+            serde_json::json!(""),
+            serde_json::json!(format!("{a}/")),
+            serde_json::json!(a.clone()),
+            serde_json::json!("x".repeat(MAX_PATH_CHARS + 1)),
+        ];
+        items.extend(many.iter().map(|f| serde_json::json!(f)));
+        p.restore(&serde_json::Value::Array(items));
+        assert_eq!(p.folders.len(), MAX_PINNED);
+        assert_eq!(p.folders.first(), Some(&a), "trailing separator trimmed, duplicate dropped");
+        assert!(p.folders.iter().all(|f| std::path::Path::new(f).is_absolute()));
+        p.restore(&serde_json::json!("not a list"));
+        assert_eq!(p.folders.len(), MAX_PINNED, "garbage keeps what is there");
+    }
+
+    #[test]
+    fn the_root_keeps_its_separator() {
+        if cfg!(windows) {
+            assert_eq!(clean("C:\\").as_deref(), Some("C:\\"));
+        } else {
+            assert_eq!(clean("/").as_deref(), Some("/"));
+            assert_eq!(clean("  /tmp/scans//  ").as_deref(), Some("/tmp/scans"));
+        }
+        assert_eq!(clean("a\0b"), None);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn locations_are_said_in_words() {
+        let home = Some(std::path::Path::new("/Users/me"));
+        let at = |p: &str| location_in(p, home);
+        assert_eq!(at("/Users/me/Library/Mobile Documents/com~apple~CloudDocs/Scans"), "iCloud Drive");
+        assert_eq!(at("/Users/me/Library/Mobile Documents/com~apple~CloudDocs/Personal/Scans"), "iCloud Drive › Personal");
+        assert_eq!(at("/Users/me/Library/CloudStorage/OneDrive-ContosoLtd-salesandservice/Scans"), "OneDrive · ContosoLtd");
+        assert_eq!(at("/Users/me/Library/CloudStorage/OneDrive-Personal/Scans"), "OneDrive · Personal");
+        assert_eq!(at("/Users/me/Library/CloudStorage/OneDrive-SharedLibraries-Contoso/Team/Scans"), "SharePoint · Contoso › Team");
+        assert_eq!(at("/Users/me/Library/CloudStorage/GoogleDrive-me@example.com/My Drive/Scans"), "Google Drive · me@example.com › My Drive");
+        assert_eq!(at("/Users/me/Library/CloudStorage/Dropbox/Scans"), "Dropbox");
+        assert_eq!(at("/Users/me/Documents/Work/Scans"), "Documents › Work");
+        assert_eq!(at("/Users/me/Scans"), "~");
+        assert_eq!(at("/Volumes/NAS/Scans"), "/Volumes/NAS");
+        assert_eq!(location_in("/Users/me/Documents/Scans", None), "/Users/me/Documents");
+        let long = format!("/Users/me/Library/CloudStorage/OneDrive-{}/Scans", "x".repeat(50));
+        assert_eq!(at(&long).chars().count(), "OneDrive · ".chars().count() + 32);
+    }
+
+    #[test]
+    fn a_missing_folder_lists_as_unavailable() {
+        let missing = std::env::temp_dir().join(format!("pdfcraft-no-such-folder-{}", std::process::id()));
+        let l = list(&missing.to_string_lossy());
+        assert!(l.unavailable);
+        assert!(l.files.is_empty());
+    }
+}
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 4d1d95c1..7e21c126 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -1,4 +1,5 @@
-//! Home tab: recommended tools, open card, recent files (local only, never another app's list).
+//! Home tab: recommended tools, open card, pinned folders and recent files (local only, never
+//! another app's list).
 
 use egui::{Align2, CornerRadius, Rect, Sense, Stroke, vec2};
 use pdfcraft_engine::catalog;
@@ -96,6 +97,12 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     });
                 });
 
+            #[cfg(not(target_arch = "wasm32"))]
+            {
+                ui.add_space(26.0);
+                crate::folders_ui::section(app, ui);
+            }
+
             ui.add_space(26.0);
             ui.label(egui::RichText::new(tl!("Recent")).font(theme::semibold(17.0)));
             ui.add_space(8.0);
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index c1e69d9f..76d0008e 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -29,6 +29,7 @@
 	OK	OK
 	Open…	Otevřít…
 	Open Recent	Otevřít nedávné soubory
+	Pin folder to Home…	Připnout složku na úvodní stránku…
 	No recent files	Žádné nedávné soubory
 	New blank PDF	Nový prázdný dokument PDF
 	Create PDF from file…	Vytvořit PDF ze souboru…
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 657d73f8..828b9c5d 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -22,6 +22,24 @@
 	Name on new comments	Nombre en los comentarios nuevos
 	Open…	Abrir…
 	Open Recent	Abrir recientes
+	Pin folder to Home…	Anclar carpeta en Inicio…
+	Folders	Carpetas
+	Pin a folder…	Anclar una carpeta…
+	Pin a folder to Home	Anclar una carpeta en Inicio
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Ancla una carpeta para ver aquí sus PDF más recientes, por ejemplo donde los guarda tu escáner o una unidad en la nube sincronizada.
+	Unpin	Desanclar
+	Unpin {folder}	Desanclar {folder}
+	Looking for PDFs…	Buscando PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Esta carpeta no está disponible ahora. Puede que se haya movido o que su unidad o la sincronización en la nube estén sin conexión.
+	No PDFs in this folder yet	Aún no hay PDF en esta carpeta
+	Show less	Mostrar menos
+	Show {n} more	Mostrar {n} más
+	The newest {n} of {total} PDFs	Los {n} PDF más recientes de {total}
+	Pinned folders need the desktop app	Las carpetas ancladas requieren la aplicación de escritorio
+	Choose a folder on this computer to pin	Elige una carpeta de este equipo para anclarla
+	{folder} is already pinned to Home	{folder} ya está anclada en Inicio
+	You can pin up to {n} folders. Unpin one first.	Puedes anclar hasta {n} carpetas. Desancla una primero.
+	Pinned {folder} to Home	{folder} anclada en Inicio
 	No recent files	No hay archivos recientes
 	New blank PDF	Nuevo PDF en blanco
 	Create PDF from file…	Crear PDF a partir de un archivo…
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index b99824aa..2544324b 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2013,4 +2013,22 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Choisissez une image PNG ou JPEG (jusqu’à 4 Mio). La transparence est conservée.
 	Couldn't import the signature image: {e}	Impossible d’importer l’image de la signature : {e}
 	Open Recent	Ouvrir un fichier récent
+	Pin folder to Home…	Épingler un dossier à l'Accueil…
+	Folders	Dossiers
+	Pin a folder…	Épingler un dossier…
+	Pin a folder to Home	Épingler un dossier à l'Accueil
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Épinglez un dossier pour afficher ici ses PDF les plus récents, par exemple celui où votre scanner ou un stockage cloud synchronisé les enregistre.
+	Unpin	Désépingler
+	Unpin {folder}	Désépingler {folder}
+	Looking for PDFs…	Recherche de PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Ce dossier n'est pas disponible pour le moment. Il a peut-être été déplacé, ou son disque ou sa synchronisation cloud est hors ligne.
+	No PDFs in this folder yet	Aucun PDF dans ce dossier pour l'instant
+	Show less	Afficher moins
+	Show {n} more	Afficher {n} de plus
+	The newest {n} of {total} PDFs	Les {n} PDF les plus récents sur {total}
+	Pinned folders need the desktop app	Les dossiers épinglés nécessitent l'application de bureau
+	Choose a folder on this computer to pin	Choisissez un dossier de cet ordinateur à épingler
+	{folder} is already pinned to Home	{folder} est déjà épinglé à l'Accueil
+	You can pin up to {n} folders. Unpin one first.	Vous pouvez épingler jusqu'à {n} dossiers. Désépinglez-en un d'abord.
+	Pinned {folder} to Home	{folder} épinglé à l'Accueil
 	No recent files	Aucun fichier récent
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index b81e8855..d45df9bf 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -28,6 +28,24 @@
 	Name on new comments	新しい注釈の作成者名
 	Open…	開く…
 	Open Recent	最近のファイルを開く
+	Pin folder to Home…	フォルダーをホームにピン留め…
+	Folders	フォルダー
+	Pin a folder…	フォルダーをピン留め…
+	Pin a folder to Home	フォルダーをホームにピン留め
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	フォルダーをピン留めすると、スキャナーや同期中のクラウドドライブの保存先など、そのフォルダー内の新しい PDF がここに表示されます。
+	Unpin	ピン留めを外す
+	Unpin {folder}	{folder} のピン留めを外す
+	Looking for PDFs…	PDF を探しています…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	このフォルダーは現在利用できません。移動されたか、ドライブまたはクラウド同期がオフラインになっている可能性があります。
+	No PDFs in this folder yet	このフォルダーにはまだ PDF がありません
+	Show less	表示を減らす
+	Show {n} more	さらに {n} 件表示
+	The newest {n} of {total} PDFs	{total} 件中、新しい {n} 件の PDF
+	Pinned folders need the desktop app	フォルダーのピン留めにはデスクトップ版が必要です
+	Choose a folder on this computer to pin	ピン留めするフォルダーをこのコンピューターから選択してください
+	{folder} is already pinned to Home	{folder} はすでにホームにピン留めされています
+	You can pin up to {n} folders. Unpin one first.	ピン留めできるフォルダーは {n} 個までです。先にいずれかのピン留めを外してください。
+	Pinned {folder} to Home	{folder} をホームにピン留めしました
 	No recent files	最近のファイルがありません
 	New blank PDF	空白の PDF を作成
 	Create PDF from file…	ファイルから PDF を作成…
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 56b0deb9..43fc9a60 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -21,6 +21,7 @@
 	Name on new comments	Nome nos novos comentários
 	Open…	Abrir…
 	Open Recent	Abrir recentes
+	Pin folder to Home…	Fixar pasta no Início…
 	No recent files	Nenhum arquivo recente
 	New blank PDF	Novo PDF em branco
 	Create PDF from file…	Criar PDF a partir de arquivo…
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index d2138710..2ab48e49 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -21,6 +21,24 @@
 	Name on new comments	Имя в новых комментариях
 	Open…	Открыть…
 	Open Recent	Открыть недавние
+	Pin folder to Home…	Закрепить папку на главной…
+	Folders	Папки
+	Pin a folder…	Закрепить папку…
+	Pin a folder to Home	Закрепить папку на главной
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Закрепите папку, чтобы видеть здесь её новые PDF, например папку, куда сохраняет файлы сканер или синхронизируемый облачный диск.
+	Unpin	Открепить
+	Unpin {folder}	Открепить {folder}
+	Looking for PDFs…	Поиск PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Эта папка сейчас недоступна. Возможно, она перемещена или её диск либо облачная синхронизация не в сети.
+	No PDFs in this folder yet	В этой папке пока нет PDF
+	Show less	Свернуть
+	Show {n} more	Показать ещё {n}
+	The newest {n} of {total} PDFs	Последние {n} PDF из {total}
+	Pinned folders need the desktop app	Для закреплённых папок нужно настольное приложение
+	Choose a folder on this computer to pin	Выберите папку на этом компьютере, чтобы закрепить её
+	{folder} is already pinned to Home	{folder} уже закреплена на главной
+	You can pin up to {n} folders. Unpin one first.	Можно закрепить не более {n} папок. Сначала открепите одну из них.
+	Pinned {folder} to Home	Папка {folder} закреплена на главной
 	No recent files	Нет недавних файлов
 	New blank PDF	Новый пустой PDF
 	Create PDF from file…	Создать PDF из файла…
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 17d7fda3..b08744a9 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2016,4 +2016,5 @@ action wizard	Start	ప్రారంభించు
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG లేదా JPEG చిత్రాన్ని ఎంచుకోండి (గరిష్ఠంగా 4 MiB). పారదర్శకత అలాగే ఉంటుంది.
 	Couldn't import the signature image: {e}	సంతకం చిత్రాన్ని దిగుమతి చేయడం సాధ్యం కాలేదు: {e}
 	Open Recent	ఇటీవలివి తెరువు
+	Pin folder to Home…	ఫోల్డర్‌ను హోమ్‌కు పిన్ చేయి…
 	No recent files	ఇటీవలి ఫైళ్లు లేవు
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 4f0487f6..37ffbabb 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -62,6 +62,24 @@
 	Name on new comments	新注释的作者姓名
 	Open…	打开…
 	Open Recent	打开最近的文件
+	Pin folder to Home…	将文件夹固定到主页…
+	Folders	文件夹
+	Pin a folder…	固定文件夹…
+	Pin a folder to Home	将文件夹固定到主页
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	固定一个文件夹，即可在此列出其中最新的 PDF，例如扫描仪或同步云盘保存文件的位置。
+	Unpin	取消固定
+	Unpin {folder}	取消固定 {folder}
+	Looking for PDFs…	正在查找 PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	此文件夹当前不可用。它可能已被移动，或其所在驱动器或云同步处于离线状态。
+	No PDFs in this folder yet	此文件夹中还没有 PDF
+	Show less	收起
+	Show {n} more	再显示 {n} 个
+	The newest {n} of {total} PDFs	共 {total} 个 PDF 中最新的 {n} 个
+	Pinned folders need the desktop app	固定文件夹需要桌面版应用
+	Choose a folder on this computer to pin	请选择此电脑上要固定的文件夹
+	{folder} is already pinned to Home	{folder} 已固定到主页
+	You can pin up to {n} folders. Unpin one first.	最多可固定 {n} 个文件夹。请先取消固定一个。
+	Pinned {folder} to Home	已将 {folder} 固定到主页
 	No recent files	没有最近的文件
 	Open	打开
 	Open file	打开文件
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 8c041d92..b5ad89e7 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -21,6 +21,24 @@
 	Name on new comments	新註解的作者名稱
 	Open…	開啟…
 	Open Recent	開啟最近的檔案
+	Pin folder to Home…	將資料夾釘選到首頁…
+	Folders	資料夾
+	Pin a folder…	釘選資料夾…
+	Pin a folder to Home	將資料夾釘選到首頁
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	釘選資料夾後，即可在此列出其中最新的 PDF，例如掃描器或同步雲端硬碟儲存檔案的位置。
+	Unpin	取消釘選
+	Unpin {folder}	取消釘選 {folder}
+	Looking for PDFs…	正在尋找 PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	此資料夾目前無法使用。它可能已被移動，或其所在磁碟或雲端同步處於離線狀態。
+	No PDFs in this folder yet	此資料夾中還沒有 PDF
+	Show less	顯示較少
+	Show {n} more	再顯示 {n} 個
+	The newest {n} of {total} PDFs	共 {total} 個 PDF 中最新的 {n} 個
+	Pinned folders need the desktop app	釘選資料夾需要桌面版應用程式
+	Choose a folder on this computer to pin	請選擇這部電腦上要釘選的資料夾
+	{folder} is already pinned to Home	{folder} 已釘選到首頁
+	You can pin up to {n} folders. Unpin one first.	最多可釘選 {n} 個資料夾。請先取消釘選一個。
+	Pinned {folder} to Home	已將 {folder} 釘選到首頁
 	No recent files	沒有最近的檔案
 	Open	開啟
 	Open file	開啟檔案
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 1137e689..db6137b4 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -67,6 +67,7 @@ mod edit_text_ui;
 mod editing;
 mod files;
 pub mod fill_sign;
+pub mod folders_ui;
 pub mod forms_ui;
 mod home;
 mod icon_data;
@@ -373,6 +374,8 @@ pub struct PdfCraftApp {
     pub palette_query: String,
     pub all_tools_expanded: bool,
     pub recent: Vec<RecentFile>,
+    /// Folders pinned to Home, and what they held when last listed.
+    pub pinned: folders_ui::PinnedFolders,
     pub toast: Option<(String, f64)>,
     /// Whether the macOS title bar is drawn by us (traffic lights over our tab strip).
     pub integrated_titlebar: bool,
@@ -420,7 +423,7 @@ pub struct PdfCraftApp {
     pub ocr_draft: ocr_ui::OcrDraft,
     pub ocr_run: Option<ocr_ui::OcrRun>,
     pub ocr_batch: Option<std::sync::Arc<std::sync::Mutex<ocr_ui::BatchProgress>>>,
-    /// Background jobs (OCR, actions) run inline instead (tests).
+    /// Background jobs (OCR, actions, listing pinned folders) run inline instead (tests).
     pub run_inline: bool,
     /// Action Wizard: the user's actions, the dialog state, the running action and (tests) the
     /// files to use instead of a picker.
@@ -612,6 +615,7 @@ impl PdfCraftApp {
             palette_query: String::new(),
             all_tools_expanded: false,
             recent: Vec::new(),
+            pinned: Default::default(),
             toast: None,
             integrated_titlebar: false,
             password_prompt: None,
@@ -1166,6 +1170,7 @@ impl PdfCraftApp {
         let trusted: Vec<String> = self.session.trusted_certificates().iter().map(pdfcraft_engine::sign::x509::to_pem).collect();
         serde_json::json!({
             "recent": self.recent,
+            "pinned_folders": self.pinned.folders,
             "theme": self.theme_preference,
             "default_mode": self.default_mode,
             "default_layout": self.view_defaults.layout.as_str(),
@@ -1199,6 +1204,7 @@ impl PdfCraftApp {
             let r: Vec<RecentFile> = r.into_iter().filter(|f| std::path::Path::new(&f.path).exists()).collect();
             self.recent = r;
         }
+        self.pinned.restore(&v["pinned_folders"]);
         if let Ok(preference) = serde_json::from_value::<ThemePreference>(v["theme"].clone()) {
             self.set_theme_preference(preference);
         }
diff --git a/crates/ui-egui/tests/folders.rs b/crates/ui-egui/tests/folders.rs
new file mode 100644
index 00000000..bfc5196d
--- /dev/null
+++ b/crates/ui-egui/tests/folders.rs
@@ -0,0 +1,210 @@
+//! Pinned folders on Home: File ▸ Pin folder to Home…, the newest PDFs listed per folder,
+//! opening one, unpinning, and the setting surviving a restart.
+
+use std::path::{Path, PathBuf};
+use std::time::{Duration, SystemTime};
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+use pdfcraft_ui_egui::folders_ui::{MAX_PINNED, SHOWN};
+
+/// A one-page PDF.
+const FIXTURE: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 400] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// A fresh, empty folder under the temp dir, removed when dropped.
+struct TempFolder(PathBuf);
+
+impl TempFolder {
+    fn new(name: &str) -> Self {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-pinned-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        Self(dir)
+    }
+
+    fn path(&self) -> String {
+        self.0.to_string_lossy().into_owned()
+    }
+
+    /// Write `name` with `bytes`, last modified `age` ago.
+    fn file(&self, name: &str, bytes: &[u8], age: Duration) -> PathBuf {
+        let path = self.0.join(name);
+        std::fs::write(&path, bytes).unwrap();
+        let file = std::fs::File::options().write(true).open(&path).unwrap();
+        file.set_modified(SystemTime::now() - age).unwrap();
+        path
+    }
+}
+
+impl Drop for TempFolder {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1400.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        // List folders on the frame that asks, not on a worker thread.
+        app.run_inline = true;
+        setup(&mut app);
+        app
+    });
+    // Fonts install on frame 1 and apply on frame 2.
+    h.run_steps(4);
+    h
+}
+
+fn listed(h: &Harness<'static, PdfCraftApp>, folder: &str) -> Vec<String> {
+    h.state().pinned.listing(folder).map(|l| l.files.iter().map(|f| f.name.clone()).collect()).unwrap_or_default()
+}
+
+#[test]
+fn a_pinned_folder_lists_its_newest_pdfs_on_home() {
+    let dir = TempFolder::new("newest");
+    dir.file("older.pdf", FIXTURE, Duration::from_secs(2 * 86_400));
+    dir.file("newer.PDF", FIXTURE, Duration::from_secs(300));
+    dir.file("notes.txt", b"not a pdf", Duration::from_secs(60));
+    dir.file(".hidden.pdf", FIXTURE, Duration::from_secs(60));
+    std::fs::create_dir_all(dir.0.join("inner.pdf")).unwrap();
+    let folder = dir.path();
+    let pick = folder.clone();
+    let mut h = harness(move |app| app.pick_override = Some(vec![pick]));
+    h.get_by_label("Pin a folder…");
+    assert!(h.state_mut().execute("file.pin_folder"));
+    h.run_steps(4);
+    assert_eq!(h.state().pinned.folders, std::slice::from_ref(&folder));
+    assert_eq!(listed(&h, &folder), ["newer.PDF", "older.pdf"], "newest first; no text files, hidden files or folders");
+    assert_eq!(h.state().pinned.listing(&folder).map(|l| l.total), Some(2));
+    h.get_by_label("newer.PDF");
+    h.get_by_label("older.pdf");
+    assert!(h.query_by_label("notes.txt").is_none());
+    assert!(h.query_by_label(".hidden.pdf").is_none());
+}
+
+#[test]
+fn clicking_a_pinned_pdf_opens_it_and_adds_it_to_recent() {
+    let dir = TempFolder::new("open");
+    let path = dir.file("scan.pdf", FIXTURE, Duration::from_secs(10));
+    let folder = dir.path();
+    let mut h = harness(move |app| {
+        app.pin_folder(&folder);
+    });
+    h.run_steps(2);
+    h.get_by_label("scan.pdf").click();
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(app.views.len(), 1, "the PDF opens in a tab");
+    assert_eq!(app.recent.first().map(|r| r.path.clone()), Some(path.to_string_lossy().into_owned()));
+}
+
+#[test]
+fn new_scans_appear_without_reopening_home() {
+    let dir = TempFolder::new("rescan");
+    dir.file("first.pdf", FIXTURE, Duration::from_secs(600));
+    let folder = dir.path();
+    let pin = folder.clone();
+    let mut h = harness(move |app| {
+        app.pin_folder(&pin);
+    });
+    h.run_steps(2);
+    assert_eq!(listed(&h, &folder), ["first.pdf"]);
+    dir.file("second.pdf", FIXTURE, Duration::from_secs(5));
+    // The listing is refreshed every few seconds while Home shows.
+    h.state_mut().refresh_pinned(1.0e6);
+    assert_eq!(listed(&h, &folder), ["second.pdf", "first.pdf"]);
+}
+
+#[test]
+fn unpinning_removes_the_folder_but_not_its_files() {
+    let dir = TempFolder::new("unpin");
+    let path = dir.file("keep.pdf", FIXTURE, Duration::from_secs(10));
+    let folder = dir.path();
+    let pin = folder.clone();
+    let mut h = harness(move |app| {
+        app.pin_folder(&pin);
+    });
+    h.run_steps(2);
+    let name = pdfcraft_ui_egui::folders_ui::folder_name(&folder);
+    h.get_by_label(&format!("Unpin {name}")).click();
+    h.run_steps(2);
+    assert!(h.state().pinned.folders.is_empty());
+    assert!(h.query_by_label("keep.pdf").is_none());
+    assert!(path.exists(), "unpinning never touches the files");
+}
+
+#[test]
+fn pinned_folders_survive_a_restart() {
+    let dir = TempFolder::new("restart");
+    let folder = dir.path();
+    let mut a = PdfCraftApp::new();
+    assert!(a.pin_folder(&folder));
+    let mut b = PdfCraftApp::new();
+    b.restore(&a.persist());
+    assert_eq!(b.pinned.folders, [folder]);
+    b.restore("{\"pinned_folders\": [5, \"relative/path\"]}");
+    assert!(b.pinned.folders.is_empty(), "only absolute folder paths are restored");
+    b.restore("{not json");
+    assert!(b.pinned.folders.is_empty());
+}
+
+#[test]
+fn an_unavailable_folder_says_so_and_stays_pinned() {
+    let missing = std::env::temp_dir().join(format!("pdfcraft-pinned-gone-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&missing);
+    let folder = missing.to_string_lossy().into_owned();
+    let pin = folder.clone();
+    let mut h = harness(move |app| {
+        app.pin_folder(&pin);
+    });
+    h.run_steps(2);
+    h.get_by_label_contains("isn't available right now");
+    assert_eq!(h.state().pinned.folders, std::slice::from_ref(&folder));
+    // It comes back by itself once the folder (or its synced drive) is there again.
+    std::fs::create_dir_all(&missing).unwrap();
+    std::fs::write(missing.join("back.pdf"), FIXTURE).unwrap();
+    h.state_mut().refresh_pinned(1.0e6);
+    h.run_steps(2);
+    let _ = std::fs::remove_dir_all(&missing);
+    assert_eq!(listed(&h, &folder), ["back.pdf"]);
+}
+
+#[test]
+fn show_more_reveals_the_older_pdfs() {
+    let dir = TempFolder::new("more");
+    for i in 0..SHOWN + 2 {
+        dir.file(&format!("scan{i:02}.pdf"), FIXTURE, Duration::from_secs(60 * (i as u64 + 1)));
+    }
+    let folder = dir.path();
+    let mut h = harness(move |app| {
+        app.pin_folder(&folder);
+    });
+    h.run_steps(2);
+    h.get_by_label("scan00.pdf");
+    assert!(h.query_by_label("scan09.pdf").is_none(), "only the newest {SHOWN} show at first");
+    h.get_by_label("Show 2 more").click();
+    h.run_steps(2);
+    h.get_by_label("scan09.pdf");
+    h.get_by_label("Show less");
+}
+
+#[test]
+fn pinning_is_limited_and_never_duplicates() {
+    let mut app = PdfCraftApp::new();
+    assert!(!app.pin_folder("relative/scans"), "a relative path is refused");
+    let root = if cfg!(windows) { "C:\\" } else { "/" };
+    let folders: Vec<String> = (0..MAX_PINNED).map(|i| Path::new(root).join(format!("pinned-{i}")).to_string_lossy().into_owned()).collect();
+    for f in &folders {
+        assert!(app.pin_folder(f));
+    }
+    assert!(app.pin_folder(&folders[0]), "pinning again is fine");
+    assert_eq!(app.pinned.folders.len(), MAX_PINNED, "and adds nothing");
+    assert!(!app.pin_folder(&Path::new(root).join("one-too-many").to_string_lossy()));
+    assert!(app.toast.as_ref().is_some_and(|(m, _)| m.contains("Unpin one first")), "the user is told");
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c790b121..0d774456 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1608,10 +1608,10 @@ area = "B"
 tier = "P1"
 milestone = "M3"
 status = "shipped"
-commands = []
+commands = ["file.pin_folder"]
 tools = []
-evidence = ["crates/ui-egui/tests/ui.rs::home_shows_welcome_and_tools"]
-notes = ""
+evidence = ["crates/ui-egui/tests/ui.rs::home_shows_welcome_and_tools", "crates/ui-egui/tests/folders.rs::a_pinned_folder_lists_its_newest_pdfs_on_home", "crates/ui-egui/tests/folders.rs::clicking_a_pinned_pdf_opens_it_and_adds_it_to_recent", "crates/ui-egui/tests/folders.rs::pinned_folders_survive_a_restart"]
+notes = "Desktop: folders pinned to Home (File ▸ Pin folder to Home…, up to 8) list their newest PDFs, read on a worker thread and refreshed every few seconds while Home shows; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Pinned folders are local paths, so a cloud drive works through its synced folder (iCloud Drive, OneDrive, Dropbox). Not yet: subfolders, search within a pinned folder, the web build."
 
 [[feature]]
 id = "view.all-tools"
@@ -9555,7 +9555,7 @@ status = "na"
 commands = []
 tools = []
 evidence = []
-notes = "Adobe cloud; use OS file dialogs and synced folders"
+notes = "Adobe cloud; use OS file dialogs and synced folders, which can be pinned to Home (view.home-view)"
 
 [[feature]]
 id = "misc.cross-device-sync"

From 85dcb9dece01bc9904b3d41fdcca91af70f48240 Mon Sep 17 00:00:00 2001
From: pauliusiv123-rgb <235694617+pauliusiv123-rgb@users.noreply.github.com>
Date: Fri, 9 Oct 2026 03:04:10 +0300
Subject: [PATCH 029/149] Issue #295: three clicks select the line, four clicks
 the page (#366)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Text: find the word and the line around a glyph

PageText gets word_at(i) and line_at(i). Each returns the first and
last glyph of the word or the line around glyph i, or None when i is
past the end of the page's text. A word stops at a word gap, a blank
glyph or a line end. A line is the run of glyphs with the same line
number.

The canvas's double-click used its own loop for this, which indexed the
glyph, line and gap arrays directly. It now calls word_at, which reads
them with get(). Double-clicking selects the same words as before.

Test: render words_and_lines_around_a_glyph, on two lines with a blank
glyph, a word gap and a line break.

* Issue #295: three clicks select the line, four clicks the page

With the Select tool, quick clicks on text widen the selection like
Acrobat: two clicks select a word (as before), three the line, four or
more all the text on the page. A third click used to clear the
selection.

egui counts only up to triple clicks and reports a fourth quick click
as another triple, so the view keeps its own count of the current run.
A single click resets it and a pause ends it.

With the markup tools (Highlight and the like) and Redact, a
double-click already turns the word into a mark at once. They stop at
the word, so more clicks don't stack line or page marks.

Tests: ui-egui quick_clicks_select_a_word_then_the_line_then_the_page
and quick_clicks_with_the_highlighter_mark_only_the_word.

parity: view.text-select cites the tests. The notes say what is
missing: paragraph selection, and Ctrl/⌘+A across the whole document
(it selects the current page).

* Clippy: as_chunks in the signature preview test (follow-up to #355)

Clippy 1.99 rejects chunks_exact with a constant chunk size
(chunks_exact_to_as_chunks), so `cargo clippy --workspace --all-targets
-- -D warnings` fails on main since #355. Use as_chunks, as #360 did
for the test above it.

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/render/src/text.rs           | 55 ++++++++++++++++++
 crates/ui-egui/src/canvas.rs        | 39 ++++++++-----
 crates/ui-egui/tests/text_select.rs | 86 +++++++++++++++++++++++++++++
 parity/acrobat-features.toml        |  4 +-
 4 files changed, 168 insertions(+), 16 deletions(-)
 create mode 100644 crates/ui-egui/tests/text_select.rs

diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 82291713..536a35e5 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -146,6 +146,41 @@ impl PageText {
             .map(|(i, _)| i)
     }
 
+    /// The word around glyph `i` as its first and last glyph (double-click): it stops at word
+    /// gaps, blank glyphs and line ends.
+    pub fn word_at(&self, i: usize) -> Option<(usize, usize)> {
+        self.glyphs.get(i)?;
+        let blank = |k: usize| self.glyphs.get(k).is_none_or(|g| g.text.trim().is_empty());
+        // Glyph `k` (≥ 1) follows glyph `k - 1` with no word gap or line break between them.
+        let joined = |k: usize| !self.space_before.get(k).copied().unwrap_or(true) && self.line_of.get(k - 1) == self.line_of.get(k);
+        let mut first = i;
+        while first > 0 && joined(first) && !blank(first - 1) {
+            first -= 1;
+        }
+        let mut last = i;
+        while joined(last + 1) && !blank(last + 1) {
+            last += 1;
+        }
+        Some((first, last))
+    }
+
+    /// The line around glyph `i` as its first and last glyph (triple-click). A line's glyphs are
+    /// consecutive.
+    pub fn line_at(&self, i: usize) -> Option<(usize, usize)> {
+        self.glyphs.get(i)?;
+        let line = self.line_of.get(i)?;
+        let same = |k: usize| self.line_of.get(k) == Some(line);
+        let mut first = i;
+        while first > 0 && same(first - 1) {
+            first -= 1;
+        }
+        let mut last = i;
+        while same(last + 1) {
+            last += 1;
+        }
+        Some((first, last))
+    }
+
     /// Merge the boxes of `range` into one rectangle per line (for highlighting).
     pub fn line_rects(&self, range: std::ops::Range<usize>) -> Vec<[f32; 4]> {
         let mut out: Vec<(u32, [f32; 4])> = Vec::new();
@@ -656,4 +691,24 @@ mod tests {
         word(&mut v, "每个字", 10.0, 10.0, 9.0);
         assert_eq!(layout(v).plain_text(), "每个字");
     }
+
+    /// Two lines, "ab cd" and "e fg": words stop at blank glyphs, word gaps and line ends.
+    #[test]
+    fn words_and_lines_around_a_glyph() {
+        let t = PageText {
+            glyphs: Vec::from(["a", "b", " ", "c", "d", "e", "f", "g"].map(|s| TextGlyph { text: s.into(), rect: [0.0; 4] })),
+            line_of: vec![0, 0, 0, 0, 0, 1, 1, 1],
+            space_before: vec![false, false, false, false, false, false, true, false],
+        };
+        assert_eq!(t.word_at(1), Some((0, 1)));
+        assert_eq!(t.word_at(3), Some((3, 4)));
+        assert_eq!(t.word_at(4), Some((3, 4)));
+        assert_eq!(t.word_at(5), Some((5, 5)));
+        assert_eq!(t.word_at(7), Some((6, 7)));
+        assert_eq!(t.line_at(2), Some((0, 4)));
+        assert_eq!(t.line_at(6), Some((5, 7)));
+        assert_eq!(t.word_at(8), None);
+        assert_eq!(t.line_at(8), None);
+        assert_eq!(PageText::default().line_at(0), None);
+    }
 }
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index a54dff08..4030d7c6 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -222,6 +222,8 @@ pub struct DocView {
     pub(crate) text_failed: HashSet<usize>,
     pub find: Option<Find>,
     selection: Option<Selection>,
+    /// Clicks in the current run on the text layer: two select a word, three the line, four the page.
+    clicks: u32,
     last_queue: Vec<RenderRequest>,
     viewport_w: f32,
     viewport_h: f32,
@@ -363,6 +365,7 @@ impl DocView {
             text_failed: HashSet::new(),
             find: None,
             selection: None,
+            clicks: 0,
             last_queue: Vec::new(),
             viewport_w: 800.0,
             viewport_h: 600.0,
@@ -1701,20 +1704,28 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     {
                         sel.head = h;
                     }
-                    if resp.double_clicked() && over_text {
-                        if let Some(a) = text.nearest(vx, vy) {
-                            // Expand to the word: stop at inferred spaces, explicit spaces and line ends.
-                            let is_break = |k: usize| text.glyphs[k].text.trim().is_empty();
-                            let mut s0 = a;
-                            while s0 > 0 && !text.space_before[s0] && text.line_of[s0 - 1] == text.line_of[s0] && !is_break(s0 - 1) {
-                                s0 -= 1;
-                            }
-                            let mut e = a;
-                            while e + 1 < text.glyphs.len() && !text.space_before[e + 1] && text.line_of[e + 1] == text.line_of[e] && !is_break(e + 1)
-                            {
-                                e += 1;
-                            }
-                            view.selection = Some(Selection { page: i, anchor: s0, head: e });
+                    // Quick clicks widen the selection: two a word, three the line, four the page.
+                    // egui counts up to three, so four come from the run kept here. The markup and
+                    // Redact tools mark a double-clicked word at once, so they stop at the word.
+                    let clicks = if resp.triple_clicked() {
+                        view.clicks.max(2).saturating_add(1)
+                    } else if resp.double_clicked() {
+                        2
+                    } else {
+                        u32::from(resp.clicked())
+                    };
+                    if clicks > 0 {
+                        view.clicks = clicks;
+                    }
+                    let clicks = if clicks > 2 && tool != QuickTool::Select { 1 } else { clicks };
+                    if clicks >= 2 && over_text {
+                        let span = text.nearest(vx, vy).and_then(|a| match clicks {
+                            2 => text.word_at(a),
+                            3 => text.line_at(a),
+                            _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
+                        });
+                        if let Some((first, last)) = span {
+                            view.selection = Some(Selection { page: i, anchor: first, head: last });
                         }
                     } else if resp.clicked() && !over_link {
                         view.selection = None;
diff --git a/crates/ui-egui/tests/text_select.rs b/crates/ui-egui/tests/text_select.rs
new file mode 100644
index 00000000..c2beef92
--- /dev/null
+++ b/crates/ui-egui/tests/text_select.rs
@@ -0,0 +1,86 @@
+//! Issue #295: quick clicks on text widen the selection, as in Acrobat: two clicks select a
+//! word, three the line, four all the text on the page.
+
+use egui::{Event, Modifiers, PointerButton, Pos2};
+use egui_kittest::Harness;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+/// One 300×200 page with two lines of Helvetica text.
+fn two_lines() -> Vec<u8> {
+    let content = "BT /F1 14 Tf 20 150 Td (The quick brown fox) Tj 0 -24 Td (jumps over the dog) Tj ET";
+    format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    )
+    .into_bytes()
+}
+
+/// The page on screen and the pointer over the "u" of "quick". Frames are 1/60 s: a click takes
+/// two frames (press, release), and egui counts a double-click only within 0.3 s.
+fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> (Harness<'static, PdfCraftApp>, Pos2) {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("lines.pdf", None, two_lines()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("author", "Tester").unwrap();
+        setup(&mut app);
+        app
+    });
+    for _ in 0..200 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let at = h.state().views[0].glyph_screen_pos(0, 5).expect("text layer loaded");
+    h.hover_at(at);
+    h.run_steps(1);
+    (h, at)
+}
+
+/// Press and release without moving or leaving the page.
+fn click(h: &mut Harness<'static, PdfCraftApp>, pos: Pos2) {
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+    }
+    h.run_steps(1);
+}
+
+#[test]
+fn quick_clicks_select_a_word_then_the_line_then_the_page() {
+    let (mut h, at) = harness(|_| {});
+    let page = "The quick brown fox\njumps over the dog";
+    for (n, want) in [None, Some("quick"), Some("The quick brown fox"), Some(page), Some(page)].into_iter().enumerate() {
+        click(&mut h, at);
+        assert_eq!(h.state().views[0].selected_text().as_deref(), want, "after {} clicks", n + 1);
+    }
+    // A pause ends the run: the next double-click selects a word again.
+    h.run_steps(60);
+    click(&mut h, at);
+    click(&mut h, at);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("quick"));
+}
+
+#[test]
+fn quick_clicks_with_the_highlighter_mark_only_the_word() {
+    let (mut h, at) = harness(|app| assert!(app.execute("comment.highlight")));
+    for _ in 0..4 {
+        click(&mut h, at);
+    }
+    h.run_steps(3);
+    let app = h.state();
+    let doc = app.session.get(app.views[0].id).unwrap();
+    let marks: Vec<(&str, usize)> = doc.info.annotations.iter().map(|a| (a.subtype.as_str(), a.quads.len())).collect();
+    assert_eq!(marks, [("Highlight", 1)], "one highlight, on the double-clicked word");
+    assert!(app.views[0].selected_text().is_none());
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 0d774456..0da89682 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1466,8 +1466,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui.rs::selection_works_in_every_view_rotation"]
-notes = ""
+evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui.rs::selection_works_in_every_view_rotation", "crates/ui-egui/tests/text_select.rs::quick_clicks_select_a_word_then_the_line_then_the_page", "crates/ui-egui/tests/text_select.rs::quick_clicks_with_the_highlighter_mark_only_the_word"]
+notes = "Drag to select; with the Select tool, quick clicks select a word (two), the line (three) or all the text on the page (four). The markup and Redact tools mark a double-clicked word and stop there. Missing: paragraph selection, and ⌘A across the whole document (it selects the current page)."
 
 [[feature]]
 id = "view.copy-text"

From dc356f0dfc68b77816a80bb6dd6d0eacf7a9d70f Mon Sep 17 00:00:00 2001
From: Dmitriy Bunakalya <bunakalya@proton.me>
Date: Fri, 9 Oct 2026 04:04:27 +0400
Subject: [PATCH 030/149] Linux: accept file:// URI args so desktop launchers
 recognise pdfcraft as PDF default (#382)

* Linux: accept file:// URI args so desktop launchers recognise pdfcraft as PDF default

GNOME Files (and other freedesktop-spec launchers) only register an app as the
default handler for a mimetype if its .desktop Exec accepts URIs (%u/%U), not
just paths (%F). pdfcraft's entry used %F, so even after `xdg-mime default
ai.storyteller.pdfcraft.desktop application/pdf`, double-clicking a PDF in
Files silently fell back to another installed viewer.

Switch Exec to %u and decode file:// args back to plain paths in main.rs
before they reach the rest of the app, which only ever opens paths. Other
schemes and plain CLI paths pass through unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* path_from_arg: file://localhost, foreign hosts left alone, Windows drive paths, no indexing; Exec %U (several files)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Dmitriy Bunakalya <dmitriy.bunakalya@appfollow.io>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 apps/pdfcraft/src/main.rs                     | 54 ++++++++++++++++++-
 .../linux/ai.storyteller.pdfcraft.desktop     |  4 +-
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index bf3b4883..e40607a8 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -78,6 +78,37 @@ fn migrate_legacy_folders() {
     }
 }
 
+/// Desktop launchers (GNOME Files, KDE Dolphin…) only recognise an app as the default handler for a
+/// mime type if its `Exec` takes URIs (`%u`/`%U`), not just paths (`%F`); the packaged `.desktop`
+/// file uses `%U` accordingly (packaging/linux/ai.storyteller.pdfcraft.desktop). Decode a local
+/// `file://` argument (`file:///path` or `file://localhost/path`) to a plain path here so the rest
+/// of the app, which only ever opens paths, is unaffected. Other schemes (`http://`, `mailto:`…),
+/// URIs naming another host, and plain paths pass through untouched.
+fn path_from_arg(arg: String) -> String {
+    let Some(rest) = arg.strip_prefix("file://") else { return arg };
+    let rest = rest.strip_prefix("localhost").unwrap_or(rest);
+    if !rest.starts_with('/') {
+        return arg;
+    }
+    // `file:///C:/x.pdf` on Windows names `C:/x.pdf`. `rest` starts with the one-byte '/', so
+    // byte 1 is a char boundary.
+    let rest = if cfg!(windows) && rest.as_bytes().get(2) == Some(&b':') { &rest[1..] } else { rest };
+    let mut out = Vec::with_capacity(rest.len());
+    let mut bytes = rest.bytes();
+    while let Some(b) = bytes.next() {
+        if b == b'%' {
+            let hex = bytes.clone().take(2).collect::<Vec<u8>>();
+            if let Some(byte) = std::str::from_utf8(&hex).ok().filter(|h| h.len() == 2).and_then(|h| u8::from_str_radix(h, 16).ok()) {
+                out.push(byte);
+                bytes.nth(1);
+                continue;
+            }
+        }
+        out.push(b);
+    }
+    String::from_utf8(out).unwrap_or(arg)
+}
+
 fn main() -> eframe::Result {
     // First, so the panic hook and every start-up warning are recorded (`logging`).
     let logger = logging::install();
@@ -115,7 +146,7 @@ fn main() -> eframe::Result {
                 let value = args.next().unwrap_or_default();
                 options.push((flag.trim_start_matches("--").to_string(), value));
             }
-            _ => files.push(a),
+            _ => files.push(path_from_arg(a)),
         }
     }
     let integrated = cfg!(target_os = "macos");
@@ -351,6 +382,27 @@ fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[(
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn path_from_arg_decodes_file_uris() {
+        assert_eq!(super::path_from_arg("file:///home/alice/report.pdf".to_string()), "/home/alice/report.pdf");
+        assert_eq!(super::path_from_arg("file:///home/alice/my%20report.pdf".to_string()), "/home/alice/my report.pdf");
+        assert_eq!(super::path_from_arg("file://localhost/tmp/a%C3%A9.pdf".to_string()), "/tmp/aé.pdf");
+        // Malformed or truncated escapes are kept as written; bytes that aren't UTF-8 keep the URI.
+        assert_eq!(super::path_from_arg("file:///tmp/100%.pdf".to_string()), "/tmp/100%.pdf");
+        assert_eq!(super::path_from_arg("file:///tmp/a%2".to_string()), "/tmp/a%2");
+        assert_eq!(super::path_from_arg("file:///tmp/%zz%".to_string()), "/tmp/%zz%");
+        assert_eq!(super::path_from_arg("file:///tmp/%FF.pdf".to_string()), "file:///tmp/%FF.pdf");
+    }
+
+    #[test]
+    fn path_from_arg_leaves_plain_paths_and_other_schemes_alone() {
+        assert_eq!(super::path_from_arg("report.pdf".to_string()), "report.pdf");
+        assert_eq!(super::path_from_arg("/home/alice/report.pdf".to_string()), "/home/alice/report.pdf");
+        assert_eq!(super::path_from_arg("https://example.com/report.pdf".to_string()), "https://example.com/report.pdf");
+        assert_eq!(super::path_from_arg("file://server/share/a.pdf".to_string()), "file://server/share/a.pdf");
+        assert_eq!(super::path_from_arg("file://".to_string()), "file://");
+    }
+
     #[test]
     fn gpu_backends_avoid_vulkan_on_windows_and_prefer_low_power() {
         let mut native = eframe::NativeOptions::default();
diff --git a/packaging/linux/ai.storyteller.pdfcraft.desktop b/packaging/linux/ai.storyteller.pdfcraft.desktop
index f32d625d..f7928d62 100644
--- a/packaging/linux/ai.storyteller.pdfcraft.desktop
+++ b/packaging/linux/ai.storyteller.pdfcraft.desktop
@@ -3,12 +3,12 @@ Type=Application
 Name=PdfCraft
 GenericName=PDF Editor
 Comment=Read, organize, combine, split and secure PDFs
-Exec=pdfcraft %F
+Exec=pdfcraft %U
 TryExec=pdfcraft
 Icon=ai.storyteller.pdfcraft
 Terminal=false
 StartupNotify=true
 StartupWMClass=pdfcraft
-Categories=Office;Viewer;Graphics;
+Categories=Office;Viewer;
 Keywords=pdf;viewer;editor;annotate;sign;forms;merge;split;
 MimeType=application/pdf;

From 438a269bac84cc569de487a562df217f217f61a0 Mon Sep 17 00:00:00 2001
From: midasdf <205497066+midasdf@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:03:16 +0900
Subject: [PATCH 031/149] M7: report Japanese Type 3 fallback font names (#387)

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/automation/src/tools.rs |  2 +-
 crates/edit/src/tests.rs       | 24 ++++++++++++++
 crates/edit/src/text.rs        | 13 ++++++--
 crates/fonts/README.md         |  7 ++++
 crates/fonts/src/pdf.rs        | 58 ++++++++++++++++++++++++++++++----
 parity/acrobat-features.toml   |  4 +--
 6 files changed, 97 insertions(+), 11 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 3d47c83c..40153a43 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -998,7 +998,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("text_edit", "Edit text", "Replace the text of one paragraph (paragraph, from text_paragraphs: rewrapped to the paragraph's width with its line spacing) or one line (line, from text_lines) in place, keeping position, size and colour. For a paragraph, also change its formatting: font (helvetica, times, courier) with bold/italic, size (points), color (#rrggbb), align (left, center, right, justify), underline, line_spacing (× size), char_spacing (points) and scale (horizontal, percent), or move it (dx, dy in points; up is +dy) and rewrap it to a new width (points); text may then be omitted. Its own font is reused when it can show every character; otherwise the line is set in Helvetica (the result shows the font used). Text that no available font can show is refused. Undoable.")
+        t("text_edit", "Edit text", "Replace the text of one paragraph (paragraph, from text_paragraphs: rewrapped to the paragraph's width with its line spacing) or one line (line, from text_lines) in place, keeping position, size and colour. For a paragraph, also change its formatting: font (helvetica, times, courier) with bold/italic, size (points), color (#rrggbb), align (left, center, right, justify), underline, line_spacing (× size), char_spacing (points) and scale (horizontal, percent), or move it (dx, dy in points; up is +dy) and rewrap it to a new width (points); text may then be omitted. Its own font is reused when it can show every character; otherwise a standard font or the Japanese Type 3 fallback is used (the result shows the font used). The Japanese fallback does not yet preserve the source's family or weight. Text that no available font can show is refused. Undoable.")
             .cmd("edit.edit_text")
             .with(schema(
                 json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "line": { "type": "integer", "minimum": 1 },
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index a48e9647..0ca8ad2e 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -304,6 +304,30 @@ fn japanese_line_uses_unicode_type3_fallback() {
     assert_eq!(text::text_lines(&reopened, 0).unwrap()[0].text, replacement);
 }
 
+#[test]
+fn japanese_fallback_reports_the_face_after_save_and_reopen() {
+    if without_craft_fonts("japanese_fallback_reports_the_face_after_save_and_reopen") {
+        return;
+    }
+    let face = pdfcraft_fonts::document_japanese_font().unwrap();
+    let expected = format!("{}-{}", face.family, face.style).replace(' ', "");
+    for paragraph in [false, true] {
+        let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+        let replacement = "見本商会　御中";
+        if paragraph {
+            text::replace_block(&mut doc, 0, 0, replacement).unwrap();
+        } else {
+            text::replace_line(&mut doc, 0, 0, replacement).unwrap();
+        }
+        for d in [&doc, &reopen(&doc)] {
+            let lines = text::text_lines(d, 0).unwrap();
+            assert_eq!(lines[0].text, replacement);
+            assert_eq!(lines[0].base_font, expected, "report the real fallback face, not an empty BaseFont");
+            assert_eq!(text::text_blocks(d, 0).unwrap()[0].base_font, expected);
+        }
+    }
+}
+
 #[test]
 fn japanese_paragraph_uses_unicode_type3_fallback() {
     if without_craft_fonts("japanese_paragraph_uses_unicode_type3_fallback") {
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index ff559cf2..ee749980 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -27,7 +27,7 @@ pub struct TextLine {
     pub text: String,
     /// Its box in user space.
     pub rect: [f64; 4],
-    /// The font's resource name and `/BaseFont`, and its size in text space.
+    /// The font's resource name and `/BaseFont` (or Type 3 descriptor's `/FontName`), and its size in text space.
     pub font: String,
     pub base_font: String,
     pub size: f64,
@@ -569,7 +569,8 @@ fn no_japanese_font() -> EditError {
 }
 
 fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str) -> Result<Type3Fallback, EditError> {
-    let family = pdfcraft_fonts::document_japanese_font().ok_or_else(no_japanese_font)?.family;
+    let face = pdfcraft_fonts::document_japanese_font().ok_or_else(no_japanese_font)?;
+    let family = face.family;
     let mut chars = Vec::new();
     for ch in text.chars() {
         if !chars.contains(&ch) {
@@ -614,6 +615,14 @@ fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str) -> Result<Ty
     font.set(b"Type".to_vec(), Object::name("Font"));
     font.set(b"Subtype".to_vec(), Object::name("Type3"));
     font.set(b"Name".to_vec(), Object::name("PCJapanese"));
+    let mut descriptor = Dict::new();
+    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+    descriptor.set(b"FontName".to_vec(), Object::name(&format!("{}-{}", face.family, face.style).replace(' ', "")));
+    descriptor.set(b"FontFamily".to_vec(), Object::String(PdfString::literal(face.family.as_bytes().to_vec())));
+    descriptor.set(b"Flags".to_vec(), Object::Int(if face.family.contains("Mincho") { 6 } else { 4 }));
+    descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
+    // PDF 1.7 tables 5.9 and 5.19: a Type 3 descriptor is indirect; Ascent/Descent may be omitted.
+    font.set(b"FontDescriptor".to_vec(), Object::Ref(doc.add(Object::Dict(descriptor))));
     font.set(b"FontBBox".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(-300), Object::Int(1000), Object::Int(1000)]));
     font.set(
         b"FontMatrix".to_vec(),
diff --git a/crates/fonts/README.md b/crates/fonts/README.md
index 6f3056dc..6a34a187 100644
--- a/crates/fonts/README.md
+++ b/crates/fonts/README.md
@@ -30,6 +30,13 @@ set). Without that variable `CRAFT_FONTS` is empty and everything below copes:
   `japanese_glyph` returns `GlyphError::NoFont` and the editor reports a clear error.
 - `SHIPPORI_MINCHO`: Shippori Mincho's bytes, or `None`.
 
+Generated Japanese Type 3 fonts record the fallback face's family and style in an indirect
+`FontDescriptor`. `pdf::Metrics::base_font` uses its `FontName` when the Type 3 dictionary has
+no `BaseFont`, so text inspection and edit-tool results identify the fallback after save/reopen.
+The descriptor does not change glyph programs or replace the Type 3 `FontBBox` metrics when
+`Ascent`/`Descent` are omitted (PDF Reference 1.7, tables 5.9 and 5.19). Matching the source
+font's family and weight remains unsupported.
+
 wasm32 builds embed only BIZ UDPGothic Regular and any `Arab` or `Telu` face, to keep the web build small: the web build
 currently has no Chinese face, so Chinese there still shows the replacement glyph.
 Font files are never
diff --git a/crates/fonts/src/pdf.rs b/crates/fonts/src/pdf.rs
index 42c87d18..88b77c06 100644
--- a/crates/fonts/src/pdf.rs
+++ b/crates/fonts/src/pdf.rs
@@ -47,7 +47,7 @@ pub struct Metrics {
     pub composite: bool,
     /// Code → Unicode text.
     unicode: HashMap<u32, String>,
-    /// `/BaseFont`, and whether it is a subset (`ABCDEF+Name`: other glyphs are missing).
+    /// `/BaseFont` (or Type 3 descriptor's `/FontName`), and whether it is a subset (`ABCDEF+Name`: other glyphs are missing).
     pub base_font: String,
     pub subset: bool,
     /// Whether the PDF identifies this face as bold or italic. These come from the
@@ -162,7 +162,16 @@ impl Metrics {
 
     pub fn from_dict(doc: &Document, font: &Dict) -> Self {
         let mut m = Self::read_metrics(doc, font);
-        let base = String::from_utf8_lossy(font.name(b"BaseFont").unwrap_or(b"")).into_owned();
+        let base = font
+            .name(b"BaseFont")
+            .map(|name| String::from_utf8_lossy(name).into_owned())
+            .or_else(|| {
+                (font.name(b"Subtype") == Some(b"Type3"))
+                    .then(|| dict(doc, font.get(b"FontDescriptor")))
+                    .flatten()
+                    .and_then(|d| d.name(b"FontName").map(|name| String::from_utf8_lossy(name).into_owned()))
+            })
+            .unwrap_or_default();
         m.subset = base.len() > 7 && base.as_bytes()[6] == b'+' && base[..6].bytes().all(|b| b.is_ascii_uppercase());
         let (bold, italic) = style_from_name(&base);
         m.bold |= bold;
@@ -263,11 +272,18 @@ impl Metrics {
             let weight = d.get(b"FontWeight").and_then(|v| doc.resolve(v).as_f64()).unwrap_or(0.0);
             m.italic |= flags & 64 != 0 || angle.abs() > 0.1;
             m.bold |= flags & 262_144 != 0 || weight >= 600.0;
-            let a = d.get(b"Ascent").and_then(|v| doc.resolve(v).as_f64()).unwrap_or(0.0) / 1000.0;
-            let de = d.get(b"Descent").and_then(|v| doc.resolve(v).as_f64()).unwrap_or(0.0) / 1000.0;
+            // Type 3 descriptors may omit these metrics; the glyph-space FontBBox still applies.
+            let ascent = d.get(b"Ascent").and_then(|v| doc.resolve(v).as_f64());
+            let descent = d.get(b"Descent").and_then(|v| doc.resolve(v).as_f64());
             // Fonts often claim 0; never shrink the glyph box below a sensible minimum.
-            m.ascent = if a > 0.3 { a.min(1.5) } else { 0.9 };
-            m.descent = if de < -0.05 { de.max(-0.6) } else { -0.25 };
+            if ascent.is_some() || subtype != b"Type3" {
+                let a = ascent.unwrap_or(0.0) / 1000.0;
+                m.ascent = if a > 0.3 { a.min(1.5) } else { 0.9 };
+            }
+            if descent.is_some() || subtype != b"Type3" {
+                let de = descent.unwrap_or(0.0) / 1000.0;
+                m.descent = if de < -0.05 { de.max(-0.6) } else { -0.25 };
+            }
         }
         m
     }
@@ -505,6 +521,36 @@ mod tests {
         d
     }
 
+    #[test]
+    fn type3_descriptor_names_the_font_without_changing_its_metrics() {
+        let mut doc = Document::new_empty();
+        let mut f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type3")),
+                (
+                    "FontMatrix",
+                    Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
+                ),
+                ("FontBBox", Object::Array(vec![Object::Int(0), Object::Int(-300), Object::Int(1000), Object::Int(1000)])),
+            ],
+        );
+        let before = Metrics::from_dict(&doc, &f);
+        let mut descriptor = Dict::new();
+        descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+        descriptor.set(b"FontName".to_vec(), Object::name("ExampleMincho-Regular"));
+        descriptor.set(b"Flags".to_vec(), Object::Int(6));
+        descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
+        let reference = doc.add(Object::Dict(descriptor));
+        f.set(b"FontDescriptor".to_vec(), Object::Ref(reference));
+        let after = Metrics::from_dict(&doc, &f);
+        assert_eq!(after.base_font, "ExampleMincho-Regular");
+        assert_eq!((after.ascent, after.descent, after.scale), (before.ascent, before.descent, before.scale));
+        assert!(!after.bold && !after.italic && !after.subset);
+        f.set(b"BaseFont".to_vec(), Object::name("ExplicitName"));
+        assert_eq!(Metrics::from_dict(&doc, &f).base_font, "ExplicitName", "an explicit BaseFont takes precedence");
+    }
+
     #[test]
     fn simple_fonts_decode_and_encode_through_their_encoding() {
         let mut doc = Document::new_empty();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 0da89682..647ddbf1 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1806,8 +1806,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_edit"]
-evidence = ["crates/edit/src/tests.rs::japanese_paragraph_keeps_ideographic_spaces", "crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/editing.rs::editing_existing_text_in_place", "crates/automation/tests/automation.rs::editing_existing_text_through_tools"]
-notes = "edited paragraphs are rewrapped to the box width with the font's own advance widths and the original line spacing, starting at the original text matrix; text state and fill colour restored after; a single line grows to the right margin; U+3000 ideographic spaces are preserved (including paragraph edges and repeated spaces); Japanese font-style fallback remains limited (#184)"
+evidence = ["crates/edit/src/tests.rs::japanese_fallback_reports_the_face_after_save_and_reopen", "crates/edit/src/tests.rs::japanese_paragraph_keeps_ideographic_spaces", "crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/editing.rs::editing_existing_text_in_place", "crates/automation/tests/automation.rs::editing_existing_text_through_tools"]
+notes = "edited paragraphs are rewrapped to the box width with the font's own advance widths and the original line spacing, starting at the original text matrix; text state and fill colour restored after; a single line grows to the right margin; U+3000 ideographic spaces are preserved (including paragraph edges and repeated spaces); Japanese Type 3 fallback reports its face through FontDescriptor/FontName after editing and save/reopen; source family/weight matching remains limited (#184)"
 
 [[feature]]
 id = "edit.text-move-resize"

From d4d2e832738441de4b14722c1c4dff92f394f181 Mon Sep 17 00:00:00 2001
From: Books <sabaksa11@gmail.com>
Date: Fri, 9 Oct 2026 12:03:30 +1100
Subject: [PATCH 032/149] FDF: replies and review status keep their parent
 comment (fixes #333) (#388)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

FDF export dropped /IRT, so a note's replies and its review-status reply
imported as unrelated comments. Each comment is now an indirect object of
the FDF (with a cross-reference table), and a reply's /IRT points at its
parent's object there, as ISO 32000-2 §12.7.8.3.1 allows. Import maps the
FDF objects to the placed comments and links replies in a second pass,
falling back to a parent of the same /NM already in the document.

FDFs with direct comment dictionaries still import. Self-references,
missing parents and cycles are ignored without panicking.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/xfdf/src/lib.rs   | 110 ++++++++++++++++++++++++++++-----------
 crates/xfdf/src/tests.rs |  72 +++++++++++++++++++++++++
 2 files changed, 153 insertions(+), 29 deletions(-)

diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs
index c41f8da2..e52e2318 100644
--- a/crates/xfdf/src/lib.rs
+++ b/crates/xfdf/src/lib.rs
@@ -13,6 +13,7 @@
 
 use std::collections::HashMap;
 use std::fmt::Write as _;
+use std::io::Write as _;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString};
 use pdfcraft_forms::{FieldKind, FieldValue};
@@ -350,9 +351,13 @@ fn pdf_string(s: &str) -> Vec<u8> {
     v
 }
 
-/// FDF with field values and/or comments (direct objects only; appearances are not carried).
+/// FDF with field values and/or comments (appearances are not carried). Each comment is an
+/// indirect object of the FDF, so a reply's `/IRT` can point at its parent's object there
+/// (§12.7.8.3.1); nothing else refers back into the source document.
 pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> Vec<u8> {
     let mut body: Vec<u8> = b"<< /FDF << ".to_vec();
+    // Comment dictionaries, written after the root as objects 2, 3, …
+    let mut annots: Vec<Dict> = Vec::new();
     if fields {
         body.extend_from_slice(b"/Fields [");
         for f in pdfcraft_forms::fields(doc) {
@@ -377,44 +382,71 @@ pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> V
         body.extend_from_slice(b"] ");
     }
     if comments {
-        body.extend_from_slice(b"/Annots [");
+        // Every exported comment with its source reference, numbered in export order.
+        let mut picked: Vec<(Option<ObjRef>, Dict, usize)> = Vec::new();
         for (pi, p) in pdfcraft_model::pages(doc).iter().enumerate() {
             for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
-                let Some(mut d) = doc.resolve(&a).as_dict().cloned() else { continue };
-                let Some(sub) = d.name(b"Subtype") else { continue };
-                if !SUBTYPES.iter().any(|(s, _)| s.as_bytes() == sub) {
-                    continue;
+                let Some(d) = doc.resolve(&a).as_dict().cloned() else { continue };
+                if d.name(b"Subtype").is_some_and(|sub| SUBTYPES.iter().any(|(s, _)| s.as_bytes() == sub)) {
+                    picked.push((a.as_ref(), d, pi));
                 }
-                // Only direct values travel: references into this file would dangle.
-                for k in [&b"P"[..], b"AP", b"Popup", b"IRT", b"Parent", b"FS", b"Sound"] {
-                    d.remove(k);
-                }
-                let keys: Vec<Vec<u8>> = d.iter().filter(|(_, v)| matches!(v, Object::Ref(_))).map(|(k, _)| k.clone()).collect();
-                for k in keys {
-                    let Some(o) = d.get(&k) else { continue };
-                    let v = (*doc.resolve(o)).clone();
-                    if matches!(v, Object::Stream(_)) {
-                        d.remove(&k);
-                    } else {
-                        d.set(k, v);
-                    }
-                }
-                d.set(b"Page".to_vec(), Object::Int(pi as i64));
-                pdfcraft_cos::serialize(&Object::Dict(d), &mut body);
-                body.push(b' ');
             }
         }
+        let numbers: HashMap<ObjRef, u32> =
+            picked.iter().enumerate().filter_map(|(i, (r, _, _))| Some(((*r)?, u32::try_from(i).ok()?.checked_add(2)?))).collect();
+        for (_, mut d, pi) in picked {
+            // A reply points at its parent's object in this FDF; a parent that isn't exported
+            // leaves the reply unthreaded.
+            let irt = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| numbers.get(&r)).copied();
+            // Only direct values travel: references into this file would dangle.
+            for k in [&b"P"[..], b"AP", b"Popup", b"IRT", b"Parent", b"FS", b"Sound"] {
+                d.remove(k);
+            }
+            let keys: Vec<Vec<u8>> = d.iter().filter(|(_, v)| matches!(v, Object::Ref(_))).map(|(k, _)| k.clone()).collect();
+            for k in keys {
+                let Some(o) = d.get(&k) else { continue };
+                let v = (*doc.resolve(o)).clone();
+                if matches!(v, Object::Stream(_)) {
+                    d.remove(&k);
+                } else {
+                    d.set(k, v);
+                }
+            }
+            if let Some(num) = irt {
+                d.set(b"IRT".to_vec(), Object::Ref(ObjRef::new(num, 0)));
+            }
+            d.set(b"Page".to_vec(), Object::Int(pi as i64));
+            annots.push(d);
+        }
+        body.extend_from_slice(b"/Annots [");
+        for i in 0..annots.len() {
+            let _ = write!(body, "{} 0 R ", i + 2);
+        }
         body.extend_from_slice(b"] ");
     }
     body.extend_from_slice(b"/F ");
     body.extend(pdf_string(file));
     body.extend_from_slice(b" >> >>");
-    let mut out = b"%FDF-1.2\n%\xE2\xE3\xCF\xD3\n1 0 obj\n".to_vec();
+    let mut out = b"%FDF-1.2\n%\xE2\xE3\xCF\xD3\n".to_vec();
+    let mut offsets = Vec::with_capacity(annots.len() + 1);
+    offsets.push(out.len());
+    out.extend_from_slice(b"1 0 obj\n");
     out.extend(body);
-    out.extend_from_slice(b"\nendobj\ntrailer\n<< /Root 1 0 R >>\n%%EOF\n");
+    out.extend_from_slice(b"\nendobj\n");
+    for (i, d) in annots.into_iter().enumerate() {
+        offsets.push(out.len());
+        let _ = writeln!(out, "{} 0 obj", i + 2);
+        pdfcraft_cos::serialize(&Object::Dict(d), &mut out);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    let _ = write!(out, "xref\n0 {}\n0000000000 65535 f \n", offsets.len() + 1);
+    for o in offsets {
+        let _ = writeln!(out, "{o:010} 00000 n ");
+    }
+    let _ = write!(out, "trailer\n<< /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n");
     out
 }
-
 /// The XML element name for a field name (letters, digits, `_`, `-`, `.`).
 fn xml_name(name: &str) -> String {
     let mut s: String = name.chars().map(|c| if c.is_alphanumeric() || matches!(c, '_' | '-' | '.') { c } else { '_' }).collect();
@@ -817,10 +849,16 @@ fn import_fdf(doc: &mut Document, bytes: &[u8]) -> Result<Report, DataError> {
     if let Some(list) = body.get(b"Fields").map(|f| fdf.resolve(f)).and_then(|f| f.as_array().cloned()) {
         walk_fdf(&fdf, &list, "", &mut values, 0);
     }
-    // Comments.
+    // Comments: parents first, then replies (whose /IRT needs the parent's new reference).
     let pages: Vec<ObjRef> = pdfcraft_model::pages(doc).iter().map(|p| p.obj).collect();
+    let mut placed: HashMap<ObjRef, ObjRef> = HashMap::new();
+    let mut later: Vec<(ObjRef, Option<ObjRef>, Option<String>)> = Vec::new();
     for a in body.get(b"Annots").map(|a| fdf.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
-        let Object::Dict(mut d) = deep(&fdf, &a, 0) else { continue };
+        let Some(mut src) = fdf.resolve(&a).as_dict().cloned() else { continue };
+        // The parent is another comment: link it below rather than copying it in.
+        let irt = src.get(b"IRT").cloned();
+        src.remove(b"IRT");
+        let Object::Dict(mut d) = deep(&fdf, &Object::Dict(src), 0) else { continue };
         let Some(page) = d.get(b"Page").and_then(Object::as_int).and_then(|p| usize::try_from(p).ok()).and_then(|p| pages.get(p).copied()) else {
             continue;
         };
@@ -829,9 +867,23 @@ fn import_fdf(doc: &mut Document, bytes: &[u8]) -> Result<Report, DataError> {
         }
         d.remove(b"Page");
         d.set(b"P".to_vec(), Object::Ref(page));
-        place(doc, page, d)?;
+        let r = place(doc, page, d)?;
+        if let Some(fr) = a.as_ref() {
+            placed.insert(fr, r);
+        }
+        if let Some(irt) = irt {
+            let parent_name = fdf.resolve(&irt).as_dict().and_then(|p| text_of(&fdf, p, b"NM"));
+            later.push((r, irt.as_ref(), parent_name));
+        }
         report.comments += 1;
     }
+    for (r, parent_obj, parent_name) in later {
+        // The parent imported from this file, else one already in the document with its name.
+        let parent = parent_obj.and_then(|p| placed.get(&p).copied()).or_else(|| parent_name.and_then(|nm| find_by_name(doc, &nm)));
+        if let Some(parent) = parent.filter(|p| *p != r) {
+            doc.update_dict(r, |d| d.set(b"IRT".to_vec(), Object::Ref(parent)))?;
+        }
+    }
     apply_values(doc, &values, &mut report);
     Ok(report)
 }
diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index 07d079a5..10b17981 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -129,6 +129,78 @@ fn fdf_round_trips_values_and_comments() {
     assert_eq!(values(&dst), values(&src));
     assert!(r.comments >= 3, "{r:?}");
     assert!(summaries(&dst).iter().any(|s| s.contents.as_deref() == Some("scribble")));
+    assert_eq!(comment_view(&dst), comment_view(&src), "replies keep their thread");
+}
+
+/// Who each comment replies to, by name, with its review state.
+fn threads(doc: &Document) -> Vec<(Option<String>, Option<String>, Option<String>)> {
+    summaries(doc).into_iter().map(|s| (s.name, s.in_reply_to, s.state)).collect()
+}
+
+/// #333: a note with two replies and an Accepted review status keeps its thread through FDF.
+#[test]
+fn fdf_keeps_replies_and_review_status_on_their_note() {
+    let mut src = blank();
+    let meta = |id: &str| Meta { date: Some("D:20261002120000Z".into()), id: id.into() };
+    let note = Shape::Note { at: [100.0, 100.0], icon: pdfcraft_annot::NoteIcon::Comment };
+    add_annotation(
+        &mut src,
+        &NewAnnotation { page: 1, style: Style::default_for(&note), shape: note, contents: "Literal Note".into(), author: "Alpha".into() },
+        &meta("note"),
+    )
+    .unwrap();
+    let index = summaries(&src).iter().find(|s| s.subtype == "Text").map(|s| s.index).unwrap();
+    add_reply(&mut src, 1, index, "Reply One", "Beta", &meta("one")).unwrap();
+    add_reply(&mut src, 1, index, "Reply Two", "Gamma", &meta("two")).unwrap();
+    pdfcraft_annot::set_review_state(&mut src, 1, index, pdfcraft_annot::ReviewState::Accepted, "Review", &meta("status")).unwrap();
+    let want = threads(&src);
+    assert_eq!(want.iter().filter(|t| t.1.as_deref() == Some("note")).count(), 3, "{want:?}");
+
+    let fdf = export_fdf(&src, true, false, "notes.pdf");
+    // Every cross-reference entry points at its object (other readers trust the table).
+    let tail = std::str::from_utf8(&fdf[fdf.windows(5).position(|w| w == b"xref\n").unwrap()..]).unwrap();
+    let xref: usize = tail.lines().skip_while(|l| *l != "startxref").nth(1).unwrap().parse().unwrap();
+    assert!(fdf[xref..].starts_with(b"xref\n0 6\n"), "{tail}");
+    for (num, line) in tail.lines().skip(3).take(5).enumerate() {
+        let at: usize = line[..10].parse().unwrap();
+        assert!(fdf[at..].starts_with(format!("{} 0 obj\n", num + 1).as_bytes()), "object {}: {line}", num + 1);
+    }
+    let mut dst = blank();
+    assert_eq!(import(&mut dst, &fdf).unwrap().comments, 4);
+    assert_eq!(threads(&dst), want);
+    assert_eq!(comment_view(&dst), comment_view(&src));
+    // Importing again replaces the thread instead of duplicating or detaching it.
+    import(&mut dst, &fdf).unwrap();
+    assert_eq!(threads(&dst), want);
+}
+
+/// FDFs written before #333 (direct comment dictionaries, no /IRT) still import.
+#[test]
+fn fdf_with_direct_comments_still_imports() {
+    let fdf = b"%FDF-1.2\n1 0 obj\n<< /FDF << /Annots [<< /Type /Annot /Subtype /Text /Rect [10 10 30 30] /Contents (old) /NM (a) /Page 0 >>] >> >>\nendobj\ntrailer\n<< /Root 1 0 R >>\n%%EOF\n";
+    let mut dst = blank();
+    assert_eq!(import(&mut dst, fdf).unwrap().comments, 1);
+    assert_eq!(threads(&dst), vec![(Some("a".into()), None, None)]);
+}
+
+/// /IRT pointing at itself, at a missing object, at a non-comment or in a cycle neither panics
+/// nor loops; only a real parent is linked.
+#[test]
+fn hostile_fdf_reply_parents_are_ignored() {
+    let fdf = b"%FDF-1.2\n1 0 obj\n<< /FDF << /Annots [2 0 R 3 0 R 4 0 R 5 0 R 6 0 R] >> >>\nendobj\n\
+2 0 obj\n<< /Subtype /Text /Rect [0 0 9 9] /NM (self) /IRT 2 0 R /Page 0 >>\nendobj\n\
+3 0 obj\n<< /Subtype /Text /Rect [0 0 9 9] /NM (missing) /IRT 99 0 R /Page 0 >>\nendobj\n\
+4 0 obj\n<< /Subtype /Text /Rect [0 0 9 9] /NM (cycle-a) /IRT 5 0 R /Page 0 >>\nendobj\n\
+5 0 obj\n<< /Subtype /Text /Rect [0 0 9 9] /NM (cycle-b) /IRT 4 0 R /Page 0 >>\nendobj\n\
+6 0 obj\n<< /Subtype /Text /Rect [0 0 9 9] /NM (number) /IRT 42 /Page 99 >>\nendobj\n\
+trailer\n<< /Root 1 0 R >>\n%%EOF\n";
+    let mut dst = blank();
+    assert_eq!(import(&mut dst, fdf).unwrap().comments, 4);
+    let t = threads(&dst);
+    let parent = |nm: &str| t.iter().find(|x| x.0.as_deref() == Some(nm)).and_then(|x| x.1.clone());
+    assert_eq!(parent("self"), None);
+    assert_eq!(parent("missing"), None);
+    assert_eq!((parent("cycle-a").as_deref(), parent("cycle-b").as_deref()), (Some("cycle-b"), Some("cycle-a")));
 }
 
 #[test]

From 9c63f3e8f2148eac2146d9aa6490f67e3b535250 Mon Sep 17 00:00:00 2001
From: sanyamsingh001 <sanyamsingh001@duck.com>
Date: Fri, 9 Oct 2026 01:37:09 +0000
Subject: [PATCH 033/149] fix(cli): validate page positions and preserve
 command results (M13) (#391)

Reject invalid page positions before input I/O and keep diagnostic stderr
failures from overriding rendering, text errors or MCP startup. Preserve
real file and protocol output failures and upstream compact MCP behavior.

Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 apps/pdfcraft-cli/src/main.rs     |  34 ++++++--
 apps/pdfcraft-cli/tests/edit.rs   |  88 ++++++++++++++++++++
 apps/pdfcraft-cli/tests/stderr.rs | 132 ++++++++++++++++++++++++++++++
 apps/pdfcraft-cli/tests/text.rs   | 114 ++++++++++++++++++++++++++
 4 files changed, 360 insertions(+), 8 deletions(-)
 create mode 100644 apps/pdfcraft-cli/tests/stderr.rs

diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index 3c05c0c4..3fe28824 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -176,6 +176,22 @@ fn info(args: &[String]) -> Result<(), CliError> {
 
 fn text(args: &[String]) -> Result<(), CliError> {
     let path = *positional(args).first().ok_or("text: missing file")?;
+    let mut selected_page = None;
+    // Validate every supplied value before reading, retaining the first valid selection.
+    let mut options = args.iter();
+    while let Some(option) = options.next() {
+        if option == "--page" {
+            let page = options
+                .next()
+                .and_then(|value| value.parse::<usize>().ok())
+                .filter(|page| *page > 0)
+                .ok_or("bad --page: expected a positive page number")?;
+            selected_page.get_or_insert(page - 1);
+        } else if option.starts_with("--") {
+            // Match positional(): an option's operand is not itself another option.
+            options.next();
+        }
+    }
     let password = flag(args, "--password");
     let bytes = read(path)?;
     let mut r = PageRenderer::new(bytes.clone(), RenderConfig { password: password.map(Arc::from), ..Default::default() });
@@ -188,15 +204,15 @@ fn text(args: &[String]) -> Result<(), CliError> {
             return Err("text: the document could not be parsed".into());
         }
     }
-    let pages: Vec<usize> = match flag(args, "--page") {
-        Some(p) => vec![p.parse::<usize>().map_err(|_| "bad --page")?.saturating_sub(1)],
+    let pages: Vec<usize> = match selected_page {
+        Some(page) => vec![page],
         None => (0..r.page_count()).collect(),
     };
     let mut failed: Vec<usize> = Vec::new();
     for (n, p) in pages.iter().enumerate() {
         let out = r.render(RenderRequest { page: *p, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0 });
         if let Some(e) = out.error {
-            eprintln!("page {}: {e}", p + 1);
+            let _ = writeln!(std::io::stderr().lock(), "page {}: {e}", p + 1);
             failed.push(p + 1);
             continue;
         }
@@ -263,11 +279,11 @@ fn edit(args: &[String]) -> Result<(), CliError> {
             "--move" => {
                 let (pages, to) = value.split_once(':').ok_or("--move PAGES:TO")?;
                 let to: usize = to.parse().map_err(|_| "bad target")?;
-                edits.push(Edit::MovePages { pages: page_list(pages)?, to: to.saturating_sub(1) });
+                edits.push(Edit::MovePages { pages: page_list(pages)?, to: to.checked_sub(1).ok_or("--move target must be at least 1")? });
             }
             "--insert-blank" => {
                 let at: usize = value.parse().map_err(|_| "bad position")?;
-                edits.push(Edit::InsertBlankPage { at: at.saturating_sub(1), width: 612.0, height: 792.0 });
+                edits.push(Edit::InsertBlankPage { at: at.checked_sub(1).ok_or("--insert-blank must be at least 1")?, width: 612.0, height: 792.0 });
             }
             "--title" => edits.push(Edit::SetInfo { key: "Title".into(), value: value.into() }),
             "--author" => edits.push(Edit::SetInfo { key: "Author".into(), value: value.into() }),
@@ -338,6 +354,7 @@ fn split(args: &[String]) -> Result<(), CliError> {
 fn render(args: &[String]) -> Result<(), CliError> {
     let path = *positional(args).first().ok_or("render: missing file")?;
     let page: usize = flag(args, "--page").unwrap_or("1").parse().map_err(|_| "bad --page")?;
+    let page_index = page.checked_sub(1).ok_or("--page must be at least 1")?;
     let dpi: f32 = flag(args, "--dpi").unwrap_or("96").parse().map_err(|_| "bad --dpi")?;
     let out = flag(args, "--out").ok_or("render: missing --out (.png, .jpg, .tif or .pam)")?;
     // The file is what its name says (#248): a `.png` used to get a netpbm PAM stream.
@@ -349,7 +366,7 @@ fn render(args: &[String]) -> Result<(), CliError> {
         _ => return Err(format!("render: --out {out}: use a .png, .jpg, .tif or .pam name").into()),
     };
     let mut r = PageRenderer::new(read(path)?, RenderConfig { password: flag(args, "--password").map(Arc::from), ..Default::default() });
-    let p = r.render(RenderRequest { page: page.saturating_sub(1), kind: RequestKind::Pixels, tile: None, scale: dpi / 72.0, tag: 0 });
+    let p = r.render(RenderRequest { page: page_index, kind: RequestKind::Pixels, tile: None, scale: dpi / 72.0, tag: 0 });
     if let Some(e) = p.error {
         return Err(e.into());
     }
@@ -363,7 +380,7 @@ fn render(args: &[String]) -> Result<(), CliError> {
         }
     };
     std::fs::write(out, bytes).map_err(|e| format!("{out}: {e}"))?;
-    eprintln!("rendered page {page} at {dpi} dpi: {}×{} px in {} ms", p.width, p.height, p.millis);
+    let _ = writeln!(std::io::stderr().lock(), "rendered page {page} at {dpi} dpi: {}×{} px in {} ms", p.width, p.height, p.millis);
     Ok(())
 }
 
@@ -582,7 +599,8 @@ fn run(args: &[String]) -> Result<(), CliError> {
 fn mcp(args: &[String]) -> Result<(), CliError> {
     let compact = args.iter().any(|a| a == "--compact");
     let mut server = pdfcraft_automation::mcp::McpServer::new(automation(args)?).with_compact(compact);
-    eprintln!(
+    let _ = writeln!(
+        std::io::stderr().lock(),
         "pdfcraft-cli: MCP server on stdio (protocol {}{}); close stdin to stop",
         pdfcraft_automation::mcp::PROTOCOL_VERSIONS[0],
         if compact { ", compact tool list" } else { "" }
diff --git a/apps/pdfcraft-cli/tests/edit.rs b/apps/pdfcraft-cli/tests/edit.rs
index 8cd47cfb..15fdb68c 100644
--- a/apps/pdfcraft-cli/tests/edit.rs
+++ b/apps/pdfcraft-cli/tests/edit.rs
@@ -91,3 +91,91 @@ fn the_documented_options_still_edit_and_save() {
         assert_eq!(info.title.as_deref(), Some("Rotated"), "{name}");
     }
 }
+
+mod one_based_arguments {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    struct TestDir(PathBuf);
+    impl TestDir {
+        fn new() -> Self {
+            static NEXT: AtomicU64 = AtomicU64::new(0);
+            for _ in 0..128 {
+                let path =
+                    std::env::temp_dir().join(format!("pdfcraft-cli-one-based-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+                match std::fs::create_dir(&path) {
+                    Ok(()) => return Self(path),
+                    Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                    Err(e) => panic!("cannot create test directory: {e}"),
+                }
+            }
+            panic!("cannot reserve test directory");
+        }
+    }
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn zero_render_page_and_edit_positions_fail_before_io() {
+        let dir = TestDir::new();
+        let source = fixture();
+        std::fs::write(dir.0.join("input.pdf"), &source).unwrap();
+        for input in ["input.pdf", "missing.pdf"] {
+            for destination in ["output.pam", "new.pam", "input.pdf"] {
+                std::fs::write(dir.0.join("output.pam"), b"keep destination").unwrap();
+                for (command, option, value, diagnostic) in [
+                    ("render", "--page", "0", "--page must be at least 1"),
+                    ("edit", "--move", "1:0", "--move target must be at least 1"),
+                    ("edit", "--insert-blank", "0", "--insert-blank must be at least 1"),
+                ] {
+                    let out = Command::new(BIN).current_dir(&dir.0).args([command, input, "--out", destination, option, value]).output().unwrap();
+                    assert_eq!(out.status.code(), Some(1), "{command} {input} {option} {value}");
+                    assert_eq!(out.stderr, format!("pdfcraft-cli: {diagnostic}\n").as_bytes());
+                    assert!(out.stdout.is_empty());
+                    assert_eq!(std::fs::read(dir.0.join("input.pdf")).unwrap(), source);
+                    assert_eq!(std::fs::read(dir.0.join("output.pam")).unwrap(), b"keep destination");
+                    assert!(!dir.0.join("new.pam").exists());
+                    assert!(!dir.0.join("missing.pdf").exists());
+                }
+            }
+        }
+        assert_eq!(std::fs::read_dir(&dir.0).unwrap().count(), 2);
+    }
+
+    #[test]
+    fn first_render_page_move_target_and_insertion_position_remain_usable() {
+        let dir = TestDir::new();
+        let source = fixture();
+        std::fs::write(dir.0.join("input.pdf"), &source).unwrap();
+        for output in ["page.pam", "page.png"] {
+            let out =
+                Command::new(BIN).current_dir(&dir.0).args(["render", "input.pdf", "--page", "1", "--dpi", "18", "--out", output]).output().unwrap();
+            assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+            let bytes = std::fs::read(dir.0.join(output)).unwrap();
+            if output.ends_with(".pam") {
+                let header = b"P7\nWIDTH 50\nHEIGHT 75\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n";
+                assert!(bytes.starts_with(header));
+                assert_eq!(bytes.len(), header.len() + 50 * 75 * 4);
+            } else {
+                assert!(bytes.starts_with(b"\x89PNG\r\n\x1a\n"));
+                assert_eq!(u32::from_be_bytes(bytes[16..20].try_into().unwrap()), 50);
+                assert_eq!(u32::from_be_bytes(bytes[20..24].try_into().unwrap()), 75);
+            }
+        }
+        let out = Command::new(BIN)
+            .current_dir(&dir.0)
+            .args(["edit", "input.pdf", "--out", "edited.pdf", "--move", "1:1", "--rotate", "1:90", "--insert-blank", "1"])
+            .output()
+            .unwrap();
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+        assert!(out.stdout.is_empty() && out.stderr.is_empty());
+        let info = pdfcraft_render::inspect(std::sync::Arc::new(std::fs::read(dir.0.join("edited.pdf")).unwrap()), None).unwrap();
+        assert_eq!(info.pages.len(), 2);
+        assert_eq!((info.pages[0].width, info.pages[0].height, info.pages[0].rotation), (612.0, 792.0, 0));
+        assert_eq!((info.pages[1].width, info.pages[1].height, info.pages[1].rotation), (300.0, 200.0, 90));
+        assert_eq!(std::fs::read(dir.0.join("input.pdf")).unwrap(), source);
+    }
+}
diff --git a/apps/pdfcraft-cli/tests/stderr.rs b/apps/pdfcraft-cli/tests/stderr.rs
new file mode 100644
index 00000000..9991bc1c
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/stderr.rs
@@ -0,0 +1,132 @@
+//! Diagnostic stderr failures must not replace a command's real result.
+#![cfg(target_os = "linux")]
+
+use std::io::Write as _;
+use std::path::{Path, PathBuf};
+use std::process::{Child, Command, Output, Stdio};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{Duration, Instant};
+
+const BIN: &str = env!("CARGO_BIN_EXE_pdfcraft-cli");
+
+struct Scratch(PathBuf);
+impl Scratch {
+    fn new() -> Self {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        for _ in 0..128 {
+            let path = std::env::temp_dir().join(format!("pdfcraft-stderr-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+            match std::fs::create_dir(&path) {
+                Ok(()) => return Self(path),
+                Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                Err(error) => panic!("creating stderr test directory: {error}"),
+            }
+        }
+        panic!("no unused stderr test directory after 128 attempts");
+    }
+}
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+// Only this test's newly spawned child is ever terminated, including assertion unwinding.
+struct OwnedChild(Option<Child>);
+impl Drop for OwnedChild {
+    fn drop(&mut self) {
+        if let Some(child) = &mut self.0 {
+            let _ = child.kill();
+            let _ = child.wait();
+        }
+    }
+}
+fn run(command: &mut Command, input: Option<&str>) -> Output {
+    command.stdin(if input.is_some() { Stdio::piped() } else { Stdio::null() });
+    let mut owned = OwnedChild(Some(command.spawn().unwrap()));
+    if let Some(input) = input {
+        owned.0.as_mut().unwrap().stdin.take().unwrap().write_all(input.as_bytes()).unwrap();
+    }
+    // Every fixture emits only a few short lines, below the pipe capacity.
+    let deadline = Instant::now() + Duration::from_secs(30);
+    while owned.0.as_mut().unwrap().try_wait().unwrap().is_none() {
+        assert!(Instant::now() < deadline, "owned CLI child exceeded thirty seconds");
+        std::thread::sleep(Duration::from_millis(10));
+    }
+    owned.0.take().unwrap().wait_with_output().unwrap()
+}
+fn full() -> Stdio {
+    std::fs::OpenOptions::new().write(true).open("/dev/full").unwrap().into()
+}
+fn render(pdf: &Path, out: &Path, stderr: Stdio) -> Output {
+    run(Command::new(BIN).arg("render").arg(pdf).args(["--page", "1", "--dpi", "18", "--out"]).arg(out).stdout(Stdio::piped()).stderr(stderr), None)
+}
+
+#[test]
+fn failing_diagnostics_preserve_render_success_and_real_text_or_file_errors() {
+    let dir = Scratch::new();
+    let bytes = pdfcraft_engine::Session::new().create_from_text("Diagnostic test", "Ordinary diagnostic text").unwrap();
+    let pdf = dir.0.join("input.pdf");
+    std::fs::write(&pdf, bytes.as_slice()).unwrap();
+    let image_path = dir.0.join("page.pam");
+    let failed_sink = render(&pdf, &image_path, full());
+    assert!(failed_sink.status.success(), "completed render must survive failed diagnostics: {}", failed_sink.status);
+    assert!(failed_sink.stdout.is_empty());
+    let image = std::fs::read(&image_path).unwrap();
+    assert!(image.starts_with(b"P7\nWIDTH ") && image.windows(7).any(|part| part == b"ENDHDR\n"));
+    let ordinary = render(&pdf, &image_path, Stdio::piped());
+    assert!(ordinary.status.success());
+    assert!(String::from_utf8_lossy(&ordinary.stderr).contains("rendered page 1 at 18 dpi"));
+    assert_eq!(std::fs::read(&image_path).unwrap(), image, "diagnostic destination must not change rendered bytes");
+
+    let invalid = run(Command::new(BIN).arg("text").arg(&pdf).args(["--page", "2"]).stdout(Stdio::piped()).stderr(full()), None);
+    assert_eq!(invalid.status.code(), Some(1), "page errors remain normal failures rather than stderr panics");
+    assert!(invalid.stdout.is_empty());
+    let valid = run(Command::new(BIN).arg("text").arg(&pdf).stdout(Stdio::piped()).stderr(full()), None);
+    assert!(valid.status.success());
+    assert!(String::from_utf8_lossy(&valid.stdout).contains("Ordinary diagnostic text"));
+
+    // An existing directory with a supported extension reaches the real file writer.
+    // Using /dev/full as the render path would only test upstream's extension check.
+    let folder = dir.0.join("folder.pam");
+    std::fs::create_dir(&folder).unwrap();
+    std::fs::write(folder.join("keep"), b"sentinel").unwrap();
+    assert_eq!(render(&pdf, &folder, full()).status.code(), Some(1));
+    assert_eq!(std::fs::read(folder.join("keep")).unwrap(), b"sentinel");
+    assert_eq!(std::fs::read(&image_path).unwrap(), image);
+    assert_eq!(std::fs::read(&pdf).unwrap(), bytes.as_slice());
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn failing_startup_diagnostics_preserve_mcp_replies_and_protocol_output_errors() {
+    let requests = [
+        serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "initialize", "params": { "protocolVersion": "2025-06-18" } }),
+        serde_json::json!({ "jsonrpc": "2.0", "id": 2, "method": "ping" }),
+        serde_json::json!({ "jsonrpc": "2.0", "id": 3, "method": "ordinary-unknown-method" }),
+    ];
+    let input = requests.iter().map(|request| format!("{request}\n")).collect::<String>();
+    let output = run(Command::new(BIN).arg("mcp").stdout(Stdio::piped()).stderr(full()), Some(&input));
+    assert!(output.status.success(), "failed startup diagnostics must not stop stdio: {}", output.status);
+    let replies: Vec<serde_json::Value> = String::from_utf8(output.stdout).unwrap().lines().map(|line| serde_json::from_str(line).unwrap()).collect();
+    assert_eq!(replies.len(), 3);
+    assert_eq!(replies[0]["id"], 1);
+    assert_eq!(replies[0]["result"]["protocolVersion"], "2025-06-18");
+    assert_eq!(replies[1]["id"], 2);
+    assert_eq!(replies[1]["result"], serde_json::json!({}));
+    assert_eq!(replies[2]["id"], 3);
+    assert_eq!(replies[2]["error"]["code"], -32601);
+    // Upstream's compact mode still reaches stdio even when its expanded diagnostic fails.
+    let ping = "{\"jsonrpc\":\"2.0\",\"id\":4,\"method\":\"ping\"}\n";
+    for (stderr, diagnostic_expected) in [(full(), false), (Stdio::piped(), true)] {
+        let output = run(Command::new(BIN).args(["mcp", "--compact"]).stdout(Stdio::piped()).stderr(stderr), Some(ping));
+        assert!(output.status.success());
+        let reply: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
+        assert_eq!(reply["id"], 4);
+        assert_eq!(reply["result"], serde_json::json!({}));
+        if diagnostic_expected {
+            assert!(String::from_utf8_lossy(&output.stderr).contains(", compact tool list); close stdin to stop"));
+        }
+    }
+    let output = run(Command::new(BIN).arg("mcp").stdout(full()).stderr(full()), Some("{\"jsonrpc\":\"2.0\",\"id\":4,\"method\":\"ping\"}\n"));
+    assert_eq!(output.status.code(), Some(1), "actual protocol output failure must still fail");
+}
diff --git a/apps/pdfcraft-cli/tests/text.rs b/apps/pdfcraft-cli/tests/text.rs
index c573393b..5ac2e07c 100644
--- a/apps/pdfcraft-cli/tests/text.rs
+++ b/apps/pdfcraft-cli/tests/text.rs
@@ -95,3 +95,117 @@ fn text_of_a_protected_document_with_the_password_succeeds() {
     let stdout = String::from_utf8_lossy(&out.stdout);
     assert!(stdout.contains("Page 1") && stdout.contains("Page 3"), "{stdout}");
 }
+
+mod page_argument_tests {
+    use super::*;
+    use std::path::PathBuf;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    struct PageDir(PathBuf);
+
+    impl PageDir {
+        fn new() -> Self {
+            static NEXT: AtomicU64 = AtomicU64::new(0);
+            for _ in 0..128 {
+                let serial = NEXT.fetch_add(1, Ordering::Relaxed);
+                let path = std::env::temp_dir().join(format!("pdfcraft-page-{}-{serial}", std::process::id()));
+                match std::fs::create_dir(&path) {
+                    Ok(()) => return Self(path),
+                    Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                    Err(error) => panic!("creating page test directory: {error}"),
+                }
+            }
+            panic!("no unused page test directory after 128 attempts");
+        }
+    }
+
+    impl Drop for PageDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn malformed_page_values_fail_before_reading_or_printing_document_text() {
+        let dir = PageDir::new();
+        let path = dir.0.join("three.pdf");
+        let bytes = fixture(3);
+        std::fs::write(&path, &bytes).unwrap();
+        let missing = dir.0.join("missing.pdf");
+        let invalid = [
+            vec!["--page", "0"],
+            vec!["--page", ""],
+            vec!["--page", "bad"],
+            vec!["--page", "-1"],
+            vec!["--page", "1.5"],
+            vec!["--page", "18446744073709551616"],
+            vec!["--page"],
+            vec!["--page", "--password", "unused"],
+            vec!["--page", "2", "--page"],
+        ];
+        for input in [&path, &missing] {
+            for args in &invalid {
+                let out = Command::new(BIN).arg("text").arg(input).args(args).output().unwrap();
+                assert_eq!(out.status.code(), Some(1), "{args:?}: {out:?}");
+                assert!(out.stdout.is_empty(), "{args:?}: no text may be printed");
+                assert_eq!(String::from_utf8(out.stderr).unwrap().trim(), "pdfcraft-cli: bad --page: expected a positive page number");
+                assert_eq!(std::fs::read(&path).unwrap(), bytes);
+                assert!(!missing.exists());
+            }
+        }
+    }
+
+    #[test]
+    fn valid_page_values_preserve_all_page_selection_and_first_duplicate_semantics() {
+        let dir = PageDir::new();
+        let path = dir.0.join("three.pdf");
+        let bytes = fixture(3);
+        std::fs::write(&path, &bytes).unwrap();
+        for (args, expected) in [
+            (vec![], vec!["Page 1", "Page 2", "Page 3"]),
+            (vec!["--page", "1"], vec!["Page 1"]),
+            (vec!["--page", "2"], vec!["Page 2"]),
+            (vec!["--page", "3"], vec!["Page 3"]),
+            (vec!["--page", "2", "--page", "1"], vec!["Page 2"]),
+        ] {
+            let out = Command::new(BIN).arg("text").arg(&path).args(args).output().unwrap();
+            assert!(out.status.success(), "{out:?}");
+            assert!(out.stderr.is_empty());
+            let text = String::from_utf8(out.stdout).unwrap();
+            assert_eq!(text.split('').map(str::trim).collect::<Vec<_>>(), expected);
+            assert_eq!(std::fs::read(&path).unwrap(), bytes);
+        }
+    }
+
+    #[test]
+    fn an_option_shaped_password_is_not_parsed_as_a_page_flag() {
+        let dir = PageDir::new();
+        let source = dir.0.join("three.pdf");
+        let bytes = fixture(3);
+        std::fs::write(&source, &bytes).unwrap();
+        let protected = dir.0.join("protected.pdf");
+        let script = dir.0.join("protect.json");
+        let steps = serde_json::json!([
+            { "tool": "doc_open", "args": { "path": source } },
+            { "tool": "doc_protect", "args": { "doc": 1, "open_password": "--page" } },
+            { "tool": "doc_save", "args": { "doc": 1, "path": protected } },
+        ]);
+        std::fs::write(&script, steps.to_string()).unwrap();
+        let out = Command::new(BIN).args(["run", "--script"]).arg(&script).output().unwrap();
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+        let protected_bytes = std::fs::read(&protected).unwrap();
+        for (args, expected) in [
+            (vec!["--password", "--page"], vec!["Page 1", "Page 2", "Page 3"]),
+            (vec!["--page", "2", "--password", "--page"], vec!["Page 2"]),
+            (vec!["--password", "--page", "--page", "2"], vec!["Page 2"]),
+        ] {
+            let out = Command::new(BIN).arg("text").arg(&protected).args(args).output().unwrap();
+            assert!(out.status.success(), "{out:?}");
+            assert!(out.stderr.is_empty());
+            let text = String::from_utf8(out.stdout).unwrap();
+            assert_eq!(text.split('').map(str::trim).collect::<Vec<_>>(), expected);
+            assert_eq!(std::fs::read(&protected).unwrap(), protected_bytes);
+            assert_eq!(std::fs::read(&source).unwrap(), bytes);
+        }
+    }
+}

From 0afe0b70946b834f07e445401d0232a5deb18337 Mon Sep 17 00:00:00 2001
From: Austen <51180221+aus10d@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:37:22 -0700
Subject: [PATCH 034/149] Keyboard shortcut to enter page number to jump to
 (#393)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* added view.read_mode command

* added view.focus_page_input

* Go to page…: Ctrl+Shift+N / ⇧⌘N (Acrobat's), no indexing, rustfmt, catalog entries

Shift+Y alone (the first proposal) would have typed a capital Y in text fields
on Windows and Linux.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml                    | 18 +++++++++---------
 crates/engine/src/commands.rs       |  1 +
 crates/ui-egui/src/commands.rs      | 11 +++++++++++
 crates/ui-egui/src/i18n/cs.tsv      |  1 +
 crates/ui-egui/src/i18n/es.tsv      |  1 +
 crates/ui-egui/src/i18n/fr.tsv      |  1 +
 crates/ui-egui/src/i18n/ja.tsv      |  1 +
 crates/ui-egui/src/i18n/pt-br.tsv   |  1 +
 crates/ui-egui/src/i18n/ru.tsv      |  1 +
 crates/ui-egui/src/i18n/te.tsv      |  1 +
 crates/ui-egui/src/i18n/zh-hans.tsv |  1 +
 crates/ui-egui/src/i18n/zh-hant.tsv |  1 +
 12 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 5b7db4b3..3a1801a2 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "741e71280fc40ccf711fd8c2d7cf9ad66ceb4305827b2a82b462c2a27af25d92"
+sha256 = "50ec1133889f3a3948a3901a9fa40b3499f3c549b605e55848138483946d74da"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "7e64066dd8d5a872899a1bd19916ee4b3a57effffe54a55d6e0a5777798fc97d"
+sha256 = "3746a7d87fb98c9f3aeb41c63ce50371c42dfebca64b67ccbb599abb36a93ba8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1facd561cbfbfa4f2cc81c783f4ed7675871a3d63724e8b2c0fb9e29550ea4f3"
+sha256 = "2c09a121e493fb123d9f886529f62268119ca580ad5d5300eca61d4a39216827"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "c041497ad777eb4616a204a2fbe78c6bfc38150632450d83d8498f1c573b74eb"
+sha256 = "0ccf62e34424981d5980eeaee8799db2653a4c186807df143326ef9881959006"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e7c4d57500dea64165fe9a356bab10ed1e288bf3a8b1d6ab8377ee642e0fd109"
+sha256 = "0b579afad6e52b98cef5e61e07e238d9cf76cc7f295395f7e1c855400e5fbaf9"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4a8508d6fd385dff2d9214e41719824639c0608e5807c46d32ad2933e679f6e1"
+sha256 = "956753e05b5a9e1d4c4a63ee57667cc9fa5bb95288c3d46c6b15435b83d6ed8d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b2a4bb2fc0eb247cada87f14c8186abf72cd36b7269d173503fcb65383a9439e"
+sha256 = "e8b96edd718a1cd212b7440c4ab100f2555c97dccb0cda289bdb1775d5f3aa61"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d9419953763bcb55a017196d72d28e8e47eb5e9197fd508e348bc047fcb433db"
+sha256 = "136a9ae206c4ee5aad29d248613c568799080b4b3ee9cd197233072ee9a2983a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f8af4c1a71747533dc4b609c495c19c47f9ad6aefe1f470dfcb6440a43f3e55f"
+sha256 = "d2e7114c70da3c52200cf68e9023dc32ff462439795784e49c2ae771531240e2"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index e94691a7..eb53cfd2 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -193,6 +193,7 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("edit.snapshot", "Take a snapshot", EDIT, None, Document, "camera"),
     c("view.full_screen", "Full screen mode", VIEW, Some(Shortcut::cmd("L")), Document, "maximize"),
     c("view.read_mode", "Read mode", VIEW, Some(Shortcut { command: true, shift: false, mac_ctrl: true, key: "H" }), Document, "book-open"),
+    c("view.focus_page_input", "Go to page…", VIEW, Some(Shortcut::cmd_shift("N")), Document, "text-cursor-input"),
     c("view.theme", "Switch light / dark theme", None, None, Nothing, "moon"),
     c("view.theme.system", "Use system setting", None, None, Nothing, "settings"),
     c("view.theme.light", "Light gray", None, None, Nothing, "sun"),
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index b3a86651..6d3f97f9 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -133,6 +133,17 @@ impl PdfCraftApp {
                     self.views[i].open_find();
                 }
             }
+            "view.focus_page_input" => {
+                if let (Some(ctx), Some(view)) = (self.ctx.clone(), active.and_then(|i| self.views.get(i))) {
+                    // The page box in the toolbar (chrome.rs); select its number so typing replaces it.
+                    let id = egui::Id::new("page-input");
+                    ctx.memory_mut(|m| m.request_focus(id));
+                    let mut state = egui::TextEdit::load_state(&ctx, id).unwrap_or_default();
+                    let len = view.page_input.chars().count();
+                    state.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(len))));
+                    state.store(&ctx, id);
+                }
+            }
             "view.palette" => self.palette_open = !self.palette_open,
             layout if crate::canvas::PageLayout::from_command(layout).is_some() => {
                 if let (Some(i), Some(layout)) = (active, crate::canvas::PageLayout::from_command(layout)) {
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 76d0008e..75cf6d50 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -111,3 +111,4 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Vyberte obrázek PNG nebo JPEG (nejvýše 4 MiB). Průhlednost bude zachována.
 	Couldn't import the signature image: {e}	Obrázek podpisu nelze importovat: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Přenosný režim je vypnutý: do složky {folder} nelze zapisovat ({error}). Nastavení se místo toho ukládá do vaší uživatelské složky.
+	Go to page…	Přejít na stránku…
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 828b9c5d..afc29fbc 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1998,3 +1998,4 @@
 	None of those files can be made into a PDF; use PDFs, images or .txt files	Ninguno de esos archivos se puede convertir en PDF; use archivos PDF, imágenes o .txt
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Elija una imagen PNG o JPEG (hasta 4 MiB). Se conserva la transparencia.
 	Couldn't import the signature image: {e}	No se pudo importar la imagen de la firma: {e}
+	Go to page…	Ir a la página…
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 2544324b..64a86273 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2032,3 +2032,4 @@
 	You can pin up to {n} folders. Unpin one first.	Vous pouvez épingler jusqu'à {n} dossiers. Désépinglez-en un d'abord.
 	Pinned {folder} to Home	{folder} épinglé à l'Accueil
 	No recent files	Aucun fichier récent
+	Go to page…	Aller à la page…
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index d45df9bf..ca53e983 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1974,3 +1974,4 @@
 	None of those files can be made into a PDF; use PDFs, images or .txt files	これらのファイルは PDF にできません。PDF、画像、.txt ファイルを使用してください
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG または JPEG 画像を選択してください（最大 4 MiB）。透明度は保持されます。
 	Couldn't import the signature image: {e}	署名画像を読み込めませんでした: {e}
+	Go to page…	ページへ移動…
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 43fc9a60..d9048a96 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -65,3 +65,4 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Escolha uma imagem PNG ou JPEG (até 4 MiB). A transparência é preservada.
 	Couldn't import the signature image: {e}	Não foi possível importar a imagem da assinatura: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	O modo portátil está desativado: não é possível gravar em {folder} ({error}). As configurações ficam na sua pasta de usuário.
+	Go to page…	Ir para a página…
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 2ab48e49..5b91f559 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -1993,3 +1993,4 @@
 	No changes to save	Нет изменений для сохранения
 	Created a PDF from {n} files; left out: {names}	PDF создан из файлов: {n}; пропущены: {names}
 	Created a PDF from the first {n} files	PDF создан из первых файлов: {n}
+	Go to page…	Перейти на страницу…
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index b08744a9..1e381f12 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2018,3 +2018,4 @@ action wizard	Start	ప్రారంభించు
 	Open Recent	ఇటీవలివి తెరువు
 	Pin folder to Home…	ఫోల్డర్‌ను హోమ్‌కు పిన్ చేయి…
 	No recent files	ఇటీవలి ఫైళ్లు లేవు
+	Go to page…	పేజీకి వెళ్లు…
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 37ffbabb..5e4a6a3d 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2043,3 +2043,4 @@
 	None of those files can be made into a PDF; use PDFs, images or .txt files	这些文件都无法转换为 PDF；请使用 PDF、图像或 .txt 文件
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	选择 PNG 或 JPEG 图像（最大 4 MiB）。透明度会保留。
 	Couldn't import the signature image: {e}	无法导入签名图像：{e}
+	Go to page…	转到页面…
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index b5ad89e7..7696480c 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1967,3 +1967,4 @@
 	None of those files can be made into a PDF; use PDFs, images or .txt files	這些檔案都無法轉換為 PDF；請使用 PDF、圖片或 .txt 檔案
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	選擇 PNG 或 JPEG 圖像（最大 4 MiB）。透明度會保留。
 	Couldn't import the signature image: {e}	無法匯入簽名圖像：{e}
+	Go to page…	轉到頁面…

From 3146e8767e020ad5c4f120dceceefbee4d686d0a Mon Sep 17 00:00:00 2001
From: midasdf <205497066+midasdf@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:48:02 +0900
Subject: [PATCH 035/149] M7: preserve Japanese Gothic fallback family and
 weight (#394)

* M7: select real Japanese fallback faces by family and weight

Refs #184. Keep Type 3 font-name reporting separate in #387; missing weights and the small web font input remain explicit limitations.

Assisted-by: OpenAI GPT-6.1 (gpt-6.1-sol)

* Test the Japanese fallback name for a sans source: the Gothic face since #394 matches the source style

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/lib.rs          |  1 +
 crates/automation/src/tools.rs        |  2 +-
 crates/automation/tests/automation.rs | 14 ++++
 crates/edit/src/tests.rs              | 94 +++++++++++++++++++++++++--
 crates/edit/src/text.rs               | 27 ++++----
 crates/fonts/README.md                | 10 ++-
 crates/fonts/src/craft.rs             | 41 +++++++++++-
 crates/fonts/src/lib.rs               |  6 +-
 crates/fonts/src/script.rs            |  6 ++
 9 files changed, 179 insertions(+), 22 deletions(-)

diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index bda8922c..8563e94d 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -420,6 +420,7 @@ impl Automation {
                 let block = self.doc(&a)?.text_blocks(page)[k as usize - 1].clone();
                 let text = a.opt_str("text")?.map(str::to_owned).unwrap_or(block.text);
                 let mut style = pdfcraft_engine::BlockStyle {
+                    bold: a.opt_bool("bold")?,
                     size: a.opt_num("size")?,
                     underline: a.opt_bool("underline")?,
                     line_spacing: a.opt_num("line_spacing")?,
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 40153a43..83d5a411 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -998,7 +998,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("text_edit", "Edit text", "Replace the text of one paragraph (paragraph, from text_paragraphs: rewrapped to the paragraph's width with its line spacing) or one line (line, from text_lines) in place, keeping position, size and colour. For a paragraph, also change its formatting: font (helvetica, times, courier) with bold/italic, size (points), color (#rrggbb), align (left, center, right, justify), underline, line_spacing (× size), char_spacing (points) and scale (horizontal, percent), or move it (dx, dy in points; up is +dy) and rewrap it to a new width (points); text may then be omitted. Its own font is reused when it can show every character; otherwise a standard font or the Japanese Type 3 fallback is used (the result shows the font used). The Japanese fallback does not yet preserve the source's family or weight. Text that no available font can show is refused. Undoable.")
+        t("text_edit", "Edit text", "Replace the text of one paragraph (paragraph, from text_paragraphs: rewrapped to the paragraph's width with its line spacing) or one line (line, from text_lines) in place, keeping position, size and colour. For a paragraph, also change its formatting: font (helvetica, times, courier) with bold/italic, size (points), color (#rrggbb), align (left, center, right, justify), underline, line_spacing (× size), char_spacing (points) and scale (horizontal, percent), or move it (dx, dy in points; up is +dy) and rewrap it to a new width (points); text may then be omitted. Its own font is reused when it can show every character and no font/weight change is requested; otherwise it uses a standard font matching the source style or, for Japanese, real Mincho/Gothic fallback outlines matching the requested/source family and available weight (the result shows the font used). Missing Japanese weights use Regular, not synthetic bold; the small web build has only Gothic Regular. Paragraph bold may be set without font to keep the source family. Text that no available font can show is refused. Undoable.")
             .cmd("edit.edit_text")
             .with(schema(
                 json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "line": { "type": "integer", "minimum": 1 },
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 38f3a1d2..093a3443 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1288,6 +1288,20 @@ fn editing_existing_text_through_tools() {
     assert_eq!(p["lines"].as_array().map(Vec::len), Some(2), "{p}");
 }
 
+#[test]
+fn paragraph_bold_without_font_keeps_the_source_family() {
+    let dir = workdir("paragraph-bold");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 2, "paragraph": 1, "font": "times" }));
+    let bold = ok(&mut a, "text_edit", json!({ "doc": doc, "page": 2, "paragraph": 1, "bold": true }));
+    assert_eq!(bold["paragraph"]["font"], "Times-Bold");
+    let regular = ok(&mut a, "text_edit", json!({ "doc": doc, "page": 2, "paragraph": 1, "bold": false }));
+    assert_eq!(regular["paragraph"]["font"], "Times-Roman");
+    assert_eq!(regular["paragraph"]["text"], "Page 2");
+    assert!(matches!(a.call("text_edit", &json!({ "doc": doc, "page": 2, "paragraph": 1, "bold": "yes" })), Err(ToolError::InvalidArgs(_))));
+}
+
 #[test]
 fn editing_page_images_through_tools() {
     let dir = workdir("page-images");
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 0ca8ad2e..0a0830fd 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -296,7 +296,7 @@ fn japanese_line_uses_unicode_type3_fallback() {
     let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
     let replacement = "25362738こんにちは、お元気ですか？ 2.3444";
     let result = text::replace_line(&mut doc, 0, 0, replacement).unwrap();
-    assert_eq!(result.substituted.as_deref(), Some("Shippori Mincho Type3"));
+    assert_eq!(result.substituted.as_deref(), Some("BIZ UDPGothic Type3"));
     let bytes = page_content_bytes(&doc, 0);
     let content = String::from_utf8_lossy(&bytes);
     assert!(content.contains("/PCJp"), "{content}");
@@ -304,12 +304,98 @@ fn japanese_line_uses_unicode_type3_fallback() {
     assert_eq!(text::text_lines(&reopened, 0).unwrap()[0].text, replacement);
 }
 
+fn styled_text_page(base: &str) -> Document {
+    let mut doc = text_page("BT /F1 12 Tf 72 700 Td (Original) Tj ET");
+    let r = pdfcraft_cos::ObjRef::new(5, 0);
+    let mut font = doc.get(r).as_dict().unwrap().clone();
+    font.set(b"BaseFont".to_vec(), pdfcraft_cos::Object::name(base));
+    doc.set(r, pdfcraft_cos::Object::Dict(font));
+    doc
+}
+
+fn fallback_paths(doc: &Document) -> Vec<Vec<u8>> {
+    let p = pdfcraft_model::pages(doc).swap_remove(0);
+    let res = doc.resolve(p.dict.get(b"Resources").unwrap());
+    let fonts = doc.resolve(res.as_dict().unwrap().get(b"Font").unwrap());
+    let font = doc.resolve(fonts.as_dict().unwrap().get(b"PCJp").unwrap());
+    let procs = doc.resolve(font.as_dict().unwrap().get(b"CharProcs").unwrap());
+    procs
+        .as_dict()
+        .unwrap()
+        .iter()
+        .map(|(_, object)| match &*doc.resolve(object) {
+            pdfcraft_cos::Object::Stream(s) => s.decoded().unwrap(),
+            other => panic!("expected a glyph stream, got {other:?}"),
+        })
+        .collect()
+}
+
+#[test]
+fn japanese_line_fallback_uses_real_source_family_and_weight() {
+    if without_craft_fonts("japanese_line_fallback_uses_real_source_family_and_weight") {
+        return;
+    }
+    let mut sans = styled_text_page("Helvetica");
+    let mut bold = descriptor_text_page();
+    let mut serif = styled_text_page("ABCDEF+ShipporiMincho-Regular");
+    let replacement = "見本商会　御中";
+    text::replace_line(&mut sans, 0, 0, replacement).unwrap();
+    text::replace_line(&mut bold, 0, 0, replacement).unwrap();
+    text::replace_line(&mut serif, 0, 0, replacement).unwrap();
+    assert_ne!(fallback_paths(&sans), fallback_paths(&serif), "sans source must not use Mincho outlines");
+    if pdfcraft_fonts::CRAFT_FONTS.iter().any(|f| f.family == "BIZ UDPGothic" && f.style == "Bold") {
+        assert_ne!(fallback_paths(&sans), fallback_paths(&bold), "bold must change the actual glyph paths");
+    }
+    for doc in [&sans, &bold, &serif] {
+        assert_eq!(text::text_lines(&reopen(doc), 0).unwrap()[0].text, replacement);
+    }
+}
+
+#[test]
+fn japanese_paragraph_fallback_honors_requested_family_and_weight() {
+    if without_craft_fonts("japanese_paragraph_fallback_honors_requested_family_and_weight") {
+        return;
+    }
+    let replacement = "見本商会　御中";
+    let mut regular = styled_text_page("Helvetica");
+    let mut bold = styled_text_page("Helvetica");
+    let mut serif = styled_text_page("Helvetica");
+    text::replace_block(&mut regular, 0, 0, replacement).unwrap();
+    text::rewrite_block(
+        &mut bold,
+        0,
+        0,
+        Some(replacement),
+        &text::BlockStyle { family: Some((added::Family::Helvetica, true, false)), ..Default::default() },
+    )
+    .unwrap();
+    text::rewrite_block(
+        &mut serif,
+        0,
+        0,
+        Some(replacement),
+        &text::BlockStyle { family: Some((added::Family::Times, false, false)), ..Default::default() },
+    )
+    .unwrap();
+    assert_ne!(fallback_paths(&regular), fallback_paths(&serif), "requested serif must change actual outlines");
+    if pdfcraft_fonts::CRAFT_FONTS.iter().any(|f| f.family == "BIZ UDPGothic" && f.style == "Bold") {
+        assert_ne!(fallback_paths(&regular), fallback_paths(&bold), "requested bold must change actual outlines");
+        let mut source_bold = styled_text_page("Helvetica-Bold");
+        text::replace_block(&mut source_bold, 0, 0, replacement).unwrap();
+        assert_eq!(fallback_paths(&bold), fallback_paths(&source_bold));
+    }
+    for doc in [&regular, &bold, &serif] {
+        assert_eq!(text::text_blocks(&reopen(doc), 0).unwrap()[0].text, replacement);
+    }
+}
+
 #[test]
 fn japanese_fallback_reports_the_face_after_save_and_reopen() {
     if without_craft_fonts("japanese_fallback_reports_the_face_after_save_and_reopen") {
         return;
     }
-    let face = pdfcraft_fonts::document_japanese_font().unwrap();
+    // F2 is (a subset of) Arial: a regular sans face, so the fallback is the regular Gothic.
+    let face = pdfcraft_fonts::document_japanese_font_for_style(false, false).unwrap();
     let expected = format!("{}-{}", face.family, face.style).replace(' ', "");
     for paragraph in [false, true] {
         let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
@@ -493,9 +579,9 @@ fn missing_glyphs_substitute_helvetica_and_impossible_text_is_refused() {
     let doc2 = reopen(&doc);
     let lines = text::text_lines(&doc2, 0).unwrap();
     assert_eq!((lines[0].text.as_str(), lines[0].base_font.as_str()), ("abc", "Helvetica"));
-    // Neither font can show Greek.
+    // Neither the standard font nor the craft-fonts Japanese faces have this emoji.
     let mut doc = text_page("BT /F1 12 Tf 72 700 Td (Hello) Tj ET");
-    assert!(text::replace_line(&mut doc, 0, 0, "Ωmega").is_err());
+    assert!(text::replace_line(&mut doc, 0, 0, "\u{1f4a9}").is_err());
     assert!(text::replace_line(&mut doc, 0, 5, "x").is_err(), "no such line");
 }
 
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index ee749980..d8a2dd93 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -16,7 +16,7 @@ use std::rc::Rc;
 use pdfcraft_content::{Matrix, Op, parse, serialize_ops};
 use pdfcraft_cos::{Dict, Document, Object, PdfString, Stream};
 use pdfcraft_fonts::pdf::Metrics;
-use pdfcraft_fonts::{GlyphError, japanese_glyph};
+use pdfcraft_fonts::{CraftFont, GlyphError, japanese_glyph_from};
 
 use crate::EditError;
 
@@ -510,7 +510,9 @@ fn source_family(base_font: &str) -> crate::added::Family {
     let name = base_font.to_ascii_lowercase();
     if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
         crate::added::Family::Courier
-    } else if !name.contains("sans") && ["times", "serif", "roman", "cambria", "georgia", "palatino", "garamond"].iter().any(|s| name.contains(s)) {
+    } else if !name.contains("sans")
+        && ["times", "serif", "roman", "mincho", "cambria", "georgia", "palatino", "garamond"].iter().any(|s| name.contains(s))
+    {
         crate::added::Family::Times
     } else {
         crate::added::Family::Helvetica
@@ -533,8 +535,8 @@ fn pdf_num(v: f64) -> String {
     if v.fract() == 0.0 { format!("{v:.0}") } else { format!("{v:.4}").trim_end_matches('0').trim_end_matches('.').to_string() }
 }
 
-fn type3_path(ch: char) -> Result<(Vec<u8>, f64), EditError> {
-    let glyph = japanese_glyph(ch).map_err(|e| match e {
+fn type3_path(face: &CraftFont, ch: char) -> Result<(Vec<u8>, f64), EditError> {
+    let glyph = japanese_glyph_from(face, ch).map_err(|e| match e {
         GlyphError::NoFont => no_japanese_font(),
         GlyphError::Missing => EditError::Invalid(format!("Japanese fallback font has no glyph for U+{:04X}", ch as u32)),
         GlyphError::TooComplex => EditError::Invalid(format!("Japanese fallback glyph U+{:04X} is too complex", ch as u32)),
@@ -568,8 +570,8 @@ fn no_japanese_font() -> EditError {
     )
 }
 
-fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str) -> Result<Type3Fallback, EditError> {
-    let face = pdfcraft_fonts::document_japanese_font().ok_or_else(no_japanese_font)?;
+fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crate::added::Family, bold: bool) -> Result<Type3Fallback, EditError> {
+    let face = pdfcraft_fonts::document_japanese_font_for_style(family == crate::added::Family::Times, bold).ok_or_else(no_japanese_font)?;
     let family = face.family;
     let mut chars = Vec::new();
     for ch in text.chars() {
@@ -594,7 +596,7 @@ fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str) -> Result<Ty
     for (i, ch) in chars.into_iter().enumerate() {
         let code = u8::try_from(i + 1).map_err(|_| EditError::Invalid("Japanese replacement has too many unique characters".into()))?;
         let glyph_name = format!("g{code:02X}");
-        let (path, width) = type3_path(ch)?;
+        let (path, width) = type3_path(face, ch)?;
         let mut pd = Dict::new();
         pd.set(b"Length".to_vec(), path.len() as i64);
         let proc_ref = doc.add(Object::Stream(Stream::from_raw(pd, path)));
@@ -679,7 +681,7 @@ pub fn replace_line(doc: &mut Document, page: usize, line: usize, text: &str) ->
         Some(bytes) => replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))])),
         None => {
             if needs_type3(&text) {
-                let fallback = type3_font(doc, &mut fonts_res, &text)?;
+                let fallback = type3_font(doc, &mut fonts_res, &text, source_family(&target.base_font), target.bold)?;
                 let bytes = type3_encode(&fallback, &text)
                     .ok_or_else(|| EditError::Invalid(format!("\"{text}\" can't be shown by the Japanese fallback")))?;
                 let size = font_size_before(&ops, first).unwrap_or(target.size);
@@ -866,6 +868,8 @@ pub fn replace_block(doc: &mut Document, page: usize, block: usize, text: &str)
 pub struct BlockStyle {
     /// A standard font family, bold, italic.
     pub family: Option<(crate::added::Family, bool, bool)>,
+    /// Override weight without choosing a different family (`None` keeps the source weight).
+    pub bold: Option<bool>,
     /// Font size in points (user space).
     pub size: Option<f64>,
     /// Fill colour (RGB 0–1).
@@ -913,10 +917,11 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
     }
     let o_state = ts_state.clone();
     let metrics = fonts_res.get(font_name.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|d| Metrics::from_dict(doc, &d));
-    let reuse = style.family.is_none() && metrics.as_ref().is_some_and(|m| m.encode(&text).is_some());
-    let type3 = if !reuse && needs_type3(&text) { Some(type3_font(doc, &mut fonts_res, &text)?) } else { None };
-    // The standard font used when the paragraph's own can't be (chosen, or substituted).
+    let reuse = style.family.is_none() && style.bold.is_none() && metrics.as_ref().is_some_and(|m| m.encode(&text).is_some());
+    // The chosen style also determines the real Japanese fallback outlines and advances.
     let (family, bold, italic) = style.family.unwrap_or((source_family(&b.base_font), b.bold, b.italic));
+    let bold = style.bold.unwrap_or(bold);
+    let type3 = if !reuse && needs_type3(&text) { Some(type3_font(doc, &mut fonts_res, &text, family, bold)?) } else { None };
     let std_width = move |s: &str, size: f64| -> f64 {
         match family {
             crate::added::Family::Courier => s.chars().count() as f64 * 0.6 * size,
diff --git a/crates/fonts/README.md b/crates/fonts/README.md
index 6a34a187..133b44ab 100644
--- a/crates/fonts/README.md
+++ b/crates/fonts/README.md
@@ -28,14 +28,20 @@ set). Without that variable `CRAFT_FONTS` is empty and everything below copes:
 - `document_japanese_font` / `japanese_glyph`: the face (Shippori Mincho, then BIZ UDMincho) whose
   outlines become the Type 3 fallback font for Japanese text written into PDFs. Without it,
   `japanese_glyph` returns `GlyphError::NoFont` and the editor reports a clear error.
+- `document_japanese_font_for_style` / `japanese_glyph_from`: select and draw a real Japanese
+  fallback face for edited text. Sans sources prefer BIZ UDPGothic Regular/Bold; serif sources
+  keep Mincho. Type 3 paths and advances both come from that selected face. Missing weights
+  fall back to a real Regular face, never synthetic bold; no italic face is supplied. The
+  default `document_japanese_font` / `japanese_glyph` APIs still use regular document Mincho.
 - `SHIPPORI_MINCHO`: Shippori Mincho's bytes, or `None`.
 
 Generated Japanese Type 3 fonts record the fallback face's family and style in an indirect
 `FontDescriptor`. `pdf::Metrics::base_font` uses its `FontName` when the Type 3 dictionary has
 no `BaseFont`, so text inspection and edit-tool results identify the fallback after save/reopen.
 The descriptor does not change glyph programs or replace the Type 3 `FontBBox` metrics when
-`Ascent`/`Descent` are omitted (PDF Reference 1.7, tables 5.9 and 5.19). Matching the source
-font's family and weight remains unsupported.
+`Ascent`/`Descent` are omitted (PDF Reference 1.7, tables 5.9 and 5.19). The small web input has
+only Gothic Regular, so it cannot preserve bold. No new font assets or changes to that input are
+needed.
 
 wasm32 builds embed only BIZ UDPGothic Regular and any `Arab` or `Telu` face, to keep the web build small: the web build
 currently has no Chinese face, so Chinese there still shows the replacement glyph.
diff --git a/crates/fonts/src/craft.rs b/crates/fonts/src/craft.rs
index 3d1a87f3..322d9b2f 100644
--- a/crates/fonts/src/craft.rs
+++ b/crates/fonts/src/craft.rs
@@ -85,7 +85,28 @@ fn order_cjk<'a>(faces: impl IntoIterator<Item = &'a CraftFont>, prefer_hans: bo
 /// The face for Japanese text written into PDFs (serif document text): Shippori Mincho, then
 /// BIZ UDMincho, then any other regular `Jpan` face. `None` without craft-fonts.
 pub fn document_japanese_font() -> Option<&'static CraftFont> {
-    let jpan = || CRAFT_FONTS.iter().filter(|f| f.covers("Jpan"));
+    document_face(CRAFT_FONTS, true, false)
+}
+
+/// A real Japanese document face matching serif/sans and weight where available.
+/// Sans text prefers BIZ UDPGothic Bold or Regular. Missing weights fall back to Regular;
+/// serif text keeps the document Mincho preference. No synthetic weight or slant is applied.
+/// `None` without craft-fonts. The small web input currently has only Gothic Regular.
+pub fn document_japanese_font_for_style(serif: bool, bold: bool) -> Option<&'static CraftFont> {
+    document_face(CRAFT_FONTS, serif, bold)
+}
+
+fn document_face(faces: &[CraftFont], serif: bool, bold: bool) -> Option<&CraftFont> {
+    let jpan = || faces.iter().filter(|f| f.covers("Jpan"));
+    if !serif {
+        let style = if bold { "Bold" } else { "Regular" };
+        if let Some(face) = jpan()
+            .find(|f| f.family == "BIZ UDPGothic" && f.style == style)
+            .or_else(|| jpan().find(|f| f.family == "BIZ UDPGothic" && f.style == "Regular"))
+        {
+            return Some(face);
+        }
+    }
     ["Shippori Mincho", "BIZ UDMincho"]
         .iter()
         .find_map(|family| jpan().find(|f| f.family == *family && f.style == "Regular"))
@@ -156,6 +177,24 @@ mod tests {
         assert_eq!(ja, ["BIZ UDPGothic", "Shippori Mincho", "FakeHans"]);
     }
 
+    #[test]
+    fn document_faces_match_style_without_inventing_missing_weights() {
+        let faces = [
+            CraftFont { family: "Shippori Mincho", style: "Regular", scripts: &["Jpan"], bytes: b"serif" },
+            CraftFont { family: "BIZ UDPGothic", style: "Regular", scripts: &["Jpan"], bytes: b"sans" },
+            CraftFont { family: "BIZ UDPGothic", style: "Bold", scripts: &["Jpan"], bytes: b"bold" },
+            CraftFont { family: "BIZ UDPGothic", style: "Bold", scripts: &["Latn"], bytes: b"not-japanese" },
+        ];
+        assert_eq!(document_face(&faces, false, false).unwrap().bytes, b"sans");
+        assert_eq!(document_face(&faces, false, true).unwrap().bytes, b"bold");
+        assert_eq!(document_face(&faces, true, false).unwrap().bytes, b"serif");
+        assert_eq!(document_face(&faces, true, true).unwrap().bytes, b"serif");
+        assert_eq!(document_face(&faces[..2], false, true).unwrap().bytes, b"sans");
+        assert_eq!(document_face(&faces[..1], false, true).unwrap().bytes, b"serif");
+        assert!(document_face(&faces[3..], false, true).is_none());
+        assert!(document_face(&[], false, true).is_none());
+    }
+
     #[test]
     fn arabic_faces_are_picked_by_script_in_manifest_order() {
         // Synthetic faces: the filter must not depend on the real build input.
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index 2994052f..9c3ce6d1 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -10,10 +10,10 @@ mod encodings;
 pub mod pdf;
 mod script;
 pub use craft::{
-    CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_japanese_font, ui_arabic_fonts, ui_chinese_fonts, ui_cjk_fonts, ui_japanese_fonts,
-    ui_telugu_fonts,
+    CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_japanese_font, document_japanese_font_for_style, ui_arabic_fonts, ui_chinese_fonts,
+    ui_cjk_fonts, ui_japanese_fonts, ui_telugu_fonts,
 };
-pub use script::{GlyphError, GlyphOutline, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, script_outline};
+pub use script::{GlyphError, GlyphOutline, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, japanese_glyph_from, script_outline};
 
 /// Approximate advance of `s` in Helvetica (or Arial) at `size` points.
 pub fn helvetica_width(s: &str, size: f64) -> f64 {
diff --git a/crates/fonts/src/script.rs b/crates/fonts/src/script.rs
index 23000ffb..1247ca25 100644
--- a/crates/fonts/src/script.rs
+++ b/crates/fonts/src/script.rs
@@ -129,6 +129,12 @@ impl OutlinePen for Flatten {
 /// outline data. [`GlyphError::NoFont`] when the build has no Japanese face.
 pub fn japanese_glyph(ch: char) -> Result<GlyphOutline, GlyphError> {
     let Some(face) = crate::document_japanese_font() else { return Err(GlyphError::NoFont) };
+    japanese_glyph_from(face, ch)
+}
+
+/// The bounded outline and advance from the explicitly selected craft-fonts face.
+/// Uses the same complexity and missing-glyph checks as [`japanese_glyph`].
+pub fn japanese_glyph_from(face: &crate::CraftFont, ch: char) -> Result<GlyphOutline, GlyphError> {
     let Ok(font) = FontRef::new(face.bytes) else { return Err(GlyphError::Missing) };
     let loc = LocationRef::default();
     let metrics = font.metrics(Size::unscaled(), loc);

From a6bc63a497954af87c1cd5a2a1e72e928a11c039 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 11:46:32 +0900
Subject: [PATCH 036/149] M3: render pool renders each request once when the
 caller re-sends it (#400)

The canvas rebuilds its render queue from every page, tile and text layer it
is still missing, and calls `set_queue` whenever that list changes, which is
whenever any answer arrives. Requests a worker had already popped were still
missing, so they went back into the queue and an idle worker rendered them a
second time. With one worker every other page was rendered twice; with seven
workers about half of all renders were duplicates. A slow page could also take
every idle worker in turn until the watchdog fired.

The pool now remembers the requests its workers have taken until `try_recv`
hands out their answer. A queued request equal to one of them is skipped, and
an answer removes queued copies of its request. Equal requests to one pool
always produce the same answer (its bytes and settings never change), so
nothing the caller sees changes except that answers arrive sooner.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/render/src/raster.rs | 115 ++++++++++++++++++++++++++++++++++--
 1 file changed, 110 insertions(+), 5 deletions(-)

diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index ea691bbe..267be471 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -281,6 +281,11 @@ pub const STUCK_AFTER: std::time::Duration = std::time::Duration::from_secs(20);
 struct Shared {
     /// Pending requests, most urgent last (workers pop from the end).
     queue: Mutex<Vec<RenderRequest>>,
+    /// Requests a worker has taken whose answer `try_recv` has not handed out yet. Callers keep
+    /// listing the requests they're still waiting for in each new queue, so a queued request
+    /// equal to one of these is dropped instead of being rendered a second time. Lock `queue`
+    /// first when holding both.
+    taken: Mutex<Vec<RenderRequest>>,
     /// Per worker id: the request it is rendering and since when.
     #[cfg(not(target_arch = "wasm32"))]
     busy: Mutex<Vec<Option<(RenderRequest, std::time::Instant)>>>,
@@ -296,6 +301,26 @@ fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
     m.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
 }
 
+/// Whether two requests ask for the same answer (the scale compared bit for bit, so that a NaN
+/// request still matches itself and leaves `taken` when answered).
+fn same(a: &RenderRequest, b: &RenderRequest) -> bool {
+    (a.page, a.kind, a.tile, a.scale.to_bits(), a.tag) == (b.page, b.kind, b.tile, b.scale.to_bits(), b.tag)
+}
+
+/// Pop the most urgent queued request that isn't already taken, and mark it taken.
+#[cfg(not(target_arch = "wasm32"))]
+fn take_next(shared: &Shared) -> Option<RenderRequest> {
+    let mut queue = lock(&shared.queue);
+    let mut taken = lock(&shared.taken);
+    while let Some(req) = queue.pop() {
+        if !taken.iter().any(|t| same(t, &req)) {
+            taken.push(req);
+            return Some(req);
+        }
+    }
+    None
+}
+
 /// Renders pages on worker threads, most urgent request first.
 ///
 /// **Watchdog:** a render running longer than `stuck_after` (default [`STUCK_AFTER`]) is reported
@@ -394,7 +419,9 @@ impl RenderPool {
         self.stuck_after = limit;
     }
 
-    /// Replace the pending queue (most urgent first). In-flight renders are not interrupted.
+    /// Replace the pending queue (most urgent first). In-flight renders are not interrupted, and a
+    /// request equal to one already taken (rendering, or answered but not yet received through
+    /// `try_recv`) is skipped rather than rendered twice.
     pub fn set_queue(&self, mut requests: Vec<RenderRequest>) {
         requests.reverse(); // workers pop from the end
         *lock(&self.shared.queue) = requests;
@@ -409,10 +436,15 @@ impl RenderPool {
             return next.map(|req| r.borrow_mut().render(req));
         }
         self.watchdog();
-        if let Some(p) = lock(&self.abandoned).pop() {
-            return Some(p);
+        let page = lock(&self.abandoned).pop().or_else(|| self.results.try_recv().ok())?;
+        // Copies of the request queued while it rendered are answered too.
+        let mut queue = lock(&self.shared.queue);
+        queue.retain(|q| !same(q, &page.request));
+        let mut taken = lock(&self.shared.taken);
+        if let Some(i) = taken.iter().position(|t| same(t, &page.request)) {
+            taken.swap_remove(i);
         }
-        self.results.try_recv().ok()
+        Some(page)
     }
 
     /// Give up on renders that exceeded `stuck_after` (see the type docs).
@@ -465,7 +497,7 @@ fn worker(id: usize, bytes: Arc<Vec<u8>>, config: RenderConfig, shared: Arc<Shar
         let pdf = parse(&bytes, config.password.as_deref());
         let cache = RenderCache::new();
         loop {
-            let next = lock(&shared.queue).pop();
+            let next = take_next(&shared);
             let Some(req) = next else {
                 if wake.recv().is_err() {
                     return; // pool dropped
@@ -552,6 +584,79 @@ mod tests {
         assert!(pool.try_recv().is_none());
     }
 
+    #[test]
+    fn a_request_being_rendered_is_not_rendered_again() {
+        use super::*;
+        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
+        *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_millis(1000)));
+        let req = |page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0 };
+        pool.set_queue(vec![req(0)]);
+        let t = std::time::Instant::now();
+        while !lock(&pool.shared.busy).iter().flatten().any(|(r, _)| r.page == 0) {
+            assert!(t.elapsed() < std::time::Duration::from_secs(8), "page 1 never started");
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
+        // What the canvas sends next: the page it is still waiting for, then another one.
+        pool.set_queue(vec![req(0), req(1)]);
+        let mut answers = Vec::new();
+        let t = std::time::Instant::now();
+        while answers.len() < 2 || lock(&pool.shared.busy).iter().any(Option::is_some) {
+            assert!(t.elapsed() < std::time::Duration::from_secs(8), "answers so far: {answers:?}");
+            if let Some(p) = pool.try_recv() {
+                assert!(p.error.is_none(), "{:?}", p.error);
+                answers.push(p.request.page);
+            }
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
+        while let Some(p) = pool.try_recv() {
+            answers.push(p.request.page);
+        }
+        // Page 2 went to the idle worker instead of waiting behind a second copy of page 1.
+        assert_eq!(answers, vec![1, 0]);
+        assert!(lock(&pool.shared.taken).is_empty());
+    }
+
+    #[test]
+    fn re_sent_queues_render_each_page_once() {
+        use super::*;
+        let pages = 12;
+        let mut pdf = format!(
+            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 200 200] >> endobj\n",
+            (0..pages).map(|i| format!("{} 0 R", 4 + i)).collect::<Vec<_>>().join(" ")
+        );
+        let body: String = (0..3000).map(|k| format!("{} {} 5 5 re f\n", k * 7 % 195, k * 13 % 195)).collect();
+        pdf += &format!("3 0 obj << /Length {} >> stream\n{body}endstream endobj\n", body.len());
+        for i in 0..pages {
+            pdf += &format!("{} 0 obj << /Type /Page /Parent 2 0 R /Contents 3 0 R >> endobj\n", 4 + i);
+        }
+        pdf += "trailer << /Root 1 0 R >>\n%%EOF";
+        let pool = RenderPool::new(Arc::new(pdf.into_bytes()), 3, RenderConfig::default());
+        let wanted: Vec<RenderRequest> =
+            (0..pages).map(|page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 2000 }).collect();
+        // The canvas's loop: take what arrived, then queue every page still missing whenever
+        // that list changes (requests already rendering included).
+        let mut got = vec![0; pages];
+        let mut last = Vec::new();
+        let t = std::time::Instant::now();
+        while got.contains(&0) || lock(&pool.shared.busy).iter().any(Option::is_some) {
+            assert!(t.elapsed() < std::time::Duration::from_secs(30), "rendered so far: {got:?}");
+            while let Some(p) = pool.try_recv() {
+                assert!(p.error.is_none(), "{:?}", p.error);
+                got[p.request.page] += 1;
+            }
+            let queue: Vec<RenderRequest> = wanted.iter().copied().filter(|r| got[r.page] == 0).collect();
+            if queue != last {
+                pool.set_queue(queue.clone());
+                last = queue;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
+        while let Some(p) = pool.try_recv() {
+            got[p.request.page] += 1;
+        }
+        assert_eq!(got, vec![1; pages]);
+    }
+
     #[test]
     fn effective_scale_never_exceeds_the_caps() {
         for (w, h, s) in [(934_775_807.0, 792.0, 0.25), (612.0, 792.0, 0.0), (1.0e9, 1.0e9, 1.0), (612.0, 792.0, 2.0)] {

From 084f7636ea253291c5422ff7394fc4a7cdfbe9b9 Mon Sep 17 00:00:00 2001
From: Xus Badia <xus@badia.me>
Date: Thu, 8 Oct 2026 15:12:32 +0200
Subject: [PATCH 037/149] macOS DMG: branded window background and icon layout

The DMG opened as a plain Finder window. It now shows the app icon's figure on
the PdfCraft colour, with PdfCraft.app and the Applications link side by side.
Same approach as PhotoCraft's and VectorCraft's.

- packaging/macos/dmg/: background.svg (source; text outlined, no paper grain,
  the figure an <image> of assets/app-icon), background.tiff (1x + 2x HiDPI,
  16-colour palette, Deflate, sRGB; ~95 KB) and dmg-layout.DS_Store (Finder
  view settings: window, icon size 128, positions, background).
- generate.py writes the TIFF and the layout on any OS, byte-for-byte
  reproducible, with nothing from the machine that ran it.
- package.sh copies them into the staging folder; the image is still built with
  hdiutil makehybrid. Nothing extra runs in the signing job.
- The volume name drops the version: the layout finds the background through
  an alias that includes the volume name. The DMG file name keeps the version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.md                          |   4 +-
 ATTRIBUTION.toml                        |  23 ++++
 docs/releasing.md                       |   3 +
 packaging/macos/dmg/README.md           |  44 +++++++
 packaging/macos/dmg/background.svg      |  31 +++++
 packaging/macos/dmg/background.tiff     | Bin 0 -> 94912 bytes
 packaging/macos/dmg/dmg-layout.DS_Store | Bin 0 -> 16388 bytes
 packaging/macos/dmg/generate.py         | 158 ++++++++++++++++++++++++
 packaging/macos/package.sh              |   7 +-
 9 files changed, 268 insertions(+), 2 deletions(-)
 create mode 100644 packaging/macos/dmg/README.md
 create mode 100644 packaging/macos/dmg/background.svg
 create mode 100644 packaging/macos/dmg/background.tiff
 create mode 100644 packaging/macos/dmg/dmg-layout.DS_Store
 create mode 100644 packaging/macos/dmg/generate.py

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 0f56341b..ef2f96f8 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (251)
+## In this repository (253)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -259,6 +259,8 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/sign/tests/data/openssl-signed.pdf` | One-page PDF signed with OpenSSL CMS (adbe.pkcs7.detached) by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl cms -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/pdf.rs): a signature PdfCraft did not make |
 | `assets/icons/clipboard-paste.svg` | Lucide icon "clipboard-paste" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/fonts/DancingScript.ttf` | Dancing Script (variable) | The Dancing Script Project Authors (Pablo Impallari) | OFL-1.1 | https://github.com/google/fonts/blob/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/dancingscript/DancingScript%5Bwght%5D.ttf | Fill & Sign typed signatures and initials: the typed name's glyph outlines, drawn as filled paths (the font file itself is not embedded in PDFs) |
+| `packaging/macos/dmg/background.svg` | PdfCraft macOS DMG window background | @XusBadia | MIT OR Apache-2.0 | Original work for this repository, derived from the PdfCraft app icon (assets/app-icon/pdfcraft.svg, referenced via an SVG image element, not copied) | Finder window of the macOS DMG; rendered to background.tiff by packaging/macos/dmg/generate.py |
+| `packaging/macos/dmg/background.tiff` | PdfCraft macOS DMG window background (rendered) | @XusBadia | MIT OR Apache-2.0 | Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py | 1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile |
 
 ## Compiled in through dependencies (6)
 
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 3a1801a2..d646dee2 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -3105,6 +3105,29 @@ kind = "font"
 usage = "Fill & Sign typed signatures and initials: the typed name's glyph outlines, drawn as filled paths (the font file itself is not embedded in PDFs)"
 sha256 = "21808625578fe8d8cd10cb684be546dca077b27cd03a53a2f1ec11dc743c924c"
 
+[[asset]]
+path = "packaging/macos/dmg/background.svg"
+title = "PdfCraft macOS DMG window background"
+author = "@XusBadia"
+source = "Original work for this repository, derived from the PdfCraft app icon (assets/app-icon/pdfcraft.svg, referenced via an SVG image element, not copied)"
+licence = "MIT OR Apache-2.0"
+licence_file = "assets/app-icon/LICENSE.txt"
+kind = "image"
+usage = "Finder window of the macOS DMG; rendered to background.tiff by packaging/macos/dmg/generate.py"
+sha256 = "e8b9ea9d5e64b7b741c977543c1693825e77d5c4c579eeb674bf5dcd3764cd8a"
+
+
+[[asset]]
+path = "packaging/macos/dmg/background.tiff"
+title = "PdfCraft macOS DMG window background (rendered)"
+author = "@XusBadia"
+source = "Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py"
+licence = "MIT OR Apache-2.0"
+licence_file = "assets/app-icon/LICENSE.txt"
+kind = "image"
+usage = "1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile"
+sha256 = "f46881724a6621f3686a612a79dbdce4f7dbe9e2025610e44c9a094341334c2c"
+
 [[fetched]]
 file = "text-detection.rten"
 url = "https://ocrs-models.s3-accelerate.amazonaws.com/text-detection.rten"
diff --git a/docs/releasing.md b/docs/releasing.md
index ec5e3b1d..30900549 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -82,6 +82,9 @@ from Preview). Files opened from Finder arrive as Apple events, which
 - **Notarization:** the app is zipped and sent with `xcrun notarytool submit --wait`, the ticket is
   stapled, and the result is checked with `codesign --verify`, `stapler validate` and `spctl`. The
   app ships on a drag-to-Applications DMG, which is signed and notarized too.
+  Its Finder window (background, icon size and positions) comes from
+  [`packaging/macos/dmg/`](../packaging/macos/dmg/README.md), and its volume is named `PdfCraft`
+  without the version, which the window's background needs; the DMG file name keeps the version.
 - **CLI:** `pdfcraft-cli` is signed and notarized as a zip. A bare executable can't hold a stapled
   ticket, so Gatekeeper looks it up online the first time a downloaded copy runs.
 
diff --git a/packaging/macos/dmg/README.md b/packaging/macos/dmg/README.md
new file mode 100644
index 00000000..ec902e30
--- /dev/null
+++ b/packaging/macos/dmg/README.md
@@ -0,0 +1,44 @@
+# macOS DMG window
+
+What Finder shows when the DMG opens: a 660 × 400 pt background with the app icon and the
+`Applications` link side by side. `package.sh` copies these files into the image; nothing here is
+generated at build time, so the DMG still builds with `hdiutil makehybrid` (no mounted device, no
+Finder scripting on CI, nothing extra installed in the signing job).
+
+| File | What |
+|---|---|
+| `background.svg` | Source of the background: the app icon (`assets/app-icon/pdfcraft.svg`, linked, not copied) cropped as a cover on the PdfCraft colour field (`#12a58a`), Ink and Paper. Its text (Inter, JetBrains Mono) is outlined, so rendering it needs no fonts. No paper grain: noise doesn't compress, and this keeps `background.tiff` small. |
+| `background.tiff` | The background at 1x (660 × 400 px, 72 dpi) and 2x (1320 × 800 px, 144 dpi) in one HiDPI TIFF (16-colour palette, Deflate, sRGB). Goes to `.background/background.tiff`. |
+| `dmg-layout.DS_Store` | Finder's view settings for the volume: window size, icon size 128, PdfCraft.app at (326, 205), `Applications` at (574, 205), and the background. Goes to `.DS_Store` in the image; named so it isn't mistaken for (or ignored like) a Finder-generated `.DS_Store`. |
+| `generate.py` | Writes `background.tiff` and `dmg-layout.DS_Store` from the SVG and the layout above. |
+
+## The volume name has no version
+
+The mounted volume is called `PdfCraft`, not `PdfCraft <version>`. The layout points at the background
+through an alias that includes the volume name, and Finder resolves it by that name: with a
+versioned name the window keeps its size and icon positions but shows no background (tested).
+The DMG file name (`pdfcraft-<version>-macos-<arch>.dmg`) still carries the version.
+
+## Rules
+
+- **Finder draws the icon labels in black in light and dark mode** when a window has a background,
+  so the area under both icons stays light (Paper).
+- **Nothing goes inside the icon boxes:** artwork keeps 10 pt clear of each 128 pt icon box and of
+  the label strip under it.
+
+## Regenerate
+
+Edit `background.svg` (or the layout constants in `generate.py`), then run, on any OS:
+
+```sh
+pip install 'pillow>=12' ds_store==1.3.3 mac_alias==2.2.3
+python3 packaging/macos/dmg/generate.py   # needs resvg on PATH
+```
+
+Both outputs are byte-for-byte reproducible and carry nothing from the machine that ran it: the
+SVG renders without any fonts, and `dmg-layout.DS_Store` is written from scratch, its background
+alias holding only the volume name and `/.background/background.tiff`. If you add text to the SVG,
+outline it (`usvg` from resvg converts text to paths). The window is 660 × 432 with Finder's 32 pt
+title bar; the content area is 660 × 400.
+
+This follows VectorCraft's `packaging/macos/dmg/` (storytold/vectorcraft#493).
diff --git a/packaging/macos/dmg/background.svg b/packaging/macos/dmg/background.svg
new file mode 100644
index 00000000..749b6a49
--- /dev/null
+++ b/packaging/macos/dmg/background.svg
@@ -0,0 +1,31 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="660" height="400" viewBox="0 0 660 400">
+<defs><clipPath id="panel"><rect width="232" height="400"/></clipPath><pattern id="hatch" width="2.6" height="2.6" patternUnits="userSpaceOnUse" patternTransform="rotate(-38)">
+  <rect width="2.6" height="1.05" fill="#0b0b0c"/></pattern><filter id="grain" x="0" y="0" width="100%" height="100%">
+  <feTurbulence type="fractalNoise" baseFrequency="0.9" numOctaves="2" seed="7"/>
+  <feColorMatrix values="0 0 0 0 0.04  0 0 0 0 0.04  0 0 0 0 0.05  0.5 0 0 0 -0.225"/>
+</filter></defs>
+
+<rect width="660" height="400" fill="#efe9dc"/>
+<g clip-path="url(#panel)"><rect width="232" height="400" fill="#12a58a"/><g transform="translate(-134.0,-40.0) scale(1.0)"><image href="../../../assets/app-icon/pdfcraft.svg" width="512" height="512"/></g></g>
+<line x1="232.5" y1="0" x2="232.5" y2="400" stroke="#0b0b0c" stroke-width="1.2"/>
+<line x1="236.5" y1="0" x2="236.5" y2="400" stroke="#0b0b0c" stroke-width="0.5"/>
+
+<line x1="267" y1="88.5" x2="624" y2="88.5" stroke="#0b0b0c" stroke-width="0.6"/>
+<path d="M271.5,81.5 L276,88.5 L271.5,95.5 L267,88.5 Z" fill="#12a58a"/>
+
+<rect x="408" y="197" width="78" height="16" rx="2" fill="#12a58a" fill-opacity="0.45"/><line x1="414" y1="205" x2="482" y2="205" stroke="#0b0b0c" stroke-width="1.6"/><path d="M499.1,205.0 L486.1,211.0 L486.1,199.0 Z" fill="#0b0b0c"/>
+<line x1="267" y1="335.5" x2="624" y2="335.5" stroke="#0b0b0c" stroke-width="0.6"/>
+
+
+<g id="text">
+    <g>
+        <path fill="#0b0b0c" stroke="none" d="M 268.19727 72 L 268.19727 50.17383 L 276.35645 50.17383 Q 278.86133 50.17383 280.5752 51.11133 Q 282.28906 52.04883 283.16797 53.68213 Q 284.04688 55.31543 284.04688 57.395508 Q 284.04688 59.49023 283.16064 61.12353 Q 282.2744 62.75684 280.5459 63.687008 Q 278.81738 64.61719 276.29785 64.61719 L 272.1084 64.61719 L 272.1084 72 Z M 272.1084 61.394527 L 275.78516 61.394527 Q 277.99707 61.394527 279.02246 60.266605 Q 280.04785 59.13867 280.04785 57.395508 Q 280.04785 55.65234 279.02246 54.55371 Q 277.99707 53.45508 275.75586 53.45508 L 272.1084 53.45508 Z M 292.6875 72.29297 Q 290.7539 72.29297 289.22314 71.3042 Q 287.69238 70.31543 286.81348 68.42578 Q 285.93457 66.53613 285.93457 63.84082 Q 285.93457 61.11621 286.82813 59.233883 Q 287.72168 57.351563 289.25244 56.38477 Q 290.7832 55.41797 292.67285 55.41797 Q 294.1377 55.41797 295.06787 55.90869 Q 295.99805 56.399418 296.54004 57.080566 Q 297.08203 57.76172 297.375 58.33301 L 297.53613 58.33301 L 297.53613 50.17383 L 301.34473 50.17383 L 301.34473 72 L 297.60938 72 L 297.60938 69.40723 L 297.375 69.40723 Q 297.06738 69.993164 296.51074 70.66699 Q 295.9541 71.34082 295.02393 71.816895 Q 294.09375 72.29297 292.6875 72.29297 Z M 293.72754 69.1582 Q 295.5879 69.1582 296.59863 67.686035 Q 297.60938 66.21387 297.60938 63.82617 Q 297.60938 61.438473 296.60596 59.995605 Q 295.60254 58.552734 293.72754 58.552734 Q 291.79395 58.552734 290.8125 60.046875 Q 289.83105 61.54102 289.83105 63.82617 Q 289.83105 66.12598 290.81982 67.64209 Q 291.8086 69.1582 293.72754 69.1582 Z M 313.48633 55.623047 L 313.48633 58.61133 L 309.9414 58.61133 L 309.9414 72 L 306.14746 72 L 306.14746 58.61133 L 303.14453 58.61133 L 303.14453 55.623047 L 306.14746 55.623047 L 306.14746 54.055664 Q 306.14746 52.429688 306.83594 51.33838 Q 307.5244 50.24707 308.67432 49.697758 Q 309.82422 49.148438 311.23047 49.148438 Q 312.2412 49.148438 313.01758 49.309566 Q 313.79395 49.470703 314.16016 49.60254 L 313.3838 52.561527 Q 313.13477 52.488277 312.77588 52.407715 Q 312.417 52.32715 311.9336 52.32715 Q 310.86426 52.32715 310.40283 52.854492 Q 309.9414 53.381836 309.9414 54.348633 L 309.9414 55.623047 Z M 325.51074 72.29297 Q 322.63965 72.29297 320.3838 70.95996 Q 318.12793 69.62695 316.82422 67.12207 Q 315.5205 64.61719 315.5205 61.101563 Q 315.5205 57.571285 316.83154 55.059082 Q 318.14258 52.54688 320.39844 51.213863 Q 322.6543 49.88086 325.51074 49.88086 Q 327.89844 49.88086 329.854 50.774414 Q 331.80957 51.66797 333.08398 53.359863 Q 334.3584 55.051754 334.70996 57.439453 L 330.76953 57.439453 Q 330.40332 55.50586 328.96777 54.443848 Q 327.53223 53.381836 325.56934 53.381836 Q 322.88867 53.381836 321.16748 55.381344 Q 319.4463 57.38086 319.4463 61.101563 Q 319.4463 64.86621 321.1748 66.8291 Q 322.90332 68.79199 325.5547 68.79199 Q 327.51758 68.79199 328.96045 67.72998 Q 330.40332 66.66797 330.76953 64.734375 L 334.7246 64.734375 Q 334.417 66.8291 333.21582 68.54297 Q 332.01465 70.256836 330.05176 71.2749 Q 328.08887 72.29297 325.51074 72.29297 Z M 337.6377 72 L 337.6377 55.623047 L 341.3291 55.623047 L 341.3291 58.362305 L 341.50488 58.362305 Q 341.94434 56.941402 343.04297 56.172363 Q 344.14163 55.40332 345.54785 55.40332 Q 346.28027 55.40332 346.93942 55.50586 L 346.93942 59.006836 Q 346.70505 58.948246 346.17773 58.882324 Q 345.6504 58.816406 345.1377 58.816406 Q 343.54102 58.816406 342.49365 59.805172 Q 341.4463 60.79394 341.4463 62.36133 L 341.4463 72 Z M 353.33887 72.336914 Q 351.78613 72.336914 350.54102 71.77295 Q 349.2959 71.208984 348.57813 70.11035 Q 347.86035 69.01172 347.86035 67.40039 Q 347.86035 65.55469 348.7612 64.53662 Q 349.66214 63.518555 351.09033 63.057125 Q 352.51855 62.595703 354.1006 62.43457 Q 356.2393 62.200195 357.1914 62.00244 Q 358.14355 61.804688 358.14355 60.95508 L 358.14355 60.88184 Q 358.14355 59.680664 357.41113 59.01416 Q 356.6787 58.34766 355.2871 58.34766 Q 353.85156 58.34766 353.00195 58.977543 Q 352.15234 59.607426 351.85938 60.413086 L 348.32907 59.695313 Q 349.04688 57.527344 350.92917 56.472656 Q 352.81155 55.41797 355.27246 55.41797 Q 356.4297 55.41797 357.6089 55.688965 Q 358.7881 55.95996 359.76953 56.597168 Q 360.75098 57.234375 361.35156 58.325684 Q 361.95212 59.416992 361.95212 61.057617 L 361.95212 72 L 358.3047 72 L 358.3047 69.74414 L 358.1582 69.74414 Q 357.61624 70.79883 356.4297 71.56787 Q 355.24316 72.336914 353.33887 72.336914 Z M 354.3203 69.509766 Q 356.07816 69.509766 357.1255 68.49902 Q 358.17282 67.48828 358.17282 66.12598 L 358.17282 64.19238 Q 357.90918 64.39746 357.23535 64.55127 Q 356.56152 64.70508 355.8071 64.81494 Q 355.05273 64.924805 354.5547 64.99805 Q 353.26563 65.17383 352.4087 65.70117 Q 351.5518 66.228516 351.5518 67.356445 Q 351.5518 68.41113 352.32813 68.96045 Q 353.1045 69.509766 354.3203 69.509766 Z M 374.1084 55.623047 L 374.1084 58.61133 L 370.56348 58.61133 L 370.56348 72 L 366.76953 72 L 366.76953 58.61133 L 363.76663 58.61133 L 363.76663 55.623047 L 366.76953 55.623047 L 366.76953 54.055664 Q 366.76953 52.429688 367.458 51.33838 Q 368.14648 50.24707 369.2964 49.697758 Q 370.4463 49.148438 371.85254 49.148438 Q 372.86325 49.148438 373.63965 49.309566 Q 374.41602 49.470703 374.78223 49.60254 L 374.00583 52.561527 Q 373.75684 52.488277 373.39795 52.407715 Q 373.03906 52.32715 372.55566 52.32715 Q 371.4863 52.32715 371.0249 52.854492 Q 370.56348 53.381836 370.56348 54.348633 L 370.56348 55.623047 Z M 383.1006 55.623047 L 383.1006 58.61133 L 379.93652 58.61133 L 379.93652 67.38574 Q 379.93652 68.2793 380.3101 68.69678 Q 380.6836 69.11426 381.5625 69.11426 Q 381.82617 69.11426 382.25098 69.04834 Q 382.67575 68.98242 382.9541 68.92383 L 383.5547 71.868164 Q 382.9248 72.05859 382.26563 72.13916 Q 381.60648 72.21973 381.00586 72.21973 Q 378.64746 72.21973 377.3877 71.04785 Q 376.12793 69.87598 376.12793 67.70801 L 376.12793 58.61133 L 373.79883 58.61133 L 373.79883 55.623047 L 376.12793 55.623047 L 376.12793 51.726563 L 379.93652 51.726563 L 379.93652 55.623047 Z"/>
+    </g>
+    <g>
+        <path fill="#0b0b0c" fill-opacity="0.7" stroke="none" d="M 267.828 112 L 267.828 105.42999 L 269.943 105.42999 Q 270.861 105.42999 271.4055 105.9565 Q 271.95 106.483 271.95 107.365 Q 271.95 108.247 271.4055 108.7735 Q 270.861 109.299995 269.943 109.299995 L 268.638 109.299995 L 268.638 112 Z M 268.638 108.571 L 269.943 108.571 Q 270.474 108.571 270.7935 108.2425 Q 271.113 107.914 271.113 107.365 Q 271.113 106.807 270.7935 106.483 Q 270.474 106.159004 269.943 106.159004 L 268.638 106.159004 Z M 274.668 112.09 Q 273.90298 112.09 273.453 111.6625 Q 273.003 111.235 273.003 110.542 Q 273.003 110.083 273.21 109.741 Q 273.417 109.399 273.78598 109.20549 Q 274.155 109.012 274.632 109.012 L 276.162 109.012 L 276.162 108.625 Q 276.162 107.661995 275.109 107.661995 Q 274.641 107.661995 274.353 107.83299 Q 274.065 108.00399 274.047 108.31 L 273.237 108.31 Q 273.28198 107.72499 273.7815 107.3425 Q 274.281 106.95999 275.109 106.95999 Q 276.009 106.95999 276.49048 107.392 Q 276.972 107.824 276.972 108.59799 L 276.972 112 L 276.171 112 L 276.171 111.1 L 276.15298 111.1 Q 276.081 111.55899 275.694 111.82449 Q 275.307 112.09 274.668 112.09 Z M 274.866 111.406 Q 275.46 111.406 275.811 111.118 Q 276.162 110.83 276.162 110.335 L 276.162 109.64199 L 274.722 109.64199 Q 274.326 109.64199 274.0785 109.8805 Q 273.831 110.119 273.831 110.51499 Q 273.831 110.929 274.1055 111.167496 Q 274.38 111.406 274.866 111.406 Z M 279.249 113.619995 L 279.249 112.882 L 280.64398 112.882 Q 281.067 112.882 281.31 112.6435 Q 281.55298 112.405 281.55298 112 L 281.55298 111.55 L 281.57098 110.74 L 281.54398 110.74 Q 281.472 111.18101 281.121 111.4195 Q 280.77 111.658 280.23898 111.658 Q 279.474 111.658 279.033 111.172 Q 278.59198 110.68599 278.59198 109.84 L 278.59198 108.796 Q 278.59198 107.95 279.033 107.45501 Q 279.474 106.95999 280.23898 106.95999 Q 280.77 106.95999 281.121 107.212 Q 281.472 107.464 281.54398 107.90501 L 281.56198 107.90501 L 281.56198 107.05 L 282.36298 107.05 L 282.36298 112 Q 282.36298 112.746994 281.89948 113.183495 Q 281.43597 113.619995 280.63498 113.619995 Z M 280.482 110.983 Q 280.986 110.983 281.274 110.668 Q 281.56198 110.353 281.56198 109.795 L 281.56198 108.85 Q 281.56198 108.29201 281.274 107.977 Q 280.986 107.661995 280.482 107.661995 Q 279.969 107.661995 279.6855 107.959 Q 279.40198 108.256 279.40198 108.76 L 279.40198 109.885 Q 279.40198 110.389 279.6855 110.68599 Q 279.969 110.983 280.482 110.983 Z M 285.90002 112.09 Q 285.027 112.09 284.49152 111.5635 Q 283.95602 111.037 283.95602 110.11 L 283.95602 108.94 Q 283.95602 108.01301 284.49152 107.4865 Q 285.027 106.95999 285.90002 106.95999 Q 286.48502 106.95999 286.9215 107.194 Q 287.358 107.428 287.601 107.851 Q 287.84402 108.274 287.84402 108.85 L 287.84402 109.732 L 284.74802 109.732 L 284.74802 110.19999 Q 284.74802 110.749 285.06302 111.0685 Q 285.37802 111.38799 285.90002 111.38799 Q 286.35 111.38799 286.64252 111.2125 Q 286.935 111.037 286.99802 110.74 L 287.808 110.74 Q 287.72702 111.361 287.20502 111.72551 Q 286.683 112.09 285.90002 112.09 Z M 284.74802 109.102 L 287.052 109.102 L 287.052 108.85 Q 287.052 108.265 286.75052 107.9455 Q 286.449 107.62601 285.90002 107.62601 Q 285.351 107.62601 285.0495 107.9455 Q 284.74802 108.265 284.74802 108.85 Z M 294.81 112 L 294.81 111.262 L 296.592 111.262 L 296.592 106.131996 L 294.81 107.464 L 294.81 106.537 L 296.295 105.42999 L 297.402 105.42999 L 297.402 111.262 L 298.86 111.262 L 298.86 112 Z M 307.5 112.072 Q 306.60898 112.072 306.0825 111.55 Q 305.556 111.028 305.556 110.092 L 305.556 108.958 Q 305.556 108.01301 306.078 107.4955 Q 306.59998 106.978 307.5 106.978 Q 308.4 106.978 308.922 107.4955 Q 309.444 108.01301 309.444 108.958 L 309.444 110.092 Q 309.444 111.028 308.91748 111.55 Q 308.391 112.072 307.5 112.072 Z M 307.5 111.35199 Q 308.03098 111.35199 308.3325 111.055 Q 308.634 110.758 308.634 110.182 L 308.634 108.868 Q 308.634 108.29201 308.3325 107.995 Q 308.03098 107.698006 307.5 107.698006 Q 306.978 107.698006 306.672 107.995 Q 306.366 108.29201 306.366 108.868 L 306.366 110.182 Q 306.366 110.758 306.672 111.055 Q 306.978 111.35199 307.5 111.35199 Z M 312.135 112 L 312.135 108.463005 L 310.695 108.463005 L 310.695 107.72499 L 312.135 107.72499 L 312.135 106.69001 Q 312.135 106.105 312.504 105.76751 Q 312.87302 105.42999 313.52103 105.42999 L 314.97 105.42999 L 314.97 106.168 L 313.52103 106.168 Q 312.945 106.168 312.945 106.69001 L 312.945 107.72499 L 314.97 107.72499 L 314.97 108.463005 L 312.945 108.463005 L 312.945 112 Z M 321.81 112 L 321.81 111.262 L 323.592 111.262 L 323.592 106.131996 L 321.81 107.464 L 321.81 106.537 L 323.295 105.42999 L 324.402 105.42999 L 324.402 111.262 L 325.86 111.262 L 325.86 112 Z M 334.5 109.66 Q 334.167 109.66 333.96448 109.462 Q 333.762 109.26399 333.762 108.949005 Q 333.762 108.616 333.96448 108.409 Q 334.167 108.202 334.5 108.202 Q 334.83298 108.202 335.0355 108.409 Q 335.23798 108.616 335.23798 108.949005 Q 335.23798 109.26399 335.0355 109.462 Q 334.83298 109.66 334.5 109.66 Z M 343.05002 112 L 344.75998 105.42999 L 345.849 105.42999 L 347.55002 112 L 346.73102 112 L 346.299 110.254 L 344.31 110.254 L 343.87805 112 Z M 344.47202 109.57 L 346.12796 109.57 L 345.624 107.545 Q 345.48004 106.96901 345.39902 106.58201 Q 345.318 106.19499 345.30002 106.078 Q 345.282 106.19499 345.20102 106.58201 Q 345.12 106.96901 344.976 107.536 Z M 351.60004 112 L 351.60004 110.56 L 348.63 110.56 L 348.63 109.291 L 351.02402 105.42999 L 351.942 105.42999 L 349.44 109.47099 L 349.44 109.82201 L 351.60004 109.82201 L 351.60004 108.21999 L 352.41 108.21999 L 352.41 112 Z M 361.50003 109.66 Q 361.16702 109.66 360.9645 109.462 Q 360.76205 109.26399 360.76205 108.949005 Q 360.76205 108.616 360.9645 108.409 Q 361.16702 108.202 361.50003 108.202 Q 361.833 108.202 362.03552 108.409 Q 362.238 108.616 362.238 108.949005 Q 362.238 109.26399 362.03552 109.462 Q 361.833 109.66 361.50003 109.66 Z M 370.42804 112 L 370.42804 105.42999 L 372.543 105.42999 Q 373.461 105.42999 374.00546 105.9565 Q 374.55005 106.483 374.55005 107.365 Q 374.55005 108.247 374.00546 108.7735 Q 373.461 109.299995 372.543 109.299995 L 371.238 109.299995 L 371.238 112 Z M 371.238 108.571 L 372.543 108.571 Q 373.074 108.571 373.3935 108.2425 Q 373.713 107.914 373.713 107.365 Q 373.713 106.807 373.3935 106.483 Q 373.074 106.159004 372.543 106.159004 L 371.238 106.159004 Z M 375.828 112 L 375.828 105.42999 L 377.52896 105.42999 Q 378.168 105.42999 378.6315 105.673004 Q 379.095 105.91599 379.3515 106.357 Q 379.60797 106.79801 379.60797 107.401 L 379.60797 110.02 Q 379.60797 110.62299 379.3515 111.0685 Q 379.095 111.514 378.6315 111.757 Q 378.168 112 377.52896 112 Z M 376.638 111.27999 L 377.52896 111.27999 Q 378.123 111.27999 378.46054 110.947 Q 378.798 110.614 378.798 110.02 L 378.798 107.401 Q 378.798 106.816 378.46054 106.483 Q 378.123 106.15 377.52896 106.15 L 376.638 106.15 Z M 381.25504 112 L 381.25504 105.42999 L 385.12506 105.42999 L 385.12506 106.168 L 382.04703 106.168 L 382.04703 108.346 L 384.891 108.346 L 384.891 109.084 L 382.06506 109.084 L 382.06506 112 Z M 386.475 112.98999 L 389.67 104.53 L 390.52502 104.53 L 387.33002 112.98999 Z M 391.65002 112 L 393.36002 105.42999 L 394.449 105.42999 L 396.15 112 L 395.33102 112 L 394.89902 110.254 L 392.90997 110.254 L 392.47803 112 Z M 393.07202 109.57 L 394.72803 109.57 L 394.224 107.545 Q 394.08002 106.96901 393.99902 106.58201 Q 393.918 106.19499 393.90002 106.078 Q 393.88202 106.19499 393.80103 106.58201 Q 393.72 106.96901 393.57605 107.536 Z M 397.86005 109.39 L 397.86005 108.670006 L 400.74005 108.670006 L 400.74005 109.39 Z M 402.774 112 L 402.774 111.253006 L 404.961 108.913 Q 405.43796 108.409 405.636 108.01301 Q 405.834 107.617 405.834 107.23899 Q 405.834 106.699 405.5235 106.3795 Q 405.213 106.06 404.682 106.06 Q 404.133 106.06 403.8135 106.388504 Q 403.49396 106.717 403.49396 107.275 L 402.684 107.275 Q 402.71097 106.384 403.251 105.862 Q 403.791 105.34 404.682 105.34 Q 405.591 105.34 406.1265 105.853 Q 406.662 106.36599 406.662 107.24801 Q 406.662 107.716 406.4055 108.238 Q 406.149 108.76 405.528 109.408 L 403.755 111.262 L 406.743 111.262 L 406.743 112 Z M 410.38803 112.09 Q 409.83002 112.09 409.47003 111.8155 Q 409.11 111.541 409.04703 111.055 L 409.03802 111.055 L 409.03802 112 L 408.22806 112 L 408.22806 105.42999 L 409.03802 105.42999 L 409.03802 106.87 L 409.02002 107.995 L 409.02902 107.995 Q 409.101 107.51799 409.4655 107.23899 Q 409.83002 106.95999 410.38803 106.95999 Q 411.135 106.95999 411.57602 107.45501 Q 412.017 107.95 412.017 108.805 L 412.017 110.254 Q 412.017 111.1 411.57602 111.595 Q 411.135 112.09 410.38803 112.09 Z M 410.118 111.38799 Q 410.631 111.38799 410.91904 111.118 Q 411.20703 110.848 411.20703 110.24501 L 411.20703 108.805 Q 411.20703 108.193 410.91904 107.9275 Q 410.631 107.661995 410.118 107.661995 Q 409.62302 107.661995 409.33054 107.977 Q 409.03802 108.29201 409.03802 108.85 L 409.03802 110.19999 Q 409.03802 110.758 409.33054 111.07299 Q 409.62302 111.38799 410.118 111.38799 Z"/>
+    </g>
+    <g>
+        <path fill="#0b0b0c" fill-opacity="0.65" stroke="none" d="M 270.4912 358 L 267.88623 358 L 267.88623 349.99707 L 270.5664 349.99707 Q 271.74805 349.99707 272.5913 350.4778 Q 273.43457 350.9585 273.88574 351.8501 Q 274.3369 352.7417 274.3369 353.9878 Q 274.3369 355.23923 273.88306 356.13623 Q 273.4292 357.0332 272.56714 357.5166 Q 271.70508 358 270.4912 358 Z M 269.11084 356.92578 L 270.4214 356.92578 Q 271.78027 356.92578 272.45703 356.16574 Q 273.1338 355.40573 273.1338 353.9878 Q 273.1338 352.5752 272.4651 351.82327 Q 271.7964 351.07126 270.48584 351.07126 L 269.11084 351.07126 Z M 277.3247 358 L 277.3247 349.99707 L 280.19287 349.99707 Q 281.1167 349.99707 281.73438 350.31934 Q 282.35205 350.6416 282.6582 351.20825 Q 282.96436 351.77487 282.96436 352.51074 Q 282.96436 353.3164 282.59912 353.90457 Q 282.2339 354.49268 281.50342 354.7666 L 283.26514 358 L 281.87402 358 L 280.25195 354.97607 Q 280.21973 354.97607 280.18213 354.97607 L 278.54932 354.97607 L 278.54932 358 Z M 278.54932 353.9287 L 280.06396 353.9287 Q 280.94482 353.9287 281.33423 353.55542 Q 281.72363 353.18216 281.72363 352.51074 Q 281.72363 351.83398 281.33154 351.4392 Q 280.93945 351.04443 280.05322 351.04443 L 278.54932 351.04443 Z M 285.33984 358 L 288.18652 349.99707 L 289.69043 349.99707 L 292.59082 358 L 291.26416 358 L 290.52832 355.88916 L 287.38086 355.88916 L 286.6665 358 Z M 287.72998 354.86862 L 290.16846 354.86862 L 289.70654 353.54733 Q 289.5454 353.06934 289.35742 352.43823 Q 289.16943 351.80713 288.9331 350.9585 Q 288.69678 351.81784 288.51147 352.4543 Q 288.32617 353.09082 288.17578 353.54733 Z M 298.21045 358.10742 Q 297.1255 358.10742 296.3037 357.6079 Q 295.48193 357.1084 295.0254 356.1899 Q 294.56885 355.27148 294.56885 354.00388 Q 294.56885 352.72562 295.03345 351.80444 Q 295.49805 350.8833 296.30908 350.38647 Q 297.12012 349.88965 298.15674 349.88965 Q 299.02148 349.88965 299.7251 350.2253 Q 300.4287 350.56104 300.88794 351.15454 Q 301.34717 351.74805 301.48145 352.52686 L 300.2246 352.52686 Q 300.0044 351.82327 299.4807 351.41504 Q 298.95703 351.00684 298.16748 351.00684 Q 297.49072 351.00684 296.95093 351.3506 Q 296.41113 351.6943 296.09692 352.36304 Q 295.7827 353.03174 295.7827 353.99854 Q 295.7827 354.96533 296.09692 355.63135 Q 296.41113 356.29736 296.95898 356.6438 Q 297.50684 356.99023 298.21582 356.99023 Q 299.1665 356.99023 299.74927 356.42896 Q 300.33203 355.86768 300.35352 354.90625 L 298.39307 354.90625 L 298.39307 353.89648 L 301.55127 353.89648 L 301.55127 354.81494 Q 301.55127 355.8247 301.1189 356.56323 Q 300.68652 357.30173 299.93457 357.7046 Q 299.18262 358.10742 298.21045 358.10742 Z M 312.33936 358.10742 Q 311.30273 358.10742 310.48364 357.61328 Q 309.66455 357.11914 309.19458 356.20068 Q 308.7246 355.2822 308.7246 354.00388 Q 308.7246 352.7202 309.19458 351.7991 Q 309.66455 350.87793 310.48364 350.3838 Q 311.30273 349.88965 312.33936 349.88965 Q 313.37598 349.88965 314.1897 350.3838 Q 315.00342 350.87793 315.4734 351.7991 Q 315.94336 352.7202 315.94336 354.00388 Q 315.94336 355.2822 315.4734 356.20337 Q 315.00342 357.1245 314.1897 357.616 Q 313.37598 358.10742 312.33936 358.10742 Z M 312.33936 356.99023 Q 313.02148 356.99023 313.56128 356.6465 Q 314.10107 356.30273 314.41528 355.63672 Q 314.7295 354.9707 314.7295 354.00388 Q 314.7295 353.03174 314.41528 352.36304 Q 314.10107 351.6943 313.56128 351.3506 Q 313.02148 351.00684 312.33936 351.00684 Q 311.65186 351.00684 311.10938 351.3506 Q 310.5669 351.6943 310.2527 352.36304 Q 309.93848 353.03174 309.93848 354.00388 Q 309.93848 354.9707 310.2527 355.63672 Q 310.5669 356.30273 311.10938 356.6465 Q 311.65186 356.99023 312.33936 356.99023 Z M 318.93652 358 L 318.93652 349.99707 L 320.34912 349.99707 L 323.3623 354.76123 Q 323.5503 355.062 323.80273 355.51053 Q 324.05518 355.95898 324.32373 356.5337 Q 324.28076 355.9536 324.26196 355.42453 Q 324.24316 354.8955 324.24316 354.55176 L 324.24316 349.99707 L 325.4839 349.99707 L 325.4839 358 L 324.06592 358 L 321.36426 353.74072 Q 321.16553 353.4238 320.9856 353.1123 Q 320.80566 352.80078 320.59082 352.41135 Q 320.37598 352.02194 320.08594 351.48483 Q 320.12354 352.23682 320.1504 352.82764 Q 320.17725 353.41846 320.17725 353.72998 L 320.17725 358 Z M 328.35352 351.0498 L 328.35352 349.99707 L 334.56787 349.99707 L 334.56787 351.0498 L 332.08105 351.0498 L 332.08105 358 L 330.85107 358 L 330.85107 351.0498 Z M 340.43994 358.10742 Q 339.40332 358.10742 338.58423 357.61328 Q 337.76514 357.11914 337.29517 356.20068 Q 336.8252 355.2822 336.8252 354.00388 Q 336.8252 352.7202 337.29517 351.7991 Q 337.76514 350.87793 338.58423 350.3838 Q 339.40332 349.88965 340.43994 349.88965 Q 341.47656 349.88965 342.29028 350.3838 Q 343.104 350.87793 343.57397 351.7991 Q 344.0439 352.7202 344.0439 354.00388 Q 344.0439 355.2822 343.57397 356.20337 Q 343.104 357.1245 342.29028 357.616 Q 341.47656 358.10742 340.43994 358.10742 Z M 340.43994 356.99023 Q 341.12207 356.99023 341.66187 356.6465 Q 342.20166 356.30273 342.51587 355.63672 Q 342.83008 354.9707 342.83008 354.00388 Q 342.83008 353.03174 342.51587 352.36304 Q 342.20166 351.6943 341.66187 351.3506 Q 341.12207 351.00684 340.43994 351.00684 Q 339.75244 351.00684 339.20996 351.3506 Q 338.66748 351.6943 338.35327 352.36304 Q 338.03906 353.03174 338.03906 354.00388 Q 338.03906 354.9707 338.35327 355.63672 Q 338.66748 356.30273 339.20996 356.6465 Q 339.75244 356.99023 340.43994 356.99023 Z M 350.85742 358 L 353.7041 349.99707 L 355.20804 349.99707 L 358.1084 358 L 356.78174 358 L 356.0459 355.88916 L 352.89847 355.88916 L 352.18408 358 Z M 353.24756 354.86862 L 355.68604 354.86862 L 355.22412 353.54733 Q 355.063 353.06934 354.87497 352.43823 Q 354.687 351.80713 354.45068 350.9585 Q 354.21432 351.81784 354.02902 352.4543 Q 353.84372 353.09082 353.69336 353.54733 Z M 360.76855 358 L 360.76855 349.99707 L 363.63675 349.99707 Q 364.56055 349.99707 365.17822 350.33813 Q 365.7959 350.6792 366.10205 351.26733 Q 366.4082 351.85544 366.4082 352.59665 Q 366.4082 353.3379 366.09937 353.92603 Q 365.79053 354.51416 365.17285 354.85522 Q 364.55518 355.19626 363.62598 355.19626 L 361.99316 355.19626 L 361.99316 358 Z M 361.99316 354.15967 L 363.50778 354.15967 Q 364.38867 354.15967 364.77808 353.71655 Q 365.16748 353.27344 365.16748 352.59665 Q 365.16748 351.91992 364.77808 351.48218 Q 364.38867 351.04443 363.49707 351.04443 L 361.99316 351.04443 Z M 369.32617 358 L 369.32617 349.99707 L 372.19434 349.99707 Q 373.11816 349.99707 373.73584 350.33813 Q 374.35352 350.6792 374.6597 351.26733 Q 374.96582 351.85544 374.96582 352.59665 Q 374.96582 353.3379 374.65698 353.92603 Q 374.34814 354.51416 373.73047 354.85522 Q 373.1128 355.19626 372.18362 355.19626 L 370.55078 355.19626 L 370.55078 358 Z M 370.55078 354.15967 L 372.06543 354.15967 Q 372.9463 354.15967 373.3357 353.71655 Q 373.7251 353.27344 373.7251 352.59665 Q 373.7251 351.91992 373.3357 351.48218 Q 372.9463 351.04443 372.05466 351.04443 L 370.55078 351.04443 Z M 377.88376 358 L 377.88376 349.99707 L 379.1084 349.99707 L 379.1084 356.94727 L 382.7339 356.94727 L 382.7339 358 Z M 386.82813 349.99707 L 386.82813 358 L 385.60352 358 L 385.60352 349.99707 Z M 393.4253 358.10742 Q 392.38327 358.10742 391.56958 357.61328 Q 390.75586 357.11914 390.28857 356.20068 Q 389.8213 355.2822 389.8213 354.00388 Q 389.8213 352.7202 390.29126 351.7991 Q 390.76123 350.87793 391.57495 350.3838 Q 392.3887 349.88965 393.4253 349.88965 Q 394.26855 349.88965 394.9668 350.20923 Q 395.66504 350.5288 396.12695 351.13303 Q 396.58884 351.73734 396.72314 352.58594 L 395.49316 352.58594 Q 395.34277 351.82327 394.76538 351.41504 Q 394.188 351.00684 393.43604 351.00684 Q 392.74854 351.00684 392.20605 351.35327 Q 391.66357 351.6997 391.34937 352.3684 Q 391.03516 353.0371 391.03516 354.00388 Q 391.03516 354.97607 391.34937 355.6421 Q 391.66357 356.3081 392.20605 356.64917 Q 392.74854 356.99023 393.43604 356.99023 Q 394.188 356.99023 394.76538 356.5793 Q 395.34277 356.16846 395.49316 355.40573 L 396.72852 355.40573 Q 396.60498 356.20068 396.15646 356.8076 Q 395.708 357.41455 395.0071 357.761 Q 394.30615 358.10742 393.4253 358.10742 Z M 398.81396 358 L 401.66064 349.99707 L 403.16458 349.99707 L 406.06494 358 L 404.73828 358 L 404.00244 355.88916 L 400.855 355.88916 L 400.14063 358 Z M 401.2041 354.86862 L 403.64258 354.86862 L 403.18066 353.54733 Q 403.01953 353.06934 402.8315 352.43823 Q 402.64355 351.80713 402.40723 350.9585 Q 402.17087 351.81784 401.98557 352.4543 Q 401.80026 353.09082 401.6499 353.54733 Z M 407.37158 351.0498 L 407.37158 349.99707 L 413.58594 349.99707 L 413.58594 351.0498 L 411.09912 351.0498 L 411.09912 358 L 409.86914 358 L 409.86914 351.0498 Z M 417.68018 349.99707 L 417.68018 358 L 416.45557 358 L 416.45557 349.99707 Z M 424.2881 358.10742 Q 423.25146 358.10742 422.43237 357.61328 Q 421.61328 357.11914 421.1433 356.20068 Q 420.67334 355.2822 420.67334 354.00388 Q 420.67334 352.7202 421.1433 351.7991 Q 421.61328 350.87793 422.43237 350.3838 Q 423.25146 349.88965 424.2881 349.88965 Q 425.3247 349.88965 426.13843 350.3838 Q 426.95212 350.87793 427.42212 351.7991 Q 427.8921 352.7202 427.8921 354.00388 Q 427.8921 355.2822 427.42212 356.20337 Q 426.95212 357.1245 426.13843 357.616 Q 425.3247 358.10742 424.2881 358.10742 Z M 424.2881 356.99023 Q 424.97018 356.99023 425.51 356.6465 Q 426.04984 356.30273 426.364 355.63672 Q 426.67822 354.9707 426.67822 354.00388 Q 426.67822 353.03174 426.364 352.36304 Q 426.04984 351.6943 425.51 351.3506 Q 424.97018 351.00684 424.2881 351.00684 Q 423.6006 351.00684 423.0581 351.3506 Q 422.51563 351.6943 422.20142 352.36304 Q 421.8872 353.03174 421.8872 354.00388 Q 421.8872 354.9707 422.20142 355.63672 Q 422.51563 356.30273 423.0581 356.6465 Q 423.6006 356.99023 424.2881 356.99023 Z M 430.88528 358 L 430.88528 349.99707 L 432.29785 349.99707 L 435.31104 354.76123 Q 435.499 355.062 435.75143 355.51053 Q 436.00394 355.95898 436.27246 356.5337 Q 436.2295 355.9536 436.2107 355.42453 Q 436.1919 354.8955 436.1919 354.55176 L 436.1919 349.99707 L 437.43262 349.99707 L 437.43262 358 L 436.01465 358 L 433.31296 353.74072 Q 433.1143 353.4238 432.93433 353.1123 Q 432.7544 352.80078 432.53958 352.41135 Q 432.32468 352.02194 432.03464 351.48483 Q 432.07227 352.23682 432.09912 352.82764 Q 432.126 353.41846 432.126 353.72998 L 432.126 358 Z M 443.3906 358.13428 Q 442.04248 358.13428 441.2422 357.50317 Q 440.4419 356.87207 440.38818 355.77634 L 441.61813 355.77634 Q 441.67188 356.43164 442.18213 356.74582 Q 442.6924 357.0601 443.38525 357.0601 Q 444.14795 357.0601 444.64746 356.70557 Q 445.14697 356.35104 445.14697 355.771 Q 445.14697 355.25 444.70923 354.99487 Q 444.27148 354.73975 443.62695 354.56787 L 442.6924 354.31006 Q 441.70947 354.0469 441.15894 353.53125 Q 440.6084 353.01566 440.6084 352.19388 Q 440.6084 351.50098 440.98172 350.98267 Q 441.35498 350.46436 441.99683 350.177 Q 442.63867 349.88965 443.44434 349.88965 Q 444.2661 349.88965 444.89185 350.177 Q 445.51758 350.46436 445.87476 350.96655 Q 446.23193 351.46875 446.24805 352.1025 L 445.05566 352.1025 Q 444.99658 351.5547 444.5481 351.2539 Q 444.09964 350.95316 443.41748 350.95316 Q 442.6924 350.95316 442.2627 351.28345 Q 441.833 351.6138 441.833 352.12402 Q 441.833 352.50537 442.06396 352.739 Q 442.29492 352.97263 442.63065 353.10962 Q 442.9663 353.24658 443.2725 353.32715 L 444.05124 353.53125 Q 444.43262 353.6279 444.83813 353.79175 Q 445.24365 353.95557 445.5874 354.21606 Q 445.93115 354.47656 446.1433 354.8606 Q 446.35547 355.24466 446.35547 355.7871 Q 446.35547 356.46387 446.00635 356.9956 Q 445.6572 357.52734 444.9939 357.8308 Q 444.33057 358.13428 443.3906 358.13428 Z M 453.34082 351.0498 L 453.34082 349.99707 L 459.55518 349.99707 L 459.55518 351.0498 L 457.06833 351.0498 L 457.06833 358 L 455.83838 358 L 455.83838 351.0498 Z M 465.42725 358.10742 Q 464.39063 358.10742 463.5715 357.61328 Q 462.75244 357.11914 462.28247 356.20068 Q 461.8125 355.2822 461.8125 354.00388 Q 461.8125 352.7202 462.28247 351.7991 Q 462.75244 350.87793 463.5715 350.3838 Q 464.39063 349.88965 465.42725 349.88965 Q 466.46387 349.88965 467.2776 350.3838 Q 468.09128 350.87793 468.56128 351.7991 Q 469.03125 352.7202 469.03125 354.00388 Q 469.03125 355.2822 468.56128 356.20337 Q 468.09128 357.1245 467.2776 357.616 Q 466.46387 358.10742 465.42725 358.10742 Z M 465.42725 356.99023 Q 466.10934 356.99023 466.64917 356.6465 Q 467.189 356.30273 467.50317 355.63672 Q 467.81738 354.9707 467.81738 354.00388 Q 467.81738 353.03174 467.50317 352.36304 Q 467.189 351.6943 466.64917 351.3506 Q 466.10934 351.00684 465.42725 351.00684 Q 464.73975 351.00684 464.19727 351.3506 Q 463.6548 351.6943 463.34058 352.36304 Q 463.02637 353.03174 463.02637 354.00388 Q 463.02637 354.9707 463.34058 355.63672 Q 463.6548 356.30273 464.19727 356.6465 Q 464.73975 356.99023 465.42725 356.99023 Z M 477.6816 349.99707 L 477.6816 358 L 476.45703 358 L 476.45703 349.99707 Z M 480.95407 358 L 480.95407 349.99707 L 482.3667 349.99707 L 485.37988 354.76123 Q 485.56787 355.062 485.82028 355.51053 Q 486.07278 355.95898 486.3413 356.5337 Q 486.29834 355.9536 486.27954 355.42453 Q 486.26074 354.8955 486.26074 354.55176 L 486.26074 349.99707 L 487.50146 349.99707 L 487.50146 358 L 486.0835 358 L 483.38184 353.74072 Q 483.18314 353.4238 483.00317 353.1123 Q 482.82324 352.80078 482.60843 352.41135 Q 482.39352 352.02194 482.10352 351.48483 Q 482.1411 352.23682 482.16797 352.82764 Q 482.19485 353.41846 482.19485 353.72998 L 482.19485 358 Z M 493.45944 358.13428 Q 492.11133 358.13428 491.31104 357.50317 Q 490.51074 356.87207 490.45706 355.77634 L 491.68698 355.77634 Q 491.74072 356.43164 492.25098 356.74582 Q 492.7612 357.0601 493.4541 357.0601 Q 494.2168 357.0601 494.7163 356.70557 Q 495.21582 356.35104 495.21582 355.771 Q 495.21582 355.25 494.77808 354.99487 Q 494.34033 354.73975 493.6958 354.56787 L 492.7612 354.31006 Q 491.77832 354.0469 491.22778 353.53125 Q 490.67725 353.01566 490.67725 352.19388 Q 490.67725 351.50098 491.05057 350.98267 Q 491.42383 350.46436 492.06567 350.177 Q 492.70752 349.88965 493.51318 349.88965 Q 494.33496 349.88965 494.9607 350.177 Q 495.58643 350.46436 495.9436 350.96655 Q 496.30078 351.46875 496.3169 352.1025 L 495.1245 352.1025 Q 495.06543 351.5547 494.61694 351.2539 Q 494.1685 350.95316 493.48633 350.95316 Q 492.7612 350.95316 492.33154 351.28345 Q 491.90186 351.6138 491.90186 352.12402 Q 491.90186 352.50537 492.1328 352.739 Q 492.36377 352.97263 492.69943 353.10962 Q 493.03516 353.24658 493.34134 353.32715 L 494.1201 353.53125 Q 494.50146 353.6279 494.90698 353.79175 Q 495.3125 353.95557 495.65625 354.21606 Q 496 354.47656 496.21216 354.8606 Q 496.42432 355.24466 496.42432 355.7871 Q 496.42432 356.46387 496.0752 356.9956 Q 495.72607 357.52734 495.06274 357.8308 Q 494.3994 358.13428 493.45944 358.13428 Z M 498.9126 351.0498 L 498.9126 349.99707 L 505.12695 349.99707 L 505.12695 351.0498 L 502.64014 351.0498 L 502.64014 358 L 501.41016 358 L 501.41016 351.0498 Z M 506.43356 358 L 509.28024 349.99707 L 510.78418 349.99707 L 513.6846 358 L 512.3579 358 L 511.62207 355.88916 L 508.4746 355.88916 L 507.76028 358 Z M 508.82373 354.86862 L 511.26218 354.86862 L 510.8003 353.54733 Q 510.63916 353.06934 510.45117 352.43823 Q 510.26318 351.80713 510.0269 350.9585 Q 509.79053 351.81784 509.60522 352.4543 Q 509.41992 353.09082 509.26953 353.54733 Z M 516.3447 358 L 516.3447 349.99707 L 517.56934 349.99707 L 517.56934 356.94727 L 521.1948 356.94727 L 521.1948 358 Z M 524.06445 358 L 524.06445 349.99707 L 525.28906 349.99707 L 525.28906 356.94727 L 528.91455 356.94727 L 528.91455 358 Z"/>
+    </g>
+</g>
+</svg>
diff --git a/packaging/macos/dmg/background.tiff b/packaging/macos/dmg/background.tiff
new file mode 100644
index 0000000000000000000000000000000000000000..119a02d338e33952283d6eae42416fdf90ac16b7
GIT binary patch
literal 94912
zcmV*AKySZENh$!CVE_Plob6qUa^pI#j3_I&oXX7p|KDz*y8(g}Wy?wC?$I2gY9@{?
zQHtGeyusV;56bU1$hNF+Z|~{(`}@0IT9?IMgp_5|&vGlje)v`vTUZyG^3RsrpOm;t
zF*v;6Zg0Pqr7R1;K`54GF}OhdQCUh^K7RIACMK^Vw?87E_uK7PDb9e#hvdL*p_I2(
z{8%a`-vHKP;9Qqwu<SQ*Ix%@2x%~;b8_oc~P?wvK=b&7j6-ykmy%l?EfkrQmNn=(#
zFh>2)mv3oe@;Y++1M)8ND-A0B0iIo!x0NqdOcolR#;#>q6B3u(?ekMee!G9|o+c)*
zBe$QIduZgfWFN+bR9Qrn36m?7_X?sc#W;~jG!xX({Y6MlOkPNS7LC8|_YZ?4)GsgK
zE=>|?brL1e3)q%IU&#I~<*nRr((^cceS2Hiuix(E$?M3ELek-55L*|yHH{Y&&ln!b
zrADO14qX#=?XhvJ(X5oV8JX?%%5whpCnm2WKM2Y9t;kkfmQvP|B9FcLwnNON0VNtI
z_6H;tFQP3=8y@<=`X6Uq@rlXn$j?DCmV^zt8YXM(vBMl*lYY0OOX-gwZkLTb3gqUC
zVS&{g^@+*9PJRlJv?3*232;guXT5B~$hqs}Wi7iTi@chRuwIs5EkzcC@v{8i+54M3
zc^&x~L{eMt6>!zx7J7sVrjfZW7Vin7To$@F&6##;KytmCVem<cEURgIQ~l@faOM^-
zBj3Z~2ZA-Fb&s>GJt#e)V<=oml*JY>_1&I_13g|;FMw;TWwYmU4t-+suaR#-@^>lK
ztqIgL>u>QyS)jp@t3d?vjZ|m<txNGl4@H(J53ZgQQNI<$J%{PXBbhvT9r+F<+m+0%
zA$k-8lEf2cG_Fx;0k}bVTdb&<Nm)hVBMYBLOsJTnP6L$J=^{fDlYfhR50a}9Wn)M}
zr|v+>0}PPc+a}_yfuNey@kO)*|MRS(Vn<@lvi`o^K0fZHlwT(TLX#)2Bj18#GV~0Z
zTCy_@v!|oP;Tj|e?`B!e-APeOR8smcVGrO3Ns|||7`=>#r{$Itlh=_~k$AtqLsXO7
zsqI{zmL%mDOEoE3Y_Y5;mz2{30feh>#B<Fs1qoL_YSRORLZ5Ku#N>74HAL2ei6q-f
zanc;%vbsKSWpW7{jKdYk%#}ip&rKZbHE!bAZhd3ViOIi3UgF62Y8zImUNPaK$YLw?
zIWs=Jo>yo^PMd|ie9HdQ5pJA@p96fhaU**F>-~QFxZe*7hbB*6N6rKCcXEN7B}{QQ
zN;{{z{i)XTaTat$m$GbTR+1s1)Ae!$l2T5Hu1@_1bTZW96O-4GlZbrR;X_bDe=80o
zY)TDR=}OkB3iimOC3O%2YG|@LI@N`ut7EH~eTnZw6D1wSh$belBc~|x-7vQvfzr9E
z(5f7IIeo<%dC**M$7C_f5j_z`lXZQn>$>U|T>7@<Yat@F9lGEXlh=`_fcz-`X;X(@
z^c_L&BgdwbwhV(r$mk?(N*a`fA)?h8vX3jl9`&x<-6hOy9sd~<lh=`Fko?@I4p#?{
zyVASn2II>o*Cp1<vW7#AIHeILUep4WTr(w_^2WdBDx&aZ`5b8PiOIhQlY18eFxmis
zaTC8|<8h0BBy(a}VA5lgd>Mqu<V{*%K2Y-B^JO6ulNXkUfc%A`hp4lN2ga0)UlSF*
zCf#IXjx}tSV)Pi8#QFpqP6g@~>u2oCFLR>DSIS~VZIdT2D#w8A;*6}xS&R9{M5Cwq
z23=r~+L7}>42q6;V3LJGx+Y6Dc1}Dz?{pzNr<*ZP3lCdgXX@_j$OA-LRT#2{_?+cm
zn;RUht>!I*+jiDt8?Zc(679C`do!?^*F)g4>oHr6hwE=D6Ry9HxN>6hI&x@6qRA^L
z%w$6t5+1hwWSH;>c?9rdTr&0@P7c$I-a4jbU}I_wRu%iM_yJu`=fI|%n7ocWY>E{@
zN+M|O<&f4c^T3fAz_Raeuoc3|VcTrbB+GeO`nC_jtK+8)6{$pnmwf;D_!Og0OkPR`
zfP9yw_+0rON@cOu|8D6nnr*y$g2_ddn5#a`?n4Jw5z-ktk0<NJz~fauCQn{ThFQc$
zXMY8nQ0=3Vj8@ru=XUbvW8fNIQs-lGvy}kSRq`eEJyMf7I3AVh%<N3veH|G<GIwOj
zjvUAuYS|*>ehitefhCgC>9p3D*Gged`n)w_&z|+-HDT2I9&<&9MT@|-x}9`4^uNpJ
z#N>6PSKN^*JmEGAAgX|<>e^G|8o|=cJ#F-@&l7M=VpxF)(ofV}A#dMN+%iGZE@-f4
zua0Wh{05hD*GRV6OM6vJ=1RxsQh}TO8TsT%aW|D}8I(NGF&R|pHYKqXzPLB$^2?Bb
zM@dG9U978Oo0z<e^pNbMedh&<o!*F)L1^)wEebE1ir#gHN#fSJ9DyZ+BdUG9E!Xjh
z6)N(=ui-s3)oUBP_&Lw~8qz`Xds5jl^tKPQ04S9stfWas4Id{kX=!j~!p*+4a1oc_
zNt{!_$GLLS5;y^ObIz=)Q{+7{c^zqO$?prvDzZL#uwNcX<wsLFTUs$N$?`~Zn^D1L
zgxF|q6Nh9I@;S<Jf*~g+uOr>;yq^#TC2fETnJof3oG-ws0i-*QU{l|svmG#t>LX4g
zFwKr9195SuD49zqj>Rn4iOCCM(xX1~qF*+>pd}*)<2|n|zTFZi9dtfWAE>f)OoA4I
zLzZ(iI$V_SPFe3-(u;69Nm4g4u!iAOO-x=#a;Q8_BIW$37l^ZO@K$t3uYw-oquBbK
z69lqk;e|EWCQKR(Z6uKS*8*qujGB4Al_IOV-wK`diOK7TAo;7NYc$EZ3H6*47WyvY
zOOd6P3db2N9Gj8A2wdLaS!+x*jy38;Z>^b@ePPDlOwj4WBjol^zxy%*M1EG?m&4op
z-u~yZ_VE~p68pLVMNz2fRG5QhQ!yqjP*{-gp*crLI)5;N+L4%J_If3Ha5YzTV)8md
zTavwjJ6Ays*Dof$qi}prwQ{8Svf)KlL4p?pM+)k|sAS&Jl)b^W-k9H>BNAMhuA^L#
zN7AP~c_ndMvf;NRR{U_($8d<$2+<7YVT3nR@|0dSh`D0tI6oDhD_oQ(x_Bop1M#fn
zWO7G=dVC$+bO2{gp1h9OWK)Mw$7#97tSeMxXEnTv<Zjn9OWBlG>8wBl9_Wq#Dsn0&
zX;RXV)HkJT38UZbEQwlUeVY^z^_S~kgfT@kk8=${8`zK`9}3ODV8pI+*AYHwZj?od
z@hw!!!X!*b@2Wt&ax;gV^=k@RlJW>nI`C=Gl|r5Y$y`Rl0?diYYsjmJj0j-LX$J;F
zqN$N)ViL@mG(0Qs5@B*|BGzD%+)4A2NCX<impSsY(%{q`;s#pMpMLk1qzNOQk+q#a
zm2-Rv*i_wKmb>qs6&UqHlP}yShfA)(7_d5>CK*s-h@iRaoOc}lk?W80B+5#^cy2%N
zYsyYeQKVaps+Nr+a>F7WbDKVi9@c8}p#z)`Q){f5ihya%WKpx3?uHokIFMQyxhp6a
zs`Wti{`R})wYPsVx5!qwgW`I_lGhXa7fElyD~cv<XFBD9L=o(f#O4jCpH1NxN;OHn
z+t#VeBj&!0{ZE53*OH;yk>@BI1T@x=B?n)?Ct~i=volVa*haM7IU)(##Lr-|-qJqK
z(3Ia*Sfw-0pfbG4+Icx;C$*~VkyNm)bw3b3Hpjb`E~eG?sTXcL+hMX%!BJAtVA6-U
zkSfEnjM`m$Zj1SVLwOmK{c3?pn#x2}GY{s(gar;~=Wv<F-2QKtvuY<>jDlr-x{htp
z6#R&36UO+@ymY<bSc}izhp18i3zPitV_b{ENDTOJEPAPs#MAu_dSAdKRd-g-BTS}u
zFHf&|`Yx&(rSAus(#Q+uwqOamgzKyo8m=f^qZocHG05DF!8*|(qT0T>Sghn_=4!{G
zN2Ge9s5IC2fV0>hFx6R1>c00xIl^ShX+D_gmEXdN$+H4Qw2jIf;3f7k9#mPFQ&Z1$
z2-U=SUWH|8G0W6!%GQ_+Yc*q%)T25#_}|pru_zV{OSc(J5Tzeq!(`sRRC8vC$tZt{
z!jCN%RPm4D*DSu4;W3d;D-(a+dH=hG+cgv`=^0RFGYQwvaMRJor}3@z@F2-=aFv+j
zq7S-avi5QlWew>nSY((~7CcRrR#Byf40yw1no!wv+`foOwWn1zAWWvOOj}|SM5;1n
zp04k3jf(a1<c|KGf;Y@u*jK#33d`IJE+y9c2F$9Y2xAmm`e)*3VveWmFo`N(ZLJ*C
zqSi6rQU_@ukCbD-(U@NFElf7F-C?o=RV7cpKMe|FyQzuEr*eSBXAlhna8lqKUmIqt
z?uz|oQJcn1>iiTQQiCj-0i1yzP>{0rE2wB)mqSPs8AS9uA`=wEX}9u4Ov+Y?5Kh+J
zS-)4QPMW^(GM!=aPThS**p!t7<T5VVCQz*gJQeNMNtF8d7#UA}T&UNP;wDZ!<YWA7
z-Hfg!QGmY3q=Mqr*wgAh^uV@p)R2Cn)9`CmaJoLM+1D^BwOoB2{iXS+N0^MTS?(yF
zKF&F5w@#2p?F`7LYX!Qu!uCzn4$iKgL#Q--XtxI6`BSk+Y1#O^K$(s11_`VFqQ*VL
z5b((tTa908yFB*b)*R2*{O)8i?lCzI?6w*H=w<Vbc4sW;C84v^nR8a4$n8PU)e_(K
zMyEL{rN*V-pmMRWQi6&i`oL)UJ$1STDYL~S7<-GB8VA`Hsm8D%MUSYT3o9Yi`%Cf3
zFf0<j$_tp>Jv%Y^B}rys2BqzqjnCNIVs}F(1m66V513}W2w-41D2j9AGp{<{n{1nP
zxg{C=CVVm6te~|P)x9VTLLrg&rd3YYc6cx6akgieJl5SgHI*SgdGZC>VJv?(n3bEd
zCSz2#kgm|u6<C-9zZn~TiYB?U2}Y}G7(urVr}WB~7W92%9e1E?ZB?ghm}LyH^z`GY
zx}fH3g=fBr$wuk4FU~y96N$(SD{VVr7lHzWd<Ii0;`Je-og$(G)~Y0+$2DMJqZdNm
z>_!_w*WQC(g8$+ls-dtBse}Olo08UW>W+YaWv{)ITlAZLh{-+{#36$TlhJz~Hs-|S
zSxFn(Ajr2DIX(cNZ=zj~Yq`zShFF@4mfDxfv}|%?4AwF^!?p0BU$Y(@ZM1;<2q8~K
z0(k~#+p)(H&Okt&mZetQ7h^$ZFu9MJ%T*6&ENc~irzcN7m+CvKw!wluWA5XVntq#(
zh&A|vFlvjdzkxLq_Jn3$U{;mlk;#AdkG{jCq0Futc_OD(4}EHm0k;ti&qwu^F+}5a
zOa>4~es||$^R3C4Oe8-s`GTbKoX$8ZzVp%^n!A)lilDm>qEANCpkeaickYN|C?ZYL
ze~#Km*scv#M~XY?KyeLCQ2N;Q79s@0mB^xB!(;_mjZ~(i^c9WAo<Xdb^vvhP<O>p?
zWTar)3{D#xIu=x#M^KMpbcH*KCYvw7EQ<zU&;@7xS=}gXwTG=O5PLHQ(zjZarr3Ep
zL%|`u1W3MQPY&Lmnyc<H>2p8yw?_+a&y)UD>2&uj>K#iU%AeR*YY&4&0T}KnFRbXN
zqS{IrGr3}UIj*PZp*Mcj8RohgI4>ub#kizNV{dC^;0<p(16UuqEK@?#MhSimlkGQh
zS3lXlHEqsDCqIY<%^Hlc?B5#Fn>!|uM_lR29uGx^D_nPVFy))7%rZ@Sa@s$|Fc0Mh
z@jvzP$eP3sd$CDqYkc}gFY`h5mnUbljN&tqni}{x9VlxdW#@PMK9V~Uom4rL#4Qpk
z$_)jH)mzv>v8Hfzo~kZXn`5PHEZ5?sJ;Wt-Nj$XQI8RL(>6CnQ&l`J;A!3gvUSSR+
z2uQl>%njEjx*`0QRXO&04MvCu;m4S)sEn9bem_;hG4Q*cMW5W#zfum~7;}zMk*E^H
z9VV4g8OMz!&F)`Yv=6G4n?WM4K{Ld#FbI`tsnymKlumpkT@4u^52BFMvrNd43rY6h
zhP}?tVDj+qcvd9!;DAT1V7raar$E})Cg@!~;(U}Kq>;{+_5XGxdDrdQ(#jtKNo0sr
z>qEL@A8iCGJ;@`FXEPg;T<asub+EPM)YugKGr#sXFgfM_R~nOsj6zc#cAF_zWbX_w
zfyT;|UYB;bdj17niFnd*&X6RXoVXWgbCkT(2GfLAK+222%$yWi8k;K#DBh;;ulw{m
zw>g{TT9Vraft57Xr25LHYj^saFnHKN+LQ)6CgDH%C8(`=u%V0&yV;Q0^Y%@|fH5d-
zk!9*=>22N=2-<#l4#t!}FK+XojinlaX75B61DM%?67KeTa(PQT@;dQS4%JsJoXC!5
zf`KbF>6#BFleAuhiM)Cmx+n3afqgnLc_E1@6aWpfD+7U@*Qdhcw7k>Y=;R|z!Xx&<
zFVTk!w?1#7OiMIR9s;B4H=bYXCF|S*ZWX08=H$ui2=<7t8y6m6(o}ja462F}XJ?}n
z9!aOry@S@+uD>>6x*2qsy=Hc@ai>hfE1=?CKHyC)qG#|pHDdvraLMKCOx=AI;YZ7=
za7KoQCgO(L$7<mvwp@3h?6w5K6#YDCH;zpYJi_kX4vlCKAa$^xGx+jo!;1RlsdKR=
zCa)r1L}QL@ltLa53jAHq>~^3@z79I{+lwrfjr*(n0YICk4k#U*jRbyY%;gSA1#aDK
zs&dJzkS8XuC6-^I9hV)Ln26RLtfXKv+L-7Ib8asLd^Z@Q7xXtUG6_c+Tp56bLry0@
z``M|6a%U6Zw5G0U^5k{I{pObSniNcyb@TBT0U4hgG(LmzCHHQ|!p*sv_h#%So2+Za
zWWI>!m&Ni~WJ^TA@;oNLy$$M=ACOuZ(aDMk`aqh9OVafNqBOuLo%kS*3AYNF8K#bW
z7NEGe_T=X9PXoig^t0ZIl8h&3?B9Q8Bh)G16qGfNx)$lf?y=NP8HoOsArm6+@@%XI
zfaX<e=$ZvSBg3uHX$UjcIjd_wCt<L%PbJ*W?QQp-Hu;<KKNI#O92KJ(5VnD_R?E6G
zG6vdP=ITRCGRLBQ#n?Tdae?ww(7H%xOeypJDw+?}Uq#JcUY`CGlRvVF`IPU<L1(Ot
zN_JN@&MtRJO1%bIQFhovR?k56kS5XXmnKeeu1X5y_{4!jOxg-<oG8CYkL&~{??1PV
z`IPSnKFCq8qWi$@hwZH|?T~?kS-(2_L`hbY&*5<Clx9Q?2#{@qst#6Y;zaocw(UH}
z<ZtbV`uq9qPWhw4Px3%@o7&u#wHEr(=p!imDFb^!L-v_5f);&b{gL;0r<+0tnd|}<
z=#B*K6^D-08J=vmGN1Bi<S7(bg$7Wx&9O;)C)I5!X3N<yox{DjAMf=7mV6in(#i_y
zXjc*|#I4qWR{=Me9H39Fk)!)L)k`~h@*g6(o#{ZduZ<apX6tdYIiS)?HXasXv$K0U
zTL&U%2in`Nv*t~exuERH5zd)AA6W`EU1r*oml0(_9(K%XycGN$R&VDakz=A{9DY?~
z@Pt^%9I9J0R-#d?sbpu%;?WKdY>_<tJEz}$4QXl?j|742f;Q}6FT!y|fs7V<uK8>=
z4opu>7DN*mk~gHuHsEAmpssW>tud(cfSik&&-mm&LX?_&D&B9HQ^-d;neMvJ_8uQ&
z3CiXivpg-AV_R$y`|6#=n2cr>!{lgLWGCCFaG$u7na8=9JSIvd_s}cTwLl!Pl6;Ya
zrbxL<?Q^xchDC9rNsh@tE+&o*^KvIXt}4V0-kI;dnvCO<6?nPOw|3GW6k2jO8TkFf
zx#(LNT7)&sL)SYsZqsXyTR2V(ZA?53`d?>V(8Z+g4RQoZ+keK6tj$`Dk=Ih5&#giQ
z+#ugL+#1omnxf80beGquswh%weI=^{85)ReamyPA@S8I+c`-R2lU7wUw?*FC!9Wn>
z#D+0xMiL5p2idH?0hrWv!_CGj@+(c2UPpJWx)kIoQ-I3jv=ft8lfEHwPnGI%RfmM{
z77N+B4e+uZSx1(HwjE;$hAM{~C=Oo}>Z})UFJLDO!%RLyr86uhCf_b2{{_#vf}wbv
z?Ols<<T#EjiJ>k3{}*2%GXa7Rsj4q#cg$!adOWs7k+ds?H^A2mbRHk+<e2ih3VwVw
zbhSSo$MJfV<5m2+{Y)ya^L&-kj<<owiBZQ<Fg7jS5B5pAJ?N?P^}5b}e>UZ0_@-Y=
z=k*0BD>%>7P*ToQpK>XIJtsiJfpG$G_1^0>f!XUQ<v3rLFbUv`e3fR)Q%qvn;)qO7
zY)r03=h0%)IMxI4kpswd@N^(M#VGkhxsD3j3rud{t>v(7yvjjDVNUMKel&zP!;kA_
z>$kA9d2K%h!0g_G%_rBQo)ta{a}$mggoTtQGj>Nr5VghuTkH^_=ZMK-|AE(~H^Vrh
zfwdhD_UoKFT?{p&c}q4X*CT!Uk0QH5vdm;}C5;T&9Rp7Uvux)m24t#}f|j%3^E6pM
z^44pz55oF5&R)UYd~!LuB!H8EzQd%1YobC0(<lUQNusmma2!|cY7a|b(vV3bNh_WO
zH_A8_hIT{_`zp|PgIoS?Ouql^4g6wIo@X^JGCn(WUIPXyxX!}_GX<|-OUh(idR>Ex
z2-#~U6xGq|s+xq0ZhI)tGO@_1O_EvunT^wGAl<zlHg)W9%YT*l+Rz)z_!kWLX=Zuj
z)`z|R6$Cce$nG0K-u|_&v;QE;n;?1p()15}x;SpAP@O!F>oW6Mn1n#)F5AK5w3p%E
zoK59bj8mQ`d;(u!@_oLGp<}w)pZ>Rezwd5wYgp`O0@qUBrPx}<Ccyw0ak2Dic>ldT
z{eMW=_tIjpyYu|lGAI}*P1F1Mu20z<bVL)}uR~lri|*DR^t6KTjCbuzOac$!`R94Q
zvr3ZK;*X){T`@WOTDi6Idc9{5FK>h8`FaQNFhRBg-==Io{&If_-P$*lgL5`H5<zTC
z>f?$tpZDtk?qIXKFUYL!i=w;p2i@^t!_?Vu@UJjg$nwCb${U-Ay;e5^{-w#&GIfO$
zK7e#D%~VdqzX6XPUi+^U6W#*)PrLSCOy<71Q6RrYB=ph~;`cL6Cj%x6_!S(MrddjK
zo1NV(RlQB!#J+rm#CNjWBLTwXj8B%gp()RmFj<G62D~4rhW#youi=vhL%a{vFYU|5
zB*>6gZjJ5l5Q&ff`=Jwp@@Re`<BqicO`4nbS(<2&^n}}qz+}%;2HBUgTVQzqh*#yc
z>Y}%pOxH|qmze;DG4oDJBQBh8F8|Ve8<YIl8d9{8!R;>;N&P*|*2U;A2G3^@CJ(b`
z+-(li-8=!!M-091Zl1>K{sT;wpC9uim7hkROf0j?+u>FvOfko+FlkyTC$X=Y^`17N
z>k)rDO>LXdCeN=Gfb)ytVi7X|j*r};I>s{TqB2ZbM#q5kTj(q9`6sfwr8^7!AEz%A
z@4uNkbuu|C6UMHZdy(k!zpM-V=fAWGu7coT=eoQuLg$22(lkg92=PicO~|_xU2lIM
zF}pv+<dds%)BlW2*4;XU07>)rwVvqSbN-#)$+#jNG$W4mKSmn)n(#`Q4Ax5UJWZB8
zi@!p@JC3tyP6!5GH`a~W!Q!1ak2l$F&!9A+jFgKB=X03h1ra9kKG0=(vo`XH9v9u1
zT$1?l2d)}Pt{~5&A2$tsws21K&;gh;uQ{JB<-9x>1JUazF2@wN@w)Ly3E_>&HK`ZZ
zgZze*;tm@={EKxiv#ZNRqh-kK@vI5JOlDRYGT9Rq<L`A_t_nuD+%(FK$(5*tnNbCI
zFT5ik@f?!C5*qcyJ$OV1bwi2n0pmioO-D>VnAa$p@bEfkidavzQ%u?2`s6YM@fbgy
z(=hi5T{3cRdQvtS`KaOY11L>!!vhI_<ERc8P?1^$?+^1R?{$WQuJh_ox8-98CcNzj
z>ZafRQ8xX{)I^<S$z;*3S{>!fa!_WLy6U#jlaM7{V3PL5LWm;^)Fn$eXDmi;>iO>b
zJWTsGxrp54+L&C5TE^BZk>Ry=*=VLtdO)9lN<#mz8b%9{bM=%G-9kb_6kLqcj17-^
z*NKo)obR*Ba$|BGLeRuN!!ZTJyo5!?2+Wz8+TN@bG;h*JWs>m~id;GtCrOlyB_h~u
z>!P0LPJUBs%o*o~-ZC-0w(MSmTJA%qcw&<NSv!*)YG!$}Lip=-m1h7`XF~LuBQNN6
zAzSUv&SAOPQ6ot<vYIz^25o(EG3t^Cl1f?S^}Uh7=yrkX_eIX6VTk`unK09bSj7m9
z(!L)mANxIAHMP>iHkG#QUW$+nZfr<DcH&zO=X*S`n)+f6?dRn#v$^@tT;d+3>B&%K
zfV8Z0fb)1vyN21F*<{aqQEk3u_acM}gZSxVnM2Po;jhF~9~DWCH%-!<<q*xqMDtBj
zE;7~FfB;J6lP})Jgqc%HmyV9tWn*$3VvS(MWoDG);2wHxQSk?gq_I@!imox<#C;Io
zVTv&wrT5+-Dy68r)e@c0lfTjClgkh+<y;I^^~sdT4=7qyL-Q;HdO##1%U>->hobq!
z&CPx14TtkbZ$`J9$?tG=5$|EFX{B3suR_Deoh+QVzz!5cD>XbAZGC2G{?jETS!Gxc
z8I*id{9CCX;B(cm9tg&HE3o_Db7OKDA~Q-CWN^FNr?#``F-J(2d)0GZf34UemqJ$h
zbYHa#2IJ_kdTxIU`cab_IlgBblgkid#pwey4BC(8tLc$g&GULk9?hF*%+&C4SB=Z&
zdrZn(N-xu_4@+#?BzI-xcwO?^X1#COy$YGt(i%AOK@TX)4S>AgM1=18)@qoemP>SH
zC#Y(8))SG_n>_f>4k@#Ts=36(%dU&d#^f?2&o}@!GQ8GHGy_G>9%|;zphU1Qu{orS
z6LJmbP3xX9K$v`V1|igw;oYV9QmpUT;u=JKP5C|@*Q!SGtXp)wF*9&Vo7iEhKz$y4
zBbn3QJQClY7cp70I3KEJ@xamWQ8)^;0c6l^*}V`+@;29G;8w;nQyFuE=N^zYLGH}U
zsColZ18t`bq-joTBO$+}WAeG&=E{-toW>-zc=O41$SvD24;b`wNP21{a=tTpB2ea%
zHU3AFJo|Op211I{G%olooPkO4aKZkQ;7wa(LVRa=Z`r*Jxn1jh?9o^cg@SJC!c~5?
z5gf~@%ngPBn9TJWNvjs6xn#!JWUo!8)CpqJR*8l&A3XA%zT0!vExQ*YhN{bH-5ycj
zZPg24G#9lpZztJgqqAAL*Km3Ix!-0DL>(^1+bEChE!oVOMwk!0`tK24`~s6{_F?qq
zlj~48rBzfzys>qJxrr!W&lw~Y>rTDLaO{F1xPydx?B>gZ9*XdHcbbl+UU-4;r^u!K
z7KxR24ShEz7ozawkR@7nH@lLWw05CMv(?BDm*U>_h8m$rmz?IJ=lo&#ZZgnx>O<^`
z?OXl;lP%jF(v3EsT!(6CkOI=HW(|1mt*)VDaG%^fKSlF`VYXhICe=1bU0&)1W6~(l
z;X}$BVnq&2@K3#-8tqj22$za&Z2#mM6fST7@R?igr+~<o@zE65HUGwiZ55j6%@}Ny
z+2lT$=DhB-vfJuyQm2-TNvW;MaJ!|<vZ?KstT1d$E{e&>jy3N&j2pHlZ$rmC&(OXP
z&S;`mpvcS*Px5AzaaI3(m&n5;NDv~|etr`$$^HaS0zBn*Lh5&!BO8<JP|GG!XaK;N
zE~$^UO(x@+bs47g6GhQ?meF8Vz`ARiJbsS73EE&J%OeBJ_Mb2*gXbeAYkZwraE9f^
z<eHc??ngMtA<1-_h6LI8*=oaPNkLv|ZN)l3_~oG=*5jC3kg?8SqpTns$josTdB=#l
z?6|MQC*5PfJ8=DPOfJeNS!$);QEZRW4L9|S&TsdpBh!uN)N%w<EWGE7pl$K%^MaY8
z1dL8}lR;}exX+_1qhd1o<oj<D+l8^@78Lb?ooBuhbzLTr`T#stuVly0031ng8tmEe
zc)>0~^Kn|`;#pVp!zbJ70_b*fZEgAECpvofK^jLW!;SI!#(`a@Lnulon1JI`Q`mO*
zsy0rBq<eaf(G%@l2?}EMDza`6fG{%!YMsm_6encQQRgvds<?h~Cd)Hw`)noD28D7E
z6Z&nO%_CMxm1O7iu0<W2yij$`oF4DSl5LiFr~=XRFCsEiZd&~&D+H!Xvk$1UInE<{
zsOw;b6XWe0o?xfu=aSd)n%LG;T~YMl`ltVRoBk`*v&r+amZf$_ITKAT?KMEsTRm3@
zKApE5pj7p%Tf{J}8ZQ#8b7GP%fLN|>2w9f;Hud~vOOBp4CYPb+Q**sdcWAH-+(lU%
z_+FtBZ(eoZqrZaEk)!kK$S;+I<X&}oGTC=PD~^3vFo4?#$=|e9-<VvI>c{5wH6aaE
zfY8@@!HGlj$JI-<9o2!GbE-!#J1BL4i0h=sMUbjX26E;MlR5;-ca<_cn9;^PaidcX
zx%uQ`)I&0qE`?GCHVM~^XG|u%GBdbQ<WgT%W26}#T#Aj=DtW_nV3FO_a7<=O*NA37
zz-{<5<;0pXW;Gn%vU?dCAQ|O|eXfoVV3TotUm?lJi9cGIBLUg_oT?yh^4D0OO?;VO
z67U2t4b*yu2ZW;YZaJ@bajKyW2&Y~iawu&~E<+t8Bb^K`a|9dv2V8KsSJg{JR&Q`b
zp(HhYNz0)j8yPbV9a`=DR~(agGx}avJnc@td!@8FB;kJY4VYu-%QNLS{Ss<ay!x@R
z%8McBz9-5wn8+3Zg0{0M*CA6*oJ6~Zxs8)c7Uj4{(U+Bm5uu?vY6VoKv;HEM3rsrC
ztkdqkY73FD6LGn8OI^>pbKF&4Gj_PB{iTB~hFud%rUiYRbrO@vYEN0=G-6nV2uz|m
zV800>7h<}k6DmC4j@igO@<B1q%_o;3AZBP!#aj#-_8Mih)tgv9?wV0|d|D?h6RWJ#
zZ5$KM!Habi1jC$=-B1|2#=Bsic3*`-9VvK8C;BDrbIa~kC}%me1U+tYFoP?U{S78o
zdbwEetQIVOr#jCSs!3))OdnV?#H9U$ZIkvupfbccnA_(0$7-0B-mHzub%;)y=^fa!
zL+2=*kOUpDyTRhu8a<@&mJqMZ(Op8mipAEGhDtmtp-r&F8Ba24d~c>$C@ep+Npa)Y
z%EshU1iajIfGnoTO{6+ZmB}Mll;m9A$yA7m3hg+dJ_XFx5RG2PlzK$Pl5oU{CD{-%
zE-qH>231xNkgFD2>XzM0k$se5nB*H4_$HfdyxI!n%rd?&X3v7$fnD7|kzAIL!wZ)4
z8|l1_lqDv4%(o@Gd8q|3Upz<7JI93o$GQe16N&N8e%4LDoN6v?#}X0x%jX#4qUsiP
zd~r)S{-K%Kp-2}Ys4;hZp#0=@2@j)(*4lTzG>0XV*ONP|wl&IKG1TW}V{#da&u%;b
zTjob%lPS@5)_Sk)zB21CnNPlLl|!9Sd*uvbXqB}ZBJIp};_d%5C*$u?v<6*PYwmiS
zwWxM2A6+}}H>T_Obp52*iGwoIDSYmZA@)h_{v4X*^Mu;Al+l*+IJf*de8Si&EblaF
zvy;Row~ezJDR4dME(r<QB-*ND3(Sd$J_*lDwxH|5pw`8A$Qdeq=;q<TdO4Z0z_&;E
zU5|afHnMOm0dwn<OHtQIzY<SX8Uo%*-kqHVkK0-K{E$x>I;kH_@_2T<Zwjlh^E4kG
z7%xD2d2?&MR9l~1i@K(JBnDG@Ul3Uk+Ck1RiN5-^%-Zda86er>pk@fUf4*<fI_yeH
zgl7t6*qb>sXt7Ef-Zsukq$9H1i)i(SP83aSo8^F05E~(LBMDf<Q6{it<_>ELF)fpX
zSbg#2v|%ccE#ld6Q&yaGS~m9Bm|V^qGz;Y@dAAX$ssLy8!+g3KS__T{McZ^?ruA70
zY=(cNl^cJ(*=_M&!v0=N5TENAne?_XxfB`8nnr8bJ1RAnQW6hOIG*Z$j0JXQf_HuY
zlt4L%SnmVF4lK{z%e{v$w$vA;(LpIqmDUscAZ(xc>X1ap5nLu!`m>6kCoImMkzv#N
zBqPGd`dO%gLxj<)4I>5P10;3&H+XyPNr>8uK8H>j<{OhM5$Xb_nQH3tmwo0C=BNzJ
zJt;c6JJz$F5}G{c<H{1^4+Jl$H;XpSqo1iJg5bovZFet5-rR32yFsKGVZR{SJTSfQ
zIT;=6(_8uIF_H2v+O?n00=K;uBzb6`Jb42AxKkTy8s3)O>yVr<Lq-}JT3Mn`lOyKM
zDUas#n=e^qWT9tFdXgl#A7eEiQzas{O-$;$aTgx3$1_`>T!+|Kug4I;h^Vp}?vvth
z5&(HRohy_N^0#x}!2RReq}~9f24DB{laceVu^UXH5?56d8<Pvsv<^{6#i{*Y8m!zi
zG@wX<@H8U$*hB`qNS9sW&0L~3A)u_T8gp)&TCE13oa&|A`{t9&k*AF}*OWU34#X3j
zYPA)N3$wrz`)r<uJ7^lbj-ng3EH#gi6?nO!jbbpn-ygWsPVa|FrMd^pK5jGZPCM?d
z^7!5BZz<}I2s1)Y3D?;o)vIcgEZwU7vBM;}FG{`G26aN=zzMedx-L7aL1wq`G@dQW
zHwHBip5<{K=16LMRu{Vj#@03_SEAg(qC2}Gb&yb|tnz{^wagAz3@+49Dk;o%&rLH^
zry&-I01cZ7;GFyLQ(m)!y?t3fC)9Xs`UT8kWrvI=Q-9ky>(EW;+C?{P9SKvNn}hzQ
z)@WSnp%pH4PZQJz4VA_Y(4saO?Nl6Q#Bz}zANU*1FK3@Tx(DwKJ??3YIg3)@ePePV
z>TT9q<fT+e*A8{fv&_xvl?Ms6t^+Y5L&Y>HcD@XRw)sW{{G(}@PDom#wTaKEHl6hN
zIbMKnh|Lkd5MQ5NkFy4KkaT+*pF8EEH*)qy`Z{ZlHDtJsu*$?=3HwOJFkt|bc<OC!
zL15t)x^{3LkGSK!7eaVbQ5!+g-{z-dL#|2IUvpz}4QlyNbUITLaI+txFRF}TrV+W)
z$7^#=NgnB^bvK-n>MB~EhxC^Df*8BH|Dr3<NFIZa{LJ>1pbOsHA5hG1Os+$%$V2GH
zO@e3?(CBoQOUuJ(YMm`v;n;*g3a1j>@`&SNer8zTI^e{_b**8Xx6AT4BKJ>qGTmkp
zknImYT&k_zd~!{4NUAxhhe%vjDmRS%1R%P-76Ghq<Y<Z+vN4}prEnntkm6gAjHaj7
z<KLeL?;K#+9-oJ&+eKwrshTVf_ujI5Nz%uy_9i-6DdjPwt`_pwAeCI7{V-c}mIN=W
zn9x{z1Kh?*4a?gy$w@{=D3mn3UsoL??KS*Vcvo}`%Esi1<mhAXCv-=np9W!OL>oPD
z0&y5;d-Y|ooFy`Z=wc6wh8Bb**)H#->O<OEQ=hx{j7DcQHUbtIiwyr$KB;13aw&>f
zOMA2z^hS1WW=y5FNkhv=7If8&-DxmTEqyxwq2DyeVe}H>mDm)@&8D(D?>v0&PSyKV
zwUCX;)hO6ZYf#ALW0<7ajV@`ja^P|a&!8t#^pmSD+uYxiZY~imy5HUTMGvl67$Hq@
zNjU0>=*=hBqTn)Z9}0Z7kc;yFS$;%#Zj_6oMtuIryc~j)Ptk?WZLm^q!s0afEsoh;
z4{fnM2S7an`L4K{3ms(3?lr^R*+;D=yLPyUTs=JSK{mH1E!Hz?o>`iOvZuJK`Q{Un
zAARy9+OzNw<eb-}9Yi?OIs(@G-w%I_O}~S(+{}<fx*89*fiBsolRPg`?SX3hfoCy0
z*9+whdVFwxwU9pob4`7QxdGfYg~X(d$+f6~WNW|X+Cm9LzW|AjCgU_GVlI9+?Xfy7
z+7|T7|8MW~?EAsZ&500dHLc@HHlJLH*k#YC?K^-5KIa^hvVSZ|QRt<97oE<sPdh7=
z6R&#H<@wL(QdGWWw2ZF@Q;tqrTXru)b_@-_X^^3VKmwCYuSJF$drk3JZrp-SXAd1$
zoCH=UN|Vl@m%6Ns4?L3+IN1atDZ-w&>C=V6y7kF5D0H!wS+NPO>ScHdRyo5r=(%Q2
z7$5C5FY>%}^*K*wIUP(j==fL<+3#IJC!7?jtPE_<>K?pCl1JsNhspo^gY<9zE`Lb>
z2T*lLO?aH`U5k?2I1aSLV*dY=ueuumL5i}i*}d8@A?|kK(c9xTh-c$CUzEfCm6Vek
z4occ{9;F;Q{y5G<FL`o#y<YWo^4KF^sl7bXYu|g6*LlQsUguF?4@9>sN41C2y$|1^
zccM3e1G=~Po6E0%RbESpeVAvD7a-*|!Q^oi?f^KsM-T$CbQ%290Mg3|s81kywmY1!
zSGgkhPKsgg)HeuHPu<0S72-E0kMIAezk%psFOOXDE-Dacm^^{L6PT1LJgF%S(om@h
zlXHDkd*s)`o1C~u+APR_`Ru1%F|>E#i*|`~W0G<lYoT%~1Y$Y(kqU%(Pk3v-hkCMU
zxPuDrIH3(^Z(rEScPJG{W8Kxc?Y>_N9uWVYhn-l?a=Omuj+1ZTuV1^5VZB>Xq;^hW
zviJrpvs9qan$Vd?n14VAFj*SzI%E<lc~QrD3t$7105YWxCd8M|2`Ix104C#F)ZSXT
zHztpZ74|zzouWWk1HufGW?sGyLo3uIQPnS_$=j&iAK<81N3*vi6<Ny>EAYgGcrPXF
z1Zs3%HeCW2c5Cu4_i+vvnqa@XOwBiavK6M8ImP&j(IYW?uapWc7YLw!f-x7k%K+qB
ze;U$blT>G+U-BaXAi3(($AQ|#Bd7O9bGR&w$>U#;;W|&3qW?gqpOYRNP_a*w=))`5
z|7WStLhUkecTV7r<{Zw<-qTsk56Pw;z2bss&CkEQFh=<kmnSacJAqqJ&2LQpS__kJ
z1b8{581VxxNpb(}0N8r_M3$V~-f(`Kze5$;TyknOps~Uz<xw~O`g?&-qiCsur^WAB
z@bqC#E~+R0&b9kqfEq?>Z0W`eezy2%`QOob*mQ5Oq7!;hihynGg{DlaH$zRl3Kn4b
z@`lYvQg}rwN<bVQxa~2^W80Iz0+TC!DW?Lk(DN2t80SIo2hIz@ct}U3Gq?jTHUW5I
zUAA3vLi%WW{E1`*mca)7PRyp2COnRMgzs)&p^eF3hRNj-DHX@h)RQ^@8r_^^Le9@S
zD*dCTCUIUmRT-A@f`1cUzBKWJG>%`|qWLs=PnxNg=d2r(e^SicoLWYMiZmKlZDvXM
z?qFxmlZYqu9{g~v;kp=cosMS+3L32iI2nM~D*mHbD$NRuRViA9ZNTNWCyze?ky3HQ
zkyM-oU1TU?C3mP!1R7N4WAiJrhE<|b#({e``lC^8KJ*OnU|9FLIE7z%md?ZZ%YB^J
zA0ZW}VWtH+64z!>e_WEQk}&gg-N{MOaF!0q#&m4JG_{r5U3;$L55Lp6Cc;37MH2cJ
zMQ1{OT_5MQAvqP*NLV<C0_TNmGf;3_E<q?Nirx%L!Saj@k6a<Ys;blwsdyYe!%3<K
z;U$#!2F};U<d&&e^ap-}Z>i?0AlQBD$T4irbvsho1qt#hpT}cl*~_+cwPHK-eCMqI
z-KbYmd5EVN5hK``{NqGH^1i;2ZVz=NHQOzEs?szKc(HQRmb8d_-WhUNfBEh?VM??b
zV`=g%iu^yk?w0>Z?msBz0{Myd^^J&iTLH%V$W1{^C>fL<r-|C#ytBoao<h=|l66bI
z1x9eEB{wG5k(v3{0+42t<$Wx@sH%RP2Pi`X!*rg-(5u;wac|wJy?!WGO>W6=zn!w(
zCaSf2eB~|wg-kxDln7CbufrtQZKh?s{pL>0)ut%0X=OVO$%I$NmQ(@x96T&aW2s!+
zj-L3&<ewtGb^;w*0y9LEZB#|>do_vcG;2~;pQ4cp_%uMP1tQ`1X`w*HV=BX_FqW&$
zZBPCYqM(eqA}j-^%4xg#e}=^07V_|vXda8yxy167=99DjNM7?#TpV7I-yGDwM`$t^
z^ll$#K?$pp+A2kBRB@9E%7sZ=jNh!X)-C4RkVa_DRdCssJ&>FBEa6X{-%Jc76XA5H
zy2%}%TvJ+AEwxqXKXbhC!w*G;BD`2jUynMi_n2xkDCMi$?F^DF!~_)8(3C$BwVSi*
z;?)Nxcg%c6NzJVINTZX67Ns&I4SQ^$jZBSqc=IxovfLEliItmOw0VuD?#;^h`8z;$
z2;C%=G4--ykJw)>36fNp&2~iChWT!HXz8jjr>v#BTfHZ-p}<|Hs<2c}I#CzuR`bX2
zfz3C3alxc_aBNI22uZG<9WDUJ>J7EF;;LoQm+r20b%a!GP;F62?^s)52i)Z!zYA}p
zto9w+dU9n+kr!3gbUWRFO_)Skh6sgn;g7Y3^`dmQ#T^r3$6yauU6pE5exNPkBY8aN
zMA=9VP8ucA){~2B%sx11%~!P2ya<w*RB>dKnv?xv0wpM3<`+GO<A-;mT`KCel;dMq
z0*LAoa&x2ElV%WaOs*pB)6ZFF32JNPGZ2Gbr+8Rx?^(RXnwjh?j;!giGG>^|EGCa2
z!vQOJ;}Uoxj02f!A2F%G!N%kwl6th&ci8P@?WB+?uhu_w<*2<@{H7LzikBx{In^#w
ztglw|22bBcIb|1Lz3vvw+L&BJOfRzXurURgAi%<S5TlZYNva^JJtGOa^Op-_@650y
z9-(_-2RVCdf8gs_0mjwCp<3UVTu2&6AG-#7RRSNo^q90x{*wwdGK_C96l^YEFj3K3
z{i#Azcz&ql-7)h8MXdtPE6`)hnV}exG)i47w_yjPWqQ~Q5$6ooSA)!ZkHtbjC^U)|
zuOGY>XWQykB!jEl$5~F?gd383&VQ>gxnoiky~g*b(0Nm@aI^Czl&kC^R&T&W&R%QQ
zLI2p-kFN_NjLLtn0dp%s-}dA>BJbF!1)2nNTE-+*XTzjS&=wjmQNLlAR*ohoAg}%q
z-FhW5WzaJ9m=5>=PpjP!@J1(x28WEzjmdRHIJnd;0#4yK2$L`l2TV2^0_)f5F2VM}
z?p~r~>+dh{u&#rV_mN%w9hh2Q*hx05F}H}|q%mb~Os?j7i&82H%Nn)*79<$a9L5I0
zhDj0r1rA5YU5)>SUeB0cHKp4EBu+IS{cHU2x}p-cr~o-xhCtBn5nD^#>%BV9+C)sM
zt{e@j#xOz4uZr@qVe-s~t4tR%uHNzJU-})znjWQ=qK*9U)Z$a~LQTuebI0g;BL%*D
z#MTn6*b`<_1Cj{;Se;ma$;x<(2!qtY82yOAU*A#2RvE^^`%8CvP}-Em?Opce`m9$6
zzqFKM)Wzkc+dZAVb}uJghqZ6A;HB1U+KS9c)0vfNiI#<;XeCx<BpZ7s0k+y)AUT+b
zZH4dQbcJQ_`LHvCsxXMxkq_!FV%@+Slk3T(#@mqus?n2!L#Xtm9nDe`+XSPPSj-3h
zKXF+RGouaJR}q;(IZF%bMC#B4Y!rN?HQG9Gw5!kLm{#AITuvqd!RX*;gvMwrsJp!H
zn=3gK5!UvK(KIJ0Qrfa=#B2<P51O(o>NSW@vVz{;#eT#%9IdkbF|F(vuF}~RnB$Q}
zRsDbY({1_x2xl;jn~qeOh?yZ8IAdM3_`u=g9*#-Ck-13JR=Q|Wy+l4QQriMNL!~`S
zt(8m#S9MA>w@3F2Nn<KMx-q$!AU!y=cQsxLc7++Lh)Lxajk%2FlvJfuldvsY-MX>z
zf2Lc>6B_2YWbpFtpm4hL<$|Tx*|WBuTu8_+(8p)|GbZ|sc2byhiV0Uo?nK~!Smcw!
z6-g;`-d44H`v}KBl{W6d**h#Y$<Wot<a%N$l=Qo^O&KAtrhA%K6ZGM|u7Wo)cuQP$
ziCnK*yODP~@`I?dyuFe1T=?3^;@Em}H6bHF|GQo&vS`KM9Lyz<QVETi<VKD#i3_EJ
z+i;zmN0=$Uo5HhHN`5LJWEW8)sW~}DDXobrd+lCHG9v(gFMXxBs?jj$!?lklcU?4=
zm?`5@qVpYQSKXwqr=T1NR+>a;QrOfbz_d{rL5RiML!TRyi%G}j(}|B&vZ+dqRBvc{
z38T`wz9AZichQcCRAac;43l|ly5Cs*<JT7H>NzUfjmhQ27y<66D82H>W+yu!5cuif
zf>I64A<<+AQd3!#Sa-8GR^_-<Yo5bJN}WS8VwerRcHoXrE+*DgIPZc<%?*|=(Q?fB
z-3^n>H)}4f83L-jc<0t!DgFAsY%lb=K(be<vpcjAB(aKbdvYZ)F34%47l*;yyaodU
zkqHoz62n!dV^YCPjS1^@SbxvE(x0&n_Ohf~{boqeZ>4Lri|}E0kJy4Dw|KI{HaZK2
z@**)au3^%V3D=yNo;3V>KA-#E3GYzJXigVV@0uG}2uI0rgYJmvPTzj_N}@?hGfZ~$
z`qm$2S)5jM6FLbYO6JBHSa(L0YgN!EsYwIBnqgoY;-<Y~?_*g>kIKy0m|RQb$xQSX
zqCoMBu@BHhJ9Az!FrwUFiWH&J;sdMXog40e=djr{%rmh0w(7SZjkEg}mlL*iO_y$4
z^d#2lEennH7f@hh657o@(~m>z!|d+&d(14zYSO<0x$mqOGR4$<tTnIiwR;g^dIm3G
z^i3*nyEzPnnZ;^aury3|Wwh2_BStJjl4m@BwtT@Z`jbnKu4j3G0M#P_%8ki&#0SKS
zYh_Y+YZJdHR$y-Hcf#Z~h{)nLC-@zzcD{Z#0g);)``Yh~0l7uu>TrX1_v5T2Uhmzr
zIX5A&A`;EURF4qKa=a;?AikAs_BqRs8BeXsL*#;K>3*Yf&8To7HY;@N$#ulXx@#KF
z?1+W|&*NCikC;pt$O3{&DA`0dpcd|jOL(Z=xJQ|CxYf$$9E(Z$_ri={p1keJ<%A*b
zY0x~7%51hd7%Xi-zJ?v&m({y<#kTrh;M1upz80_ZXtw3>bXM8v6>Dxc#5aeJY)ind
z3tCH5FfrMlhSK`DICXPbr-Sg4Bb9)+f}LX;2R;%R$1mNq_cHMA&M=8N5@vN;f4Pq?
z75C-#aaNTJ4~90TDJ0Z89^yeLNQFXN83U07WVqYYn5Tg{HoQfry!aN?nH=Dw<kN0H
z+RHe$-@T-`8!+&h$IAjT9;!;qRuhw@GxylpXzS)}xLo)lw6Uaq8r5_)2|i0K-uh1M
znE8^z1_!zzeG9~d6VS#Gs|ZLL@RC(zpr_J?yuD!}8MIBu2TXo#i27rY(K6o1wkMYo
zH0m1-bXRX~O%JVU$8}}Kq)4M$aW@P~rG`GCC?IQY`s|ows($@;nwK7gs~eN6i7Ii)
zCXlNx`Y}pJ)ue3my2V)Kw4;uLvs8xC`|91yVKI|$a@PX^pa=@@-j6#*;_TmCf6G?&
ziUTrB=C1%BrMw1>BOy;DJeCto0ES45!-!VOmd!_|;8o_vBx}=VmsR^iR1oRF9Sd4c
z$YgO*lLNDr=|xhdW=u9!7Ci|nG-^?#e=xKzFgah?5d(;5sL!fL$Ugdp<k#=DdojVp
zYcb_doSG)2<n`7A)b0|V<i?e!(}L$Q(oScdIivGb{PK7E5uijsNHv>Cw1;L@D`lyh
zFK9VI0Sy(5^kTs0ickiD%-2SLgMv8;k%kAxdD_{Us~x{x2!TI5-3OnW0n=13lACc(
zPO{$|`^$;Og*mZLijsFg;4zlE6Iw~3CMGM{n6`HN1iW-|f#@s`&NmYD4^MaRb2l!y
z@Y(fkXo}KI$-Q>3CG{Y?r17e>w8}_aYOA!$C}TU^2rH575a~>$CXGSGg5>WD#k(8d
ztI4@V5Jm*ZC*`4UOs*y6zycR)vXxEbephO@<BCb8_89(gOEPnn4m~z<eiWYhHUh5f
zz4coh!Lu*CxQF2G?ykWJ!Civ826uONS=?O`f;+)=ad!#s1b2BiIp6m==ZAa$f%Du2
zc0N?gOjlJ`_4L$q=U&}4<V`?LYDgHh=SmZRZyeC`sm!@=xlPMH%*Tmuw#QmEOgQ{G
zJ|3K%<8N?$B#g9(UkrZUVO9RI67f~{_um4KQ~O&k0n!*dq66X`;$cokDzi2oaq#jT
zPQwkmEdpsh@Gm1cld7bp8||fnOFb2d3t^&!Y+@D%*lB1}6#;J=71^CsjUC3mu~B#;
z4$P^JSukQ{>nW!D)2{(Rj#%dw2?IZ8R|NNd<rCY?GOX|f&8qazb+NT38*aJjt5pc#
zTuKnYgtcMYZlrC;mQsY8G0rRhAxQAyynA@DR8ZhzIC{<2;HCFUF}eD79}6l8!KfeC
zA^YVM{+*H398R13(+A_-cq|DviB{{MxeDtUBeqg{GWU=R8`GC{JSV92k{^r0h+5cM
zcgNt6U>kc$lMNrx3W2GEGO8)+RFq}EbWcGn5o50!*W>4GdhXY<Gr4nWw1Wzt<7P|K
zNA|&CRWkWo{k^j48789RDUMuL=`OrV1dbjPrZZ%<pUZuapV!Jk<*Mzck@-8fgzx;c
z!IN^c=Oub_HdIZ9N@Xi@^2anfy)xm_1Pta2`yw8td%p;p9ym|d>q2t+mnQk!q`8)Y
zmD$Ry3O#~yhO}fNBy@Vs2*c7d=U52SP6d+fEJpmGXDa7EaU^_YET~b|`3!pCz7jmo
zMJkeCDG9T%t8Tlt?bdo08*W%?9T@0G&>Sn65E#=EtbiU{u0sB~-IkAJw+2AL-2X;P
zxf5N_IAcn>!Q<n8)_N~W72{%aE16-Uw{CQ`+9cSTT)saREP6IeQVMkVmGcoZeYeiC
z17@Ksy#)e2x7R+2qH;h8mQJ6__3lC9+(t!?C7QsLx_j`r$=m8H2J|R};mm?o3!LYn
zIsV1b%RaJo)a@Jyehma-Ok6ZAR9hv`IEt>n`J#S|M9vI#C?VTUKs(UW=$qY0NiO7~
zh^qMN_~gisxI?&BZv}%{*&RWpDtGXjj_!IPM+<w70?H~dzONYOHlRn`pX0#noZmOs
zlCcq??&+S<-;0MEo;o~LjfDVNUQ<Km<EZjeqL3PRt@XEC^FwEJhwbTXl+X{<Opn24
zBFN+XdDt~J&Le~poiOxc+q|M-Wb{hqiweX<J-*Ssxb%Od473RKWW^-ZNA9k`i&tfH
zr_LlEeuvx}rgs+Fsp`>`6$^KTO7q&1gL@w!A~->FVa7Cfg2ekEeN<&HqNM{7z8OJA
zCK5L?X}$Z!v8>c}n-;N{nu55N?XheegFsANrPRgah|FqUt+V~0S@FV$0au13E|$%(
zpf!50mp0G^hJOWsos2I6vMS+Z8-rg4d;bx2dHs04E2k=Dca6KEU&ei6K)WZsoz`r4
z0G`E_2tiY@W;~BFD=Z8D_ZvfebgrNob3r?AC*{jJi8|f2-FL&o5`zvErYk-u%Abd9
zTdKkKI!D@{8GBL<@FAkr(Q_gucX~eh3q%WUSIU&<b(FJBXi!@uekE$O_WFtz>U5(W
zv(Hl`%1lzBvWd-Gms$z0_?=fExFm{3#c>=K`*3rgEgUEK!G~)ODrs=SI#8Cu`Rn)-
zYw-|=OtlKa$lXi(gb$iD*9v0vWJknRleXNPzwH($44*<U>p3?mo(u+|7&rW+x~UII
zWn&^4?T_T^thO&rP(y~LL5j%mqN?A6Y)zb~_<F9=tl8{%m8x_!Jpvs{J^P7^kw4Wb
zqG~rtnPSDd6^$yE+1dVh3&5T~A$(t$#|m$Qm)uIS2_U1)Z9kZ)qCCuJ$LgnCkKJ6K
zhHGHzui>F77V+dEWrI>x{>&Y3Hf1b5VQw==;i!h#$#aC3y&TYz8<9*I17p9kB!F9;
zvg==vqXY4GDmgN4jsHUf6)uO!+q*wbB|UM{x?s+!IT{4{hV0YDykmw%B7gifZ~P9g
z*QYo)LJMKPBy9g1yH5@Ec}>@NGnbN&`7-MXGhQbLuAk!du&YWhZEk<y3@vO;xcz2X
zZQuHsMr0#2lIpLDOxbPP9_L4dQY}1CZ0kdO;F+_Yzzw;VnLkt36`8l7&Ex4x+(}v!
zrR%m;z004a7w3oU4mMhn3bS;P096lR_=~>r6~~)vRzY`xd|NM*EaY<A@%**89WQ>X
z9xMN)!pQ`ZY5$w+Q>D$fPtCcyh(ON+KQ-W@O`8q}6@pX~1Q5!+JgzoWOG5yD&d<D#
zMDaT+%-APtZxV$AUYsSPjgv{ReqsTIze~3-2PV5^d|HM8XkH-333aiB=&BhX<UgLW
z^03`=zk988=Z16VAyjWk=l;}t5#)Ut+~s##$lsUbS|(6V5?Vpntm@HNXer(7&HMq?
zD`^kBe}I-owIgQJifJQy*w=RZB+n5KDGWaZ9u7-R1Q@-4mTxM89^O}2A>PN}?xR>A
z$vU$0DblmM9I^HclzvCn^uD6GOz2iLKeWxW@plrGW7qd&c|FCVJU>Ar_^J-X+v4=I
z5se$YEyp7XIifq`EKoguqN6hvZMFI$OEq;F8s6$G8ZA{mm|Bfu9lwmH8qz!&xch<2
z>fVogJ*s6qHd!ESIiB5y_pGF74U*{db(k#V$~|~KL=y3Xo_waAXq;y%TT+Sx3t$pG
zl1I+%Q0}d|&&SQI6gs?Kans;++JnO6!;YYUAo%__f)zF`!9Ayyh%8@Q>vKI1m#4mD
zxUyv7H3IMsA5m@kDg3MX#OLg`PU%`2$%$`>$jySE`Xa&6_-O0Azm?M2+7IaKAq(i@
zi0s@>9^xMd=YU81WJJ<(=oY9G;Fq;F=|R7WbuzE&FqVTGZ+8o4#J4=YTr_YN3RNkI
z5UbE-LSR1p;xRWgmpZ0mJCeRSh{oM(6Fs(SzHWoz)9^=?AW3Vx-IWQ7pe}+KJ#5J&
zOvo4eoiG-7Ssb*hU)_RsL9<uW$+dBYR~G;5;*5We8ko|)&KGA;!`7MrFhby1h%y_X
zx#runIHkD-ecRHJ(*_-?e<mq=XF6BlVA-L5;o{FQI33&-WA}{sJ==m+y(&>vPKtGm
zr8(el&noR3hVH%)NW4pA7+(Dw@^>XL?RP;kF(WGY5%MA$Ib+6$d`TA-3fPY#6q&%U
zh<x<S+94)YyV023Gy6VU3(rt;8(8M;40Gt}o{bSJxM{{ZE!Mx-TH~@+xmJ&7#?IDN
z5=X>wxDbd#`~!<Uy8qw-*B*<CAAPefy@q2O2-QTU756_@E_j0@Vy$@Y#~RW@x16~{
zwer3TCf1coN=wc)XjFLO^ySnJm*I`Lr+-e&amh0^JnX+ylg=20DL~n595CCJagMZv
znd5qhv|uYPz9e_n8(BzQMi`Hr*_M?nmG_r`&fLp6gM~slL$5?<<6;q%CfQzKss;1U
zv<<of>-zDd0#Fv?kOPa4KSLiINBor&9lw0Xc{3Q<o!6TL)Q++zCq@>Q<g)rx^JMGm
zxnH&fC8ta=j`UU3T>OYn!<usyY)b=<h9H~T6{(3o?&js>qzh$UAP>O<UCvD)bOmPZ
z(YDUyGPqABbwjyA@L<&{RM_H-G}8xT7#hy5nth-WoR(HZ2P&nJB+mQUsHrmga?@l$
z0e$3QXDSo^&RIj}nguv0V(GzYr?lc7$Mmr&jq|lzeJ|28zpgF|;cLNllHVN3>i4XU
zfUWLhiyYmHOi#}AJ7`)TmHIB7ac+6-CclGsBeS1_=<o8|@<tvsQ8^eS4K4BK^y>Lf
zNAqB8Go0d>l<0JpqR(O@xXVbvuCuS}OWZ)3h}56n7~+h(7?l37+%~ww3?jKyQ2mZ{
zmP2}C3d(n~X?)VuBI?f%?>on}z(WfRQ*IU={DP`^6Em52{>R1Hh-=)6k#UShjviWh
z`5@Gk^nE|72Nkxl!!YR;=%Q=w7*z)r!?03eFjdq5@-LWqWkx#QAXwh8BL%t6+#F-F
z%dCs%BJ}t;)pd0mW-Wi)8G%{QUn5ogLB6quC)3`nP4v0#q_+0s1V6F&cOoEFQwAHI
z?Gb0xqnBTsp#Z=};f4YdXgGtnA?hJnQWoX_ZXLX_+J4^pI)i41j@@Ih1fbWvlz?|o
z$INVIi{J@2@+B|Qx=(9+U=LL>-PR?Z=Y#O!olC+=U@c2kB3Kw`R!z9>`+3pIj`eFi
za&=iT9jMBOmk!i$I<X(jG3oq=3(B1Fe%d646S7&!ckW_kWqG2-C;E4Q`xE-rSoW5b
zXu3o58slAznt`(K8Vn3Il6LZZr_l@`M1-i!yM^&c#opMYQHl;ChH$2KY*Hj6M>(!1
zF|bvbSjyB^ur&!FAD1DAV#GRcYeJ=WOmhiS5tU25s|zYViJ_PWJQ<=2dnF<(2VKW?
zDH&z1seJ@WS+Hm8yn>=+l;QV)f7y-83%j5InBP*ODz|FwiYq)#r2cqlIc#7tDDWbU
zJZ@M?jG-U4Q{lTX?2H9;(3XsiE`v7kI6}B7o*Bb7%Ng&{{5+`C&#-dA_D4%di80si
z=hKTI;#W<R6zuqeU>M@3aiMwvcRtF^nfT%|gfXI5C%K7bk8syBmw;^&mdv!<v^Rw2
z7yFX&Zz^;yJOewv&}t;vT`gxq0ugOfQ^b6wXtMYTM*6?I@07e|0|q=T(=CmZ8>`#~
zi%XHzR9YR=XOIfwz@GT4JU{h1rs9#KBKmlLzFg{cepRofHcW07=T45hf;!jKG9#yM
zaPxu6G-R7V*BP7fj9^SHx{SmTlm$5K6CGwqMK6)HL8-@Oc8(@>JbG4{d`WaNFfJ?#
zkr#`FRl3sYFoQj6B2Ni-QW>VKVYk>?tLyRz@{k<SB285L?wgHZYn;QC``T}Zol|pj
zT|xrjn&6K~Za+-zG?XSnCcPjanFID^FcL=u<%fA(`c&`hRW#rsoGR5w-OfCht9do)
zGX%AA`r4KI9)?`+-gS>f%C_102BD|$tp^lpFjqYMvn7!%tLDv`zLCnQ^RWz@&##}7
zDYow(*rO~|CA!ft&?l-MuFRk~#|5-76eZCZD>bd2wPBszpG#Y2I<X}%)BLLd@p8I{
z(nx87V;^yxS79<d%wf_~cH`<q%~N&Sz268uG_i<0Dy46_wsKVzvG;3_O{uHVEDeXs
zKi^xa7<q{Z?6hK=5bnuM%8xZ!A6b=PD4q<U4~;8?TZ&Q%?$;<%#qs#bWg{)XaUo=c
z%c<ROq20wagp+XC%6^<JsWw9})Xy;>T&RbB)8GTvh1$`tEd64v)!8`MPP)<b=Zuy1
zs~s^H`zs`0kc|~lJ|k^*{~T3|E^We;`=CxFIw{rO`~5aL)^?Mn4AIl`8jkWq`q<kB
z`-iF*&Wh0-4g=|{4@Dm}S?M-{Jn+y~NI%k_y#q5{o*CrykvsTI1X!2-!&WWQDNS;0
zT30>f-ss-~^oF#gwqeB+myg5QwzW9(>XJ(B>`H1R(xZic;}ilS`jNR0a3QZ>{h)yN
zq|bDFemDA3R{DS3-WRjxIp%NP--gz&Bn#VrT+*Q}(Qbu@aDT~vxFgq@*eFi_l^Kji
z$XSZ7jKTgs$A>XANq>Pt4J0PKb$vrevAwmHp)q_0%7Q9W(SgfPDLeO{G%@B~o{cWT
z#K%Q8K$Gg$$~_TsLyC;oNOB9e_B&(0^qV)HhF3^KE{MQ$dcQ0{?E~<%_}>g%xwWi~
z1u$pN%-KiQ2&r<R3<5w5te}BGVjWxmUQ=c|H1D0_#CHUVqs6b~ho8>%r94JmqC=$}
zjnpSbBb8`_Hp@Gw<kAT!({VZ1-gIWrAZqt>Jy))~x_8wN?ZhP&X=P;V*x&PhufOf`
z2eoGxBN(b^D@L(lD~s%iPIc4YFFc^0vZ;F3F>*yG5Y%uIvs}ry3ibanWDn51Bl3?H
zSp3~OpM3~+cPgt$aB?#_bBvJjZ49Uu#cK3BKhOVUcDWFN5IL=cP^~}t#(=b^L2oWC
zXjQaWrdWr6bf?5r7(hb$oJETfnet1YcOtEZAlu2N?7J&vW8N|R(IkZ5%v9^bO!xW#
z^LZt|TNFt8Ic4hRd96GMeQTUWM<XV?%I~xJESYJ_Qo`q5e?%5}$gXLTet?glQ-(vg
zq;EqOS`#eg*+~}0y_Cdfg{^wxDQwxX!Pl6pG3-!#wl|vjcC&QW-gtMGchrn5z~DWE
zv6Q!&(|%F^Fu^mB#q!P{cLq0@wN^2t@j%(t8Fr0Q=IQ8k>b)6UTwDF(_^`0CV(}iZ
zW*8XSa_!~(@_{a8dZl~`5>o>IQLar&?TU^%%N8CBcwld+lH!>p@B(llbZE2T-6`LC
zYftCQTeja~frILNBIaLKGF#Mpz4Cr4K_fpqdHDXuiF&gK7h&>ME;VPR+CWlp?LPXt
zacOrC6e;aJDtOxd((A{_^Sa2Y<ry0Qfxc<p;2ZbR7(GT%G9wIwQrxmRHgRItMQ^sp
zIc4`d3?riCA)9wD4yP{zB(N2iIF+tD>YIQ+`m>ju?>jT~WB5AdMyJ8=uE(jkr71go
zp3^1ddo*CncxXDg3Q}jI|17WD0Hxcu?szE+y^qJ8{v^-OoJ$X<Bk42ckBoA6ahn&D
zMoF`FB-+h44Yi?xnB1gBlyrq+&Sd2xCvrqh<Q)Sy$`kdJYB0%VxCb7g(gsJAG<fCh
zIt-r}RPC8QlJYhR_ZDNK{n6POUzAV2I7ins*!1l+^_1V;KKg*Wy~HCoSldoBgGl{2
zL*$e5N5|IrHmMYNJ>?kM8txZY3;QlD7Z)4dYnnkDyMmnhzAd=#69oYrRv?hU-SiNz
zY<FQTFwtqjaATn6z|d#sz4Z)S5vPVf$%S4(|8u@Gvya&FipqL)I=Rtlh<HZ5LRknW
zM|{Rat@Ga7HTd<}&Ht+1Wp<r)x#5*T&d>MpvA6mG0T^Po9-RK`)bN$0zZjj9F2<xV
ze&IN@@R3yRXo|qq_sh#dbS!+K?@pPlXW*Hh>?eMP^8Q<^i(e+5pTEd$^LK2X(tj+q
z5BLEZt?Lo>50T!WG$^ZVge8b|f3<7xihFw<bfah>qwew;>T1^)SUG3N)X-l#7uW<8
z@-#i495US>MuH6ds{B!aJ%4g-i?6Yle5cw=UW(b_<j@OIO0y`5wkC0qF9|L0958fs
zzt{_$Os0njTF8b9e;(eO)H~1(3yQfHj&f8(NIJM<AAA(6J#kGp>V8%4Xbl-sjhWps
zXg0oDeD!(V!L?X}ssS2opJ=~2r~BkDJ!M`AnGb9eo6>cV29;~T0X$e#%W~@9S~}z2
z%req;lYW~W=bF@Y4efF*+wB4yq%$H%K>ICK<=qtWaTc^R`hK}cGfZ<P^CfCk;kr|4
z>xWSwHliZvaSG}TOnhfiCd~DZ<QB|_qj_0udp90e-IUceyIBJ1UzbYOriNle{k0+z
zYF8y99c$6lp~}3e<0+G7{62;d;g1x-41dPDs%T>qL*bL~3UB0|C1$mXi8T`9T;W)Y
zoO^+YUA=<PzS-&NP(@<N2|{IU-P=rv!;%_o6feXGM`d!wjLp{+cTHqNb59xS&kkZh
zlh2zNYZV3|w!^V-vo4#<WnM9*_cQuG5YTqcx?M;7{J5n>MU}J2bvw9A-)o+sBQuy#
z#@<ZL^(n+BeR7FfgTngkOXL2mKgZ$+XnCj^5u<2B0otT}&LtTo9|hgZ!5})zwt3z;
zn|5iI^y75JF|ZxoR?8uvmWJ%5ZfmTnYzg{B(0f9jAwXfB;+wpUm7omUe;}nrUh)bH
z6e>_h4X18Ul7O1lHu^Pxu8ZZ`5aR(zF{uU5KiG4Rnsz7`6j=xuqHCd}q|;05Q^&Xr
zSNiat^U|h?Qn4<Z0duG<dZKx5SMao|F2AWD!_H*?I0R3s_zs#?`j_s5%Dd~yJf4Bp
z@M>#0CrYqNZ5zn5@)IqahQ+g>+Kc7=h>t9g5k2)$>rRhPo_e?;d9U?x(gD&wH>Zqg
zXsH8t6<-Tz`v^Yl$Vaq+7YEpl1*z}Wl3D8?Q$wP<*-)&PA64|4B1_1cQ}xocB}t!5
zVTy+J8QVA&1*CopH%0~OB{!aqwvoe0WN-uom#XD5zy5tf2K`MXvu?M{**F7kqU{78
zPpVR?30v~BLNKk9!W5g4$_WSia>Vgew#WfYc4EDo+*8C=M44r&Y(Zj30^nXh+EjGw
ztZbIoXohtkqS=lEBr0dP-_1_XXg>$x#XLXMak;|5rA?QJhhP4M%N-nI0x6_=Uke>d
zj8RQ#CPd2eXM}IQzyQo&smjk7)*P5SXG9Sc2-BD=B^t05^z0FpkRM^yN0+*5*vBiL
zz|j(Aw`%Pyb^<YgvA|N3l5CpT+Ali*C?Up;Fi;Rp^GcJqAeR<oTuYbbDL$O=H+{NH
zQe0Ray^Ifes4d$r+^S{8Uq1gRlB7m<4?5gQcTp(L17*>Mv5DxH(&_iI8gW^?c(>_w
zIX?qO;bTpI*J8V14tzj^T0uog%@-v_4EGwdN^!z1@s=P4hklG&*-DtG1oQ3(WOC%J
zFs`<}5ixt4cS<w+i<QsLdVrsmP-vqur=k(Cf=cvhPRbEV1L_E+V{7NoY)OzQP~^OJ
zOmZ#?8Tq*Avp^3b9^FaU-s#=Pk}(3)BIL@wBIz!LmxH_7#wLN}mBdJXi9y6RUM_v#
zV>Nab*Ib<WJFNvh(>EjzX(X&9Zt`&}tKrCVqjjwlV{5&3!pC;aC~tgeCef6XpVZG@
zcIgZ0R5@OI_zZ=*3tO^~^#l+L^teOnTw$)?S|aXZK<o%e#B}%{i)fQa6OPGi8U!hy
z$vSYz_KgP@CE97I2dY=WQ@xtiwYzseW2aJbSH*@92^!n2G*K|c%KN7UNk8Y8(6Ajb
zUKj^gd@FHaVw_PyrF4c@-Dpl?h&Sew_#)lcJJE-0C@d0k|MvmjZ{;ag-sFOo5RfLs
z=j%$$d`t5x-2u*iE*a)@Q;A_3d`+Wvom2$Ean6l4=u%!iByYDeSg~z&nXWK#Q1p;^
zz3sgi<j$y2aHL}uo)vM-fnJ#%)q!Yqgl6?G_psJLcew?+*N$AyQX5t^Nk(Ql6_lrl
zb<Ie;@c3>zF1FWD)+eE4B(_h&;9FrSkr#5}eb=^Z{fg!Ri@p!tmDp(0!)xGpUYYrc
z3s!Ng%=lc!iax@lYC7f(jvoaQLYUNR>crwLs6i^JV;yb5$1N^be~nDv%YN=kkhH}T
zcA9)?*6>!RHb(<<!{=_&f=E>}XFSYe^9BTK8?k5*;j-3#C@Ei<x^fbUlRJapA?OA?
z+7nB%+p$%WF?51t2$z`tk*reJ+rrW%qK<_h?NO(S2X7k^EEK$X0EA|dRV=ir@H|NU
z=^}B|rzeJXJ>yHrW&NqpJ7hATE+N=ylEXmCr>Dr#%5$i=nu0wRvrd<iR9t*wN@H}c
z9D=6Y)`{D(Dvm2B{S)~#(}K6f^^Y{00H2Ug8!zyBl5-XYRmTd6gZ+%RYAL$U%>MiP
zidAGidtT}5eTMf|RxAcP!8J%Qr4P*tapW*ksv7E#6<RI^?O%Y86a^Kk7u)&jd^A#g
zs(!?cdFZ^JC&91~ZF=A^7)fXl4VUz+m0ql>P7#hyjW%@9onc`Q>ezV3&Sew4QPR@9
zRmr32EsFtm8s3ZPZH;p_=^iK3rUD_UKMBiHS&>0AID!RU7WJgl3Ff@a3}5PKi+h{T
zfm#?-H<UU0Xi-OwUz|eIN^a{1tL1s2QX1*JN{h)%#RX%LI9#=ROnnmX$tUdx$=~bL
z<<PoZrM*Mf*hN|zt~Jy-rnOcRnI`PN59P+vtA2zbyLlzzU{)yf#$bK93gm-iRT10b
z`sPmP^$cV{aKRO`>6@8?Dj=>bBTLk7>NjyE9DW8xX%BeRUnjkdg1UsZmWkv;wZ5^K
z&`J3&dl?fZe-OG8sY@z$IGM0iHQ>29|9ijbnxAQb=R2>@vM;mpXa5r_^;KsLV<7RZ
zU9QsZ2SfJog+nM}SV8_00u2PoiN%D{-CEpU>wH5!`iyNa*CAdc>Ak=K?PaKpx^hss
zBi@S2HS~p6WW-V**InFR5S4y->66+%dX{B(%6%D{Hhyj@bCKlAHzGKm-8U$nGIuUK
z>=>NGVqCuMS`{yQeAP`))E!$2gAr@(6Tv5vV}bodPH5r6G4zj(y(ePKrU9gpc$;N&
zn@zU&>?&98iJExWM!P<=zU-c<J(V|Zy==!#yKN->&YU&1`UHf`rnqyZK1q2AexU^C
z1hlB{HOw%PvjeN(C#29ocaee{@>&2D3J$lo4Gu%Y4K7moB^C@&%u}mt;VX1rYSCmt
z1$4TU@CJ<<O&Oi(G}<ebQ03-D(#YH>_})_@y>FWE#n@+{I-<6;2(S9v3`TUNbQ+5G
zSj~u;xd5))m4yD#lxxurbRgkV<K3jtX&H^>gKN8_jp%fKGNUydq-<;3??O`MgEcsh
zvR)5W|H?X14KmEMVaPutpIBy*F4B_ZMMLLmNks9cN@w|q)R*sm(xjmU7quF@0r&b!
zs!Y;#JU8RNB>~wG-^rG3r$=^xAwKl2&8(Q0jHPKFmF09vN<s`$aC#WDJ1Neo-;<Y5
z{qOUfM&G4;E=^i(MugztMWbSy#n-(xZ&Rk_s!&U9lKK{sYbsc2<fBT2q_^%pdRHZH
z4y*ztTL=_Cw$EEXT)WviQcdGuQu@fs53Yb#sPU`dMzg6t>-_3xT|Q4|48D-gQR<)$
zLy~V(ImzRtRfg#`4T4BMgHyt;Z4KfMas>ydgm8V#Q;m;lhN|fQ&=^PiQ+?aIk8%*X
z_)E%J6_dbm#$KiR*cnNOXxs<2Q9LONehXyTd95uIc9M&W;Nz#PP^e}$PezJ&i0NG;
zS@2_~RILwCZ1Ca`(a#30b%9zlNB)vg^WU}LBa_2bgTpiW#wuzezP0KwEba4H|AOS@
z5Aue_FiO2UE#4+~m_r_93OY$4VtZB-_Q2kkfit-p<Icc4Da}xqtW(v6dbr+QAd!&@
z%AZRK{v~CF;5V#Q>|hHS{)+*~ObwT7)t@7sC@M#)shq<ngUL~V!52w+BKBu33Z~%E
z(g(-0ib5CltS-YRe9$_I1H6JZZHZ+;IJe2bG)xN;?WWuydjBsGaY})qNP>Yv3{NpF
zq0vG^X~Gxl${^wx_OA-9Y~nn?>gl!P0M+K71P2&MMjHEbcOEs5!63imowr}tXklzj
zC5!E`PGj|_ZEq68&<u1);$4#DYCQ?R;fgQ=n>$}zIIOCt;kbW7MF2hk01!|B2mk<(
z3<-w+!3kgj<bN<cI1TE5VA%g)C@>uj0vZ4VK7KO>0I>f<Hv#{T^B=kfn2rwt^RNCd
zU`+5ItN_M@|H=RN+_e9}kYFqV#sKiIA2^S5I2=F@O!Tt^=dpqSNP*M;=KueX2RH!0
zDELnn8vwAt2LKqriGQ#6517`*0sz2#0RU_a!Gv=F8o(G(2tWt)0iprJfB=9pfCUf%
z_ykY^`~(PqbNs*0|7H#x0zLu^0l9z@Kqp`XtOLG)DnKkC6s!}GfH{E3|K_IuzqWxn
zunO+~I)GF_6rcgn3}^wk0n!0p0DpiMz#FU$g8z?4|JykLDQ9D1>kKUd0NC2OIH^dA
zk!osblfoSX5dS$0aPy5!oE=1!l;r;JoVZ)~=X?OOOn>Y8zvufurXZP`IfGpz#9#Ns
zZQ|hM0>&a>Ea&dx@E6B`F{X*7ktrDGgE6BM_yWOr>@VH;zwqzB*y6wN&0p-KrXmjZ
z)PL(FwfG;{_<vv%OD9`!9$Ii7N?RLO@HPDV{B@(qW_IeT;3L>`0tf-lU|%Q+5Cf2c
zt)eTy3Sa|p0Wg7&c3__UpUbiSE2jXk2bVDce>(s?0Z!l&7640dSw=9`6<n(s_-GEM
zn}L690G@yO4lW1&{5L<H%{kcrksy%8z+QXf{r#E>0DuDm0Ivz};N|b$-(L&CgMu{x
zpxf@h%iHGz0KB(gdcuFxDDwaS)DQrmsqepO#%TaRb2tEiyX;`(Wc2SmP~dM!b8`UT
zstf=?(E<Q4rT_p$o&Vw$IPGsbplA^QQ1b?hXdD2@$OHhW!TC{j|E2%{(%}89G~fR1
zXO(kQw?m5@YC>8SMFaAEZ_Y7BlY(S9`mFVR;@+eb7!WJSRYukDvA4P|8+vy4iew@S
zIB~#`wOb~aLEpKUSN5^jR=fABa|U&u#_0_O1mG>>qCR^b$eR=~YasmKrt@|a!cNEb
zu;IFsx+f%me=#mX1HnrA!nj`aP-<&>%Vd|SFhP|<K%gl>8{Mm6E=U&V45~ujM0P<3
zK=n?td!(DIP-k5cb~wT!<SBJCCfnr$XNJd$wuO6fpmLzQ11_T1QYFq5?x;&{ejxe%
zRy`m)7K@9|{O<I`%j?57B@IA^7w+Gydts7Yp~|K{Xs9O4XjGEPkrV!MuzaGa;9tQ_
zZ@?Za`}SaIwa(*yU}x{i;6xO$1Gw<&{o@eHpMuSFCLX!kM7tBOg7bPDdMIP&vQkKh
zm)wkwVowS8iowkP?@Iq%7+^F|`}uvPrMoYacW~MmK8q9ns^w<pg1-dXOya5?=vm$V
zCU9i?U(HAKABbUu{5mjf#$@8blsi*=n(SB%#NeTo_5^m)2iKLGVomBac!fq7Y(A#u
z0|B@n{X&vohC}NzBK3OX7wc%`WF)19viOg*>RQV-LHRc3#=zgjKwV0!f-KKJ)v){s
z0T5d}v|F}AH#DJYgED;X8xN_Xd~=|>cxj4E(Tp*<PBtx;EV*$z;oluqJpY<tFEY9(
z=6QAfE!P8XwuUb&N?jN3x*kSrmMz1G@3B17Q@Pg*liGS6$>Rqb0+{t-7Z}+*g|j=K
zFF#lvI}+5%yQ|O$u19{_sHGiZT1h8-Sbck?NAN}mVDv6-uYn#<9#5IcRqJp@_!!J^
zCY9ldc3{mibHi)0cIh}x_dQQ1^d2XQIjMa0R8?kqpt=aa@^7xgTn9BS%i%g3#dt*g
z;%K2r=1K?dvj^8bT`?-<`ricmPE=NXWd>GwNG>HET`OdIo*rIbHN*bXjCFQUfBCmP
zfs1+|{JFsQDfU!xt#(t^9JxqQD1qq1niINs@0ApgHzI;44a5UNue;NNE9cq|A`N`E
zlJyf<v)Aq}#YmB7c>>p5?@aP$sq3<zWup|odfuo`|EiUNv~GrbhCaiqjPrU&zIz9>
zFRgdv&7O}44Tg<;!}4+y<kiYTUMzKcI)}><QePhAKcOHUc|pvN^(*kHM{bJ-C)sps
zcj>Jki2sS9N?RPA5!)xq(>XOQ?Jr8}<UgbYz=r%WnRC}&v7zc6|Jm~Lsz6MYH_x}B
zIxXF0q4qs1`fTRK$oXp>qD@?D*TQ|60;HkH1OI|Xri$%gR_y7jd}6eBy65)TEVUw&
zO-`GsO;@c3^l~N+=;Q22u=1r+h8FV5VyD2r6S0`A`8SiY`-inBUuK7+tZ|MnbL?9I
z8_Q`xmFGOgi}|{5)al7}oIX`Lk++}!<i>z#t6BVf|Mf6~&y^026K8`a5z2m^YP~mq
zt{SiUqrLTjp5++!T(_E+<G6blK-VQxcC)liJDh_|BhYsS=PR^5o6aXJvA+hv$6{oc
zt+7&wGdQZw`j3<^VR{ke^+vv2-mCc_e=MW86MnH&fWZp0Y2*Q?D!W3t#1Xb@?7ws8
z?YXrV+o8MA7MglA1P5ffsnGha3t@_B$x9n4mBQk<{QUV@ZYA54<VX44NxYc!2cDm?
zp|Qv#T?OE7b@BABPV(I4l}1#7i4t=Bb-9sfFE6b$NxDY++ea=)`i1>A1?*QLdZ7Bn
zvdXtOpv2>U^_3yb&#^bD!!|N|zirORlg~5>Tz?tI6<x?&W>cyO*+V<2*^@I*6QBa`
zW$Lk;En7jdq5ouKnOe*u!Q(B%CyYG~5|fq|oB5rsek3Q0HA%kT1j%=#p^Lw0Hsd*R
zRap{uG!rsz6!Wi*B*rc2%NW`M%_^>@%cQ<3y;NLi*{>sFEL=(ASUats2EQxFtTr~4
z5fW>B*>oJz&p|f={Oi*eEyUV{pQMcpXa^!}FxY#HyDA2SxUv%CjCFqwqrpU-;eN?g
z%U}XsITPeq)RAd~M}xZpSQ>4@j|y*!49aWxb4X_NMwF<T7JuNEi;)&Tx}0lv2DKrq
z@(^iu3Un7we#{%^&k_GusO~V#I^6lPC5x$I%_GWq(iJB^AqJgSt44~(Ytiy%M1Gep
z_6esVi9;v;3IzN`ofFe~SkgRX)uyXoYx38k1Y97DbV%X>e-har1ho4W5Z;hf(*%05
zrT@$?FRJD{y!_&f^XZ#x`a!JF=Q9ExFB$wg#-cL+r}2L(^ea!ejmP?V7G!3j`{bd}
z3u{t9IjLi(ydc7bHE4=rT97Stc;>8LWaB+yKVEocV?Fcpg-WRjQFqP#!j|Mtt0d&F
zh&(t(Jq2ghVOsA`9C1gARdbui3MuEuzNte_|16(&t<B@DqpCX5p^dbIlfDS+lzEu%
zn=hE;I{znMR&zds>Y<?3{;_$gJu)GxWbw&%Zbb&wD?U>u&!H1ja*drOF1UqerZ3+=
zf}lpLck(>f{|PvC%~S3Htyqn?{My_*S%x;NSpabgQ=S2vbe^e6A1}nAcn|D^@9++;
zO%z{a{-FG2mf^6k=_X1+y#s#E5}_SQ@gG`5<3ZIZkrYFBZd!@m@<#0AIEGm?>JF!Z
zd~ejPJf@d__JOr{wM9ofn%ueBGsfhezmH(ywSP-xq$GMv(lvTF>RNf;ck%0=Cz}{~
z&?^+#kK?yzhVZ|PVcq^SCig?oq~@#i<0q@VD&^%>2Q&@L*>PILi~}r-Pp?4yxLMMT
zE6I(-O?mA7a)O_r-Bb0Kk-YcRJwKY&Cx~bCzXp(+T$=5S3$7s;Y2XX&UX{cbcCNRS
z`=8|zRQu<<T(S{bg=dOSNyhh%>L(H<6Tf?I3^1>Dwn%yZs<WJ8i?YHYP*$)onL*MU
z=L;ge#uDKl^i}0rr;VpVA7aMZW}j<UE5uJIXNK0TePaJ~>g$hUxp*}y@1a!8V17!T
znU*!CQLW`dQ{lSh;O}Dl9?u%8vxIK1$i8Ei9`4jY9|T=0_qI`@pH_d>p<7nM>4=?*
z1Vg4n`75RA#&r&=P7eEGSq_6N<sSWWq6;%cdl@%PxZ<ik0cQrLGRa~dG$nm<x)ZSi
zR?y$_Na{|SRvaXlGAVjOk(gwBPBcV`-_RuC3m9~wx0@=DJY-``_jjfIvnEQed!8W*
zBNB;j1=k|SbJ#|>MnAQZyx9Z(%6c&~sp3w_Ds-;vMx6%rjfA5<JR*h|=Dnofkbg+W
zMrj{?@Eghp?7=?vzR<5<v+|6*Gf`<mgswK>|MHv#4V2t7(>iL(ERA+b(YaFkJcOSs
zo)Ogs*V^O}ZIb;qoM}2mf9*!qWyp!t{FS5La>}Hjaywl($?e16vmZ!YHMxExC(>pL
zb<%w<<2lJSd?nZY5#=E5Xit#rf(y+sAYJd$x!W^9$aq~fC42pKR}u0;>vS@8+@k->
zH=cE&1AfF^)rmW04{F6_=2J$a1q-J3%?2$gI4+HC3?dyj0%?DYhl%eRCz!HMLt=b2
zG!VQUx$h870~7Dy`Ouuzq*eY861Hqb-;0y7-``j1(3?>%$d^;w6vqvPi&vARlx1$&
zMFM`uljI#8Tx;%K(w^bG)h?2(?og%FC62s3NZIl}c@x2+AT~6M>j=L3*txDvIRyv)
zxp7d?aStI-ZO`#uU98UE;QIFIep9r0$f#7MV)BNJ+CRH{_qz4$C2dmaTUXaj_}cw_
zRg_`8m733iO9XF4O;Yr#6d?Ex)2Zg>_bvmT!CK*lp+~_DyI(vAq;~9|3PkyUEW?_j
zpRc#LNyr`!DbhDAk_dERdD8MZDYN*)U9hPypg9U&FPn}pL&i5;sAxA22Je#!Hv>pZ
zmL)ye+p12V<&ptZaUL!Mzm{;25~|}FuxjvIEfMNR`?5>l40*1}6>jp8dzlK)q3vh8
ztAk&Ggx18L4CO(OA4#&~@L2AE9Pv@h48#UMhtO!itI4-w`O9{j7Uhkb#x>>?J&zsP
zJ!NFem2~Rcvt2E6-}|M+q6E4MeYgbKh+^B6z$;Jk&#t`$4bcor;Cm{3FFU2fsT{^n
z=j*5B!p&V^iG(0pcb`H}u~IArUjT~C8&|zG?ZprGupkOEwC^qxk4T*^Feg}5?$HyU
zna|>YXK1EwSUOQ$6%em`0rSV%F;HJj9T+7lv?uzVlYkX-C|(&!NUAC@Z`=k=6lf>{
z1o~dRxs|HP7hA7G8=<w{CB`Jfq6$qX=C}thxx_`vH-jr@UbcRa#;j0V9hY>pz<+fx
zIP@jVWq)A}_>QwaLFY~BOf9Fs;<K*bUhy+tQr6cd?{mA>$dAlFOA-ph{FK~Q#FOBS
z1tgoqD*6WWMn3}UX<M6)DL(xbAkys@4Nn+R1Yq38%2wCYpzymEvuN5aRfXOy8AGf!
zdgPyw?CcC6lbbjYp1rR|?xBL%i*&CCy7xlxU0R`3#h^Tmt<}isLro&}?6>2%_da_v
z{0sV4*CH91u@mvI$H{vwtDYm{K->4vKAL5!XXbYvb#22*jHtr~keCLtyaz0~T|eFn
zbmM_CdOzJEd5MVH^`mJtFEupyto(c<WO9NDb2*_Li)!R2r4>w%3wg1fE7<I7_>BT5
zKKqXOYyb{iT!o4TM)!nwCk<++{I6onoY+&^L=Wg5NAY;7VU=aV0YYzfZj-EV9Qt**
z#q}Rsi@K$smi3SsNSe!V7gxr6@|%smPgQ8*=B_@u-u~qYb56*vaM!xra*71@hW-zf
zf<gov4JcQwO@Y{BKD<&I$&PQxKLq;|tgbIBuO`ZpvlWq>e~mQIs8$fTj3m9RGrJ;t
z`UF3H6O~lX86bDU>7iC|QYpKL3_h6_9Bf>UGvhe7BHdhV_FGwqxBVsHj3-c}Td-?N
z?;5ONcqQDIE|$X<ERbKFuupPUv?pAIUDRtqZu40^=7p1Lvua-DdcU}CaosyeI{F({
z_<#ia$EljerM^t1Ok6vyR0!bT7JMKwxw_w~+adTlDq>VbPIzzTEB4GstHVL|brQrX
zc%<v{sFz6pC!A$jBM_gCh|{?>+_SV>vZ2CuKk&VNCReV+Zc5tPDIE#(J%7^5JFt@Z
z^=c~+C46AY2O-%;yf>dP(NaFHZ5{W@aih(LTZO>)-cRisAUuuL6-SEVYT0s<^+5Hm
z<^NCP`NKgFR0T3q(N#RuGZ%@Tirmt?Qt3T>eWjPiX$Z9Qn1oI$^)yym6mAFnhrjIF
zyAw6F6<I+R+B~PGB){f!lM*sAZ^u+CkX!>m205eS7$zhY6eZ3~qY24xmXb0;O8S73
z`eiQ#r@P$+LWk^O!VKWP>$8wv?v#K|(g6UzG6bZ|t`w8n-2N^eR!ogZ1r`*`zG;VP
zyAgTP%R^5A4CZ2S|F+P9h?Ui@xB?=xj^D>IlQ4oXXj$EZ9g<qD9&x$4y_M>Kv^o-%
z;aTmz_9)Sdzv60CFuA%i9Jge^lZtfVw#FkuE>2dlea)eM>AwvVq$%MU5enCdv#W;Z
zq`pqIdb7iSB-RQ$Z(=`xJ5;9I{8z&Vwn)xLMAy);hnk`QVQM%%j$aN}&>oK=z>nhy
zR$p@XwEQzc5shrSF+MkRqN;Ne_}{YB5t9Cv?f78A`y({4xoAe&G2wmZ1hq9E6+7E<
z>X-zwJ<FjEYOVfmFl8kLXe@!<j=DW>!rrpUAs2=W#d>g%V8fC9*Pwkpfd`VP_jN$0
z=v5SKC?HjYJ+<p|ZzMxh>pLg?VOd=|4%;nA^~8-(EZWV!6!D^SJ4%p3vLCB)b0)^H
zPOAEA0C*1JftzL1x_jMplI?Z@omjNu9Zq+(L_TYEL?i13=)@GxGYR-6yqTz&C$9^C
z0@?0O4KD5U)0I~=#M!<u-3ox+!g{_x6Sc+OEWZl9MSs4N<41rL&UWDNWan=2IL^#|
z%<q?l!LiSV`I4<E9?sSQw4;tT#BINoJm`KzX#eZ&a6hoR^ny(b;*uxs!BJ6rtVO4!
z90-wtXI?`L1`NO^kMcbl9eW>{F{yeowjJ7yNr^V`NOJE59G-l&zv@81*|WQ|StP1&
zmR&YiLU#w@=c`Ha;XZ^P`;%VlpWs5#h2TtJV|HsU#}nR?vCKyX1^KF3@9)B|E79LE
zApiC_*jVs}rnc)BOqW@;4ze2cXMj)7(8(=HlTlJvadqk48^5faD&YEOqF0|z#U|Lt
zKY(MQ%ia9dNL<oVz7&C%CT5hzml$kUt@y#!z5D%bq8VZF`)RNQzaXuvXUrtkP|&W1
zusAQM)HoouvFdrmZZ{vUd36j_ySOfyWU8Id!La!lwQUvp&x&}-9p^Dn?phW^u}l<y
zE?71bh;sY`FH>BR@XdYNqCmGEeKZ-k+w^ral}8ivVj62Y`&56fyT5o5@2B)ZM&8(n
zN}A9=sU*&xA>IFW)A(Z(|Bz|OaZ$%fuS5PpVQUN0K8vis2w&tbZ5|c8l`uY!&FfU5
zpe}w~94j-*3YqInSZBF5Co7df<Zilb9@zWZO&LKCDXT0%Z--m&(VT1xp`N?^^8ZY3
zlL9|#rt9le<=#_DX<NPStdhz3<5Iai$esWp+};6c^-^QAXy8=+*%X3DdnmlOgTmPl
zY~J<5A4PD*BmLKTV#-_%;!Y}=6haM9+_a;_Ea+SPv?&bMa~5n{cM6Y9Yt^HHWi(W^
zNq*4G?(v+SU;U6|`5uh-(0<&8Ny|0+M3<<%=S3~-+K4gQ3Fv+CyTqw=vQvu-n!rZl
zDMH1S8KmNy?^Ws~1`H~=eQLun&snuK5#8?TRv5gzyrVH|^k=h70k^LT2p-oYvdtxE
zcJ>KG3h`!xcMx!g{GN2=B*yX4tO6-7Dftrr$W8E*f>X0?23g~hce73*J0T^%U+04j
zP+PiF`TbYIeX^fB*a@^r@q{(Zmp^mU*u}{Nj|nyTxC=(=Ek)VvQ@tv*hR^9L!yu?A
z%CcL?Ci%J_PkBEI#PnGp#lt+_Tz|=YrX#6kU#mAIqyam@FQB}@q=<6I)p{+4JS%NO
zIfXIU0tJsX<wg3Jxozt;*|X}VAT4R6@atP9h6u#35oC*g&BnlypO1b<ejaw}yHB31
z*T9gBOwQbYiZzw_S&F|7xt^NuQ2vPao}8l?mz@5qzzlNEMt*YH%r?$E9gC`hF*Dzs
zP?;=rV`JmX8Y+j^n)c{KQ?_72Ni^i|lHf58#gg;HJ^7%LZ8|<EG<E6ElXsm<3e8P_
z=3@6@sa&=m5Mam>fooB`(jm!aF&Y*T_LM(DVRr%-P3X>j_<T;}7{TlN2f2{jC3@~x
z%;7lHIa??$@nCE4?s55*GS^<3=9^k7g?S22N^kwh^lAC547si%D77O_D47N$x;kT(
zisJt?e{}Um5-sQIfd#qn?}AjNScG9fzAl<NxlxZcJ1{(7byDhzB_e6W8@h#{b5<?Z
zld#84-*lC!vTfeU+gn-AOj)rF4D^^+rju`+tIRdFOXCHpxxOV|{~ez}%00nEA;E5u
z(0*SPZ0zc#2O<SIMDEJCA|_)K)OGnsjW|WtBZr1)D)wmwjY-(|ARaSLokg8GJ?QT9
zN+RJ5c|NI)pRpAdSLfpC=XiV6aB}#AwO*T(XIU~OEf!mPfAqy!49j1Hkpw>t`(UZP
zF!_gDueiOG%6E^5)x#uvg>dBTWKMF~lACPGW*ys^2VQvof+m3|{gbZzfJ*pfGitB>
z4Dg7$d_h_Kd92{n38CsP?Lh3g|H`>I`Pzv}^2nCwY>EZVO6elzQy?@U!f(qKsUV(_
z{-CieL-v??0Fn_w^G#NlX4sz*{^48RiaFOOg0dGo<|zV-_UVM24WAm#X<qIw5^SPy
z_FtJg2#F?m23pQnR@sz4)SjdEi=n?7Zlmjq-WRt>mES^|Ev^gf-B5{!{u>45*p-?d
zeL{Ym7i1`-04NG3Ih~!za_Q;ta}0|Pt=qU-3?R^C_@pXY5wK;RSvoYxV6n}`DjuY%
z^|nd+{F<-de>zt?CWevG_YdyDM#sj_%XiZM(6ZXQ>O^S4lx<5Zov4jYA=ExIyY#)x
z)frwIsm@1ceR1`d=?}LrS$t8Y_S&OnZq8YE{2ErbnqQgEz}DR{=M8D(gW~qz7o?Z#
zcIc7EYJa@E=lP6Uo?!RNDr9H01rwVq5Q?PdH)*_FV>EQ;=DR*VK5ESjl>A=C&z%H^
zS|yxFhj+Z5++JzSEQbvfmR$aLjlN!9J<krwiKBO4$ZWJvG$7D27rC#V6>MofGi1Bw
zhinYQX^-E_-y<n>wQ6|#6hrfBPwViz$9ArmC$g((d%-{#AE3^my};C_t@xO({X7(A
zw-AwVX~8z<w5yFZv(VTr-Tg&W)aVB<f>b*ynj&1-093jSR7b46E&GW<G_WT9HaMT@
zu|9@IMZpW03kUilJ76wRtA&GxIgl2Z+G3z@P;F}zs9IhawxN#CuR#9P1J{GKIMlGi
zr(owbFejZ;U|c@IG?@JSJ=Htd>X&Hmz6oyyKkke=Y5g51A+y=QSl)u<$_)YK4=?yB
zAa%}+h`o34f?0uY%Q=O;mP!)oDf-M(a5im1`eEg3Cyy@*r5)%ah6>pd*$Y&l*=eOU
z?g|V;f}Nzsy!bqHnxkkA=dC)YDx9$7I68H`iVw~~@%4~HlFN~YrtUKR&2KtG_VJiC
zrY<kF?4I53Wj3oBy1>%<6F`^ewp%ZmTk&Wr(q}6ri$t3?Wh!2~9DeGh8|V7;^c_<V
zdh4yVBpSydVMz6U>3~V93SdxC*hls{Z>E$`A+n3N)vIRzbHqmG!9HG3gn_597>%0~
zjG$B|KM9^PA*&fOys+1A47Yw_BpS@$TXnCFpv@sJ>1|rV5GCC)JD?Nd9N3kpMAN)T
zL_<P(HsHt6ioQG_yuK4XaA!DL_8fDUWNi{u+2*fm*1``8#RCs?itUGjZ4YdOLM?w)
ztfXeJ<w)DBXbN??ep?QMR)%L%fnI(MIgUr_`f3qCCdJeYMI0?#EE<n!MV3|s!C4dQ
zEQ5hGk6y%Ur?>k4Jbt_g0rZ3Wn5I2eaWV1a4@0B4?(@n53mA6i-oL{8O3t221ERSB
zzgABEGmq09Qh18;F537jK5J02<;s_!5hD3TCpU2(66bkg(LCrO3njs+NeG2rOxvJ|
zxqRG?Wa`JkN<qqmM4z>_`?l8sUeBPd%bkJZ5!a241IO5Gh!)@LU26F@5q0vNYIwD7
zbb7ehy-_om)wSZ18}MuRhI~*aNV(m^R}~IUta2p8%`I{LnJxmo(o>@2vK47xonQev
z82b+^-RCIwm+lT%9;a2xM2VwO9Yeny1^p#YreIhdoo1N6yI)kp-+zi|v)8`cxi6PU
zvm6$J1n5$rN`(dp1h_&{p^kE>>eWCZ&-6%Nk){w;+My0+%_H=9g-OT0-Wz=v4h1HL
zMG22?_47N_#X(`$&?F4O<;Uoe54&vd7VGqD-jR_PL)~1ik=p5zD$_8<If*2n;!c}5
zUheUy!+XSQMi5{~x{nd;6c;NRqbrpI&0Vvcow~L;RLudvFk8sdkKs=Y4p)@O?j$tr
z*^G8C2%&W?k&!^)Mgdg9OG;Afyk<pV>TZnf8L|xbY$1ih^gs{VAU(WEfLYI+Q#k)~
z?w7^t5xN4_qAG@{B89n>!QZvE(m9{gW30}(Bo_n7%QOX}fB<8XZqO1T*8%FG4+ag5
zpe#yj6{oIFp+rX+9{qCD$i>>~CQ+Q3?5FtOVzE8w8tQj#opRi+u?42)?v5&0V=3(0
zNHF}pd_Jl{R~qxP>!!qqx9Zt9^M{g~cH6t%Cb1%X9w9hXpMq1twfkl^5nZs3Uk342
z8T%#Y>Km67b?aA3g)X(boKERL?Fp@DzU?5x13{G8DeTfu^l?AGIOo8{l1BH5_{M#r
z^M>M|0}+e#e<`aZ>x9x>t*g3L&c2~!>HMxCrbf9;QK<a#qBObm^F0A!LG-RH;=#N?
zkJc)w<}&7CgwZtHCD^z+R;Jcko4L_MeL5c<HB;op<pj@bS{YAVXbbkUJ6S_>y)W+d
zi%zQFYn7UF8k@q?rDzq`Vq7b&@ou#a%?N%W3vh5XaBG(LNHHRCmJ+?jkcBEqf8Jh)
zBeLTt=a<>U%E+v6LHr;K&1*b@YcthIzVJ&vQvv&#x#C7(KX~PQ7ZF?yH(!+59I`*t
z(ElGtSK$|B6ND-0?ru0hN;;0tqmJ%wknR?wI}YiV5Trr6(*x-eknZl3`0)D!-siWw
z^X$ws^X~41H!hOjxYq2eP7(tajL5VfW}IUU<-6tNIU>&*Yb<v(hUKRlV}33)yG|1&
z5yd3!;i}BX*g*$exh~me=&#oQt!Re$HUmx;W{nRii}3G*u!dH6Oe;zref~X~PBI3e
zl=+56e;+cjEPpPW+l{d20frp|1lNjVdyeN*Q+2sn#NQuUY?o9EF#{<8?In6O8^wXY
z-&%F5l+qmXct)k>zTLA07||`yuAR?rr=Cd6kBwoVvn%S<DWxGl`Q6cDLRt>xrZ9)q
z_w07RQCEbjX#luQTZN+CC=9<!xMlQ-Fw5hs-aF=0^0d7dSk#-`(^yO-WsYQu$QKYi
za2C-yL7j^VrMznqi1G4bSF48c2%pyELqeaH=aSy3^n7M|H5r5w6ZLSe1$%@(Qg2qk
z(+)L5k_^!ZMmr**KL&mBhM;lIb2Yy20I>?0Gv&oJZ*Tt=0p?MZ1Kp;1+kR-wn=t2@
zPwbiU70RZx&}Owa*7oWTJNt#FxTa)IQnLqLOuc&+KfD*;xSx?V5YFJ)XU9DL(i7(;
z!@)?^9=+wS;~5(CKEa~U_P$D+eK8sRuP4C7r7&~@tE{O1v_Rfh1{*%kq|ViiT>_ZC
zRy9@pDT+RH6Zu(t`1`1VFzk8Ss!Gb$2*@L2AOFPYSd-ZZ31Hk~dfzQA_Ve@5(wXXl
zxip$~y4qzD$fX?d+EpNiaDZM9PI|Uzao^AVbS>4}ni%FATNnN?q-t#f?J!XlcKM$3
z)1^vq_3N0|NY3~7+@IX0BjxYba8wRgV~4K@aEglw?l>_DaW_fd?fh0(;Xp6&$ftx!
z^D+whEn%m_uVQzN(muVAD}f^2DuTwG)<LPg=!n?x$HCZEG*F5_?$cdne~_Q5xX@g`
zK&Hyeg=e&hjXy4++*bT*!I<KxA6|eO)@izUbe2!~OMhD4%)SiAuR6E&-*MsRmWGBc
z+NF_<)AAaP3v;qhbTZ+1o2|veT<5<WT8e1NoskCSHom)KTr(@87>B*5+ATE(VU_#u
zUB9`)AacO-&;uQj2*yT*t)~r3E<?kfBz{Bo8%ef!kT(l91cH$@F=MYWrzhu^QbYw{
zExyNeB?F42)>YryOWj3z|9mGcFzM&Zi3!pHpw9^$^m`#=_cs(BLX+aZ_kUx~Mu5Ow
z?xF|(kaO_C2lSFb#Z0_w1WIu6NAmz0f}LLzCf;Z+qS(fL;;@*dx`Pho!OK)$MEBdQ
z1Hz1u|8ceZK-U33!fQbgm@qq##E=NXkoiO9@CSK50F4^)-KLSfg?EDUeobJ)HX&c@
z(_0H*u*sE5rW(}{hz|9$Yxc2KATj_<v9(h0&%r8a!Mda1kxs18VY^!LBT7k4b);1E
z;%J(W{g_WE5)BB6{TP`IExhH{23U|_Qk0qD!Ef()i|K15^gqqY?CAfnl_QWTKz0_k
z+r|%mWK~IPbjv;#J^ul+An0Gq9NA&^)+v3X1)a363;l=XO>9_g8aS(Nxx}cM$aY<<
zf$tjua@h@+Ns1Sn?4gpu0rP*|l-{}Gqh6q1Hj5&oy^9Oh(^cYcS7QiEE#1X+l3G7`
zxJVOqbW>q;yi^p(q~QAFPOicn(artEEHuDPVZr?^)`2y=^(Q{qQ4btTvO7RIYy_Ab
z9yZ8NvVN+Y6iZ^t@~2%UyW+a{(V*iTY!pM@tuInwoKhx_oX+OtRhZB!@{X-=+RVAw
z?S(En5Gq*QeK^ls<X;Tx;8?e$FP^p+3d949jxF8fywL&Tfkf?V!Uxt?up`+Q26&k7
zf9+bdq~C(IZBTt0R?GQm@9L>OwmJXqGcEeqV1Olb!0eE_woT}~PJIazAzNsoh%KK>
zM-)HATR2^(`NoG5&>lAULe!D~@xJ`U0lthH{e_lwttd2Hi^EJ_h^T3!l7Pwbx7BI?
zY#3)=-He<_*<Ld6QZsk<J^j^TSw|y`1mSo{pIlr3HPB5q80pw?2uJy@!y6R`>V1FY
zn7BocX<+!dI^E?`Wo2`YStaK!T9vF=SJ(A7N9r##c2``tz_=`)P_8>sYsaivX=#tx
z6!>a`(r$jlC~~=^%t3!zdW3U0xEo_@0<ij5d#ET%n7^5kGtbUCz1@5zV1)ll7mJ)Z
zI6%jB&8kvLUvIJxIh*x1$)w@WdE73Zz;o_E9yOlg9)wG~-BtXab)qLluo_(NJ;GAK
zEWs+Ut58I1Pf`x?w^q|3h74+JbznDbq~f+k6rLGb`t8<T|MK3lasJlB<>arJ&_^%*
zHNY<cWp%T)qo9b8X8wv#g%W@WVyn`cnHOli*0cWSjIL7GM?Y-0t*PTHRQ-vDqwMRc
z^~l6*a8@r@`K33UXxfnbG4qmzq<Q%WkM&_V^4x)XKL#SAi@4F0Iicpiq3Gy1klKWC
zC&3QGU9-FefJsi+EpdgFr>Z(*+{|u|ghXyF_aF&?E;?}X%fTv-oSucY(<aq$CD*gc
z37nth^|}UJu31PS>5pUMIEeG<BNa&q3Ot<l`^mTts#Z;6#0GtI-}qfOu^UQa+DOmV
zQR%CFg2N;lOSJR})c%?<nv%R$&&#wZ5eg9~1;GP8%ABdcY!{@J0XwQJH3S6!Dk^@d
z6#*2nEMeSdj2mbSK4B%B3me!?_GWf3OxskvZ4N%Y0w{;Y%r?a;=AdSSbA44?U?QB*
z2*_34-*ZkZSupH`Cc=@^ZX6^g%butGq}?C&6gKyQ<Wm3MDv^1Hz&^s?g7eg^(0}gC
z_A~dY$bs^RUk*&l&bTgJkj2WE7RCCeiA{;zEnF$lVC2RNW@J3}Zh>31$Pb>=BEiH1
zb-$dopp9i2QyIJ>Ic;vZ?SFYS0SBBTOuEH*%ygmZIm9l1uTfEkXM;gNl&kjw53!G@
zL9Q`o8jIk;5)Q1~w;hIZ2m=O>Qldr4x`C731X&i?zxj+V1QBMb&w6}iy6=tKj~WOS
zM4;W`t$SY%q2#Z7ZNK9=?mv8r41(3TEh75bk-bo<vdOlNlkqN+C_e+1KqR@FdFF{x
zr8GdZP(ZAiEcP+Qp!8+4pxqVfJl0YHHdb)S=Yf7p2faP(hE)95sa@4XYO5=`F!Q=t
zCEPV!-4G#2B}-Y2)yc7JQ1o+|E^PuK$67`2omvp{e#3|IJ{TEa8G0->w^~^d-AsO7
z(`k3S7Z{bztc!|CUEaunul%HM$<*MWdjFer7L|rC?+&1Uq4?I3N}qYi*t>rF=lK5Z
z@iE#}GTyLuW27_A)Opph{om4M)&r07jiSD~e+j<2N9*NYmn_jNi#fd8Gz$aPgm`<@
zl>2)G>QRb);!-OV)@~352P^IQxxCV~x3k^|wMD<N(=U>pnPXJS6FB#NfM<rYwT61X
z{ha3+Z8SN|c4XCgfd)Rlh;&j`=6ky$M#?hPaz9O_U_;&c%n#sSw~Iga)rA=Vc)!|D
zC#R8ToAj(GFG>epk-t;<B$v?07pZ(D+KUVDaylUEqIM~2Dffpvv149=h|J1IQVi3I
zngTo|y$k|HW!xQX{gW_uSCYh)DH5JsdTXKQ-#O;w*A#EU3RIeK_@@~DZaA7F#fEhw
z@9GT+eN*qO>G5`T6Y<&3-P+!0I>6d~zXv#gJOvB3p=j!srMpdQ6?N+ILx-8!slpWa
zm}!s@*-anOVM>f{yV(-h96>$Ly6)ifx@uETIeXP+Y089B9u*gHbHtWeYOd4fUtaM8
z+o|0UY#lDPD{}z+ZM%Tp*mBxFIUtd5th^j}>K6t1b5`MPH{GqW^I{ISVBqibUUx_2
z_KNa?vq&0FeN#@%uTIQf>NOY!L(0D=IXG*BO@C#@VVkgykFhg~^+hr^H<n%mEocQ^
zlBD;W&!zNXDD<4XZ6ZI^HG+P{<M||&$i*$^z4oBZAqw2y`v*wJ>|0PaqFdVN=fm;4
zuE1r+mu`IWP2^g>Uee==7^|ee=b5sVc(jUwln7<UaO-u((`M@2#OSA*qJD%3m0PeX
z=Q`~5F=!po|45Z0Umfk9>x$iW`zNPOI^}mnV{%htJkqnYJkR`$N4WQbW)uYvNR1YG
zZ~|?2D|L2dT21-qt1`U9Q(f4?<$=j$_zGy@{-N9cMFoxV8w|kQxp+?dKr+gyi_OC9
zu+pP`bM7(r`ngat3Yn;)Cdk(=FGRn}9Dp(ue)F#Y)aRWq?1D?ZLWVq0ZbjI8pEsvC
zD1F|1y7;}nYy$IgxkT~4o@?z_|35W3J=))~DHQtzM|L$~#6iWIG+05Ssg>ayH~|13
z=X+#$RJ6GpZKW-hwwx{cik_3H-l+vIcrn~TPy`Pn`9mf@Ok^E`02Y-&dy{vf-R4oV
zYyD_gM<m2oYPPk=%3Hu_VtjHd;%m04)u-uVjTj7l@*G~|K>tHy(}^9^1gWF|(zAs_
zYK{k5M&lqya%s1Yx*T;zc?PL4LC1T`kLFsz8RuUiHqlMpE?hD5Ofl<%TJQdJB5jzU
zKdq@Vrt(HVk{JPEBKB`caysPvyZY8Kh8MndZX&Mg24uP_0{lX++PZojr^OWSfnBqI
z23CUy*M=U2Fqh%leENgu|Eenk{JpoA*z-QO(|b<OatnX|DFL;PLJ^CLi_1c;uZfp>
z|M>@HbTirqP|WJEd@_>N$L&2e76EgXf^Pi#iS_Mb(5ti1XJ!$A7C0<Pu|n#UuWY2F
z?ZKr5O`OD72Gw}2Ag5Y0uzahH7IbK-Qs}|GI_4_Tp&C+!EWBmOO4AXH?&NL4`-wNf
z--lroFkV+sCM#X>D<pljcF50``1y^I%6@@aFYrI5^&9@LASP__VW%?4VfDg2ymn*!
zJUt9em(RvC{ahWnNMT@43IFAB_vniY&qdq*+DyQ!&=pe6mJh|kktfx#Yxdt79lTSE
zG{5yVdKFPaaqm@Dt_j2jp^NOGh=*w%mgBJCYn0NVWoe>I$$JgSuGpYb3Y^I?&^q(i
znK>KWT#k}<PW!fK`rnC8-OcrLjjq2%AJ*|RL&Vn&&}}dKu0HC;<#k`%cC&AeUYiw-
zZgu^#IB{)Hyr9pIU>5VK{P2hmHXhMz&g3>q_wME9omm*8PXiqwl%RPM#P%g*&Ru$$
z;a%lSJO$BQ-qKx>h03j8=yojkkr~EmwfqeQz=u?QBia1+bCd~K*-B5qRhRQOqOn{W
zNT8ROriOa>V0~)D#)G2s_ReKG$DaQ_)ozJBqbh&~cE;;^U;E3pM2wyo^Vb6v-`-kU
z^bsJLfpMp;O3k;uDkSB@<ExflNJx(paTco}8WtO~=#94yNb3PQp?yE&UM>9)-HTyp
zk=OAHHL5o|y<FQa7$j*{YB#fI53?+@7%$}6O3y|z23#FnVq<E!DgD+|^GDfm(}W+I
zgq4SmaNCcq1r@4+1ycfy90MT_8_I|@dA~0pn2!&VC5_x&h`>yaj;!ydBP{cIfKMem
zR!GNID@ZoWD2mgZ2<&E61R7&8Cw6mC!kOkkA}3a1#@_;Lj6Pi0_pkz<lb@`9SN2-r
z*4KiCGH6<FhQPuaoX5*&8}LN$z$q5>yTy`Nnr0c=MNsqI@UqFu;h}G-B6g5PQf-R*
z8qj-;{Dl=#^xH0kI2WDL^V)X!5Gv_jNTx_N`Kv8iWc)-_UPkbc5RP=pb(8rIzQ64m
zKMzXMYG9+!W)F+6mi&r@{sN)0PlI(1?ehH4V=Z!o!k*+?{)t&HX(>qM&l!1~Gfada
zxbVI&RIS%7o<8+-Qs!u#<TS9St$KDJxpyj&X0qqpfly1Ws)<q*0@&0>5XF+*@t<=`
z!5bbV0Y!iR!!3h8D1)GX);4lNN7?5$4y*)w+EcDLoHHosZh=sud5&jBaGO~r^SYaQ
z%BP&ilg&86S>XD-J&B@Zk!^ql7p@lnIBhoOyBP63C0f4TlkegPHeMg&4%|aMN|nNy
zqsyVA+S!)FcITGV=Xk*^X>krinepvt9?hl$7jukE?_C}ilycb@|9qe*P|LsQkx5YB
zjlW<c4|DV5=|CJ}JNKhWf<Vhpyi1xthsA~gG&DyYRNO3*x(-&#`7SD4?%R%GRuoG?
z*@C8c$bF}n2z+0)1MW8_*qeFtEK$Y1Obgw4jr<1^c4@rjw?}$6BVA)B{bO_{I;bk#
z=)8EQ8Tj0|<rir_l8<&{)U@Gv`mGL6nLrrp+BQ;KZ)zCY$$=!u$B_(@?5wWfE&WrK
zQp92}A_Y~z9)rdXof;o7&Pf+_q-BkgQU8)jkY}v3!zas%?%pwtT6!e<$RUouxti~0
zIVl~vO!c9SabsZK24@%r;kHk-DQZY4PpNI=bBlU{3sjYc43}ZTu_KE0HOsmv#(NQ)
zqtc0$?gJs=Y@z=zHCooH;xX_cPs8V>!hybQoPT4AnE$v1Z^8K<JWuc*oRmst5YtbE
zF-16pxEpNzTR$xoy2t5T;tqPs{<OzPAT7Ow*`Mm8gD>;M>g5-SJ-X1lWx05_k()}(
z`j6>qQ6=S6wk!2Dd_Xb0<3pWUM#mlmmydQ&XQt9jC0809SqG`i)ewKb0#H;M#szxz
z;+jj3y}oKQd!2mVwTyD^5526WPYL$IQu*izUZE!%7`!%Pb*AiyBzZHRAE3MFN{S4p
zu1KoC7ZUuy^lG0ocNdJ&3IuC!oKkR&ezn@Vrgh6IBy>=6X3r0Z`12h}W^1rLVjJ0f
z-)DXs-fv7|k8y?tiCcm3iZ4-}E~MxkwpP9#P`WG@kxn=aPmfGH#Hgcu=B_I3=B7M|
zwzXCe-W~P`5LzT&7r)p7HaZ$j5S}q+DG}-vn^nnsy0VE(6<=QnrPBAUj?m)C#GK#e
zz9V)cDapP<Pos1zFM6qmo3@4r4M1o8KF+qU5;J=i2TFU#c=159R~Xw?OSOb0FoL~b
zWrck&pI2!Zu<xHuG3t)jCuN%*O3?z(&q99J8%^l<?e6%v<?sk%hpItMY^$6MC%=Lc
zZi+YN0!>Lx{qPOGMel5-CoTVd8qIX-3`zjJ`gXrAQZv4xwRGZMX?__)`IC>}i72h7
zzC*r%!aP-DcpVUc05Pl{oSDwl;ghwS_TIYDS}c9`buS)wivTWaG(0n&ZbQY+?*3Aw
zc~h&3HRAynC%g|r97k!?^hpc45);?C$&1IfbUImgoM`#;uu1*T|L_841(6+<$fsLI
z>VA;q+9ilI09c)nuJ#nxoOhto5HnvSI0V;&O!XY3B27Ba5wfTuTrBBmJD@f>oNZdD
zY-T<rv;x8iKb_S_pzN17`=AJyXo*6wsFZlP-BDltQ1!bl9{50Xv29|4hKdj*d|zJr
zdY3hspzFv|O^4LXgKN*l!yUz*{}Z={?4`1mR}rLY#tWTkiXK2!;^6+f8Z3ny4*BIP
z(Dn;!&KGGvZJZ5WCa%a<ePPQH2;w0@wW1aW^YSxHFbmG`=;ht;fA*?p-tn%^w^Xoe
z95tGKJGkTdVmGDAz85i&#dxC7Sepzb9hAr+;N?Y%CsK3UzS^0+$T8#6Y(A&A<%;6M
z7Kh_~&WW@f<?IKBfv<7cZ|1&Eq~bO4NA0&(x}uBFNHS(FV=R~ME+NT_x^c=0uLBLd
zi5IW*&zpn*^KLt)&3Zi_Il%RE|4cyL1^PWXGZ{d_lj9(ku_<(nYXx>yQWDfCq?MV|
z;9a5k<{MuxB{wbbIH&G^v)eOVYW{M-lryfq^8G-$>F9wmPcsWWoC~{lWE>8hLI+`%
zK)YqRCyZ7uDpu-2WHY3zH*LpPx;C3GmT$;}fIePdW>CcY8ogf&>TRSz&IDf+GbT+O
z6*#e!F~dBj0bZMc4|m@6a3LmGWKS818`J~eyINGR2gx&}CN6D>@kV-2o}<w~%Tdqi
z;)&3PR%B?wc1SD{5<72R977&`(qI>E8^9)bJH=@OWZ@aPLxC)ipy#UU)-Au=8PrRy
z{<+wFt6yNIiQ611En_fpEw41DHh-usdOb59W(6miBkxjmNpIBYrf5E2ae1Mbcg;ic
zwn*z)*W*%{GQsJ!&$g>pYfwN@j&mbyor#P~$AGmL4pNQsys|L47FF9VELd{H=Kb#h
z2!nFh+Vng#_Pvb2Z7()F*Ck`LdPb<HFo5?tNi!=|@YJUkl=ShVg%>4xO>GBGrjHE%
zWnA3c%G)2|&hh5+;-)G?<JoF=yEoDEibYOV_z;*9$}f{Ts}%R6O`U1DZ^~I6VjqKt
z&n41^pRSjbHT=>+L8eYGTolNjJ-x*Lt<?7h=HA`+^3evX-;Nxi)n}~>c=Z<EVc|Ut
z>4T{N6koDVG|GJXHNV8!eh-U2S&4I>fWrVl-WnK!r*Y~Z_H~V6$KnY?fZvqF;~jiO
zPb!Zywa>Q=L9`$5JIV~-oufZ|lqLsY|3<B;m)G=TxEvcQkqx~B3+8LV)mzOV3K?vm
zQBUSQ94P9g*rhI{ywJrIRzRl9T7J{Dn0%*JeHpvl&WVwK77^g&b7et5T+R?9@s$V(
zF0u`8kxoot;{C(sDO7Bn{DCEK2>q=Smfi|aiojLZul#Fsqgex$AypH)k_3CVW;;x~
zRie@j=OSSzNl{*S%rtlYV$jHz@kO!?<y#2S(H7kSrH>Rj((b>tTOSS*e-6#e_xL>E
z?f5zCb0+qV0LqPMO3<;&ciug}z0p82<sA??@&^%&-M!4vpDW60&BSjYf*!#mf})HH
z70oj|q)8chAFlj<kbYm3mB70qP}z2;xhm#&j-J^JyD98(gIOCq^AB7-P-G*~&!~vU
zRJO1%`62(N0b$Y)>-W>HJ<6(}0{pUltV6Og9GqP?OPgs*_F9yXqCqK#gqL>NZSq1~
ze*>^j4~tS#8KJe$G=M@x@_Lpay>I*ll59bV%o*2qDJX|~fTH8FpWetJ>Nja5Lq&lm
zPKU~E76nZ3Ul9~E#Yq6}yps=R5hk_6CDt^-p7yNb$F?$Q6Lm~X^6CW#hO%dK)i%6Z
zULRl}5D(ctOJ-`;hpF1?<yh#M@p{nx5Np!dmP?_O{3-w7a8JN3K}&Y+fbW7iGG&)f
zBxG5XJT$4gpqkPK-24+MZYs=kb-pwN8M<_8qZc#d&uAz8Eq*bXg3ntdJULGA$08m%
z$uB!!>91FV5@K75J_8jf0}W`mu#|VU;wLpIXdco7-Xsf887Id!A^m$-f62eS_OWwm
zAnVTbTXg#snDfLG+t$^pwQ#6J$y5PO$oS!Vdib}8j+LtC_ejYsLYz`kW(K}o<0Tjf
z_5oj2(>|D7zkcZ(WSl2Gatr6ZLtUVLL^l=1%fF$>%A(g(;ESAIs-nfv*wPl#{Seen
zFg5e}VD(`6_Hr91{xe(%s!4czmA8ZJDV*GDOPXxT?T%>$N{`v&WF;5UdZB<&g~YPg
zjXalP|Ka>x^Q>47pibIkwyZ^9{_i7}?<F{Al>%AwJ_k^OrV9B{;S~Sz6eL1U_J#A?
zzQs~jQo&xlh}zFZ4ZuTw5e%NYMcZ+USm8vqug28IZ{<_5ZKyc4>N-z}Pd;u5eKt`{
zL3&5Wjrx5?>xHymJc$o_3^%u;$VG()z{nESh`-_vCI4te2T<ZLrR3Gs{;r8fI3)7$
zs_V)XE<_wHwrtuf`f?I3yJ)VdUIAmA<g90)34@@_pj4A*dUqFDzXRgdgOS?yM?oGd
z_<W$|Nh~87qY#|NS;4aaGox}pU9I>p9eS%TX68)tLQ?;xYRdhF_GRtP4#NEc298L%
zEawtt_aEQ^L9Lq**_yB)Y$x0JGWsSKWdgbCmqP9Jt;^VdnXIit^SmE&RwHcYD9doX
zys6Kxe5iX-iW=o`rXh-_!oD5Ch3O<mtupn36;}@3MK;^N7*&~7k`Ewu8U#IVi#dQW
zXE}RU%(9yE;)FFrI|cN%>)3NJBHVD$6B^=^RPn!r_`r$23R4-iT<Gj|K<6!|ht*KL
zUWuMaRGJ<Wt<YF~cw~`Z<IWkrBSk{@_$G$?;+peF#>+e&z^VRMs~MOB=c@T>Lr%_K
zOp$Z#LWINs>mgoa%HDT(OL6yb{2(|jGS88xg;nTAkt(?Csu8@_INC4lM~(fvKNSTF
z3p{Nxq8xIYVTwfpE7%~Xpus0Fhi<ZG2Z@(p8ph;+&E2Gq2Ef~M<ouyRP$ijik()VD
za0ywxnJiU2vKwB9im!X#e{&g31yMR#W8t!716KP42_7|H5geA?&1ov9(YnPEO(<aF
zqC$B#i{pfU-`Q^i{VCy)xTMX{JW^O~_Cj-R(B8bu>hK*J^_T29>-1Y;D-25Znr4dl
zR%IGys5|SZ!bg3U*yL+xLeJJg)9i7PVv4*<Y1@E!<q3{A>FPt0*|$oqKrfdx62;A}
z-exKVU)tkD!3`T47lptY`d~1@3WyuylUrwLG)UvU{)X&R&r55V-imLBOID=RB~brw
z5>`DL0&k5W{aQEQd7Y+$RlIgsw>!C}r#LsEqzx-rRs#7PNQ)6#KHH=9OK#+Iw}%Hq
z0kUEKtPBQemaRHCW3I_*Gw=T&j5zv8<8QMa+`B1yviAgETE^0Ui0irH+0N6+sV?CF
zq8&4yOfRfV1wU(cYU~?W)@Rnrqw=G+xQCV#(;Wo(Oonl=S|t1%l4GUikk#=dIuDX>
zH?Ihf#S*?$mV^3uVH@)~xQ>>TPk~LPG}APiHh&j1*NkoP!^xOZ@aJ$Jt#E3_@$jhW
zgx8HRPI^Xb$p2WsEI~m$HPgjuL-yepsq0X3F_bv#;0S7`qQo}ck#cY8=KPo{Tq!8G
z^^d>pvDTHVOnPcICbv;lt}wLnm+!}lqSWz-H6?ZBR%`#ad1dh+S+bNsNX+mmf?bvt
zvcHTRby+fye<|lt#Mc)$O^MRQiq_VIgn5Qkd1H}IK4(y{5gmORNo>VpAQK6W<7-jx
zmY^Kw#gJ86>Ti&YMm$N<AG(IlkZ%e~d}86O9nAbHgxe#8wl9w*DVII7BMpj|#Wh=k
zS}ib?y>T1=3MnSyY)yt=Wu7%Z>W@+h<#h1I&`eRU#sE4W_!Jt+?Q3|b!s_>S_=9W+
z5pPNxMA@?ZNPG&{YM#!3^Rq0A{D~cd;_J%a%JS9k^m#DR;boI(7}=_eUj5EcKXwc8
zmT;b>7a2JRjZQtN4*_7ec3sFbRqM2_+{8l}K71#&tT(E8HLAqe?=D&uOsU8TLnnDl
z7(1{AU77~n#PdHY=|Q6i;qZ-Vi|DgX@!E}m(df{JsMtS*>P26Caf$RmK0B2e)SWN1
z&H{jL>iv==0rqdIW%};t+gj2GNj;dTu(f1gdwrvsi0q(o34)q7Y4pM$P}5Hq$&<xC
ztZz~aMAlhqeIMjme!nYQ<pqw_78ryUgT?no$U=4#FShrt9t@B6NggFR8V+pyx$Q5X
z%8k+TOFJ(nUKHS8`L+dl0tMw$+v!_fIIi5CGdT>3iWiqlyTa^Byo7VcD#>HF<rD?|
zW*n2TKK}5}>e*-gqTM$Z+rK6{RpxUUs;0kOoa6|5MaX&TRZ~&*DB|eA2(8h~E?K2p
z@a3AZvzlwLR}JY7)3{U`A^_B_7v(e9Tv_Rz=!OS=?9_QE;tdEN`B@(&HiHPx8_~~t
z2Ks{ZE9ULJH=v8;qIud6(VCZ49V)n+1bIsN6G3pIE)zvEhuct3j(01wi?RHW^M&is
zm_D^p2=I5}1?mXZh8+SJ(eKAHC=_ivXF8cpiqFxMcm#R2$l%>48d~RL+BgO0cgDy+
zzuxD`^MbSN?<^Bmh|4u%Cr6~CU*GNZ15ut_pB!#RE?3OWw?4{oh=}9RLNr#NO%s7g
zr=#XT5^ZJGuD>pk>rfa8oE)&dgNBCCA3=Q;HOr#ZZ$s^`CMsEQc@A)VAAYpsR$QR#
zdj<^+YG4{wLV>4S@A3vTJ<7TB8N^b!*l0Kde?^Ol4PRW5Totd3$_m9$Oc@j<l3K^~
z2g085#@$JM3Q8F0PJ{g>cAKTMg7rjjjHFymF3g{&$F)gNbUk1#jC8wziMxie1FKek
z<rkaQ?61$izbRT#M1!v1PX^4aqBUO$wWXiVM@j>3(Nz@Qg@nZIbG*8J!lV)K&R5B6
z^r_dBq=d%NgDIo&?|P_)8H&j7^uH(=a73`C2qeCmXEJwqd_1QoWj!MGh%E8S=Vtf1
z^k~T1yy7a!vhl^`QN=Gc1>!eG0XKB8w$y5<JTX$fE)-~^5Tjlg{8Z;s7-h%?xN>I!
ze)y_;+;`w+BR)K1(@4V(@PX6(ns)h{#iLis(D}Ma`_TB6t-R90-2MQVHj~EK<l%q#
zKP41+?M2+?F8X#IMn12^kA}^;n927CErKikFcz!=9SDE_q9VAM+_$+_&o1{-cUD7W
z!7G3mAkMs;)~X|NWo&t6OkeK;X&#eRP^2F+y0+34xbwAuzNX14)-ISL{GBV@SM+kE
zzUja(D*1QbWvLjE48f%vpl-{1dN7;>tT3IHuW!ni=NJGa1@QhWfQ0FN9{rihxutkW
zSTUKEZ@xKn^HiHT4vhZzV*+BU{)Bi%FI+QwD9=2+fBnNZ<;7LwQ??)c)0}N4)-u3M
zejSnrXwN7v^PP6m5fE<3`JV4~KkMghM+;}}%RFle@cD;43aq9dS-hKYCABKn^=9r$
zoISTBWSIg+mukeE7AMh^S2np3B$IlN9T=^dWE$^4W5`EqzUFq0K{9j7;HqK)%im}}
zP){NRTB^EUg{@MElmGfOiab*Hcb6oMK12rkqx<#K8{|t!lYAfygK;^%tO^}ZYuZq_
zyLxmin@-0lq=!%}h6}`f_vq?$Mekot_O-Bv=%r#4FuIBMp$V^XEs_dA&D3aFYwDjF
zf70bEe`?{~sy|ipDhA81et^cJmw-u%f>acm!dO%QCLHAtE&JYgGwK`rWpyk%TntwX
zls^xAfEMWz{>-YQW=GD}-}qw9fmcjPbT=gm-n7I3k8nyyDI+k*aPKrrzT9m6N=JV>
z$|#@lz$+|bi&e@uL~fy`GGG7L84YO2K+dW+Ecoht$#6xlt=&(W^L;T#P(nF<=^)p5
z7bKIQizqpm>201~j(${HdN5HXsgW&d@fTQr+5Q)om|^#)A&n*tl=Rg&OMSftw`4jL
zL{oKM@Jp^a;h+t#dFZ=S%)Tf|4IE`Lo;0XYslG!up{O|F>)e#Y=f84u3=Ume!<p<G
z`FN$YzW^>cS5H|LhL{x@XOosj9s6D4(LuH&;gr&8#OtF?A%F{!!eZI6wGqx%QRLCs
z{=+@$b9I}38;V-HTRw1*X#OWo5(XA9BD=-up{UA^yQ4i<M!&?($@`=I-IlA26#hrs
zPYDuEc29I#EWAQIhgND<yaC>obEm6<tlp<Ww|xLeP%MDWN*Mb-TcG6j7rLkDNE{=c
zTE!8{5v4ROZJpXGElkXc#01Zap`}*Jte&hbZBQ8C;G+W_*IocG8^rCht&E2uS2W!l
z@OAm`<@Wn6M7URP(+ykC+`C$P45@0DMQr$TSN1Ab@%7l#Gq)H_Rk!||6)a4yj}#2Q
z<L{Ws%Fe#{x`DJD(Yhjry<IW=J+|Y5prRzm2rTJ`bw(cQJG}c%L4IVAE0I8~)S$s6
z`OJjt!6kia9oa@;`A~9WE<qNX>&?ddJ9Tv@rGKSs#r3~!X|f9Nvc3aGLBhr~3T{<V
zEyLbC0_vsjarDMZ3U6WnX8VrODpT8YRfumIy8E5yO`%z6&cT+aOUVMGV8$z`$kNTy
z^=v!4d*0|fUk}8l9D#nX|00Anr2c3a%X2gR%kDq<vQR+zlE*ZmS5HeY+o|X0#`AKc
zkVXwt#3}D!d}-Z;pz!<aCY`UpxW+oDxE;;>+A$0LO`-;2$(SE=5b}f#UB=Ui{|vP!
zhA#YWaU3B|p27NJdB7^Ehm!jCDn+%pCJ=Pg&UjZrn^%2%O!plQLGtbE7w%q2UaY$&
z`|oO9z0ul4AE)vjte<@uGGB}Ei8{1FxhR6_CNRvgmZu%{;`Kh5wwDgW4zKV`+rWR-
zWANJZWI+tapR6{z4FFs=GeNsnJ2Se?V(UZ0pZzLmj^dfIq3KIzGiJboUmsbXgFuSR
zs39lM=37RnV@eR48;($Qbf?XFkW!NstDVoN&>^6`>8aU@8fnuuK8yItgL%{-&F8~S
zj%2N+ZU5GazBQihGH>SP#k;p<t_e0o4k~ICRA#r|>AhD7;}s%mQ`qvAyg|euBj>u#
zR&S?Z81#LI8#EEq+`(Bp*L4>$mYFJ6eOP>EGWIP|c=H#0$R5l@*$Gg-9cTAX2&Mhg
zj12iEReIe63t&u&9|j*KjOmA0co2DLLz=SSpJE^Wqfp7cw{2S##feqcj%=&$vtM~;
z%tWyEPx$Qx=Xfn87J;HPf3#abWiPh;arxnvLmHN2I?Dbi2O^<}2vqhRN)k|-RgE_z
z@)fBQ+gJG(pd~A|;A?MQuw2JDG5l=ccpbcK7Z~Y#<7-EFA%5z^4E2bL;=CvEoHB-E
z=lm3pmcfiw5M2!!QqsM%5l;Lj0fmJQE?b0vHouR%)5P6efWk?oQ%e)M-6&-2lf*yz
z(lTyl?G4F%?I1R;D;ds|51%92oB1H|RtMiS=qXlxS2fEW71jJ>bL?mU?D@>gp~>FD
zwixr!XkwfHh=2J8Kv+sd!cG@fQJiajrU^fOR55owsp9SJtbqF6G1bsw%!bTV=u4%y
zPrEI@3ZqF~g;OP%A>Mu8@8pQk{cOFY@W}{=2p_oviCd5TFY-Jb0~$oZ*dYwmc5h#~
ztkc{{%o>0dZa*jsDgoG48T89LnP~+<#vmEZEfmz!9SUMctLCXW==v1;_iqV!nFP3S
z<Kou#4=!2gLHr<vp^}5`H>GTbmGL3(Ab5sHGFFHul-p~vk~>1>51uNiETZd*Y3m~#
zkDo~$9|R!ivSK(oxiTBEgY-rq6RfRI1x>=p|Ns0=DHcF?a6zbheH|ogax%b`>jg4X
zmA0eRV&GYps5t+nDmd})H@OHsA%EVa2<qu}A&Gx0s9tv;w|qzlMECo4@M_$H3IFnZ
zlW$=1YaHzl-~IZfwD78f$&#-5*AGLEi3Dd`XJo2-Tc+cJwF5h5ecT$sc-w?%;e9p1
zccNdb5HO-$a@ZEIIXoF#l~N+o?RHJh#xuj5s;6=uq%!KZ-aX58-^G8cy7`podVSlr
z6R>G$V{BO4P~hn7QhOs713(L3aJ3|NZ46wKY6Aw_E?rNH>J9qzccK_0PHyRXzrsp4
z%aM*7FeRJ67W%rO!}W{qdC%@95D$FFEnIHvn1+P+E$^FKuHB~9PUCz7eW#?FDP{yI
z|N4{<JCA}(IIwZ^UJZo#-hVlo8ws2MUT&yCm4OuID6u}eay(BFfC*7eU;`bYy<Y%G
z`O21lPkkwt#b;+w=m+HUdE(CawPY2Zoi*K)5OkD|h$dl$(dQ8Vlq4V6b-}Nwm>k-7
z>Mu~q4UwPkMSj}(N@1<hT3c(_tZtDR2k-oxmsb&`&-T5>@d`0P;!R25x&GwHNv&@t
ze^0c%PmG%&GS~YIi)a}&n=OXlk-PbZ<LEGKLPydZ*0ErEXzw>F-<|OXJF-XY7ST1D
zh!Yv{GgW`qyH#mL{}vP{RjxQGbd-cKqktT;`aO+?>@A6JU%%u;(9lGrno3XoTi0e-
zIHo9tHB(SRlCH<$=r5b~!G7e?H78rjS8=jb$thcB3(g4J(@k3@Sx_=A`15x+x=%aY
zDM%^rKtipwQ)Zdik9GathJ&uC;aK8f8|qeBlD;7m;{&8h4rP9dAh=+1?=San9Y>Rb
zn>*h1=xirAu*!e9#xScqYRy1wVKR5@U&S9lp%OfJiP^$OH3{B?w>=w=lsemfm!`=|
zoL>v(cw8egf$vG8i$@`#VT?^w$~)?aNOsufc2SO5#E`$L#0@?lisFya%pwemC$jIF
z7&&FfUq#d(WZ4Dg_l6L}U#apG<65aJr^GOw?E9%dY6YhtjQ#qIU9_^V)KOv@UJ*h3
zMXt0<JdfEN6Ke`JH|+Ah@TjKY|E1>qfJ@P4Z_C$XfGw>`y01wwazJnMsV&)omQP>s
z{eE)Jtcp|u>;-3BWUOU$yX6`D_<i#N0{%a~tdmNN0b7kfTx|Lh`<6m+ejV(H)wu5>
zZ`q;%f2+t;I-A~>(tg;T*q!cC#{}IZ5iY31uq0?O1q4e|TZ@hy;0yG7xC?Bc2~ya(
zv7Eo`<n0cQfujGi0&153^27xaC;8b^ju~l1KP2b8P%iy`(2sqyCKmNC{LW7esfNA|
z5Br)*_RZAlmAAD<ECa1yK3SL#rr2Y4c=eaamsKYsaK+Jo-+Nq|UC&t|2?UFKX~eyb
zi0LtPV99`A+U=B-sAsHWHm%vprIq=PlJDLr24`mNH8AxA9JZTgv|zh*Pq9UPY}N^1
z;UxA<>w~bTG&Fu5>A%h!yZYWXD7m4Gto8%1Xj?X6#DMR&*{PxLkcrU46No;SXW4Tq
zf*@optzjl7JyI>uKh1N?*5_XD9pI)Z4At!{&hpQ{m6!7Hub~49eN)BD(5<M00ZOVd
zl=x;ymGAFv`fV(ctxO6)b0S*`O>@0k6(lzMzT9nKhN7*rD6!o5b>`lDni=W3wk$lS
zyrse2`U6x2UHV}<P4}_3vlGvf+eT_v5)lQaN6K0?oqCs&oTf$p!WgfGw4N8curE-q
z!jFPZ8$N)Q6Gg5WbOOB#&)?n8d1=rJ5>}~n8`cs}ZIf@Q)*l~MXcT#zZo?qjSLbvH
zF&l$oT!kIhlw8Sxm0gyCC~M?bGZwyiD*=P;Z&v9U;1?#bT0pvKU3p^c1O5G(DU}Kf
zTq*;I!kiXvxeTsL78rS3r$RId?|&Yqsiif7XjZaYkKziCwcytenAm5(s&;nNzacHa
z>Lb681;}>%A^5qzyUOSE{W>Xb@x!5j*a5`Usl`Kgy|zqA2(PZ1;xpa{?!1nM_yM>t
z)s{4DabShr(SPQ}*knjeyxJ@Gy7*)1edlm)%Qc#>sRd-yHl+NL<S<{vW?bf7;Lgg(
z>876?lQrYg?V#IBG5svJPRPTR(D~03Qi+2E9L#)v>@K-OKG+<C?Jg^Mc9ZJ%xLbFJ
zJlEA4jM?>a=rj?XDuYzH9WC1(Bj3(*=LHZC*11hn(O^STnZnn&T<lL24VXF*=UuKs
znw%Hg`A(=AsaA`i<xWou&jqw2-2&4ahLKmUIXluSZ6^ZWV-VE|yRWPK-p+<LJtM^z
z!vRQ_YnGjG*L6-)n!vYdA<>0RbB}#IQu{ca?I=2x>b1tOfObrXA@h#IP?^%kM>fA=
zsqaJI#`*S|26}1PGg;Y>Xq8+z8J4y3%g?Cc9MsM}Xznx@(t-ioJidL+0ezc`!Uh$;
z8qrB9GRmy;Ff4hLcOqPa5zB!&X(CtKSnAbiW~)UGnTBwy)`$*Uv1lA3Z=*<X|4!7$
zoAnczB`vpQ8=I!WWJI|%_IXh12eH0;EM|%3a%+yX_TAe}40t3hHlUsJ*D^klHE?<Z
z2T}R=2Edha$LK%j6|ut-2_rEqe%sK7_$N>arA=^YQ5#Fsvqh!K_M^b7HoFR{nyFpA
zl`j67szi<ep6E|j^E@DKUVxJq_gpxBP)ZNW>!+Q3R{Yie5v>SeA*$d<Apx;uNr4#L
zl9wSf{ce@v6`#m)w46u~IueJdOBu&qhgm^_*3qiysi`s|_xHUMeDA{%=m@^E+2ZmY
zV=<`B8!4NwzB8QY&HiVh#4-H6uvr86vd5JxWIE?By4xn2AeIbjscxe(sNGTSl`>uZ
z&)5?;9Hc=(>D-*p{AZWNtt3G~&L`iq<K0LV(vy4+{slzan4+g$_Ag!sqI?~naA9S^
znH{6z*!4)>^7t`Pg|tJ5dUND%1XkCpk;+j@PG)`c3Xg+F4)tosT!WP7mLo0;$(1LP
z!($`d9QdNaeiJk>eYeGvmU~F+&1QOd(HXXJ_Oc|u!kVfXeiQ(wjhI+gepb&}40ygD
z$<FvIlpEja7>C-0H+!{gvH`XHMD1q{{mPQZ`UZtuH1CK0`E|g{rt)FQHa<k>gEEVD
z30}<<eb*82!4DRX7NC~Dobx27i&#Z(s=_-?@*b?vfE|tT{1bwIaG8gkmt<n(_2xPF
z;x24c3703g15??z$vty#$K6`OO}wl0$4;x+8*IPC90%BYX30vBfYtXl($27tjtfMt
zin+QT^j`Eikwe3_wha{i1rsV$2GFmYjo;`fIbRsd@`#MlBL@>pu{A_DJ8w095dlQC
zQuRaMwMvLAtz^p##37E&_tz^4M7Cd$cJ~S!9OfZ(TwTxpbF1*ItkL=If2nKJ<(iS~
zPQp9vR&8rSAIz#3Yi@vLArBsm^3E3005xk5o4c`@4gba?<8g7Ftv1f~?9CC#wBA<w
zY(XVQZZ~`Q|7c1)c4#%sG`P4v=x>MN>`Cl`B0Wb+W;my<;B#tyeIdgNxPJUdFHEzB
zxpp)2&Ra{==mU4Pf<VyF<NCe{4+G}G?Z)~Z_Pd6EO5{@kz|$pybSs0%yGwk~Iw!?B
zPOY8iph0bKApBhlg8KwsX31ByAFY~F{uG!?*|LS%Fxf#SZ~fG;#27g27mnS6Lv7kh
z>K!9>Tyx%35^FJ_eC;@g98<)Ouq!8aP%y!$ie0~aD}^KRGn?Og10d}|wu&O=7@ePr
zT_~XspjE77<y48IMHy&k)T&gA1y%Q!%XUI_YbbT5*Ra%kb20%ia+LO&$YO)54Ls$?
zc8Nap{Dzp6)0F`@%40KT$1gcYrJe@HHlq}J;a#ViDn;&Y^a~T;3uC=TA+@1lL8!Lr
zV%O@AZYdSgd-`;L->LtD49;MLCTY4F6U?Y}I!$cWR(yxod2}(=lSr^*k0SeMJF#!+
zV1LNdn~!(4J()L!xD=51<ggwKmxshWmS+<Ke1r%49cEj$lXy=r4!)^eB>A0Uha^)}
z{8rVepHL4}fcrPSEd2gJd*6Ae;BRrYDSlLuO(O0@8j9&pG|?Bz{u{oDfZo(*oV*$7
zVT5z5#$$U4#%2o7#|EEz)q9xC9BK26*k&v;v|*_Y^pv;i6hl6v#mqEGCat8TlXmka
z$8&!5&80Pk#pI6`16etCH($47xy7Jqh^rpfDL3pDc{N${|47j}(wVY|-`Fe~&m3{r
zcgEmnHqR>i6SuN8WA~a!TX;}LNA-TQ;*Co;OYjhJvJx>Y(rxDzE5YRW=s&;Ufj6)2
z;003*OuK}1+X?^e2<l`=4$#pLseFN#PE-UIrFHW67>1cAWdrOJ(BYNlgi$L~I%3r7
zZ;emqaq^C_TN6=jfFe`gpX&4NaR0bAyPpfcrekt}ovIKMUx~NuAZmv`tC~fXj@HdE
zE4wDDRc1N(uwcHq-_yseu3^e;PnvFy%Ka(EBC3<^?Utb`W}-<AtWC2-t+9LoLicA;
z<<qbORH)cGsBCsWm5KRl&og=a;{l?yQreqGd0_(=6-(kU2#!DDn&5@}u`x7u+;O76
z2z#R0z3IcVyqu2CV%m}Y$#lA;w#iRyua0Nk2?%#AlaJ$Vmr!T}f?lAW*E<cZRzhqp
zrMlmDZyXo{8*SSDL9fbMdc_XcjPYbLCW5IYHIzBiXx(noQ$0qJC)43c)WgGCR<dwA
z8mTtd<>!0@42zukQ2=!}qE?8>;zoSc;(0tWA0%EI7|PsGA7{QP){?bA+{L_8wngB^
z>Er`_Z{A$%i}AoKUJL8Mzf5wudixt@RdDL->o#3L^9Phg$hGgqw5^vGOK{;Af-SOV
z-J<89Zp7EK>l5$G$cs@|@@`>rxw7mHj%)g{b;TKjn+6Htg!v0BzU0#1Ti6HKAqf{m
zLJfiO?{fig`-;A5DR`%zmpl$UZIkbMNUkRtP*QKG*l&Gc{o>gQKXGqDPlgDDD@Ug4
zr`~eQwc1^fZ`_yEYmx}LyIEtmO^GaulXLA|E{d%E2Ieoa*HiNQUo~_bX%+52>H@Fl
zhrP|R2F<Ufn0!6<_WCr;7~9_JQtH;Zn?Elk87VqTeZ=uEW_7fjnGDX#ezm``)(7iE
zJ(s?oXSN4@eU5T+1NWQ`Oui{t5n2>A_BT;%G;xKSfmyvTxF?V69e&zD1#Ast<Ht4F
z@($(epXKmcmYzEqU7@(dAcZ|fw83<)yf}1lI%a^yx#DNS61~CICyg(ndQ4C6J?p=k
zGh|x_Jw8?YFNus8Re<XH_Si3O4)j%Z%9-6$js<u6VNuJkyNN+fD`>a}6>^UhRk<m=
zz}kxDV|Q9MMu{$bT{Tv6C*NNc!bc%6HZimR+*L>XN6!@e?^k!i?c9&PqzX(ZHOq2c
zXVaE)1keu=BjJ{lLN|arQm6sI>OJPW!?Z&~Jk3OM{u1|T<K)J-2Ab;n417F?d=9S<
z(}L*nU9gGYarILOo<&XN9h!DZ-uB>Y1Yjd%0N_1I&*WhJ*S0mHDhX#@$X6cH-)AkD
zC<|&agO3(ND97kN@DxrDSUB-p7j8edB;!c#QvWtKa=;;NZRQT{E2(_X^C|jYIB_(b
zq(8=)>J6YAKAVkPIm7%r4c{OEksun=E%2PjdgWHD7bc55Y+y_EnItwBx&IQ}g@56Y
zOF>k>*9_pmEf`;{{9Zb5dEP1bPo_9;ZJNP*V&|V<{Pt>}z}#SJ?q{`|)_C`qF+%S;
zadsbvf`#;`SYg!%<-S#^%gL$QdaxR3x3XsT8GmSCN~swL(w>Sgjg<5E7WqF<cD<;i
z(c4r$eYhj+BDTp0dE%Vyxv>(Z!_(z>6qdFlrfe?(MUU!5NYjPh&z7u2yYkO#fq^K^
zeUgjJSwB8}>cBRgKPEfe?&p`icuP(A(zYf4aAH&0w1qnTM&q}^JaED~L?)EY>*)Se
zAUpA1>dL)uU8jyPLsb!V9C#3ONy{hkmF*p+Ufw`0g^`djU;=7wj{>d`IzTU-Q2pQB
zskT8XnK5c&<XoZPhv`%zeOvUz3q(OQ>jtxk{*QsDS=&I`?j~`$ePdjtA7}w(lS+Q@
z#CKhl@Fz_e;EF{JI|Z_ol_JM;`pm$p&o4+{+Wu_;GR3UMW+i2n6(y%{5ZrkpJOZ5!
z!L&`vx87VB)6rL^Z1?W;K}JT)<_priJX;__UX{V8!jHM}MInIlAM&^SXIlTy)-6vD
zDYiW<L)kMW-#GnGX98o)#Ir^dr`f?MD0;f|fp?d`D-<xkJqn5s+yp&YQL=EW9x|?8
z(H|^X(ghYN2m!$V<2aEFGGeQvF=l)hmkLdrF23O!ZfDjF@bL{vBh(c9Oo-P8qvJ8)
zK!q>W^Lg*fuv#RKtN1U73jr;c^5ab%pQ`#2dL}n`19V+9TAi)$;8twu+SmM#e1S?6
zD<1uZlM%1#%n{i*Dsqsa!_3vOMLutH+Pg6&<l>x5C=ce$l)6LOXOfgvH0k7IKyTYO
zy*(~vJc;P5KE<S&aYZO-xo@qvZ;81hAS+Xk$NGHwUxme04x$m2&rE?&7v|QO%DBK^
zQ}LYvSZ*~v0OPYk>usSCY8BVPi{|o7Jz{fA1OyRG9{Z7Gm!*=^<_&niQ>VLqJ2ilf
zQcP;`w3qS;)fB{vsPn(Q$+B|1R#K8^`C9+tP)9MHh)R0*?q9ZICaUG3pB#q~Lhz8#
zY@O}cZ#Wjc=n{Kv$RV55dUMx#EbU4AkJB!i*Qgshpx}XBGgN(ogQ(HT4?h|)-iIgu
zxO_`AbzGGp?!N3)$_<4o>ahf$wkv-**hsMfvdCrVX|tvC9Ola`hMOgdxKNIqNR~3=
zSn-_D@+@Z<=>2L;kQnjgi>h2!7Pm7yF?D0SbY<L+FUkfv{%PwTUS$<oX=^UlTdP?p
zuTg}3vM}dCto3$*-QYddf@X_{fFf7X^@o@?;%FXmIm_x)S_u>|=Bhm%R*<7ntwQAt
zUg2nXWOj*z7<-Cz`rh?<@AN-c<lLV;(kWDK)!V46;%8xdo5~1T5}xX&@WtiEpd0qs
zJ9cG0l;vy9LXK7_m5r6WZttLH0xzF$*OQhxU8z0KZf5p;8oib#BtFg*dgex}WciPz
zYYwaQefo>Ad8^IZc(QHVo4MJxzu7$5ZfnD4n<sa&ZQJ#pe((R!HP?O5%rm-YKI8Kd
z{iLu;v9(>Bb~N1I-aVtr#o*dHMUW~ww?+WwcZA$xmm}Vl$<ed|7|7FLV*9FjI@16U
z6r2mPo8QBA(B`+~V3=FQ9G6r|84qqS(SRn6@ghVUCN|8kqP!cI1Rd3e6Ppu6?)Kd{
zmhx&VJXs}SY}5Y0(88(>)}_Vck5QiO-#oyRu`RjEOq$2?N|7JXJ4=14<yslPiY;pU
zLnCE-mxq@zsras7v<6py{*gBN;JUTVgNId!Myx!Zm!r+F(odjD6qsV=^)q`B0dWk=
zEG0J#LTuPcEO*m3zATdV+Y>+N#7zn6BJ41WJGns9Jtvc!uFAyKg;TSv2ka(uk3`f1
zT(ggy!989N=yLg5{oS0$*rIN&I}8A-?NW_+NV^v*<#{@w7oXr3TqSxZ`m)_Am7u@k
zx*gNVwnJwuNgwZE;Ex>~;}L2b4Fil)2TsK~{^D4i#i9R*T|&UH)w{^ng;9L_mV7Yv
z3D_ye{u`+mWPAO`Av=D0fyZX1D<E;vJFV?^GYMo|8J})8=|4=oQqlm*Vr;v_acL27
zzqz32x(_thLgsN0>~4c<gvlW!3jV8jYMets{vPB~o<WOO1mbfl=Gu&xFBXR~{6TOV
zK+(N(P-$wBYFvO%9Ik}fCX6PdiVz27T)XTTmvl4XP4H7X+-KFb-_8PUaVd+s6gB&)
z?0=czCn`-rU@JdniToNCVo!ibNZ2`^dF7pR)h2RtXmg*12|f>@QSg?=-eh0j`k1xs
zood7`7m~t}JU+ZOSe#d(V+YEbu9RtlTB2?0o|YU^$$=Dy1W{Je)18lu)lz6bxiyu`
z+a8qT1Gx}(MFLqr#Y3hT`*Y*XGBt!V_ZcY?6ZH$2%(wCjz9>W(g%EH(IGAYW;#xQL
zy3sVch2=9@Quu#TF)FxQ4emL{Mp=D~q5wtvFQ2Zia$|&TEDXtk0^-rEBt-9q+!G{l
zyru=YYCk0ylg1Feg35sS)nQm-K-L)iIz%1Oa*<DkeNgq#3YC93U20E}fq$BEg*R!;
zJ!)X(5^)|3)U_8q@g0m#;MtoU5B>!S5@{hB(I-WcJ3Ee}+PAR38<r>HTN_b~Q&%5M
z|Ih&8Io9Y^3eV+rU#KqMSd)@IL?j3*q9%2iRcC+vy*Yxz41Gk&Qsi6ZMGt1Yx%Lh$
z*8n63JPV86Vb@AxxWThYb@**%j%hs$By&P`wM^<r78V#d-BBPMb^wANqN>o;xKKoq
zWG*=CZyO0q+GUHRKIg|T!T%{m|J&0>voSwc!+$d2x?KO7v8XvHq!{rGtMMqt3@~pF
zwc7k*@P`XUd-j_Keij~7<k5$MCLdjDgu~L939l%J0cckb%gWiAdz70mN2kbFy&n5&
zWf73DcnvB^|J!I>(g_&TFpEsRk9kr@Iqq_^<A^OPcBM9~wr<93g-tPp36+@S_}9q!
zc;Up$0v2FBbwo}7uJ^(Kr4C-vPwxC%nb9@R`C*5q5x<ll-G_zzL`1dCU>g(z<OV7D
z!FY)_P!+eTsY379|46>A#F!b4&-Btbn89;dIxsK&K^IxmDJhqbApB3qK2Bs9c;cL+
zqrA7|E*30>hWZf&5&fL{w^xfWM{oB8WDei)v--5H_7u}FZksv$MYr^iN86Zp4lXh|
zaM?Oyx^g$p4zTO#=>5cjbydIX+m^~p999_NEjfB<^XY*>Fcf;eqZJYn)CSZG0p+uF
z#1&g=+f#Gdx9Auw&@f7!VkxmSqkVQk@nC@-kz-GSqZPQQdRxIxE0;W-@m=Q!n14Y7
z`WGS}e*AMWEQ^b8)r=G#ZsHBTW6Es42ZEgLOBRkgSH8|4`;m=PvH&zkV_AdT85i_o
z2{}@u3T=C5{=vfxalB~|a_<I^Ml|++>=N9d^BcHpK_wI%f;SXLlFr$CT&I^R3>jS9
zfqhGK>fLGT6V@Y;<CwLA%h;uwmV*q*P~~ExdN}H=E6uFzP_tz3BrDr}q|Sf~1<1At
z-(q=Fq{OwAO>hQl>9YE{La_{s65&`pxP|i}A-r5BBDj-!p*jk?e);fmpNUATlXjTb
zNElU7s$)#;H$Pt6353#d*jzmUg_9|0)_-}W>S7Vj`5%@5RmHRqcN&ZtJ$}59T#aL8
zTpvo>2`*iEGr3J1{S6Ky49d1$koytyRx60Mz)R_WmDVoUdg~$&g`*wv`%>=G7iaA;
zow#XsD$9E@yjWNYX?%I7=(FQa8_BAieiqi)oFObPaH%j+b+g<L20uvoi68-%Gt_Bl
zXG!7ezg~bV`^ktior0Hq++KNb_=b~<a)K^lZ+I2^#6MH2)mDyhx%Y7_;?dkI$WzWc
zgWQ!Atg_mvGM5T8@}j{X;pN-^g3S_6#NIZkl&BTPmMxV4Hd-8#ZB!S$UiZPj(s&it
zL>Zc?ii2!OkU!$(bHTkTr1ZqV?@i3x<e|T-bhZ+N4VQkUkLIJXW!PtsFx^UyAt-4l
z{W7ZH=1N=_IPV<uN2K=wwd>5Gr&?Daw9l!K(|>s3REm1x1za6Mi8sS1y-E@i7UJtD
ziHGh*w1L4y^d`7}D?3usEF}z574ZCygLf#X2lku(JK{q*Q(<!PqhxrOgonk;_}xm7
zi0K6(9Y2RY+M(&|9%*;#!|0;luTF1@QR~!JU<8!rVe>#nwK8=(zw6c^=79cgQ3Ji5
z8uX?&LE9Tvk@DBs=z5a!UV52I@Mv`zx5fO2-O`^Xn+NIy0&ia$o=J945F!NZOC(mX
zc85x9gid7?SpTdKJJ&WplJ<&b{b2LbOmQOiK}eeN@IKu076ty2rO5fK{oz|nzOOYQ
zT@epWh4-aImYagv<)BbqI-4K&h7N6P`FMV)Tgib&t4m78+EA#zigw_ukjWhu=o*}m
zsnjM;%`5F;(WaT#H??eKFnsU}Y7D$1|8?wdH*9K5eRi%dg0iX@!fHgV0kvsF(`xR1
z53blRgw@LMgeVl9T|<=sXVyn78gf^18Po7sn<ft0Qnn!PrFbdgGH*x~?H=_FmbQ;$
z@c&<tYuk`zWiig*he~Km>)m^ILLbM2pA0F0zl~D!r?p-m@z*1^uS+}md2&DBiV=AF
z@|*BhdUpo<`RrnKI-F${&y)%jRYocFGwcDhs#36gmaIAs7B6`XN=eQ8U+xW2Q#cPi
zo!MFp^+0Z)-NtL%FVG`-q?_bSJS5P<`}kIhr3`sJ5!1fJ!pU8F_kFsGBr;T7#|02U
z7K-cBozZ@M<Ca#6src@gpEJ6cUA}co@E}Ox9zc<_J??I)rIB`N9Dhty5R;$tmbC*C
z-E#P^BUyGPHa9ez$W57zZ^tH^ko&A)cptt5@C~)Hl~XXt7O}G^=LUAcyogoP!Xt>n
zV=uS-mLbpKk)C*qH^#kYPXXrb^ONS4G0EkZVVm@w!A!lf?*s&9YHo+oV_r=%K*yRc
zTBH635$}BZ32iI$pFw}ASI%%=gYS0&yUPZw=&pz+pVN8MB-=h2RQaR_eg12@K6Jpw
zVEnJ;_#YqJA|0Ce@fxm7Rfq3B2-X~J6xPjl5I7Fb4!<_qIZq5v0HB9+5bp%<-=+5-
zC}FM>N2fEMlrDk(_#<9G`Zz+`@B3E!QvtIwlKVKddzbnOHlpIjG&J1+7YzC~=b7aq
z8m@~necTGkofbcqS73PGbnaj|e{r8EZr4M(;YgU>Gz+y-X5MoYWuEVEid~e3MtVz3
zM%-9S<SbF?ow6g6SZH*;^;9<eX(C6C9rP!P?t4j8;r`$`zfr^S9^ZBMB+&nemLRfn
zG3612DeY2KR-quxBf>^-`Tg{Dj6H(N{f*JiW5k`&0=EIxoAH%cvWO~dYXK^3=LIpT
z?}`uI1MCy)z11wjIx;ax`uEq*m8lQOK}%Yao*d9{$Khk9=3Ba^oKwF!I`YdW$#f1z
zv8DE6zM|bqr(esuE4O_i^NcSAeYM;wjCqaqx7{~PGH+ai?X2`+t}NK)0T@?NC{Um=
zY_K}Hk|uw>6!GKq=e%57ESNy%Waje7f5i~iq>?-PGn_qd%KKO!)|n|`MDK}X!g(%x
z%(icn%n+_I7zVi4&6QlO>Y4VtC4&$<@0!{PnYGb@^_PsWW(DI6GqTmknfbX$J`Nn&
z4pp*4*A__F`5xbJ>W%sE<WxBd`HVsTuF<vydK(?=)1UijH(Zso9f@$v>YF@4<hxI-
z^)EUzX5%Zz%?6N<pibS1lhB)qhRHSOsH@BJ5Bzl5iMHMX6ISBo`PZ3>s92~^0#bGM
z9MeJGuAiVB+A+BIRecoQbZIxZ4(oBD#zo>jwCxMc?ApH;-A5!;E6vnZdHMVh{O(I)
zP;?}bYIGiZ$Uye|(%*`2X6@xQ;1r)<yk)G_F5Wnl1la;ph0Q**RhwUx_4aJJ?ZSsW
z#%%>Zv>!&^bK}sV-SaAsV2lqAs7j=MUhCwDX4=Tu&3MEjyV{qLD|OKoa%0IO6!zH~
z99{XyDLF<!0!ZpoF+P4sHTMM^;zN}>Fq8I~zg*vsQHR#A>66JLgOe=BjFwiz`*?C0
zN0O2ahz|?+!}yxwB)(CZbHHII_3(%!XuC9hCK42fFLhe*c_#5-YOy^N%&VY$5Mc||
ztW5eWH<wAkci7yU!q}YT$~HmSBCAO~o)Gtd7ZM?O2n#571xRPhlC5>e*vZN&rWhmN
zvD7Xjh~+SU+XMv;D&=4(80u}CQ@|;!H&)ika7a|e3`M%kP5zU$NSHtxYfNK;dIKj?
ztW*z}NuN)6!&49K4t52`fAARQpeHi$d(1y3#qg<8K$Z5`PEQ@Fp$@7`qCqmJIp0rL
zRTKT>0;OUKAC-d$g7{pi(^9yrw#w@nonMW8UwmtSqdl{jZ-wWIzDDZ^SU=t!DMOUY
z?mxmgnrGBu5P6#0nN(F}W^`!~JZ`QfaIUdoN^_1<%kPqkL;F2un)0+_;kRVrUlcq|
z915c9JPL&zf?Ox<5%zPKPtVZ^W6f{kEVUa-HfM_e6JMNpdk6-~($8cgQ&+Esqa8AI
z#9u<kF9kRZDL*Tm`*HzXRQn-bm+1|~hkJ8SAO@OAvXWR!iXH#-90wboPgJ<!HO{<n
zcNxCA-{Zlt9-As3RN-kOs=qD-#Q<hyZ>9`<PSG3|<muLxrAUfT@z;leRy{&di=l0g
zD~>e|GBu{i9a^SmYhUc(X=V>hKSv2-Dnr>99k;?V9hD6H)(&_=Rf}fmDmLN(Z5|0b
zt%r(k30(kNe46+}-yY}4ut*Vo2*zylDZxGtzX)7wZOE6u(M`LD(^)J$d7@3*9yDxM
zoK?P#mlQ~mJ>oB`${r2yW@W8ilHn4@I?3z~YYL6TBE#aG|Ic3iF4G|RZZ1LKKd#na
za7d(Q7m23;K3}q_J`SK4ZLBrygcFGaMy|+0Ux^xJxG=sk@=1?+7f7MbxI2kNSb4Fc
zkM5n-Ka+;5U&95<mE;i)cgaFjEE|Te00DZ=UOnZZ#D9Ls+f(Ouy!5L|;;*8b;%?mQ
z)tKA!`*Kt@#dfz<O0?OumyCgo4f6EzX?D`CunM4qjO<Z+I0w#aMBuESSc~J-r5=|a
z-O>ov=^2C*Q9lv`HT=s0TZ9v~oVwZ<=@`l;;u_f%Nr5EnW3GSa7EXF3aO5Y4q>{^1
zOgVh9im};z>dl9^q^I^mEfQ#IdyQL7xB`7suV~<h58Y#+FK@>?K*%&cvhNTv;?IQ?
zJblS9ZzRPcT67>FO*Gf>EJjFSjcz&A+|LEsZZ*JxC;?o0&N`DAyq{a-%AL@~*`g$4
zCU=_Xovixhmf~FoF9ICdNr9x7jaFWp6g>$aj%%=50$7YZ@*iM!x_FEFVd1;tJ)U~+
zSV=UqAT$!(XiCK~8iE>6^zE#-0hQ^QrCz~T=`IfQ1cd`5miw>-V8qJfY%yWgO6X><
zDAUMK59WAx{J+>SQ)J&JEi>hyK|rqc;i4u!0s;&dp_F)~W@9AOgx~x~EMsHp-aT}T
zPtMYY`~@QOSKH26uDc>Qotr8ZUV$$3nzFrs<mEw$m=s$q!mNQ0eHdBDmm0#-A3AOG
zbT`X>j;h0&MCXotB;Mfn^r^NaiJlyj%g2*fiP^Ka3GMpxd5Hi#23N#uFK!#sdh8+{
z;_X)ly1G@VNfjbRrCb6UDIexQlwp7unK(Ab&v#keVtkX+%{l*`4BuZqBv{UpJlK)u
zf)037P^4#?V5}lQ{7B`U?=>66LRrxehaT|6Q<srjr44@@I)ZE3yv-^tIY+N$_Z>Dr
z=q2152;pmI?`JsH2*bwkP#=}vmnc~%wA%)#Jf`XJKW&CY;r$N+ea33ro~#l@xazop
zygyUmV;g&ZR`yuzUxShzYcUbBnai$r3~8h}r3A7xFkfl+B_YcD2Hmq}IDpZI`aKL6
zCH(87prWPrKAl(q|42w05NcD6qzI<mLflJ+)Bd+x#<HN%n5?1(slGCfWH-GoXmO>b
zp!Z9K8_Q^c#jjUJP0Dv?Rf(qWZ-)Q9PygY$4nPa<6gC#{l0*FJJN3jTfJXg`{p>Bf
zqdU$Phz_=P$IS_;gCgNSGdIx8Hew|iU!E+aNQdRmC_G9XUvp8G4^x)+8(&Gugxi7i
z`$ybxB<Osw!SB;DY1{@u(gEz*7l?b5T>O=-7vp)1$z#Z+4j{Hx=j+$IYfyzb)b6Rd
zar&WkhG?k(tnBvSG#~Q!Gzue+)kg~~t5ROFynx|Dzb9w;<L;7yFn}cU!3za*aJFHx
zVn=WP6zd85U7wJw*r?pzwDqD@)*CifiB<K~h|Vc{O<=M87+MAsX?h*F;B{C`&r*_>
z#BfkIlWf6ioAb>=$j953rTBv$mmK%M_*LgG@Tk}_VmH5SUFh6eLL&Kny{frQsIkn_
z&t4^S*hP1&f@D>YV=VH#1X*>58Bmwu=AVYTz`aa=#uDvFD<RGKIZxCdzX5?wp`kp`
z(0KdN^cNS|9r43deB8boMc>-LtkVKE?MRyC47>En62W-&*axX4rHE@*dJ}tC)(jA$
z#p?YYd^Jf)-r**hKVEfb9E#r}{ImeXnMDpz=s=mHu5!Wf9ya()^_+Em^^c{<=>F+Y
zyOL}^>b>j|)TVc$$YWSGrGqQQaHQEjwZ9<3!U-_MJa+E3FGS#Uys^+0zr{J1CnJ<l
zM`C6W3Cc|D6JX^;zgDzr-%SbKO%DW2$uk|$!l|A+C@_LO_&vP}YCXm@Yb?+6a`BWZ
zT^|^eU!p0PQdwZj^CTM;bAGR}#X9-Fe#C=fbvAADtW-ImUsU<uc|oBX_JCn>9|^|=
zwmkyxMAJll(woqSY^^nQ*A>M5l=0oh;-=_!c)QHH<NrqWaqXq+DnAz%YpLHVVx4!U
ze;6lqe@ipi+n>lkREJ77CmH%uc{{hVt;<T<)2PrlC$UGu+s7*B&Lp&??=bf*@}sG$
zSA7!#CPltw1k!y!1Du70bbDe|AKKo^wG24u2$7|8ZgYnBMRw_Z>s>nQzN}6oyEYaQ
z84C6SclLUsZ5}G_SC}o*X4!_&VXpZ@XKK&1e^<VdwJrJ<+%bqIB}_26VV{=O$rX^B
zc%zas72EcH1BnIvYUxh7PErq=KWB@Bfi9tHIhZpCtWIyx;67_3yl06LBFukmsbw_<
zNA1A9?fLd)^sheAL6kyc=m|)wVw9|gMODDOO|7<osBJPdzZ$RmzH3bGg!r)1*jEs^
zd~_A~hi|hn((i$sXEMj6tzd)D_E6ZuEa>310^NdGzLvP}$=lk-2{QDH4^tWI4)fIO
z*8cM!W;B(?|D32G`syXX=@&Xld`vz&R!%Yi@19KM*9ed-d??vF0`RwMm5|md@^4G{
zuU|pzit~HtbTpk=wFLwTGT22ic9$|#AF7Nila3F~rU7r!(X_DE<H(zoczX*&$Ij)v
zjGKUqwr}c`uFp_P;bVt_Oz598?Pa_90P}iyvk_;lyDyEJ*dY6q9NwBo4&ha-k>UAR
z0a`@?QxhI4IV{ZpDJSRXji%L|d)V!x#kfMJZxflr7;&eA&&m3<vHIn~+1!ERjQbUH
z2A&CD@P|E_w@;yvllN@?7BWRIM4%viEod6jgL8O|J|RMy>AXZMF|(3EFs*$c9iW`!
zH(ecLhlRd+A;~m)*a0lBL%A*fIK{cp9qYkSy4jgflKvcnc@K~&iWKL+1&UBD!5dx=
z>eKK;LNA@DNoZHD{JKVB&2OBqd6|f5FZ_0X_?+my-XG8T$sK_NK5>^2r_UwHv`H_=
z+-iXZN(RKw0fg`(t~6Siu^7XroOeM_&E<a``lFR;AG_{+epFkV91gL)GAV%3D!4ML
zz7kNthUd<NrF`X&T$lV1*S^pT$}2Vl|Nmb26AHM|SSf$r8N9uFaj4u=OCjEA)X6*V
ziYPSF#dV2rAD6w}E;UrN(cbN0bT^z{IQ8a4JsFDm>$|$QzO5XGA00xblS|%I-|L-D
zZclx@vNF>CwCR;(KGYvqA)EXI`#3{q#k=rf&3oUA+I><VWWn?jm~dr{p<$)WhLfO-
zSObfaT#{p_i|8o9u>9oTi?IK)!}ptrk4WHvanl0u*>ja6UsFr9RN^HG5D&o3j8~|n
z_v10(dc_e(f5)?D)_W;l|7p-*nEdITb-opK>LbOwR?HdS3yu%!0bmmCISm2-TpmSU
zy^M@JNTx8#yxOb}S5|!|MzBKED4$Zd&GVCJ|E4^&igWZ_g=1e^noGO6R{Nb}on^DO
z)Q_~cINKY_FNXYbKke^(g}Fxcjg3GM_KXiIDFCucjUYgQ>4-Q{k+Y4BiAE~5QzPN1
z^%Vn2uVc`*+|moHd;TH)tD9+?*u^y7sCh1r5Y9r|n~gwtUF-gq1}2c<#f^0MkBsRj
zo+ifAXb-fX{F2PmCLK@Ian?F;il2~FLn#=n{=NCd0|D`Dy3&xHtx>i?8H!LQ*rM}t
zRlNe6GKecJAYiACoLXUiW*DTm6D|fOgA`xE6@|J7cxC-n;40pi)r)V{+iw>%C43xZ
z@+Y#DwOK$KIOZcHgwtuy&Oo_*PI}K&n4KAIWFXu5ppU2ky}!T)7pQPe>qa=fw}QXu
z%7Ek!H|AmGg$HIw&BDv&e00sB@RHZO#CQv~75E}YTQab&E!6BKw73?$1Cnr{MciIf
z@Wy%TenG%9zz-Qvag7hHyN9!YnLK;--@|tLDFIrA8<tQqBU=`tY?A=~D_+|bX7oL&
zdc}9HzQZd7P`aTeUbIMMZn64P0;UDHFa~>4t>0fPIgy(jGJ+Ml;ukli_=v*?roBBM
zq>h-fG2-iCcpt~z$OpJX)N7Z&%eM#B%EcVfZDk1hpV-NT2h_AR2(N!{-|cRf&i4K>
z*z?;U;er3eraf;tiH(tSM4=R?%WTJ4FyrV85h?6&dv?O4+%D{J(m-Ru=nK!d%r9N#
z+9V3{{#veS)tmPm#i7Y$tcRFXRgs$vTj70}u9Q&suwM%N{ze8-FDKz82D~B4mfIf6
zQt<+;+rdCq7vAE1q<&Pd8;!L+DLhSv6zLc`{o$Zc#j7_Rz3=F|XXh0e{}S7MCj@Z?
zLo1J8<4?+a8rhB=Ot&<!uULx<u0jp64au=bfYgMCbo-CjF1&Ift$WI(9vjbs@opm*
zi3$=JT!2aRv1r~fp$B>9J)KaL??vI-mmIP3nhi&Bg_80dGju1ZypM=6!3M&fphN*U
zQlzQlp`6jRn4c8oyv?nQtW-aV0kGc{bmqp2m^qZavFDVDFt`&A{c3`?(elLW#;G(B
z6K#q=fn8nBwTmPQmHoahA*zL!7G-CK8yP&zgd+OBW2gTU=>^h{)~YT!7IPC&DV;O_
zW{Rmh(beU=!>)<uW^WA-EA`f~K=Tbh6*PTUN0^7XpGki*p<ydttqiPU@wl?UM<6W@
zD=N6kXi|Vt)0a~Cc^}?XPW+9uHP=NoS6TXWCEXT2J=Cdcd(bE5G4g2Q`9}H}ZJ+Fl
zk*s(A*8pkuK@<9(wJ_JR9#D{~d{;s|8<Csj8G5X{nlW8v$$0pD^R3;PjR_Z~x<xVj
zQds9(-O%8t(Dp9jM8hn81qgm10U?%q-gVtb97@qKoB4%!;CXOFp-<Mc4wIC+3HRV7
zN8o9pO7HLeqWiA26%cUR;ibf#Iqgc@y|<}Ogh~(HhnU(dEFw2<IkUjpEc(9;dSTM+
za^jedS6<h4dtL&tNyv+WC=}%58g+OU4D8c}0bg=axELYoL$Oq%N)>l7hI>hNCfuM*
z<VFO5rSO`djd+ZXPl_vRTZ&u^`R8C9Q)=MAoy}gHJ3KzMcR+pw0)@Vx#j~sKf8jC-
z^mgt?g9Pj4<K!E<SY$qdl#}b*Qa@S})1=dhJ+1)mj@nT3ylJwJNGoQr)1vA-xPE9i
zWpN~tVquocIAoct9Ie&<&{xKvyZ6gF<nY8pYNaj8(^t*R;IHx=vEdW(n&Gmc5gfBq
zmnfCaIN2Vo2|j7GnmYl2fE<ylo%24klmDc`mR>{kFwY7~h)#u^@WVJ|!%mi)YZ`?X
z;f;NqW;vM2$`=q+278p@+jUi+yI;~pOCNy~+lZE#f0XbtowVXU$8eBy7SmIoo`ED=
zpWU`tjDR%oTw#LyTk8)g#T!4U5`t7>(*$|bG-3*iN2b>J7URNLTD=Hp7nsbGA*f^}
z*?<7if^re&WJ>Z+fd<If!woa3uJ=ZqnBoHtYJnEB2pGf_ixrPP@)w^Kq=DH}iv$Yk
zw)M_n#+lyq)mO=Q+qEJlfVAiq`QjQut&$b`A;+!Z#%s4OVClw<r%7nwe?Mg!Rvk9y
zDGH(GE(rSvQ-{oWnTo#7Z5dLkvUehGw|GcY`;ccVoicisfm96fpkV57moU&t>o?~^
z6{-O@6)(e>7<e576oA+Z<LpPn-(S$y7ZzDs-RyJoE_TYLNeHp0s?!d2lLFevHD9Cv
zC*Q>3(GDm7Ij1xlGYkX`;rVc(#N62wxJ_?!>J^Q#nX`!=fzlv1oTH<M!T9aE-)HWc
zVTkV`BL68kQvFvd=?MjsZEtGK@15+Zc`vaAYx1Nf!*`Ojar*N;i)i#&Wddl2Ty=5U
zKZREIbb=6Rc2zUhpbTjJ{sJyG?&rJA9Qk?)?d`9jK-#*(V9hxw6FYfrfkJGfhND)@
zlNId~<#4agtB#n$3v@r@)>-1EdBHpqbDZoSCWX-IgV3s4sxfWclv+K~Y70EskE|2b
zWPmh8x27bsbdc5`@-NW;I~|l%L(kS;>I!yZ@_DSlr0C-4*pMZ9!_Du>a1XN1$>x2e
zjR}tT@th9`UshCRE#==oSZ)M5Ya7%0j<09L;{6cYUjEeD5}$c;+@0>;w<eMCR=^5J
zw^BItlz%vYnD4Buqzvz&I%NB5Ph-rmYVKa*=STse_{>iWovc^3mYPELA7XD|QuBIg
zdc#1A-JCQ!Q+!#bD^&A|X<^VJYy(@O2$)!J+;TJKM-I9i|1{gs-CuMexMa7B8s$xZ
z%6DR#;?-BO4~k)Q&_MdbbpKjQvcZD0h+S>xk&9MDNbh>wi{!r^P?qNC+GurV;uXOq
zfkt)_q8%|csb>j$Si_RmQ`a@YT@Zc0EJQZ~Ai9Bmo%C~}A~}Xp;p!71_2J%A;k6p8
z>-mxPPdt69xVvVH)?YQ5Cztk!w%W|l=#V$LxVkHjOsJghQEC{rRYL|!uIOyy9_G_C
z347Wovopah!c;#pnS@sV5xhJr1_Zgo%uS73ddb!$(P3L{&f8?eGjLJfF+83e=dO1$
zg#%j&=#(|t?N3J?(rk<5`;P1jS8{(&DOR>SN>700y5lsA=e~7@%9cC5*__4*-n1nb
z2|Vo@do>P#9LQMO0OK~sve<j1)o(F})=4sV-`9f=*EK@G8Y1BNv!G8d`-KaCWDC|#
z+AvBn)BMiu_qPg*8dBSgYoS(&VWLJj;Z+s;3e#>$9`sDAggweOhRj4~`Dx%QTsoOk
z&SKS!BoKG4>%Njlr`>oyh2wUoRzpRpI9&(*2sV+mgH!ZwQfQd@m0@iis}){^ggyyq
z!=bk&NG-!UW%()xPJW4(V?psXVV0BT%~?=*nvxpt=oG#9{87(;htsI_8UhaRQTcs$
z>qxUBjiw2<Z*@%IF<o%AerWlJ1X<v;ht?xQjL+6d8yfsKWT}X8Z5KLsg!FD#jxSA;
z79n2%neYZbMp-{}8%d#~bEF3oJ4S`-l(e9iQ={&FNNMs;u3$16eiaxFguU}D@Pl(E
z7Cc{26GgPkSPwdzdHQnhmkp^Xmm^jx8)u(10ZdBh6WndLPu#?C8T(|$Y~{M^U|8z}
z&ox%_F6<Wcl<!9z&`0`51H{`VA2n#wR1~R~Ydcfm*dQ5|1`cHYINQ3-JrliRmRqYw
zggD{;ukN4ebO*lyr#iJpvZubfT=^e=CPD&_va5uC{rRT?YT#-tO)3X%o7P#^nCU5!
zRDW;FtjpM`%P;||<VUy4Uf$rfrXETe5X#aC@14@pX{;g^nz*9YX~x%7N<P|^FtsC*
zx#d3uSXOIx*2&^_TO+=RDm001-EROZezPu0)XVyjY1J4PlUl%+A~%+Fq(3_6|I1Pr
z7JL4qh=1LzoxXFRY?OST3BL|QDLEO|)}n{Lr5HWkXaAN0;mT+iz_@=Z*fA1dG{`cR
z{{}l{6wXmTioMHptvFTu%y`eSHVrTb`|b}lAQQx%yCi!cl@vj$E*&wgi~iYQEiSH=
zlL4|X#9u)ntVB$#3})ZI=QlJCVU6D;cQGC8v)?9={u<L;vrEbMgGY_X{IcX5?aU+p
zky1E0OkZL?MWXIEwZx6Uk<m@2uFfNkRc+>r_;NdjlF)I;n7W=V9cN}vx6Xln>sNj!
zSEpx-q;)yJ{3uxnt&sX3jIa<i?k*C_Z+vMUIC%?|#RJDzWRh*|gzI1t>cuwycQ+K0
zoj7LJs3wA=L%PWJE$~g6W59b5(L1r;OY!4fq|srb5K(~^fh}Wz0~}&#?<62SuGF@$
zcO1PlCN7V*__?I1A;p`F;NgfHP_Gc`{2N$v4nj44qnMhrb4XgILJIoGZDAdbH|@US
zwXKub%6LTrY?|gWchIrXn^SbcFD)CFgU(x*l{$;t!kDpnQkby1`lMfNu>8=@$Ax2&
zhi4$!<3w(}4Y*zD-U25fdsDoQ&Skk;VZK)nG{+OZV=B2Ah(ORv$8(T{gr^J@c@G&I
z(zNzzMoo-EwqT!-f{0=+fE^cIK^Kr=SC<iW;$i|Wye!XQjy0#CSFkQz|NTx-Bz1~M
zJ1FVz0&uy+NuOb*xele%+tH5JXV*1;gH))W_}@_G{DXl1d!w!_hfF$$^}YLDQ8tXY
zx<0XP@<++EIC=V$G3K|l?Okhb^2P+}=}44y##OOg0XS>8A_h5Qudk&f-t733#asFH
zMaD--i`vR8$AJ_Z3<!nWL$z5i`&%X(JUEY>*Z+A32~-nWq3`HjVL*T$(`*TBU24Aa
z#G${;LVxjZmwY<F=o6lBcoQVlYqK5)Xc?YyUkd_I2FaeeIsv&*V3M;q)x_gdZ`mME
z9Bp52ncb03^OKgXSRE)JU{)KIpUs2bvBL+3+A^p1*^t7{;wy7$NFr<o;o5krgmQM9
ziqqAfQa)ce6Sbkm1WOM(;a=VJ!fhV3cpP>h>WB(P5<@r$QIXhJ#{S-7Q96Q!3&#_J
zGYhBDM`#=brU9yddF-MUyHA`exSH&%`zdLdhg_v*rqIE|ptbHXaTHQNrvDGKB9`;U
zjadI)pjs#C?BVW!ZY&2I;{*EP9Y*)BrUf%wUAO*5eE(m6>4Is3z{`K9x$tw2GVN63
z1BTrMcTjS|;t`mYp@xG*+SfAheuVkN3VRZI^m?U}IwUWUo3RV_{`gK>SMt&)XMQI2
zp2%&CLDomcYf)p1PxLt}OJDl;-dOU^(2jZ)xr&L)S27h6_1n;I)3HB;E6*gtUAflJ
zp-Rv*c-8tK6Z3;iGXeJUb9Kb}2fb7%Wki7rc_=J=%59lQdagv$e_F0ZBV%+dTLzHe
z_Kkh0n&4mLUh~Ml8CU;xi!Z4UlY0viYl*!;bg#Lw{<t3=V`6|TErCI(4si(okZoL{
zthB-<z@*Y7B0!u(-6Rx{r;24f+e92WS}?xZl<um7d>s}AHPz6GoT2n`kgA6jdYA}^
zRP^`&Cg8ogo>l%LDwk34=fw03RJ$uBXF;6ZMiyoCLZP&pT<3mKG`lKp^qV!dQd$0Z
zk^$`p`B37!b6e&zaiN4?*6$oMS@8RRkokn)3{PjA=b6?WNhm7gO)t4~fpCAn?{Rk;
z!_6bi{_Jbja;v2$w9oxgB19~DvYRhT-D&GxYkk9|*5rhc&HI5I-9RFcNMPwO4$7-!
zc0IY=(YzvCgaD8_NtR^Pg5Gtjf5<7~JEuvX;`0*>8&`&;zloW~1=+Wa1PW~Oa2A6;
z&Or0T#aOB5K-o8X67oJ8AHUFP+%N2s5UX6{SeRW*P8u^?sYy*VA111Dcr(vKpztR=
zbs0^<F8k#NS&$Je-F?#RYbxOOUF-n@C4qGC{8_hsOJgBz@ia$ysu&H4%KeIVRGWH>
z3dSrjV_%;h-y_YtDT<VYEt+|Hu<P8v*gb{Dt9Bq`r$7gXxk~az0RpIW6Ayu1fGij7
zT7-6>P;=9*3-jc;u@ywl-IhXLMazhg`G>DK@6>xx)btNrAoF-w6kk<3um7h26glL=
zxC8Ug3hbDnQ|Of}u4#e~L9+VtoF|kSK6~l~-K@v%E^g37BmquFuDnZ6gDoh4jsu?%
zXl>!Urpfg5TD#ou?qqsqmE7E%38|YsMwAzVbSK~F6_SxcNG5o{yZ=z%pK|k{GBS))
zHqvL<$_(59v6Mjh1IA90btLjg^VGOkeHcS)0=VH)&0)2ih1$=A9d0j_E%W!d)eqf<
zVk6{@srF_RjXw>`AweKa*f+T;gdjM+`Q~(tGyee=g)Huxtvo1n=OVIg#8ur?GU8Gv
z-ZMcUjN9~Uw4)!3T$XE{Mn0rmpA_kTyo+HSJ%8iF`NkVtV{pph$oxE62(H?aq9ZqG
znQ~VsrZ#6OHN`y7xd5-@x|ug@s>rVmb{7lO)lg)j{9+;M^U#581{NF3Uwima0<4(k
z%uIV^@RPmxxUPdspjP3DrC8H}*nTiSy5=INs4WS<>M8Q!lxhq%d!Bnp{V82ttx;zR
zDKYD`M*wn$u%4d4To$+WASX()zlh{QOI!;1#K;o{XZ(u$Si+O44%4EdX=-e5JbgBb
zLC$NENMLYLP2?0o{s#_BL+*tDNkfIB<1nH-YgGhbbG4vknM41tdjfJWQQZ5=KJhxP
z+^zbPl>8hWTN8`;9h~8STZ^Ga3dPF2b_hpXN*+Y@N|c}x<23oto+^HNK;IX-LTg<W
zmep7*C0~0RxuTOB&hi6Zo=7uP`KZYK;(xFddsKMDwG!T`u5C#@Q^B|LK!mI3Bc$C^
zm_<X$D$QHMYf;t5uJZX9_x32KQ%A^@)vcIxvTCxTIgxF;saT`2_r6nSaYbu^z$MbZ
zi=MOp523&^(1aWitt-x}X`>~G^PjEjdTb+}yZ#gIHTUm-?;EMK+SgBfVDFwu?fys)
zz0sB}snxtc2i8~)nSvW!KMGZcL7GR#i|?%yK#3Fp-(#6R__qI#siqQ9g<!7&2SbY=
z*P3gi$+OLfK8;@8_XTAoOMsKH{s*FrLhnty+7AQ)SB`ikd-*&UD|=qelhb^ugDr8|
z^yn0*#Z`C1YVT8lWJkVX6wd@IiFHYJrx=yy-HsWAUY*uESE$x0rC9WD)*+~=R{BgZ
zz*4?3k?h2dwo3BUeJO!o66I2<W;VHwMER(ZtA~6$Kk&_*q#GKo_=4=GlfhzEHQ6uX
zhF4RGfa(di9S9s@Mjjy(hQ}|*%U1NYP0)yFJl{JtS%r<=XXO7B9-b1v$8dgbL1@R4
z<N$o8Fot)9Uj4q{CEex|ru`Ih;09{BXxOmvDX-O9SoQDn<pO1x(OJtT0hivCJkSpP
zZq$!OGcONLrMTjvuhab&SU8EBoyp+eWHCpCoyM%ixtWQt07X^_wiu7iFoBQ<whp21
zs$&I(EF<$c3exm#u4*6fn6BNLSxY)@o=rC;&8ECk6Fg7_e*c&-w2&OkRy@U-?EwUy
z%o3)x3rl}*F{yvd9p5SG3H)V-nwScZU@oL=5WxH0%(e5)d}8wpM-NaV^!5ub_FBri
zH|YoTdyrPVTxuvvO3iky<ln<9W8CXP<Y|n5))ES>rPG~@^6ac%U(F1>ya*HSE1UL1
zs9&8ZS3FTQ{o^kSsYgmTqg7NRmn8HQe_n7>7i-$ENv2PifGHImXH<<z9v8#7rV{`a
z{*Cm);yCmHbYs-)FH+g4Qex6rd9wtRbFh^hbDAz9?^g9OPk7G3DL2PE2yrPuy1uSr
zegxJJKuug##D1`kX;%TQnR~V@o5J3IVcW#FmX7nH;kPqZHAy#WBH9T|O7=j>r<<~e
z<W}W1dm>yEDf#bXn;`*!i^G|pYx9}O|FxAf{}j;<8xvl8K)v#K|A=d*DYLAS`S=9}
z9bjOs;j?E#Gc*_G>GNT<5e;35=A5q7xNFws%zW!P&>eDB6B<QLRd`T+f)`g~z;N^L
zi0%|4_Y0imsa|vWSRg2C_Ya^OuZyhNRo8l^>^fuO380uAqZPX7O9_g*l%O$F&b}f-
zLKcEYx`se}Ja@exfVL!{;+L>g!g$AfeudIL3qcDNDakJ)w=#_eYgrzO;o^~@<eehH
z4ZkQyi6F1^QWaY|g&Hn76sF6<eH<Bl@L{@?lfNAIfd^3w=4_uCj;gX77E9iVJJ^tV
ze{p9gvmtWgiK0G-jcx1jfsE|}{aO1jf+o9~Q7nZ{_s8{3n|3bYsO7&b;%sYPP?%(-
z#;RwF-rFELmonZAneEi&e15b*&_%eb{N{@}cG)U{N%x<2?t>Ydu6pV-ko6H&W*$z4
zoZECLK==cdNj(ndSo}b3!Eh9qi2>rJazxvNK~EqNXif=a%4ami)H2!q{aKnfA=90}
z++Q=96nn62t*Y90yKa0I1%Ce|cIsc%rLmt4LALB{#w6r)t}Bl6bC+oH1}bnCaD3mT
z6SgUbK@k#yc2DUNDbXDh<&>dvo}A`nLgx8(^{v0>uq&)Lni^cM>%sl49ahIYgEA9L
zWplZ1yqccE6nJ3E&Yzy>9}u1Yc~J?q6MP2lzS}ox*Z8zC)L2^6qy0KkNCZrj)3P8a
z<(iRwzTO|r6K=1$2o5k3@o`rg<!!=nlC)oJRO^&V{CS6b4S&=-nB1sd^ub1i)TB?z
z5*V08#R^)=@f5JtvI!fZ1yIgzL6OnB6j|xlI_~RsikpHsEo4?V>e@3X@K$bq2)y^S
z&)e|BuD0A~KUXpXZ<ZEH27&$c56e85jrNxIF)AOn#Pv7P$*vMPo=fj4X98sBJ*`JV
z&lb5tO&FPN(t>-ebKeI2_KX$R=+-%m!rF3c<h`z-`w)q|svtbDHi;L1Y4rGt_ef=C
zNPG37d&m0#;x`5U(T!$WEkTw8E%Bo!kmEg3=2wKM3zhr*Yo?>_C8wa<BO_O2ahL<K
zCbAc%&$4bj`j8}cR#tf^V<Tk9%b(%eZSmkqR2Avzb!0^6RUYrMIz4$HK)m`13>UVG
z+Y(6W7Io;9Dcd+0I-9mJK+-9DCok32LblJ!(!7;e0w|!0fhonMe^EHP?w}?4qBk6a
zDUvF**1TWQIpduynt0;+4dU7s5GQwZfR`*sd9FFCg0+FjyodQ*HPAr|@v_l9Xkme7
z9dVo-JI1jsucrFH8;BySqN_W=K<^m#ouRrRD>aHvwoEkred<j6hF*dyZLho`$WjE?
zfZA8Jc>GP&dw<q^6*~h$F|UGq_k?UyWF;P}U+tM`OldTWJfL%)5wUp^o3_hi<mF-0
zZH*E5NB*5);4g>S?tE_57<`U!8pWG3bUMNhT@nReCtKbIX4c}5P~$zz<60NEOUUhz
zWE5>lsU@%Yr+6VF9cg7!F_68`$UWI&jg;r&C>BTiaZG?~z0A{Zv$Ie>w!u{7@|)N@
zH?JH%{W%g!z6g*3bKzw>(@{O%SSN8{ki!KJZ%EZpl!C-!d91x))B$NactffYidciB
zoYQqS{rCmWQ{vmg29{+WGj1QQ3|Wlz_%QEuC~)jeP=z$x8JV4by*dH_M>PR@cW0at
zncFZ3Vm!d!D!y*zzTKn8f5)9I+Tv@#bDX5#zq7)CBxw)4vG1RZJD7qYX>8VNO(8X6
zuy$$9__M$z)er+QWy^AQMm@c$r?r@KL>2IR&;GQ<a>Es*nQe{eZhanIwuo@CVPd~_
zB<IR!(=Jj^Z2t;wS;g!1tkwps0eA1bRMfso-{3ozy(PQcskWZ=gkKv2LU3ge)SrFZ
zStS0ZH7Rc$4(Tl;itFzM4pf6{%B*3Xt~NF&WKFzvA-k#FP5VBf09i{?SCBiJosTOE
zfp(Vbt$rXHOX=*%&cicdkI2?n=Kp}-Z)&h*e~FYwolF@Ft1s3+tEB=@C(N&t5agHA
zVD;mi&53ZgThC+CQ1p68&IoaH{5>q)OLXZs)1E>eHV7eoj|#$*R{2V%6b5fTFw`zF
zr%`fTRHTbAEdY_898+D7l$QFO{}K!g+LUuT*)RGs+n|Rf^qvUAOH2*C+iy%){Updt
z5aP}8>W}{chz|gI_q@2N-lVzA>7ZPGae3Dut^%d)Zi!Kv<|f(RPdzARFtM(SPhO0G
z2jSh%l!IY`R^%bRk=T2#=HS#|69dR$GFmQL&{Y;`zv}Px0(+#$1v$DHDjLKE2%caz
ziVJQFYky6Q4qBR>GH4_^6@zzFUHd1S2&kF|<?5^_I9B?tNAE^H$qP@mE-h<hc&+Bd
zv$D7HHLX@;m6qrxm}@5ytePl?bN}E35SGfJWGzNMkNw_7k{{0|wd-}FYo&BuCa?e`
zvJiF1Aa!|jK(*&1RC#$yp>NOr#M`6!q7)VYN7aJ^v_*yf_G2DLFeLtVUrTY3i#Cp#
zfk#q6gav70vcya^!(DNn@D<Y^BAx8?+a9Np$jdgvubTT=w}00b-~=sx@P@>%Be%w~
zUd5*3I$Q7Ea17qJ)k?>^5bUnp6qs#YY^GD+j+5j_y-N$4IV$BCKz&^3Xqsqb=Gm3o
z8K1~GOO7j!X~E>nC7@s<ES1@@<~B^kWl(;cC75LSaWFu}26%PvEGB4sy+!N8dUkU2
z3{9?kAOz=y7O<u=(#qszPgo?|pI1j8+^=oCMHGpuIp~JHZLokYwWxSoT*TOx224oz
zxU`;N4x*<M%V}^giuAatKRCp`kp%{S&k4$Pn-TW4oNLlaq;ZI|z3AmpUrq)2alBPH
zBwU$(W0`4qXie|-{bjN~Kf2ql&&6WCdfA{dC`&VE8|ZU2kicbc4><^`$7*s&qj#3f
z7mg>!>6#?cdrr;KQ_Sp1T`h{oKrxP}4ika46N5AZz#*ua?1tyrvtk?9^cx?g&mXkR
zpxpT%ZD*?TXj)td{o=f^Kll_p(HaD`HWccw@Oe3F!@gNa?ON9j*SpPAT$$YSUjFJs
zEg7esu>71e>FiyiNn{?bH22kqjGhO)BuIex%~Q-L<{`oTO*}#&NJo}n)>Ix2|2`AQ
z&(!WvqbCEr5dI--1eZ$tH$DJ>!ECt>z@FK$duPmXfH!k|)Ek?<w556h$l2GU9*y{I
zkU_OmYYX`#SP`<uID$1Egc1H7c2n`<1D1~l2WCv=A4SJv+>D3|fP>y@lIGyWAmEfM
zWIb2T3g!9wj@+Y3Z0dPPt{Vox0FyP^C?r457I#qm*<nno>^L`NYP6B2)F9IT%=nGB
zJXXj&GMj<i?P<tz$4_I)c5r{>V8WBJ;g<+1{@5qT@2IM&Vr@Bzm_8LA+QQ<o<K%Xc
z0IXwHTD1*`_gL-NSRmSRC`v4%+*g8t4q}SRBeP6e3_Kk&k1W>876(YbhC6LWO|$>}
z_Ef>ebvpqf;Funne|Lm^T(G{lw#ds58M{ypE&aA!pbU(q#KY2&j(0nDch9v(-e>S3
zAW!@3-Rerg2`99!o-$p_IkW(q%_fdP)_PG`g+iP;D$zMk6pO)D2zPjz69rmE3Q|s&
zmE>WjU`;kadftB9%RFiHH3tMhexU&C6Z+QG8d7<1DlILU<O00-CRxSUnxQcR>3_k1
zXc3j%n&G0JprXVP@XIYvMD6mc&hW*j&*t~#`g-L!ws>o5ub3V}-*3wP+{sNdvvbl=
z5dZp$g_?k+PD8Gf?y+O6S6dxS_Bw!^X(GjuFXFfi2;ZNWW0N=FT=LFS>Gxq<juY-c
z%d<w;k?IYD7^ujlv({C#pu}2IYf5!M%P>AN>ok~?OTPx(x~g@^`#V9wld!BU&wyP*
zAk)VDl9q9i_Kx2v=MAUjzbD9bVmM=VU2~X#J3Ye*XhJQ$n-}d1QQY-;?8Z`@Y2`*L
z@-4A_l)c6ae0vhtSn>ZQm$LeVai70Zl7}lFEbH#11eKBZcL9zd2cc2+8;fD|Fs0fd
zYCJE;$#0<hZ71(o1iy@V5(Q-GxnZQ_qZsMzGWOx=@GjnR;GVq-jY%Uftz-uzz)%E2
zjuL^*Vv9Wz*O5M!mnp(7dQD(u@>Z<2x5r6dJ4ScTE?@a$EwAp(m8PL$<<&P-iW=i&
z<oo%)?R{?y$Xf$33_OkUdG)Ku9z;ZaxHGxgKRk4zij+V$nkomK_IpP49oUY~nLrsw
z2men$&8EtX-trAe+JAeuz&}sP89%!2Ftjfg{=vNp_<8VbNVNPD;H{H+%MQ!QeljW%
z%DPv$CtAGgxo>H_aZ&o+@&J4ic|PLscfZI*V+4KOI^7K#UEga+cb_QV;RxXoav2*3
zcd)l<Wvi1J>AZC$E;30-5)FTSrlQuFL(P(vcgfKovul!c?&+4xlZq9O3&QR2W!=B8
z$qpiyBgqp-L6TiyUyPo;h9Q>F+;fZn^3s4Kq&(e)KW3vt<l!={Wq`Xw0awmrc^qos
zd(~RU{|xtBQ;z@j=T)_ARS*_P9CUHoCy;hXEZk#3Y?IyJ9j`pc_Hc5lB=6cqwK`j6
zE!iqH`I^tBaKI#zH~Pg)Z?<*w?vb1nR=vZpQZA{4M-PP4`5_xeDMD|pm_`o0L&N4w
zzuELiWQgT&#E2Hp?(9%1h#yPe{LKpBiZtIb-mfZdRY9O>p|=nkDQyzte%3tNs^<kK
zM4MGP{w++8laqV2hBOvwRE2t7!${9SY_|T;UX?n-&~G*t0JN_17fD`Or2btQtmWIj
z&j?a_jzhD55_iVRj4V*9U0gI1cc}ok^{vfBo;2*hb-J@k*qyKbU|dmev;f~+7r%O>
zsZC0o=Sik20yk|vsQ?t8Qj__s8<F9Zn_GL#EAnHQ-!0Q_>LI7C#YKJtsOReQPi}ww
zzv!CJu<$il?F#OALp*?Q5gzR#7>+3AYv1Dbs@i-DQ)=SBda|6p)8bNOb(njWN=;r>
zj&3IZd7??K^$UYe+JAXe@^`*<BSs89*P8~M0vHfp>s$C>0wxajmaq{^K2cR*l9?>h
zQlzNX-6EF)3fziPTB!aqv9!hfrMDY8O-^=x9k8_?)8&_MaJ;sYND;a$IwhUk7Mz?Y
zgyJ49;A<|Itx8Yw&U|nXm8VuGA=9RhZ)EbhZM>!O&_!F5U@MwavTa|r;GJGKU8+@I
zU!{`ISHh&(f~X(fB5jN;{HQV&fFcVwR`Z9PTkBRu=j+gUyRDS_!~**9wVvd3B^;a9
z*3eUuhTY$21<uFEh9{77?c}rc&(uNx+<7tL-pYu$<&@TWi(My|wIb!J(`GsrPCh^^
zGE@Q8qQjNs{8l-yzJL)u(eMgZhc(mS&OJKEAi-z=Rn&{rx2JGwbQ@-&1P{~wD-F3$
z)yN1=O=}R6*UI)<z5nNDXs=-+tbMLtNADn)Njc8PSMRY+pCO@Ej2GK)p884Hmhxr$
zJUCbBy$L>`QX%#PIyUCr!qYsK0%OLXV_AML{}yG#>pNCtb&`y}KUWU4N?s)iK>I>M
zB-(75c#z8dJZP^rZL^<P^0It&=}hhaSUL;0sGF~iD@Zre-AlK0NC+&kq;!aMN=bKj
zEzJ^A(j_6?v7~f&cXz$;{N8_HcE2+x=bH1mZ~gHOl$iW+v+lSA7Fn|9wPGt~t!+O>
zTx}io#bV@@zEnf1EIo8@8@Qt%sYXfs_0>L+E*-+BgTa&)R@>)E&h>_3(vov2wSuxH
zcz^`!3mH$P1)qQ~HAH(IKjY%f-ublpJCvd@6T+4gzhzveC8c(uQSP`3uePjVS4SvY
z)`l5s+<1Z~aXn_=LdJ4D>enuK`SZ1$yO6f8o0|-_pZ4}e*hv9Pbld8%7;p8&ROIJZ
z&j<vA?-mk}?8Td;Nt1uRqWM{+_^ALx?t{b47ErD)OPyKdOj1bYpaKkx0f<gQr_HeG
zi*#Kq^3`j)rPcb0Ogj9#NOU4du!k^G?ayM>CYOUlvb%^OLWldjro4p4-knd_bC@t8
zyW1E-D#4$_n^a?gXPN15+J9#hMyN%Q#Mnywh8eRn(!ri$pfS_oLVh=02bHDm-Dda$
zm3fyLbAxN25U8et&6PlMA(0Dye9(%nXq1cVVO>*f6K?V$(rdgJjE4zt;dfi_2QBGd
zqckX|E~`IQk(Wob>*Z{1OZzyP!TFD1I@Ub)92+*sws{RV9vJXJ1e#4B46+GrqE;Hi
zUL!p9R$>Pb(OnBcLx{O#d()x;wa%LHeceZpHf@LuH1B)Gx2?)`OENYM!RWTa5C{pX
z<64Fe(dY{b^gHC5w{0m6Qd3`u^yV0M)z1h^e4qZ)09tT3pg?sRihOwik5ZJ`Qb737
zc7PB63ZkPrNT(xgNkY~=TcS6nd{()h1Y&T@U)69~+P+Azb-Iy6iH@1w7b{PA`Vy;h
zyWAgK8fg6>T53eQ5gO$pyI153ITj5<Evu()V-xmn(LY1?#3S7oweOlaus-i=cy7Z*
z4muh8ZQSKKWx#C(5T}~`Ae>}S$1B8ebHTi-=>6$t?rK|}f#^4@d+qjRTi4A?`T^Sw
z$$iMPZR}287ooXI*0{+F4Vm}rD19Xc&6m$Vz!3S(Fr~#}4oYo#OOyEE=}>@T=5(}a
zqo)8qGed^f_!ye9q0HbjnNP=6Mw+!Ff>VO)`Z*iosMv9C1?kJTw~1}9(?MG!{>+~&
zsZaIY8%Z&l0LmEcA4fT<%kbE{%$8YE92W0EJL^g#W5amM8W)?b%`gTpHno{D%Zjnh
zUIoAB*$=}2TdCtmV^7}MujruJ5Rokk*s9`B{Ha6UwSgwFw0Hg9z0FT@dWZ-2SiD)>
zg}XGAK!~iT;0gqjU+&O5^1%4Ks^f7uZ3lR$EH`&xW=O`T;a^?#q%!(O->CCrHcm0!
z4(P~}Gxc$nXV)TSt7^`7M**RzYp@tNU@#-?E4XoPlzvWYStD=aFExu{Z6b4`jwGwc
z7ITBT4#cR^AAV4#85NM{nfj(dNBV={m(GD*bX*^rBK$lIvE=(N2bcXHmuk~pIz~7w
zq+F84WFkZZuWi8Tsm%|j4yzi7sdQ&{Ly4;HuT$3KgSKGszFZ3EhrGB(FR!?Sm~qt}
z^9Iij%XgF_4!?~|x1|OuK@qTb+WUW5FCJ;!wj;R5Sw8^VS_QK9Bx5iXN{(-b_c7%s
zNlo9gxt;d$Y-<uKdy{$3;jZqVwULTl;P*BUr658%hj$8`2~w>j<g~C<6QiOrRhK^k
z4;R|%FpkZNYh?VT0#I!)-uTwnh1r#drl2N{Mw1o#ws?QFYFSt8U+boDLCWXnHM=?N
z)X`*Ov$(s}KR{N>D1EO8?|(H+J}qLC)6RuqeJHwb$S~^<K;T#Jr%=SibUx^0@<zE4
zb&gABNF<S#Qi<wQzH*{|7FsZ{FUuwFSlI&TJxKTADE(?H<|yQ}kRtAknZCdH?c7lc
zg-vTJ4_kqD4L=7ew<mfEZ%Ip8!bmwa%Df!*8BBl$lTC1!xSRwh%@;nw;HED8iI9-b
zza><52!60ps*NX}zmlMv-mM_{SdS52NP>#Nx=%cKe^?14+y~n!<B=yLam#z+)43CR
z)O^BLICf;dDRyxlHB+9G#3=$}8`2onl)@GMzWtLAX$G2z)Kn*BkPl_ieXd7Pc(Ker
zYzL6v7<B89J9!e@Bm>i_)oIf+sveF@q@oZDu2L-L=dw8dVHX$NQIz|5W-$S+q|zI3
zFnt(Ia?oYXz{yEh{ejtY#x79qFHQMQC;GSV{@$jxt0pc1I{+Lss?PgQ3ayD?jL7h@
z%>C1<)vq}u+yc*N6My;lfdT_6q+}IuhecO;0w3Sa)->aQeVln(CWkmvhzpTIo!3{O
zW~EJs&v$rq7Y>KUzUQCVq+;4RiP>}{BIC}aR4kRZV^BuFtO%M4_6sQl=%cOLy_peG
zif3_dcLa5tY8#JZs-W?+nZC22$VTwI+!BvFZGi_WAXz4-RKO(Gw*G5GtFI%Mm*+67
z-+~CGtPggS=cTE#oL}me;oD~}WN%^Qr^GNfefs0x7^pF5n7Ydsv2Mqn$X4$yT6T_E
zlVl+sk&u8K>G(aSOOS0s<2I+cY~%C>zrrSyNNANnHA{vbS|qX4<AV6*Kc^KdNVY5#
z0~I96@K6Lxh$zH@_ZJ<A+&MUdT+8(C97hB=Uh(A1IU+v9Cl{V*qE~woxjWq{ne??5
zUcheb6Hg-9pxfZL@MPm#ru_70AcpFi?mkwJSUgM`<;UKPg!!HOAK?UH?uk)9Jq6}?
z5p1b>?S5z$z;Y$;<}nyx_9s9r;u$f7>ht9Mw6q@{CT|cRQf}atyLad}$>uU>s&&Bv
z<7=K40z>$Wk(FEaeDa5_Hl%=r@V=BV7YZjw6}&sc&ogSC+`T4|spc*(OD?Ap)g<9V
z8Ww#hu+UU@%B-OC##s@hoR&%5?bTn#Jrax9NC_f95n>E5kJuU8@m$6JDuI32xgs96
zEScJsO7?JRHtwleev{BFuef}&%IHW#DuXfCB>sYlLd#1NSDyd+u~C>8d2S_3sPat7
zU2_}he5U++H!y)19+B=?;?pf|YPn0HK(-Z{Yr5f_#c-$5G#9(Hrw!sBN}a>JV(+T2
zlZ{PEv+y|UUjY(}H-<%EA+}qsQSJy%g1&ZertBmM65c;etLF_gh43z&C^ur&zdn6n
zyzf`gIqN?pa(Hrtj!VZ1Hti;_1Yzg*P6fL7*It_U2`vy*D3dltS&=7qUo0Tx7ktH)
z>GF+XaAW6ICb-H$bCXTlN2uotS26m@=*O_7C`nV#X=ipeL$e`w;6T1dGWl<%S(u_c
z(=7{{lG~9Yl1<}B@yIC3W6$PZ2dbaXgGJ>z4K$+Yl@J`0c_<Rqg1WhV?==&-3%LQ_
z<1$%~DOIJDn_r$)bfdPeHI7@4jb{GFE4a-Nqnq;ERpTj2YWD<OO40OZYqT-uk){my
z5wG%*&tMfxb6O@A18GsvJXTGiJKu`Tjl>wgzCZm*V9Sh5%LVU^L7KVOX-h+gUF9n=
zyb?~uUIn}g!3U&2<wYjBP0<0OV802Y3K7ay-XZ?P&m(JY@r!<BUE#$s0mUT9wH1Hz
zZap9GI3ZcyGZk0<-e-OH44GI!?NIHI)p-l3?^QFo6t!86>Pmj84fGRl6d?oYkq6fM
zk0kLC2vB0=enJ@xMmN=FO^3!d3FeHFM*r%KuwP2=8fpF8<SnN$QzP+bG|<D^QP=h^
zU%t@$>5dZAl0Ae@D^mD*tI6Uxz$NKtV9JvC*X2OKlo;u*T%pn(%T{RW?>uM`*8rol
zHo>5(>4eh|oU*=RE_+7ePl9&`_m9rDuH%T_$!|H8qS1b}N&mQv0*)~`Dh%SJ=03az
z?o71>r^_WTeH#p<bqFKWmOrOLh`G&Qa?PPD5;ZcvTWtHy<d)}3mYQ`ys=WV#AQky`
z5cuppfkHGBm<>G_bCPZ-Q<I$h7U@9O%mi_9?KtcLDe162>F?tJ4236qIiGxJg*Z#t
zrooT3;|q(XYh!;6>0;f@A!Z2<HeB3W=2w{Zp_uxif08eiMsRqj)9`pi7o$?WwPEGs
zrCI?UPgeH$F+T@BI39u3-IZfNi2m8}FSg8&)7T(A+bAX)23+=>yi4*B!>eS~xA=&n
z`OyIEj-7mI{YfXW%ETdXaDjBE=dpPr2?LQx(~hoZ@!?5aoKJ&zFxMwIUF3QR0#Q$$
zMi~ivcvX4INX(|i=oAGPA-T!$I<zU#dxq^E_j2GHk<l#)qr@@>q0mcxHEjrbZkG($
z|5poRvxhv1@XfmhX=8^tP)qcO#-fag3qor{*mC5_t|2^<POzE94X&9!y|skh2A^Kx
z$orcq;sr8g#(t*s-Yx}k=)mqDCGDEnOs6TPkUrllaz7Mmt)E<@!JD+=@}4sT(`^S0
z)OuJB{G?~HgRAnKFp)8T*N0Go^j5WTBvhh$QV{yO)4wn+ezHf=wsK;`-xQHc%T$S)
z-O-&3`J_<%Prw^_a_%w-=<3+`?QnDX2zOC#MIr(F4*qlyV`H+Lrc6-!ChLfx_LW3_
zO?hrG6J$}nMof;lkGgf|8u0GCK=S$UOZwUJaGFkpWZ~-lPd`U*1Bzo(7t7|a<(TI6
zdd}zF>FpV}3PAa#K|_L~Xr(X*#G1~YH^h<%>NXJUBN3H#Bl)4ov3U(j$!~^;JBfzD
ze&eXf^`(<NqB}=I^!?(~+Vq)?I0;gwWDp<I;#kOOAieTu8BKd9qEyOG{&M&n<~Q4=
zLjG9#xV?LHBiVh=^=CAwKpgT*-PzGW<&tu%ev_MD19}TaFnPx>2Tw`7uwBdZwMXeC
z0;Sqh-8i7EWCSYgHj@#X@MMYb-)hfnY9Ohe^Nyc+p79?M;0SB-^B9N$d|rP;`+)1M
zO>A4z6)1~TU%`#X)B9rQ@Eklkw|M|_o^gNNE=r!Ldls(VGC!*&J^DxKJcsjJHIS)B
zPtBKZ6n_f)BIWFI(d32A(s83_PIDgoc4@A)^D)I8I40Jst9|@9E~F+3?^j8KO^3z}
zAv@)1@dV96V*LM-3dbIqe8bKhZL_h^iJOXgp31mQWKdi-bnUdAdXLu!8C50XaMH=q
z@Ai@L8~C#io1NNi7^)pv(#c3!Vtkfw1w#X!tbw&^fTG@7)SHU}3Z4+Sv(F4A{xY|O
zFpyik-fcPR#PHs+&ZNR_hz`jADl_DtH={DZ1>-viSmf#vg-<?Kg_yjL*&J!m@sjW{
zQ=d(x$Ee=~tpncBbr~rIkU$!5Y5+b^ur4CnoQol&Jc!<GK&NuEk^V~|f|GEB(cx1g
zo7(ckf}vlJ*fy|w8@&R7#lz{LdhJVd$r_n$i6s9lCAOK%o0sB)SH2YgR@U5r#o%nN
zy2DKxj5>iuQ#`MXDo4fd{kvGl^RH&~Hcn*7LVVuOdoBHmBn3Te&Iy%fgC=R5*BZy=
zqV88GmDR^mp7qY%AbNn9)?1~XCB$IA!c8i=11w_k@JT8`A}o)h2nn6h<Y3xP(x#xw
zB@dz|3F*jw9&;nr(4heYH%jO6#e@N%G=k0Ko>c?HTw7?0ji(Bzt#^%SV8Z|E%6Di^
zsjl%c<xx@m#}TUg!<UDeh5<$I+YJ3s@(i<*Q5>wpm{{~D^k=Ks3MqtoXbBag;x!Kb
zS=6(wYd_INP8@B3ncJ|48)wy2*fy|AvI9p7zTW-Q?}5WbZtH7U1*WwN9c(Y*Ovk#O
zUB@{`tp&wv84**;+oDkqcT<w~t3B?3I>oY0!@M0+nyT$T9OkGPgrQ<Tjm6O%HcvI{
z=lfY^J!t(AKI>KP`P+T{ZjeDnFSPpnRgcGr_xXKC9LMVm@FTs0kvv9B63VkDayN+;
zVxn%sr)O&ohmm9YoXRTZd#O8$0cBD6E55aFgo-To-xjXm{xK~lyaczsyEPNEcPd=W
zt0fv4NFA8ba8Fb0=pecG6&Sg0l6gQs5{Ph^oF;3ehkFUQ^J`sL`}o3m^kCbRT6EMa
zQ0)47QldkY32nVw*&*bV-n8G@^kZ1J;%f3dn6kO`a{TMVx`A{37#=@?4t4D*n=vd^
z02f7MEa!u|D?AxV|GFf$kyN(_WmLPEDfx_1(JSG_ImIVZh;WEzvG?cVjjQf?9y>#n
zfs|MlY^#mO;(xrLb`*`#XuzGY<kxyOg;;|MTc}Owt4L#5IgufyRn&U)C5}T+f6jRL
zi+G;o_qd{u!9bsP^_X&Q)iCpi7S#$7`!z5&GTdo<DBJB9f3qrcUpd7LGPp^nQQu&u
zJvvhV_Zts-mcRWqLGy`==)Syl3$YMuUO{v^u(Je?6t!Lg8o!0bZx*?*G~@}iWlaL^
zV}SR0udh_Q*Y`|R?w>{yFR|N0@G?r+26(qJ|8y-iD$x~R-$v`dvt+5a!^uE6c~1CL
z(DH>|nb?$R6<QoI<XyyQ{mW-*13yPKM^3Ads!38$ttu)wfUjFdDdQ>5b)4*Q8_wjs
zJ;9@^9cdiyua-Ua6Sc4Kgh;B45QgVnGorY?u}#84%kaGR1?dZ#E>%C+R7@cXW_QfN
zWZbc4W|KiFcPp(hz@alhUID?`#s&cvWxaSuI+JGj&{myEczNV=3I$X;s3u17`!<B7
zY_AVULk3s;u@6iG2!lQDhZbcu5pku}7$zfM(D2)tackKQ0xeo+TD`M3NUfN47<#mk
zgc?pcx;`wr?|LKN`tYbRW;|g052h8J>o4kRH=8rRuo*SjRCu$oi&3o&Ll$Vlq9UP~
zWTFGQHe(YWpg8f}@yr|Fas|<PUGK}=#TPFo#ghHCHv8R-n;<gDaP;~%9p&A#m~=Ra
zxPfH@8(_!9-gCV(0JIGS^Q8*Sb>&QUgY^5mo?mTl`y8Iy-~yKowG@5F+~9M>PEc4*
z(SV1_Y>ZgvyJiGwqs0GcTfWAINdC(L=sMowptNiWiM|j<iqN%=D-ndpA&sKsoYI{f
zH%CnK(~Lqm7_Z}K>33O)gHTI@;QN+rW+7pMFSsIF^RF-N`^1KfG<xG24tP_PC_ai%
z*U50!zc=7exPCU23&=vD<i{vi`z$9rVd0&5;dtzgCHrYx9iC(!DPo=jMsjqJ4tT$1
z1i0dO`%621kL#`~iXt=s8{>w(bdo=ko&cpN_C;Oi;VqghL#nN-n_04!QSSHLhc>WX
z%CK8V%pMJ=Qf9ZZYaqWg9aYD9c{IP%w;}MA)6E@w{-VpZ^TS)RUM73n(y|>{@SSpJ
z_255zY?^&eW5R3QA2Br~(`6Og>I6eS0r^2;Czi4w;YY!0$^M*IuTSw|LN&!RA+zna
z@9+!b-<uz~>jnQbNt49-i<pzjs4%38mC0=}wn~>{ln^p!LTgK_+lWvPi({R_m;O-9
zT8iu~BcMLA^MP`RQe5oB;uVylzX9Dvd(i_?{qBFThCxkD2`@VE-E)<3yJ+qXf^3FM
ze9nhF-daRE<r5;_1t(meiMg!KOndcj{>3Kq<<cutheSgmc0x$|yx0kE--yy)&#?(z
z*`jfXx2&byk#@x<j6AZHE&=hFbTRyv3FjkL_oGlYPMgQ?2skDND5ze-cnR{ReCUZ0
zd0=+Jji*0|FHn2&lAQjJ8}_OnM`Ck)>au#D*nG%yE<Fr}^gE<c#n#jX*E)=naLLAn
zOK7se*oHD*SdVselQ6cPf2H4jWrCCH&0{;kGvBGk$^HCexcB!hfaqmDHd6rd*@>TO
zZpL<j0-w2oZUEKP+Vge01H5Q7r_lV6Lh;RyWDJ9UuJ9D$kL05i*wIRV-DB0}S15O`
z)Vxh%pit=B^O47cb%`|ag0kA9sI44;MmTP`ELFb;1`D}V<3gjd+t7?T8za=dge=Db
z+k)mR%;Tr$l;9NCKXTWnJ8rzqgNUvJDN9!#c;53Z@$)D)))jsSN(X<T+es4gkXny5
z|BPV)L|A-JH69ixLY^}_Y-Wf+L*BC-@v(1f4wxz)_;ngZ_7!)e5(!&9@NpXG`K!xB
zn2W%^PzX*0gP|~#6{hIZtL)ORyGI7a@;0_hI|!M30AQ}e#sTV;3iy}*c1+}_G&@B@
z#qKM+jU}dBi-DAlh%+&-Dv!OE8$0}A9L8r*rt9}HKT3n-af35he-{e2h{Xj1pr4DT
zWFPCKv_^&ETw!yG5s+v><e6oR8V;NV3#<d_Gutw7%$R-Rb$-v{nF+ci>$CQdtPrfj
ztgahIUe;#3gv1Dh`U1^E(3QDM#edsLfL~Mv!TGpyYzbN15+q!g1?yr497e&0Nxq+x
zq=t-2<GYaH5d(cX7lRx>8S~cuY*LHurOU3xX1jSI`On^VOBf)9_z%bg-%S>$O;psc
zt7+A;QMWen6fGO0nA?bT8g&-u{5@gw{{H@5A%a$jKE>Sxk50r))_j_24F5KOR*^js
z6|{VITse@i^g(nE?YglgY6Hupe}Mpgz6zFcW?$~xWz0({0Ksc`qu<~49*D3CvwmBG
z0t_S4;vLs>3x5NLv1L<p-p>sJKi2-K_s-8yb=l0bkhtSIY$bE!jKuLTp{dpB?-6<a
z!>wf|1pUx(!$K)&(o#y6*OY$NHt6*EzfU1>qNc5MO)Tmm5{BD-W+!DY?jN@?llfDR
zvp;5MuTl=HC}oLq?7-~mFfr9)P>9dZG!WWX(ND*6k*9C6@y(7#k8{J^+duNvI>`Dy
zhdNE-Vi+y&ZLRUEMo7jwUx~zh25@o#z?i)2(aQngTzR+ZOChA7PkcLOj*QM<cP5kU
zas|>YT8o!JMp&77h0}WjB5#n8_g?H-qu5fP?|KWH?-KCx@=6DwNLs0CLR5Zrp{BCO
zZk(9<B1nsqsN;~Vmeg5{O326k;qw!r!_hjw_&=)*2ll%h|E&|<I#LALG^uKHrkj+x
z;^QaeLc9;^KZ2>Zp+ecr!@=MT#3DQwQas1)rEF<JUbd>6{Oyv<Jq$vZ%f$II>KGpJ
ztgQZDSfGe}KC2LHEjHS{6PlHpPggMSs*{ZEOw!bX*`l!_KSrefj<pcnMQ_u&X}fB?
z$m)6+B<Rt$3NHm`$O4UcKOkjg=XevtK4keuQNxz)^UR!F6)sp`_2}he!k7`4o5i$F
zFrQ#nV5+j7Uxg~Wt(6;(IG_Hcja+TO_d2@R3}ej#Q7gjB5Z|oB&J~dqyiNYOA~Z%D
zn~4F4^Y4GrA~K)}idV;tqJU_jA$2mSywc*|K&?$PwFFH3?0Ykt$CV>JE!%RkNAP@v
z6>}EDCHIt&|6jzT-I|NTS@@v@kHhl`hQn6A5xi_;EC<|R5IxHyx|}YW)%dH^a2{-J
z0`5Y$E))aMbN%3myM-;JLqd!G$lo9{B&J?n;h0R;b=r}(*;9pU(Y6D86zjf{5Ex;?
z^*++D_!0Pf0d~pj{k<18m-pNG4j580#Afb&_iyZ{^a*0C6;1^2e^SZfZN2#(^^p3i
z_-rV4B`l;LHGIv|Gw$zqo8?8zv(;<izZZd#Df8&UUbV5*l+R?Ki_~O8yzPJ;FlrM}
z1gXLBEiDSNza6j%k95Trz|CF5U$p0<h_Ct^K4?Jj&>gx~c;sh9-vB;+NPHbL6hiFs
zk;Z)P{9%!d^cN8)@SspkFP5?5+~kFw+kgHsi&!Yk)+o7BRls0^*J^ha>Vj;?diX22
z-BobFo?R~Ua)p_^>}{Q9U;d4=UYO=XcscSDt;&B|PK2clTJgbxn~1pk<c&CqoVIPJ
zd0aW(Ci$q}eVr5LE#0k^EMn6cloimO&}QaR%A4OJG(NkDkZzeee$6n`>>x|8?nNr3
zM!{{4g(xZXJ#bwo)2Ys%E%~3~MV>H#^%<So?c7X4l)ONq4R!RV3)LC-wnMxsF8`jk
z!NguB=JUGhcMmGc-xbZsO58TGnR)$l=cI}`KhG^juh3V@ZB0jhv673xJ`+So9+zF@
zC>oZb{1*;V2BFR{E=TL8#>$(R$6vLP3tT2*Lb;2R!P8S+3nEJ4eDj2CZrF(xHgiL+
zoy4Pw`%m$Je9LsNc-xh;6hKt#bUzDm*B5e{L!r0Ifp6QPTB}{@RUcF4KuR<3L`!`M
z44#gcQR~R(rlLzdH&#1&T;ogqah0d*qIPgDQtqa5RBM`MeJ582N&RnUu{8=4actI0
z&n@_Su^G65W4YBW?bwjTkAuK+U8qVwAKhnc^?1Fb6C5SC4saGq=A%#$sUgu>9tqQw
z-L?_|dK8f}N$-n~7Wsd11!bdztwSJhr;-QGqusA#AmNdoyzgq#Z!04dw6oYQDLk-0
z$0#gSYYm&}DYWb!@v7Y2`A4|Ky?p7oNiAdPVpFNWCHgI~(?;%xbdiVo4=As~Z5x3}
zq<Nw&ww8)uuzfxp(BNZ+UJY3Uhz%b*PQPBN2KWoc3@Nb>&~`qt!y`l!_>z`j2!&1g
zo3mx0EWb4b%N?4}{#N<~$k?n#{BA>%INgSFS!WR}y`Q2#)qldZm|Jp6*nv9!Vp<}r
zn_j=^$JuMQoxC6|zY&YEwj*$>M#1YWblefwS)_h?MN$zH7zpbxW5NA`mV&`1M3@#2
zkUZv0J==(w1SxgfdM8B{*`*C&`pEfeb$aU240@zF>yuPd^+u2|;w61eW5S;|OW1LH
zgr(Ky<b7)?tzr%t(GTfVYF=LOE81C`hL}=QH_K~guGS!X-0#IB!dE;+wsb_W`feV2
zUc&ExeR}Y2lYTfMu#IQhDt%eCdXSiRy6HyA_hRJKC0^ALtv%WA$?Z>8CArj#yLNwK
zSbguavT>F#YBJJe7G5++eE}vbQ*NrLp=+W%<+4tv#SSB1`$sAh`!wKjRZ7nIp6ncV
zchLU(%d|TA!jPc`xkq>$sXhWr)}LrMPaEf}eX~ArkY<M4c!8SW-6Ncd=5O)<_gE<D
zN*o|@zq9B1_7Pc!@-2G8=K8AK<W!O#Eyo-xegr(EcfzerPHUJuhJ*wr5o7UYGP6o&
zkQQ0HVh1vMR=_?g)GdCTWFgVS%lO9MYL@5yiVw!U<1MQlB5NDA3`}^d+c{)|3pV-B
zYA|R+!K6EZ`k!qj`W8}SgUfVZ@!FYL7wyjgiFRK`{}H!pEg1jl2jWsPOOKec@qQc5
zmJ@qs*LWXam6vM#-st1Eh~Og+agzHL>JoeHl#D)L@Yo#N9L+LTn5sswX1&3kneZ^u
zVa|I>gOu(E=!j`sZQyImipVw7VmjjK@B=(e<<F?q)L5ls{TEy+@c=fkC1omX4Qdvc
z>ck{u!q??+M-rOag*nJ!iLAtKPCQNTO?tp~){okdZp+8@>0GcBR6K$(T4)c?2$#OL
zY?0|l<d$!d3jll6Xtk!eHO=^UX@K+b_t0hn3rE_&HgKGX%Ij6;FTPliHD@6to+3L5
z)1Q93G(JoqS%kJWgODGJipEh}q(|WEfp*vuHuC7|C4v8P>$lmbZO(RhTXIn0QtoK2
zOGo*kFB6CA=j;0Icnf4MRxJ#ZT(@MASa^+EpS^Vixq#Fnp(hQt*biuvZ6&eI6kc1v
zr_m3xl5%=f|0Vt5j&__?Y?>ooT2aI=%sQzqi>%CuCMCCIyC2q7xfIcb8fulW7wouj
zqX!e|>maGs^E--#Tt#sp#-tx^D!3=IXU<bT;SqDDkFPNd87AO$%+GsUgkY&n?5N!G
zUif^D6Ro>-o^&Xi0>1T(Oc9=bIAcO-%!)#HFUEesX8m`?Hxw`J)4bN0Vzn}uEr#XC
z1H-qj&IJ?a`-O8zR0K1z$shrn7g((B=yRRIhI+tGB)|s*mc7Sre?qAa2)(%@p2Q7U
z_4@`QbyZm*+T0SOc;~Kz27Zf({=1*y{<IHgCr^DZV)0DZ&grME+XkWpF)&&HD>qez
z=19){%xxupx5QX9PGN8u4)P-lg(+4#w6`mFF-`sHm5a*0;K1U(dZmq_NnYC-_}l8v
zhqHX{`!J&TVu;Q@G%d8}P*SoKT4-vM>R;XT?ubQkTAvt;^d-Xji%`z!j;86yJx)zu
zr6^}c%LR(e8O)NghJ?32mK6)Tjso=conv_#s14oL@mcCEQflGLagMMGapU~ABAkX3
zw7_5NcaGqq<*U&lU;k|s!$0eE({N7G0hVF;>a0hDu1;rf!hfV`5Aa`gI~V|)dWy$G
zvDfq{c`!Y#4ltVUJupRlAwAud%%t&VAiw3KV$!GG?{5ZDw5C1pR4Dn)n--k-+D6-k
zT1%*S7tVB?u7r;-Q!D>xW$m*vT{KI+(_!B}DtI6wrL_lmO#9DaUANtb4G95Z*c7aK
zc><;s$tZAi!65~EdP6V!cfn?a`UtW;YE$1+_=V-CDzvh#5B%!EFC-<*z5iVhrC|MI
zEc$91nuAX5`q7q8%5)@!Y$TAja7l)*Mr?Z$o1m}6aHzG1UZmysAUFK_*B^2kdC`Nd
zg#4U};Vug*ErzW^yFubUPGZl5uS`ZE^jwaMWl5O*{LjvGi~kx&1%>u<)spO&`Pf`l
ziU9h{XEc9<P!W9AfQc?fRfgUmn&p1{U`o`4%ra;^OTT`QrHQopvecEnDt*H3e}LMM
zxp!+Val%A(?0%gCC+16=HToa1nWnK@Kjv^}49-#@%``O%c(yjlTvB9*FFrEyqJ`Ji
z`)q*W9{lOoI5UUjT8@{RwRx{ybeI(LXV57^GxgZ<&7^Dd``x!++2WP^756JHdAa`<
zp=auRIRLS8q_B<1Qk|7&WnUB9u`u{~ewXl@j*hT(mrUkfJ>tAqL9Kh?H~<5aJ{{X1
z;)oQ-XYf>PKrXzB$wb>AeZWK3RQ-P?70gujCv1;|_TZ#?>LL5{&H@`6rvA9YYR$7e
zl^nZJh1+mIkM!btUlUc23rZ$65d>US7L)Q&KF6zmZ^n4+573b@x3WwOQ?At97%F)d
zE+sO7^?doygFfVA&V?DG+^{GNU4RjteXp!lK4mmAZ@fz&fr?2CxjDmYWM3~43YhBn
zl2)-Hx+DWW^^M=M2-)ui$uZ&b#^|im`umN0@+H|9$sZVlI<o83k9y+X%KB<Peg<OV
z_MMtVJ3n8^Ys(wscj&mr0rUz-@A9RwT;mV1T~%fa!i<({uSGL9X?QC)pw-(zO}dzj
zxk)z_ZzMq@iETOSIZY>melPyFEG+kV{eoMn2{t3f9RRZc?wKLWY6pEIou;)vagC3>
zm+I8mFf{6VZ<GfuKFv2W7>!v-l*_Csg`&(xF%qeqp>J7SRNNWwBAg-s|7#bREfhXv
zw6Z+6{mK*fST0(Uc%f(DK`O6tV`v~y%)AI__Q;&fJEikgnXQxZXQSgsiW<Mu)T8xS
z9(jsdZzirOrBc)s*Uv4_L}P(Kjf&3x=;Xb50j}hD7%DYdbZW~PX!Tdg5^onyk&na9
zz5!{2j2M)1)3X!&6ogl|)GYe?Vz9%m6jXG4mfMz%F=5U)8B_{gzbsTra1ok|M5vZg
zzlYKK+-z-1`0Jx{Xgic7{`z%&dlD;qY|epxaI-<Z+X5!wN5M<nU&|$87LGA{;V^Tq
z)qv(?p*dI0{#G2-><56dT#;x|ofS44+X@g(AoEfGJTH|<AV30#KBzo-8$Gt!YE=<H
zM2r1m>RHhZWW^Ob+x=TJ7c0|yCl)3935q2)w8$5=D<662c3vGDJ6;-$L;987YTy2b
z=3k%}<2`pXy?S{WUBAX4ZJBgK2iO=w-z7+kn9zlSJTY0t$H)D))z}o>T4$s-SR{Wj
zG4(RFZ_3I}X0UD~+UQ|DxD}@_EEziDRUB>U8<iG_6=nV9ia4Zl?R_u48^fGOW9n~T
zb>Y(LxkFM(vki>+9J2Wl{^X)0;6*K05WZx+#oBi(+teA%ZsWWM84eaM=ftATP}nL^
zE+Bwuj&tHwmKU5awJ|B?sYDWp=e7Q=GABsfRh`bodvM1%jj1-~h?@>8Wdm9E2LW68
z->?oF{r^h;+iGc=b&_1<qd>?2g&*5A510D5h8c&$Nrs0fk#HC_;aaP0<aZ&rl5w|^
z_JS$e{q_-c{cvd~*DPNXywuS?q2vB;bSoz0=kJ~yQ2pg-Y>WEut!busd*i7puY}l4
zsZ)GuF?piEvLAjEpY~k$9|(v-T3Rva&R6m949j@w2x*hI7yMjI@MvqOWj%&W5A!$)
zcM<?t?<$^gCba>!<<p?dYpN%yRguDF?-C;Joak-Q6he?urRSUL!OVtD(85~=q<jsf
z;!#*zCchNm;yHH3&fIdVh}-yF(EBN5mN_|yVFokvGL|?pI+t8HaAAjsOcp6CN?4A`
zpo*Ah7WI2+3*wPLm@RZjJnY@$srnnpME@PX{YWYwAzCc<0yFwf$zK_^Cpjc%!A!}f
zqS*Pk=-;9`n8ua3%f(J0y-%M-{$SB+kz5v0QT=Xl64Ht(IW=K%ajRBs?&$BM(uTqf
zjA%ZRC?-j+zrbXLtTsDjKSnPsN?EF=?wiwSdNYEK(S1%cyjVcR>6(su^B-kytbR}4
zdrDP2`Z<WFl-_^a<qS%zPG0hq9<kMUCLWf+i2U7twsl+X=uZedAg1qre9N4HqY~_8
z3&paUwVX?dT`Y;5`@MDATM?OVTnG6X8w+W}L}*nTvW;oy>&mlonUAkhE9q=C_Kl?i
zC+z5b*5V_&0~LR1&y6n~1~2x&iXUXn7d2t@e_y^5Wfi+JdNHY&u$nNBWw&DF>{TM>
zoPT@0IH!p#D7b%+qik0Gn{((|{W>{|#1i}uVOzqB@?o@#7a-(D%?|v*fgsvn8I1eO
z5|gUm%<9)cQQy>jI_;ac!0mG#qbsx1x~ikVeyyv>pQivVvxSI}ev^;D;N?f93!w8z
zB@)^IIzn|F@ZlT~wvFB^v1N&%y0pr?*E`LN`~q;SpNU91I9gA5M<|Cs8LmF>!tlBi
zqY};;mJ4{QMq&X`LczoX3SCB(%}XN&PKADA1i*bSjd3eZ^$18qAGpuJRfQ^w!daWw
z$(v6@?PLUB`~9#rvtIkhmA@U=5QgP#hQ77s+m`=s=YKVQ!uw$jbj=Y<Oa7pgP8tCo
zWVEU(|EKa!&)sE`4*^@c_17s4nvIwsN~U$y!pvqq$%nT3i%qzTIP-?-lLv;^@i<L@
z3{*eP<r!QnxKL&5nXU7m6;E!Pdgi3J1eIm;Ne-=D3l?6^K>)z4#VxlI21l5iLn63O
zjaP*B;WeZl?3DRB^RFXr39t96H(qR3DsI>yB5itzY?Go>r)n)P0>kouer>L!v-Rm>
z?Ju>K3(E>+DFM?StMgC!CY?Wf_8E8PPLqEZejw%3w3D@M0hxV;6ZKmf6C2Jl`HJMM
z;Ze4M`1CHKX~=PzUjuRF9$x*7dv;AOFtA+`*OO1B4}w5>=05EL_*}kkSo-C+<^~MU
zn7YpTpEc-NAPIMie;c6iDoWNyGz8U9S#%92TV&Sk9hmy*zs??Zz7Y_l(DVm>CyywN
zg#{Aw7u!3>$D{UYhJQUR6+Z{(h)<kYFE@Zaan!&SJJc(1Jb4A+R?W&Uj8MR@>D(7o
zwL?X#dklIrAEFw^C^Vsh^OOtY3msQJ=T#`jw${N4v-2}uVYQJk{exU)Hz6u)a@E8m
z*+34({q<sZ*5^fqDTXPgW!BMgDi-fg7}J-xMQ^#x;<oqaFDQx;vupLjw6!bh9B*2S
zwLJSDiSjKv!IYn?&|IrrTMRz#R-YXxF4<n78+P7FpRD_MjOccrd2F_6!okow)lLIO
zShwS86mebUu`r|_*Dbz<@2l*lDn;)hF{7BXG=#=sH&B8=s0*rJnx~DuVI^ddS&ra7
ze!eqeXM8f1)t;Q=k$lU%4>dvib^o7b(9r433R6-|z6KQ|hr+_LtWrkuvJ7`02rK>-
z3l-eoAEceRRp1A{zjyuME#b^d-BZzAVNV@hAtXZjsqk-u%R8*&CGW@&3E!H*-(zRK
z!Q$i63FsJO(P};QaYZ4Bar47h{pxY7EquVQ<Pg}Q2Ua0B_{=<dB86+R;m{Xm#pMkZ
zJt`v!wr?RsGERB3N~qLMo1~_?N>pcV?_c09F25AL&A9H^ZZu;De?*Ffy?s8p@l{=6
zNN5g&JlQ2(P=|e;B@s!J+Q0Z{{4m?g_I!7D*YG1N>*2P>=L3IlKFvmqJ*Ch5+JF~E
zh*X?3a}Y*fPK&P>_h$C?>5|}6j;iYueL~uZ#u?zgLvPjFB1|;lDUnm8k@z5PEGIx(
zDY#S6Wa(VOelhKSowpKLB$vc|*U(J}>Q<IL&mslb@Qjm#KCcmklU1ieien}Sk+Zdn
zu!6v>2&4p<^HE^IC2R`La0;3yHBWO;HyIbjMi@9+Q`7_z{ZN2(GqeBKEpFu49<nY(
zw|Wx|+l&Ycpx8D5+?dLSVeqD5uef9W0|e3143H}K1xCPo5ek+w5UD<TXBQSGF6ypf
zTQqI#K3nuHvow(HdnnV_0z57rvzsop-jnu3<JTs#YW{Co0Fh^<mWZiUrz(5XlM~E7
z`%@jtACF=Xk;bJn{CCU#U>sZo-=fTJ=B+&QG@k%)cYpEF{kLhuu?vy&z2Xk&A}N3C
z;W4e;aT5DzU9S?&Msn%rrk!_x79as*Sp}#Q5{U4zdB3H8V%t&uWeI07U`s}`O@VKs
zyx+s8zI>tr=?k$FsV8W8Sto#iG2Q3OX3@IN%LOp_fMjO3fLrbe5)PX${Cme-ytr2a
z%7&ehD}4yH(5Ve)RwZAK_VDd{DrWR&l1@GqS|f`ce;#|JL!TgU-Z$G+OU%moQ5@MD
zi+@Nj%gEQTni?c#(D;WBrj98qBogmI?tFMlVB^HW$w<cB;LMwkKdWnc*uN=MsXLc9
z>v=hh3G+wqFL|7jdOnka>VoU3E8P6mf>i$Qt!3^1(0kiD;qPGP)O<5Ypd_&iIvwwJ
z@T=TOxY5>EFYb=+PNFlZrXM8a$mvYU?!5Nrw@r{d%2KQ!2VbTDER+KeL&3a(K8%2d
zCb_KFm2Ca^@d`+p!u`PSIN%a)UutONt#RZCNJFVoQ!HI&pV4XY+_^Rrre<6^7(Z^s
zqu8O~$zQDO(2z4o`2<K4<drH}ny<i@*;6xvShddakW`t6j)WaJZ_yLMrMD?p2R+pu
z@)Jcym4aQY1<yrDWy9;LI{1VCz^2Y}5FNil<3;a8u);G9)8t)YQSby?u%JzA2>S<8
zz@D7W{boF^OT<tmHJ9;(60%9{2ar2~^d+w!fu#q(0m7W7KSyy)TBq^5S^r+70#U?R
zj?|@j(dca_NFe0?Ay4~eyITgoZsYw*<gN49rGh?RTI8RGMOFId_72earY`^oa8xq?
zo|QxbIH&E`F`qI(BGJSG$-D^5>{V+1YgXElXYD)X9A0O23w>(xtTsx>kv<I{u7eYD
zM$>t!fawYh4czCr2(VnzA{%E66FWM8&meG}NFbwsECzl;_>=>|UY0I<KbPRy@D~cY
zgH{r;mjZua<R*A)3XuW;x%9kTan>3zB=qHBnq1dDKZuR~e6ui+B+_6ET@qI<S)idB
zI<f+3&!$(z=9mCMYANyB=J)iYo_Sg-)E^C6V8@n&gM3mH=IqY#g_5w9_PKaBTsu!0
z=%+52g!9Q)_l~R{4<5b=wYnWQnJhEK82o)WLrC=W==T26|NMR|^;7y98h`}`#Xi1}
zJ1y8v29a8wP(-!^6_$r-BVkl7z2qk&a;}r~u<a!D8{DlI#M4F<^|_(`SZRWI58s>N
zJn$bV)Fa8E{?VeUEe0GDWpZfFEh>3seRfuR@x`X-ZjpXmF-Tj6?5q{q9W!-SYu7(t
zRxjH8ExzK2sh%AY(wR1GX!!f-k1Smal8J$C#MLy%W#?x6T()~#x){Gg-|fzap=~aj
z8c4!JqD^alnw0%@hQ-^!?sSF>*3T5rq1?r95Pt!N$?GlAocJrqqt=IJTN^AzIehk5
z)yD(@n8`YJy4z69pm-5rNVLH^jl7m94*pq4TC{^sW74KC)r}R1@t#hVciI&HU@CtJ
z0I|06KOg0vLr=X@WJ<j%*w_S)#(^zR2fbJT8<i}eOq9SNz=c-{B=RO#1OeYQSe}Qe
z%S@-y#>IWAwvlcR`{R6{UbUaLIa6NF3m#yr)RcY=@K=Ti$bzJGZ>|4hP5C_}59w4N
zbR5%X<O44iY0#JKXe-|j@SX$;Zd)+?$@I8wUfKaWuhi{y+|;@m>R4j&PFRjP>wI+t
zi7OOESXi$<zsoH5nU)p2jx648J{-%GwpA>jAr}$}&SA`qvtuhh83!nKAB}U75CGgB
zX6@Q6?7Zc}C!JC@wGa8AY2Y%X7@WO%n-5|o1_>JMR~ZFS(?V!L@<sUQ84lz9^yso=
zYoOe#uc`K$4L&)1;p&G>OFNNm5nv%3bhWO_2jY)<FUwi%3-3^ZEW8o1u4#Qn`S(~-
zEQ%h`S*ra%r!peAgRVc>ERaS0Ljs`W-&z<wfsNpolI|;RNcgmRD<j1wj&=xm*nZld
z>w0z!%?0k1I@%-m8u!Qck>>JMx?{f3t_uh+v5qImHhwAObWyygq6jSwm}61Y#JJ{;
z37FxZ+l%gl1DF7!+krY;c`y=~op%MT9#U;(Ungg8D(uF0AZPHuXX^4}=0gPjkXD2+
zevYwG#T(*Bn%9j;n*8vfb7pol?Oy=7Oha$ml-W|`-;3&^ym<D?pP%QGqklLk-BJ2M
zDDi`BGOkg$HJ}HY+;i(7u$Bm3Kms61I?1T<26cvtoHm;~XD5W6nDPesSo13^4J7vn
zyR_mU4BI}0RH^ekCAcs(Q|RT~HYm;rj<(Unf`5$br#RvT(|&VIK8kbw>*=#zzOBQr
zb;X$t|1|e*y}3Jk?p50t1Vfcc;I^A?*9m<J2NOKH<(<bcft+I^{<T#caHQRk7%5aO
zpY@H9$ATYff#ibChsUZMj!y9?Ea7p7oM-%Nd8P7sCt<vTs_x-8DvSq{e#)!|(%6On
z3Lpxu3vC)xk_?Q8Dx2FPhj@{B9&W#Dqkj{1WiDay6)hAe`X`)xaRgbV+#=<r4<2-F
zRoG!4+6wGs9auYyiM;D1%W(tohxxcf{-X2UhU3}cswcLDLn_-Fl-B4%fv5@U-QVD@
z^L4TCMbWk`J8l{icG)bnI*>NZjgn9pJVQ~i(uN5-it~o<AjiWumXmXnRLEnTGP^5>
zMgnd<xiY_hrt2;Ad`~b|boh#X$9mthqm&VtjjsMZ`m^N1fgxmD{43gl$Y<k%15!&L
zxh3f)lm?=SLV*pzIj7A!H2#Jcbb$T1C|L|v-&_Y>&zxy;d^dKk4XQB_sM!%zXX5&i
zZ#=GIuH)|v?9MZ=l;NuzwuuAC`)YG5xP9->?9+iT#<e$LSB18;?X_kLo(jh6=<An)
z1NmAiaGW6xFxvG`Tefno_*#t3XXAxEkc;-^&*&Ub@tn;F>oj~vC6b5jZ8({U!80J?
z1^&wfE<p6z7yL8VVc*YD#csf<Jcim)<sTs`>4td~eD#42&o0Evki4x23dy7TI1$~S
z@30jC+2mT;GPZ@uhx7JA0|^Ohb|WlW-3kDD%=j@vbsgdp^@P0a=11(w0S5%=IzsWB
z+)bzp>zj%1^tCC$aV}`#0_cln+n?;?zY1u6w1}>c1_ufO9hIfcMrTYB<QLic6aMXG
zwtHw>aC7OU^YS_!B<7{E0K5#a<fJ-lw^OZ#(+Y5Q@$ZoUEV@0khi%3#eTUKlpKzq9
zW6%AnE_0TK;m=%-ju!*d9L$e0sn@!XS+`!QmWHWAA(N)dCN3vS1hS+tsR!UlSj1aq
zuXEkH!BF@=R`N<RIYN^O1w}<dG}-Lbn7RuLfUou>BU1JOj2gGt&_B+$vm>^i1mCaa
zYmlfvFc+_12?7^8fT%<bcqnYANa7p$-s`Ig%)+<U{DgXgCs&HqL4XyxkqFx%1Lm=J
z>CCIIconW_)wIvsSFK&hNz#t1TYMmv7sU-e&;2<5J6ZjICH9aOVhR2mh{HMKo%g=P
z6M*)(bixQ0w)U8z_rXw((#<QymP1TBnhE5s_9tCGz65{`7&}B4BQd&+fIz-PTEQq^
z$?Dp3;^S$&&OohKRrV;TDl4)}LS>1UA^0D_XHdK&C9)`#i+?VBE`i!o?^gy<7!}Ol
z3m+`})c>bG@Y2;xA;6!*h<CC)>aV{tfRdxCNFd?CNRa_{FJ5vu>3#*}&Q3OK2Jupa
zOlU@Zo9O4p%{WJU{Dhq+>eW01<Zk*o@Mnp9z|ViZG3{_>gK^T6H&!!C``3)5E}eF!
zJ@%#J?5QTTyiL$_`-qK+FxJ8nu_BL)%vN(UIP-f>a|a2uWfLSwsXxfYOQOK<7H5-j
zb_)yQ`Q&%-6Pu_PA>7P6`T1-9RjZKWQ?C`WAnRImnARxLxR+9rNEnq}L*(PQ3mk;o
zd=GA0zzDTr4sCIt&ti^!1LOSD`SwaVzO9jCeK%CN2%LSSPF~D1!V%lw(=w-*%L9Ng
z6UI4rCGiT?VXBs-&%3M^SlwjFYJjse`*?|$>&taMh*Eb)<$IYQATQ0u=2D0=sPZ_4
z9^6OvUWA_iOQ1WzYeB+me0mS4D$t$f4%+^{lyfthIBh?5>dK=f!*<i`fZeM^4y261
z4iEl4D}?mT9vf~Y$(1hQ%e!<vf||M^V1ywtSYE<1N_HVq<Ify|d>zLX+7E1s>K83Q
z!3TRBS8Q=v#?-~#_qbceFV?gA8#Kg|!hqDU=5Pd(gnhv>Ue_OXE4KogAt&19a~}ju
zT^v=qapL1c5Y7L%-Sj<tYp2?}$nUpdRWM3z?S?9m5wwr0sm}B;02aL1n|)$M`A1P1
zBT#<NsC$rSTIi7~aYx22t0K_)yu8%iR^z9we3Wgp@i1272c#0=0pl!CkHxjRGoEdh
z;>}3IcAjM95_}#zg4%)qlqNiI^5biM{n*WMtY)pAJKo$x1l|3lRIOgdma$!lB53@@
zmXu{;C8&CTPki$g%#$+10zmXKGWev_D}EH?zA}qV1)K;Zw^y;U9B|p$N&o|%h@rr<
zVjdRr@rwwrDP3Oql}>9dfy>I{i5kASFyi{*=TLe~P9&{=9_us+b|1*sS_JMA{q*E&
zm{odeOx#Coyfqqfx?<QAKhaMNW2#Gkd)4rWZ0iTAO9MclqQ>C%#-Qy?Y2SY}Cv=<X
z2UqT8L>CJ!kjJ>UYV<{n>?Kv$X-1^QCA=-q1P^?=hfskWplhq#6>7~XO{qbWJKBiy
zV*%4UBL(Db7gT)|t-8YEHr&YLG?rf!Y|{yy*NS*fkM|saKE;FaoT~yd-(QY3(_wKd
z&ZIx-)r<g3rpfSLDBs$V7rF#&n>{f{`T6mKPH2>wkli>nN_7$fHqCEHciGTjk|-+M
z%(tt8gue<sKloS6Al(t}93acMY$P5O2byWt)O;~dI|^o+Jq-ulWY1g|an{HYv<0MY
z2S0P2$bZB`0y|c3y<&r6J0_&Z=jU_J9mX`p=yE&o#)XsgmQJTwHE2&gPM)m#Z#c&o
z5ufz(5XtHE!C4MIzgu%Z^gQqkvn{0Ht6*NuYIe)Qb5r*Dy^9e#0<!Jd>b!t`cxABR
ze|@rT)lv7(nL)ZQYU&0(B(f3JgAPj{yAk)pRa!J-dJ=PVCCc8+GgT<0%cxzER>$9b
zh-x3|QlJ?8UL{RJE$A4jqVeAq7Y|My;>We(ayZ0K&@YP$2cdQjg940s6>P5?<xu~Q
zZ&RV>cMh2Xdq*5tuUEjJ{b$d&pO&Ha)#YR8wLL<zg$nisW2ROa@fLOkql01~Do1v&
zr7Jn%{xf{dp^=a-0UOw2QK>^dcT{tZCb%AE@lg!gi-&vq-2J_U(zy$hxuw@e2~ZfM
z_oG)vE{6$l^ARMQFtccr2!<#gMLeZ_nvVm&`f{<#ziKY-6=qw>f-&zA;DyP)j;&KD
z6(E1tJh^LxWLze=VNBIobU=CkEXm;q9#4jZ?k{A`W21wm4s3(B&KTsjbeP2dmlqQF
zg}(>fx6DTgl*%j->4a&Zt{Cf0zeM|9YG!C+wCB&!>)01LmDL14MH%cc0E`+n&*Qh|
zY0$Y$OW(o-kF6oR(=%EK3*;CaVE5!nW_(F=P#NVb{_nVTo`(+UxFZ*o)+SEHM}e(r
za~q<{t^l<FEd*6Haj#TlGxgwNp{#y1Mb!agiEG1QI)uDh{gZm?waAtpF$CC*GM&6n
zQ$pUD=@wDShhJ6bNiY0-%w2Pd393*98Cl*e7vBEMCfv_>EFM$VV?tK8y<>g`X;%!c
zDmOO%qK5)fd`KiC`;FxPwfEg$Q8dfnLsp^$B}kIAiv-CzEhw;v3j%_YbB;?A1j$iA
zWEVkPf<zHPL~@dxa|X#QNY03$z<2QRJ@@`_&-(}5b7!`vKT{p1ySl5Zy3g$N=mTsv
zewbC(eNC*ndEL;p(|Jm|P9iHBJ1W_tmKKTV+>@uF2HRvx=|)UAZ$Fqc&A0rN(8<%d
zV?3H%{nfHFA)Off-g`2BXd{N`=GbE*_qidKM;7)K`2%`7JouY;7qGiapN|LU8nPTZ
z?X=msMfsQ#&>s8OPZ4ziJ@8J(p$+KIPiGynV@w>PFd=Sqv6_LheAw`p1u{u|L7Nc_
zW&Flh32;8^WUeU@z*H7=S2CinTo~ayF$U<Q00s1;_d6m2QIthQMddn?`G~yO1cz3x
z#6sUIs?m9ej+%&5YpgQ=oENU^o712t2}Iw+3v{6=3sH(sLU!%#4-yk%5>u9|Ue|k1
zFaB96fGinW3?+Qf#<l7({fKD+;xdPi1jzOWh~Td%S72oMqm`YMzr&egg&<|-hRb<h
zIX`Ayh4qfvsOcP-F3!R~)J}>qu;kB}ZuMX9+9#OcJjJXsu}j4mbBNe=CU71{Zo#O@
zzFO-xDbi#11yAFZ*cDap+kRInVhJ}2{plph87Ab?8c8ml!|=-Tz<ckfGSlppvag;>
z?)QIvZezQH7yC0Q`)Be>cV^-Z#QM$Wr5EtGV};nC<%}Uop3>VHGRxWi*Dse7YGIF+
zZl46j2HV{~67k~|dNG-6<>{C3-5-uuQC=zSUPJ{OiFl#?XiWFsVz@H0Fh9fjZhP!V
zAZnDjjZ$-T^lg@LQw!X%hhGLk%xV1+LT*pHrZ=1$e`k%8|5Db!HdvP=GmNx(D#R)x
z!XMPB2?S3-46heboy9gDOJvwd6M_4k#TJIEcxyCmubwA0Or@+xr;AQq$-5_-N>twU
zjLGkr_z{&g;<P5Ha>LHErdC}wqISgU4b13mOBUn0!KE1Xu3JvHm){Gs(^i%-Qn&En
z%a^kDdZE@bR`ClmtmZZuO-B8)iKm&HFLFySD?y5+9oKfwp?#tiBU1Z|xv74t?NC*8
z*#@rlk)Fio)=|fK<a7dU=vq|?<C<kzRoL2zUL7Jq^3OWmSJn#ww&AbGR=-D5Cz6Ag
zh_-!$#z}l6rucSjBBitLSyL&~C|BxGekwka>TnF1QCZHO$tBa=df2-i@~d@i)lQ?k
z>ctIAY~Sf7U!;D;wznBox=<Ovx6TNckK@%Y1Fz!*PM2$At#{d*;S;Zd^KvCmSChEh
zy00&Yy_k;lg(@_=5*kbr(>~89-C-b%rC~&tfuqTLi7KF|0UpF)NFTd_10Q(6dCQ;h
zj(PohZgKB42NplPBIfauSL*0>78SEC^3=Al=&`Nk%k{V=>k}42z%BH0ad{)Ippq&K
zPt|tzBI>2<%-HRutFqL6pY#o;X5bAI&U-nAv<H*rP8WXVPT%Cx{oR?C3gJtUXYO`$
z<?g>LjnPCVg?@1b3mfwryt0!il_GNTo3Z}iytm+t`;u*<a^pvRgR9Ta0*;m&iWtw^
zej44BXfvp(O<?!9Hoj*u{mskxYxk{jm-8orc!U1*Dd%3E83SvwC9nl)w^RGmqWU=Z
zHHs3GgW@$GfrsPLQk*}X3r0^hs!f+dtG25*2y377!rqA&%_Ow{3^18pC08|DIa)#=
zlUCH6+sr(4)`lzx4~4oRJ%p!<KdWOHFS?14%Yq_1hx|^2uIBtVLXKx|f2BTo@-ryY
zWf5zC>ao%`PTA<8{w5#^rqtW1yFnmHgJ!95({kz9Kff;3>HjfzJ{skWXricl)4EST
z;MTMG{036x!EFe3bw@&n!qsB1UyV-!-G~{HV+p`w&nGDyP6c=p?85dfs5@AKhH5Y|
zeP*wn-=>A@IXo*FJ*}I@=s52(xPEdmjfg8P7K3`9i8N%(xADocW)U(Wspd0Mb!bTH
z1G_?-UNE*tqr~)=ECN*)sCfKO$cS3X%Y>59QhvhUNNT>M$qQ!qSFcfA3*fCpx|fXl
z!pdVFxog!vH|_T`dD?yZurJ*vt!1OVRaqEaiwC1$wiHXCf{ac)7^tdtokeODeNp-p
z(-k!ug_7a^CCC1`4e2=%o!5OQ`#PkZbD=*d0QEzoT>mQ?XQ-FAB+FSc-@Ev2V%Z2E
zJ*_})hh6y!0fOyIAZn?D#&RJ?lqw5fFBui>;C-}QCLeM!?-CS@@+R4tZfD%%mWZS-
zJdk$V*XFBziz*x=A*Q8kK`!zeB}Xw^le6*3INng#lSU-1E{#@BMqCIvdrFQBWF#oH
z+aU$N-Vlrg|DUCmIdo%EP8Wm0o9*lxOVj?wn31QkduDbOqM3Gz5FKAEeT>v%mlWA7
zhZq!^@aTHkC+|M+rH(wRrQ82;y*=(?33uCkL?G_zWT`Y#-8}A>MDL4AEJrPW<#O%4
zmmg}FaQlX735nj8S@qR||DkZ-Q}4M0lbk|&<900St!cbV61foc%95P4uVWP_@sEu;
zwk^DBDvo2$`J##-44Od1y%|jKg+4=1qc$W?ZwagGmN1RtgfzoU<^AIu;V;kKcfK#E
zXvH7-!QP`YbOMK%N)J3JO2#p0^sTgr70ZI7I9&I%hSiGI=x0PXZBGVd4U+Ptxlu>C
zVwAi-qDfF!cIyH^w7M+TQmr~)g8L-x_3;~t{IR_!_(-kC?Ilx?{wy!?Sw_iidkXue
zUo@HJUwX+N_IaFlbmYJ0?|bwO<oeF?L#p;1t!)FEn^(n7`d_bPXZ0bO1w9{{3ezzh
z%kd_09({l8M%B66IlrrG*i^Ie%HkOR8iYMVhC=?H^G9i81Ir#6S;65r9)-0d1r$7r
zcAmVW#i1)-d>G?c_WX`X*!Bt=YIobnHC!U!=S2@(PJ7ZTRd_#3w#VFzv96yie|!&-
zAfTtxzN?0bIgdqoB&YOJLuAkI$a3x6ZsxJ7s)50`74eI+F)F_!6MyFlL%YK&s_|v^
z>Mr^Ij&ClTxawK@lEf&nLvErSxnD!?CglcOOjgVFikq%O)yT@aH}pbbZXF-9Dwd18
z<x?cMEtf65QiHiOuSaDWKgL$Q>QE4_T)qwg9vSgyKU{E6Qt3GIXY#$291T;eCncRT
zCDPl&k?1*Bt)vAnPROeoNGv-cRHTdTt<6ZQt2$@L71+ToldTfdNhSxQrD3`lLxsAG
z6iPI%AzH%s44Io-XV7K*teIHO{rfw2)E$u~Ic@7}&y`Mi536fNeO2m@5CYr$(bPo}
zCaLKs{9GRz#FR=mnL{(X>}O=4<%<s)uNJk13Hn=`j3aousAI0hHo%{#8k|0pfW92H
zd=HnJ8tGFEg|=qo`e|<Xi}`9)t>CLAv#bJ-t~^z9xU7Z>9sR(!5y#3fQ?f#Zss)a@
z$+StnPno<1F!w4*V@)zN=hZ<J>c!BSWhoBB%P16kOOal&6RgRiA%s#d@St1RyR@pa
zO3KPt>;813;f0bx{hoB!z4Y139{QRUe<894{M<>yBgr>%h5hju`7;ye4d^m8X`B_W
zf=fKBV@H0;emOD)Rom?PdW2oIn4X9P*~6EC!6IE*Xkpx>YO3hqm)0RvD?AJSrO3^z
zuZ5xheb+APww=pn6K1TaUc62|PU>;PW=~HZy1DH)-c*<hlf6dHjd80%Ju6`qkih-k
z(19T(m%D5781j<M(%U{DIQpl5JgHibq*NLmS|SeZCD(ybngcfk=YD2#GPkj<yFn&t
zA>g(<i;1ZjzMXrr>eCyyaaX)@-^M&Hc7WU?&d~Q>{ZVg;G;KRR<RvG>DX;7b4@~pE
z7u8Gpee32rlJ5CLm=A}%!z(X2qRB1ww1<6a_K0%*9cWMbd{YvX+*L@iv6MMY;!P1y
z#=ZLn3%*ySZIT;1cXtIFS{a8)m4Hhw_Q7LnCv@vi!`_+TjmfLJx7Xd8X{HBPPj8|P
z_k_<L6p80!ztNstH>!L8e(O>NEo72=!9ZR=U1N4luy;-H>Aad$zd7qRBN;Dn>R#w{
z%S|fHlA56R4N7{;F28WvZRmAbq>Dpmnlz=TTADC{-~D`;8!17?I3Z_IZDYT}^0dj=
zEIqnf^w-lzHj@?lg#kILGBKRn-tJTmIm>O!JsG^J#F@np2l$C^3O<r99~)JAu}aAQ
z)Iw*dkpOb5n&oWYIp%_M8lPb5;aa60v)X+V4f<F!O)Wjb$7Wy6R`d1qU&|rB*!SaQ
zCJkEt>51edGemoDB-b#9tlf1=2Qsa^)7le}bRT4z1Q7fT*cYr2qGGcXUM3xKM2Hn4
zIAlnh>YY7w=yfS7?igBTribrUBm&KW(53C$Y=u(8p2uaYG4H8TDcslyE3(zU9MJm1
z`op5ST3sGu<~byWw-G^7Nx~8C&3cljI0Y&nd#KfSnPaay$9q<N0bhujRBGuAHN=yr
z3wmz15w8xz5DL0XVKPOa%hH6T%Zo3Ol*kX39JXJo{2VVtKpisI{Ug%T#F$R)rQ{Q3
z8;DO(X3g;x%1RxwZ#*t;ubbCB=rSWE;1gsBWVm!GCr5VY=lsE<Uq9&h)%C^4E&M`r
zAx4lk_agf`f3L-TuMTw1wvy8YC`Hn@Smgo)AfFZcuXzVF2@o`cJi3YxegqjFGa`q4
zD?m*8quS1=A6}HKuAND%j5uv|TCNMoKbzLFS$!I7uor`LXW&_S(VR=`K4kl;#-NZE
z?NXYz!hsx$-#ubf_l&x$`dv6QveCLkc5;18*<*r)xfv=fV#hPUOflw9jxKS|Ux_L2
z$dmV^86LSO#f2{Y#+$d4XC%ANHYH2N?HfWKf%cgM2Xy0s%%YtFNxK4A0e3bwwana;
zIqcaf-43_n=FF=f4v4sc2OOcz3T)?RfhfBj;wMi{L^!+%K6%oqi?Q@b(E4y~Vfh4)
zpJ{R(LoXiPu#>+ut^BzQnOS$F^hqmiw&C*K0oumS<IWbP>am{t5(<2knPs2PNAI~t
zqmu))YM!`LDYV4I>KtI0oaqmz{7)ZC-*&JslkksHUkd)gDsB70bi^-MCA;+Q`%5e3
z&YId3EN=o2yM|YBUcMRE>^NB$P!!NPW8)D>;2pI+NZ_Gy{tRJ06}MxD&V!RGFkKBp
z{&-sQ(Mxtn%`D~C*Ms-4H)DgV6p?c1cKzE9?QZ&oCf#0n@p{*+&N63)8`C#+>22<f
zrq6BEI0+Goj_nVNr)EbihKh7i-u%VLg8+9(CDQPee_HbP!}Ir}ENegN%Y{?ggV?H~
zeh75I_A1kIa+Gq!N2L))SnGvF*FQo6V=&F=rAbRh{W25JxwRejOsLkaD_p0>DV5k!
znzBGHzx&Q_zw|r|rg>VGNf;WWG?Z|dus$x^rWJ@J|1t4}cFVV19EAYrvR%8dFJkf$
zJ6>r%1xMk<YLnAu>_ewviR0C7nD5HNKWGtCA#IghgCf_3#^IZ<E2%#Qxkc6VS*$JW
zqF=A&Fy7TcQ!Yrq!Vwi%KiexJgu0!in})*^O&?Z!8YQD2@n>t0F+sex*D<;UM>_-*
zX1ldF3TU1%L>W($eoAv4+ED#1_EMuxg+caRL1JNN7A^LQ@jEsMj?rnNsWp=&)swW$
zR3Srrof_&DHu_4lXuXWkEzt<J;CehLAA@y<49oA)!_%iw4n5IJ^G!|cyOnVl^EFIt
zbB=&lt%@-Cl3<psQ%p$|z`u|8Nf*a}B`a%pF+M^+=00MP9PT9=+iGj9v#W2@>4$GI
z5Z{mL8rEnVC+(_a4H_anz@Pe*-IL)64%%P!rh15C1*VjdA5v@N?$pK{XJC^i!7Urg
z%wrcCl`Ar-gg)wG+=WN&V^q4#r?RI)s&zGH-cdbJ_6`(syziy8ea{(Yd1iY&UD5eH
zfYU1F%cWv;_lXZVX4T#xe3B?3iF9Q2*2t6)7G0}VCp^uTGGY-A-wejd4)=R3WqZ?~
zbjl|}-ZhP_GQF$szNTU`$*+Mt=0%&OhIX!Ho$84_P+t+;yDj{z6ju)5WTSoaEV1sG
zDb+DNZX+BXnd{gK?+_ZFSL56G{JY4h`#x{w;8oWbypmUg#tE%baIkJuS&LVp1o7pA
zyB4T@DS|0yu+n#IJ*A~0an&N5xX*>OKYkQZSBa;OF6;4`G!oMDi%#j2y?&DOIXPsA
zRE$Y<Gq8xu_La%@*=OU)({fx+8Vh!4x3Yy&=ZETF^w3U^e=@vBTXnKViKi|h1|f;d
zflQ(?Z`XI9eoNb*a;=v)(v2Cvu3L;$#(biJBz0r64$f^l`=S1=sp7&=vk=wy0=Eqa
z=B&IT^+$itjr<vDJbtOgcz?*ZM!o9b?4_Z}j;*xGS=E^0#_e#ZIZ*%pi;HfyfVbN{
zn)PK4qmM{Va>7{w%<geG<$4v3LA%HgDs<rSFt43^pgJsNIz994pIKb*D2vs?Ug_PH
zh$m}l6j3OX;Q7u1?unL}US64cRjKMG?$Vh)K#u{@z*}W9o;#I*=xpg@kD2hrk7W)*
zKKB#HPR?a(-Iyc&C$}2j7;oXUr_!w1)SJw3Obj+N3@P*qE$6F&jrS|-f%_7R(M&z%
zxn^;@?TJPwF~a=!=QAlM5%Qkw=uT<P+=}14_X`c7P8CIkp2nI5M@76Cfdy^@M1Ipm
z@ewUzh4n=6P7U9)8so1fv^{2Sq}{4Si$dS=AlYf90%Gl6YMqcb?KA{$#A0mALyai|
zgFW_KGI}VU+g`SBr&hYgwC)zyBB@6Mfq9$pmM(sWWn1=@&k5DjzC)6o%uSLTf`+Mf
z-7}s7K2DBt1+K8uO~-jFIU4yQ*pr-z_NiaYXrJMX%c+wd%_uizZTV0ua<aFqx7dt=
zdWk;-*;SPdEiKfdP8NckWR^2oc~$6(V+)rGLK1#FzAt?51hL@m+PIzSg)nu-=~|pw
zqR7~kIndp>U^T>cZqz>1*Y|pxN=MeiIWab`c+f{*N+*UOW#D_O>dL$gFsI0#H-0)f
z(ezogSIijmOV_Qoi^%dZZB?A>HxAtYf}b-!m!$TfTo#-Iuutpu?zR>z9%>S;#MKO+
zW79CuF6l@IR0XGOdzg$&@NpBJbT|n)r2}Dy^v`R~la-7p5q{-I5u(tS-!ncQCzool
zgp^#)CKzf2N!o^flq|VWaXr+SRrY_}o#Hm>16nJGDg6OUSk*f+w$Lf=lb`&el$1%C
zU0$$>j>6=muOTI3a$CbUmy%L0#}iN)1YA?R#|AE{U<`&atfb-Bt$$z0S1I*D48N@#
z&AxbU(0a|)PmH6o-81d`XOG2*s&nJRfDwr}H|xen?QVuEii0JZMjSVmCUInoo_FdF
zwmB5#mbV(-;HnXAfbB3mZ{wO0a#&w=^~>eE8Nxp%(A?p+Yn@>m%G+`1Ycw@<bl({x
zkGbw`<-z{Vp-lhcc6fupQ$r%sK)TE~o*6;3KfhS|zNo~fUBQL{Y6#PtHkP6f@~9z`
z74OcZkcn)#w~I-=I^409Ju^OtBd^Hselu7N15IY}j9T7`ii}$D)s8U;!y(i_i0rvC
zfjuy&AZB5HN>UQl(}F(;bNgnA;2(Y$D=z>kdGvsnqLJ3qLDjGe=ZmNR9hSMOJs~J%
zHP8jL+oxfvMY@=DCv+9`_PEkaBgPCrPHsE}rz=K>J^PAD7pJaNS68?*`nN;`69qQC
z1`Sgg2aeaRg7r-0#rC>4qsEg7r@v59Emh_-dI^3v4s;NIz;%V=jtGN_c&0QtI_dF5
zAkzC89lC}Pvk=Hy3AV34D{;f>U}9pL&-@)?Der}Bx|02?eW5ME?_6A|;*iKVWDHfZ
z&;w>Id$tj}{20?SmY>a(EQPf@3Y}48UAQv!@*`VZ4}dv9#Ec|?2{bQu?vKa*rcJXV
zf~c=82M$K}Q$hDjzFF>caZ0);*fkFp?g%4=4sIyHmpO8|iD>l%c)e!lv`|9vDe=Y4
zIaPxqiujylr}D594mZV$NMx%~yIt8V`aYsB2Hv?EcHOzOx!s3=p~^l!oM*lV&OzCn
z`?!h-5!XEKDFks-PYN{x{NQ|%8{Ar7h_XLdArh|X&<>U8u!<AZ`q2x!Xm{ryk>p=d
zqhp<L0=uP&DjToCFRudUnbpigb*_1d{mc&m8|@_xN*MfVr>>dCRf(0?s8yh7#>ch?
zy(+JasbSxrF;mE&)R+2*PqCT{xQCL-1fVi`e;*{og!Ymj)@SH$Jer&$ld<ITXi??F
zN8Y=2H;zP3>&)Pe+}xsNBKZgv`O9eV%WA<ihGuq7)-4#l9}V&E9g(kirUL8s5yPxk
zjECIye~+`x?c97Aho-LiV-CX6S<=OLDesLJuCzAo2jgqkDsc%F-PO;S$3ytCTft|L
z31Tcm85lih+-TmW>0qrNrq%EIdc~k=3CYQ%a*m}l<ml~ra}MRi%j`TSTQihp)u_!7
zE!YP2+zEkV)$Z-yo3d%X1Gvl{T*D_JsKf`jNh8iZ5{2;e;22ae;bAQvCs`YC?dHfF
zKBL|G5!DxYQ`5#>MF|rJ9_?|^x~8yHBc?~8=J4GV7Oi(b&D67tsCRFp=Xfn`4crrY
z-c}g*$wCA_+1o*Pv$u7uo^&yr*WjvUGseBTY54Y2utj>NpKHLb!+O&D^h;AAipGy4
z9fPj8`2CRF!*ZAmXIuXD%=h1|a6=pId;UD@jM^U-au{yX{}L}>Djm2rt(dORc>_PN
zbjO2eTj<`2tIL1}W~hRm;Zk}|74p+e(_EjLJPsHLRv;`C=*fQc4%bY33*niO02zMd
z(Ze%;+D)zXsb0{cqD!L1mRqI0(E^b}rKUK+C(Ff#Jqda^SfBM%KPOfB+~I3-=ChYO
zn#<fv6_@gpK{rB|20P@uW=f2peLHzSG~6!Y=a!3k<asp8V0-`Eqb5tG&0cS|NDIX-
z9o27WK19*GOAUL}Ud<S`zAQ7Uf!npq!#K)^72myF@q;9&XdYi-s9vb2A=jNQzwuOT
z>%MTw`v-~ZzIgo>2sM1Tj|AyrxwVK6j~21l@)ly#cz4A-9w+DQ2`d?e8`4>Cmi<$0
z`gEpA%}`$G$II6KsTcqVL1?AO0RRUNzySaNN&v#Ym=zBIaR1^fU>M%NVZy%{i~>;N
z-~*JPf7>1hxbc@R2;S5FrLWlG01P+;fASv#@y)+@7Q~Ey<NtZ~UyKW;RRA#n{+z))
z-6Mzqb&%-ndKn7<;z4(b{-2*s3;-X<06>ujEDHqyY=YHM1Kn>BuYj%|#O<K70ppy5
zzBcH1uK|G34FGrq7Tgc4^MpO<djbGg2msh70f0{~09cg)z^7&aC>RESS4#i@Zi^1q
z4+rok#{r%(;Q)O+IKZhi4xp!n1AMdqOSBD;0hT~EKn1)2nt=`=5MTtffe7Fea0hq@
zATP`QzvI7{1FK;BTL2kA4ydu~!5-ibxC5VoFklpj1$#l$e{s$KSG7wHd;`b<V;~ub
z1}cD3pbGE;%z?MSbD#zA0neiUG3mdZ1Gwsr7EbQ?3IO2b?19u$QDlAmM4y#t9UulS
z6)1R^S-88xG&R-#x%*GoA7g)%8!*gwnb&`c@&BQbSX#MTfZFl$X<`<xNDmMzfLPtz
z!}Su!fSAU@*31&b86f6Gf&~O|&n4abA3T4FZT`WBml&y|r36|6mwB?<{2Mm^H*8^x
zbOPf*!8jaFj-Fr{{v4NTn$*hqkv8ZvfQ}Iy5w!pnKoMXCWy2G&0~`SlfDiPYL7x5R
zbOL|UApjRJjRkmh1!V~drmz8Q!L+;})f3Fs3iPc(x)pdj0zQ{~2h)Mazxe5HEiCkh
zghQ$b00gra7YCdGK!gH-v-pdPU+*q1&N4xxV;TS&od1>HB?AB?jzD_+zi1rk06-B6
z0Oig9qM3tMLq!At&`r9UA<h0g2M@gBT3Z9aejWgjJplmf0RSL2_=i_u*kw47H4Xqe
X&%h??1%NjxpalZPr!c$>0f7Gl^cNb0

literal 0
HcmV?d00001

diff --git a/packaging/macos/dmg/dmg-layout.DS_Store b/packaging/macos/dmg/dmg-layout.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..33dd6ed8bc14613c3ee1e2b5754cfe030cbc6488
GIT binary patch
literal 16388
zcmeI2%}*0S6u{psphduL0R_}UO~b)RN(D8>gO)<no*<SW1QB+-vvtF=)9h|RBqZF7
zQE%RiSMjLv5Af>6D_3vEg9k5O)i*m^TWU;<i3j4FP3OItd2eRkZ_|%?T>xN(nsp8!
z0gad5jg1EY=`NJAXi7i_N(P|EO%g<a2oM1xKm>@u0VdF<_MVX6_rv(T-*bRtp{)}E
zBJg(vSo>6Is(`-uBmcKWj^*(s<&Kh(Iabj*0cAUOM+NnthXvI0vJ>TwlBi)}@$rJi
zZY(;B$bRL@ARXJ~W4WWGat9WziuUoUOde&huy|#bmMv`OBS94rAOb{y2oM1xKm>>Y
z5g-CYfCvx)B0vO)01@~f38??}v*t!nHC<sMf>&nMb%HRL+hbZ=d&i-}vLu%E{z>75
zhU0O+bXRPY9E+QVzu2TNMS5t2wV)7>%o^sL!#5(USs`5XxP8m<EU{4#HO~rg+QF@@
zv0QE>ePQg<_DFi`;ziWYkB@C{CytF=x_0x<s;h1bi}QZa*>aoki3Lm=W}WhS96?)W
zJ%SH<GL9k9d8Dhm=V($-rBc0p{r$&|4-5<romen@-|#BDu(_=FnMQfF;>&$a3Rn0A
zx5hE*mfq_==iaj3+tPiLTl;K_Yet1nxQ-FrX;{u~R{3JZcdTjK4tO}<q%TBzscMuR
zuQKnHg;#R!^Cj0XxjXF@L>P*-Wjz@n`63R^_<S9?-j3QKUn_dHm=F2AP<r9+<luBQ
zbc7eoaX&yg>j{r%u6|MQrc=z48rGObP0U#Kq;J@v8r)ZZ{QP9+#@Xl*kfCHFlx*nO
z_CCWuYn+ht)lI)+0qBVnx%FP?$~M-KiDXRd#$Kr=UFD63aR0;g?O$$kybO&=;>{k#
zjB*l8FrW;pPyrtV)W8D^vJip;HeN~S#WiNI&xT2~Fi?ircWSh0?$Oq%`ye$sC*0Z^
z4@T>o0U4XFW$IyN@(W7M<X4o^naJdGO4Vid`wWaj5ms<dkKq~Y!W(!C?_du;!B_ak
z`q&^ltv%EpX-~E1+6!%0d#Sxv-dg>waZ<JGwe|)zd~2+ie9skLC29e5!vs|EaxvyI
zMkr$!$RQ}Yq8xt+U=m%sg7)v_J(7`N>HdXF7QJz%{eJ9Pi(lkS6%il;M1Tko0U|&I
mhyW2F0z`la5CI}U1c(3;AOb{y2oM1xKm>>Y5g-EpkiZXG?H&gJ

literal 0
HcmV?d00001

diff --git a/packaging/macos/dmg/generate.py b/packaging/macos/dmg/generate.py
new file mode 100644
index 00000000..27adba06
--- /dev/null
+++ b/packaging/macos/dmg/generate.py
@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""Regenerate background.tiff and dmg-layout.DS_Store for the macOS DMG window (see README.md here).
+
+Needs resvg on PATH and:
+    pip install 'pillow>=12' ds_store==1.3.3 mac_alias==2.2.3
+
+Runs on any OS, no Mac needed. Both outputs come from this script alone, so they carry nothing
+from the machine that made them: no local paths, user or disk names, dates or volume UUIDs.
+
+    python3 packaging/macos/dmg/generate.py
+"""
+
+import datetime
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+
+from ds_store import DSStore
+from mac_alias import Alias, TargetInfo, VolumeInfo
+from PIL import Image, ImageCms
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+# Keep in sync with package.sh (volume name) and README.md (layout).
+VOLUME = "PdfCraft"
+WIDTH, HEIGHT = 660, 400  # window content, pt; the background's 1x size
+TITLE_BAR = 32
+ICON_SIZE = 128
+PALETTE = 16  # colours in background.tiff
+ICONS = {"PdfCraft.app": (326, 205), "Applications": (574, 205)}
+# A fixed date for the alias and the colour profile. Finder never matches it against the image
+# (each build is a new volume): it finds the background by volume name and path.
+FIXED_DATE = datetime.datetime(2026, 10, 8, tzinfo=datetime.timezone.utc)
+
+
+def render(svg, width, out):
+    # The SVG's text is already outlined and no fonts are loaded, so every machine draws the
+    # same pixels.
+    subprocess.run(
+        ["resvg", "--skip-system-fonts", "-w", str(width), svg, out],
+        check=True,
+    )
+    with Image.open(out) as im:
+        return im.convert("RGB")
+
+
+def quantize(im):
+    # No dithering: dither noise compresses badly and the artwork has flat fills.
+    return im.quantize(PALETTE, method=Image.Quantize.FASTOCTREE, dither=Image.Dither.NONE)
+
+
+def srgb_profile():
+    # LittleCMS's built-in sRGB ("No copyright, use freely"), with its creation date fixed.
+    icc = bytearray(ImageCms.ImageCmsProfile(ImageCms.createProfile("sRGB")).tobytes())
+    d = FIXED_DATE
+    icc[24:36] = b"".join(v.to_bytes(2, "big") for v in (d.year, d.month, d.day, 0, 0, 0))
+    if icc[84:100] != bytes(16):
+        sys.exit("error: the sRGB profile has an ID; recompute it after fixing the date")
+    return bytes(icc)
+
+
+def write_tiff(svg, out):
+    """1x (72 dpi) and 2x (144 dpi) in one TIFF, as `tiffutil -cathidpicheck` writes them."""
+    with tempfile.TemporaryDirectory() as tmp:
+        one, two = (
+            quantize(render(svg, WIDTH * s, os.path.join(tmp, f"{s}x.png"))) for s in (1, 2)
+        )
+    two.encoderinfo = {"dpi": (144, 144)}  # the rest as the first page
+    # Opaque 16-colour palette, Deflate: the artwork is three inks plus antialiasing, and a palette
+    # keeps the file small (RGB was ~230 KB; repository assets must stay small). As PhotoCraft's.
+    one.save(
+        out,
+        "TIFF",
+        save_all=True,
+        append_images=[two],
+        compression="tiff_adobe_deflate",  # brand-ok: Pillow's name for TIFF compression 8 (Deflate)
+        dpi=(72, 72),
+        icc_profile=srgb_profile(),
+    )
+    with Image.open(out) as im:
+        im.seek(1)
+        if im.info.get("dpi") != (144, 144):
+            sys.exit("error: the 2x page isn't 144 dpi (needs Pillow 12 or later)")
+        strips = []
+        for page in (0, 1):
+            im.seek(page)
+            strips += zip(im.tag_v2[273], im.tag_v2[279])  # StripOffsets, StripByteCounts
+    # TIFF keeps directories and tag data on even offsets. When a strip ends on an odd one, libtiff
+    # leaves the padding byte after it uninitialised, so the file changed from run to run with
+    # identical pixels. Zero it: nothing refers to that byte.
+    starts = {o for o, _ in strips}
+    with open(out, "r+b") as f:
+        for o, n in strips:
+            if (o + n) % 2 and o + n not in starts:
+                f.seek(o + n)
+                f.write(bytes(1))
+
+
+def background_alias():
+    # What Finder stores for /.background/background.tiff on the volume, minus anything about the
+    # machine (dmgbuild writes the same kind of alias from a mounted image). Disk type 5 (ejectable),
+    # the volume flags and the folder/file ids (25, 26) are what Finder wrote on a test image; the ids
+    # are only hints, as the volume's creation date.
+    volume = VolumeInfo(VOLUME, FIXED_DATE, b"H+", 5, 0x0D02, b"\0\0")
+    volume.posix_path = f"/Volumes/{VOLUME}"
+    target = TargetInfo(0, "background.tiff", 25, 26, FIXED_DATE, b"\0\0\0\0", b"\0\0\0\0")
+    target.folder_name = ".background"
+    target.cnid_path = [25]
+    target.carbon_path = f"{VOLUME}:.background:\0background.tiff"
+    target.posix_path = "/.background/background.tiff"
+    return Alias(volume=volume, target=target).to_bytes()
+
+
+def write_ds_store(out):
+    if os.path.exists(out):
+        os.remove(out)
+    with DSStore.open(out, "w+") as d:
+        d["."]["bwsp"] = {
+            "ShowStatusBar": False,
+            "ShowToolbar": False,
+            "ShowTabView": False,
+            "ContainerShowSidebar": False,
+            "ShowSidebar": False,
+            "WindowBounds": f"{{{{200, 528}}, {{{WIDTH}, {HEIGHT + TITLE_BAR}}}}}",
+        }
+        d["."]["icvp"] = {
+            "viewOptionsVersion": 1,
+            "backgroundType": 2,
+            "backgroundImageAlias": background_alias(),
+            "backgroundColorRed": 1.0,
+            "backgroundColorGreen": 1.0,
+            "backgroundColorBlue": 1.0,
+            "gridOffsetX": 0.0,
+            "gridOffsetY": 0.0,
+            "gridSpacing": 100.0,
+            "arrangeBy": "none",
+            "showIconPreview": True,
+            "showItemInfo": False,
+            "labelOnBottom": True,
+            "textSize": 16.0,
+            "iconSize": float(ICON_SIZE),
+        }
+        d["."]["vSrn"] = ("long", 1)
+        for name, pos in ICONS.items():
+            d[name]["Iloc"] = pos
+
+
+def main():
+    if not shutil.which("resvg"):
+        sys.exit("error: resvg not found (brew install resvg / cargo install resvg --locked)")
+    write_tiff(os.path.join(HERE, "background.svg"), os.path.join(HERE, "background.tiff"))
+    write_ds_store(os.path.join(HERE, "dmg-layout.DS_Store"))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 7f69443b..507e911d 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -130,10 +130,15 @@ STAGE="$WORK/dmg"
 mkdir -p "$STAGE"
 ditto "$APP" "$STAGE/PdfCraft.app"
 ln -s /Applications "$STAGE/Applications"
+# Finder window layout: background, icon size and positions (packaging/macos/dmg/README.md).
+mkdir -p "$STAGE/.background"
+cp "$HERE/dmg/background.tiff" "$STAGE/.background/background.tiff"
+cp "$HERE/dmg/dmg-layout.DS_Store" "$STAGE/.DS_Store"
 rm -f "$DMG" "$WORK/raw.dmg"
 # makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`,
 # which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions.
-hdiutil makehybrid -hfs -hfs-volume-name "PdfCraft $VERSION" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
+# The volume name has no version: .DS_Store finds the background through an alias that includes it.
+hdiutil makehybrid -hfs -hfs-volume-name "PdfCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
 hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
 rm -f "$WORK/raw.dmg"
 sign "$DMG"

From 4e79bbdbdfc277aadbc16a5648b4f7387e220786 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 08:51:23 -0400
Subject: [PATCH 038/149] CI: no macOS on PRs or main; macOS is built and
 tested by releases (#512)

The org has 5 macOS slots in total (GitHub Team), shared by every repo's CI and
release builds, and PR CI kept them full, so release builds queued behind it.
macOS now runs only in release.yml; a release that fails on macOS is fixed and
rebuilt.

Co-authored-by: Brandon Thomas <shared2@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f2730a3..821b7de7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,12 +23,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        # No macOS on PRs, main or nightly: the org's 5 macOS slots are kept for release builds,
+        # and release.yml builds macOS (a failing release is fixed and rebuilt).
+        os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
 
       # The optional craft-fonts build input (Japanese fonts), so the Japanese font tests run on
-      # Linux; macOS and Windows test the build without it. See craftrules standards/fonts.md.
+      # Linux; Windows tests the build without it. See craftrules standards/fonts.md.
       - name: Check out craft-fonts (Linux)
         if: runner.os == 'Linux'
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

From a9a7eea2cc8e37ff2a0458a9f47c5a5417573b11 Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Fri, 9 Oct 2026 15:13:46 +0200
Subject: [PATCH 039/149] M1: enforce decoded limits on unfiltered COS streams
 (#477)

Check the effective output limit before cloning a stream with an empty
decoder chain. Share the raw guard between tolerant and strict decoding,
including empty filter arrays and already-applied Crypt filters.

Add small regressions for exceeded, exact and zero-byte limits and keep
filtered decoding behavior unchanged.

Co-authored-by: OpenAI Codex <codex@openai.com>
---
 ROADMAP.md               |  4 ++-
 crates/cos/src/object.rs | 67 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index e61995ad..67935962 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -90,7 +90,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M | Milestone | Est. hours | Done | Remaining (h) | Notes |
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 92% | 2–4 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
-| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
+| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
 | M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
@@ -125,6 +125,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 ## Log
 
+- **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index 983b5373..808fdef1 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -223,19 +223,29 @@ impl Stream {
     pub fn decoded_within(&self, max: usize) -> Result<Vec<u8>, CosError> {
         let chain = self.filters();
         if chain.is_empty() {
-            return Ok(self.raw.as_ref().clone());
+            return self.raw_within(max);
         }
         pdfcraft_filters::decode_tolerant(&chain, &self.raw, max.min(MAX_DECODED)).map(|(v, _)| v).map_err(|e| CosError::Filter(e.to_string()))
     }
 
-    /// Decoded data; any corruption is an error.
+    /// Decoded data, bounded by [`MAX_DECODED`]; any corruption is an error.
     pub fn decoded_strict(&self) -> Result<Vec<u8>, CosError> {
         let chain = self.filters();
         if chain.is_empty() {
-            return Ok(self.raw.as_ref().clone());
+            return self.raw_within(MAX_DECODED);
         }
         pdfcraft_filters::decode(&chain, &self.raw, MAX_DECODED).map_err(|e| CosError::Filter(e.to_string()))
     }
+
+    fn raw_within(&self, max: usize) -> Result<Vec<u8>, CosError> {
+        let max = max.min(MAX_DECODED);
+        // An empty decoder chain still produces an owned output buffer: check its limit
+        // before cloning, including streams whose /Crypt filter was applied on load.
+        if self.raw.len() > max {
+            return Err(CosError::Filter(pdfcraft_filters::FilterError::LimitExceeded(max).to_string()));
+        }
+        Ok(self.raw.as_ref().clone())
+    }
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -391,4 +401,55 @@ mod tests {
         assert_eq!(keys, vec![b"B".to_vec(), b"A".to_vec()]);
         assert_eq!(d.int(b"B"), Some(3));
     }
+
+    #[test]
+    fn raw_streams_refuse_decoding_past_a_caller_limit() {
+        let stream = Stream::from_raw(Dict::new(), b"abc".to_vec());
+        for max in [0, 2] {
+            assert!(matches!(stream.decoded_within(max), Err(CosError::Filter(_))));
+        }
+    }
+
+    #[test]
+    fn empty_filter_arrays_refuse_decoding_past_a_caller_limit() {
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::Array(Vec::new()));
+        let stream = Stream::from_raw(dict, b"abc".to_vec());
+        assert!(matches!(stream.decoded_within(2), Err(CosError::Filter(_))));
+    }
+
+    #[test]
+    fn crypt_only_streams_refuse_decoding_past_a_caller_limit() {
+        let mut dict = Dict::new();
+        dict.set(b"Filter".to_vec(), Object::name("Crypt"));
+        let mut parms = Dict::new();
+        parms.set(b"Name".to_vec(), Object::name("Identity"));
+        dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        let stream = Stream::from_raw(dict, b"abc".to_vec());
+        assert!(matches!(stream.decoded_within(2), Err(CosError::Filter(_))));
+    }
+
+    #[test]
+    fn identity_streams_preserve_bytes_within_a_caller_limit() {
+        let mut array = Dict::new();
+        array.set(b"Filter".to_vec(), Object::Array(Vec::new()));
+        let mut crypt = Dict::new();
+        crypt.set(b"Filter".to_vec(), Object::name("Crypt"));
+        for dict in [Dict::new(), array, crypt] {
+            let stream = Stream::from_raw(dict.clone(), b"abc".to_vec());
+            assert_eq!(stream.decoded_within(3).unwrap(), b"abc");
+            assert_eq!(stream.decoded_within(usize::MAX).unwrap(), b"abc");
+            assert_eq!(stream.decoded().unwrap(), b"abc");
+            assert_eq!(stream.decoded_strict().unwrap(), b"abc");
+            assert!(Stream::from_raw(dict, Vec::new()).decoded_within(0).unwrap().is_empty());
+        }
+    }
+
+    #[test]
+    fn filtered_streams_preserve_the_caller_limit() {
+        let stream = Stream::flate(Dict::new(), b"abc");
+        assert!(matches!(stream.decoded_within(2), Err(CosError::Filter(_))));
+        assert_eq!(stream.decoded_within(3).unwrap(), b"abc");
+        assert_eq!(stream.decoded_strict().unwrap(), b"abc");
+    }
 }

From 5c354023ab178ce7f153b8193f7d4e750d6e1fed Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Fri, 9 Oct 2026 15:13:56 +0200
Subject: [PATCH 040/149] M2: handle Unicode dates and preserve inspection
 fallback pages (#469)

Read the date prefix at a checked UTF-8 boundary and leave malformed dates
unchanged. Commit auxiliary metadata only after successful inspection so
an escaped inspector panic cannot discard the renderer's page geometry.

Add synthetic date-boundary, UTF16BE annotation and independent failure
regressions.

Co-authored-by: OpenAI Codex <codex@openai.com>
---
 ROADMAP.md                   |   2 +
 crates/render/src/inspect.rs | 122 +++++++++++++++++++++++++++++++----
 2 files changed, 110 insertions(+), 14 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 67935962..a7fc14b1 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -138,6 +138,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (community, document inspection):** Annotation dates preserve non-date Unicode text instead of panicking while opening; failed auxiliary structure inspection keeps renderer page geometry and reports a warning. Synthetic UTF16BE annotation, UTF8-boundary and independent panic regressions cover the fix. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (community, Home pinned folders):** Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, M14, Telugu):** Telugu (తెలుగు, `te`) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; `te` and `te_IN` locales follow it. Telugu text is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 938525e6..03af9fa2 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -304,30 +304,35 @@ pub fn inspect(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Result<DocInfo, O
         Err(p) => return Err(OpenError::Invalid(format!("the page tree could not be read: {}", crate::raster::panic_message(&p)))),
     }
     let options = load_options(password);
-    let structure = catch_unwind(AssertUnwindSafe(|| match Document::load_mem_with_options(&bytes, options) {
-        Ok(doc) => {
-            let mut tmp = DocInfo::default();
-            std::mem::swap(&mut tmp.pages, &mut info.pages);
-            Inspector::new(&doc).fill(&mut tmp);
-            Ok(tmp)
-        }
-        Err(e) => Err(e.to_string()),
+    inspect_structure(&mut info, |tmp| {
+        let doc = Document::load_mem_with_options(&bytes, options).map_err(|e| e.to_string())?;
+        Inspector::new(&doc).fill(tmp);
+        Ok(())
+    });
+    if info.pages.is_empty() {
+        return Err(OpenError::Invalid("the document has no pages".into()));
+    }
+    Ok(info)
+}
+
+// Commit auxiliary metadata only after inspection succeeds; renderer geometry is the fallback.
+fn inspect_structure(info: &mut DocInfo, fill: impl FnOnce(&mut DocInfo) -> Result<(), String>) {
+    let structure = catch_unwind(AssertUnwindSafe(|| {
+        let mut tmp = DocInfo { pages: info.pages.clone(), ..Default::default() };
+        fill(&mut tmp)?;
+        Ok::<_, String>(tmp)
     }));
     match structure {
         Ok(Ok(mut filled)) => {
             filled.file_size = info.file_size;
             filled.pdf_version = std::mem::take(&mut info.pdf_version);
-            info = filled;
+            *info = filled;
         }
         Ok(Err(e)) => info.warnings.push(format!("Some document structure (bookmarks, comments, fields) could not be read: {e}")),
         Err(p) => {
             info.warnings.push(format!("Document structure inspection crashed and was skipped: {}", crate::raster::panic_message(&p)));
         }
     }
-    if info.pages.is_empty() {
-        return Err(OpenError::Invalid("the document has no pages".into()));
-    }
-    Ok(info)
 }
 
 struct Inspector<'a> {
@@ -955,7 +960,8 @@ fn alpha(n: usize) -> String {
 /// A PDF date (`D:20261001123000Z`) as "2026-10-01 12:30"; other strings unchanged.
 pub fn pretty_date(s: &str) -> String {
     let d = s.trim_start_matches("D:");
-    if d.len() >= 12 && d[..12].bytes().all(|b| b.is_ascii_digit()) {
+    if let Some(d) = d.get(..12).filter(|d| d.bytes().all(|b| b.is_ascii_digit())) {
+        // Twelve ASCII digits make every slice below a UTF-8 character boundary.
         format!("{}-{}-{} {}:{}", &d[0..4], &d[4..6], &d[6..8], &d[8..10], &d[10..12])
     } else {
         s.to_string()
@@ -1106,6 +1112,94 @@ trailer << /Root 1 0 R >>
         );
     }
 
+    #[test]
+    fn structure_failure_preserves_renderer_pages() {
+        for crash in [true, false] {
+            let mut info = DocInfo {
+                file_size: 321,
+                pdf_version: "1.7".into(),
+                pages: vec![PageInfo { width: 300.0, height: 200.0, label: "1".into(), crop: [10.0, 20.0, 210.0, 320.0], rotation: 90 }],
+                ..Default::default()
+            };
+            inspect_structure(&mut info, |tmp| {
+                tmp.pages.clear();
+                tmp.title = Some("partially inspected".into());
+                if crash {
+                    panic!("synthetic structure inspection failure");
+                }
+                Err("synthetic structure inspection failure".into())
+            });
+
+            assert_eq!(info.pages.len(), 1);
+            let page = &info.pages[0];
+            assert_eq!((page.width, page.height, page.label.as_str(), page.crop, page.rotation), (300.0, 200.0, "1", [10.0, 20.0, 210.0, 320.0], 90));
+            assert_eq!(info.file_size, 321);
+            assert_eq!(info.pdf_version, "1.7");
+            assert!(info.title.is_none());
+            assert_eq!(info.warnings.len(), 1);
+            assert!(info.warnings[0].contains("synthetic structure inspection failure"));
+            assert_eq!(info.warnings[0].contains("crashed"), crash);
+        }
+    }
+
+    #[test]
+    fn invalid_dates_with_unicode_are_unchanged() {
+        for input in ["", "D:", "D:20260930104", "D:202609x01045", "yesterday"] {
+            assert_eq!(pretty_date(input), input);
+        }
+        // Cover every position before the 12-byte prefix, including characters that
+        // straddle its end. None of these strings is an ASCII PDF date.
+        for character in ['é', '€', '😀'] {
+            for prefix_len in 0..12 {
+                let input = format!("D:{}{character}123456789012", "1".repeat(prefix_len));
+                assert_eq!(pretty_date(&input), input, "{character} after {prefix_len} digits");
+            }
+        }
+    }
+
+    #[test]
+    fn unicode_annotation_date_does_not_prevent_opening() {
+        use lopdf::dictionary;
+
+        let date = "D:12345678901éX";
+        let mut encoded_date = vec![0xFE, 0xFF];
+        encoded_date.extend(date.encode_utf16().flat_map(u16::to_be_bytes));
+        let mut doc = Document::with_version("1.7");
+        let pages_id = doc.new_object_id();
+        let annot_id = doc.add_object(dictionary! {
+            "Type" => "Annot",
+            "Subtype" => "Text",
+            "Rect" => vec![10.into(), 10.into(), 30.into(), 30.into()],
+            "M" => Object::String(encoded_date, lopdf::StringFormat::Hexadecimal),
+        });
+        let page_id = doc.add_object(dictionary! {
+            "Type" => "Page",
+            "Parent" => pages_id,
+            "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
+            "Annots" => vec![annot_id.into()],
+        });
+        doc.objects.insert(
+            pages_id,
+            dictionary! {
+                "Type" => "Pages",
+                "Kids" => vec![page_id.into()],
+                "Count" => 1,
+            }
+            .into(),
+        );
+        let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id });
+        doc.trailer.set("Root", catalog_id);
+        let mut bytes = Vec::new();
+        doc.save_to(&mut bytes).expect("write synthetic fixture");
+
+        let info = inspect(Arc::new(bytes), None).expect("opens despite a non-date /M string");
+        assert_eq!(info.pages.len(), 1);
+        assert_eq!((info.pages[0].width, info.pages[0].height), (200.0, 300.0));
+        assert_eq!(info.annotations.len(), 1);
+        assert_eq!(info.annotations[0].modified.as_deref(), Some(date));
+        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+    }
+
     #[test]
     fn dates_are_prettified() {
         assert_eq!(pretty_date("D:20260930104512-04'00'"), "2026-09-30 10:45");

From ff496918a173c4773543297572f67952766771a4 Mon Sep 17 00:00:00 2001
From: MarekSpodBiedry <73122968+MarekSpodBiedry@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:14:04 +0200
Subject: [PATCH 041/149] M7: pick a Japanese fallback face that has every
 glyph of the edited text (#384) (#472)

Replacing text in a serif line (Times New Roman, say) with Cyrillic failed
with "Japanese fallback font has no glyph for U+0444". The Type 3 fallback
took only the style's first face, Shippori Mincho, which has no Cyrillic,
although BIZ UDMincho and BIZ UDPGothic ship alongside it.

`document_japanese_fonts_for_style` lists every Japanese face in the
existing order of preference, and `type3_font` uses the first one that has
a glyph for every character. If none has them all, the preferred face still
names the missing character, as before.
---
 crates/edit/src/tests.rs  | 22 ++++++++++++++++++++++
 crates/edit/src/text.rs   | 28 ++++++++++++++++++++++++++--
 crates/fonts/README.md    |  3 +++
 crates/fonts/src/craft.rs | 39 +++++++++++++++++++++++++++++----------
 crates/fonts/src/lib.rs   |  4 ++--
 5 files changed, 82 insertions(+), 14 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 0a0830fd..6711ba4a 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -414,6 +414,28 @@ fn japanese_fallback_reports_the_face_after_save_and_reopen() {
     }
 }
 
+#[test]
+fn cyrillic_in_a_serif_line_falls_back_to_a_face_that_has_it() {
+    if without_craft_fonts("cyrillic_in_a_serif_line_falls_back_to_a_face_that_has_it") {
+        return;
+    }
+    let replacement = "Привет, world";
+    let has_all = |f: &pdfcraft_fonts::CraftFont| replacement.chars().all(|ch| pdfcraft_fonts::japanese_glyph_from(f, ch).is_ok());
+    if !pdfcraft_fonts::CRAFT_FONTS.iter().any(|f| f.covers("Jpan") && has_all(f)) {
+        eprintln!("skipping: no Japanese fallback face has Cyrillic");
+        return;
+    }
+    for paragraph in [false, true] {
+        let mut doc = styled_text_page("Times-Roman");
+        if paragraph {
+            text::replace_block(&mut doc, 0, 0, replacement).unwrap();
+        } else {
+            text::replace_line(&mut doc, 0, 0, replacement).unwrap();
+        }
+        assert_eq!(text::text_lines(&reopen(&doc), 0).unwrap()[0].text, replacement);
+    }
+}
+
 #[test]
 fn japanese_paragraph_uses_unicode_type3_fallback() {
     if without_craft_fonts("japanese_paragraph_uses_unicode_type3_fallback") {
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index d8a2dd93..bf74edfb 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -570,9 +570,13 @@ fn no_japanese_font() -> EditError {
     )
 }
 
+/// The first of `faces` (best match first) that has a glyph for every one of `chars`, else the first.
+fn fallback_face<'a>(faces: &[&'a CraftFont], chars: &[char], has_glyph: impl Fn(&CraftFont, char) -> bool) -> Option<&'a CraftFont> {
+    faces.iter().copied().find(|face| chars.iter().all(|ch| has_glyph(face, *ch))).or_else(|| faces.first().copied())
+}
+
 fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crate::added::Family, bold: bool) -> Result<Type3Fallback, EditError> {
-    let face = pdfcraft_fonts::document_japanese_font_for_style(family == crate::added::Family::Times, bold).ok_or_else(no_japanese_font)?;
-    let family = face.family;
+    let faces = pdfcraft_fonts::document_japanese_fonts_for_style(family == crate::added::Family::Times, bold);
     let mut chars = Vec::new();
     for ch in text.chars() {
         if !chars.contains(&ch) {
@@ -585,6 +589,10 @@ fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crat
     if chars.is_empty() {
         return Err(EditError::Invalid("replacement text is empty".into()));
     }
+    // The faces differ in coverage (e.g. of Cyrillic), so use the best face that has every
+    // character. When none has them all, the best face reports the character it lacks.
+    let face = fallback_face(&faces, &chars, |face, ch| japanese_glyph_from(face, ch).is_ok()).ok_or_else(no_japanese_font)?;
+    let family = face.family;
     let mut codes = Vec::with_capacity(chars.len());
     let mut charprocs = Dict::new();
     let mut widths = Vec::with_capacity(chars.len());
@@ -1138,4 +1146,20 @@ mod tests {
         assert_eq!(wrap("A\u{2028}B C", 3.0, width), ["A B", "C"]);
         assert_eq!(wrap(" \tA  B\r\nC ", 3.0, width), ["A B", "C"]);
     }
+
+    #[test]
+    fn fallback_face_moves_on_when_the_best_face_lacks_a_character() {
+        static JPAN: &[&str] = &["Jpan"];
+        let mincho = CraftFont { family: "Mincho", style: "Regular", scripts: JPAN, bytes: b"" };
+        let gothic = CraftFont { family: "Gothic", style: "Regular", scripts: JPAN, bytes: b"" };
+        let faces = [&mincho, &gothic];
+        // Only the Gothic face has the Cyrillic letter.
+        let has = |face: &CraftFont, ch: char| ch.is_ascii() || face.family == "Gothic";
+        assert_eq!(fallback_face(&faces, &['a', 'ф'], has).map(|f| f.family), Some("Gothic"));
+        // Characters the best face has keep it.
+        assert_eq!(fallback_face(&faces, &['a', 'b'], has).map(|f| f.family), Some("Mincho"));
+        // No face has them all: the best face stays, and names the missing glyph.
+        assert_eq!(fallback_face(&faces, &['a', 'ф'], |_, ch| ch.is_ascii()).map(|f| f.family), Some("Mincho"));
+        assert!(fallback_face(&[], &['a'], has).is_none());
+    }
 }
diff --git a/crates/fonts/README.md b/crates/fonts/README.md
index 133b44ab..0f59dd6b 100644
--- a/crates/fonts/README.md
+++ b/crates/fonts/README.md
@@ -33,6 +33,9 @@ set). Without that variable `CRAFT_FONTS` is empty and everything below copes:
   keep Mincho. Type 3 paths and advances both come from that selected face. Missing weights
   fall back to a real Regular face, never synthetic bold; no italic face is supplied. The
   default `document_japanese_font` / `japanese_glyph` APIs still use regular document Mincho.
+- `document_japanese_fonts_for_style`: every `Jpan` face in that order of preference, so the
+  editor can use the first one that has all of the replacement's glyphs (the faces differ in
+  coverage, e.g. of Cyrillic).
 - `SHIPPORI_MINCHO`: Shippori Mincho's bytes, or `None`.
 
 Generated Japanese Type 3 fonts record the fallback face's family and style in an indirect
diff --git a/crates/fonts/src/craft.rs b/crates/fonts/src/craft.rs
index 322d9b2f..84bc0d04 100644
--- a/crates/fonts/src/craft.rs
+++ b/crates/fonts/src/craft.rs
@@ -96,22 +96,36 @@ pub fn document_japanese_font_for_style(serif: bool, bold: bool) -> Option<&'sta
     document_face(CRAFT_FONTS, serif, bold)
 }
 
+/// Every `Jpan` face that can stand in for the document text, the best match for the style first
+/// (the face [`document_japanese_font_for_style`] returns), then the others. Not every face has
+/// every glyph (their coverage of e.g. Cyrillic differs), so a caller can move on to the next one.
+/// Empty without craft-fonts.
+pub fn document_japanese_fonts_for_style(serif: bool, bold: bool) -> Vec<&'static CraftFont> {
+    document_faces(CRAFT_FONTS, serif, bold)
+}
+
 fn document_face(faces: &[CraftFont], serif: bool, bold: bool) -> Option<&CraftFont> {
+    document_faces(faces, serif, bold).into_iter().next()
+}
+
+fn document_faces(faces: &[CraftFont], serif: bool, bold: bool) -> Vec<&CraftFont> {
     let jpan = || faces.iter().filter(|f| f.covers("Jpan"));
+    let mut preferred = Vec::new();
     if !serif {
         let style = if bold { "Bold" } else { "Regular" };
-        if let Some(face) = jpan()
-            .find(|f| f.family == "BIZ UDPGothic" && f.style == style)
-            .or_else(|| jpan().find(|f| f.family == "BIZ UDPGothic" && f.style == "Regular"))
-        {
-            return Some(face);
+        preferred.extend(jpan().find(|f| f.family == "BIZ UDPGothic" && f.style == style));
+        preferred.extend(jpan().find(|f| f.family == "BIZ UDPGothic" && f.style == "Regular"));
+    }
+    for family in ["Shippori Mincho", "BIZ UDMincho"] {
+        preferred.extend(jpan().find(|f| f.family == family && f.style == "Regular"));
+    }
+    let mut out: Vec<&CraftFont> = Vec::new();
+    for face in preferred.into_iter().chain(jpan().filter(|f| f.style == "Regular")).chain(jpan()) {
+        if !out.iter().any(|f| std::ptr::eq(*f, face)) {
+            out.push(face);
         }
     }
-    ["Shippori Mincho", "BIZ UDMincho"]
-        .iter()
-        .find_map(|family| jpan().find(|f| f.family == *family && f.style == "Regular"))
-        .or_else(|| jpan().find(|f| f.style == "Regular"))
-        .or_else(|| jpan().next())
+    out
 }
 
 const fn str_eq(a: &str, b: &str) -> bool {
@@ -191,6 +205,11 @@ mod tests {
         assert_eq!(document_face(&faces, true, true).unwrap().bytes, b"serif");
         assert_eq!(document_face(&faces[..2], false, true).unwrap().bytes, b"sans");
         assert_eq!(document_face(&faces[..1], false, true).unwrap().bytes, b"serif");
+        // Every Japanese face is a candidate, the style's match first and none twice.
+        let order: Vec<&[u8]> = document_faces(&faces, false, true).iter().map(|f| f.bytes).collect();
+        assert_eq!(order, [b"bold".as_slice(), b"sans", b"serif"]);
+        let order: Vec<&[u8]> = document_faces(&faces, true, false).iter().map(|f| f.bytes).collect();
+        assert_eq!(order, [b"serif".as_slice(), b"sans", b"bold"]);
         assert!(document_face(&faces[3..], false, true).is_none());
         assert!(document_face(&[], false, true).is_none());
     }
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index 9c3ce6d1..1dc6ced2 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -10,8 +10,8 @@ mod encodings;
 pub mod pdf;
 mod script;
 pub use craft::{
-    CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_japanese_font, document_japanese_font_for_style, ui_arabic_fonts, ui_chinese_fonts,
-    ui_cjk_fonts, ui_japanese_fonts, ui_telugu_fonts,
+    CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_japanese_font, document_japanese_font_for_style, document_japanese_fonts_for_style,
+    ui_arabic_fonts, ui_chinese_fonts, ui_cjk_fonts, ui_japanese_fonts, ui_telugu_fonts,
 };
 pub use script::{GlyphError, GlyphOutline, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, japanese_glyph_from, script_outline};
 

From e93a6f255f08be2aa7a24d5d827ab6ee805a1d3e Mon Sep 17 00:00:00 2001
From: Hal Goff <henry@tollitt.com>
Date: Fri, 9 Oct 2026 14:14:13 +0100
Subject: [PATCH 042/149] Never crash: CMap parsing can't panic, overflow or
 run away; tokens need no spaces (#495)

The font-metrics CMap parser (ToUnicode and embedded CID CMaps) split the
stream on whitespace and sliced hex tokens as UTF-8 text:

- a non-ASCII byte inside `<...>` sliced a character in half and panicked
- `bfrange` arrays and `/Differences` incremented code counters past
  u32::MAX, and CID lookup added `c + (code - lo)` unchecked
- 4 KB of overlapping `bfrange`s could ask for millions of map entries
- legal CMaps with no space between tokens (`<0001><0070>`) mapped
  nothing, so their text was not found for editing

A byte-level lexer now reads hex strings (whitespace inside allowed),
brackets, names, literal strings and comments. Counters use checked or
saturating arithmetic, array entries stop at the range's `hi`, and a CMap
adds at most 1 Mi ToUnicode entries and 64 Ki codespace/CID ranges. A bad
array entry still stands for its code, as before.


Claude-Session: https://claude.ai/code/session_01VNJqS2dEQawHJn1qTRJiKp

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/fonts/src/pdf.rs | 337 ++++++++++++++++++++++++++++++++--------
 1 file changed, 272 insertions(+), 65 deletions(-)

diff --git a/crates/fonts/src/pdf.rs b/crates/fonts/src/pdf.rs
index 88b77c06..aeee43e1 100644
--- a/crates/fonts/src/pdf.rs
+++ b/crates/fonts/src/pdf.rs
@@ -68,12 +68,125 @@ fn dict(doc: &Document, o: Option<&Object>) -> Option<Dict> {
     o.and_then(|o| doc.resolve(o).as_dict().cloned())
 }
 
-fn hex_bytes(tok: &str) -> Option<Vec<u8>> {
-    let t = tok.trim_start_matches('<').trim_end_matches('>');
-    if !t.len().is_multiple_of(2) || t.is_empty() {
-        return None;
+/// Most entries a CMap may add, so a small stream of overlapping `bfrange`s can't take minutes
+/// or gigabytes; a full 2-byte code space is 65 536. Entries past it are ignored.
+const MAX_CMAP_ENTRIES: usize = 1 << 20;
+/// Most codespace or CID ranges kept from a CMap; Adobe's largest published CMaps have a few
+/// thousand.
+const MAX_CMAP_RANGES: usize = 1 << 16;
+
+/// A token of a CMap stream (PostScript syntax, ISO 32000-2 §9.10.3).
+#[derive(Debug, PartialEq)]
+enum Tok<'a> {
+    /// A `<…>` string; `None` when it isn't an even number of hex digits.
+    Hex(Option<Vec<u8>>),
+    Open,
+    Close,
+    /// An operator, number or name (with its `/`), a `(…)` string or a `<<`/`>>`.
+    Word(&'a [u8]),
+}
+
+/// Splits a CMap into tokens without assuming whitespace between them (`<01><0041>` is two
+/// strings), skipping `%` comments.
+struct Lexer<'a> {
+    data: &'a [u8],
+    pos: usize,
+}
+
+impl<'a> Lexer<'a> {
+    fn new(data: &'a [u8]) -> Self {
+        Self { data, pos: 0 }
+    }
+
+    fn at(&self, i: usize) -> Option<u8> {
+        self.data.get(i).copied()
+    }
+}
+
+fn is_cmap_space(b: u8) -> bool {
+    matches!(b, 0 | b'\t' | b'\n' | 0x0c | b'\r' | b' ')
+}
+
+fn is_cmap_delimiter(b: u8) -> bool {
+    matches!(b, b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%')
+}
+
+impl<'a> Iterator for Lexer<'a> {
+    type Item = Tok<'a>;
+
+    fn next(&mut self) -> Option<Tok<'a>> {
+        loop {
+            let b = self.at(self.pos)?;
+            if is_cmap_space(b) {
+                self.pos += 1;
+            } else if b == b'%' {
+                while self.at(self.pos).is_some_and(|c| c != b'\n' && c != b'\r') {
+                    self.pos += 1;
+                }
+            } else {
+                break;
+            }
+        }
+        let start = self.pos;
+        let b = self.at(start)?;
+        self.pos += 1;
+        match b {
+            b'[' => Some(Tok::Open),
+            b']' => Some(Tok::Close),
+            b'<' | b'>' if self.at(self.pos) == Some(b) => {
+                self.pos += 1;
+                Some(Tok::Word(self.data.get(start..self.pos)?))
+            }
+            b'<' => {
+                let mut digits = Vec::new();
+                let mut valid = true;
+                loop {
+                    match self.at(self.pos) {
+                        // Unterminated: what's left is one bad string.
+                        None => return Some(Tok::Hex(None)),
+                        Some(b'>') => break,
+                        Some(c) if is_cmap_space(c) => {}
+                        Some(c) => match (c as char).to_digit(16) {
+                            // A hex digit is below 16, so it fits a u8.
+                            Some(d) => digits.push(d as u8),
+                            None => valid = false,
+                        },
+                    }
+                    self.pos += 1;
+                }
+                self.pos += 1;
+                if !valid || digits.is_empty() || !digits.len().is_multiple_of(2) {
+                    return Some(Tok::Hex(None));
+                }
+                // `chunks` never yields an empty slice, so `p[0]` exists.
+                Some(Tok::Hex(Some(digits.chunks(2).map(|p| p[0] << 4 | p.get(1).copied().unwrap_or(0)).collect())))
+            }
+            b'(' => {
+                // Literal strings nest and escape their parentheses; only skipping them matters.
+                let mut depth = 1usize;
+                while depth > 0 {
+                    match self.at(self.pos) {
+                        None => break,
+                        Some(b'\\') => self.pos += 1,
+                        Some(b'(') => depth += 1,
+                        Some(b')') => depth -= 1,
+                        _ => {}
+                    }
+                    self.pos += 1;
+                }
+                Some(Tok::Word(self.data.get(start..self.pos.min(self.data.len()))?))
+            }
+            _ => {
+                // A name keeps its `/`; other delimiters (`)`, `>`, `{`, `}`) stand alone.
+                if b == b'/' || !is_cmap_delimiter(b) {
+                    while self.at(self.pos).is_some_and(|c| !is_cmap_space(c) && !is_cmap_delimiter(c)) {
+                        self.pos += 1;
+                    }
+                }
+                Some(Tok::Word(self.data.get(start..self.pos)?))
+            }
+        }
     }
-    (0..t.len()).step_by(2).map(|i| u8::from_str_radix(&t[i..i + 2], 16).ok()).collect()
 }
 
 fn be(b: &[u8]) -> u32 {
@@ -89,47 +202,64 @@ fn style_from_name(name: &str) -> (bool, bool) {
     )
 }
 
-/// Codespace ranges and CID mappings from an embedded CMap stream.
+/// The next entry of a `begin… end…` section: `N` tokens, or `None` at its `end` operator or
+/// the end of the stream.
+fn entry<'a, const N: usize>(toks: &mut Lexer<'a>, end: &[u8]) -> Option<[Tok<'a>; N]> {
+    let mut out = Vec::with_capacity(N);
+    for _ in 0..N {
+        match toks.next()? {
+            Tok::Word(w) if w == end => return None,
+            t => out.push(t),
+        }
+    }
+    out.try_into().ok()
+}
+
+fn number(t: &Tok) -> Option<u32> {
+    match t {
+        Tok::Word(w) => std::str::from_utf8(w).ok()?.parse().ok(),
+        _ => None,
+    }
+}
+
+/// Codespace ranges and CID mappings from an embedded CMap stream, at most
+/// [`MAX_CMAP_RANGES`] of each (every glyph searches them).
 #[allow(clippy::type_complexity)]
 fn parse_cmap(data: &[u8]) -> (Vec<(usize, Vec<u8>, Vec<u8>)>, Vec<(u32, u32, u32)>) {
-    let text = String::from_utf8_lossy(data);
-    let toks: Vec<&str> = text.split_whitespace().collect();
     let (mut spaces, mut cids) = (Vec::new(), Vec::new());
-    let mut i = 0;
-    while i < toks.len() {
-        match toks[i] {
-            "begincodespacerange" => {
-                i += 1;
-                while i + 1 < toks.len() && toks[i] != "endcodespacerange" {
-                    if let (Some(lo), Some(hi)) = (hex_bytes(toks[i]), hex_bytes(toks[i + 1]))
+    let mut toks = Lexer::new(data);
+    while let Some(t) = toks.next() {
+        match t {
+            Tok::Word(b"begincodespacerange") => {
+                while let Some([lo, hi]) = entry(&mut toks, b"endcodespacerange") {
+                    if let (Tok::Hex(Some(lo)), Tok::Hex(Some(hi))) = (lo, hi)
                         && lo.len() == hi.len()
+                        && spaces.len() < MAX_CMAP_RANGES
                     {
                         spaces.push((lo.len(), lo, hi));
                     }
-                    i += 2;
                 }
             }
-            "begincidrange" => {
-                i += 1;
-                while i + 2 < toks.len() && toks[i] != "endcidrange" {
-                    if let (Some(lo), Some(hi), Ok(c)) = (hex_bytes(toks[i]), hex_bytes(toks[i + 1]), toks[i + 2].parse::<u32>()) {
-                        cids.push((be(&lo), be(&hi), c));
+            Tok::Word(b"begincidrange") => {
+                while let Some([lo, hi, c]) = entry(&mut toks, b"endcidrange") {
+                    if let (Tok::Hex(Some(lo)), Tok::Hex(Some(hi)), Some(c)) = (&lo, &hi, number(&c))
+                        && cids.len() < MAX_CMAP_RANGES
+                    {
+                        cids.push((be(lo), be(hi), c));
                     }
-                    i += 3;
                 }
             }
-            "begincidchar" => {
-                i += 1;
-                while i + 1 < toks.len() && toks[i] != "endcidchar" {
-                    if let (Some(code), Ok(c)) = (hex_bytes(toks[i]), toks[i + 1].parse::<u32>()) {
-                        cids.push((be(&code), be(&code), c));
+            Tok::Word(b"begincidchar") => {
+                while let Some([code, c]) = entry(&mut toks, b"endcidchar") {
+                    if let (Tok::Hex(Some(code)), Some(c)) = (&code, number(&c))
+                        && cids.len() < MAX_CMAP_RANGES
+                    {
+                        cids.push((be(code), be(code), c));
                     }
-                    i += 2;
                 }
             }
             _ => {}
         }
-        i += 1;
     }
     spaces.sort_by_key(|s| s.0);
     (spaces, cids)
@@ -312,7 +442,7 @@ impl Metrics {
         if self.cid_map.is_empty() {
             return code;
         }
-        self.cid_map.iter().find(|(lo, hi, _)| code >= *lo && code <= *hi).map_or(0, |(lo, _, c)| c + (code - lo))
+        self.cid_map.iter().find(|(lo, hi, _)| code >= *lo && code <= *hi).map_or(0, |(lo, _, c)| c.saturating_add(code - lo))
     }
 
     /// The advance of `code` in text space per unit of font size.
@@ -392,60 +522,66 @@ fn utf16(b: &[u8]) -> String {
     String::from_utf16_lossy(&units)
 }
 
-/// `bfchar`/`bfrange` entries of a ToUnicode CMap.
+/// `bfchar`/`bfrange` entries of a ToUnicode CMap, at most [`MAX_CMAP_ENTRIES`] of them.
 fn parse_to_unicode(data: &[u8], out: &mut HashMap<u32, String>) {
-    let text = String::from_utf8_lossy(data);
-    // Tokenise, keeping arrays' brackets as tokens.
-    let spaced = text.replace('[', " [ ").replace(']', " ] ");
-    let toks: Vec<&str> = spaced.split_whitespace().collect();
-    let mut i = 0;
-    while i < toks.len() {
-        match toks[i] {
-            "beginbfchar" => {
-                i += 1;
-                while i + 1 < toks.len() && toks[i] != "endbfchar" {
-                    if let (Some(c), Some(u)) = (hex_bytes(toks[i]), hex_bytes(toks[i + 1])) {
+    let mut budget = MAX_CMAP_ENTRIES;
+    let mut toks = Lexer::new(data);
+    while let Some(t) = toks.next() {
+        match t {
+            Tok::Word(b"beginbfchar") => {
+                while let Some([c, u]) = entry(&mut toks, b"endbfchar") {
+                    if let (Tok::Hex(Some(c)), Tok::Hex(Some(u))) = (c, u) {
+                        let Some(left) = budget.checked_sub(1) else { return };
+                        budget = left;
                         out.insert(be(&c), utf16(&u));
                     }
-                    i += 2;
                 }
             }
-            "beginbfrange" => {
-                i += 1;
-                while i + 2 < toks.len() && toks[i] != "endbfrange" {
-                    let (Some(lo), Some(hi)) = (hex_bytes(toks[i]), hex_bytes(toks[i + 1])) else { break };
+            Tok::Word(b"beginbfrange") => {
+                while let Some([lo, hi, dst]) = entry(&mut toks, b"endbfrange") {
+                    let (Tok::Hex(Some(lo)), Tok::Hex(Some(hi))) = (lo, hi) else { break };
                     let (lo, hi) = (be(&lo), be(&hi));
-                    if toks[i + 2] == "[" {
-                        let mut j = i + 3;
-                        let mut code = lo;
-                        while j < toks.len() && toks[j] != "]" {
-                            if let Some(u) = hex_bytes(toks[j]) {
-                                out.insert(code, utf16(&u));
+                    match dst {
+                        // One destination per code, from `lo` up to `hi`.
+                        Tok::Open => {
+                            let mut code = (hi >= lo).then_some(lo);
+                            for t in toks.by_ref() {
+                                let Some(c) = code else {
+                                    if t == Tok::Close {
+                                        break;
+                                    }
+                                    continue;
+                                };
+                                match t {
+                                    Tok::Close => break,
+                                    Tok::Hex(Some(u)) => {
+                                        let Some(left) = budget.checked_sub(1) else { return };
+                                        budget = left;
+                                        out.insert(c, utf16(&u));
+                                    }
+                                    // A bad entry still stands for its code.
+                                    _ => {}
+                                }
+                                code = c.checked_add(1).filter(|c| *c <= hi);
                             }
-                            code += 1;
-                            j += 1;
                         }
-                        i = j + 1;
-                    } else {
-                        if let Some(u) = hex_bytes(toks[i + 2])
-                            && hi >= lo
-                            && hi - lo < 65536
-                        {
+                        Tok::Hex(Some(u)) if hi >= lo && hi - lo < 65536 => {
                             let mut units: Vec<u16> = u.chunks(2).map(|c| u16::from_be_bytes([c[0], *c.get(1).unwrap_or(&0)])).collect();
                             for code in lo..=hi {
+                                let Some(left) = budget.checked_sub(1) else { return };
+                                budget = left;
                                 out.insert(code, String::from_utf16_lossy(&units));
                                 if let Some(last) = units.last_mut() {
                                     *last = last.wrapping_add(1);
                                 }
                             }
                         }
-                        i += 3;
+                        _ => {}
                     }
                 }
             }
             _ => {}
         }
-        i += 1;
     }
 }
 
@@ -484,13 +620,14 @@ fn unicode_map(doc: &Document, font: &Dict, composite: bool) -> HashMap<u32, Str
             let mut code = 0u32;
             for item in diffs {
                 match &item {
-                    Object::Int(n) => code = (*n).max(0) as u32,
+                    // Out-of-range codes map nothing a simple font can show.
+                    Object::Int(n) => code = u32::try_from((*n).max(0)).unwrap_or(u32::MAX),
                     Object::Name(n) => {
                         match glyph_unicode(&String::from_utf8_lossy(n)) {
                             Some(c) => out.insert(code, c.to_string()),
                             None => out.remove(&code),
                         };
-                        code += 1;
+                        code = code.saturating_add(1);
                     }
                     _ => {}
                 }
@@ -637,4 +774,74 @@ mod tests {
         assert_eq!(glyph_unicode("u1F600"), Some('😀'));
         assert_eq!(glyph_unicode("nonsense"), None);
     }
+
+    fn to_unicode(cmap: &[u8]) -> HashMap<u32, String> {
+        let mut out = HashMap::new();
+        parse_to_unicode(cmap, &mut out);
+        out
+    }
+
+    #[test]
+    fn cmap_tokens_need_no_space_between_them() {
+        // Hex strings, brackets and operators may touch; comments and literal strings are skipped.
+        let cmap = b"/CIDSystemInfo << /Registry (Adobe (x) \\) beginbfchar) >> def % beginbfchar <0001> <0058>\n\
+            2 beginbfchar<0003><0020><0010><00 E9>endbfchar \
+            1 beginbfrange<0024><0026><0041>endbfrange 1 beginbfrange<0030><0031>[<0048><0069>]endbfrange";
+        let map = to_unicode(cmap);
+        let mut got: Vec<_> = map.iter().map(|(c, u)| (*c, u.as_str())).collect();
+        got.sort_unstable();
+        assert_eq!(got, [(3, " "), (0x10, "é"), (0x24, "A"), (0x25, "B"), (0x26, "C"), (0x30, "H"), (0x31, "i")]);
+        let (spaces, cids) = parse_cmap(b"1 begincodespacerange<00><FF>endcodespacerange 1 begincidrange<20><7E>1 endcidrange");
+        assert_eq!(spaces, [(1, vec![0], vec![0xff])]);
+        assert_eq!(cids, [(0x20, 0x7e, 1)]);
+    }
+
+    #[test]
+    fn malformed_cmaps_never_panic() {
+        // Non-ASCII bytes inside hex strings once split a UTF-8 character and panicked.
+        for cmap in [
+            "1 beginbfchar <0é0> <0041> <AéB> <0042> endbfchar".as_bytes(),
+            "1 beginbfrange <0é0> <00é> <0041> endbfrange".as_bytes(),
+            b"1 beginbfchar <0001> <004",
+            b"1 beginbfchar <123> <0041> <0002> <zz> <0003> endbfchar",
+            b"1 beginbfrange <FFFF> <0001> [<0041>] endbfrange",
+            b"1 beginbfrange <0001> <0002> [<0041> (",
+            b"1 beginbfrange <0001>",
+            b"\xff\xfe beginbfchar \x80<\xc3\xa9> <0041> endbfchar %",
+        ] {
+            to_unicode(cmap);
+            parse_cmap(cmap);
+        }
+        // Code counters at the top of the range stop instead of overflowing.
+        let map = to_unicode(b"1 beginbfrange <FFFFFFFE> <FFFFFFFF> [<0041> <0042> <0043>] endbfrange");
+        assert_eq!(map.len(), 2);
+        assert_eq!(map.get(&u32::MAX).map(String::as_str), Some("B"));
+        // A malformed array entry keeps its place, so the next one maps the next code.
+        let map = to_unicode(b"1 beginbfrange <0001> <0003> [<0041> <zz> <0043>] endbfrange");
+        assert_eq!((map.get(&2), map.get(&3).map(String::as_str)), (None, Some("C")));
+        let mut m = Metrics::fallback();
+        (_, m.cid_map) = parse_cmap(b"1 begincidrange <0000> <FFFF> 4294967295 endcidrange");
+        assert_eq!(m.cid(5), u32::MAX);
+        let mut doc = Document::new_empty();
+        let mut enc = Dict::new();
+        enc.set(b"Differences".to_vec(), Object::Array(vec![Object::Int(i64::MAX), Object::name("A"), Object::name("B")]));
+        let f = font(&mut doc, vec![("Subtype", Object::name("Type1")), ("Encoding", Object::Dict(enc))]);
+        assert_eq!(unicode_map(&doc, &f, false).get(&u32::MAX).map(String::as_str), Some("B"));
+    }
+
+    #[test]
+    fn a_cmap_adds_at_most_max_entries() {
+        // 200 ranges of 65 536 codes would be 13 million strings from 4 KB of stream.
+        let mut cmap = b"200 beginbfrange ".to_vec();
+        for k in 0..200u32 {
+            cmap.extend(format!("<{:08X}> <{:08X}> <0041> ", k << 16, (k << 16) | 0xffff).bytes());
+        }
+        cmap.extend(b"endbfrange");
+        assert_eq!(to_unicode(&cmap).len(), MAX_CMAP_ENTRIES);
+        let mut many = b"begincidrange ".to_vec();
+        for k in 0..MAX_CMAP_RANGES + 10 {
+            many.extend(format!("<{k:08X}> <{k:08X}> 1 ").bytes());
+        }
+        assert_eq!(parse_cmap(&many).1.len(), MAX_CMAP_RANGES);
+    }
 }

From 966bd0ffce7b14be7f9575bd5454dc5a1807fdbb Mon Sep 17 00:00:00 2001
From: feraremag2680 <feraremag@gmail.com>
Date: Fri, 9 Oct 2026 15:14:19 +0200
Subject: [PATCH 043/149] tests: pin the interface language so the suite passes
 outside English (#502)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ui-egui integration tests drive the shell by its English labels, and
`i18n::system_lang` returns `Lang::EN` under `cfg!(test)` so they can. That
only covers the unit tests: an integration test links the library as it
ships, where `cfg!(test)` is off, so `PdfCraftApp::new()` leaves `language`
on `auto` and the shell is drawn in the system language. On a Spanish
Windows eleven of the test binaries fail; a French, Russian, Chinese,
Japanese, Portuguese, Czech or Telugu machine does the same. CI never sees
it because its locale is English.

`tests/theme.rs` and `tests/create.rs` already pin the option; the other
119 harnesses now do too, and the comment in `system_lang` says why, so a
test copied from an existing one keeps the line.

Also `i18n::tests::windows_display_language_query_returns_a_locale_tag`
treated the return of `windows_ui_language()` as a single tag. It is the
preferred-language list, one tag per line, as `first_supported` reads it,
so on a Windows with two or more display languages the assertion tripped
over the newline. It now checks the shape of every line.

Co-authored-by: Fernando Areán <soporte@codebit.es>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 crates/ui-egui/src/i18n/mod.rs         | 16 +++++++++-----
 crates/ui-egui/tests/accessibility.rs  |  2 ++
 crates/ui-egui/tests/actions.rs        |  2 ++
 crates/ui-egui/tests/bookmarks.rs      |  1 +
 crates/ui-egui/tests/buttons.rs        |  2 ++
 crates/ui-egui/tests/commands.rs       |  4 ++++
 crates/ui-egui/tests/comments.rs       |  2 ++
 crates/ui-egui/tests/compare.rs        |  4 ++++
 crates/ui-egui/tests/content.rs        |  1 +
 crates/ui-egui/tests/control.rs        |  1 +
 crates/ui-egui/tests/create.rs         |  5 +++++
 crates/ui-egui/tests/document_links.rs |  1 +
 crates/ui-egui/tests/editing.rs        | 12 +++++++++++
 crates/ui-egui/tests/export.rs         |  1 +
 crates/ui-egui/tests/fill_sign.rs      |  7 ++++++
 crates/ui-egui/tests/folders.rs        |  4 ++++
 crates/ui-egui/tests/forms.rs          |  4 ++++
 crates/ui-egui/tests/identity.rs       |  2 ++
 crates/ui-egui/tests/javascript.rs     |  4 ++++
 crates/ui-egui/tests/layer_actions.rs  |  1 +
 crates/ui-egui/tests/links.rs          |  1 +
 crates/ui-egui/tests/marks.rs          |  1 +
 crates/ui-egui/tests/ocr.rs            |  2 ++
 crates/ui-egui/tests/pageboxes.rs      |  1 +
 crates/ui-egui/tests/pdf_links.rs      |  1 +
 crates/ui-egui/tests/perf.rs           |  2 ++
 crates/ui-egui/tests/pickers.rs        |  1 +
 crates/ui-egui/tests/prepare.rs        |  1 +
 crates/ui-egui/tests/print.rs          |  1 +
 crates/ui-egui/tests/protect.rs        |  1 +
 crates/ui-egui/tests/recovery.rs       |  5 +++++
 crates/ui-egui/tests/redact.rs         |  1 +
 crates/ui-egui/tests/signing.rs        |  4 ++++
 crates/ui-egui/tests/stamps.rs         |  3 +++
 crates/ui-egui/tests/text_select.rs    |  1 +
 crates/ui-egui/tests/theme.rs          |  4 ++++
 crates/ui-egui/tests/ui.rs             | 30 +++++++++++++++++++++++---
 crates/ui-egui/tests/updates.rs        |  2 ++
 crates/ui-egui/tests/view.rs           | 10 +++++++++
 crates/ui-egui/tests/viewer.rs         |  4 ++++
 crates/ui-egui/tests/xfa.rs            |  1 +
 41 files changed, 145 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index c6bd7ced..8eb90b02 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -218,7 +218,9 @@ pub fn lang_from_tag(tag: &str) -> Option<Lang> {
 
 /// The system language (cached). English when it can't be determined.
 pub fn system_lang() -> Lang {
-    // Tests drive the UI by its English labels whatever the developer's locale is.
+    // Tests drive the UI by its English labels whatever the developer's locale is. This covers
+    // the unit tests; the integration tests link the library as it ships, where `cfg!(test)` is
+    // off, so each of their harnesses pins the `language` option to `en` instead.
     if cfg!(test) {
         return Lang::EN;
     }
@@ -450,10 +452,14 @@ mod tests {
     #[cfg(target_os = "windows")]
     #[test]
     fn windows_display_language_query_returns_a_locale_tag() {
-        let tag = windows_ui_language().expect("Windows should report a display language");
-        let tag = tag.trim();
-        assert!(!tag.is_empty());
-        assert!(tag.split('-').all(|part| !part.is_empty() && part.bytes().all(|b| b.is_ascii_alphanumeric())));
+        // One tag per line, as `first_supported` reads them: a machine with several display
+        // languages reports them all, so each line is checked rather than the list as a whole.
+        let list = windows_ui_language().expect("Windows should report a display language");
+        let tags: Vec<&str> = list.lines().map(str::trim).filter(|t| !t.is_empty()).collect();
+        assert!(!tags.is_empty(), "no display language in {list:?}");
+        for tag in tags {
+            assert!(tag.split('-').all(|part| !part.is_empty() && part.bytes().all(|b| b.is_ascii_alphanumeric())), "not a locale tag: {tag:?}");
+        }
     }
 
     #[test]
diff --git a/crates/ui-egui/tests/accessibility.rs b/crates/ui-egui/tests/accessibility.rs
index 93074a97..b4be8841 100644
--- a/crates/ui-egui/tests/accessibility.rs
+++ b/crates/ui-egui/tests/accessibility.rs
@@ -38,6 +38,7 @@ fn checking_fixing_skipping_and_reporting() {
     let d = dir.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("notes.pdf", None, FIXTURE.to_vec()).unwrap();
         app.export_dir_override = Some(d.to_string_lossy().into_owned());
         app
@@ -110,6 +111,7 @@ trailer << /Root 1 0 R >>
 fn setting_alternate_text_figure_by_figure() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("figures.pdf", None, FIGURES.to_vec()).unwrap();
         app
     });
diff --git a/crates/ui-egui/tests/actions.rs b/crates/ui-egui/tests/actions.rs
index a1ed7ed2..dd4da8d3 100644
--- a/crates/ui-egui/tests/actions.rs
+++ b/crates/ui-egui/tests/actions.rs
@@ -17,6 +17,7 @@ fn run_and_create_actions() {
     let d = dir.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.run_inline = true;
         app.export_dir_override = Some(d.join("out").to_string_lossy().into_owned());
         app.action_files_override = Some(vec![d.join("r.pdf").to_string_lossy().into_owned()]);
@@ -49,6 +50,7 @@ fn run_and_create_actions() {
     h.get_by_label("1. Add watermark: DRAFT");
     let saved = h.state().persist();
     let mut fresh = PdfCraftApp::new();
+    fresh.set_option("language", "en").unwrap();
     fresh.restore(&saved);
     assert_eq!(fresh.custom_actions, h.state().custom_actions);
     h.get_by_label("Start").click();
diff --git a/crates/ui-egui/tests/bookmarks.rs b/crates/ui-egui/tests/bookmarks.rs
index ea93ad35..8288b046 100644
--- a/crates/ui-egui/tests/bookmarks.rs
+++ b/crates/ui-egui/tests/bookmarks.rs
@@ -17,6 +17,7 @@ trailer << /Root 1 0 R >>
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("pages.pdf", None, PAGES.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("panel", "bookmarks").unwrap();
diff --git a/crates/ui-egui/tests/buttons.rs b/crates/ui-egui/tests/buttons.rs
index 9c9481d6..3fae947d 100644
--- a/crates/ui-egui/tests/buttons.rs
+++ b/crates/ui-egui/tests/buttons.rs
@@ -57,6 +57,7 @@ fn buttons_reset_navigate_and_print() {
     let path_str = path.to_string_lossy().into_owned();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("buttons.pdf", Some(path_str), fixture()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
@@ -124,6 +125,7 @@ fn name_hidden(h: &Harness<'static, PdfCraftApp>) -> bool {
 fn hide_actions_hide_and_show_fields() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("show-hide.pdf", None, show_hide_fixture()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index 55058b4f..27ac8304 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -35,6 +35,7 @@ fn fixture(n: usize) -> Vec<u8> {
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
         app
     });
@@ -70,6 +71,7 @@ fn every_registered_command_is_implemented() {
             continue;
         }
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         if spec.id.starts_with("form.") || spec.id == "comment.flatten" {
             app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         } else {
@@ -139,6 +141,7 @@ fn every_registered_command_is_implemented() {
 #[test]
 fn disabled_commands_explain_themselves() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     assert!(!app.execute("file.save"));
     assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("Open a document first"));
     app.open_bytes("doc.pdf", None, fixture(2)).unwrap();
@@ -206,6 +209,7 @@ fn the_open_recent_menu_lists_files_and_opens_one() {
         let path = path.clone();
         move |_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
             app.recent.push(pdfcraft_ui_egui::RecentFile { name: "recent.pdf".into(), path, pages: 2, size: 0 });
             app
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index 51ae14d7..688a962e 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -26,6 +26,7 @@ trailer << /Root 1 0 R >>
 fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("text.pdf", None, TEXT_FIXTURE.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("author", "Tester").unwrap();
@@ -539,6 +540,7 @@ fn hovering_a_comment_shows_its_author_and_text() {
     );
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("hover.pdf", None, pdf.into_bytes()).expect("opens");
         app.set_option("left", "closed").unwrap();
         // No Comments panel: the comment's text should only appear in the hover popup.
diff --git a/crates/ui-egui/tests/compare.rs b/crates/ui-egui/tests/compare.rs
index 2264f57f..a06d2b07 100644
--- a/crates/ui-egui/tests/compare.rs
+++ b/crates/ui-egui/tests/compare.rs
@@ -13,6 +13,7 @@ fn compare_two_versions() {
     let v2 = s.create_from_text("t", "Delivery within three days. Returns accepted for a week.").unwrap().to_vec();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("v1.pdf", None, v1.clone()).unwrap();
         app.open_bytes("v2.pdf", None, v2.clone()).unwrap();
         app
@@ -49,6 +50,7 @@ fn compare_panel_screenshot() {
     let v2 = s.create_from_text("t", "Delivery within three days. Returns accepted for a week.").unwrap().to_vec();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("v1.pdf", None, v1.clone()).unwrap();
         app.open_bytes("v2.pdf", None, v2.clone()).unwrap();
         app
@@ -68,6 +70,7 @@ fn pdfa_dialog_verifies_and_converts() {
     let doc = Session::new().create_from_text("t", "Keep forever").unwrap().to_vec();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("keep.pdf", None, doc.clone()).unwrap();
         app
     });
@@ -93,6 +96,7 @@ fn export_to_word_html_and_rtf() {
     let dir = std::env::temp_dir().join(format!("pdfcraft-office-ui-{}", std::process::id()));
     std::fs::create_dir_all(&dir).unwrap();
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.open_bytes("e.pdf", None, doc).unwrap();
     for ext in ["docx", "html", "rtf"] {
         let out = dir.join(format!("e.{ext}"));
diff --git a/crates/ui-egui/tests/content.rs b/crates/ui-egui/tests/content.rs
index aec39001..eefec1ce 100644
--- a/crates/ui-egui/tests/content.rs
+++ b/crates/ui-egui/tests/content.rs
@@ -9,6 +9,7 @@ use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 634fac36..4326e1e8 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -43,6 +43,7 @@ fn harness_pages(pages: usize) -> (Harness<'static, PdfCraftApp>, ControlClient)
     let s = slot.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         *s.lock().unwrap() = Some(app.attach_control(&cc.egui_ctx));
         app.open_bytes("doc.pdf", None, fixture(pages)).unwrap();
         app
diff --git a/crates/ui-egui/tests/create.rs b/crates/ui-egui/tests/create.rs
index 9f5390bd..f8f0e339 100644
--- a/crates/ui-egui/tests/create.rs
+++ b/crates/ui-egui/tests/create.rs
@@ -54,6 +54,7 @@ fn image_import_dialog_chooses_dpi_and_cancels() {
 #[test]
 fn opening_images_and_text_converts_them_to_new_pdfs() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.open_bytes("photo.png", Some("/tmp/photo.png".into()), png()).unwrap();
     app.open_bytes("notes.txt", None, b"first line\nsecond line".to_vec()).unwrap();
     app.create_from_images(vec![("a.png".into(), png()), ("b.png".into(), png())]);
@@ -77,6 +78,7 @@ fn reduce_file_size_writes_a_compact_copy() {
     let out2 = out.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("notes.txt", None, "lorem ipsum ".repeat(500).into_bytes()).unwrap();
         app.save_override = Some(out2.to_string_lossy().into_owned());
         app
@@ -100,6 +102,7 @@ fn reduce_file_size_writes_a_compact_copy() {
 fn clipboard_images_and_text_become_new_pdfs() {
     use pdfcraft_ui_egui::Clip;
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.create_from_clip(Clip::Image { width: 40, height: 20, rgba: [10u8, 20, 30, 255].repeat(40 * 20) }).unwrap();
     app.create_from_clip(Clip::Text("Pasted\nlines".into())).unwrap();
     let docs = app.session.docs();
@@ -121,6 +124,7 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
     let out2 = out.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("notes.txt", None, "lorem ipsum ".repeat(500).into_bytes()).unwrap();
         app.save_override = Some(out2.to_string_lossy().into_owned());
         app
@@ -211,6 +215,7 @@ fn multiple_files_open_as_one_document_in_the_page_grid() {
 #[test]
 fn multiple_files_that_cannot_be_converted_open_nothing() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.use_files(pdfcraft_ui_egui::FilePurpose::CreateMultiple, vec![("report.docx".into(), b"PK\x03\x04".to_vec())]);
     assert!(app.views.is_empty());
     assert!(app.toast.is_some());
diff --git a/crates/ui-egui/tests/document_links.rs b/crates/ui-egui/tests/document_links.rs
index a866a916..1951d24f 100644
--- a/crates/ui-egui/tests/document_links.rs
+++ b/crates/ui-egui/tests/document_links.rs
@@ -44,6 +44,7 @@ fn fixture() -> Vec<u8> {
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("links.pdf", None, fixture()).unwrap();
         app.set_option("left", "closed").unwrap();
         app.set_option("panel", "none").unwrap();
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 10734782..99c0ec11 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -37,6 +37,7 @@ fn fixture(n: usize) -> Vec<u8> {
 fn harness(pages: usize, setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, fixture(pages)).expect("fixture opens");
         setup(&mut app);
         app
@@ -395,6 +396,7 @@ fn save_prompt_stays_inside_the_screen_for_a_long_filename() {
                 Vliek, Ed Sutherland, -- 5, 2024 -- McGraw-Hill Education (UK) Ltd -- isbn13 97815268.pdf";
     let mut h = Harness::builder().with_size(egui::vec2(1365.0, 719.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes(name, None, fixture(1)).expect("fixture opens");
         app.close_request = Some(CloseRequest::Tab(app.views[0].id));
         app
@@ -429,6 +431,7 @@ fn save_prompt_fits_the_smallest_window_whatever_the_name() {
         let start: String = name.chars().take(10).collect();
         let mut h = Harness::builder().with_size(size).build_eframe(move |_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.open_bytes(&name, None, fixture(1)).expect("fixture opens");
             app.close_request = Some(CloseRequest::Tab(app.views[0].id));
             app
@@ -818,6 +821,7 @@ fn columns_resize_and_the_layout_is_kept_in_the_settings() {
     assert!(widths[size_index] > 120.0, "{widths:?}");
     let saved = h.state().persist();
     let mut fresh = PdfCraftApp::new();
+    fresh.set_option("language", "en").unwrap();
     fresh.restore(&saved);
     assert_eq!(fresh.combine_columns, h.state().combine_columns);
     // Malformed settings give the default layout.
@@ -1123,6 +1127,7 @@ fn save_pages_writes_what_the_grid_shows() {
     h.run_steps(4);
     assert!(!dirty(&h));
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.open_bytes("saved.pdf", None, std::fs::read(&path).unwrap()).unwrap();
     assert_eq!(texts_of(&app, 0), ["Page 1", "Page 3"]);
 }
@@ -1194,6 +1199,7 @@ fn protected_with(algorithm: pdfcraft_cos::Algorithm, user: &str, owner: &str, p
 fn password_prompt_opens_and_security_tab_reports_the_details() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("secret.pdf", None, protected("pw", "owner", -1)).unwrap();
         app
     });
@@ -1218,6 +1224,7 @@ fn password_prompt_opens_and_security_tab_reports_the_details() {
 fn restricted_documents_show_a_notice_and_block_page_changes() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("locked.pdf", None, protected("", "owner", 0b0100)).unwrap(); // opens without a password
         app.set_option("organize", "on").unwrap();
         app
@@ -1240,6 +1247,7 @@ fn restricted_documents_show_a_notice_and_block_page_changes() {
 #[test]
 fn replace_pages_dialog_swaps_page_content() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
     app.views[0].select_pages(&[1]);
     app.start_replace("other.pdf".into(), fixture(5));
@@ -1365,6 +1373,7 @@ fn source_font_fixture() -> Vec<u8> {
 fn open_source_font_fixture() -> Harness<'static, PdfCraftApp> {
     Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("fonts.pdf", None, source_font_fixture()).expect("font fixture opens");
         app
     })
@@ -1465,6 +1474,7 @@ fn double_drawn() -> Vec<u8> {
 fn editing_a_double_drawn_line_replaces_every_copy() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("bold.pdf", None, double_drawn()).expect("opens");
         app
     });
@@ -1497,6 +1507,7 @@ fn editing_existing_images_on_the_page() {
     image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("picture.png", None, png.clone()).expect("opens");
         app
     });
@@ -1622,6 +1633,7 @@ fn dragging_a_paragraph_moves_it_and_its_edge_rewraps_it() {
 fn pages_panel(pages: usize) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, fixture(pages)).expect("fixture opens");
         app.set_option("panel", "pages").unwrap();
         app
diff --git a/crates/ui-egui/tests/export.rs b/crates/ui-egui/tests/export.rs
index f90c0097..4b5a6a77 100644
--- a/crates/ui-egui/tests/export.rs
+++ b/crates/ui-egui/tests/export.rs
@@ -20,6 +20,7 @@ fn export_dialogs_write_images_and_text() {
     let d = dir.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, FIXTURE.to_vec()).unwrap();
         app.export_dir_override = Some(d.to_string_lossy().into_owned());
         app
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 54fa780d..7888555e 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -21,6 +21,7 @@ fn harness_bytes(fixture: &[u8]) -> Harness<'static, PdfCraftApp> {
     let fixture = fixture.to_vec();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, fixture.clone()).unwrap();
         app.set_option("left", "closed").unwrap();
         app.set_option("zoom", "150").unwrap();
@@ -129,6 +130,7 @@ fn signing_draws_a_signature_once_and_places_it() {
     // The signature is remembered (persisted with the app's settings).
     let saved = h.state().persist();
     let mut again = PdfCraftApp::new();
+    again.set_option("language", "en").unwrap();
     again.restore(&saved);
     assert!(again.signature.is_some());
 }
@@ -160,6 +162,7 @@ fn typed_signatures_and_initials() {
     // Both are remembered.
     let saved = h.state().persist();
     let mut again = PdfCraftApp::new();
+    again.set_option("language", "en").unwrap();
     again.restore(&saved);
     assert_eq!(again.signature, h.state().signature);
     assert_eq!(again.initials, Some(pdfcraft_ui_egui::fill_sign::SavedSig::Typed("GH".into())));
@@ -214,6 +217,7 @@ fn changing_saved_signatures_and_initials_preserves_placed_marks() {
     click(&mut h, 40.0, 100.0);
     assert_eq!(items(&h).len(), 3);
     let mut again = PdfCraftApp::new();
+    again.set_option("language", "en").unwrap();
     again.restore(&h.state().persist());
     assert_eq!(again.signature, Some(SavedSig::Typed("Grace Hopper".into())));
     assert_eq!(again.initials, Some(SavedSig::Typed("GH".into())));
@@ -269,6 +273,7 @@ fn saved_signature_cards_remove_and_add_without_changing_the_document() {
     assert_eq!(h.state().signature, None);
     assert_eq!(h.state().initials, Some(SavedSig::Typed("AL".into())));
     let mut again = PdfCraftApp::new();
+    again.set_option("language", "en").unwrap();
     again.restore(&h.state().persist());
     assert_eq!(again.signature, None, "removal survives restart");
     h.get_by_label("Add signature").click();
@@ -366,6 +371,7 @@ fn image_signatures_and_initials_can_be_imported_placed_and_remembered() {
     let settings = state.persist();
     assert!(!settings.contains(&path.to_string_lossy().to_string()), "only the image is saved, never its source path");
     let mut again = PdfCraftApp::new();
+    again.set_option("language", "en").unwrap();
     again.restore(&settings);
     assert_eq!(again.signature, state.signature);
     assert_eq!(again.initials, state.initials);
@@ -800,6 +806,7 @@ fn image_import_cancel_clear_and_errors_preserve_saved_signatures() {
     assert!(h.state().signature_draft.image.is_none());
     // Malformed settings are ignored while legacy typed/drawn values still restore.
     let mut again = PdfCraftApp::new();
+    again.set_option("language", "en").unwrap();
     again.restore(r#"{"signature_text":"Ada","signature_image":{"Image":"bm90IGFuIGltYWdl"},"initials":{"Image":"%%%"}}"#);
     assert_eq!(again.signature, Some(SavedSig::Typed("Ada".into())));
     assert!(again.initials.is_none());
diff --git a/crates/ui-egui/tests/folders.rs b/crates/ui-egui/tests/folders.rs
index bfc5196d..0f9fe80b 100644
--- a/crates/ui-egui/tests/folders.rs
+++ b/crates/ui-egui/tests/folders.rs
@@ -51,6 +51,7 @@ impl Drop for TempFolder {
 fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1400.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         // List folders on the frame that asks, not on a worker thread.
         app.run_inline = true;
         setup(&mut app);
@@ -144,8 +145,10 @@ fn pinned_folders_survive_a_restart() {
     let dir = TempFolder::new("restart");
     let folder = dir.path();
     let mut a = PdfCraftApp::new();
+    a.set_option("language", "en").unwrap();
     assert!(a.pin_folder(&folder));
     let mut b = PdfCraftApp::new();
+    b.set_option("language", "en").unwrap();
     b.restore(&a.persist());
     assert_eq!(b.pinned.folders, [folder]);
     b.restore("{\"pinned_folders\": [5, \"relative/path\"]}");
@@ -197,6 +200,7 @@ fn show_more_reveals_the_older_pdfs() {
 #[test]
 fn pinning_is_limited_and_never_duplicates() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     assert!(!app.pin_folder("relative/scans"), "a relative path is refused");
     let root = if cfg!(windows) { "C:\\" } else { "/" };
     let folders: Vec<String> = (0..MAX_PINNED).map(|i| Path::new(root).join(format!("pinned-{i}")).to_string_lossy().into_owned()).collect();
diff --git a/crates/ui-egui/tests/forms.rs b/crates/ui-egui/tests/forms.rs
index 1fde4e1e..f4f3552d 100644
--- a/crates/ui-egui/tests/forms.rs
+++ b/crates/ui-egui/tests/forms.rs
@@ -6,6 +6,7 @@ use pdfcraft_ui_egui::PdfCraftApp;
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app.set_option("left", "closed").unwrap();
         // The whole 300×400 pt page on screen.
@@ -148,6 +149,7 @@ fn date_fields_offer_a_calendar() {
 /// The value of `name` in a saved PDF, read back by opening it in a fresh app.
 fn saved_value(path: &std::path::Path, name: &str) -> Vec<String> {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.open_bytes("saved.pdf", None, std::fs::read(path).unwrap()).unwrap();
     app.session.get(app.views[0].id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone()
 }
@@ -310,6 +312,7 @@ fn a_rejected_value_keeps_the_typing_and_stops_the_save() {
     let out = dir.join("saved.pdf");
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("order.pdf", None, validated_form()).unwrap();
         app.set_option("left", "closed").unwrap();
         app.set_option("zoom", "150").unwrap();
@@ -356,6 +359,7 @@ fn a_value_refused_on_enter_keeps_save_in_the_same_frame_from_running() {
     let out = dir.join("saved.pdf");
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("order.pdf", None, validated_form()).unwrap();
         app.set_option("left", "closed").unwrap();
         app.set_option("zoom", "150").unwrap();
diff --git a/crates/ui-egui/tests/identity.rs b/crates/ui-egui/tests/identity.rs
index 87e6a1a7..9a4e3c38 100644
--- a/crates/ui-egui/tests/identity.rs
+++ b/crates/ui-egui/tests/identity.rs
@@ -21,6 +21,7 @@ trailer << /Root 1 0 R >>
 fn the_identity_name_signs_new_comments_and_is_remembered() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, PDF.to_vec()).expect("opens");
         app.set_option("author", "Tester").unwrap();
         app.set_option("dialog", "preferences").unwrap();
@@ -62,6 +63,7 @@ fn the_identity_name_signs_new_comments_and_is_remembered() {
     assert_eq!(author(&h).as_deref(), Some("Grace Hopper"));
     // It survives a restart; an empty or missing name keeps the default, and a huge one is cut.
     let mut restored = PdfCraftApp::new();
+    restored.set_option("language", "en").unwrap();
     restored.restore(&h.state().persist());
     assert_eq!(restored.comment_prefs.author, "Grace Hopper");
     restored.restore(r#"{"author": "  "}"#);
diff --git a/crates/ui-egui/tests/javascript.rs b/crates/ui-egui/tests/javascript.rs
index 19ad05a5..a5c5a6af 100644
--- a/crates/ui-egui/tests/javascript.rs
+++ b/crates/ui-egui/tests/javascript.rs
@@ -33,6 +33,7 @@ fn form() -> Vec<u8> {
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, form()).unwrap();
         app
     });
@@ -98,6 +99,7 @@ fn document_scripts_and_preferences() {
     assert!(!h.state().session.javascript());
     let saved = h.state().persist();
     let mut fresh = PdfCraftApp::new();
+    fresh.set_option("language", "en").unwrap();
     fresh.restore(&saved);
     assert!(!fresh.session.javascript(), "the preference is remembered");
 }
@@ -108,6 +110,7 @@ fn merge_data_files_into_a_spreadsheet() {
     std::fs::create_dir_all(&dir).unwrap();
     let out = dir.join("report.csv");
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.save_override = Some(out.to_string_lossy().into_owned());
     app.merge_data_files(vec![("form.pdf".into(), form())]);
     assert_eq!(std::fs::read_to_string(&out).unwrap(), "greeting\n\n");
@@ -121,6 +124,7 @@ fn prepare_a_form_detects_fields_on_a_paper_form() {
     let paper = pdfcraft_engine::Session::new().create_from_text("t", "Name: ____________________\n\nPhone: ____________________").unwrap().to_vec();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("paper.pdf", None, paper.clone()).unwrap();
         app
     });
diff --git a/crates/ui-egui/tests/layer_actions.rs b/crates/ui-egui/tests/layer_actions.rs
index efa9a1e3..95b35ff2 100644
--- a/crates/ui-egui/tests/layer_actions.rs
+++ b/crates/ui-egui/tests/layer_actions.rs
@@ -38,6 +38,7 @@ fn fixture() -> Vec<u8> {
 fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("layers.pdf", None, fixture()).unwrap();
         app.set_option("zoom", "150").unwrap();
         setup(&mut app);
diff --git a/crates/ui-egui/tests/links.rs b/crates/ui-egui/tests/links.rs
index 9b5e3215..d3ee7819 100644
--- a/crates/ui-egui/tests/links.rs
+++ b/crates/ui-egui/tests/links.rs
@@ -9,6 +9,7 @@ use pdfcraft_ui_egui::{Dialog, PdfCraftApp};
 fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         setup(&mut app);
         app
     });
diff --git a/crates/ui-egui/tests/marks.rs b/crates/ui-egui/tests/marks.rs
index b19607c4..0a216ba5 100644
--- a/crates/ui-egui/tests/marks.rs
+++ b/crates/ui-egui/tests/marks.rs
@@ -17,6 +17,7 @@ trailer << /Root 1 0 R >>
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, FIXTURE.to_vec()).unwrap();
         app
     });
diff --git a/crates/ui-egui/tests/ocr.rs b/crates/ui-egui/tests/ocr.rs
index 8e9e9774..a62661fd 100644
--- a/crates/ui-egui/tests/ocr.rs
+++ b/crates/ui-egui/tests/ocr.rs
@@ -19,6 +19,7 @@ fn scan() -> Vec<u8> {
 fn recognize_text_dialog_adds_searchable_text() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("scan.pdf", None, scan()).unwrap();
         app.run_inline = true;
         app
@@ -52,6 +53,7 @@ fn recognize_text_in_multiple_files_writes_searchable_copies() {
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.run_inline = true;
     app.export_dir_override = Some(dir.to_string_lossy().into_owned());
     app.use_files(pdfcraft_ui_egui::FilePurpose::Ocr, vec![("one.pdf".into(), scan()), ("two.pdf".into(), scan())]);
diff --git a/crates/ui-egui/tests/pageboxes.rs b/crates/ui-egui/tests/pageboxes.rs
index 6ad018b7..865f1277 100644
--- a/crates/ui-egui/tests/pageboxes.rs
+++ b/crates/ui-egui/tests/pageboxes.rs
@@ -15,6 +15,7 @@ trailer << /Root 1 0 R >>
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, FIXTURE.to_vec()).unwrap();
         app.set_option("left", "closed").unwrap();
         app.set_option("zoom", "150").unwrap();
diff --git a/crates/ui-egui/tests/pdf_links.rs b/crates/ui-egui/tests/pdf_links.rs
index 8095ec10..a149b3d3 100644
--- a/crates/ui-egui/tests/pdf_links.rs
+++ b/crates/ui-egui/tests/pdf_links.rs
@@ -10,6 +10,7 @@ fn harness() -> Harness<'static, PdfCraftApp> {
     // 60 fps steps, so two clicks fall inside egui's double-click window.
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
diff --git a/crates/ui-egui/tests/perf.rs b/crates/ui-egui/tests/perf.rs
index b4a8e45d..f30be048 100644
--- a/crates/ui-egui/tests/perf.rs
+++ b/crates/ui-egui/tests/perf.rs
@@ -100,6 +100,7 @@ fn scrolling_a_500_page_document_stays_within_the_frame_budget() {
     let t0 = std::time::Instant::now();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("big.pdf", None, bytes).expect("opens");
         app
     });
@@ -124,6 +125,7 @@ fn panels_with_hundreds_of_items_stay_within_the_frame_budget() {
         let b = bytes.clone();
         let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.open_bytes("big.pdf", None, b).expect("opens");
             app.set_option("panel", panel).unwrap();
             app
diff --git a/crates/ui-egui/tests/pickers.rs b/crates/ui-egui/tests/pickers.rs
index df8b1ae5..fb0103f4 100644
--- a/crates/ui-egui/tests/pickers.rs
+++ b/crates/ui-egui/tests/pickers.rs
@@ -45,6 +45,7 @@ fn harness(docs: &[usize]) -> Harness<'static, PdfCraftApp> {
     let docs = docs.to_vec();
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         for (i, n) in docs.iter().enumerate() {
             app.open_bytes(&format!("doc{i}.pdf"), None, fixture(*n)).unwrap();
         }
diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index 3b1a5dc3..5f011fa8 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -9,6 +9,7 @@ use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
diff --git a/crates/ui-egui/tests/print.rs b/crates/ui-egui/tests/print.rs
index 94ab37ff..53ad1b86 100644
--- a/crates/ui-egui/tests/print.rs
+++ b/crates/ui-egui/tests/print.rs
@@ -7,6 +7,7 @@ use pdfcraft_ui_egui::{Dialog, PdfCraftApp};
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app
     });
diff --git a/crates/ui-egui/tests/protect.rs b/crates/ui-egui/tests/protect.rs
index 714d5095..903b1510 100644
--- a/crates/ui-egui/tests/protect.rs
+++ b/crates/ui-egui/tests/protect.rs
@@ -14,6 +14,7 @@ trailer << /Root 1 0 R >>
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, FIXTURE.to_vec()).unwrap();
         app
     });
diff --git a/crates/ui-egui/tests/recovery.rs b/crates/ui-egui/tests/recovery.rs
index 6f59bb16..8cc9eebf 100644
--- a/crates/ui-egui/tests/recovery.rs
+++ b/crates/ui-egui/tests/recovery.rs
@@ -46,6 +46,7 @@ fn files_in(s: &RecoveryStore) -> usize {
 /// A session that edits a document, autosaves, and then "crashes" (is dropped).
 fn crashed_session(s: &RecoveryStore, bytes: Vec<u8>, password: Option<&str>, path: Option<&str>) {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.enable_recovery(s.clone());
     match password {
         Some(pw) => {
@@ -62,6 +63,7 @@ fn crashed_session(s: &RecoveryStore, bytes: Vec<u8>, password: Option<&str>, pa
 fn harness(s: RecoveryStore) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.enable_recovery(s);
         app
     });
@@ -103,6 +105,7 @@ fn discarding_removes_the_autosaves() {
 fn saving_or_closing_clears_the_entry_and_nothing_is_written_for_clean_documents() {
     let s = store("save");
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.enable_recovery(s.clone());
     app.open_bytes("a.pdf", None, fixture(2)).unwrap();
     app.autosave_now();
@@ -130,6 +133,7 @@ fn quitting_cleanly_leaves_nothing_behind() {
         let s = s.clone();
         move |_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.enable_recovery(s);
             app.open_bytes("q.pdf", None, fixture(2)).unwrap();
             app
@@ -206,6 +210,7 @@ fn control_click_effects_are_visible_when_the_reply_arrives() {
     let (slot2, s2) = (slot.clone(), s.clone());
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         *slot2.lock().unwrap() = Some(app.attach_control(&cc.egui_ctx));
         app.enable_recovery(s2);
         app
diff --git a/crates/ui-egui/tests/redact.rs b/crates/ui-egui/tests/redact.rs
index b2037788..8351b597 100644
--- a/crates/ui-egui/tests/redact.rs
+++ b/crates/ui-egui/tests/redact.rs
@@ -9,6 +9,7 @@ use pdfcraft_ui_egui::{Dialog, PdfCraftApp};
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
diff --git a/crates/ui-egui/tests/signing.rs b/crates/ui-egui/tests/signing.rs
index 22f82c8d..a777517e 100644
--- a/crates/ui-egui/tests/signing.rs
+++ b/crates/ui-egui/tests/signing.rs
@@ -30,6 +30,7 @@ fn dir() -> std::path::PathBuf {
 fn harness(dir: std::path::PathBuf) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("contract.pdf", None, FIXTURE.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.export_dir_override = Some(dir.to_string_lossy().into_owned());
@@ -155,6 +156,7 @@ fn drawing_a_signature_creating_an_id_signing_and_trusting() {
     // Trusted certificates and the ID list persist.
     let saved = s.persist();
     let mut fresh = PdfCraftApp::new();
+    fresh.set_option("language", "en").unwrap();
     fresh.restore(&saved);
     assert_eq!((fresh.digital_ids.len(), fresh.session.trusted_certificates().len()), (1, 1));
 }
@@ -248,6 +250,7 @@ fn clicking_an_empty_signature_field_signs_it() {
 #[test]
 fn os_store_identities_are_not_persisted() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     for path in ["windows:Store signer", "keychain:Store signer", "file-id.p12"] {
         app.digital_ids.push(pdfcraft_ui_egui::DigitalIdEntry {
             path: path.into(),
@@ -262,6 +265,7 @@ fn os_store_identities_are_not_persisted() {
     assert_eq!(settings["digital_ids"].as_array().unwrap().len(), 1);
     assert_eq!(settings["digital_ids"][0]["path"], "file-id.p12");
     let mut restored = PdfCraftApp::new();
+    restored.set_option("language", "en").unwrap();
     restored.restore(&saved);
     assert_eq!(restored.digital_ids.len(), 1);
     assert_eq!(restored.digital_ids[0].path, "file-id.p12");
diff --git a/crates/ui-egui/tests/stamps.rs b/crates/ui-egui/tests/stamps.rs
index 3665f187..ddb24e6a 100644
--- a/crates/ui-egui/tests/stamps.rs
+++ b/crates/ui-egui/tests/stamps.rs
@@ -8,6 +8,7 @@ use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
 fn choosing_and_placing_stamps() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
@@ -47,6 +48,7 @@ fn choosing_and_placing_stamps() {
 fn creating_placing_and_keeping_custom_stamps() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
@@ -88,6 +90,7 @@ fn creating_placing_and_keeping_custom_stamps() {
     // The library is kept with the app's settings.
     let saved = s.persist();
     let mut again = PdfCraftApp::new();
+    again.set_option("language", "en").unwrap();
     again.restore(&saved);
     assert_eq!(again.custom_stamps.len(), 1);
     assert_eq!((again.custom_stamps[0].category.as_str(), again.custom_stamps[0].name.as_str()), ("Company", "logo"));
diff --git a/crates/ui-egui/tests/text_select.rs b/crates/ui-egui/tests/text_select.rs
index c2beef92..683f391c 100644
--- a/crates/ui-egui/tests/text_select.rs
+++ b/crates/ui-egui/tests/text_select.rs
@@ -29,6 +29,7 @@ trailer << /Root 1 0 R >>
 fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> (Harness<'static, PdfCraftApp>, Pos2) {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("lines.pdf", None, two_lines()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("author", "Tester").unwrap();
diff --git a/crates/ui-egui/tests/theme.rs b/crates/ui-egui/tests/theme.rs
index 9a90181f..2b16796f 100644
--- a/crates/ui-egui/tests/theme.rs
+++ b/crates/ui-egui/tests/theme.rs
@@ -86,13 +86,16 @@ fn toolbar_and_view_menu_share_three_state_preferences() {
 fn saved_preferences_restore_with_legacy_light_dark_settings() {
     for (value, preference) in [("light", ThemePreference::Light), ("dark", ThemePreference::Dark), ("system", ThemePreference::System)] {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.set_option("theme", value).unwrap();
         let saved = app.persist();
         let mut restored = PdfCraftApp::new();
+        restored.set_option("language", "en").unwrap();
         restored.restore(&saved);
         assert_eq!(restored.theme_preference, preference);
     }
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.restore(r#"{"theme":"Dark"}"#);
     assert_eq!(app.theme_preference, ThemePreference::Dark);
     assert_eq!(app.theme, ThemeKind::Dark);
@@ -107,6 +110,7 @@ fn saved_preferences_restore_with_legacy_light_dark_settings() {
 #[test]
 fn commands_and_options_apply_before_the_first_frame() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.run_command("view.theme.dark");
     assert_eq!(app.theme_preference, ThemePreference::Dark);
     assert_eq!(app.theme, ThemeKind::Dark);
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 5299c664..ecc7a21a 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -20,6 +20,7 @@ trailer << /Root 1 0 R >>
 fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         setup(&mut app);
         app
     });
@@ -75,6 +76,7 @@ fn a_tab_with_an_arabic_file_name_keeps_its_logical_accessible_name() {
 #[test]
 fn garbage_input_is_rejected_without_panicking() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     assert!(app.open_bytes("junk.pdf", None, b"this is not a pdf".to_vec()).is_err());
     assert!(app.open_bytes("empty.pdf", None, Vec::new()).is_err());
     let mut truncated = FIXTURE.to_vec();
@@ -173,9 +175,11 @@ fn drag_selects_text_and_copy_returns_it() {
 #[test]
 fn persistence_round_trips_and_tolerates_garbage() {
     let mut a = PdfCraftApp::new();
+    a.set_option("language", "en").unwrap();
     a.set_option("theme", "dark").unwrap();
     let json = a.persist();
     let mut b = PdfCraftApp::new();
+    b.set_option("language", "en").unwrap();
     b.restore(&json);
     assert_eq!(b.theme, pdfcraft_ui_egui::theme::ThemeKind::Dark);
     b.restore("{not json");
@@ -246,7 +250,11 @@ impl egui::DroppedFile for Dropped {
 
 #[test]
 fn dropping_a_pdf_on_the_window_opens_it() {
-    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| PdfCraftApp::new());
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app
+    });
     h.run_steps(3);
     assert!(h.state().views.is_empty());
     let file: egui::DroppedFileHandle = std::sync::Arc::new(Dropped { path: "dropped.pdf".into(), bytes: FIXTURE.to_vec() });
@@ -258,7 +266,11 @@ fn dropping_a_pdf_on_the_window_opens_it() {
 
 #[test]
 fn pdfs_dropped_on_the_combine_tab_join_its_list() {
-    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| PdfCraftApp::new());
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app
+    });
     h.run_steps(3);
     h.state_mut().execute("page.combine");
     h.run_steps(2);
@@ -284,7 +296,11 @@ fn a_folder_dropped_on_the_combine_tab_adds_its_pdfs() {
     std::fs::create_dir_all(dir.join("inner")).unwrap();
     std::fs::write(dir.join("one.pdf"), FIXTURE).unwrap();
     std::fs::write(dir.join("inner").join("two.pdf"), FIXTURE).unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| PdfCraftApp::new());
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app
+    });
     h.run_steps(3);
     h.state_mut().execute("page.combine");
     h.run_steps(2);
@@ -321,9 +337,11 @@ fn default_workspace_mode_persists_and_tolerates_invalid_settings() {
     use pdfcraft_ui_egui::Mode;
     for mode in [Mode::AllTools, Mode::Read, Mode::Edit, Mode::Convert, Mode::Sign] {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.default_mode = mode;
         app.set_option("mode", "sign").unwrap();
         let mut restored = PdfCraftApp::new();
+        restored.set_option("language", "en").unwrap();
         restored.restore(&app.persist());
         assert_eq!(restored.default_mode, mode);
         restored.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).unwrap();
@@ -331,6 +349,7 @@ fn default_workspace_mode_persists_and_tolerates_invalid_settings() {
     }
     for json in ["{}", "{not json", r#"{"default_mode": null}"#, r#"{"default_mode": 5}"#, r#"{"default_mode": "unknown"}"#] {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.restore(json);
         assert_eq!(app.default_mode, Mode::AllTools);
         app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).unwrap();
@@ -342,6 +361,7 @@ fn default_workspace_mode_persists_and_tolerates_invalid_settings() {
 fn newly_opened_pdfs_use_the_default_workspace() {
     use pdfcraft_ui_egui::{LeftPanel, Mode};
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.restore(r#"{"default_mode": "edit"}"#);
     app.open_bytes("first.pdf", None, FIXTURE.to_vec()).unwrap();
     assert_eq!(app.mode, Mode::Edit);
@@ -365,6 +385,7 @@ fn explicit_mode_overrides_default_before_and_after_open() {
     for before in [false, true] {
         for (value, mode) in [("all", Mode::AllTools), ("read", Mode::Read), ("edit", Mode::Edit), ("convert", Mode::Convert), ("sign", Mode::Sign)] {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.default_mode = Mode::Read;
             if before {
                 app.set_option("mode", value).unwrap();
@@ -403,6 +424,7 @@ fn preferences_selects_default_workspace_for_next_open() {
 fn explicit_mode_preserves_independent_tool_and_panel_options() {
     use pdfcraft_ui_egui::LeftPanel;
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.set_option("tool", "export").unwrap();
     app.set_option("left", "closed").unwrap();
     app.set_option("mode", "edit").unwrap();
@@ -418,6 +440,7 @@ fn opening_a_pdf_keeps_a_closed_left_panel_and_the_chosen_tool() {
     use pdfcraft_ui_egui::{LeftPanel, Mode};
     // `--left closed` without `--mode`, default workspace Edit: the panel stays closed.
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.default_mode = Mode::Edit;
     app.set_option("left", "closed").unwrap();
     app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).unwrap();
@@ -425,6 +448,7 @@ fn opening_a_pdf_keeps_a_closed_left_panel_and_the_chosen_tool() {
     assert!(!app.left_open);
     // Default All Tools: opening another PDF leaves the tool panel the user picked.
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.set_option("tool", "export").unwrap();
     app.open_bytes("first.pdf", None, FIXTURE.to_vec()).unwrap();
     app.open_bytes("second.pdf", None, FIXTURE.to_vec()).unwrap();
diff --git a/crates/ui-egui/tests/updates.rs b/crates/ui-egui/tests/updates.rs
index 141c2781..c06bd8b2 100644
--- a/crates/ui-egui/tests/updates.rs
+++ b/crates/ui-egui/tests/updates.rs
@@ -15,6 +15,7 @@ fn source(answer: Result<&str, &str>) -> UpdateSource {
 fn harness(answer: Result<&str, &str>) -> Harness<'static, PdfCraftApp> {
     Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.update_source = Some(source(answer));
         app
     })
@@ -78,6 +79,7 @@ fn nothing_is_asked_until_the_user_checks() {
     let counted = calls.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         // Settings from a build that had the startup option are ignored.
         app.restore(r#"{"check_updates_at_start": true}"#);
         let counted = counted.clone();
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index aedeff82..2d8881ea 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -35,6 +35,7 @@ fn harness(options: &'static [(&'static str, &'static str)]) -> Harness<'static,
 fn harness_stepping(step_dt: f32, options: &'static [(&'static str, &'static str)]) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(step_dt).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("pages.pdf", None, PAGES.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("panel", "none").unwrap();
@@ -63,6 +64,7 @@ trailer << /Root 1 0 R >>
 fn mixed_harness(options: &'static [(&'static str, &'static str)]) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("mixed.pdf", None, MIXED.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("panel", "none").unwrap();
@@ -230,6 +232,7 @@ fn layout_option_rejects_typos() {
 #[test]
 fn view_options_without_a_document() {
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     assert!(app.set_option("default-layout", "single").is_ok(), "the default needs no document");
     assert_eq!(app.view_defaults.layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
     assert!(app.set_option("cover", "on").is_err(), "cover needs an open document");
@@ -251,6 +254,7 @@ fn default_page_display_is_used_for_new_documents() {
     // Persisted preferences survive a restart.
     let saved = h.state().persist();
     let mut fresh = PdfCraftApp::new();
+    fresh.set_option("language", "en").unwrap();
     fresh.restore(&saved);
     assert_eq!(fresh.view_defaults.layout, PageLayout::Single);
     // Garbage keeps the previous default; casing is forgiven; legacy files lack the key.
@@ -259,6 +263,7 @@ fn default_page_display_is_used_for_new_documents() {
     fresh.restore(r#"{"default_layout":"TWO-UP"}"#);
     assert_eq!(fresh.view_defaults.layout, PageLayout::TwoUp);
     let mut legacy = PdfCraftApp::new();
+    legacy.set_option("language", "en").unwrap();
     legacy.restore("{}");
     assert_eq!(legacy.view_defaults.layout, PageLayout::Continuous);
 }
@@ -287,6 +292,7 @@ fn default_zoom_is_used_for_new_documents() {
     // Saved settings keep it, and garbage leaves it alone.
     let saved = h.state().persist();
     let mut fresh = PdfCraftApp::new();
+    fresh.set_option("language", "en").unwrap();
     fresh.restore(&saved);
     fresh.restore(r#"{"default_zoom":"bogus"}"#);
     fresh.open_bytes("again.pdf", None, PAGES.to_vec()).expect("opens");
@@ -463,6 +469,7 @@ trailer << /Root 1 0 R >>
 fn form_harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, FORM.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app
@@ -531,6 +538,7 @@ fn required_radio_buttons_get_a_round_red_border() {
     let _gpu = gpu();
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("radios.pdf", None, RADIOS.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("panel", "none").unwrap();
@@ -575,6 +583,7 @@ fn field_highlighting_is_remembered() {
     assert!(h.state().views[1].highlight_fields, "the next document opens highlighted");
     let saved = h.state().persist();
     let mut next = PdfCraftApp::new();
+    next.set_option("language", "en").unwrap();
     next.restore(&saved);
     next.open_bytes("form.pdf", None, FORM.to_vec()).expect("opens");
     assert!(next.views[0].highlight_fields, "and so does the next session");
@@ -666,6 +675,7 @@ trailer << /Root 1 0 R >>
         let bytes = pdf.clone();
         let mut h = Harness::builder().with_size(egui::vec2(1000.0, 800.0)).with_pixels_per_point(ppp).build_eframe(move |_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.open_bytes("lines.pdf", None, bytes.clone()).expect("opens");
             app.set_option("left", "closed").unwrap();
             app.set_option("panel", "none").unwrap();
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index 39802d6f..67dcecb2 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -34,6 +34,7 @@ fn fixture(n: usize) -> Vec<u8> {
 fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("a.pdf", None, fixture(5)).unwrap();
         app.open_bytes("b.pdf", None, fixture(2)).unwrap();
         app
@@ -213,6 +214,7 @@ trailer << /Root 1 0 R >>
         .to_vec();
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("damaged.pdf", None, damaged.clone()).unwrap();
         app
     });
@@ -250,6 +252,7 @@ fn initial_view_is_edited_and_honoured_on_open() {
     // Opening the saved file follows it.
     let bytes = s.session.save_bytes(id).unwrap();
     let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
     app.open_bytes("again.pdf", None, bytes.to_vec()).unwrap();
     let view = &app.views[0];
     assert_eq!((view.current, view.cover, app.right), (1, true, Some(pdfcraft_ui_egui::RightPanel::Bookmarks)));
@@ -559,6 +562,7 @@ fn page_down_steps_every_spread_when_several_fit_on_screen() {
         let bytes = sized_fixture(&sizes);
         let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.open_bytes("book.pdf", None, bytes).unwrap();
             app
         });
diff --git a/crates/ui-egui/tests/xfa.rs b/crates/ui-egui/tests/xfa.rs
index f03d12c4..587972d5 100644
--- a/crates/ui-egui/tests/xfa.rs
+++ b/crates/ui-egui/tests/xfa.rs
@@ -36,6 +36,7 @@ const XFA_PACKET: &str = "<< /Length 52 >>\nstream\n<xdp:xdp xmlns:xdp=\"http://
 fn open(bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, bytes).expect("opens");
         app
     });

From 7d9cc53472b703729e8ab7cd8bc35a93ba78aa2f Mon Sep 17 00:00:00 2001
From: Hal Goff <henry@tollitt.com>
Date: Fri, 9 Oct 2026 14:14:27 +0100
Subject: [PATCH 044/149] Issue #225: a closed Comments panel stays closed when
 picking comment tools (#501)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Picking any comment tool opened the Comments panel whenever no right panel
was open, so closing it was undone by the next tool switch. Now closing
Comments (its close button or the rail icon) is remembered, across restarts,
and comment tools leave it closed until the user opens it again (rail, View
menu, Comments ▸ list, or a Reply action). Switching to or closing another
panel doesn't count. Opening a document with comments still shows them, as
Acrobat does.


Claude-Session: https://claude.ai/code/session_01VNJqS2dEQawHJn1qTRJiKp

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs     |  6 ++++-
 crates/ui-egui/src/chrome.rs     |  4 ++--
 crates/ui-egui/src/commands.rs   |  6 ++---
 crates/ui-egui/src/lib.rs        | 19 +++++++++++++++
 crates/ui-egui/src/panels.rs     |  2 +-
 crates/ui-egui/tests/comments.rs | 40 ++++++++++++++++++++++++++++++++
 6 files changed, 70 insertions(+), 7 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 4030d7c6..065d01fe 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2001,7 +2001,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let field_props = field_props.then(|| view.prepare.selected.clone()).flatten();
     match canvas_action {
         Some(comments::CanvasAction::Edit(e)) => view.pending_edit = Some(*e),
-        Some(comments::CanvasAction::OpenComments) => app.right = Some(RightPanel::Comments),
+        // `choose_right_panel` would borrow all of `app` while `view` is held; same effect.
+        Some(comments::CanvasAction::OpenComments) => {
+            app.right = Some(RightPanel::Comments);
+            app.comments_panel_closed = false;
+        }
         Some(comments::CanvasAction::Properties(p, i)) => open_props = Some((p, i)),
         None => {}
     }
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index 41df36e7..bc4a717a 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -240,7 +240,7 @@ fn main_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     (RightPanel::Compare, tl!("Compare")),
                 ] {
                     if ui.radio(app.right == Some(p), tl!(label)).clicked() {
-                        app.right = Some(p);
+                        app.choose_right_panel(Some(p));
                     }
                 }
             });
@@ -278,7 +278,7 @@ pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     ui.painter().circle_filled(c, 3.0, t.accent);
                 }
                 if r.clicked() {
-                    app.right = if selected { None } else { Some(panel) };
+                    app.choose_right_panel(if selected { None } else { Some(panel) });
                 }
             };
             rail_button(ui, RightPanel::Comments, "message-square-text", "Comments", has_comments);
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 6d3f97f9..126b7f31 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -180,13 +180,13 @@ impl PdfCraftApp {
             "view.theme.system" => self.set_theme_preference(ThemePreference::System),
             "view.theme.light" => self.set_theme_preference(ThemePreference::Light),
             "view.theme.dark" => self.set_theme_preference(ThemePreference::Dark),
-            "comment.list" => self.right = Some(RightPanel::Comments),
+            "comment.list" => self.choose_right_panel(Some(RightPanel::Comments)),
             tool if crate::comments::CommentTool::from_command(tool).is_some() => {
                 let Some(tool) = crate::comments::CommentTool::from_command(tool) else { return false };
                 self.comment_prefs.group_tool[tool.group()] = tool;
                 self.quick_tool = crate::QuickTool::Comment(tool);
-                // Acrobat opens the Comments panel with the commenting tools.
-                if self.right.is_none() {
+                // Acrobat opens the Comments panel with the commenting tools, unless the user closed it.
+                if self.right.is_none() && !self.comments_panel_closed {
                     self.right = Some(RightPanel::Comments);
                 }
                 // A text selection made before picking a markup tool is marked right away.
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index db6137b4..91f2edd8 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -356,6 +356,9 @@ pub struct PdfCraftApp {
     pub left: LeftPanel,
     pub left_open: bool,
     pub right: Option<RightPanel>,
+    /// The user closed the Comments panel, so picking a comment tool leaves it closed until they
+    /// open it again (#225). Remembered across restarts.
+    pub comments_panel_closed: bool,
     pub quick_tool: QuickTool,
     /// The tool to go back to when Space, held for a temporary Hand, is released.
     space_hand: Option<QuickTool>,
@@ -602,6 +605,7 @@ impl PdfCraftApp {
             left: LeftPanel::AllTools,
             left_open: true,
             right: None,
+            comments_panel_closed: false,
             quick_tool: QuickTool::Select,
             space_hand: None,
             comment_prefs: Default::default(),
@@ -1165,6 +1169,17 @@ impl PdfCraftApp {
         };
     }
 
+    /// Opens a right panel, or closes it with `None`, because the user chose to. Closing Comments
+    /// keeps comment tools from reopening it; opening it again lets them (#225).
+    pub fn choose_right_panel(&mut self, panel: Option<RightPanel>) {
+        if panel == Some(RightPanel::Comments) {
+            self.comments_panel_closed = false;
+        } else if panel.is_none() && self.right == Some(RightPanel::Comments) {
+            self.comments_panel_closed = true;
+        }
+        self.right = panel;
+    }
+
     /// Serialize the user's persistent state (recent files, theme). Local only.
     pub fn persist(&self) -> String {
         let trusted: Vec<String> = self.session.trusted_certificates().iter().map(pdfcraft_engine::sign::x509::to_pem).collect();
@@ -1190,6 +1205,7 @@ impl PdfCraftApp {
             "javascript": self.session.javascript(),
             "actions": actions_ui::encode(&self.custom_actions),
             "combine_columns": self.combine_columns.to_json(),
+            "comments_panel_closed": self.comments_panel_closed,
         })
         .to_string()
     }
@@ -1217,6 +1233,9 @@ impl PdfCraftApp {
         if let Some(on) = v["highlight_fields"].as_bool() {
             self.view_defaults.highlight_fields = on;
         }
+        if let Some(closed) = v["comments_panel_closed"].as_bool() {
+            self.comments_panel_closed = closed;
+        }
         if let Some(defaults) = v["default_zoom"].as_str().and_then(|zoom| self.view_defaults.with_zoom(zoom)) {
             self.view_defaults = defaults;
         }
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 54759477..27ac404e 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -584,7 +584,7 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             });
     }
     if close {
-        app.right = None;
+        app.choose_right_panel(None);
     }
     if let Some(e) = panel_edit {
         app.apply_edit(e);
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index 688a962e..e596e74f 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -600,3 +600,43 @@ fn the_opacity_set_for_a_tool_goes_into_its_new_comments() {
     h.run_steps(2);
     h.get_by_label("Opacity");
 }
+
+/// #225: comment tools open the Comments panel until the user closes it; then it stays closed,
+/// across restarts, until they open it again.
+#[test]
+fn a_closed_comments_panel_stays_closed_when_picking_comment_tools() {
+    use pdfcraft_ui_egui::RightPanel;
+    let mut h = harness(|_| {});
+    assert_eq!(h.state().right, None);
+    assert!(h.state_mut().execute("comment.highlight"));
+    h.run_steps(2);
+    assert_eq!(h.state().right, Some(RightPanel::Comments), "Acrobat opens Comments with the tools");
+    h.get_by_label("Close").click();
+    h.run_steps(2);
+    assert_eq!(h.state().right, None);
+    for tool in ["select", "comment.underline", "comment.note", "comment.highlight"] {
+        if tool == "select" {
+            h.state_mut().quick_tool = QuickTool::Select;
+        } else {
+            assert!(h.state_mut().execute(tool));
+        }
+        h.run_steps(2);
+        assert_eq!(h.state().right, None, "{tool} reopened the closed Comments panel");
+    }
+    let mut again = PdfCraftApp::new();
+    again.restore(&h.state().persist());
+    assert!(again.comments_panel_closed, "the choice survives a restart");
+    // Opening it again from the rail lets the tools open it once more.
+    h.get_by_label("Comments").click();
+    h.run_steps(2);
+    assert_eq!(h.state().right, Some(RightPanel::Comments));
+    assert!(!h.state().comments_panel_closed);
+    // What the rail and View menu call; "Bookmarks" labels two controls on screen.
+    h.state_mut().choose_right_panel(Some(RightPanel::Bookmarks));
+    h.state_mut().choose_right_panel(None);
+    h.run_steps(2);
+    assert!(!h.state().comments_panel_closed, "switching to and closing another panel isn't closing Comments");
+    assert!(h.state_mut().execute("comment.strikeout"));
+    h.run_steps(2);
+    assert_eq!(h.state().right, Some(RightPanel::Comments));
+}

From bc1d67cb615ac0672b498fbdc74047db65336f2e Mon Sep 17 00:00:00 2001
From: Erige005 <162100015+Erige005@users.noreply.github.com>
Date: Fri, 9 Oct 2026 20:14:34 +0700
Subject: [PATCH 045/149] Export to Word: detect tables of at most 63 columns,
 Word's limit (#479) (#483)

---
 crates/export/src/lib.rs | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index e92d09ec..ba165b09 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -96,10 +96,11 @@ fn level(b: &Block, body: f64) -> u8 {
 
 /// How far two cell left edges may drift (points) and still be the same grid column.
 const COL_TOL: f64 = 4.0;
-/// More grid columns than this isn't a table. It also bounds a table's size: every row is
-/// materialized to all its columns, so a hostile page laid out as a staircase of blocks would
-/// otherwise make (blocks / 2)² cells.
-const MAX_COLS: usize = 64;
+/// More grid columns than this isn't a table. It is Word's limit: a .docx whose table has 64 or
+/// more columns doesn't open. It also bounds a table's size: every row is materialized to all
+/// its columns, so a hostile page laid out as a staircase of blocks would otherwise make
+/// (blocks / 2)² cells.
+const MAX_COLS: usize = 63;
 /// A cell is short: taller blocks are body text (or a multi-column layout), not table cells.
 fn is_cell_like(b: &Block) -> bool {
     (b.rect[3] - b.rect[1]) <= b.size * 5.0 && !b.text.trim().is_empty()
@@ -809,6 +810,28 @@ mod tests {
         assert!(started.elapsed() < std::time::Duration::from_secs(5), "took {:?}", started.elapsed());
     }
 
+    #[test]
+    fn word_opens_tables_up_to_its_column_limit() {
+        // Rows of short numbers on a regular grid, n columns wide.
+        let grid = |n: usize| Page {
+            width: 1500.0,
+            height: 792.0,
+            blocks: (0..3)
+                .flat_map(|row| {
+                    (0..n).map(move |col| {
+                        let (x, y) = (20.0 + col as f64 * 22.0, 700.0 - row as f64 * 14.0);
+                        Block { text: (col + 1).to_string(), rect: [x, y, x + 8.0, y + 8.0], size: 8.0, bold: false, italic: false }
+                    })
+                })
+                .collect(),
+            images: Vec::new(),
+        };
+        let grid_cols = |p: &Page| part(&docx(std::slice::from_ref(p), "Grid"), "word/document.xml").matches("<w:gridCol ").count();
+        assert_eq!(grid_cols(&grid(63)), 63, "63 columns is still a table");
+        // Word refuses to open a document with a 64-column table, so that grid stays text.
+        assert_eq!(grid_cols(&grid(64)), 0);
+    }
+
     #[test]
     fn two_column_body_text_is_not_mistaken_for_a_table() {
         let para = |t: &str, x: f64, y: f64| Block {

From 271139bd3bd5f57429c9d73a0760bfe4c84ffb62 Mon Sep 17 00:00:00 2001
From: MarekSpodBiedry <73122968+MarekSpodBiedry@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:14:40 +0200
Subject: [PATCH 046/149] Comments: a new highlight opens its note for typing
 (#475) (#481)

Adding a highlight selected its card in the Comments panel but left the
note closed; the text field only appeared after double-clicking the card.
Acrobat opens the note for typing as soon as the highlight is made.

apply_edit now opens the inline editor for a new highlight (text drag,
selection then tool, area highlight all pass through it), unless a note
typed into another card is still unsaved, so that text is never dropped.
---
 crates/ui-egui/src/editing.rs    |  8 ++++++++
 crates/ui-egui/tests/comments.rs | 23 +++++++++++++++++++++++
 parity/acrobat-features.toml     |  4 ++--
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index a28a5485..e8b9aad5 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -57,6 +57,14 @@ impl PdfCraftApp {
                         let newest = info.annotations.iter().filter(|x| x.page == a.page && x.in_reply_to.is_none()).map(|x| x.index).max();
                         view.comments.selected = newest.map(|n| (a.page, n));
                         view.comments.reveal = true;
+                        // A new highlight opens its note for typing straight away, as in Acrobat,
+                        // unless a note typed into another card is still unsaved.
+                        if let (pdfcraft_engine::Shape::TextMarkup { kind: pdfcraft_engine::Markup::Highlight, .. }, Some(n)) = (&a.shape, newest)
+                            && a.contents.is_empty()
+                            && view.comments.editing.as_ref().is_none_or(|(_, _, text)| text.is_empty())
+                        {
+                            view.comments.editing = Some((a.page, n, String::new()));
+                        }
                     }
                     Edit::DeleteAnnotation { .. } => view.comments.selected = None,
                     _ => {}
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index e596e74f..cb1dc9a3 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -116,6 +116,29 @@ fn dragging_over_text_with_the_highlighter_highlights_it() {
     assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Add highlight"));
 }
 
+#[test]
+fn a_new_highlight_opens_its_note_for_typing() {
+    let mut h = harness(|app| app.set_option("quick", "highlight").unwrap());
+    assert_eq!(h.state().views[0].comments.editing, None);
+    let (a, b) = {
+        let v = &h.state().views[0];
+        (v.glyph_screen_pos(0, 4).expect("text layer"), v.glyph_screen_pos(0, 14).expect("glyph"))
+    };
+    drag(&mut h, a, b);
+    assert_eq!(comments(&h).len(), 1);
+    assert_eq!(h.state().views[0].comments.editing, Some((0, 0, String::new())), "the Comments panel edits the new highlight");
+    // An area highlight opens its note too, replacing the empty one.
+    drag_pt(&mut h, (40.0, 100.0), (140.0, 40.0));
+    assert_eq!(comments(&h).len(), 2);
+    assert_eq!(h.state().views[0].comments.editing, Some((0, 1, String::new())));
+    // A note being typed is kept: the next highlight is only selected.
+    h.state_mut().views[0].comments.editing = Some((0, 1, "typed".into()));
+    drag_pt(&mut h, (160.0, 100.0), (260.0, 40.0));
+    assert_eq!(comments(&h).len(), 3);
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 2)));
+    assert_eq!(h.state().views[0].comments.editing, Some((0, 1, "typed".into())));
+}
+
 #[test]
 fn a_selection_made_first_is_marked_when_a_tool_is_picked() {
     let mut h = harness(|_| {});
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 647ddbf1..6cc6eaef 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -3494,8 +3494,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.highlight"]
 tools = ["comment_add"]
-evidence = ["crates/ui-egui/tests/comments.rs::dragging_over_text_with_the_highlighter_highlights_it", "crates/engine/src/tests.rs::highlight_multiplies_over_text"]
-notes = "drag over text, or pick the tool with text selected; agents can highlight by text search"
+evidence = ["crates/ui-egui/tests/comments.rs::dragging_over_text_with_the_highlighter_highlights_it", "crates/ui-egui/tests/comments.rs::a_new_highlight_opens_its_note_for_typing", "crates/engine/src/tests.rs::highlight_multiplies_over_text"]
+notes = "drag over text, or pick the tool with text selected; a new highlight opens its note for typing in the Comments panel; agents can highlight by text search"
 
 [[feature]]
 id = "comment.underline"

From 5f570eab01032729c0959b9cf3f3524dd5d94aa5 Mon Sep 17 00:00:00 2001
From: Chen Tao <t.clydechen@gmail.com>
Date: Fri, 9 Oct 2026 22:14:46 +0900
Subject: [PATCH 047/149] M2.6: non-embedded Mincho fonts draw half-width
 katakana (#484)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since #368, a non-embedded Adobe-Japan1 font with a Mincho name
(HeiseiMin-W3, MS-Mincho, ...) is drawn in document_japanese_font(),
i.e. Shippori Mincho. Shippori Mincho has none of the 63 half-width
katakana (U+FF61-U+FF9F), which are common in Japanese documents.
hayro maps the CID through Adobe-Japan1-UCS2 to Unicode, finds no
glyph in the face's cmap, and falls back to drawing the CID as a glyph
index: half-width katakana came out as unrelated glyphs (ligatures
such as fi and fl).

The Mincho substitute is now BIZ UDMincho Regular, which covers
half-width katakana (and was designed as a metric-compatible
replacement for MS Mincho), falling back to document_japanese_font()
when it isn't built in. The face used for Japanese text written into
PDFs is unchanged. Without craft-fonts nothing changes.

Tests: raster::tests::mincho_substitute_covers_half_width_katakana
(with CRAFT_FONTS_DIR: the Mincho substitute's cmap maps U+FF61-U+FF9F
and 日本; it lacked all 63 half-width katakana before; skips without
craft-fonts). skrifa 0.44 is a dev-dependency of pdfcraft-render for
it, the version pdfcraft-fonts already uses. The parity entry
view.render-cid-fonts cites the test.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                   |  1 +
 contributors/people.toml     |  5 +++++
 crates/render/Cargo.toml     |  4 ++++
 crates/render/src/raster.rs  | 31 ++++++++++++++++++++++++++++++-
 parity/acrobat-features.toml |  4 ++--
 5 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 10531cb1..7ce59c30 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3751,6 +3751,7 @@ dependencies = [
  "log",
  "lopdf",
  "pdfcraft-fonts",
+ "skrifa 0.44.0",
  "thiserror 2.0.21",
 ]
 
diff --git a/contributors/people.toml b/contributors/people.toml
index 00beb658..ade46dac 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -59,3 +59,8 @@ sync_github_name = true
 
 [people.amitabhthakur]
 sync_github_name = true
+
+[people.chent11]
+real_name = "Tao Chen"
+display_name = "Tao Chen"
+sync_github_name = false
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index 2a5b974d..fa68a064 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -20,3 +20,7 @@ log = { workspace = true }
 # lopdf (bootstrap) draws random bytes for encryption; on the web they come from the browser.
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 getrandom = { version = "0.4", features = ["wasm_js"] }
+
+[dev-dependencies]
+# Checks the Japanese substitute's character coverage; the version pdfcraft-fonts already uses.
+skrifa = "0.44"
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 267be471..e6b6e7ea 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -73,7 +73,13 @@ fn japanese_fallback(query: &FontQuery) -> Option<(FontData, u32)> {
         return None;
     }
     let face = match japanese_face(f.post_script_name.as_deref().unwrap_or_default(), f.is_serif, f.is_bold || f.font_weight >= 600) {
-        JapaneseFace::Mincho => pdfcraft_fonts::document_japanese_font(),
+        // BIZ UDMincho before the document face (Shippori Mincho): it covers half-width katakana
+        // (U+FF61–U+FF9F), which Shippori Mincho lacks, and hayro draws a CID the substitute
+        // can't map by Unicode by glyph index, i.e. as an unrelated glyph (fi, fl, …).
+        JapaneseFace::Mincho => pdfcraft_fonts::ui_japanese_fonts()
+            .into_iter()
+            .find(|c| c.family == "BIZ UDMincho" && c.style == "Regular")
+            .or_else(pdfcraft_fonts::document_japanese_font),
         JapaneseFace::Gothic { bold } => {
             let faces = pdfcraft_fonts::ui_japanese_fonts();
             let style = if bold { "Bold" } else { "Regular" };
@@ -1652,6 +1658,29 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// Half-width katakana are common in Japanese documents set in a non-embedded Mincho font
+    /// such as HeiseiMin-W3. The Mincho substitute must have those glyphs: one that lacks them
+    /// (Shippori Mincho) draws each CID by glyph index instead, as unrelated glyphs (fi, fl).
+    #[test]
+    fn mincho_substitute_covers_half_width_katakana() {
+        use hayro::hayro_interpret::font::FallbackFontQuery;
+        use hayro::hayro_interpret::hayro_cmap::CharacterCollection;
+        use skrifa::MetadataProvider;
+        let query = FontQuery::Fallback(FallbackFontQuery {
+            post_script_name: Some("HeiseiMin-W3".into()),
+            character_collection: Some(CharacterCollection { family: CidFamily::AdobeJapan1, supplement: 2 }),
+            ..FallbackFontQuery::default()
+        });
+        let Some((data, index)) = super::japanese_fallback(&query) else {
+            eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+            return;
+        };
+        let font = skrifa::FontRef::from_index((*data).as_ref(), index).expect("a craft-fonts face parses");
+        let charmap = font.charmap();
+        let missing: Vec<char> = ('\u{FF61}'..='\u{FF9F}').chain(['日', '本']).filter(|&c| charmap.map(c).is_none()).collect();
+        assert!(missing.is_empty(), "the Mincho substitute lacks {missing:?}");
+    }
+
     #[test]
     fn japanese_font_names_pick_mincho_or_gothic() {
         use super::JapaneseFace::{Gothic, Mincho};
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6cc6eaef..627fe94b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -746,8 +746,8 @@ milestone = "M2"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::huge_cid_width_ranges_terminate", "crates/render/src/raster.rs::non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face"]
-notes = "CID-to-Unicode tables are M2.4; a non-embedded Adobe-Japan1 font is drawn in a craft-fonts Japanese face (Mincho or Gothic by name) when built with craft-fonts; non-embedded GB1, CNS1 and Korea1 fonts still draw nothing (no allowed face)"
+evidence = ["crates/render/src/raster.rs::huge_cid_width_ranges_terminate", "crates/render/src/raster.rs::non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face", "crates/render/src/raster.rs::mincho_substitute_covers_half_width_katakana"]
+notes = "CID-to-Unicode tables are M2.4; a non-embedded Adobe-Japan1 font is drawn in a craft-fonts Japanese face (Mincho or Gothic by name; BIZ UDMincho for Mincho, which covers half-width katakana) when built with craft-fonts; non-embedded GB1, CNS1 and Korea1 fonts still draw nothing (no allowed face)"
 
 [[feature]]
 id = "view.render-image-codecs"

From 5c5f4d8b49bf3e3cc24c4108ad434f53d2b26434 Mon Sep 17 00:00:00 2001
From: MarekSpodBiedry <73122968+MarekSpodBiedry@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:14:55 +0200
Subject: [PATCH 048/149] Phone photos follow EXIF orientation; image
 signatures stay upright on rotated pages (#434) (#485)

* Stamps and added images follow a JPEG's EXIF orientation (part of #434)

Phones store a portrait photo as landscape pixels plus an EXIF
Orientation tag. A JPEG went into the PDF as it was (DCTDecode), and PDF
image XObjects have no such tag, so a photo used as a custom stamp, an
added or replaced image, a watermark or background, or a button image
showed up turned 90 degrees.

Before these images are embedded, a JPEG whose Orientation is not 1 is
decoded, turned the way the tag says and re-encoded (quality 92). Its
JFIF resolution is kept, swapped for quarter turns, so the natural size
on the page stays right. Other images, JPEGs without the tag, JPEGs that
fail to decode and photos over 64 megapixels are embedded unchanged, as
before. Fill & Sign image signatures already applied the tag.

* Image signatures stay upright and anchored on rotated pages (part of #434)

On a page with /Rotate 90, 180 or 270 an image signature turned with the
page, because its picture was drawn along user-space axes while the click
or the "at" argument is a displayed point. It was also anchored at the
wrong point: its left edge and vertical centre were taken in user space,
so on a 90 degree page the image centre ended up elsewhere.

The signature's appearance now carries the counter-rotation as its form
/Matrix, which viewers fit to /Rect, so the picture reads upright as
displayed. The page's rotation is kept in /PCPictureRotate, so restyling
regenerates the same matrix and moving and resizing keep it. The box of the
signature runs along the displayed axes, so its left edge and vertical
centre are where they were asked for. The page view matrix in
pdfcraft-model is split out as view_matrix_for.

The Fill & Sign preview and the live move/resize preview draw the picture
the way the appearance does, and the resize handles keep the image's
proportions as displayed. comment_image_preview reports image_rotation,
how far the image is shown turned (0 for one placed upright).

Custom image stamps are left to #473.

* Use is_multiple_of for the quarter-turn checks (clippy) (#434)

* Probe the pointer preview away from egui_kittest's drawn cursor (#434)

The kittest render paints a mouse cursor (a 16 px triangle with a black outline) at the
hover point, so the 2 pt probe beside the pointer landed on its outline when zoom and view
rotation made 2 pt only a pixel or two. Put the stroke's block at the picture's right end and
probe there and at its far margin instead.
---
 Cargo.lock                            |   1 +
 crates/annot/Cargo.toml               |   1 +
 crates/annot/README.md                |   2 +-
 crates/annot/src/appearance.rs        |  23 ++++-
 crates/annot/src/lib.rs               |  18 ++++
 crates/automation/README.md           |   2 +-
 crates/automation/src/comments.rs     |   3 +-
 crates/automation/src/tools.rs        |   2 +-
 crates/automation/tests/automation.rs |  51 ++++++++++
 crates/engine/src/lib.rs              |  20 +++-
 crates/engine/src/signature_image.rs  |  58 ++++++++---
 crates/engine/src/upright_image.rs    | 133 ++++++++++++++++++++++++++
 crates/model/README.md                |   2 +
 crates/model/src/lib.rs               |  22 +++--
 crates/ui-egui/Cargo.toml             |   2 +-
 crates/ui-egui/src/canvas.rs          |  21 ++--
 crates/ui-egui/src/comments.rs        |   8 +-
 crates/ui-egui/src/fill_sign.rs       |  15 +--
 crates/ui-egui/src/signature_drag.rs  |  17 +++-
 crates/ui-egui/tests/fill_sign.rs     |  97 ++++++++++++++-----
 20 files changed, 419 insertions(+), 79 deletions(-)
 create mode 100644 crates/engine/src/upright_image.rs

diff --git a/Cargo.lock b/Cargo.lock
index 7ce59c30..ca64fd79 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3477,6 +3477,7 @@ dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
  "pdfcraft-fonts",
+ "pdfcraft-model",
  "thiserror 2.0.21",
 ]
 
diff --git a/crates/annot/Cargo.toml b/crates/annot/Cargo.toml
index 9603e572..8a313814 100644
--- a/crates/annot/Cargo.toml
+++ b/crates/annot/Cargo.toml
@@ -11,6 +11,7 @@ workspace = true
 [dependencies]
 pdfcraft-cos = { workspace = true }
 pdfcraft-fonts = { workspace = true }
+pdfcraft-model = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
diff --git a/crates/annot/README.md b/crates/annot/README.md
index c98cb6d2..38ad68b5 100644
--- a/crates/annot/README.md
+++ b/crates/annot/README.md
@@ -1,6 +1,6 @@
 # pdfcraft-annot
 
-Comments (annotations), ISO 32000-2 §12.5. Layer L3, depends only on `pdfcraft-cos`.
+Comments (annotations), ISO 32000-2 §12.5. Layer L3, depends on `pdfcraft-cos`, `pdfcraft-fonts` and `pdfcraft-model`.
 
 ## What it does
 
diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index 6045743f..11b21434 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -200,6 +200,12 @@ fn form(bbox: [f64; 4], content: &[u8], resources: Dict) -> Stream {
     Stream::flate(d, content)
 }
 
+/// The page `/Rotate` an image signature's picture is turned back by (`/PCPictureRotate`, written
+/// when the signature is added to a turned page): 0, 90, 180 or 270.
+pub(crate) fn picture_turn(d: &Dict) -> i64 {
+    d.get(b"PCPictureRotate").and_then(Object::as_int).unwrap_or(0).rem_euclid(360) / 90 * 90
+}
+
 /// Draw the normal appearance of an annotation, or `None` if this subtype/variant isn't supported.
 pub fn build(d: &Dict) -> Option<Stream> {
     // Imported measurement appearances may include leaders, captions and formatting that
@@ -444,11 +450,14 @@ pub fn build(d: &Dict) -> Option<Stream> {
                 return Some(form(rect, c.as_bytes(), res));
             }
             // A custom stamp: its picture (an image, or a form mapped to /PCPictureSize) fills
-            // the rectangle.
+            // the rectangle. An image signature added to a turned page (`/PCPictureRotate`) gets
+            // the standard counter-rotation as its form `/Matrix`: viewers fit the turned
+            // bounding box to `/Rect` (ISO 32000-2 §12.5.5), so it reads upright as displayed.
             if let Some(pic) = d.get(b"PCPicture").and_then(Object::as_ref) {
                 let [x0, y0, x1, y1] = rect;
                 let (w, h) = (x1 - x0, y1 - y0);
-                let place = if matches!(d.get(b"PCPictureImage"), Some(Object::Bool(true))) {
+                let image = matches!(d.get(b"PCPictureImage"), Some(Object::Bool(true)));
+                let place = if image {
                     format!("{} 0 0 {} {} {} cm", n(w), n(h), n(x0), n(y0))
                 } else {
                     let size = nums(d, b"PCPictureSize").filter(|s| s.len() == 2 && s[0] > 0.0 && s[1] > 0.0)?;
@@ -458,7 +467,15 @@ pub fn build(d: &Dict) -> Option<Stream> {
                 let mut xo = Dict::new();
                 xo.set(b"Pic".to_vec(), Object::Ref(pic));
                 res.set(b"XObject".to_vec(), Object::Dict(xo));
-                return Some(form(rect, c.as_bytes(), res));
+                let mut stream = form(rect, c.as_bytes(), res);
+                let turn = picture_turn(d);
+                if image && turn != 0 {
+                    // The page's view matrix without its offset: display axes in user space.
+                    let m = pdfcraft_model::view_matrix_for(turn, [0.0; 4]);
+                    let matrix = [m[0], m[1], m[2], m[3], 0.0, 0.0];
+                    stream.dict.set(b"Matrix".to_vec(), Object::Array(matrix.iter().map(|x| Object::Real(*x)).collect()));
+                }
+                return Some(stream);
             }
             // Only PdfCraft's own Fill & Sign marks are drawn here.
             let name = d.name(b"Name")?;
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index 2abfdce5..18174c58 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -677,6 +677,16 @@ pub fn signature_image(doc: &Document, page: usize, index: usize) -> Result<Opti
     .flatten())
 }
 
+/// The page `/Rotate` the picture of the image signature at `(page, index)` is drawn turned back
+/// by, so it reads upright on a page shown that way: 0 for one added to an unturned page, or by
+/// another app. The picture appears turned by the page's current rotation less this.
+pub fn picture_rotation(doc: &Document, page: usize, index: usize) -> Result<i64, AnnotError> {
+    let p = page_ref(doc, page)?;
+    let list = annots(doc, p);
+    let entry = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    Ok(doc.resolve(entry).as_dict().map_or(0, appearance::picture_turn))
+}
+
 // ── building ────────────────────────────────────────────────────────────────────────────────
 
 /// Annotation flags (§12.5.3).
@@ -968,6 +978,14 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
             d.set(b"PCPicture".to_vec(), Object::Ref(*picture));
             d.set(b"PCPictureImage".to_vec(), Object::Bool(*image));
             d.set(b"PCPictureSize".to_vec(), num_array(&[size.0, size.1]));
+            // An image signature's rectangle is in user space; on a turned page its appearance is
+            // turned back (see `appearance::build`), so it reads upright as displayed.
+            if *image && matches!(clean.as_str(), "Signature" | "Initials") {
+                let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
+                if turn != 0 {
+                    d.set(b"PCPictureRotate".to_vec(), Object::Int(turn));
+                }
+            }
         }
         Shape::Ink { strokes } | Shape::Signature { strokes } => {
             d.set(b"C".to_vec(), rgb(style.color));
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 21dbc3f5..29e9eb9e 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -23,7 +23,7 @@ mcp::McpServer::new(a).serve(stdin, stdout)?             // newline-delimited JS
 - Pages and positions are **1-based**. Rectangles are PDF points with the origin at the top-left of the displayed page.
 - Unknown arguments are rejected, so typos fail loudly.
 - Tools that change a document return its summary (`doc`, `pages`, `dirty`, `undo`, `redo`, …).
-- `comment_image_preview` returns JSON and a PNG: `layer: "background"` (the default) gives the page without the selected image signature/initials; `layer: "image"` gives its embedded image with alpha. The metadata supplies its displayed rectangle, document rotation and annotation opacity. Each result can be saved with the CLI's `--out`. Cache the background and transform the image for live movement/resizing; `comment_edit` commits the final geometry in one undo step. Previewing never changes the document.
+- `comment_image_preview` returns JSON and a PNG: `layer: "background"` (the default) gives the page without the selected image signature/initials; `layer: "image"` gives its embedded image with alpha. The metadata supplies its displayed rectangle, document rotation, `image_rotation` (how far clockwise the image is shown turned: 0 for one placed by PdfCraft, which keeps it upright as displayed) and annotation opacity. Each result can be saved with the CLI's `--out`. Cache the background and transform the image for live movement/resizing; `comment_edit` commits the final geometry in one undo step. Previewing never changes the document.
 - For proportional image signature resizing, use the embedded image layer's width/height ratio rather than a previously stretched annotation rectangle. The GUI preserves this ratio at corners with the opposite corner anchored; edge midpoint handles change only their own axis. `comment_edit` accepts the resulting rectangle.
 - `doc_close` refuses to drop unsaved changes unless `discard_changes: true`. `doc_save` writes atomically, incrementally in place, and in full for a new path.
 - With a root set, every read and write path must resolve inside it (symlinks and `..` included). Relative paths resolve inside the root, and `..` is resolved by name before the check. Every path outside the root gets the same refusal (`<path> is outside the allowed directory <root>`), whether or not it exists, so a confined agent can't probe the rest of the disk; on Windows another network share or device path (`\\host\share`, `\\?\UNC\…`, `\\.\…`) is refused without being contacted. "Not found" and other filesystem errors are reported only for paths inside the root. Tools that write several files into a folder name them after the document or input file, with separators, colons and control characters replaced by `_`, so a name can't lead them out of the folder. The root itself must be a folder.
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index 4d97e321..094bf498 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -109,6 +109,7 @@ impl Automation {
         };
         Ok(vec![
             Content::Json(json!({ "page": page + 1, "index": index + 1, "rect": rect_to_view(info, annotation.rect), "rotation": info.rotation,
+                "image_rotation": (i64::from(info.rotation) - preview.turn).rem_euclid(360),
                 "layer": layer, "opacity": preview.opacity, "dpi": dpi })),
             image,
         ])
@@ -386,7 +387,7 @@ impl Automation {
             let path = self.resolve(path, false)?;
             let file = std::fs::File::open(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?;
             let image = pdfcraft_engine::SignatureImage::read(file).map_err(|e| ToolError::InvalidArgs(e.to_string()))?;
-            let edit = image.edit(page, at, kind == "initials", &author).ok_or_else(|| ToolError::InvalidArgs("at must be finite".into()))?;
+            let edit = image.edit(page, &info, at, kind == "initials", &author).ok_or_else(|| ToolError::InvalidArgs("at must be finite".into()))?;
             return self.apply(a, edit);
         }
         let size = 10.0;
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 83d5a411..e088a64f 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -642,7 +642,7 @@ pub fn tools() -> Vec<ToolDef> {
             })),
             &["doc"],
         )),
-        t("comment_image_preview", "Preview image signature layers", "Return a PNG of the page without the selected image signature/initials (layer=background, default), or its embedded image with alpha (layer=image). Includes the displayed rectangle, document rotation and annotation opacity. Cache these layers for live placement/resizing; commit once with comment_edit. Does not change the document or undo history.")
+        t("comment_image_preview", "Preview image signature layers", "Return a PNG of the page without the selected image signature/initials (layer=background, default), or its embedded image with alpha (layer=image). Includes the displayed rectangle, document rotation, image_rotation (how far clockwise the image is shown turned) and annotation opacity. Cache these layers for live placement/resizing; commit once with comment_edit. Does not change the document or undo history.")
             .ro().with(schema(comment_ref(json!({ "layer": { "type": "string", "enum": ["background", "image"], "default": "background" }, "dpi": { "type": "number", "minimum": 1, "maximum": 600, "default": 96 } })), &["doc"])),
         t("comment_delete", "Delete a comment", "Delete a comment with its pop-up and replies. Undoable.").destructive().with(schema(comment_ref(json!({})), &["doc"])),
         t(
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 093a3443..c287d7c4 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1485,6 +1485,7 @@ fn image_signature_preview_layers_are_read_only_and_survive_encrypted_save() {
         assert_eq!(meta["layer"], "background");
         assert_eq!(image_meta["layer"], "image");
         assert_eq!(meta["rotation"], 90);
+        assert_eq!(meta["image_rotation"], 0, "placed upright as displayed on the turned page");
         assert_eq!(meta["opacity"], 0.5);
         assert_eq!((*width, *height), (120, 40));
         assert_eq!(image::load_from_memory(background).unwrap().to_rgba8(), expected, "page text and the other signature remain");
@@ -2040,6 +2041,56 @@ fn note_icons_anchor_at_the_requested_corner_on_rotated_pages() {
     }
 }
 
+/// An image signature is drawn upright as displayed, and anchored at the displayed point asked
+/// for, on every `/Rotate`: its picture is placed in user space, which the page turns, so the
+/// appearance is counter-rotated and its box is found in user space.
+#[test]
+fn image_signatures_stay_upright_on_rotated_pages() {
+    let dir = workdir("image-upright");
+    // 80 x 40 px, one colour per quadrant: red and green above, blue and yellow below.
+    let quadrants = image::RgbaImage::from_fn(80, 40, |x, y| match (x < 40, y < 20) {
+        (true, true) => image::Rgba([255, 0, 0, 255]),
+        (false, true) => image::Rgba([0, 255, 0, 255]),
+        (true, false) => image::Rgba([0, 0, 255, 255]),
+        (false, false) => image::Rgba([255, 255, 0, 255]),
+    });
+    quadrants.save(dir.join("quadrants.png")).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_create", json!({ "from": "blank", "width": 200, "height": 300, "pages": 4 }))["doc"].as_u64().unwrap();
+    for (page, degrees) in [(2, 90), (3, 180), (4, 270)] {
+        ok(&mut a, "page_rotate", json!({ "doc": doc, "pages": [page], "degrees": degrees }));
+    }
+    for page in 1..=4 {
+        // 64 x 32 pt from x = 60 as displayed, centred on y = 140.
+        ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": page, "type": "signature", "at": [60, 140], "path": "quadrants.png" }));
+    }
+    let (white, red, green, blue, yellow) = ([255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0]);
+    let check = |a: &mut Automation, doc: u64| {
+        for page in 1..=4 {
+            let output = a.call("page_render", &json!({ "doc": doc, "page": page, "dpi": 72 })).unwrap();
+            let Content::Png { data, .. } = &output[0] else { panic!() };
+            let pixels = image::load_from_memory(data).unwrap().to_rgba8();
+            for (x, y, want, what) in [
+                (76, 132, red, "signature top-left"),
+                (108, 132, green, "signature top-right"),
+                (76, 148, blue, "signature bottom-left"),
+                (108, 148, yellow, "signature bottom-right"),
+                (56, 140, white, "left of the signature"),
+                (128, 140, white, "right of the signature"),
+                (92, 120, white, "above the signature"),
+                (92, 160, white, "below the signature"),
+            ] {
+                let got = pixels.get_pixel(x, y).0;
+                assert!(got[..3].iter().zip(want).all(|(g, w)| g.abs_diff(w) < 12), "page {page}, {what} at ({x}, {y}): {got:?}, want {want:?}");
+            }
+        }
+    };
+    check(&mut a, doc);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "placed.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "placed.pdf" }))["doc"].as_u64().unwrap();
+    check(&mut a, reopened);
+}
+
 #[test]
 fn comment_checkmarks_locks_hiding_and_summaries_through_tools() {
     let dir = workdir("comment-polish");
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 2dca9559..22dd3d4c 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -22,6 +22,7 @@ pub mod links;
 pub mod ocr;
 pub mod optimizer;
 pub mod signature_image;
+mod upright_image;
 pub mod xfa;
 
 pub use signature_image::{ImageSignaturePreview, SignatureImage};
@@ -1505,7 +1506,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             ran.map_err(EditError::Invalid)?;
         }
         Edit::SetFieldImage { name, image } => {
-            let (img, _) = pdfcraft_create::image_xobject(doc, name, image)?;
+            let (img, _) = embed_image(doc, name, image)?;
             let px = match &*doc.get(img) {
                 pdfcraft_cos::Object::Stream(s) => (s.dict.int(b"Width").unwrap_or(1) as u32, s.dict.int(b"Height").unwrap_or(1) as u32),
                 _ => (1, 1),
@@ -1562,7 +1563,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
                 ImageEdit::Flip { horizontal } => {
                     pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.rect, 0, *horizontal, !*horizontal))
                 }
-                ImageEdit::Replace { name, bytes } => pdfcraft_edit::ImageChange::Replace(pdfcraft_create::image_xobject(doc, name, bytes)?.0),
+                ImageEdit::Replace { name, bytes } => pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0),
                 ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
             };
             pdfcraft_edit::change_image(doc, *page, *index, &c)?;
@@ -1602,7 +1603,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             pdfcraft_edit::add_content(doc, *page, &AddedContent::Text(text.clone()))?;
         }
         Edit::AddImage { page, rect, name, bytes } => {
-            let (image, natural) = pdfcraft_create::image_xobject(doc, name, bytes)?;
+            let (image, natural) = embed_image(doc, name, bytes)?;
             let rect = match rect {
                 Some(r) => *r,
                 None => {
@@ -1622,7 +1623,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             let Some(AddedContent::Image(old)) = item.map(|a| a.content) else {
                 return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("that item is not an image".into())));
             };
-            let (image, _) = pdfcraft_create::image_xobject(doc, name, bytes)?;
+            let (image, _) = embed_image(doc, name, bytes)?;
             pdfcraft_edit::update_content(doc, *page, *index, &AddedContent::Image(pdfcraft_edit::AddedImage { image, ..old }))?;
         }
         Edit::ApplyRedactions { pages } => {
@@ -2977,6 +2978,15 @@ pub struct MarkFile {
     pub page: usize,
 }
 
+/// Embed an image that is placed on a page, turned the way its EXIF Orientation says.
+fn embed_image(
+    doc: &mut pdfcraft_cos::Document,
+    name: &str,
+    bytes: &[u8],
+) -> Result<(pdfcraft_cos::ObjRef, (f64, f64)), pdfcraft_create::CreateError> {
+    pdfcraft_create::image_xobject(doc, name, &upright_image::upright(bytes))
+}
+
 /// Bring a mark's picture into `doc`: a PDF page as a form XObject, or an image.
 fn mark_source(doc: &mut pdfcraft_cos::Document, f: &MarkFile) -> Result<pdfcraft_edit::MarkSource, EditError> {
     let head = &f.bytes[..f.bytes.len().min(1024)];
@@ -2985,7 +2995,7 @@ fn mark_source(doc: &mut pdfcraft_cos::Document, f: &MarkFile) -> Result<pdfcraf
         let (xobject, size) = pdfcraft_organize::page_as_form(doc, &src, f.page)?;
         Ok(pdfcraft_edit::MarkSource { xobject, size, image: false })
     } else {
-        let (xobject, size) = pdfcraft_create::image_xobject(doc, &f.name, &f.bytes)?;
+        let (xobject, size) = embed_image(doc, &f.name, &f.bytes)?;
         Ok(pdfcraft_edit::MarkSource { xobject, size, image: true })
     }
 }
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index 3a2d5109..fc4c53ea 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -4,6 +4,7 @@ use std::io::{Cursor, Read};
 use std::sync::Arc;
 
 use image::{DynamicImage, ImageDecoder, ImageFormat, ImageReader, Limits};
+use pdfcraft_render::PageInfo;
 
 use crate::{Document, Edit, MarkFile, guard};
 
@@ -12,6 +13,8 @@ use crate::{Document, Edit, MarkFile, guard};
 pub struct ImageSignaturePreview {
     pub image: SignatureImage,
     pub opacity: f32,
+    /// The page `/Rotate` the picture is drawn turned back by (see [`pdfcraft_annot::picture_rotation`]).
+    pub turn: i64,
     page: usize,
     bytes: Arc<Vec<u8>>,
     config: pdfcraft_render::RenderConfig,
@@ -56,10 +59,11 @@ impl Document {
             let image = SignatureImage::from_bytes(&bytes).map_err(|e| e.to_string())?;
             let opacity =
                 pdfcraft_annot::props(&editor.cos, page, index).map(|p| p.opacity).filter(|v| v.is_finite()).unwrap_or(1.0).clamp(0.0, 1.0) as f32;
+            let turn = pdfcraft_annot::picture_rotation(&editor.cos, page, index).map_err(|e| e.to_string())?;
             let mut cos = editor.cos.clone();
             pdfcraft_annot::delete_annotation(&mut cos, page, index).map_err(|e| e.to_string())?;
             let bytes = Arc::new(pdfcraft_cos::write_incremental(&cos, &pdfcraft_cos::SaveOptions::default()).map_err(|e| e.to_string())?);
-            Ok(Some(ImageSignaturePreview { image, opacity, page, bytes, config: self.config.clone() }))
+            Ok(Some(ImageSignaturePreview { image, opacity, turn, page, bytes, config: self.config.clone() }))
         })?
     }
 }
@@ -141,19 +145,29 @@ impl SignatureImage {
         self.size
     }
 
-    /// Left edge at `at`, vertically centered, with the same 150 pt width cap as typed names.
-    pub fn rect(&self, at: [f64; 2], initials: bool) -> Option<[f64; 4]> {
+    /// The user-space box for the image with its left edge at `at` (a user-space point on `page`),
+    /// vertically centered, with the same 150 pt width cap as typed names. Left and centered are
+    /// as displayed: on a page with `/Rotate` the box runs along the turned page's axes.
+    pub fn rect(&self, page: &PageInfo, at: [f64; 2], initials: bool) -> Option<[f64; 4]> {
         if !at.iter().all(|v| v.is_finite()) {
             return None;
         }
         let [w, h] = self.size;
         let scale = (150.0 / w as f64).min(if initials { 24.0 } else { 32.0 } / h as f64);
         let (width, height) = (w as f64 * scale, h as f64 * scale);
-        Some([at[0], at[1] - height / 2.0, at[0] + width, at[1] + height / 2.0])
+        // Right and up as displayed, as user-space vectors: the page's view matrix without its offset.
+        let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(i64::from(page.rotation), [0.0; 4]);
+        let (right, up) = ([a * width, b * width], [c * height / 2.0, d * height / 2.0]);
+        Some([
+            at[0] + right[0].min(0.0) - up[0].abs(),
+            at[1] + right[1].min(0.0) - up[1].abs(),
+            at[0] + right[0].max(0.0) + up[0].abs(),
+            at[1] + right[1].max(0.0) + up[1].abs(),
+        ])
     }
 
-    pub fn edit(&self, page: usize, at: [f64; 2], initials: bool, author: &str) -> Option<Edit> {
-        let rect = self.rect(at, initials)?;
+    pub fn edit(&self, page: usize, info: &PageInfo, at: [f64; 2], initials: bool, author: &str) -> Option<Edit> {
+        let rect = self.rect(info, at, initials)?;
         let label = if initials { "Add initials" } else { "Add signature" };
         Some(Edit::Batch {
             label: label.into(),
@@ -172,6 +186,12 @@ impl SignatureImage {
 mod tests {
     use super::*;
 
+    /// A 300 x 400 page shown turned `rotation` degrees clockwise.
+    fn page(rotation: u16) -> PageInfo {
+        let (width, height) = if rotation.is_multiple_of(180) { (300.0, 400.0) } else { (400.0, 300.0) };
+        PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation }
+    }
+
     fn png(w: u32, h: u32) -> Vec<u8> {
         let image = image::RgbaImage::from_pixel(w, h, image::Rgba([40, 60, 80, 128]));
         let mut out = Cursor::new(Vec::new());
@@ -184,10 +204,10 @@ mod tests {
         let image = SignatureImage::from_bytes(&png(400, 40)).unwrap();
         assert_eq!(image.size(), [400, 40]);
         assert_eq!(&image.rgba()[..4], &[40, 60, 80, 128]);
-        let Edit::Batch { edits, .. } = image.edit(0, [20.0, 100.0], false, "Ada").unwrap() else { panic!() };
+        let Edit::Batch { edits, .. } = image.edit(0, &page(0), [20.0, 100.0], false, "Ada").unwrap() else { panic!() };
         let Edit::AddCustomStamp { rect, .. } = &edits[0] else { panic!() };
         assert_eq!(*rect, [20.0, 92.5, 170.0, 107.5]);
-        assert!(image.edit(0, [f64::NAN, 0.0], false, "").is_none());
+        assert!(image.edit(0, &page(0), [f64::NAN, 0.0], false, "").is_none());
         assert_eq!(SignatureImage::from_bytes(image.bytes()).unwrap(), image);
     }
 
@@ -236,7 +256,7 @@ mod tests {
         let mut session = crate::Session::new();
         let blank = session.create_blank(300.0, 400.0, 1).unwrap();
         let id = session.open_new("form.pdf", blank).unwrap();
-        session.apply(id, image.edit(0, [20.0, 100.0], false, "Ada").unwrap()).unwrap();
+        session.apply(id, image.edit(0, &page(0), [20.0, 100.0], false, "Ada").unwrap()).unwrap();
         let a = &session.get(id).unwrap().info.annotations[0];
         assert_eq!(a.rect, [20.0, 99.75, 170.0, 100.25]);
     }
@@ -247,7 +267,7 @@ mod tests {
         let mut session = crate::Session::new();
         let blank = session.create_blank(300.0, 400.0, 1).unwrap();
         let id = session.open_new("form.pdf", blank).unwrap();
-        session.apply(id, image.edit(0, [20.0, 100.0], false, "Ada").unwrap()).unwrap();
+        session.apply(id, image.edit(0, &page(0), [20.0, 100.0], false, "Ada").unwrap()).unwrap();
         let doc = session.get(id).unwrap();
         let bytes = doc.bytes.clone();
         let generation = doc.edit_generation();
@@ -268,7 +288,7 @@ mod tests {
         let mut session = crate::Session::new();
         let blank = session.create_blank(300.0, 400.0, 1).unwrap();
         let id = session.open_new("form.pdf", blank).unwrap();
-        session.apply(id, image.edit(0, [20.0, 100.0], false, "Ada").unwrap()).unwrap();
+        session.apply(id, image.edit(0, &page(0), [20.0, 100.0], false, "Ada").unwrap()).unwrap();
         let doc = session.doc_mut(id).unwrap();
         let cos = &mut doc.editor.as_mut().unwrap().cos;
         let picture = pdfcraft_annot::signature_image(cos, 0, 0).unwrap().unwrap();
@@ -278,4 +298,20 @@ mod tests {
         let error = doc.image_signature_preview(0, 0).err().unwrap();
         assert!(error.contains("4 megapixels"), "{error}");
     }
+
+    /// "Left edge at the point, centered vertically" is as displayed: on a turned page the box
+    /// is another one in user space. The image is 64 x 32 pt; the displayed point is (60, 100).
+    #[test]
+    fn the_signature_box_is_laid_out_as_displayed_on_turned_pages() {
+        let image = SignatureImage::from_bytes(&png(80, 40)).unwrap();
+        for (rotation, at, want) in [
+            (0, [60.0, 300.0], [60.0, 284.0, 124.0, 316.0]),
+            (90, [100.0, 60.0], [84.0, 60.0, 116.0, 124.0]),
+            (180, [240.0, 100.0], [176.0, 84.0, 240.0, 116.0]),
+            (270, [200.0, 340.0], [184.0, 276.0, 216.0, 340.0]),
+        ] {
+            let rect = image.rect(&page(rotation), at, false).unwrap();
+            assert!(rect.iter().zip(want).all(|(a, b)| (a - b).abs() < 0.01), "{rotation}: {rect:?}, want {want:?}");
+        }
+    }
 }
diff --git a/crates/engine/src/upright_image.rs b/crates/engine/src/upright_image.rs
new file mode 100644
index 00000000..dc2b9cdb
--- /dev/null
+++ b/crates/engine/src/upright_image.rs
@@ -0,0 +1,133 @@
+//! Photos from phones are stored sideways with an EXIF Orientation tag. PDF image XObjects have
+//! no such tag, so a JPEG embedded as it is would show up turned. Images placed into a page
+//! (stamps, added images, replacements) go through here first.
+
+use std::borrow::Cow;
+use std::io::Cursor;
+
+use image::codecs::jpeg::{JpegEncoder, PixelDensity, PixelDensityUnit};
+use image::metadata::Orientation;
+use image::{DynamicImage, ImageDecoder, ImageFormat, ImageReader};
+
+/// Quality of a re-encoded JPEG (the camera's own is rarely higher).
+const QUALITY: u8 = 92;
+/// Larger photos are embedded as they are: turning them would take hundreds of MB.
+const MAX_PIXELS: u64 = 64 << 20;
+
+/// A JPEG whose EXIF Orientation is not "as stored" has its pixels turned (and re-encoded);
+/// everything else, and any JPEG this can't read, is returned unchanged.
+pub(crate) fn upright(bytes: &[u8]) -> Cow<'_, [u8]> {
+    match turned(bytes) {
+        Some(out) => Cow::Owned(out),
+        None => Cow::Borrowed(bytes),
+    }
+}
+
+fn turned(bytes: &[u8]) -> Option<Vec<u8>> {
+    if !bytes.starts_with(&[0xFF, 0xD8]) {
+        return None;
+    }
+    let mut decoder = ImageReader::with_format(Cursor::new(bytes), ImageFormat::Jpeg).into_decoder().ok()?;
+    let orientation = decoder.orientation().ok()?;
+    let (w, h) = decoder.dimensions();
+    if orientation == Orientation::NoTransforms || u64::from(w) * u64::from(h) > MAX_PIXELS {
+        return None;
+    }
+    let mut image = DynamicImage::from_decoder(decoder).ok()?;
+    image.apply_orientation(orientation);
+    let mut out = Vec::new();
+    {
+        let mut encoder = JpegEncoder::new_with_quality(&mut out, QUALITY);
+        // Keep the resolution, which sets the image's natural size on the page.
+        if let Some(mut density) = jfif_density(bytes) {
+            if matches!(orientation, Orientation::Rotate90 | Orientation::Rotate270 | Orientation::Rotate90FlipH | Orientation::Rotate270FlipH) {
+                density.density = (density.density.1, density.density.0);
+            }
+            encoder.set_pixel_density(density);
+        }
+        match &image {
+            DynamicImage::ImageLuma8(gray) => encoder.encode_image(gray).ok()?,
+            _ => encoder.encode_image(&image.to_rgb8()).ok()?,
+        }
+    }
+    Some(out)
+}
+
+/// The resolution in a JFIF header, if the file has one in inches or centimetres.
+fn jfif_density(bytes: &[u8]) -> Option<PixelDensity> {
+    let mut i = 2usize;
+    while let Some(&[0xFF, marker, hi, lo]) = bytes.get(i..i.saturating_add(4)) {
+        let len = usize::from(u16::from_be_bytes([hi, lo]));
+        let seg = bytes.get(i + 4..i + 2 + len)?;
+        if marker == 0xE0 && seg.starts_with(b"JFIF\0") {
+            let &[unit, x0, x1, y0, y1] = seg.get(7..12)? else { return None };
+            let unit = match unit {
+                1 => PixelDensityUnit::Inches,
+                2 => PixelDensityUnit::Centimeters,
+                _ => return None,
+            };
+            return Some(PixelDensity { density: (u16::from_be_bytes([x0, x1]), u16::from_be_bytes([y0, y1])), unit });
+        }
+        if marker == 0xDA {
+            return None;
+        }
+        i += 2 + len;
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{Edit, MarkFile};
+
+    /// A 60 x 20 JPEG at `dpi` x 72 dpi, tagged with EXIF `orientation` (6: shown turned 90
+    /// degrees clockwise).
+    fn phone_jpeg(orientation: u8, dpi: u16) -> Vec<u8> {
+        let mut jpeg = Vec::new();
+        let mut encoder = JpegEncoder::new(&mut jpeg);
+        encoder.set_pixel_density(PixelDensity { density: (dpi, 72), unit: PixelDensityUnit::Inches });
+        encoder.encode_image(&image::RgbImage::from_pixel(60, 20, image::Rgb([20, 20, 20]))).unwrap();
+        let mut exif = b"Exif\0\0II\x2a\0\x08\0\0\0\x01\0\x12\x01\x03\0\x01\0\0\0".to_vec();
+        exif.extend_from_slice(&[orientation, 0, 0, 0, 0, 0, 0, 0]);
+        let mut out = jpeg[..2].to_vec();
+        out.extend_from_slice(&[0xff, 0xe1]);
+        out.extend_from_slice(&((exif.len() + 2) as u16).to_be_bytes());
+        out.extend_from_slice(&exif);
+        out.extend_from_slice(&jpeg[2..]);
+        out
+    }
+
+    #[test]
+    fn orientation_is_applied_and_plain_images_are_left_alone() {
+        let photo = phone_jpeg(6, 144);
+        let turned = upright(&photo);
+        assert!(matches!(turned, Cow::Owned(_)));
+        let decoded = image::load_from_memory(&turned).unwrap();
+        assert_eq!((decoded.width(), decoded.height()), (20, 60));
+        assert_eq!(jfif_density(&turned), Some(PixelDensity { density: (72, 144), unit: PixelDensityUnit::Inches }));
+        let stored = phone_jpeg(1, 72);
+        assert!(matches!(upright(&stored), Cow::Borrowed(_)));
+        assert!(matches!(upright(b"\x89PNG\r\n\x1a\n"), Cow::Borrowed(_)));
+        assert!(matches!(upright(b"\xff\xd8 not a jpeg"), Cow::Borrowed(_)));
+    }
+
+    #[test]
+    fn a_phone_photo_used_as_a_custom_stamp_is_embedded_upright() {
+        let mut session = crate::Session::new();
+        let blank = session.create_blank(300.0, 400.0, 1).unwrap();
+        let id = session.open_new("form.pdf", blank).unwrap();
+        // A click places the stamp at its natural size: 30 x 20 pt as stored, 20 x 30 pt upright.
+        // Named "Signature" so `signature_image` finds its picture.
+        let file = MarkFile { name: "photo.jpg".into(), bytes: std::sync::Arc::new(phone_jpeg(6, 144)), page: 0 };
+        let stamp = Edit::AddCustomStamp { page: 0, rect: [100.0, 100.0, 100.0, 100.0], name: "Signature".into(), file, author: "Ada".into() };
+        session.apply(id, stamp).unwrap();
+        let cos = &session.get(id).unwrap().editor.as_ref().unwrap().cos;
+        let picture = pdfcraft_annot::signature_image(cos, 0, 0).unwrap().unwrap();
+        let obj = cos.get(picture);
+        let pdfcraft_cos::Object::Stream(s) = &*obj else { panic!() };
+        assert_eq!((s.dict.int(b"Width"), s.dict.int(b"Height")), (Some(20), Some(60)));
+        let rect = pdfcraft_annot::summaries(cos)[0].rect;
+        assert!(((rect[2] - rect[0]) - 20.0).abs() < 0.01 && ((rect[3] - rect[1]) - 30.0).abs() < 0.01, "{rect:?}");
+    }
+}
diff --git a/crates/model/README.md b/crates/model/README.md
index 90d6ceba..19b457b6 100644
--- a/crates/model/README.md
+++ b/crates/model/README.md
@@ -8,6 +8,8 @@ L3/L4 crates need:
 - `Page::crop`, `Page::rotation` and `Page::view_matrix`: the displayed page's geometry, and the
   matrix from "display space" (origin at the bottom-left of the page as shown, after `/Rotate`)
   to user space, so content can be placed the way the reader sees the page.
+  `view_matrix_for(rotation, rect)` is the same matrix for any rectangle, e.g. to draw a
+  comment's picture upright inside its user-space `/Rect` on a turned page.
 
 `organize`, `annot` and `forms` still carry their own small walkers; they move here as the model
 grows (ADR-0004).
diff --git a/crates/model/src/lib.rs b/crates/model/src/lib.rs
index 6e558dea..ff9e70c0 100644
--- a/crates/model/src/lib.rs
+++ b/crates/model/src/lib.rs
@@ -49,13 +49,21 @@ impl Page {
     /// The matrix `[a b c d e f]` from display space (origin at the bottom-left of the page as
     /// shown, y up, after `/Rotate`) to user space.
     pub fn view_matrix(&self, doc: &Document) -> [f64; 6] {
-        let [x0, y0, x1, y1] = self.crop(doc);
-        match self.rotation(doc) {
-            90 => [0.0, 1.0, -1.0, 0.0, x1, y0],
-            180 => [-1.0, 0.0, 0.0, -1.0, x1, y1],
-            270 => [0.0, -1.0, 1.0, 0.0, x0, y1],
-            _ => [1.0, 0.0, 0.0, 1.0, x0, y0],
-        }
+        view_matrix_for(self.rotation(doc), self.crop(doc))
+    }
+}
+
+/// [`Page::view_matrix`] for a region `crop` (`[x0, y0, x1, y1]`) shown turned clockwise by
+/// `rotation` (0, 90, 180 or 270): the matrix from the turned region's own display space
+/// (origin at its bottom-left, y up) to the region's space. For a rectangle in user space it
+/// puts an upright picture into that rectangle as the page displays it.
+pub fn view_matrix_for(rotation: i64, crop: [f64; 4]) -> [f64; 6] {
+    let [x0, y0, x1, y1] = crop;
+    match rotation {
+        90 => [0.0, 1.0, -1.0, 0.0, x1, y0],
+        180 => [-1.0, 0.0, 0.0, -1.0, x1, y1],
+        270 => [0.0, -1.0, 1.0, 0.0, x0, y1],
+        _ => [1.0, 0.0, 0.0, 1.0, x0, y0],
     }
 }
 
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index f255d70e..ed1e9a32 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -12,6 +12,7 @@ workspace = true
 pdfcraft-fonts = { workspace = true }
 pdfcraft-engine = { workspace = true }
 pdfcraft-render = { workspace = true }
+pdfcraft-model = { workspace = true }
 pdfcraft-platform = { workspace = true }
 egui = { workspace = true }
 egui_extras = { workspace = true }
@@ -57,7 +58,6 @@ web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlE
 [dev-dependencies]
 pdfcraft-xfa = { workspace = true }
 pdfcraft-cos = { workspace = true }
-pdfcraft-model = { workspace = true }
 egui_kittest = { workspace = true, features = ["eframe", "wgpu"] }
 image = { version = "0.25", default-features = false, features = ["png"] }
 # Glyph-coverage test of the interface fonts; the same skrifa pdfcraft-fonts already uses.
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 065d01fe..beb88cc8 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -991,21 +991,28 @@ pub struct PageXform {
 }
 
 impl PageXform {
-    /// Draw an image in PDF user space, preserving orientation through both page rotations.
+    /// Draw an image in the PDF user-space `rect` as a custom stamp's appearance draws it: turned
+    /// back by `turn` (the page /Rotate it was placed for), so with the page's own rotation it
+    /// reads upright as displayed.
     pub(crate) fn paint_user_image(
         &self,
         painter: &egui::Painter,
         tex: egui::TextureId,
-        info: &DocInfo,
-        page: usize,
+        p: &pdfcraft_render::PageInfo,
         rect: [f64; 4],
+        turn: i64,
         color: Color32,
     ) {
-        let Some(p) = info.pages.get(page) else { return };
         let mut mesh = egui::Mesh::with_texture(tex);
-        for (x, y, u, v) in [(rect[0], rect[3], 0.0, 0.0), (rect[2], rect[3], 1.0, 0.0), (rect[2], rect[1], 1.0, 1.0), (rect[0], rect[1], 0.0, 1.0)] {
-            let p = p.user_to_view(x as f32, y as f32);
-            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(p[0] / self.pw, p[1] / self.ph), uv: pos2(u, v), color });
+        let (w, h) = (rect[2] - rect[0], rect[3] - rect[1]);
+        let (shown_w, shown_h) = if turn % 180 == 0 { (w, h) } else { (h, w) };
+        let [a, b, c, d, e, f] = pdfcraft_model::view_matrix_for(turn, rect);
+        for (u, v) in [(0.0_f32, 0.0_f32), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
+            // The texture's (u, v), from its top-left, in the picture's upright frame, then in user space.
+            let (dx, dy) = (f64::from(u) * shown_w, f64::from(1.0 - v) * shown_h);
+            let (x, y) = (a * dx + c * dy + e, b * dx + d * dy + f);
+            let q = p.user_to_view(x as f32, y as f32);
+            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(q[0] / self.pw, q[1] / self.ph), uv: pos2(u, v), color });
         }
         mesh.add_triangle(0, 1, 2);
         mesh.add_triangle(0, 2, 3);
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index 37438d05..3d08ac95 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -808,11 +808,9 @@ fn select_input(
         && let Some(o) = origin
     {
         if let (Some(h), Some(a)) = (handle_at(o), selected) {
-            let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).and_then(|ratio| {
-                let p = cx.info.pages.get(cx.page)?;
-                let rotation = u32::from(p.rotation) + u32::from(cx.xf.rot);
-                Some(if rotation % 180 == 0 { ratio } else { ratio.recip() })
-            });
+            // On screen, the image is also turned by the view's rotation.
+            let turned = !cx.xf.rot.is_multiple_of(180);
+            let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
             cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o, aspect_ratio });
             consumed = true;
         } else if let Some(a) = cx.hit(o)
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index ecd4eb6f..eb620426 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -5,7 +5,7 @@
 
 use egui::{Color32, CornerRadius, Pos2, Sense, Stroke, pos2, vec2};
 use pdfcraft_engine::{Edit, FillMark, NewAnnotation, Shape, SignatureImage, Style};
-use pdfcraft_render::DocInfo;
+use pdfcraft_render::{DocInfo, PageInfo};
 
 use crate::canvas::{DocView, PageXform};
 use crate::theme::Tokens;
@@ -212,10 +212,10 @@ pub fn typed_signature_at(page: usize, at: [f64; 2], text: &str, height: f64, au
 }
 
 /// Place a saved signature or initials.
-pub fn place(page: usize, at: [f64; 2], sig: &SavedSig, initials: bool, author: &str) -> Option<Edit> {
+pub fn place(page: usize, info: &PageInfo, at: [f64; 2], sig: &SavedSig, initials: bool, author: &str) -> Option<Edit> {
     match sig {
         SavedSig::Drawn(strokes) => signature_at(page, at, strokes, author),
-        SavedSig::Image(image) => image.edit(page, at, initials, author),
+        SavedSig::Image(image) => image.edit(page, info, at, initials, author),
         SavedSig::Typed(text) => {
             let [left, bottom, right, top] = pdfcraft_engine::script_outline(text).bounds();
             let height = if initials { 24.0_f64 } else { 32.0_f64 };
@@ -373,6 +373,7 @@ pub(crate) fn page_input(
     if !resp.contains_pointer() || !xf.rect.contains(pointer) {
         return None;
     }
+    let p = info.pages.get(page)?;
     let at = to_user(xf, info, page, pointer);
     let saved = match tool {
         FillTool::Signature => signature,
@@ -380,9 +381,9 @@ pub(crate) fn page_input(
         _ => None,
     };
     if let Some(SavedSig::Image(image)) = saved {
-        if let Some(rect) = image.rect(at, tool == FillTool::Initials) {
+        if let Some(rect) = image.rect(p, at, tool == FillTool::Initials) {
             let tex = image_texture(ui, image, preview);
-            xf.paint_user_image(ui.painter(), tex, info, page, rect, Color32::WHITE);
+            xf.paint_user_image(ui.painter(), tex, p, rect, i64::from(p.rotation), Color32::WHITE);
             ui.ctx().set_cursor_icon(egui::CursorIcon::None);
         }
     } else {
@@ -401,11 +402,11 @@ pub(crate) fn page_input(
             Some(FillAction::Edit(Box::new(typed(page, [at[0], at[1] + TEXT_SIZE * 0.6], &format!("{m}/{d}/{y}"), author))))
         }
         FillTool::Signature => match signature {
-            Some(s) => place(page, at, s, false, author).map(|e| FillAction::Signature(Box::new(e))),
+            Some(s) => place(page, p, at, s, false, author).map(|e| FillAction::Signature(Box::new(e))),
             None => Some(FillAction::CreateSignature),
         },
         FillTool::Initials => match initials {
-            Some(s) => place(page, at, s, true, author).map(|e| FillAction::Signature(Box::new(e))),
+            Some(s) => place(page, p, at, s, true, author).map(|e| FillAction::Signature(Box::new(e))),
             None => Some(FillAction::CreateInitials),
         },
         mark => {
diff --git a/crates/ui-egui/src/signature_drag.rs b/crates/ui-egui/src/signature_drag.rs
index e566ba3c..ad97d1b0 100644
--- a/crates/ui-egui/src/signature_drag.rs
+++ b/crates/ui-egui/src/signature_drag.rs
@@ -17,6 +17,8 @@ pub(crate) struct SignatureDrag {
 struct Layers {
     image: TextureHandle,
     opacity: f32,
+    /// The page /Rotate the PDF draws the image turned back by.
+    turn: i64,
     renderer: RenderPool,
     background: Option<TextureHandle>,
     tag: Option<u64>,
@@ -37,9 +39,13 @@ impl SignatureDrag {
                 && let Ok(Some(preview)) = doc.image_signature_preview(page, index)
             {
                 let [width, height] = preview.image.size();
-                self.aspect_ratio = Some(width as f32 / height as f32);
+                let ratio = width as f32 / height as f32;
+                // As displayed, the image is turned by the page's rotation less the turn it is drawn back by.
+                let shown = doc.info.pages.get(page).map_or(0, |p| i64::from(p.rotation)) - preview.turn;
+                self.aspect_ratio = Some(if shown.rem_euclid(180) == 0 { ratio } else { ratio.recip() });
                 self.layers = Some(Layers {
                     opacity: preview.opacity,
+                    turn: preview.turn,
                     image: ctx.load_texture(
                         "signature-drag-image",
                         ColorImage::from_rgba_unmultiplied(preview.image.size(), preview.image.rgba()),
@@ -87,7 +93,8 @@ impl SignatureDrag {
         self.key.is_some_and(|(_, p, i)| (p, i) == (page, index)) && self.layers.is_some()
     }
 
-    /// Use the embedded image's proportions, even after an edge handle stretched its rectangle.
+    /// Use the embedded image's proportions, even after an edge handle stretched its rectangle: its
+    /// width over its height as the page is displayed (before the view's own rotation).
     pub fn aspect_ratio(&self, page: usize, index: usize) -> Option<f32> {
         self.key.filter(|(_, p, i)| (*p, *i) == (page, index)).and(self.aspect_ratio)
     }
@@ -124,7 +131,7 @@ impl SignatureDrag {
         if !(dragging || released || layers.settling) {
             return;
         }
-        let (Some(background), Some(a)) = (&layers.background, cx.get(index)) else { return };
+        let (Some(background), Some(a), Some(p)) = (&layers.background, cx.get(index), cx.info.pages.get(page)) else { return };
         let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), painter.ctx().input(|i| i.pointer.hover_pos()), pending);
         let rect = cx.rect_to_user(rect);
         let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
@@ -132,9 +139,9 @@ impl SignatureDrag {
         cx.xf.paint_user_image(
             &painter,
             layers.image.id(),
-            cx.info,
-            page,
+            p,
             rect,
+            layers.turn,
             egui::Color32::from_white_alpha((layers.opacity * 255.0).round() as u8),
         );
     }
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 7888555e..2e85ff76 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -45,6 +45,21 @@ fn at(h: &Harness<'static, PdfCraftApp>, x: f32, y: f32) -> Pos2 {
     xf.norm_to_screen(p[0] / xf.pw, p[1] / xf.ph)
 }
 
+/// The screen point `dx` points right and `dy` points up, as displayed, from the user-space point
+/// (`x`, `y`): unlike `at`, offsets don't turn with the page's /Rotate.
+fn shown(h: &Harness<'static, PdfCraftApp>, x: f32, y: f32, dx: f32, dy: f32) -> Pos2 {
+    let s = h.state();
+    let page = &s.session.get(s.views[0].id).unwrap().info.pages[0];
+    let xf = pdfcraft_ui_egui::canvas::PageXform {
+        rect: s.views[0].page_screen_rect(0).expect("on screen"),
+        rot: s.views[0].rotation,
+        pw: page.width,
+        ph: page.height,
+    };
+    let p = page.user_to_view(x, y);
+    xf.norm_to_screen((p[0] + dx) / xf.pw, (p[1] - dy) / xf.ph)
+}
+
 fn click(h: &mut Harness<'static, PdfCraftApp>, x: f32, y: f32) {
     let p = at(h, x, y);
     h.hover_at(p);
@@ -297,7 +312,8 @@ fn saved_signature_cards_remove_and_add_without_changing_the_document() {
 fn long_typed_names_fit_the_placed_signature_and_keep_every_outline() {
     let text = "Alexandria Catherine Elizabeth Montgomery-Wellington";
     let sig = SavedSig::Typed(text.into());
-    let pdfcraft_engine::Edit::AddAnnotation(a) = pdfcraft_ui_egui::fill_sign::place(0, [40.0, 200.0], &sig, false, "").unwrap() else {
+    let page = pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 };
+    let pdfcraft_engine::Edit::AddAnnotation(a) = pdfcraft_ui_egui::fill_sign::place(0, &page, [40.0, 200.0], &sig, false, "").unwrap() else {
         panic!("expected annotation");
     };
     let pdfcraft_engine::Shape::TypedSignature { rect, contours } = a.shape else { panic!("expected typed signature") };
@@ -319,9 +335,15 @@ fn long_typed_names_fit_the_placed_signature_and_keep_every_outline() {
 }
 
 fn signature_file(test: &str) -> std::path::PathBuf {
+    signature_file_with_mark(test, 10..20)
+}
+
+/// A 120 x 40 signature: a stroke across the middle and a block above it at the columns `mark`
+/// (the rest is transparent), so a turned or flipped picture shows.
+fn signature_file_with_mark(test: &str, mark: std::ops::Range<u32>) -> std::path::PathBuf {
     let path = std::env::temp_dir().join(format!("pdfcraft-signature-{test}-{}.png", std::process::id()));
     let image = image::RgbaImage::from_fn(120, 40, |x, y| {
-        if (10..110).contains(&x) && (15..25).contains(&y) || (10..20).contains(&x) && (5..15).contains(&y) {
+        if (10..110).contains(&x) && (15..25).contains(&y) || mark.contains(&x) && (5..15).contains(&y) {
             image::Rgba([20, 30, 40, 255])
         } else {
             image::Rgba([0, 0, 0, 0])
@@ -404,7 +426,8 @@ fn image_signatures_and_initials_can_be_imported_placed_and_remembered() {
 
 #[test]
 fn image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation() {
-    let path = signature_file("pointer");
+    // The block above the stroke is at its right end, away from the pointer's own cursor.
+    let path = signature_file_with_mark("pointer", 100..110);
     let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
     let mut h = harness();
     // A link under the placement point must not replace the image with a hand cursor.
@@ -416,7 +439,8 @@ fn image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation()
     });
     h.state_mut().signature = Some(SavedSig::Image(image));
     h.state_mut().execute("sign.fill.signature");
-    // Exercise document rotation and view rotation separately and together.
+    // Exercise document rotation and view rotation separately and together. The image is upright
+    // as displayed, whatever the page's /Rotate; the view rotation turns the whole screen.
     let mut previous_document_rotation = 0;
     for (document_rotation, view_rotation, zoom) in [(0, 0, "150"), (90, 0, "100"), (0, 90, "100"), (90, 90, "75"), (0, 180, "75"), (0, 270, "100")] {
         let delta = document_rotation - previous_document_rotation;
@@ -433,20 +457,23 @@ fn image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation()
             h.hover_at(at(&h, 40.0, y));
             h.run_steps(2);
             assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::None, "the image replaces the crosshair");
-            let ink = at(&h, 90.0, y);
-            let margin = at(&h, 42.0, y);
-            let upper_stroke = at(&h, 52.0, y + 8.0);
-            let lower_margin = at(&h, 52.0, y - 8.0);
+            // The picture is 96 x 32 pt with its left edge at the pointer: the stroke spans 8..88
+            // and the block above it 80..88. egui_kittest paints a mouse cursor, a 16 px triangle
+            // down and right of the pointer, over the render, so only probe far from the pointer.
+            let ink = shown(&h, 40.0, y, 50.0, 0.0);
+            let margin = shown(&h, 40.0, y, 92.0, 0.0);
+            let upper_stroke = shown(&h, 40.0, y, 84.0, 8.0);
+            let lower_margin = shown(&h, 40.0, y, 84.0, -8.0);
             let pixels = h.render().unwrap();
             assert!(pixels.get_pixel(ink.x as u32, ink.y as u32).0[..3].iter().all(|v| *v < 60), "ink follows the pointer at the placed size");
             assert!(pixels.get_pixel(margin.x as u32, margin.y as u32).0[..3].iter().all(|v| *v > 240), "alpha exposes the page");
             assert!(
                 pixels.get_pixel(upper_stroke.x as u32, upper_stroke.y as u32).0[..3].iter().all(|v| *v < 60),
-                "the asymmetric image rotates with the page"
+                "the asymmetric image stays upright as displayed"
             );
             assert!(pixels.get_pixel(lower_margin.x as u32, lower_margin.y as u32).0[..3].iter().all(|v| *v > 240), "the image isn't flipped");
             if y == 150.0 {
-                let old = at(&h, 90.0, 250.0);
+                let old = shown(&h, 40.0, 250.0, 50.0, 0.0);
                 assert!(pixels.get_pixel(old.x as u32, old.y as u32).0[..3].iter().all(|v| *v > 240), "moving the pointer removes the old preview");
             }
             if document_rotation == 0
@@ -665,31 +692,53 @@ fn embedded_image_signature_live_gestures_follow_document_and_view_rotation() {
         h.state_mut().signature = Some(SavedSig::Image(image.clone()));
         h.state_mut().execute("sign.fill.signature");
         h.run_steps(3);
-        click(&mut h, 40.0, 250.0);
-        rendered_ink(&mut h, 90.0, 250.0);
+        // Points as displayed (from the shown page's bottom-left, y up). The signature is upright
+        // as displayed, so the same points apply whatever the page's /Rotate.
+        let page = h.state().session.get(h.state().views[0].id).unwrap().info.pages[0].clone();
+        let u = |x: f32, y: f32| page.view_to_user(x, page.height - y);
+        let [x, y] = u(40.0, 250.0);
+        click(&mut h, x, y);
+        let [x, y] = u(90.0, 250.0);
+        rendered_ink(&mut h, x, y);
         // Future placements may use a different signature: drag the PDF's embedded image.
         h.state_mut().signature = None;
-        h.drag_at(at(&h, 136.0, 234.0));
+        let [x, y] = u(136.0, 234.0);
+        h.drag_at(at(&h, x, y));
         h.run_steps(1);
-        let end = at(&h, 184.0, 228.0);
+        let [x, y] = u(184.0, 228.0);
+        let end = at(&h, x, y);
         h.hover_at(end);
-        rendered_ink(&mut h, 160.0, 242.0);
+        let [x, y] = u(160.0, 242.0);
+        rendered_ink(&mut h, x, y);
         let pixels = h.render().unwrap();
-        assert!(pixel_at(&h, &pixels, 58.0, 254.0)[..3].iter().all(|v| *v < 60), "asymmetric ink rotates during resize");
-        assert!(pixel_at(&h, &pixels, 58.0, 230.0)[..3].iter().all(|v| *v > 240), "alpha isn't flipped");
+        let [x, y] = u(58.0, 254.0);
+        assert!(pixel_at(&h, &pixels, x, y)[..3].iter().all(|v| *v < 60), "asymmetric ink stays upright during resize");
+        let [x, y] = u(58.0, 230.0);
+        assert!(pixel_at(&h, &pixels, x, y)[..3].iter().all(|v| *v > 240), "alpha isn't flipped");
         h.drop_at(end);
         h.run_steps(3);
-        h.drag_at(at(&h, 112.0, 242.0));
+        // The corner keeps the image's 3:1 as displayed: 144 x 48 from the top-left corner.
+        let ([x0, y0], [x1, y1]) = (u(40.0, 218.0), u(184.0, 266.0));
+        let rect = h.state().session.get(h.state().views[0].id).unwrap().info.annotations[0].rect;
+        let want = [x0.min(x1), y0.min(y1), x0.max(x1), y0.max(y1)];
+        assert!(rect.iter().zip(want).all(|(a, b)| (a - b).abs() < 0.01), "{rect:?} != {want:?}");
+        let [x, y] = u(112.0, 242.0);
+        h.drag_at(at(&h, x, y));
         h.run_steps(1);
-        h.hover_at(at(&h, 132.0, 142.0));
+        let [x, y] = u(132.0, 142.0);
+        let target = at(&h, x, y);
+        h.hover_at(target);
         h.run_steps(2);
         let pixels = h.render().unwrap();
-        assert!(pixel_at(&h, &pixels, 132.0, 142.0)[..3].iter().all(|v| *v < 60), "image moves before release");
-        assert!(pixel_at(&h, &pixels, 160.0, 242.0)[..3].iter().all(|v| *v > 240), "old ink is removed during movement");
-        assert!(!has_blue_near(&pixels, at(&h, 204.0, 166.0)));
-        h.drop_at(at(&h, 132.0, 142.0));
+        assert!(pixel_at(&h, &pixels, x, y)[..3].iter().all(|v| *v < 60), "image moves before release");
+        let [x, y] = u(160.0, 242.0);
+        assert!(pixel_at(&h, &pixels, x, y)[..3].iter().all(|v| *v > 240), "old ink is removed during movement");
+        let [x, y] = u(204.0, 166.0);
+        let corner = at(&h, x, y);
+        assert!(!has_blue_near(&pixels, corner));
+        h.drop_at(target);
         h.run_steps(2);
-        assert!(has_blue_near(&h.render().unwrap(), at(&h, 204.0, 166.0)));
+        assert!(has_blue_near(&h.render().unwrap(), corner));
     }
     std::fs::remove_file(path).unwrap();
 }

From 3c771e0395ca6d453a63847cf27aeef829119473 Mon Sep 17 00:00:00 2001
From: pauliusiv123-rgb <235694617+pauliusiv123-rgb@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:15:00 +0300
Subject: [PATCH 049/149] =?UTF-8?q?Issue=20#425:=20long=20file=20names=20a?=
 =?UTF-8?q?nd=20paths=20on=20Home=20end=20in=20"=E2=80=A6"=20before=20the?=
 =?UTF-8?q?=20row's=20details=20(#443)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/ui-egui/src/folders_ui.rs |  5 +++--
 crates/ui-egui/src/home.rs       | 10 ++++++----
 crates/ui-egui/src/widgets.rs    | 10 ++++++++++
 crates/ui-egui/tests/folders.rs  | 26 ++++++++++++++++++++++++++
 crates/ui-egui/tests/ui.rs       | 30 ++++++++++++++++++++++++++++++
 5 files changed, 75 insertions(+), 6 deletions(-)

diff --git a/crates/ui-egui/src/folders_ui.rs b/crates/ui-egui/src/folders_ui.rs
index f5cd90b5..727417e2 100644
--- a/crates/ui-egui/src/folders_ui.rs
+++ b/crates/ui-egui/src/folders_ui.rs
@@ -364,11 +364,12 @@ pub(crate) fn section(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 18.0,
                 egui::Color32::from_rgb(0xE0, 0x3E, 0x3E),
             );
-            ui.painter().text(rect.min + vec2(62.0, 19.0), Align2::LEFT_CENTER, crate::bidi::visual(&f.name), theme::medium(13.0), t.text);
             let size = crate::panels::human_size(usize::try_from(f.size).unwrap_or(usize::MAX));
             let when = f.modified.map(crate::combine_ui::ago).unwrap_or_default();
             let detail = if when.is_empty() { size } else { format!("{when}  ·  {size}") };
-            ui.painter().text(rect.right_center() - vec2(12.0, 0.0), Align2::RIGHT_CENTER, detail, theme::regular(12.0), t.text_muted);
+            let detail = ui.painter().text(rect.right_center() - vec2(12.0, 0.0), Align2::RIGHT_CENTER, detail, theme::regular(12.0), t.text_muted);
+            let width = detail.left() - 16.0 - (rect.left() + 62.0);
+            widgets::row_text(ui, rect.min + vec2(62.0, 19.0), crate::bidi::visual(&f.name), theme::medium(13.0), t.text, width);
             if resp.on_hover_text(&f.path).clicked() {
                 open = Some(f.path.clone());
             }
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 7e21c126..35f4efb6 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -123,16 +123,18 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     22.0,
                     egui::Color32::from_rgb(0xE0, 0x3E, 0x3E),
                 );
-                ui.painter().text(rect.min + vec2(46.0, 15.0), Align2::LEFT_CENTER, crate::bidi::visual(&r.name), theme::medium(13.5), t.text);
-                ui.painter().text(rect.min + vec2(46.0, 32.0), Align2::LEFT_CENTER, crate::bidi::visual(&r.path), theme::regular(11.0), t.text_faint);
-                ui.painter().text(
+                let detail = ui.painter().text(
                     rect.right_center() - vec2(12.0, 0.0),
                     Align2::RIGHT_CENTER,
                     format!("{} {}  ·  {}", r.pages, tl!("pages"), human_size(r.size)),
                     theme::regular(12.0),
                     t.text_muted,
                 );
-                if resp.clicked() {
+                // The name and path stop short of the page count; hovering shows the whole path.
+                let width = detail.left() - 16.0 - (rect.left() + 46.0);
+                widgets::row_text(ui, rect.min + vec2(46.0, 15.0), crate::bidi::visual(&r.name), theme::medium(13.5), t.text, width);
+                widgets::row_text(ui, rect.min + vec2(46.0, 32.0), crate::bidi::visual(&r.path), theme::regular(11.0), t.text_faint, width);
+                if resp.on_hover_text(&r.path).clicked() {
                     open = Some(r.path.clone());
                 }
             }
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index dc06ff1c..8351c126 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -81,6 +81,16 @@ pub fn section_title(ui: &mut egui::Ui, text: &str) {
     ui.add_space(2.0);
 }
 
+/// Paint one line of `text` left-aligned and vertically centred on `pos`, cut with "…" so it is
+/// at most `max_width` wide: a long file name or path stays inside its row (#425).
+pub fn row_text(ui: &egui::Ui, pos: egui::Pos2, text: impl Into<String>, font: egui::FontId, color: Color32, max_width: f32) {
+    let mut job = egui::text::LayoutJob::simple_singleline(text.into(), font, color);
+    job.wrap = egui::text::TextWrapping::truncate_at_width(max_width.max(0.0));
+    let galley = ui.painter().layout_job(job);
+    let rect = Align2::LEFT_CENTER.anchor_size(pos, galley.size());
+    ui.painter().galley(rect.min, galley, color);
+}
+
 /// Transient message at the bottom centre.
 pub fn toast(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let Some((msg, start)) = app.toast.clone() else { return };
diff --git a/crates/ui-egui/tests/folders.rs b/crates/ui-egui/tests/folders.rs
index 0f9fe80b..583cc35e 100644
--- a/crates/ui-egui/tests/folders.rs
+++ b/crates/ui-egui/tests/folders.rs
@@ -197,6 +197,32 @@ fn show_more_reveals_the_older_pdfs() {
     h.get_by_label("Show less");
 }
 
+#[test]
+fn a_long_pdf_name_is_cut_before_its_date_and_size() {
+    let dir = TempFolder::new("long");
+    // Short enough for Windows' 260-character paths under the temp folder.
+    let name = format!("{}.pdf", "Signed contract with a long name ".repeat(4));
+    dir.file(&name, FIXTURE, Duration::from_secs(10));
+    let folder = dir.path();
+    let mut h = harness(move |app| {
+        app.pin_folder(&folder);
+    });
+    h.run_steps(2);
+    let text: Vec<(String, bool, egui::Rect)> = h
+        .output()
+        .shapes
+        .iter()
+        .filter_map(|c| match &c.shape {
+            egui::Shape::Text(t) => Some((t.galley.text().to_owned(), t.galley.elided, t.visual_bounding_rect())),
+            _ => None,
+        })
+        .collect();
+    let (_, cut, rect) = text.iter().find(|(s, ..)| *s == name).expect("the PDF is listed");
+    let detail = text.iter().find(|(s, _, r)| s.contains('·') && r.y_range().contains(rect.center().y)).expect("its row shows the date and size").2;
+    assert!(*cut, "the name is cut short");
+    assert!(rect.right() < detail.left(), "the name ends before the date and size");
+}
+
 #[test]
 fn pinning_is_limited_and_never_duplicates() {
     let mut app = PdfCraftApp::new();
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index ecc7a21a..2582ce88 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -37,6 +37,36 @@ fn home_shows_welcome_and_tools() {
     h.get_by_label("Open file");
 }
 
+/// Every piece of text painted on the last frame: its whole text, whether it was cut with "…",
+/// and where it was drawn.
+fn painted_text(h: &Harness<'static, PdfCraftApp>) -> Vec<(String, bool, egui::Rect)> {
+    h.output()
+        .shapes
+        .iter()
+        .filter_map(|c| match &c.shape {
+            egui::Shape::Text(t) => Some((t.galley.text().to_owned(), t.galley.elided, t.visual_bounding_rect())),
+            _ => None,
+        })
+        .collect()
+}
+
+#[test]
+fn long_recent_names_and_paths_are_cut_before_the_page_count() {
+    let name = format!("{}.pdf", "Quarterly report final version ".repeat(10));
+    let path = format!("/{}/{name}", "A folder with a long name".repeat(8));
+    let h = harness({
+        let (name, path) = (name.clone(), path.clone());
+        move |app| app.recent.push(pdfcraft_ui_egui::RecentFile { name, path, pages: 7, size: 2048 })
+    });
+    let text = painted_text(&h);
+    let detail = text.iter().find(|(s, ..)| s.starts_with("7 pages")).expect("the row shows its page count").2;
+    for whole in [&name, &path] {
+        let (_, cut, rect) = text.iter().find(|(s, ..)| s == whole).expect("the row shows the name and the path");
+        assert!(*cut, "{whole:?} is cut short");
+        assert!(rect.right() < detail.left(), "{whole:?} ends before the page count");
+    }
+}
+
 #[test]
 fn every_catalog_tool_is_listed_after_view_more() {
     let mut h = harness(|_| {});

From 561377eb1f4506e4c0f21dff370a8f045a08c1d1 Mon Sep 17 00:00:00 2001
From: sanyamsingh001 <sanyamsingh001@duck.com>
Date: Fri, 9 Oct 2026 13:15:06 +0000
Subject: [PATCH 050/149] Keep document view state consistent when closing tabs
 and reverting (#439)

Preserve the selected document when an earlier inactive tab closes. Clear the reverted document's form drafts and queued edit only after a successful Revert.

Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
---
 crates/ui-egui/src/editing.rs | 100 +++++++++++++++++++++++++++++++++-
 crates/ui-egui/src/lib.rs     |   1 +
 crates/ui-egui/tests/forms.rs |  74 +++++++++++++++++++++++++
 crates/ui-egui/tests/ui.rs    |  91 +++++++++++++++++++++++++++++++
 4 files changed, 265 insertions(+), 1 deletion(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index e8b9aad5..1d1b6902 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -427,7 +427,13 @@ impl PdfCraftApp {
                 if let Some(i) = self.active
                     && let Some(d) = self.session.get(id)
                 {
-                    self.views[i].document_changed(&d.info);
+                    let view = &mut self.views[i];
+                    view.document_changed(&d.info);
+                    // Revert discards this source's uncommitted typing as well as model edits.
+                    // Otherwise a later Save could write a rejected draft back into the file.
+                    view.forms.focus = None;
+                    view.forms.committed = None;
+                    view.pending_edit = None;
                 }
                 self.notify_tr("Reverted to the last saved version");
             }
@@ -796,3 +802,95 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 }
+
+#[cfg(test)]
+mod revert_draft_tests {
+    use super::*;
+    use crate::forms_ui::Focus;
+    use pdfcraft_engine::FieldValue;
+
+    fn focus(text: &str) -> Focus {
+        Focus {
+            name: "name".into(),
+            widget: 0,
+            text: text.into(),
+            picked: Vec::new(),
+            request_focus: false,
+            select_all: false,
+            calendar: None,
+            calendar_rect: None,
+        }
+    }
+
+    fn app() -> PdfCraftApp {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("source.pdf", None, include_bytes!("../tests/data/form.pdf").to_vec()).unwrap();
+        app
+    }
+
+    fn queue_draft(app: &mut PdfCraftApp, index: usize, text: &str) {
+        app.views[index].forms.focus = Some(focus(text));
+        let form = app.session.get(app.views[index].id).unwrap().form.clone();
+        crate::forms_ui::commit(&mut app.views[index], &form);
+        assert!(app.views[index].forms.committed.is_some() && app.views[index].pending_edit.is_some());
+    }
+
+    #[test]
+    fn successful_revert_clears_focused_or_queued_drafts_only_on_its_document() {
+        for queued in [false, true] {
+            let mut app = app();
+            let source = app.views[0].id;
+            assert!(app.apply_edit(Edit::SetFieldValue { name: "name".into(), value: FieldValue::Text("Committed change".into()) }));
+            if queued {
+                queue_draft(&mut app, 0, "Queued source draft");
+            } else {
+                app.views[0].forms.focus = Some(focus("Focused source draft"));
+            }
+            app.open_bytes("other.pdf", None, include_bytes!("../tests/data/form.pdf").to_vec()).unwrap();
+            let other = app.views[1].id;
+            assert!(app.apply_edit(Edit::SetFieldValue { name: "name".into(), value: FieldValue::Text("Other committed value".into()) }));
+            queue_draft(&mut app, 1, "Other queued draft");
+            app.views[1].forms.focus = Some(focus("Other focused draft"));
+            let other_bytes = app.session.get(other).unwrap().bytes.clone();
+            let other_generation = app.session.get(other).unwrap().edit_generation();
+            let source_generation = app.session.get(source).unwrap().edit_generation();
+            app.active = Some(0);
+            app.revert_active();
+            let reverted = app.session.get(source).unwrap();
+            assert!(!reverted.dirty);
+            assert_eq!(reverted.edit_generation(), source_generation + 1);
+            assert!(reverted.form.iter().find(|field| field.name == "name").unwrap().value.is_empty());
+            assert!(app.views[0].forms.focus.is_none() && app.views[0].forms.committed.is_none() && app.views[0].pending_edit.is_none());
+            assert!(!app.has_unsaved_work(0));
+            assert_eq!(app.views[1].forms.focus.as_ref().unwrap().text, "Other focused draft");
+            assert_eq!(app.views[1].forms.committed.as_ref().unwrap().text, "Other queued draft");
+            assert!(
+                matches!(&app.views[1].pending_edit, Some(Edit::SetFieldValue { name, value: FieldValue::Text(text) }) if name == "name" && text == "Other queued draft")
+            );
+            let untouched = app.session.get(other).unwrap();
+            assert_eq!(untouched.bytes, other_bytes);
+            assert_eq!(untouched.edit_generation(), other_generation);
+            assert!(untouched.dirty && app.has_unsaved_work(1));
+            assert_eq!(app.active_ids(), Some((0, source)));
+        }
+    }
+
+    #[test]
+    fn failed_revert_preserves_focused_and_queued_drafts() {
+        let mut app = app();
+        let source = app.views[0].id;
+        queue_draft(&mut app, 0, "Queued draft");
+        app.views[0].forms.focus = Some(focus("Focused draft"));
+        // Exercise the ordinary NoDocument error boundary without a corrupt fixture.
+        // This verifies UI failure preservation, not other engine refresh failures.
+        app.session.close(source);
+        app.revert_active();
+        assert_eq!(app.views[0].forms.focus.as_ref().unwrap().text, "Focused draft");
+        assert_eq!(app.views[0].forms.committed.as_ref().unwrap().text, "Queued draft");
+        assert!(
+            matches!(&app.views[0].pending_edit, Some(Edit::SetFieldValue { name, value: FieldValue::Text(text) }) if name == "name" && text == "Queued draft")
+        );
+        assert_eq!(app.active_ids(), Some((0, source)));
+        assert_eq!(app.toast.as_ref().unwrap().0, pdfcraft_engine::EditError::NoDocument.to_string());
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 91f2edd8..3770168b 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -1036,6 +1036,7 @@ impl PdfCraftApp {
         self.session.close(id);
         self.active = match self.active {
             _ if self.views.is_empty() => None,
+            Some(a) if a > index => Some(a - 1),
             Some(a) if a >= self.views.len() => Some(self.views.len() - 1),
             other => other,
         };
diff --git a/crates/ui-egui/tests/forms.rs b/crates/ui-egui/tests/forms.rs
index f4f3552d..57a80dff 100644
--- a/crates/ui-egui/tests/forms.rs
+++ b/crates/ui-egui/tests/forms.rs
@@ -401,3 +401,77 @@ fn flattening_while_typing_flattens_the_typed_text() {
         .unwrap_or_default();
     assert!(text.contains("Flat Ada"), "into the page: {text:?}");
 }
+
+#[cfg(not(target_arch = "wasm32"))]
+mod revert_tests {
+    use super::*;
+    use egui_kittest::kittest::Queryable;
+    use std::path::PathBuf;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    struct RevertDir(PathBuf);
+    impl RevertDir {
+        fn new() -> Self {
+            static NEXT: AtomicU64 = AtomicU64::new(0);
+            for _ in 0..128 {
+                let path = std::env::temp_dir().join(format!("pdfcraft-revert-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+                match std::fs::create_dir(&path) {
+                    Ok(()) => return Self(path),
+                    Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                    Err(error) => panic!("creating Revert test directory: {error}"),
+                }
+            }
+            panic!("no unused Revert test directory after 128 attempts");
+        }
+    }
+    impl Drop for RevertDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn reverting_rejected_input_saves_the_original_field_and_appearance() {
+        let dir = RevertDir::new();
+        let path = dir.0.join("saved.pdf");
+        let mut h = harness();
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::SetFieldValue {
+            name: "name".into(),
+            value: pdfcraft_engine::FieldValue::Text("Saved original".into()),
+        }));
+        h.state_mut().save_override = Some(path.to_string_lossy().into_owned());
+        assert!(h.state_mut().save_active(pdfcraft_ui_egui::SaveTarget::InPlace));
+        let saved = std::fs::read(&path).unwrap();
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::SetFieldProps {
+            name: "name".into(),
+            props: Box::new(pdfcraft_engine::FieldProps {
+                validate: Some(pdfcraft_engine::form_scripts::Validate::Range { min: Some(0.0), max: Some(10.0) }),
+                ..Default::default()
+            }),
+        }));
+        h.run_steps(3);
+        click_field(&mut h, "name", 0);
+        h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+        h.event(egui::Event::Text("99".into()));
+        h.run_steps(2);
+        h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::S);
+        h.run_steps(4);
+        assert_eq!(h.state().views[0].forms.focus.as_ref().unwrap().text, "99");
+        assert_eq!(std::fs::read(&path).unwrap(), saved, "rejection leaves the saved file untouched");
+        assert!(h.state_mut().execute("file.revert"));
+        h.run_steps(2);
+        h.get_all_by_label("Revert").last().expect("confirmation button").click();
+        h.run_steps(4);
+        assert!(h.state().views[0].forms.focus.is_none() && h.state().views[0].pending_edit.is_none());
+        assert_eq!(h.state().first_dirty(), None, "Revert discards rejected typing too");
+        assert_eq!(value(&h, "name"), ["Saved original"]);
+        assert!(h.state_mut().save_active(pdfcraft_ui_egui::SaveTarget::InPlace));
+        assert_eq!(saved_value(&path, "name"), ["Saved original"]);
+        let bytes = std::fs::read(&path).unwrap();
+        assert_eq!(bytes, saved, "later Save cannot resurrect the discarded draft");
+        let mut renderer = pdfcraft_render::PageRenderer::new(std::sync::Arc::new(bytes), Default::default());
+        let output = renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Text, ..Default::default() });
+        assert!(output.error.is_none(), "saved appearance is readable: {:?}", output.error);
+        assert!(output.text.unwrap().plain_text().contains("Saved original"), "saved AP still draws the original value");
+    }
+}
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 2582ce88..27fa3bc5 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -485,3 +485,94 @@ fn opening_a_pdf_keeps_a_closed_left_panel_and_the_chosen_tool() {
     assert_eq!(app.mode, Mode::AllTools);
     assert_eq!(app.left, LeftPanel::Tool("export"));
 }
+
+fn three_tab_harness() -> Harness<'static, PdfCraftApp> {
+    harness(|app| {
+        for name in ["first.pdf", "middle.pdf", "last.pdf"] {
+            app.open_bytes(name, None, FIXTURE.to_vec()).unwrap();
+        }
+    })
+}
+
+fn close_named_tab(h: &mut Harness<'static, PdfCraftApp>, name: &str) {
+    // The close button has no separate accessible label. Its centre is defined by
+    // chrome::tab relative to the actual accessible tab rectangle, not a viewport guess.
+    let pos = h.get_by_label(name).rect().right_center() - egui::vec2(16.0, 0.0);
+    h.event(egui::Event::PointerMoved(pos));
+    h.event(egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(3);
+}
+
+#[test]
+fn closing_tabs_keeps_the_selected_document_or_selects_its_neighbor() {
+    for removed in [0, 1, 2] {
+        let mut h = three_tab_harness();
+        let ids: Vec<_> = h.state().views.iter().map(|view| view.id).collect();
+        h.get_by_label("middle.pdf").click();
+        h.run_steps(3);
+        assert_eq!(h.state().active_ids().map(|(_, id)| id), Some(ids[1]));
+        close_named_tab(&mut h, ["first.pdf", "middle.pdf", "last.pdf"][removed]);
+        let expected = if removed == 1 { ids[2] } else { ids[1] };
+        let app = h.state();
+        assert_eq!(app.active_ids().map(|(_, id)| id), Some(expected), "removed tab {removed}");
+        assert_eq!(
+            app.views.iter().map(|view| view.id).collect::<Vec<_>>(),
+            ids.iter().copied().enumerate().filter_map(|(i, id)| (i != removed).then_some(id)).collect::<Vec<_>>()
+        );
+        assert_eq!(app.session.docs().len(), 2);
+        assert!(app.session.get(ids[removed]).is_none());
+        assert!(app.close_request.is_none(), "clean tabs close without a prompt");
+        for doc in app.session.docs() {
+            assert_eq!(doc.bytes.as_slice(), FIXTURE);
+            assert!(!doc.dirty);
+        }
+    }
+}
+
+#[test]
+fn closing_the_last_active_tab_selects_the_previous_one_then_home() {
+    let mut h = three_tab_harness();
+    let ids: Vec<_> = h.state().views.iter().map(|view| view.id).collect();
+    for (removed, name) in [(2usize, "last.pdf"), (1, "middle.pdf"), (0, "first.pdf")] {
+        close_named_tab(&mut h, name);
+        let app = h.state();
+        assert_eq!(app.active_ids().map(|(_, id)| id), removed.checked_sub(1).map(|index| ids[index]));
+        assert_eq!(app.views.len(), removed);
+        assert_eq!(app.session.docs().len(), removed);
+        assert!(app.session.get(ids[removed]).is_none());
+    }
+    assert_eq!(h.state().active, None);
+    h.get_by_label_contains("Welcome to PdfCraft");
+}
+
+#[test]
+fn cancelling_then_discarding_an_earlier_dirty_tab_preserves_the_selected_document() {
+    let mut h = three_tab_harness();
+    let ids: Vec<_> = h.state().views.iter().map(|view| view.id).collect();
+    h.get_by_label("first.pdf").click();
+    h.run_steps(3);
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::SetInfo { key: "Title".into(), value: "Unsaved title".into() }));
+    h.run_steps(3);
+    h.get_by_label("middle.pdf").click();
+    h.run_steps(3);
+    close_named_tab(&mut h, "first.pdf (edited)");
+    assert_eq!(h.state().close_request, Some(pdfcraft_ui_egui::CloseRequest::Tab(ids[0])));
+    h.get_by_label("Cancel").click();
+    h.run_steps(3);
+    assert_eq!(h.state().views.len(), 3);
+    assert_eq!(h.state().active_ids().map(|(_, id)| id), Some(ids[1]));
+    assert!(h.state().session.get(ids[0]).unwrap().dirty);
+    close_named_tab(&mut h, "first.pdf (edited)");
+    h.get_by_label("Don't save").click();
+    h.run_steps(3);
+    assert_eq!(h.state().active_ids().map(|(_, id)| id), Some(ids[1]));
+    assert_eq!(h.state().views.iter().map(|view| view.id).collect::<Vec<_>>(), [ids[1], ids[2]]);
+    assert!(h.state().session.get(ids[0]).is_none());
+    assert!(h.state().close_request.is_none());
+    for doc in h.state().session.docs() {
+        assert_eq!(doc.bytes.as_slice(), FIXTURE);
+        assert!(!doc.dirty);
+    }
+}

From 3543ca8296dc52c4703aca96555b9e1c50fa025e Mon Sep 17 00:00:00 2001
From: Wesley Haines <wes@weshaines.com>
Date: Fri, 9 Oct 2026 09:15:13 -0400
Subject: [PATCH 051/149] Edit text: fast drags on a paragraph's edge no longer
 get dropped (#436)

The rewrap handle took the drag target from the pointer's current position.
egui only reports drag_started() once the pointer has moved 6 points (or the
button was held 0.8 s), so a quick outward flick had already left the 7x14 px
handle and the drag was ignored. Resolve the target from press_origin(), as
prepare.rs does, before the hover early-return.

Also: the left edge rewraps too (width plus an x offset), and edge grips span
the box's full height, 6 px either side of the edge.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/edit_text_ui.rs | 112 +++++++++++++++++++++--------
 crates/ui-egui/tests/editing.rs    |  56 +++++++++++++++
 2 files changed, 138 insertions(+), 30 deletions(-)

diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 6a455cf4..6cab5466 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -1,7 +1,7 @@
 //! Edit a PDF ▸ Edit text & images: boxes around the paragraphs and images already on the page.
 //! Click a paragraph to edit it in place (⌘Enter or clicking away applies and rewraps it to the
-//! box, Esc cancels); drag it to move it, or drag the handle on its right edge to rewrap it to a
-//! new width. Click an image to select it: drag to move, drag a corner to resize (keeping
+//! box, Esc cancels); drag it to move it, or drag the handle on its left or right edge to rewrap
+//! it to a new width. Click an image to select it: drag to move, drag a corner to resize (keeping
 //! its proportions), right-click for rotate, flip, replace, save and delete; Delete removes it.
 
 use egui::{Color32, CornerRadius, FontFamily, FontId, Pos2, Rect, Stroke};
@@ -170,19 +170,56 @@ pub struct ImageSelection {
     drag: Option<(Pos2, Option<Pos2>)>,
 }
 
-/// A paragraph box being dragged: moved, or (from the handle on its right edge) resized.
+/// What a drag on a paragraph box takes hold of.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Grip {
+    Move,
+    /// An edge (screen left or right), dragged to rewrap the paragraph.
+    Left,
+    Right,
+}
+
+/// A paragraph box being dragged: moved, or (from a handle on its left or right edge) resized.
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub struct BlockDrag {
     page: usize,
     block: usize,
     /// Where the drag started (screen).
     start: Pos2,
-    resize: bool,
+    grip: Grip,
 }
 
-/// The resize handle on a paragraph box's right edge (screen).
-fn width_handle(b: Rect) -> Rect {
-    Rect::from_center_size(Pos2::new(b.right(), b.center().y), egui::vec2(7.0, 14.0))
+/// How far an edge grip reaches either side of a box's edge (screen pixels).
+const EDGE_REACH: f32 = 6.0;
+
+/// The rewrap handles drawn on a paragraph box's left and right edges (screen).
+fn width_handles(b: Rect) -> [Rect; 2] {
+    let h = (b.height() * 0.5).clamp(14.0, 28.0);
+    [b.left(), b.right()].map(|x| Rect::from_center_size(Pos2::new(x, b.center().y), egui::vec2(7.0, h)))
+}
+
+/// The edge of `b` that `p` grabs: anywhere along its height, within reach of the line. A narrow
+/// box keeps its middle for moving.
+fn edge_at(b: Rect, p: Pos2) -> Option<Grip> {
+    if p.y < b.top() - EDGE_REACH || p.y > b.bottom() + EDGE_REACH {
+        return None;
+    }
+    let inside = EDGE_REACH.min(b.width() / 4.0);
+    let (dl, dr) = (p.x - b.left(), b.right() - p.x);
+    match (dl >= -EDGE_REACH && dl <= inside, dr >= -EDGE_REACH && dr <= inside) {
+        (true, true) if dl <= dr => Some(Grip::Left),
+        (_, true) => Some(Grip::Right),
+        (true, false) => Some(Grip::Left),
+        _ => None,
+    }
+}
+
+/// The topmost box under `p` and what it grabs there; edges only on an upright page.
+fn grab_at(boxes: &[Rect], p: Pos2, upright: bool) -> Option<(usize, Grip)> {
+    boxes.iter().enumerate().rev().find_map(|(i, b)| match upright.then(|| edge_at(*b, p)).flatten() {
+        Some(g) => Some((i, g)),
+        None => b.contains(p).then_some((i, Grip::Move)),
+    })
 }
 
 /// What a right-click on a selected image asks for.
@@ -360,25 +397,38 @@ pub(crate) fn page_input(
     // The width handle needs the page upright (or upside down): on a quarter-turned page the
     // screen's horizontal is the paragraph's vertical.
     let upright = info.pages.get(page).is_some_and(|p| p.rotation % 180 == 0);
-    // A drag in progress: the box follows the pointer (or its right edge does); releasing applies it.
+    let draw_handles = |b: Rect| {
+        for h in width_handles(b) {
+            painter.rect(h, CornerRadius::same(2), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
+        }
+    };
+    // A drag in progress: the box follows the pointer (or the grabbed edge does); releasing applies it.
     if let Some(d) = view.block_drag.filter(|d| d.page == page)
         && let (Some(b), Some(l)) = (boxes.get(d.block).copied(), lines.get(d.block))
     {
         let p = ui.input(|i| i.pointer.interact_pos()).unwrap_or(d.start);
-        let preview = if d.resize {
-            Rect::from_min_max(b.min, Pos2::new((b.right() + p.x - d.start.x).max(b.left() + 12.0), b.max.y))
-        } else {
-            b.translate(p - d.start)
+        let dx = p.x - d.start.x;
+        let preview = match d.grip {
+            Grip::Move => b.translate(p - d.start),
+            Grip::Left => Rect::from_min_max(Pos2::new((b.left() + dx).min(b.right() - 12.0), b.min.y), b.max),
+            Grip::Right => Rect::from_min_max(b.min, Pos2::new((b.right() + dx).max(b.left() + 12.0), b.max.y)),
         };
         painter.rect_stroke(preview, CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-        ui.ctx().set_cursor_icon(if d.resize { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Grabbing });
+        let resizing = d.grip != Grip::Move;
+        if resizing {
+            draw_handles(preview);
+        }
+        ui.ctx().set_cursor_icon(if resizing { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Grabbing });
         if resp.drag_stopped() || !ui.input(|i| i.pointer.any_down()) {
             view.block_drag = None;
             let (from, to) = (user_box(xf, info, page, b), user_box(xf, info, page, preview));
-            let style = if d.resize {
-                // The new width in user space: the box's change, added to the paragraph's own.
+            let style = if resizing {
+                // The new width in user space: the box's change, added to the paragraph's own. A
+                // moved left side (in user space; on an upside-down page that's the screen's right
+                // edge) moves the paragraph with it.
                 let width = (l.rect[2] - l.rect[0]) + (to[2] - to[0]) - (from[2] - from[0]);
-                pdfcraft_engine::BlockStyle { width: Some(width), ..Default::default() }
+                let shift = to[0] - from[0];
+                pdfcraft_engine::BlockStyle { width: Some(width), offset: (shift != 0.0).then_some([shift, 0.0]), ..Default::default() }
             } else {
                 pdfcraft_engine::BlockStyle { offset: Some([to[0] - from[0], to[1] - from[1]]), ..Default::default() }
             };
@@ -388,26 +438,28 @@ pub(crate) fn page_input(
         }
         return true;
     }
-    let Some(p) = ui.input(|i| i.pointer.hover_pos()).filter(|p| xf.rect.contains(*p)) else { return false };
-    let Some(hit) = boxes.iter().rposition(|b| b.contains(p) || (upright && width_handle(*b).contains(p))) else { return false };
-    if active != Some(hit) {
-        painter.rect_stroke(boxes[hit], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-    }
-    let on_handle = upright && active.is_none() && width_handle(boxes[hit]).contains(p);
-    if upright && active.is_none() {
-        painter.rect(width_handle(boxes[hit]), CornerRadius::same(2), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
-    }
-    ui.ctx().set_cursor_icon(if on_handle { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Text });
-    // Dragging a box (not while a paragraph is open for typing) moves it; from the handle, resizes it.
+    // Dragging a box (not while a paragraph is open for typing) moves it; from an edge, resizes it.
+    // What it grabs comes from where the button went down, not where the pointer is now: egui
+    // only calls it a drag once the pointer has moved a few pixels (or been held a moment), and a
+    // quick flick has left the edge by then.
     if resp.drag_started()
         && active.is_none()
         && let Some(o) = ui.input(|i| i.pointer.press_origin())
-        && let Some(block) = boxes.iter().rposition(|b| b.contains(o) || (upright && width_handle(*b).contains(o)))
+        && let Some((block, grip)) = grab_at(&boxes, o, upright)
     {
-        let resize = upright && width_handle(boxes[block]).contains(o);
-        view.block_drag = Some(BlockDrag { page, block, start: o, resize });
+        view.block_drag = Some(BlockDrag { page, block, start: o, grip });
         return true;
     }
+    let Some(p) = ui.input(|i| i.pointer.hover_pos()).filter(|p| xf.rect.contains(*p)) else { return false };
+    let Some((hit, grip)) = grab_at(&boxes, p, upright) else { return false };
+    if active != Some(hit) {
+        painter.rect_stroke(boxes[hit], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+    }
+    let on_edge = active.is_none() && grip != Grip::Move;
+    if upright && active.is_none() {
+        draw_handles(boxes[hit]);
+    }
+    ui.ctx().set_cursor_icon(if on_edge { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Text });
     if resp.clicked() {
         let l = &lines[hit];
         // Screen pixels per point, from the box's width.
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 99c0ec11..524e42de 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -1629,6 +1629,62 @@ fn dragging_a_paragraph_moves_it_and_its_edge_rewraps_it() {
     assert!(h.state().views[0].line_editor.is_none());
 }
 
+/// A quick flick: press at `from`, and the next frame already finds the pointer at `to`.
+fn flick(h: &mut Harness<'static, PdfCraftApp>, from: egui::Pos2, to: egui::Pos2) {
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    h.hover_at(to);
+    h.run_steps(1);
+    h.drop_at(to);
+    h.run_steps(4);
+}
+
+#[test]
+fn a_quick_flick_on_either_edge_rewraps_the_paragraph() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let lines = |h: &Harness<'static, PdfCraftApp>| {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().text_lines(0)
+    };
+    let block = |h: &Harness<'static, PdfCraftApp>| {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].clone()
+    };
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let screen = |x: f64, y: f64| egui::pos2(r.left() + x as f32 * k, r.top() + (300.0 - y as f32) * k);
+    let near = |a: f64, b: f64| (a - b).abs() < 1.5;
+    // Grab edges near the box's top: a rewrapped box reaches the window's bottom, where the
+    // tool's toast sits over the page and takes the press.
+    let grip_y = |b: &pdfcraft_engine::TextBlock| b.rect[3] - 6.0;
+    // Narrow "Page 1" from its right edge to about 45 pt: it rewraps onto two lines.
+    let b = block(&h);
+    let edge = screen(b.rect[2], grip_y(&b)) + egui::vec2(2.0, 0.0);
+    flick(&mut h, edge, edge - egui::vec2((b.rect[2] - b.rect[0] - 45.0) as f32 * k, 0.0));
+    let text: Vec<String> = lines(&h).iter().map(|l| l.text.clone()).collect();
+    assert_eq!(text, ["Page", "1"], "narrowed from the right edge");
+    // Flick the right edge outward, past the box and its handle: back onto one line.
+    let b = block(&h);
+    let edge = screen(b.rect[2], grip_y(&b)) + egui::vec2(2.0, 0.0);
+    flick(&mut h, edge, edge + egui::vec2(80.0 * k, 0.0));
+    let text: Vec<String> = lines(&h).iter().map(|l| l.text.clone()).collect();
+    assert_eq!(text, ["Page 1"], "widened by a fast drag that left the handle at once");
+    // Flick the left edge inward: it rewraps and its left side follows the pointer.
+    let b = block(&h);
+    let edge = screen(b.rect[0], grip_y(&b)) - egui::vec2(2.0, 0.0);
+    let inward = (b.rect[2] - b.rect[0] - 45.0) as f32;
+    flick(&mut h, edge, edge + egui::vec2(inward * k, 0.0));
+    let after = lines(&h);
+    let text: Vec<String> = after.iter().map(|l| l.text.clone()).collect();
+    assert_eq!(text, ["Page", "1"], "narrowed from the left edge");
+    assert!(near(after[0].rect[0], b.rect[0] + inward as f64), "{:?} → {:?}", b.rect, after[0].rect);
+    assert!(h.state().views[0].line_editor.is_none());
+}
+
 /// The Pages panel, in a window tall enough to show every thumbnail of a short fixture.
 fn pages_panel(pages: usize) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1900.0)).build_eframe(move |_cc| {

From c8c7959c0fac4b132f6f6a14c28fa1b5e0caedd4 Mon Sep 17 00:00:00 2001
From: midasdf <205497066+midasdf@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:15:18 +0900
Subject: [PATCH 052/149] M4.6: search bookmark titles without changing the
 outline (#424)

Refs #257. Show matching entries and their ancestors, keep original edit paths and preserve per-document view state.

Assisted-by: OpenAI GPT-6.1 (gpt-6.1-sol)
---
 README.md                         |  2 +-
 crates/ui-egui/src/panels.rs      | 69 ++++++++++++++++++++++++++++++-
 crates/ui-egui/tests/bookmarks.rs | 65 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/control.rs   | 29 +++++++++++++
 4 files changed, 162 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 24db83c6..74deff1e 100644
--- a/README.md
+++ b/README.md
@@ -133,7 +133,7 @@ Search the whole document as you type, step through matches with <kbd>⌘G</kbd>
 
 ## Navigate long documents
 
-Bookmarks, page thumbnails and the document's own page labels (i, ii, 1, 2…) keep you oriented in long documents.
+Bookmarks, page thumbnails and the document's own page labels (i, ii, 1, 2…) keep you oriented in long documents. Search bookmark titles in the Bookmarks panel to find nested entries even when their parents are collapsed. Matches keep their ancestors for context; Clear restores the unfiltered tree without changing its expansion state.
 
 <table>
 <tr>
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 27ac404e..20ab7003 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -486,6 +486,37 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     });
                 });
                 ui.add_space(6.0);
+                let search_id = egui::Id::new(("bookmark_search", id.0));
+                let mut bookmark_query = ui.data(|d| d.get_temp::<String>(search_id)).unwrap_or_default();
+                if panel == RightPanel::Bookmarks && !info.outline.is_empty() {
+                    ui.horizontal(|ui| {
+                        let label = ui.label(tl!("Search"));
+                        let previous = bookmark_query.clone();
+                        let response =
+                            ui.add(egui::TextEdit::singleline(&mut bookmark_query).desired_width(ui.available_width() - 32.0)).labelled_by(label.id);
+                        response.widget_info(|| {
+                            let mut info = egui::WidgetInfo::text_edit(ui.is_enabled(), &previous, &bookmark_query, "");
+                            info.label = Some(tl!("Search").to_string());
+                            info
+                        });
+                        if icons::button(ui, "x", 26.0, false, tl!("Clear")).clicked() {
+                            bookmark_query.clear();
+                        }
+                    });
+                    ui.data_mut(|d| d.insert_temp(search_id, bookmark_query.clone()));
+                    ui.add_space(6.0);
+                }
+                let bookmark_query = bookmark_query.trim().to_lowercase();
+                let mut bookmark_matches =
+                    if panel == RightPanel::Bookmarks { outline_matches(&info.outline, &bookmark_query) } else { std::collections::HashSet::new() };
+                // A new bookmark must stay nameable even when its initial title doesn't match.
+                if let Some((path, _)) = &bm_rename {
+                    let mut ancestor = path.clone();
+                    while !ancestor.is_empty() {
+                        bookmark_matches.insert(ancestor.clone());
+                        ancestor.pop();
+                    }
+                }
                 egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| match panel {
                     RightPanel::Comments => {
                         if let Some(e) = crate::comments_panel::show(ui, &t, info, view, prefs, comment_allowed, &mut nav) {
@@ -503,7 +534,12 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                             editable: bm_editable,
                             current: view.current,
                             expand: bm_expand,
+                            matches: &bookmark_matches,
+                            searching: !bookmark_query.is_empty(),
                         };
+                        if ctx.searching && bookmark_matches.is_empty() && !info.outline.is_empty() {
+                            ui.label(tl!("No matches."));
+                        }
                         for (i, item) in info.outline.iter().enumerate() {
                             outline_item(ui, &t, info, item, &[i], info.outline.len(), &mut ctx);
                         }
@@ -673,6 +709,30 @@ pub enum BmAction {
     Outdent(Vec<usize>),
 }
 
+/// Matching titles plus their ancestors, keeping document paths rather than filtered indexes.
+fn outline_matches(items: &[OutlineItem], query: &str) -> std::collections::HashSet<Vec<usize>> {
+    let mut matches = std::collections::HashSet::new();
+    if query.is_empty() {
+        return matches;
+    }
+    let mut pending: Vec<_> = items.iter().enumerate().map(|(i, item)| (vec![i], item)).collect();
+    while let Some((path, item)) = pending.pop() {
+        if item.title.to_lowercase().contains(query) {
+            let mut ancestor = path.clone();
+            while !ancestor.is_empty() {
+                matches.insert(ancestor.clone());
+                ancestor.pop();
+            }
+        }
+        for (i, child) in item.children.iter().enumerate() {
+            let mut child_path = path.clone();
+            child_path.push(i);
+            pending.push((child_path, child));
+        }
+    }
+    matches
+}
+
 struct OutlineCtx<'a> {
     nav: &'a mut Option<Nav>,
     action: &'a mut Option<BmAction>,
@@ -681,6 +741,8 @@ struct OutlineCtx<'a> {
     current: usize,
     /// Expand all (`Some(usize::MAX)`), collapse all (`Some(0)`) or expand to a depth, this frame.
     expand: Option<usize>,
+    matches: &'a std::collections::HashSet<Vec<usize>>,
+    searching: bool,
 }
 
 /// The destination page label gets its own right-aligned column in a bookmark row; drawing
@@ -709,13 +771,16 @@ fn ellipsized_prefix(text: &str, mut fits: impl FnMut(&str) -> bool) -> String {
 }
 
 fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineItem, path: &[usize], siblings: usize, cx: &mut OutlineCtx<'_>) {
+    if cx.searching && !cx.matches.contains(path) {
+        return;
+    }
     let depth = path.len() - 1;
     let indent = depth as f32 * 16.0;
     let id = ui.id().with(("outline", path));
     if let Some(levels) = cx.expand {
         ui.data_mut(|d| d.insert_temp(id, depth < levels));
     }
-    let mut open = ui.data(|d| d.get_temp::<bool>(id)).unwrap_or(item.open || depth == 0);
+    let mut open = cx.searching || ui.data(|d| d.get_temp::<bool>(id)).unwrap_or(item.open || depth == 0);
     let x_text = indent + 20.0;
     if let Some((rpath, text)) = cx.rename.as_mut()
         && rpath.as_slice() == path
@@ -770,7 +835,7 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
         if !item.children.is_empty() {
             let tri = Rect::from_min_size(pos2(x0, rect.top() + 6.0), vec2(16.0, 16.0));
             icons::paint(ui, tri, if open { "chevron-down" } else { "chevron-right" }, 14.0, t.text_muted);
-            if ui.interact(tri, id.with("tri"), Sense::click()).clicked() {
+            if !cx.searching && ui.interact(tri, id.with("tri"), Sense::click()).clicked() {
                 open = !open;
                 ui.data_mut(|d| d.insert_temp(id, open));
             }
diff --git a/crates/ui-egui/tests/bookmarks.rs b/crates/ui-egui/tests/bookmarks.rs
index 8288b046..0477c306 100644
--- a/crates/ui-egui/tests/bookmarks.rs
+++ b/crates/ui-egui/tests/bookmarks.rs
@@ -129,6 +129,71 @@ fn number_pages_dialog_labels_the_selected_pages() {
     assert_eq!(h.state().session.get(id).unwrap().can_undo(), Some("Number pages"));
 }
 
+#[test]
+fn search_finds_collapsed_bookmarks_and_keeps_original_paths() {
+    use pdfcraft_engine::Edit;
+    let mut h = harness();
+    for (parent, index, title, page) in
+        [(vec![], 0, "Unrelated", 0), (vec![], 1, "Reports", 0), (vec![1], 0, "Other chapter", 1), (vec![1], 1, "Résumé results", 2)]
+    {
+        h.state_mut().apply_edit(Edit::AddBookmark { parent, index, title: title.into(), page });
+    }
+    h.run_steps(3);
+    h.get_by_label("Bookmark options").click();
+    h.run_steps(2);
+    h.get_by_label("Collapse all bookmarks").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Résumé results").is_none());
+    let id = h.state().views[0].id;
+    let before = h.state().session.save_full_bytes(id).unwrap();
+    h.get_by_label("Search").click();
+    h.run_steps(1);
+    h.get_by_label("Search").type_text("RÉSUMÉ");
+    h.run_steps(3);
+    h.get_by_label("Reports");
+    h.get_by_label("Résumé results").click();
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 2);
+    assert!(h.query_by_label("Unrelated").is_none());
+    assert!(h.query_by_label("Other chapter").is_none());
+    assert_eq!(h.state().session.save_full_bytes(id).unwrap(), before, "search doesn't edit the PDF");
+    if let Ok(dir) = std::env::var("PDFCRAFT_BOOKMARK_SHOTS") {
+        h.render().unwrap().save(std::path::Path::new(&dir).join("filtered-bookmarks.png")).unwrap();
+    }
+    menu(&mut h, "Résumé results", "Delete");
+    assert_eq!(outline(&h).len(), 3);
+    assert!(outline(&h).iter().any(|b| b.0 == "Other chapter"));
+    h.get_by_label("No matches.");
+    add(&mut h, "New section");
+    assert!(outline(&h).iter().any(|b| b.0 == "New section"), "new bookmarks remain nameable while searching");
+    h.get_by_label("No matches.");
+    h.get_by_label("Clear").click();
+    h.run_steps(3);
+    h.get_by_label("Unrelated");
+    assert!(h.query_by_label("Other chapter").is_none(), "search did not change saved expansion state");
+}
+
+#[test]
+fn bookmark_search_is_per_document() {
+    let mut h = harness();
+    add(&mut h, "First document");
+    h.get_by_label("Search").click();
+    h.run_steps(1);
+    h.get_by_label("Search").type_text("not found");
+    h.run_steps(3);
+    h.get_by_label("No matches.");
+    h.state_mut().open_bytes("second.pdf", None, PAGES.to_vec()).unwrap();
+    h.run_steps(3);
+    add(&mut h, "Second document");
+    h.get_by_label("Second document");
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    h.get_by_label("No matches.");
+    h.get_by_label("Clear").click();
+    h.run_steps(3);
+    h.get_by_label("First document");
+}
+
 #[test]
 fn expanding_and_collapsing_all_bookmarks() {
     use pdfcraft_engine::Edit;
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 4326e1e8..2ae7ed57 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -69,6 +69,35 @@ fn ok(h: &mut Harness<'static, PdfCraftApp>, c: &ControlClient, method: &str, pa
     call(h, c, method, params).unwrap_or_else(|e| panic!("{method}: {e}"))
 }
 
+#[test]
+fn bookmark_titles_can_be_searched_over_control() {
+    let (mut h, c) = harness();
+    for (index, title, page) in [(0, "Background", 0), (1, "Target chapter", 3)] {
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::AddBookmark { parent: vec![], index, title: title.into(), page });
+    }
+    ok(&mut h, &c, "ui.set", json!({ "key": "panel", "value": "bookmarks" }));
+    h.run_steps(3);
+    let widgets = ok(&mut h, &c, "ui.inspect", json!({ "query": "Search", "role": "TextInput" }));
+    let rect = &widgets["widgets"][0]["rect"];
+    let x = (rect[0].as_f64().unwrap() + rect[2].as_f64().unwrap()) / 2.0;
+    let y = (rect[1].as_f64().unwrap() + rect[3].as_f64().unwrap()) / 2.0;
+    ok(&mut h, &c, "ui.click", json!({ "x": x, "y": y }));
+    ok(&mut h, &c, "ui.type", json!({ "text": "target" }));
+    h.get_by_label("Target chapter");
+    assert!(h.query_by_label("Background").is_none());
+    ok(&mut h, &c, "ui.click", json!({ "label": "Target chapter" }));
+    assert_eq!(h.state().views[0].current, 3);
+    if let Ok(dir) = std::env::var("PDFCRAFT_BOOKMARK_SHOTS") {
+        h.render().unwrap().save(format!("{dir}/control-filtered-bookmarks.png")).unwrap();
+    }
+    ok(&mut h, &c, "ui.click", json!({ "label": "Clear" }));
+    h.get_by_label("Background");
+    h.get_by_label("Target chapter");
+    if let Ok(dir) = std::env::var("PDFCRAFT_BOOKMARK_SHOTS") {
+        h.render().unwrap().save(format!("{dir}/control-cleared-bookmarks.png")).unwrap();
+    }
+}
+
 #[test]
 fn theme_commands_and_options_report_preference_and_effective_colours() {
     let (mut h, c) = harness();

From 57c281ca0a5eda3faa0ba27266039863507022b2 Mon Sep 17 00:00:00 2001
From: midasdf <205497066+midasdf@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:15:24 +0900
Subject: [PATCH 053/149] M3: keep overflowed document tabs reachable (#416)

Refs #397. Scroll the tab strip, reveal the active tab and preserve the existing close-confirmation path.

Assisted-by: OpenAI GPT-6.1 (gpt-6.1-sol)
---
 README.md                    |  2 +
 crates/ui-egui/src/chrome.rs | 76 ++++++++++++++++++++++-----------
 crates/ui-egui/tests/ui.rs   | 83 ++++++++++++++++++++++++++++++++++++
 3 files changed, 137 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index 74deff1e..43342478 100644
--- a/README.md
+++ b/README.md
@@ -172,6 +172,8 @@ Open **Organize pages** to see every page at once:
 - *Atomic:* the file is written to a temporary copy, then swapped in.
 - *Verified:* independently checked with qpdf.
 
+When open documents exceed the window width, scroll over the tab strip with the mouse wheel or trackpad, or use its horizontal scrollbar. Opening or switching to a document brings its tab into view.
+
 Unsaved documents carry a dot on their tab, and closing or quitting asks before anything is lost. Changes are autosaved every minute. If PdfCraft ever quits unexpectedly, it offers to recover your work the next time it opens. Encrypted documents stay encrypted on disk.
 
 </td>
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index bc4a717a..7ef9361a 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -28,31 +28,59 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     app.active = None;
                     app.combine_tab.focused = false;
                 }
+                // Keep the two 28-point buttons, Discord's text/padding and three gaps outside the scrolling tabs.
+                let controls_width = ui.fonts_mut(|f| f.layout_no_wrap("Discord".into(), theme::medium(13.0), t.text).size().x) + 106.0;
+                let state = (app.active, app.views.len(), app.combine_showing());
+                let changed = ui.data_mut(|data| {
+                    let id = ui.id().with("active_tab");
+                    let changed = data.get_temp::<(Option<usize>, usize, bool)>(id) != Some(state);
+                    data.insert_temp(id, state);
+                    changed
+                });
                 let mut close = None;
-                for i in 0..app.views.len() {
-                    let Some(doc) = app.session.get(app.views[i].id) else { continue };
-                    let (name, dirty) = (doc.display_name(), doc.dirty);
-                    if tab(ui, &t, "file-text", &name, dirty, app.active == Some(i), &mut close, i).clicked() {
-                        app.active = Some(i);
-                    }
-                }
-                if let Some(i) = close {
-                    app.request_close_tab(i);
-                }
-                if app.combine_tab.open {
-                    // After the document tabs; its index can't clash with theirs.
-                    let mut close = None;
-                    if tab(ui, &t, "files", tl!("Combine files"), false, app.combine_showing(), &mut close, usize::MAX).clicked() {
-                        app.open_combine_tab();
-                    }
-                    if close.is_some() {
-                        app.close_combine_tab();
-                    }
-                }
-                ui.add_space(4.0);
-                if widgets::ghost_button(ui, "plus", tl!("Open")).on_hover_text(tl!("Open a PDF (⌘O)")).clicked() {
-                    app.open_dialog();
-                }
+                ui.scope(|ui| {
+                    ui.style_mut().always_scroll_the_only_direction = true;
+                    egui::ScrollArea::horizontal()
+                        .id_salt("document_tabs")
+                        .max_width((ui.available_width() - controls_width).max(0.0))
+                        .auto_shrink([false, true])
+                        .show(ui, |ui| {
+                            ui.horizontal_centered(|ui| {
+                                for i in 0..app.views.len() {
+                                    let Some(doc) = app.session.get(app.views[i].id) else { continue };
+                                    let (name, dirty) = (doc.display_name(), doc.dirty);
+                                    let response = tab(ui, &t, "file-text", &name, dirty, app.active == Some(i), &mut close, i);
+                                    if changed && app.active == Some(i) && !app.combine_showing() {
+                                        response.scroll_to_me(Some(Align::Center));
+                                    }
+                                    if response.clicked() {
+                                        app.active = Some(i);
+                                    }
+                                }
+                                if let Some(i) = close {
+                                    app.request_close_tab(i);
+                                }
+                                if app.combine_tab.open {
+                                    // After the document tabs; its index can't clash with theirs.
+                                    let mut close = None;
+                                    let response = tab(ui, &t, "files", tl!("Combine files"), false, app.combine_showing(), &mut close, usize::MAX);
+                                    if changed && app.combine_showing() {
+                                        response.scroll_to_me(Some(Align::Center));
+                                    }
+                                    if response.clicked() {
+                                        app.open_combine_tab();
+                                    }
+                                    if close.is_some() {
+                                        app.close_combine_tab();
+                                    }
+                                }
+                                ui.add_space(4.0);
+                                if widgets::ghost_button(ui, "plus", tl!("Open")).on_hover_text(tl!("Open a PDF (⌘O)")).clicked() {
+                                    app.open_dialog();
+                                }
+                            });
+                        });
+                });
                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                     let (icon, label) = match app.theme_preference {
                         ThemePreference::System => ("settings", tl!("Use system setting")),
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 27fa3bc5..819adaea 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -103,6 +103,89 @@ fn a_tab_with_an_arabic_file_name_keeps_its_logical_accessible_name() {
     h.get_by_label(long);
 }
 
+#[test]
+fn overflowing_tabs_can_be_reached_by_scrolling() {
+    let mut h = harness(|app| {
+        for i in 0..20 {
+            app.open_bytes(&format!("document-{i:02}.pdf"), None, FIXTURE.to_vec()).unwrap();
+        }
+    });
+    let last = h.get_by_label("document-19.pdf").rect();
+    assert!(last.center().x < 1200.0, "newly opened active tab must be visible: {last:?}");
+    h.state_mut().active = Some(0);
+    h.run_steps(4);
+    let first = h.get_by_label("document-00.pdf").rect();
+    assert!(first.center().x < 1200.0, "changing active tab must reveal it");
+    h.event(egui::Event::PointerMoved(first.center()));
+    for _ in 0..8 {
+        h.event(egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: egui::vec2(-500.0, 0.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+        });
+        h.run_steps(8);
+    }
+    let last = h.get_by_label("document-19.pdf").rect();
+    assert!(last.center().x > 0.0 && last.center().x < 1200.0, "last tab must be reachable: {last:?}");
+    h.get_by_label("document-19.pdf").click();
+    h.run_steps(3);
+    assert_eq!(h.state().active, Some(19));
+    assert!(h.get_by_label_contains("Display theme:").rect().center().x < 1400.0);
+    let close = last.right_center() - egui::vec2(16.0, 0.0);
+    h.event(egui::Event::PointerMoved(close));
+    h.event(egui::Event::PointerButton { pos: close, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.step();
+    h.event(egui::Event::PointerButton { pos: close, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(4);
+    assert_eq!(h.state().views.len(), 19);
+    assert!(h.state().active.is_some_and(|i| i < 19));
+    if let Ok(dir) = std::env::var("PDFCRAFT_TAB_SHOTS") {
+        settle(&mut h);
+        h.render().unwrap().save(format!("{dir}/overflow-tabs.png")).unwrap();
+    }
+}
+
+#[test]
+fn narrow_tab_strips_accept_vertical_wheel_scrolling() {
+    for width in [600.0, 900.0] {
+        let mut h = Harness::builder().with_size(egui::vec2(width, 700.0)).build_eframe(|_cc| {
+            let mut app = PdfCraftApp::new();
+            for i in 0..12 {
+                app.open_bytes(&format!("narrow-{i:02}.pdf"), None, FIXTURE.to_vec()).unwrap();
+            }
+            app
+        });
+        h.run_steps(4);
+        let last = h.get_by_label("narrow-11.pdf").rect();
+        assert!(last.center().x > 28.0 && last.right() < width - 100.0, "active tab: {last:?}");
+        h.state_mut().active = Some(0);
+        h.run_steps(4);
+        let first = h.get_by_label("narrow-00.pdf").rect();
+        assert!(first.center().x > 28.0 && first.right() < width - 100.0);
+        h.event(egui::Event::PointerMoved(first.center()));
+        for _ in 0..8 {
+            h.event(egui::Event::MouseWheel {
+                unit: egui::MouseWheelUnit::Point,
+                delta: egui::vec2(0.0, -500.0),
+                phase: egui::TouchPhase::Move,
+                modifiers: egui::Modifiers::NONE,
+            });
+            h.run_steps(8);
+        }
+        let last = h.get_by_label("narrow-11.pdf").rect();
+        assert!(last.center().x > 28.0 && last.right() < width - 100.0, "scrolled tab: {last:?}");
+        h.get_by_label("narrow-11.pdf").click();
+        h.run_steps(4);
+        assert_eq!(h.state().active, Some(11));
+        assert!(h.get_by_label_contains("Display theme:").rect().right() <= width);
+        if let Ok(dir) = std::env::var("PDFCRAFT_TAB_SHOTS") {
+            settle(&mut h);
+            h.render().unwrap().save(format!("{dir}/tabs-{width}.png")).unwrap();
+        }
+    }
+}
+
 #[test]
 fn garbage_input_is_rejected_without_panicking() {
     let mut app = PdfCraftApp::new();

From fa52469dbed7954638f602aadf9afb955221f373 Mon Sep 17 00:00:00 2001
From: feraremag2680 <feraremag@gmail.com>
Date: Fri, 9 Oct 2026 15:15:32 +0200
Subject: [PATCH 054/149] sign: read the .p12 files Windows writes (BER, not
 DER) (#453)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Importing a digital ID exported by Windows failed with "PKCS #12: not a
PKCS #12 file" — at the second byte of the file, before the password was
looked at. Windows writes a .p12 in BER: the PFX, its ContentInfo and
the [0] around the AuthenticatedSafe all use the indefinite length form
(0x80 … 00 00), and the AuthenticatedSafe itself is an OCTET STRING
split into segments. der.rs took definite lengths only, so every one of
those files was turned away. OpenSSL writes definite DER, which is why
the fixtures never showed it.

A Tlv now carries the rules it was read with, and its children are read
the same way: Tlv::parse is the strict DER reader it always was,
Tlv::parse_ber also takes the indefinite form, and Tlv::octets joins the
segments of a constructed OCTET STRING, borrowing when there is nothing
to join. Both are depth-bounded. pkcs12 reads the envelope with the BER
reader; x509 and cms keep the strict one, so nothing that is verified
over its own bytes changes.

The MAC decides what is allowed here: it covers the contents of the
authSafe OCTET STRING, the segments joined, which is what the writer
MACed. So the file is never normalised to DER — that would change the
octets the MAC was computed over and turn a right password into a wrong
one.

The test builds the Windows shape out of the OpenSSL fixtures, twice:
the outer wrappers in BER with the MacData intact, which is what proves
the MAC is taken over the right octets, and then the AuthenticatedSafe
re-encoded as well, with the MacData dropped (RFC 7292 §4 makes it
optional), for a file that is BER the whole way down.


Claude-Session: https://claude.ai/code/session_013Q5dhMC58jk1ePNW37xe1b

Co-authored-by: Fernando Areán <soporte@codebit.es>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 crates/sign/src/der.rs       | 169 +++++++++++++++++++++++++++++++----
 crates/sign/src/pkcs12.rs    |  65 ++++++++------
 crates/sign/tests/crypto.rs  |  70 ++++++++++++++-
 parity/acrobat-features.toml |   4 +-
 4 files changed, 263 insertions(+), 45 deletions(-)

diff --git a/crates/sign/src/der.rs b/crates/sign/src/der.rs
index bedbf072..949e7a92 100644
--- a/crates/sign/src/der.rs
+++ b/crates/sign/src/der.rs
@@ -1,7 +1,14 @@
-//! A small DER reader and writer (ITU-T X.690): just what X.509, CMS and PKCS#12 need.
+//! A small BER/DER reader and writer (ITU-T X.690): just what X.509, CMS and PKCS#12 need.
 //!
 //! [`Tlv`] borrows from the input and keeps its full encoding (`raw`), so signed structures can
 //! be verified over the exact bytes that were signed.
+//!
+//! Reading is strict DER by default, which is what everything signed must use. [`Tlv::parse_ber`]
+//! also accepts the two BER constructions a reader meets in practice — the indefinite length form
+//! and strings split into segments — which PKCS #12 needs: Windows writes `.p12` files that way.
+//! Writing is always DER.
+
+use std::borrow::Cow;
 
 use crate::SignError;
 
@@ -11,6 +18,8 @@ pub mod tag {
     pub const INTEGER: u8 = 0x02;
     pub const BIT_STRING: u8 = 0x03;
     pub const OCTET_STRING: u8 = 0x04;
+    /// An OCTET STRING split into segments (BER only, X.690 §8.21); see [`super::Tlv::octets`].
+    pub const OCTET_STRING_SEGMENTS: u8 = 0x24;
     pub const NULL: u8 = 0x05;
     pub const OID: u8 = 0x06;
     pub const UTF8_STRING: u8 = 0x0C;
@@ -36,56 +45,107 @@ fn bad(what: &str) -> SignError {
     SignError::Malformed(what.to_string())
 }
 
-/// One DER element.
+/// Which encoding rules a reader accepts.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Form {
+    /// DER: every length definite, every string primitive. Anything whose bytes are signed is read
+    /// this way, so that what is verified is exactly what was written.
+    Der,
+    /// BER as well: the indefinite length form (X.690 §8.1.3.6) and strings split into segments
+    /// (§8.21).
+    Ber,
+}
+
+/// One BER/DER element.
+#[derive(Clone, Copy, Debug, Eq)]
 pub struct Tlv<'a> {
     pub tag: u8,
-    /// The contents octets.
+    /// The contents octets (without the end-of-contents octets of an indefinite length).
     pub value: &'a [u8],
-    /// The whole encoding (identifier, length and contents).
+    /// The whole encoding (identifier, length, contents and any end-of-contents octets).
     pub raw: &'a [u8],
+    /// The rules this element was read with. Its children are read the same way.
+    form: Form,
+}
+
+/// Two elements are equal when they encode the same thing; the rules they were read with are not
+/// part of that.
+impl PartialEq for Tlv<'_> {
+    fn eq(&self, other: &Self) -> bool {
+        self.tag == other.tag && self.value == other.value && self.raw == other.raw
+    }
 }
 
 impl<'a> Tlv<'a> {
-    /// Parse one element at the start of `input`; returns it and the rest.
+    /// Parse one DER element at the start of `input`; returns it and the rest.
     pub fn parse(input: &'a [u8]) -> Result<(Tlv<'a>, &'a [u8]), SignError> {
+        Tlv::read(input, Form::Der, 0)
+    }
+
+    /// Parse one BER element at the start of `input`; returns it and the rest.
+    pub fn parse_ber(input: &'a [u8]) -> Result<(Tlv<'a>, &'a [u8]), SignError> {
+        Tlv::read(input, Form::Ber, 0)
+    }
+
+    fn read(input: &'a [u8], form: Form, depth: usize) -> Result<(Tlv<'a>, &'a [u8]), SignError> {
         let (&tag, rest) = input.split_first().ok_or_else(|| bad("truncated DER"))?;
         if tag & 0x1F == 0x1F {
             return Err(bad("multi-byte DER tags are not supported"));
         }
         let (&first, rest) = rest.split_first().ok_or_else(|| bad("truncated DER length"))?;
-        let (len, rest) = if first < 0x80 {
-            (first as usize, rest)
+        // `trailer` is the two end-of-contents octets, which belong to the element but not to its
+        // contents.
+        let (len, rest, trailer) = if first < 0x80 {
+            (first as usize, rest, 0)
+        } else if first == 0x80 {
+            if form == Form::Der {
+                return Err(bad("indefinite lengths are not allowed in DER"));
+            }
+            if tag & 0x20 == 0 {
+                return Err(bad("an indefinite length needs a constructed element"));
+            }
+            (contents_len(rest, form, depth)?, rest, 2)
         } else {
             let n = (first & 0x7F) as usize;
-            if n == 0 || n > 4 || rest.len() < n {
+            if n > 4 || rest.len() < n {
                 return Err(bad("unsupported DER length"));
             }
             let len = rest[..n].iter().fold(0usize, |acc, b| (acc << 8) | *b as usize);
-            (len, &rest[n..])
+            (len, &rest[n..], 0)
         };
-        if rest.len() < len {
+        let end = len.checked_add(trailer).ok_or_else(|| bad("DER length overflows"))?;
+        if rest.len() < end {
             return Err(bad("DER element runs past the end"));
         }
+        // `end <= rest.len()`, so neither sum below can overflow.
         let header = input.len() - rest.len();
-        Ok((Tlv { tag, value: &rest[..len], raw: &input[..header + len] }, &rest[len..]))
+        Ok((Tlv { tag, value: &rest[..len], raw: &input[..header + end], form }, &rest[end..]))
     }
 
-    /// Parse `input` as exactly one element.
+    /// Parse `input` as exactly one DER element.
     pub fn parse_all(input: &'a [u8]) -> Result<Tlv<'a>, SignError> {
-        let (t, rest) = Tlv::parse(input)?;
+        Tlv::only(input, Form::Der)
+    }
+
+    /// Parse `input` as exactly one BER element.
+    pub fn parse_all_ber(input: &'a [u8]) -> Result<Tlv<'a>, SignError> {
+        Tlv::only(input, Form::Ber)
+    }
+
+    fn only(input: &'a [u8], form: Form) -> Result<Tlv<'a>, SignError> {
+        let (t, rest) = Tlv::read(input, form, 0)?;
         if !rest.is_empty() {
             return Err(bad("trailing bytes after DER element"));
         }
         Ok(t)
     }
 
-    /// The children of a constructed element.
+    /// The children of a constructed element, read with the same rules as their parent.
     pub fn children(&self) -> Result<Vec<Tlv<'a>>, SignError> {
         let mut out = Vec::new();
         let mut rest = self.value;
         while !rest.is_empty() {
-            let (t, r) = Tlv::parse(rest)?;
+            let (t, r) = Tlv::read(rest, self.form, 0)?;
             out.push(t);
             rest = r;
         }
@@ -99,7 +159,34 @@ impl<'a> Tlv<'a> {
 
     /// The element inside an EXPLICIT tag.
     pub fn inner(&self) -> Result<Tlv<'a>, SignError> {
-        Tlv::parse_all(self.value)
+        Tlv::only(self.value, self.form)
+    }
+
+    /// An OCTET STRING's contents, joining the segments of BER's constructed form (X.690 §8.21).
+    /// Borrowed in the ordinary case, so the common path copies nothing.
+    pub fn octets(&self, what: &str) -> Result<Cow<'a, [u8]>, SignError> {
+        self.join(what, 0)
+    }
+
+    fn join(&self, what: &str, depth: usize) -> Result<Cow<'a, [u8]>, SignError> {
+        /// Deep enough for anything real: a writer that segments at all segments once.
+        const MAX_DEPTH: usize = 16;
+        match self.tag {
+            tag::OCTET_STRING => Ok(Cow::Borrowed(self.value)),
+            tag::OCTET_STRING_SEGMENTS if self.form == Form::Ber => {
+                if depth >= MAX_DEPTH {
+                    return Err(bad(&format!("{what}: OCTET STRING segments nested too deeply")));
+                }
+                // The join is never larger than the segments it is made of, so this is bounded by
+                // the input.
+                let mut out: Vec<u8> = Vec::with_capacity(self.value.len());
+                for s in self.children()? {
+                    out.extend_from_slice(&s.join(what, depth + 1)?);
+                }
+                Ok(Cow::Owned(out))
+            }
+            found => Err(bad(&format!("{what}: expected an OCTET STRING, found tag {found:#04x}"))),
+        }
     }
 
     /// An OID in dotted form.
@@ -172,6 +259,26 @@ impl<'a> Tlv<'a> {
     }
 }
 
+/// How many contents octets an indefinite-length element has: everything up to the matching
+/// end-of-contents octets, which have to be there (X.690 §8.1.5). The contents are elements, so
+/// finding the end means reading them, and one of those may be indefinite too — hence the depth
+/// limit. Every step consumes at least two octets, so the walk always ends.
+fn contents_len(input: &[u8], form: Form, depth: usize) -> Result<usize, SignError> {
+    /// Far deeper than any real file nests, and shallow enough never to exhaust the stack.
+    const MAX_DEPTH: usize = 48;
+    if depth >= MAX_DEPTH {
+        return Err(bad("BER elements nested too deeply"));
+    }
+    let mut rest = input;
+    loop {
+        match rest {
+            [] => return Err(bad("an indefinite length with no end-of-contents")),
+            [0, 0, ..] => return Ok(input.len() - rest.len()),
+            _ => rest = Tlv::read(rest, form, depth + 1)?.1,
+        }
+    }
+}
+
 /// A UTC time.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub struct Time {
@@ -439,6 +546,36 @@ mod tests {
         assert!(Tlv::parse(&[0x30, 5, 1]).is_err());
     }
 
+    #[test]
+    fn reads_ber_indefinite_lengths_and_segmented_strings() {
+        // SEQUENCE { INTEGER 3, OCTET STRING { "hi", "!" } }, every wrapper in the indefinite form:
+        // the shape Windows gives a .p12 file.
+        let ber: &[u8] = &[0x30, 0x80, 0x02, 0x01, 0x03, 0x24, 0x80, 0x04, 0x02, b'h', b'i', 0x04, 0x01, b'!', 0, 0, 0, 0];
+        let e = Tlv::parse_all(ber).unwrap_err().to_string();
+        assert!(e.contains("indefinite lengths are not allowed in DER"), "{e}");
+
+        let t = Tlv::parse_all_ber(ber).unwrap();
+        assert_eq!(t.tag, tag::SEQUENCE);
+        assert_eq!(t.raw, ber, "the end-of-contents octets belong to the element");
+        assert_eq!(t.value, &ber[2..ber.len() - 2], "but not to its contents");
+        let c = t.children().unwrap();
+        assert_eq!(c[0].u64().unwrap(), 3);
+        assert_eq!(c[1].octets("segments").unwrap().as_ref(), b"hi!", "the segments are joined");
+        assert!(c[0].octets("not a string").is_err());
+
+        // Definite lengths read the same either way, and a segmented string stays a DER error.
+        assert_eq!(Tlv::parse_all_ber(&int(65537)).unwrap().u64().unwrap(), 65537);
+        assert_eq!(Tlv::parse_all_ber(&octets(b"hi!")).unwrap().octets("plain").unwrap().as_ref(), b"hi!");
+        assert!(Tlv::parse_all(&[0x24, 2, 0x04, 0]).unwrap().octets("segments").is_err());
+
+        // Malformed: no end-of-contents, and an indefinite length on a primitive element.
+        assert!(Tlv::parse_all_ber(&ber[..ber.len() - 2]).is_err());
+        assert!(Tlv::parse_all_ber(&[0x04, 0x80, 0, 0]).is_err());
+        // Nesting is bounded, so a file made of nothing but wrappers fails instead of crashing.
+        let deep = [[0x30u8, 0x80].repeat(400), [0u8, 0].repeat(400)].concat();
+        assert!(Tlv::parse_all_ber(&deep).is_err());
+    }
+
     #[test]
     fn times() {
         let t = Time { year: 2026, month: 10, day: 2, hour: 9, minute: 30, second: 5 };
diff --git a/crates/sign/src/pkcs12.rs b/crates/sign/src/pkcs12.rs
index 11d1e717..69d4e14e 100644
--- a/crates/sign/src/pkcs12.rs
+++ b/crates/sign/src/pkcs12.rs
@@ -7,12 +7,18 @@
 //! base64 body (#159).
 //! Writing uses PBES2 AES-256-CBC with PBKDF2-HMAC-SHA-256 and an HMAC-SHA-256 MAC, OpenSSL 3's
 //! defaults.
+//!
+//! The envelope is read as BER, not DER: Windows writes `.p12` files with indefinite lengths and
+//! the AuthenticatedSafe split into OCTET STRING segments, and nothing in the envelope is signed
+//! over its own bytes. The certificates inside it are still read as strict DER, which is how they
+//! were signed.
+
+use std::borrow::Cow;
 
 use base64::Engine as _;
 use cbc::cipher::block_padding::Pkcs7;
 use cbc::cipher::{BlockModeDecrypt, BlockModeEncrypt, InnerIvInit, KeyIvInit};
 use hmac::Mac;
-use std::borrow::Cow;
 
 use crate::SignError;
 use crate::der::{self, Tlv, tag};
@@ -182,7 +188,7 @@ fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, Sign
                 return Err(SignError::Unsupported("PBES2 key derivation other than PBKDF2".into()));
             }
             let kp = kdf.get(1).ok_or_else(|| bad("PBKDF2 parameters"))?.children()?;
-            let salt = kp.first().ok_or_else(|| bad("salt"))?.expect(tag::OCTET_STRING, "salt")?.value;
+            let salt = kp.first().ok_or_else(|| bad("salt"))?.octets("salt")?;
             let rounds = kp.get(1).ok_or_else(|| bad("iterations"))?.u64()? as u32;
             let prf = match kp
                 .iter()
@@ -208,13 +214,13 @@ fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, Sign
                 Some(DES_EDE3_CBC) => Cipher::TripleDes,
                 other => return Err(SignError::Unsupported(format!("PBES2 cipher {}", other.unwrap_or("?")))),
             };
-            let iv = sc.get(1).ok_or_else(|| bad("IV"))?.expect(tag::OCTET_STRING, "IV")?.value;
-            let key = pbkdf2(prf, password.as_bytes(), salt, rounds, cipher.key_len());
-            cipher.decrypt(&key, iv, ct)
+            let iv = sc.get(1).ok_or_else(|| bad("IV"))?.octets("IV")?;
+            let key = pbkdf2(prf, password.as_bytes(), &salt, rounds, cipher.key_len());
+            cipher.decrypt(&key, &iv, ct)
         }
         PBE_SHA_3DES | PBE_SHA_2DES | PBE_SHA_RC2_128 | PBE_SHA_RC2_40 => {
             let p = params.children()?;
-            let salt = p.first().ok_or_else(|| bad("salt"))?.expect(tag::OCTET_STRING, "salt")?.value;
+            let salt = p.first().ok_or_else(|| bad("salt"))?.octets("salt")?;
             let rounds = p.get(1).ok_or_else(|| bad("iterations"))?.u64()? as u32;
             let (cipher, key_len, iv_len) = match o.as_str() {
                 PBE_SHA_3DES => (Cipher::TripleDes, 24, 8),
@@ -223,13 +229,13 @@ fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, Sign
                 _ => (Cipher::Rc2(40), 5, 8),
             };
             let pw = bmp(password);
-            let mut key = pkcs12_kdf(DigestAlg::Sha1, &pw, salt, 1, rounds, key_len);
+            let mut key = pkcs12_kdf(DigestAlg::Sha1, &pw, &salt, 1, rounds, key_len);
             if key.len() == 16 && matches!(cipher, Cipher::TripleDes) {
                 // Two-key 3DES: K1 K2 K1.
                 let k1 = key[..8].to_vec();
                 key.extend(k1);
             }
-            let iv = pkcs12_kdf(DigestAlg::Sha1, &pw, salt, 2, rounds, iv_len);
+            let iv = pkcs12_kdf(DigestAlg::Sha1, &pw, &salt, 2, rounds, iv_len);
             cipher.decrypt(&key, &iv, ct)
         }
         other => Err(SignError::Unsupported(format!("PKCS #12 encryption {other}"))),
@@ -248,7 +254,7 @@ enum BagKind {
 }
 
 fn bags(safe_contents: &[u8], password: &str, out: &mut Vec<Bag>) -> Result<(), SignError> {
-    for bag in Tlv::parse_all(safe_contents)?.children()? {
+    for bag in Tlv::parse_all_ber(safe_contents)?.children()? {
         let f = bag.children()?;
         let Some(id) = f.first().and_then(|o| o.oid().ok()) else { continue };
         let Some(value) = f.get(1).filter(|v| v.tag == tag::ctx(0)).and_then(|v| v.inner().ok()) else { continue };
@@ -258,7 +264,7 @@ fn bags(safe_contents: &[u8], password: &str, out: &mut Vec<Bag>) -> Result<(),
                 let p = a.children()?;
                 let v = p.get(1).and_then(|s| s.children().ok()).and_then(|s| s.into_iter().next());
                 match (p.first().and_then(|o| o.oid().ok()).as_deref(), v) {
-                    (Some(LOCAL_KEY_ID), Some(v)) => local_key_id = Some(v.value.to_vec()),
+                    (Some(LOCAL_KEY_ID), Some(v)) => local_key_id = v.octets("local key id").ok().map(Cow::into_owned),
                     (Some(FRIENDLY_NAME), Some(v)) => friendly_name = v.text(),
                     _ => {}
                 }
@@ -269,15 +275,15 @@ fn bags(safe_contents: &[u8], password: &str, out: &mut Vec<Bag>) -> Result<(),
             SHROUDED_KEY_BAG => {
                 let p = value.children()?;
                 let [alg, data] = p.as_slice() else { return Err(bad("EncryptedPrivateKeyInfo")) };
-                BagKind::Key(pbe_decrypt(alg, password, data.value)?)
+                BagKind::Key(pbe_decrypt(alg, password, &data.octets("encrypted private key")?)?)
             }
             CERT_BAG => {
                 let p = value.children()?;
                 if p.first().and_then(|o| o.oid().ok()).as_deref() != Some(X509_CERT) {
                     continue;
                 }
-                let Some(c) = p.get(1).and_then(|c| c.inner().ok()) else { continue };
-                BagKind::Cert(c.value.to_vec())
+                let Some(c) = p.get(1).and_then(|c| c.inner().ok()).and_then(|c| c.octets("certificate").ok()) else { continue };
+                BagKind::Cert(c.into_owned())
             }
             _ => continue,
         };
@@ -330,7 +336,7 @@ fn pem_body(pem: &[u8]) -> Result<&[u8], SignError> {
 /// Open a `.p12` / `.pfx` file. A wrong password is [`SignError::WrongPassword`].
 pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, SignError> {
     let der = normalize(bytes)?;
-    let pfx = Tlv::parse_all(&der)
+    let pfx = Tlv::parse_all_ber(&der)
         .map_err(|e| match e {
             // Keep "not a PKCS #12 file" but carry the exact reason through.
             SignError::Malformed(why) => bad(&format!("not a PKCS #12 file: {why}")),
@@ -341,38 +347,45 @@ pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, SignError> {
     if auth_safe.first().map(|o| o.oid()).transpose()?.as_deref() != Some(DATA) {
         return Err(SignError::Unsupported("public-key protected PKCS #12 files".into()));
     }
-    let content = auth_safe.get(1).ok_or_else(|| bad("authSafe content"))?.inner()?.expect(tag::OCTET_STRING, "authSafe")?.value;
-    // The MAC proves the password before anything is decrypted.
+    let content = auth_safe.get(1).ok_or_else(|| bad("authSafe content"))?.inner()?.octets("authSafe")?;
+    // The MAC proves the password before anything is decrypted. It covers the contents of that
+    // OCTET STRING — the segments joined, if the file is segmented, which is what wrote them.
     if let Some(mac) = pfx.get(2) {
         let m = mac.children()?;
         let digest_info = m.first().ok_or_else(|| bad("MacData"))?.children()?;
         let alg = digest_info.first().ok_or_else(|| bad("MAC algorithm"))?.children()?;
         let alg_oid = alg.first().ok_or_else(|| bad("MAC algorithm"))?.oid()?;
         let alg = DigestAlg::from_oid(&alg_oid).ok_or_else(|| SignError::Unsupported(format!("MAC digest {alg_oid}")))?;
-        let expected = digest_info.get(1).ok_or_else(|| bad("MAC"))?.value;
-        let salt = m.get(1).ok_or_else(|| bad("MAC salt"))?.value;
+        let expected = digest_info.get(1).ok_or_else(|| bad("MAC"))?.octets("MAC")?;
+        let salt = m.get(1).ok_or_else(|| bad("MAC salt"))?.octets("MAC salt")?;
         let iterations = m.get(2).map(|i| i.u64()).transpose()?.unwrap_or(1) as u32;
         let key_len = alg.digest(&[]).len();
-        let key = pkcs12_kdf(alg, &bmp(password), salt, 3, iterations, key_len);
-        if hmac(alg, &key, content)? != expected {
+        let key = pkcs12_kdf(alg, &bmp(password), &salt, 3, iterations, key_len);
+        if hmac(alg, &key, &content)? != *expected {
             return Err(SignError::WrongPassword);
         }
     }
     let mut all = Vec::new();
-    for ci in Tlv::parse_all(content)?.children()? {
+    for ci in Tlv::parse_all_ber(&content)?.children()? {
         let p = ci.children()?;
         let kind = p.first().ok_or_else(|| bad("ContentInfo"))?.oid()?;
         let body = p.get(1).ok_or_else(|| bad("ContentInfo content"))?.inner()?;
         match kind.as_str() {
-            DATA => bags(body.expect(tag::OCTET_STRING, "SafeContents")?.value, password, &mut all)?,
+            DATA => bags(&body.octets("SafeContents")?, password, &mut all)?,
             ENCRYPTED_DATA => {
                 let ed = body.children()?;
                 let eci = ed.get(1).ok_or_else(|| bad("EncryptedContentInfo"))?.children()?;
                 let alg = eci.get(1).ok_or_else(|| bad("content encryption algorithm"))?;
-                let ct = match eci.get(2) {
-                    Some(t) if t.tag == tag::ctx_prim(0) => t.value.to_vec(),
-                    // Constructed form: a sequence of OCTET STRING segments.
-                    Some(t) if t.tag == tag::ctx(0) => t.children()?.iter().flat_map(|s| s.value.iter().copied()).collect(),
+                let ct: Cow<'_, [u8]> = match eci.get(2) {
+                    Some(t) if t.tag == tag::ctx_prim(0) => Cow::Borrowed(t.value),
+                    // Constructed form: the OCTET STRING segments, joined.
+                    Some(t) if t.tag == tag::ctx(0) => {
+                        let mut v = Vec::with_capacity(t.value.len());
+                        for s in t.children()? {
+                            v.extend_from_slice(&s.octets("encryptedContent")?);
+                        }
+                        Cow::Owned(v)
+                    }
                     _ => return Err(bad("encryptedContent")),
                 };
                 let plain = pbe_decrypt(alg, password, &ct)?;
diff --git a/crates/sign/tests/crypto.rs b/crates/sign/tests/crypto.rs
index f66179bf..ef9c570a 100644
--- a/crates/sign/tests/crypto.rs
+++ b/crates/sign/tests/crypto.rs
@@ -1,6 +1,6 @@
 //! The cryptographic core against files made by OpenSSL 3 (tests/data/README.md).
 
-use pdfcraft_sign::der::Time;
+use pdfcraft_sign::der::{Time, Tlv};
 use pdfcraft_sign::keys::DigestAlg;
 use pdfcraft_sign::{Certificate, Name, PublicKey, SignError, cms, pkcs12};
 
@@ -58,6 +58,74 @@ fn opens_every_openssl_flavour_of_pkcs12() {
     assert_eq!(chain.certificate.key_usage.map(|u| u & 0b11), Some(0b11), "digitalSignature + nonRepudiation");
 }
 
+/// One element with BER's indefinite length: contents, then the end-of-contents octets.
+fn indefinite(tag: u8, body: &[u8]) -> Vec<u8> {
+    let mut v = vec![tag, 0x80];
+    v.extend_from_slice(body);
+    v.extend([0, 0]);
+    v
+}
+
+/// An OCTET STRING split into segments, BER's constructed form.
+fn segmented(bytes: &[u8]) -> Vec<u8> {
+    let parts: Vec<u8> = bytes.chunks(64).flat_map(der::octets).collect();
+    indefinite(0x24, &parts)
+}
+
+/// A `.p12` in the shape Windows writes one: the PFX, its ContentInfo and the `[0]` holding the
+/// AuthenticatedSafe all in the indefinite form, and the AuthenticatedSafe split into segments.
+/// Nothing changes meaning, and the MAC still covers the same octets, so whatever a reader makes
+/// of it, it is making it of the form and not of the contents.
+///
+/// With `deep`, every ContentInfo inside is rewritten the same way, as a real Windows file has it.
+/// That re-encodes the AuthenticatedSafe, which is what the MAC covers, so the MacData is dropped
+/// — RFC 7292 §4 makes it optional — and a wrong password is then caught by the decryption.
+fn as_windows_writes_it(der: &[u8], deep: bool) -> Vec<u8> {
+    let pfx = Tlv::parse_all(der).unwrap().children().unwrap();
+    let auth = pfx[1].children().unwrap();
+    let mut content = auth[1].inner().unwrap().value.to_vec();
+    if deep {
+        let mut inner = Vec::new();
+        for ci in Tlv::parse_all(&content).unwrap().children().unwrap() {
+            let p = ci.children().unwrap();
+            let body = p[1].inner().unwrap();
+            // A Data content is an OCTET STRING, so it gets segmented; an EncryptedData is a
+            // SEQUENCE and stays as it is inside its indefinite wrappers.
+            let wrapped = if body.tag == 0x04 { segmented(body.value) } else { body.raw.to_vec() };
+            let zero = indefinite(0xA0, &wrapped);
+            inner.extend(indefinite(0x30, &[p[0].raw, zero.as_slice()].concat()));
+        }
+        content = indefinite(0x30, &inner);
+    }
+    let zero = indefinite(0xA0, &segmented(&content));
+    let mut body = pfx[0].raw.to_vec();
+    body.extend(indefinite(0x30, &[auth[0].raw, zero.as_slice()].concat()));
+    if !deep {
+        for extra in &pfx[2..] {
+            body.extend_from_slice(extra.raw);
+        }
+    }
+    indefinite(0x30, &body)
+}
+
+#[test]
+fn opens_pkcs12_as_windows_writes_it() {
+    for file in ["rsa-aes.p12", "rsa-legacy.p12", "chain.p12"] {
+        let der = data(file);
+        let want = pkcs12::open(&der, "test").unwrap();
+        for deep in [false, true] {
+            let ber = as_windows_writes_it(&der, deep);
+            assert_ne!(ber, der, "{file} ({deep})");
+            let got = pkcs12::open(&ber, "test").unwrap_or_else(|e| panic!("{file} in BER (deep: {deep}): {e}"));
+            assert_eq!(got.certificate.raw, want.certificate.raw, "{file} ({deep})");
+            assert_eq!(got.key.public_key(), want.key.public_key(), "{file} ({deep})");
+            assert_eq!(got.chain.len(), want.chain.len(), "{file} ({deep})");
+            assert_eq!(got.friendly_name, want.friendly_name, "{file} ({deep})");
+            assert!(matches!(pkcs12::open(&ber, "nope"), Err(SignError::WrongPassword)), "{file} ({deep})");
+        }
+    }
+}
+
 #[test]
 fn certificates_parse_as_openssl_made_them() {
     let c = Certificate::parse(&pem("rsa.crt.pem")).unwrap();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 627fe94b..7da0de8f 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5786,8 +5786,8 @@ milestone = "M9"
 status = "shipped"
 commands = ["sign.digital"]
 tools = ["sign_document"]
-evidence = ["crates/sign/tests/crypto.rs::opens_every_openssl_flavour_of_pkcs12", "crates/sign/tests/pdf.rs::signing_then_validating_with_and_without_trust", "crates/ui-egui/tests/signing.rs::certifying_without_a_visible_signature", "crates/automation/tests/automation.rs::digital_ids_signing_and_validation_through_tools"]
-notes = "PBES2 (AES, 3DES) and legacy SHA-1 3DES/RC2 files; RSA, P-256, P-384"
+evidence = ["crates/sign/tests/crypto.rs::opens_every_openssl_flavour_of_pkcs12", "crates/sign/tests/crypto.rs::opens_pkcs12_as_windows_writes_it", "crates/sign/tests/pdf.rs::signing_then_validating_with_and_without_trust", "crates/ui-egui/tests/signing.rs::certifying_without_a_visible_signature", "crates/automation/tests/automation.rs::digital_ids_signing_and_validation_through_tools"]
+notes = "PBES2 (AES, 3DES) and legacy SHA-1 3DES/RC2 files; RSA, P-256, P-384; both the DER OpenSSL writes and the BER Windows writes (indefinite lengths, segmented AuthenticatedSafe)"
 
 [[feature]]
 id = "sign.macos-keychain"

From 8ce0a905bf0dbc0b94714bac2ec8f7cc6e9fa7af Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 06:15:38 -0700
Subject: [PATCH 055/149] Never crash: dash patterns can't exhaust memory or
 hang the renderer (#405)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`cargo xtask fuzz` found a 392-byte page whose ExtGState sets
`/D [[11] 0]` on a line that starts at x = 92234775807. Stroke expansion
keeps every dash, so it cut the line into billions of them and allocated
more than 5 GB before the run was stopped. Triage found the same class
in ordinary-looking geometry, and a second bug next to it:

- A tiny dash on an ordinary line (`[0.000001] 0 d` on 20 pt) passed
  10 GB in under two seconds; so did `[1] 0 d` under a shrinking matrix,
  and a long pattern on many short subpaths, because kurbo restarts the
  pattern at every subpath. The render watchdog can skip a stuck page but
  can't stop it allocating, so on a desktop this ends in an abort that
  takes every open document with it.
- A dash array whose entries sum to less than zero (`[-1 -1] 0 d`) made
  kurbo's search for the starting dash loop forever. ISO 32000-2
  §8.4.3.6 requires nonnegative entries.

Vendored hayro patch (5, 6): `usable_dash_pattern` bounds the pieces a
pattern can cut the path into, in user space where kurbo dashes:
(control-polygon length / period + restarts) x entries per period, where
restarts are kurbo's: every MoveTo and ClosePath. Over 250,000 the stroke
is drawn solid, as it is for a pattern with a negative or non-finite
entry or a period that isn't positive. Measured in release builds: a
250,000-piece stroke takes about 16 ms and 75 MB at its peak (a million
took 80 ms and 290 MB). A non-finite phase becomes 0.

Every case now renders in about 0.2 s and a few MB. Synthetic regression
tests in render. Both were red before the fix (the first killed at
2.7 GB, the second stalled past 20 s), and four mutations each turn them
red: the first estimate (one piece per subpath) with a 100k cap runs out
of memory, a 100k cap draws a fine legitimate dash solid, dropping the
negative-entry check draws `[-1 3]` dashed, and dropping it together
with the period check hangs. (The period check alone is defence in
depth: hayro-interpret turns 0 entries into 0.01, so a pattern without
negative entries always has a positive period.)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/render/src/raster.rs  | 100 +++++++++++++++++++++++++++++++++++
 vendor/README.md             |   2 +-
 vendor/hayro/src/renderer.rs |  83 +++++++++++++++++++++++++++--
 3 files changed, 180 insertions(+), 5 deletions(-)

diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index e6b6e7ea..f7b1f89f 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1340,6 +1340,106 @@ trailer << /Root 1 0 R >>
         assert_eq!(&page.rgba[((20 * 40 + 2) * 4)..][..4], &[255, 255, 255, 255], "beyond the butt cap");
     }
 
+    /// Render a 40 × 40 pt page at 1:1 on its own thread, with `/GS1` (from `gs1`) in its
+    /// resources, and fail instead of waiting when the renderer stalls.
+    fn render_with_gs1(content: &str, gs1: &str) -> RenderedPage {
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /ExtGState << /GS1 {gs1} >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page
+    }
+
+    /// The pixel at device (x, y), y down, of a 40-pixel-wide page.
+    fn px40(page: &RenderedPage, x: usize, y: usize) -> &[u8] {
+        &page.rgba[((y * 40 + x) * 4)..][..4]
+    }
+
+    /// From `cargo xtask fuzz`: an ExtGState `/D [[11] 0]` on a line that starts at x =
+    /// 92234775807 cut it into billions of dashes, and stroke expansion allocated more than
+    /// 5 GB. A tiny dash on an ordinary line does the same (`[0.000001] 0 d` on 20 pt passed
+    /// 10 GB), and so does a long pattern on many short subpaths, because every subpath restarts
+    /// it. Vendored hayro patch: a stroke whose dash pattern could cut it into more than
+    /// `MAX_DASHES_PER_STROKE` pieces is drawn solid.
+    #[test]
+    fn dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render() {
+        let red = [255, 0, 0, 255];
+        // The fuzzed shape. A line that far out isn't drawn even undashed (its coordinates are
+        // beyond the rasterizer's range), so this case only proves the page finishes and the
+        // content after the stroke is drawn.
+        let page = render_with_gs1("1 0 0 RG 4 w /GS1 gs 92234775807 20 m 30 20 l S 0 0 1 rg 0 0 4 4 re f", "<< /D [[11] 0] >>");
+        assert_eq!(px40(&page, 1, 38), &[0, 0, 255, 255], "the square after the stroke is drawn");
+        for (what, content, gs1) in [
+            ("a tiny dash on an ordinary line", "1 0 0 RG 4 w [0.000001] 0 d 10 20 m 30 20 l S", "<< >>"),
+            ("a tiny dash from an ExtGState", "1 0 0 RG 4 w /GS1 gs 10 20 m 30 20 l S", "<< /D [[0.000001] 0] >>"),
+            (
+                "a tiny dash under a shrinking matrix",
+                "1 0 0 RG 0.0000001 0 0 0.0000001 0 0 cm 40000000 w [1] 0 d 100000000 200000000 m 300000000 200000000 l S",
+                "<< >>",
+            ),
+        ] {
+            let page = render_with_gs1(content, gs1);
+            // Device row 20 is user y 20; the stroke covers x 10 to 30.
+            for x in [12, 20, 28] {
+                assert_eq!(px40(&page, x, 20), &red, "{what}: ({x}, 20) is drawn, solid");
+            }
+            assert_eq!(px40(&page, 35, 20), &[255, 255, 255, 255], "{what}: beyond the end of the line");
+        }
+        // A long pattern on many short subpaths: 9,999 tiny dashes, then a long one, restarted on
+        // each of 10,000 subpaths 0.01 pt long, is 100 million pieces from a 300 KB stream.
+        let mut many = String::from("1 0 0 RG 4 w [");
+        many.push_str(&"0.000001 ".repeat(9_999));
+        many.push_str("1000] 0 d ");
+        many.push_str(&"10 20 m 10.01 20 l ".repeat(10_000));
+        many.push_str("S 0 0 1 rg 0 0 4 4 re f");
+        let page = render_with_gs1(&many, "<< >>");
+        assert_eq!(px40(&page, 1, 38), &[0, 0, 255, 255], "a pattern restarted on many subpaths finishes");
+        // A fine pattern below the cap still dashes: 200,000 pieces of 0.0001 pt cover about
+        // half of each pixel, so the line is neither solid red nor missing.
+        let page = render_with_gs1("1 0 0 RG 4 w [0.0001] 0 d 10 20 m 30 20 l S", "<< >>");
+        let p = px40(&page, 20, 20);
+        assert!(p[0] == 255 && (40..=215).contains(&p[1]), "a fine dash below the cap is drawn dashed: {p:?}");
+        // An ordinary dash pattern still dashes: butt-capped 4 pt dashes from x 0.
+        let page = render_with_gs1("1 0 0 RG 4 w [4 4] 0 d 0 20 m 40 20 l S", "<< >>");
+        assert_eq!(px40(&page, 2, 20), &red, "inside the first dash");
+        assert_eq!(px40(&page, 6, 20), &[255, 255, 255, 255], "inside the first gap");
+        assert_eq!(px40(&page, 10, 20), &red, "inside the second dash");
+    }
+
+    /// From `cargo xtask fuzz` triage: a dash array whose entries sum to less than zero made
+    /// kurbo's search for the starting dash loop for ever (`[-1 -1] 0 d` never finished).
+    /// ISO 32000-2 §8.4.3.6 requires nonnegative entries. Vendored hayro patch: a pattern with a
+    /// negative entry, or a period that isn't positive, is drawn solid.
+    #[test]
+    fn invalid_dash_patterns_terminate_and_are_drawn_solid() {
+        for (what, content, gs1) in [
+            ("[-1 -1]", "1 0 0 RG 4 w [-1 -1] 0 d 10 20 m 30 20 l S", "<< >>"),
+            ("[-1] with a phase", "1 0 0 RG 4 w [-1] 5 d 10 20 m 30 20 l S", "<< >>"),
+            ("[-2 -3] from an ExtGState", "1 0 0 RG 4 w /GS1 gs 10 20 m 30 20 l S", "<< /D [[-2 -3] 0] >>"),
+            ("[-1 3], a negative entry in a positive period", "1 0 0 RG 4 w [-1 3] 0 d 10 20 m 30 20 l S", "<< >>"),
+        ] {
+            let page = render_with_gs1(content, gs1);
+            for x in [12, 20, 28] {
+                assert_eq!(px40(&page, x, 20), &[255, 0, 0, 255], "{what}: ({x}, 20) is drawn, solid");
+            }
+        }
+    }
+
     /// From the nightly `cargo xtask fuzz`: a Type 3 glyph that shows several glyphs of its own
     /// font. The nesting cap bounds the depth but not the breadth: eight glyphs per glyph, sixteen
     /// deep, is 8^16 paints. Vendored hayro-interpret patch: nested paints (forms, Type 3 glyphs,
diff --git a/vendor/README.md b/vendor/README.md
index 9225714e..f9c8d07d 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -9,7 +9,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 |---|---|---|---|---|
 | hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n` | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator` |
 
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render` |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows); (2) predictor row widths use saturating arithmetic | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream` |
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index 3bf5ccec..ebf3cdc5 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -23,6 +23,76 @@ use vello_cpu::{
 
 /// PdfCraft patch: largest image drawn, in pixels (2^28 ≈ 268 MP, well above real page images).
 const MAX_IMAGE_PIXELS: u64 = 1 << 28;
+
+/// PdfCraft patch: most pieces one dashed stroke may be cut into. Stroke expansion keeps every
+/// dash, so a pattern that is tiny next to its path asks for billions: a fuzzed `/D [[11] 0]` on
+/// a line from x = 92234775807 allocated over 5 GB, and `[0.000001] 0 d` on a 20 pt line over
+/// 10 GB. Measured in release builds: a stroke cut into 250,000 pieces renders in about 16 ms and
+/// 75 MB at its peak (a million took 80 ms and 290 MB). Dotted and dashed lines in real documents
+/// stay far below this.
+const MAX_DASHES_PER_STROKE: f64 = 250_000.0;
+
+/// PdfCraft patch: the dash pattern to stroke `path` with. Empty (a solid line) when the pattern
+/// is invalid, or when it could cut the path into more than [`MAX_DASHES_PER_STROKE`] pieces.
+/// ISO 32000-2 §8.4.3.6 requires nonnegative entries that are not all zero; a pattern whose
+/// period isn't positive (`[-1 -1] 0 d`) made kurbo's search for the starting dash loop for ever.
+fn usable_dash_pattern(path: &BezPath, dashes: &[f32]) -> Vec<f64> {
+    if dashes.iter().any(|d| !d.is_finite() || *d < 0.0) {
+        return Vec::new();
+    }
+    let sum: f64 = dashes.iter().map(|d| f64::from(*d)).sum();
+    // kurbo repeats an odd-length pattern once, as SVG does, so a period covers it twice.
+    let (period, per_period) = if dashes.len() % 2 == 1 {
+        (2.0 * sum, dashes.len().saturating_mul(2))
+    } else {
+        (sum, dashes.len())
+    };
+    if !period.is_finite() || period <= 0.0 {
+        return Vec::new();
+    }
+    let (length, restarts) = control_polygon_length(path);
+    // kurbo restarts the pattern at every subpath and after every `ClosePath`, so each restart
+    // can begin up to a whole period of pieces however short its segment is.
+    let pieces = (length / period + restarts as f64) * per_period as f64;
+    if !pieces.is_finite() || pieces > MAX_DASHES_PER_STROKE {
+        return Vec::new();
+    }
+    dashes.iter().map(|d| f64::from(*d)).collect()
+}
+
+/// PdfCraft patch: the length of `path`'s control polygon, which a curve never exceeds, and how
+/// many times kurbo restarts a dash pattern along it (each `MoveTo` and `ClosePath`).
+fn control_polygon_length(path: &BezPath) -> (f64, usize) {
+    let (mut length, mut restarts) = (0.0, 0usize);
+    let (mut start, mut last) = (Point::ORIGIN, Point::ORIGIN);
+    for el in path.elements() {
+        match *el {
+            kurbo::PathEl::MoveTo(p) => {
+                (start, last) = (p, p);
+                restarts = restarts.saturating_add(1);
+            }
+            kurbo::PathEl::LineTo(p) => {
+                length += last.distance(p);
+                last = p;
+            }
+            kurbo::PathEl::QuadTo(c, p) => {
+                length += last.distance(c) + c.distance(p);
+                last = p;
+            }
+            kurbo::PathEl::CurveTo(c1, c2, p) => {
+                length += last.distance(c1) + c1.distance(c2) + c2.distance(p);
+                last = p;
+            }
+            kurbo::PathEl::ClosePath => {
+                length += last.distance(start);
+                last = start;
+                restarts = restarts.saturating_add(1);
+            }
+        }
+    }
+    (length, restarts)
+}
+
 pub(crate) struct Renderer {
     pub(crate) ctx: RenderContext,
     pub(crate) inside_pattern: bool,
@@ -61,7 +131,7 @@ impl Renderer {
         }
     }
 
-    fn set_stroke_properties(&mut self, stroke_props: &StrokeProps, is_text: bool) {
+    fn set_stroke_properties(&mut self, stroke_props: &StrokeProps, is_text: bool, path: &BezPath) {
         let threshold = if is_text { 0.25 } else { 1.0 };
 
         // Best-effort attempt to ensure a line width of at least 1.0, as required by the PDF
@@ -91,8 +161,13 @@ impl Renderer {
             miter_limit: stroke_props.miter_limit as f64,
             start_cap: stroke_props.line_cap,
             end_cap: stroke_props.line_cap,
-            dash_pattern: stroke_props.dash_array.iter().map(|n| *n as f64).collect(),
-            dash_offset: stroke_props.dash_offset as f64,
+            // PdfCraft patch: see `usable_dash_pattern`.
+            dash_pattern: usable_dash_pattern(path, &stroke_props.dash_array).into(),
+            dash_offset: if stroke_props.dash_offset.is_finite() {
+                stroke_props.dash_offset as f64
+            } else {
+                0.0
+            },
         };
 
         self.ctx.set_stroke(stroke);
@@ -598,7 +673,7 @@ impl Renderer {
         is_text: bool,
     ) {
         self.ctx.set_transform(transform);
-        self.set_stroke_properties(stroke_props, is_text);
+        self.set_stroke_properties(stroke_props, is_text, path);
 
         let clip_path = self.set_paint(paint, path, true);
         if let Some(clip_path) = clip_path.as_ref() {

From e130af2ef49f6ece1666f001f05159a111b1e33d Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:15:47 +0900
Subject: [PATCH 056/149] M3: renders of a dropped render pool stop at the next
 operator (#409)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The engine replaces a document's render pool after every edit, undo, redo,
layer toggle and comment-visibility change, and drops it on close. Workers in
the middle of a page kept rendering it to the end before finding that nobody
could receive the answer. On heavy pages that is seconds of CPU per worker,
competing with the new pool re-rendering the same pages.

hayro-interpret, vendored patch 17: `InterpreterSettings::cancelled`, checked
before each content operator. The pool sets it only in `Drop`, when its result
channel is gone, so a partly drawn page can never be delivered. Live pools,
`PageRenderer` and inline pools never set it.

7 heavy pages on 7 workers re-rendered after replacing a busy pool: 2.4–2.5 s
before, 1.1 s after (1.0–1.3 s without a replacement, unchanged).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/render/src/raster.rs                 | 53 ++++++++++++++++++++-
 vendor/README.md                            |  2 +-
 vendor/hayro-interpret/src/interpret/mod.rs | 10 ++++
 3 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index f7b1f89f..716d1ddd 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -298,6 +298,9 @@ struct Shared {
     /// Pages (and request kinds) the watchdog gave up on: answered with an error at once, so a
     /// pathological page cannot trap every worker in turn.
     stuck: Mutex<std::collections::HashSet<(usize, RequestKind)>>,
+    /// Set when the pool is dropped: the workers' renders stop at their next content operator,
+    /// since nobody can receive their answers any more.
+    dropped: Arc<std::sync::atomic::AtomicBool>,
     /// Test hook: make one page slow.
     #[cfg(test)]
     slow_page: Mutex<Option<(usize, std::time::Duration)>>,
@@ -409,7 +412,9 @@ impl RenderPool {
         let mut pool = Self::new(bytes.clone(), 0, config.clone());
         if pool.inline.is_none() {
             // Native `new` always spawns at least one worker; drop to inline explicitly.
-            pool = Self { shared: Arc::default(), wake: Mutex::new(Vec::new()), _workers: Mutex::new(Vec::new()), ..pool };
+            pool.shared = Arc::default();
+            pool.wake = Mutex::new(Vec::new());
+            pool._workers = Mutex::new(Vec::new());
             pool.inline = Some(std::cell::RefCell::new(PageRenderer::new(bytes, config)));
         }
         pool
@@ -495,9 +500,21 @@ impl RenderPool {
     }
 }
 
+impl Drop for RenderPool {
+    fn drop(&mut self) {
+        self.shared.dropped.store(true, std::sync::atomic::Ordering::Relaxed);
+    }
+}
+
+/// A worker's interpreter settings: the document's, stopping once the pool is dropped.
+#[cfg(not(target_arch = "wasm32"))]
+fn worker_settings(config: &RenderConfig, shared: &Shared) -> InterpreterSettings {
+    InterpreterSettings { cancelled: Some(shared.dropped.clone()), ..config.settings() }
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 fn worker(id: usize, bytes: Arc<Vec<u8>>, config: RenderConfig, shared: Arc<Shared>, wake: Receiver<()>, out: Sender<RenderedPage>) {
-    let settings = config.settings();
+    let settings = worker_settings(&config, &shared);
     // Outer loop: (re)build parser + cache; rebuilt after a renderer panic.
     loop {
         let pdf = parse(&bytes, config.password.as_deref());
@@ -1104,6 +1121,38 @@ trailer << /Root 1 0 R >>
         assert!(pool.try_recv().is_none());
     }
 
+    #[test]
+    fn dropping_the_pool_cancels_its_renders() {
+        const TEXT: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length 35 >> stream
+BT /F1 12 Tf 20 70 Td (Hello) Tj ET
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+        let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
+        let settings = worker_settings(&pool.config, &pool.shared);
+        let flag = settings.cancelled.clone().expect("workers can be cancelled");
+        assert!(Arc::ptr_eq(&flag, &pool.shared.dropped));
+        let shapes = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
+        let text = Pdf::new(Arc::new(TEXT.to_vec())).expect("parses");
+        let pages = shapes.pages();
+        let page = pages.first().expect("a page");
+        let rs = RenderSettings { bg_color: WHITE, ..Default::default() };
+        let blue = |s: &InterpreterSettings| {
+            let p = render(page, &RenderCache::new(), s, &rs).sample(20, 30);
+            [p.r, p.g, p.b, p.a] == [0, 0, 255, 255]
+        };
+        let glyphs = |s: &InterpreterSettings| crate::text::extract_page(&text, 0, s).map_or(0, |t| t.glyphs.len());
+        assert!(blue(&settings) && glyphs(&settings) == 5, "a live pool renders and reads everything");
+        drop(pool);
+        assert!(flag.load(std::sync::atomic::Ordering::Relaxed));
+        assert!(!blue(&settings) && glyphs(&settings) == 0, "once the pool is gone, interpretation stops before drawing");
+    }
+
     #[test]
     fn extracts_text_with_positions() {
         let pdf = b"%PDF-1.7
diff --git a/vendor/README.md b/vendor/README.md
index f9c8d07d..bfa7029a 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -7,7 +7,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n` | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it when dropped, after an edit or on closing, so its renders in progress stop instead of running to the end for answers nobody can receive) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders` |
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second |
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index a9615411..e77ff75e 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -25,6 +25,7 @@ use hayro_syntax::page::{Page, Resources};
 use kurbo::{Affine, BezPath, Point, Shape};
 use smallvec::smallvec;
 use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
 
 pub(crate) mod path;
 pub(crate) mod state;
@@ -109,6 +110,10 @@ pub struct InterpreterSettings {
     /// PdfCraft patch: viewer overrides for optional content groups (object number, generation,
     /// visible), applied on top of the document's default configuration (Layers panel toggles).
     pub ocg_overrides: Arc<Vec<(i32, i32, bool)>>,
+    /// PdfCraft patch: once this is `true`, interpretation stops before the next content
+    /// operator. What was drawn is then incomplete, so only set it when the output will be
+    /// thrown away (a viewer's render whose result nobody can receive any more).
+    pub cancelled: Option<Arc<AtomicBool>>,
 }
 
 impl Default for InterpreterSettings {
@@ -129,6 +134,7 @@ impl Default for InterpreterSettings {
             render_annotations: true,
             hide_comments: false,
             ocg_overrides: Arc::new(Vec::new()),
+            cancelled: None,
         }
     }
 }
@@ -325,6 +331,10 @@ pub fn interpret<'a>(
     context.save_state();
 
     while let Some(op) = ops.next() {
+        // PdfCraft patch: stop when the caller cancelled (see `InterpreterSettings::cancelled`).
+        if context.settings.cancelled.as_ref().is_some_and(|c| c.load(Ordering::Relaxed)) {
+            break;
+        }
         match op {
             TypedInstruction::SaveState(_) => context.save_state(),
             TypedInstruction::StrokeColorDeviceRgb(s) => {

From d6c2a694ec3bfc15e9d5facb672078d7b983a113 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:15:55 +0900
Subject: [PATCH 057/149] M3: rendered pixels are moved out of the pixmap, not
 copied (#404)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`render_page` copied every raster out of vello_cpu's pixmap with
`data_as_u8_slice().to_vec()`. That is a second buffer the size of the raster
(up to 256 MB for a 64 MP page), alive alongside the first for as long as the
copy runs. `Pixmap::take` hands over the pixel vector, and `bytemuck`
reinterprets its four one-byte channels as bytes in place: the same bytes, in
the same buffer.

On a 6182×8000 px page, peak RSS goes from about 425 MB to 246 MB and render
time from 102 ms to 81 ms. Pixels are identical: every page of #260's test
file, at two scales and as a tile, hashes the same before and after.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                  |  1 +
 crates/render/Cargo.toml    |  2 ++
 crates/render/src/raster.rs | 22 +++++++++++++++++++++-
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index ca64fd79..d43c0e0b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3745,6 +3745,7 @@ dependencies = [
 name = "pdfcraft-render"
 version = "0.4.0"
 dependencies = [
+ "bytemuck",
  "getrandom 0.4.3",
  "hayro",
  "hayro-syntax",
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index fa68a064..0a42520e 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -16,6 +16,8 @@ lopdf = { workspace = true }
 kurbo = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
+# Moves rendered pixels out of the renderer's pixmap without copying; already in the tree through hayro.
+bytemuck = { version = "1", features = ["extern_crate_alloc"] }
 
 # lopdf (bootstrap) draws random bytes for encryption; on the web they come from the browser.
 [target.'cfg(target_arch = "wasm32")'.dependencies]
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 716d1ddd..f9512df4 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -17,6 +17,7 @@ use hayro::hayro_interpret::InterpreterSettings;
 use hayro::hayro_interpret::font::{FontData, FontQuery};
 use hayro::hayro_interpret::hayro_cmap::CidFamily;
 use hayro::hayro_syntax::Pdf;
+use hayro::vello_cpu::Pixmap;
 use hayro::vello_cpu::color::palette::css::WHITE;
 use hayro::{RenderCache, RenderSettings, render};
 
@@ -222,7 +223,7 @@ fn render_page<'a>(pdf: &'a Pdf, cache: &RenderCache<'a>, settings: &Interpreter
             }
         };
         let pixmap = render(page, cache, settings, &rs);
-        Ok((pixmap.width() as u32, pixmap.height() as u32, pixmap.data_as_u8_slice().to_vec(), None))
+        Ok((pixmap.width() as u32, pixmap.height() as u32, into_bytes(pixmap), None))
     }));
     match result {
         Ok(Ok(v)) => Ok(v),
@@ -231,6 +232,13 @@ fn render_page<'a>(pdf: &'a Pdf, cache: &RenderCache<'a>, settings: &Interpreter
     }
 }
 
+/// The pixmap's premultiplied RGBA bytes, moved out rather than copied (a page raster can be
+/// hundreds of megabytes). Four one-byte channels always recast to bytes in place; the copy is
+/// only there because the cast's signature allows failure.
+fn into_bytes(pixmap: Pixmap) -> Vec<u8> {
+    bytemuck::allocation::try_cast_vec(pixmap.take()).unwrap_or_else(|(_, pixels)| pixels.iter().flat_map(|p| [p.r, p.g, p.b, p.a]).collect())
+}
+
 fn finish(req: RenderRequest, start: Stopwatch, r: Result<Output, (String, bool)>) -> RenderedPage {
     let millis = start.millis();
     match r {
@@ -732,6 +740,18 @@ trailer << /Root 1 0 R >>
         assert_eq!(px(80, 5), &[255, 255, 255, 255]);
     }
 
+    #[test]
+    fn rendered_pixels_are_moved_out_of_the_pixmap() {
+        let mut pixmap = Pixmap::new(3, 2);
+        for (i, b) in pixmap.data_as_u8_slice_mut().iter_mut().enumerate() {
+            *b = i as u8;
+        }
+        let (at, expected) = (pixmap.data_as_u8_slice().as_ptr(), pixmap.data_as_u8_slice().to_vec());
+        let bytes = into_bytes(pixmap);
+        assert_eq!(bytes, expected);
+        assert_eq!(bytes.as_ptr(), at, "the pixmap's own buffer, not a copy");
+    }
+
     #[test]
     fn missing_page_and_garbage_input_fail_gracefully() {
         let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());

From 3a35a7d6ac136e516a0463227ca9f7dc60c11023 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:16:01 +0900
Subject: [PATCH 058/149] M1: incremental saves are allocated once at their
 exact size (#402)

`write_incremental` copied the original into a buffer with 4 KB to spare,
then appended the revision. A revision above 4 KB (rotating a few dozen pages,
an image, a long comment thread) outgrew it. The buffer was then reallocated
at twice the size: the whole original was copied a second time, and the
result kept up to the original's size again unused. The engine keeps that
result as the document's working bytes, shared with the renderer and handed
to Save, so the unused half stayed alive. A 100 MB document held a 200 MB
allocation after one such edit, and still did after saving.

The revision is now written on its own, with offsets counted from where it
will start. The result is allocated once at exactly the original's size plus
the revision's, and filled in one pass. The output is byte for byte what it
was before.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/cos/src/writer.rs   | 34 +++++++++++++++++++++-------------
 crates/cos/tests/writer.rs | 27 ++++++++++++++++++++++++++-
 2 files changed, 47 insertions(+), 14 deletions(-)

diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index 858a3067..73311d22 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -181,16 +181,17 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     let mut doc = doc.clone();
     stamp_mod_date(&mut doc, opts);
     let original = doc.bytes().clone();
-    let mut out = Vec::with_capacity(original.len() + 4096);
-    out.extend_from_slice(&original);
-    if !matches!(out.last(), Some(b'\n' | b'\r')) {
-        out.push(b'\n');
-    }
+    // The revision is written on its own and joined to the original at the end, so the result is
+    // allocated once at its exact size: growing a buffer that holds a large original past a
+    // guessed capacity would copy the whole file again and keep up to as much again unused.
+    let newline = !matches!(original.last(), Some(b'\n' | b'\r'));
+    let base = (original.len() + usize::from(newline)) as u64;
+    let mut out = Vec::new();
     let mut offsets: BTreeMap<u32, (u64, u16, bool)> = BTreeMap::new(); // num → (offset, gen, in use)
     for (num, generation, obj) in doc.overlay_entries().collect::<Vec<_>>() {
         match obj {
             Some(o) => {
-                offsets.insert(num, (out.len() as u64, generation, true));
+                offsets.insert(num, (base + out.len() as u64, generation, true));
                 write_indirect(num, generation, &prepared(&doc, num, num, generation, &o), &mut out);
             }
             None => {
@@ -210,16 +211,22 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     let size = doc.next_num().max(trailer.int(b"Size").unwrap_or(0) as u32);
     if as_stream {
         let rows = offsets.iter().map(|(n, (o, g, used))| (*n, if *used { Row::InFile(*o, *g) } else { Row::Free(*g) })).collect();
-        write_xref_stream(&mut out, &mut trailer, rows, size);
+        write_xref_stream(&mut out, base, &mut trailer, rows, size);
     } else {
         trailer.set(b"Size".to_vec(), Object::Int(size as i64));
-        let xref_at = out.len();
+        let xref_at = base + out.len() as u64;
         write_xref_table(&mut out, &offsets, prev.is_none());
         out.extend_from_slice(b"trailer\n");
         write_dict(&trailer, &mut out);
         let _ = write!(out, "\nstartxref\n{xref_at}\n%%EOF\n");
     }
-    Ok(out)
+    let mut file = Vec::with_capacity(original.len() + usize::from(newline) + out.len());
+    file.extend_from_slice(&original);
+    if newline {
+        file.push(b'\n');
+    }
+    file.extend_from_slice(&out);
+    Ok(file)
 }
 
 /// Write only reachable objects, renumbered from 1, with a classic cross-reference table.
@@ -317,7 +324,7 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
         ensure_id(&mut trailer, opts, doc.bytes());
     }
     if opts.object_streams {
-        write_xref_stream(&mut out, &mut trailer, rows, next);
+        write_xref_stream(&mut out, 0, &mut trailer, rows, next);
     } else {
         trailer.set(b"Size".to_vec(), Object::Int(next as i64));
         let offsets: BTreeMap<u32, (u64, u16, bool)> =
@@ -374,9 +381,10 @@ fn write_xref_table(out: &mut Vec<u8>, offsets: &BTreeMap<u32, (u64, u16, bool)>
 }
 
 /// A cross-reference stream section (§7.5.8) that takes object number `num`, ending the file.
-/// Rows are Flate-compressed with the PNG Up predictor, and field widths fit the largest value.
-fn write_xref_stream(out: &mut Vec<u8>, trailer: &mut Dict, mut rows: BTreeMap<u32, Row>, num: u32) {
-    let xref_at = out.len() as u64;
+/// `out` holds the file from byte offset `base` on. Rows are Flate-compressed with the PNG Up
+/// predictor, and field widths fit the largest value.
+fn write_xref_stream(out: &mut Vec<u8>, base: u64, trailer: &mut Dict, mut rows: BTreeMap<u32, Row>, num: u32) {
+    let xref_at = base + out.len() as u64;
     rows.insert(num, Row::InFile(xref_at, 0));
     if trailer.get(b"Prev").is_none() {
         rows.entry(0).or_insert(Row::Free(65535));
diff --git a/crates/cos/tests/writer.rs b/crates/cos/tests/writer.rs
index bfe85882..41158f10 100644
--- a/crates/cos/tests/writer.rs
+++ b/crates/cos/tests/writer.rs
@@ -3,7 +3,7 @@
 
 use std::sync::Arc;
 
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, write_full, write_incremental};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full, write_incremental};
 
 /// Four pages, a shared font, document info with a non-ASCII title.
 fn fixture() -> Vec<u8> {
@@ -87,6 +87,31 @@ fn incremental_saves_stack_on_an_xref_stream_file() {
     assert_eq!(hayro_pages(&updated), 4);
 }
 
+/// The revision is joined to the original once, at its exact size. A revision of more than a few
+/// kilobytes used to outgrow the buffer: the whole original was copied a second time, and the
+/// result kept up to as much again unused for as long as it was the document's working bytes.
+#[test]
+fn incremental_saves_are_allocated_at_their_exact_size() {
+    let table = Arc::new(fixture());
+    let stream = Arc::new(write_full(&Document::open(table.clone()).unwrap(), &SaveOptions::default()).unwrap());
+    let no_newline = Arc::new(fixture().trim_ascii_end().to_vec());
+    for original in [table, stream, no_newline] {
+        let mut doc = Document::open(original.clone()).unwrap();
+        let data: Vec<u8> = (0..100_000u32).map(|i| (i % 251) as u8).collect();
+        let added = doc.add(Object::Stream(Stream { dict: Dict::new(), raw: Arc::new(data.clone()) }));
+        let updated = write_incremental(&doc, &SaveOptions::default()).unwrap();
+        assert_eq!(updated.capacity(), updated.len());
+        assert!(updated.starts_with(&original), "an incremental save only appends");
+        let back = Document::open(Arc::new(updated.clone())).unwrap();
+        assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
+        match &*back.get(added) {
+            Object::Stream(s) => assert_eq!(*s.raw, data),
+            other => panic!("{other:?}"),
+        }
+        assert_eq!(hayro_pages(&updated), 4);
+    }
+}
+
 #[test]
 fn qpdf_accepts_object_stream_output() {
     let Ok(out) = std::process::Command::new("qpdf").arg("--version").output() else {

From 3de2be8a6801ae5e4f92f9610b49e23a95f5b0c0 Mon Sep 17 00:00:00 2001
From: pauliusiv123-rgb <235694617+pauliusiv123-rgb@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:16:10 +0300
Subject: [PATCH 059/149] Issue #442: reopen the files that were open when
 PdfCraft last closed (#462)

---
 ATTRIBUTION.toml                    |  18 ++--
 apps/pdfcraft/src/main.rs           |   3 +
 crates/ui-egui/src/editing.rs       |   8 ++
 crates/ui-egui/src/i18n/cs.tsv      |   1 +
 crates/ui-egui/src/i18n/es.tsv      |   1 +
 crates/ui-egui/src/i18n/fr.tsv      |   1 +
 crates/ui-egui/src/i18n/ja.tsv      |   1 +
 crates/ui-egui/src/i18n/pt-br.tsv   |   1 +
 crates/ui-egui/src/i18n/ru.tsv      |   1 +
 crates/ui-egui/src/i18n/te.tsv      |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv |   1 +
 crates/ui-egui/src/i18n/zh-hant.tsv |   1 +
 crates/ui-egui/src/js_ui.rs         |   3 +
 crates/ui-egui/src/last_session.rs  | 159 ++++++++++++++++++++++++++++
 crates/ui-egui/src/lib.rs           |  18 ++++
 crates/ui-egui/tests/editing.rs     | 113 ++++++++++++++++++++
 parity/acrobat-features.toml        |  12 +++
 17 files changed, 334 insertions(+), 9 deletions(-)
 create mode 100644 crates/ui-egui/src/last_session.rs

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 3a1801a2..098c5989 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "50ec1133889f3a3948a3901a9fa40b3499f3c549b605e55848138483946d74da"
+sha256 = "8444a3bd135d61feb6c5b559a9eb0babb50de2ebbd1d86b1e87ccb064e2d3f0b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3746a7d87fb98c9f3aeb41c63ce50371c42dfebca64b67ccbb599abb36a93ba8"
+sha256 = "8771d80405b8fba9da4a909fdd97b760f6b25a822807ca83ff20dc5cec83a73c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2c09a121e493fb123d9f886529f62268119ca580ad5d5300eca61d4a39216827"
+sha256 = "bf1ab8079af725264f9c4298b9737359ba831170dcba76a6bd39228239c87e83"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0ccf62e34424981d5980eeaee8799db2653a4c186807df143326ef9881959006"
+sha256 = "b23b03cf4ac163e7a63e49a0900a125507c05ad4fc7930468b859acf32b09ecd"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0b579afad6e52b98cef5e61e07e238d9cf76cc7f295395f7e1c855400e5fbaf9"
+sha256 = "1b3371f239ca89a658e2c9b80cc070be5cd941dd1ecd3e7a247696716f25721d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "956753e05b5a9e1d4c4a63ee57667cc9fa5bb95288c3d46c6b15435b83d6ed8d"
+sha256 = "dbf725ffc9177a435e894f4405834e87c70b6fe31a34f1be533c60c356510b97"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e8b96edd718a1cd212b7440c4ab100f2555c97dccb0cda289bdb1775d5f3aa61"
+sha256 = "f7a5ab0bcbdb8641b1bd4ae25db54ef187757dde3e4fe372e433a9e5c0fc4f3a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "136a9ae206c4ee5aad29d248613c568799080b4b3ee9cd197233072ee9a2983a"
+sha256 = "259f795a3cdc032aa670693d2ebff010c5dd3bcf57dda11548d5bd46e78969b8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d2e7114c70da3c52200cf68e9023dc32ff462439795784e49c2ae771531240e2"
+sha256 = "cdcdba828efea9d402cb9ce8be2b52ab1d58c8f7837d75d3b9c86f2a05e7fb2e"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index e40607a8..3d7f61a5 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -224,6 +224,9 @@ fn main() -> eframe::Result {
                     app.notify(e);
                 }
             } else {
+                // With the preference on, last session's files come back first; files named on
+                // the command line open after them, in front (#442).
+                app.reopen_last_files(&files);
                 for f in files {
                     app.open_path(&f);
                 }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 1d1b6902..57c2fef2 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -464,6 +464,14 @@ impl PdfCraftApp {
                 }
             },
         };
+        // Quitting closes the unsaved tabs one by one (and brings each forward to save it):
+        // remember what was open, and which tab was active, before the first one goes (#442).
+        if req == CloseRequest::Quit {
+            match choice {
+                Some(_) => self.note_quit_session(),
+                None => self.forget_quit_session(),
+            }
+        }
         match choice {
             None => {} // cancelled: nothing closes
             Some(false) => self.close_and_continue(ctx, index, req),
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 75cf6d50..af17a38f 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -108,6 +108,7 @@
 	Fit to width scrolling	Plynulé posouvání s přizpůsobením šířce
 	Fit one full page	Celá jedna stránka
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Používá se, když PDF nepožaduje rozložení ani zvětšení. Plynulé posouvání mezi stránkami neskáče.
+	Reopen the files that were open when PdfCraft last closed	Znovu otevřít soubory, které byly otevřené při posledním zavření aplikace PdfCraft
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Vyberte obrázek PNG nebo JPEG (nejvýše 4 MiB). Průhlednost bude zachována.
 	Couldn't import the signature image: {e}	Obrázek podpisu nelze importovat: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Přenosný režim je vypnutý: do složky {folder} nelze zapisovat ({error}). Nastavení se místo toho ukládá do vaší uživatelské složky.
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index afc29fbc..c1e3d2fd 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1986,6 +1986,7 @@
 	Default page display	Presentación de página predeterminada
 	Default zoom	Zoom predeterminado
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Se usa cuando un PDF no pide una presentación ni un zoom. El desplazamiento continuo nunca salta de página en página.
+	Reopen the files that were open when PdfCraft last closed	Volver a abrir los archivos que estaban abiertos al cerrar PdfCraft por última vez
 	Created a PDF from {n} files	Se creó un PDF a partir de {n} archivos
 	PDF, images and text	PDF, imágenes y texto
 	Insert a file before page {label}	Insertar un archivo antes de la página {label}
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 64a86273..1d27e04f 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1909,6 +1909,7 @@
 	Default page display	Affichage des pages par défaut
 	Default zoom	Zoom par défaut
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Utilisé lorsqu'un PDF ne demande ni présentation ni zoom. Le défilement continu ne saute jamais d'une page à l'autre.
+	Reopen the files that were open when PdfCraft last closed	Rouvrir les fichiers qui étaient ouverts lors de la dernière fermeture de PdfCraft
 	Show	Afficher
 	Sort	Trier
 	Reverse the order	Inverser l'ordre
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index ca53e983..bd36ccd7 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1975,3 +1975,4 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG または JPEG 画像を選択してください（最大 4 MiB）。透明度は保持されます。
 	Couldn't import the signature image: {e}	署名画像を読み込めませんでした: {e}
 	Go to page…	ページへ移動…
+	Reopen the files that were open when PdfCraft last closed	前回 PdfCraft を閉じたときに開いていたファイルを再度開く
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index d9048a96..8e38337d 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -66,3 +66,4 @@
 	Couldn't import the signature image: {e}	Não foi possível importar a imagem da assinatura: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	O modo portátil está desativado: não é possível gravar em {folder} ({error}). As configurações ficam na sua pasta de usuário.
 	Go to page…	Ir para a página…
+	Reopen the files that were open when PdfCraft last closed	Reabrir os arquivos que estavam abertos quando o PdfCraft foi fechado pela última vez
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 5b91f559..167525de 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -1972,6 +1972,7 @@
 	Default page display	Отображение страниц по умолчанию
 	Default zoom	Масштаб по умолчанию
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Используется, когда PDF не запрашивает макет или масштаб. Непрерывная прокрутка никогда не привязывается между страницами.
+	Reopen the files that were open when PdfCraft last closed	Повторно открывать файлы, которые были открыты при последнем закрытии PdfCraft
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Выберите изображение PNG или JPEG (до 4 МиБ). Прозрачность сохраняется.
 	Couldn't import the signature image: {e}	Не удалось импортировать изображение подписи: {e}
 
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 1e381f12..81f47b47 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -1911,6 +1911,7 @@ action wizard	Start	ప్రారంభించు
 	Default page display	డిఫాల్ట్ పేజీ ప్రదర్శన
 	Default zoom	డిఫాల్ట్ జూమ్
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF ఏ లేఅవుట్‌ను గానీ జూమ్‌ను గానీ కోరనప్పుడు ఉపయోగించబడుతుంది. నిరంతర స్క్రోలింగ్ పేజీల మధ్య ఎప్పుడూ స్నాప్ అవ్వదు.
+	Reopen the files that were open when PdfCraft last closed	PdfCraftను చివరిసారి మూసివేసినప్పుడు తెరిచి ఉన్న ఫైల్‌లను మళ్లీ తెరువు
 	About	పరిచయం
 	Contributors	సహకారులు
 	Models	మోడల్‌లు
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 5e4a6a3d..5b66f382 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2005,6 +2005,7 @@
 	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	尚未安装文本识别功能：缺少模型（请运行 `cargo xtask models` 或设置 PDFCRAFT_MODELS）。
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	用于打开 PDF 时。如果启动参数或控制通道明确指定了模式，则本次会话优先使用该模式。
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF 未指定布局或缩放时使用。连续滚动时页面不会逐页吸附。
+	Reopen the files that were open when PdfCraft last closed	重新打开上次关闭 PdfCraft 时打开的文件
 	Write this email?	是否撰写此邮件？
 	{who} in this document wants to open this address in your browser:	此文档中的{who}请求在浏览器中打开以下地址：
 	{who} in this document wants to open your email app with this address:	此文档中的{who}请求打开邮件应用并使用以下地址：
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 7696480c..9a9e1e85 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1968,3 +1968,4 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	選擇 PNG 或 JPEG 圖像（最大 4 MiB）。透明度會保留。
 	Couldn't import the signature image: {e}	無法匯入簽名圖像：{e}
 	Go to page…	轉到頁面…
+	Reopen the files that were open when PdfCraft last closed	重新開啟上次關閉 PdfCraft 時開啟的檔案
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index 53665e29..fb3059b1 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -295,6 +295,9 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
             .small()
             .color(t.text_muted),
     );
+    // The web build has no file paths to reopen.
+    #[cfg(not(target_arch = "wasm32"))]
+    ui.checkbox(&mut app.reopen_last_session, tl!("Reopen the files that were open when PdfCraft last closed"));
     ui.add_space(8.0);
     // Identity: the author of new comments (Acrobat: Preferences ▸ Identity).
     ui.label(egui::RichText::new(tl!("Identity")).font(theme::semibold(13.0)));
diff --git a/crates/ui-egui/src/last_session.rs b/crates/ui-egui/src/last_session.rs
new file mode 100644
index 00000000..bf64ea7a
--- /dev/null
+++ b/crates/ui-egui/src/last_session.rs
@@ -0,0 +1,159 @@
+//! Reopen the files from the last session (Preferences ▸ Documents and view, #442): which files
+//! were open when PdfCraft last closed, the page each showed and the active tab. Local only, like
+//! the recent-files list, and kept only while the preference is on.
+
+use serde::Serialize;
+
+use crate::PdfCraftApp;
+
+/// More files than anyone keeps open. Settings are untrusted, so a longer list is cut here.
+pub const MAX_FILES: usize = 64;
+
+/// The files open when PdfCraft last closed.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize)]
+pub struct LastSession {
+    pub files: Vec<SessionFile>,
+    /// The path of the tab that was active.
+    pub active: Option<String>,
+}
+
+/// One open file and where the reader was in it.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub struct SessionFile {
+    /// Absolute, so a file opened from the command line by a relative path is found again.
+    pub path: String,
+    /// The page the tab showed (0-based).
+    pub page: usize,
+}
+
+impl LastSession {
+    /// Read what [`PdfCraftApp::persist`] wrote. Malformed entries are skipped and the list is
+    /// capped at [`MAX_FILES`].
+    pub(crate) fn from_json(v: &serde_json::Value) -> Self {
+        let files = v["files"]
+            .as_array()
+            .map(|files| {
+                files
+                    .iter()
+                    .filter_map(|f| {
+                        let path = f["path"].as_str().filter(|p| !p.is_empty())?.to_string();
+                        // `go_to_page` clamps a page past the end.
+                        let page = f["page"].as_u64().and_then(|p| usize::try_from(p).ok()).unwrap_or(0);
+                        Some(SessionFile { path, page })
+                    })
+                    .take(MAX_FILES)
+                    .collect()
+            })
+            .unwrap_or_default();
+        Self { files, active: v["active"].as_str().map(str::to_string) }
+    }
+}
+
+/// `path` made absolute against the current directory, without resolving links (and without
+/// Windows' `\\?\` prefix, which `canonicalize` adds).
+#[cfg(not(target_arch = "wasm32"))]
+fn absolute(path: &str) -> String {
+    std::path::absolute(path).map_or_else(|_| path.to_string(), |p| p.to_string_lossy().into_owned())
+}
+
+impl PdfCraftApp {
+    /// The files open now. Documents that were never saved to a file are left out (crash
+    /// recovery keeps their unsaved work), and so is everything on the web, which has no paths.
+    pub(crate) fn open_session(&self) -> LastSession {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let path = |v: &crate::DocView| self.session.get(v.id).and_then(|d| d.path.as_deref()).map(absolute);
+            let files = self.views.iter().filter_map(|v| Some(SessionFile { path: path(v)?, page: v.current })).take(MAX_FILES).collect();
+            let active = self.active.and_then(|i| self.views.get(i)).and_then(path);
+            LastSession { files, active }
+        }
+        #[cfg(target_arch = "wasm32")]
+        LastSession::default()
+    }
+
+    /// What to save as the last session: the files open when the quit began, once the app is
+    /// really quitting (unsaved tabs close one by one before that), else the files open now.
+    pub(crate) fn session_to_save(&self) -> LastSession {
+        match &self.quit_session {
+            Some(s) if self.allow_quit => s.clone(),
+            _ => self.open_session(),
+        }
+    }
+
+    /// A quit is about to close its first tab: remember everything that is still open.
+    pub(crate) fn note_quit_session(&mut self) {
+        if self.quit_session.is_none() {
+            self.quit_session = Some(self.open_session());
+        }
+    }
+
+    /// The quit was cancelled: what is open from now on is the session again.
+    pub(crate) fn forget_quit_session(&mut self) {
+        self.quit_session = None;
+    }
+
+    /// At startup, with the preference on: reopen the last session's files at the pages they
+    /// showed and bring its active tab forward. Files that are gone are skipped, and so are
+    /// `skip` (files the app is about to open anyway, e.g. from the command line) and documents
+    /// the Recovery dialog offers, so neither opens twice.
+    ///
+    /// Only one password prompt can wait at a time: the first encrypted file asks for its
+    /// password and later ones stay closed (they are in the recent-files list).
+    pub fn reopen_last_files(&mut self, skip: &[String]) {
+        let last = std::mem::take(&mut self.last_session);
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.reopen_last_session {
+            let skip: Vec<String> =
+                skip.iter().map(|p| absolute(p)).chain(self.recoverable.iter().filter_map(|m| m.path.as_deref().map(absolute))).collect();
+            let mut active = None;
+            let mut prompt = self.password_prompt.take();
+            for f in &last.files {
+                let open = |app: &Self| {
+                    app.views.iter().any(|v| app.session.get(v.id).and_then(|d| d.path.as_deref()).map(absolute).as_deref() == Some(f.path.as_str()))
+                };
+                if skip.contains(&f.path) || !std::path::Path::new(&f.path).is_file() || open(self) {
+                    continue;
+                }
+                let before = self.views.len();
+                self.open_path(&f.path);
+                if let Some(p) = self.password_prompt.take() {
+                    prompt.get_or_insert(p);
+                }
+                if self.views.len() > before
+                    && let Some(view) = self.views.last_mut()
+                {
+                    view.go_to_page(f.page);
+                    if last.active.as_ref() == Some(&f.path) {
+                        active = Some(self.views.len() - 1);
+                    }
+                }
+            }
+            self.password_prompt = prompt;
+            if active.is_some() {
+                self.active = active;
+            }
+        }
+        #[cfg(target_arch = "wasm32")]
+        let _ = (last, skip);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn malformed_sessions_are_skipped_and_capped() {
+        let v = serde_json::json!({
+            "files": [{"path": 5}, {"path": ""}, "x", {"path": "/a.pdf", "page": -3}, {"path": "/b.pdf", "page": 1e300}, {"path": "/c.pdf", "page": 7}],
+            "active": 3,
+        });
+        let s = LastSession::from_json(&v);
+        let pages: Vec<(&str, usize)> = s.files.iter().map(|f| (f.path.as_str(), f.page)).collect();
+        assert_eq!(pages, [("/a.pdf", 0), ("/b.pdf", 0), ("/c.pdf", 7)]);
+        assert_eq!(s.active, None);
+        let many: Vec<serde_json::Value> = (0..1000).map(|i| serde_json::json!({"path": format!("/{i}.pdf")})).collect();
+        assert_eq!(LastSession::from_json(&serde_json::json!({"files": many})).files.len(), MAX_FILES);
+        assert_eq!(LastSession::from_json(&serde_json::json!("garbage")), LastSession::default());
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 3770168b..c70cdc12 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -72,6 +72,7 @@ pub mod forms_ui;
 mod home;
 mod icon_data;
 pub mod icons;
+pub mod last_session;
 mod pageboxes;
 mod palette;
 mod panels;
@@ -377,6 +378,13 @@ pub struct PdfCraftApp {
     pub palette_query: String,
     pub all_tools_expanded: bool,
     pub recent: Vec<RecentFile>,
+    /// Preferences: reopen the files that were open when PdfCraft last closed (#442).
+    pub reopen_last_session: bool,
+    /// The files open when PdfCraft last closed, read from the settings for
+    /// [`PdfCraftApp::reopen_last_files`].
+    pub last_session: last_session::LastSession,
+    /// Quitting closes unsaved tabs one by one: what was open when the quit began.
+    quit_session: Option<last_session::LastSession>,
     /// Folders pinned to Home, and what they held when last listed.
     pub pinned: folders_ui::PinnedFolders,
     pub toast: Option<(String, f64)>,
@@ -619,6 +627,9 @@ impl PdfCraftApp {
             palette_query: String::new(),
             all_tools_expanded: false,
             recent: Vec::new(),
+            reopen_last_session: false,
+            last_session: Default::default(),
+            quit_session: None,
             pinned: Default::default(),
             toast: None,
             integrated_titlebar: false,
@@ -1186,6 +1197,9 @@ impl PdfCraftApp {
         let trusted: Vec<String> = self.session.trusted_certificates().iter().map(pdfcraft_engine::sign::x509::to_pem).collect();
         serde_json::json!({
             "recent": self.recent,
+            "reopen_last_session": self.reopen_last_session,
+            // Kept only while the preference is on.
+            "last_session": self.reopen_last_session.then(|| self.session_to_save()),
             "pinned_folders": self.pinned.folders,
             "theme": self.theme_preference,
             "default_mode": self.default_mode,
@@ -1221,6 +1235,10 @@ impl PdfCraftApp {
             let r: Vec<RecentFile> = r.into_iter().filter(|f| std::path::Path::new(&f.path).exists()).collect();
             self.recent = r;
         }
+        if let Some(on) = v["reopen_last_session"].as_bool() {
+            self.reopen_last_session = on;
+        }
+        self.last_session = last_session::LastSession::from_json(&v["last_session"]);
         self.pinned.restore(&v["pinned_folders"]);
         if let Ok(preference) = serde_json::from_value::<ThemePreference>(v["theme"].clone()) {
             self.set_theme_preference(preference);
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 524e42de..8225ecf3 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -388,6 +388,119 @@ fn quitting_with_unsaved_changes_asks_for_each_document() {
     assert!(h.state().close_request.is_none());
 }
 
+/// PDFs written to a fresh temp folder, removed when the test ends.
+struct TempPdfs(std::path::PathBuf);
+
+impl TempPdfs {
+    fn new(test: &str) -> Self {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-session-{test}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        Self(dir)
+    }
+
+    fn file(&self, name: &str, pages: usize) -> String {
+        let path = self.0.join(name);
+        std::fs::write(&path, fixture(pages)).unwrap();
+        path.to_string_lossy().into_owned()
+    }
+}
+
+impl Drop for TempPdfs {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// The app with Preferences ▸ Reopen the files that were open when PdfCraft last closed on.
+fn session_harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.reopen_last_session = true;
+        setup(&mut app);
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+fn open_paths(app: &PdfCraftApp) -> Vec<String> {
+    app.views.iter().map(|v| app.session.get(v.id).and_then(|d| d.path.clone()).unwrap_or_default()).collect()
+}
+
+#[test]
+fn the_last_session_reopens_its_files_pages_and_active_tab() {
+    let dir = TempPdfs::new("reopen");
+    let files = [dir.file("a.pdf", 1), dir.file("b.pdf", 5), dir.file("c.pdf", 2)];
+    let opened = files.clone();
+    let mut h = session_harness(move |app| opened.iter().for_each(|f| app.open_path(f)));
+    h.state_mut().views[1].go_to_page(3);
+    h.state_mut().active = Some(1);
+    h.run_steps(4);
+    assert_eq!(h.state().views[1].current, 3, "b.pdf shows page 4");
+    let settings = h.state().persist();
+    let mut h = session_harness(move |app| {
+        app.restore(&settings);
+        app.reopen_last_files(&[]);
+    });
+    h.run_steps(4);
+    let app = h.state();
+    assert_eq!(open_paths(app), files, "the same files, in the same order");
+    assert_eq!(app.active, Some(1), "b.pdf is in front again");
+    assert_eq!(app.views[1].current, 3, "at the page it showed");
+}
+
+#[test]
+fn quitting_with_unsaved_changes_still_remembers_every_file() {
+    let dir = TempPdfs::new("quit");
+    let files = [dir.file("a.pdf", 1), dir.file("b.pdf", 1)];
+    let opened = files.clone();
+    let mut h = session_harness(move |app| opened.iter().for_each(|f| app.open_path(f)));
+    for tab in 0..2 {
+        h.state_mut().active = Some(tab);
+        h.state_mut().views[tab].select_pages(&[0]);
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 });
+    }
+    h.state_mut().active = Some(1);
+    h.state_mut().close_request = Some(CloseRequest::Quit);
+    h.run_steps(3);
+    // Each unsaved tab closes as it is answered, before PdfCraft quits.
+    for _ in 0..2 {
+        h.get_by_label("Don't save").click();
+        h.run_steps(3);
+    }
+    assert!(h.state().views.is_empty());
+    let mut app = PdfCraftApp::new();
+    app.restore(&h.state().persist());
+    app.reopen_last_files(&[]);
+    assert_eq!(open_paths(&app), files, "both files come back");
+    assert_eq!(app.active, Some(1), "with b.pdf in front, as when the quit began");
+}
+
+#[test]
+fn the_last_session_is_off_by_default_and_skips_missing_and_duplicate_files() {
+    let dir = TempPdfs::new("skip");
+    let (a, b) = (dir.file("a.pdf", 1), dir.file("b.pdf", 1));
+    let mut app = PdfCraftApp::new();
+    app.open_path(&a);
+    app.open_path(&b);
+    let off: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert!(off["last_session"].is_null(), "nothing is kept while the preference is off");
+    app.reopen_last_session = true;
+    let settings = app.persist();
+    let mut later = PdfCraftApp::new();
+    later.restore(&settings);
+    later.reopen_last_session = false;
+    later.reopen_last_files(&[]);
+    assert!(later.views.is_empty(), "turned off again: nothing reopens");
+    // b.pdf is gone, and a.pdf is about to open from the command line.
+    std::fs::remove_file(&b).unwrap();
+    let mut later = PdfCraftApp::new();
+    later.restore(&settings);
+    later.reopen_last_files(&[a]);
+    assert!(later.views.is_empty(), "neither opens from the session");
+}
+
 #[test]
 fn save_prompt_stays_inside_the_screen_for_a_long_filename() {
     // Issue #161: an unwrapped title carrying a long filename widened the centered modal past
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 7da0de8f..19698c15 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -661,6 +661,18 @@ tools = []
 evidence = ["crates/ui-egui/tests/ui.rs::persistence_round_trips_and_tolerates_garbage", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_lists_files_and_opens_one", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_is_disabled_while_the_list_is_empty"]
 notes = "never reads other apps' lists; File ▸ Open Recent lists them (#290), an already-open file focuses its tab instead of reopening it"
 
+[[feature]]
+id = "core.reopen-last-session"
+title = "Reopen the files from the last session at startup"
+area = "A"
+tier = "P2"
+milestone = "M3"
+status = "shipped"
+commands = []
+tools = []
+evidence = ["crates/ui-egui/tests/editing.rs::the_last_session_reopens_its_files_pages_and_active_tab", "crates/ui-egui/tests/editing.rs::quitting_with_unsaved_changes_still_remembers_every_file", "crates/ui-egui/tests/editing.rs::the_last_session_is_off_by_default_and_skips_missing_and_duplicate_files", "crates/ui-egui/src/last_session.rs::malformed_sessions_are_skipped_and_capped"]
+notes = "Desktop, off by default (Preferences ▸ Documents and view, #442): the files open when PdfCraft last closed reopen at the page each showed, with the same tab in front; files named on the command line open after them, in front; files that are gone, and documents the Recovery dialog offers, are skipped. Quitting with unsaved changes still remembers every tab. Not yet: zoom, layout and scroll position within the page (#418); only the first encrypted file asks for its password (later ones stay closed), and a file opened after it dismisses that prompt; a save that fails partway through a quit can leave the remembered list from that quit; never-saved documents and the web build have no paths to reopen."
+
 [[feature]]
 id = "core.usage-rights-preserve"
 title = "Preserve usage-rights (UR3) signatures from Reader-extended files"

From 79eadc2aa869e10335110d1ff2f28e68a99144cb Mon Sep 17 00:00:00 2001
From: Dimitar <bulgaria_mitko@yahoo.com>
Date: Fri, 9 Oct 2026 16:16:16 +0300
Subject: [PATCH 060/149] =?UTF-8?q?M14:=20Bulgarian=20(=D0=91=D1=8A=D0=BB?=
 =?UTF-8?q?=D0=B3=D0=B0=D1=80=D1=81=D0=BA=D0=B8)=20interface=20language=20?=
 =?UTF-8?q?(#466)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A complete clean-room catalog (2,035 entries: every command, All tools
label and tl! literal), registered as `bg` with one/other plurals so Auto
picks it on Bulgarian systems. Tests mirror the Russian ones (registration,
plurals, persistence, command and literal coverage), and Bulgarian joins
the Latin/Cyrillic font-coverage test.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.md                 |    3 +-
 ATTRIBUTION.toml               |   11 +
 crates/ui-egui/src/i18n/bg.tsv | 2044 ++++++++++++++++++++++++++++++++
 crates/ui-egui/src/i18n/mod.rs |  107 +-
 crates/ui-egui/tests/fonts.rs  |    3 +-
 docs/localization.md           |   10 +-
 6 files changed, 2170 insertions(+), 8 deletions(-)
 create mode 100644 crates/ui-egui/src/i18n/bg.tsv

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 0f56341b..cb810db2 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (251)
+## In this repository (252)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -16,6 +16,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/fr.tsv` | French interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ru.tsv` | Russian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/bg.tsv` | Bulgarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ja.tsv` | Japanese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 098c5989..e11b6547 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -98,6 +98,17 @@ kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
 sha256 = "259f795a3cdc032aa670693d2ebff010c5dd3bcf57dda11548d5bd46e78969b8"
 
+[[asset]]
+path = "crates/ui-egui/src/i18n/bg.tsv"
+title = "Bulgarian interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "121c3881bf6ba69682ca6acae32303e3bf425479a8c2cb3e875c6598f5ffef7d"
+
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
 title = "Japanese interface translation catalog"
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
new file mode 100644
index 00000000..08d8775b
--- /dev/null
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -0,0 +1,2044 @@
+# Bulgarian (bg) catalog. Format: see the header of ja.tsv
+# (context <TAB> source <TAB> translation; @id, @plural and other contexts; escapes \n \t \\).
+# Plural forms (see `plural_one_other` in i18n/mod.rs): one (1) | other.
+# Clean-room: every entry was written from the plain meaning of the English label using ordinary
+# Bulgarian computing vocabulary. No proprietary localisation resource, string table or product UI
+# (Acrobat's included) was consulted or copied; add entries the same way.
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
+# the trailing "…" of dialog commands is kept.
+
+	About	За програмата
+	Contributors	Сътрудници
+	Models	Модели
+	Show	Покажи
+	Username	Потребителско име
+	Display name	Показвано име
+	Real name	Истинско име
+	Sort	Сортиране
+	Name (A–Z)	Име (А–Я)
+	Merged PRs	Обединени PR
+	PRs	PR
+	Commits	Къмитове
+	Lines added	Добавени редове
+	Lines deleted	Изтрити редове
+	Line delta	Разлика в редовете
+	Binary assets added	Добавени двоични ресурси
+	Binary assets removed	Премахнати двоични ресурси
+	First commit	Първи къмит
+	Last commit	Последен къмит
+	+LOC	+LOC
+	−LOC	−LOC
+	ΔLOC	ΔLOC
+	+Bin	+Bin
+	−Bin	−Bin
+	First	Първи
+	Last	Последен
+	Reverse the order	Обърни реда
+	Grab bag	Смесица
+	Table	Таблица
+	{n} contributors · {c} commits	{n} сътрудници · {c} къмита
+	No contributor data was built into this copy.	В това копие няма вградени данни за сътрудниците.
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: {prs} PR, {commits} къмита, +{added} / −{deleted} реда (Δ {delta}), +{bin_added} / −{bin_deleted} двоични ресурса, {first} – {last}
+	No model credits were built into this copy.	В това копие няма вградени данни за моделите.
+	Company	Компания
+	Model	Модел
+	% of all commits	% от всички къмитове
+	Lines +/−	Редове +/−
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Продължете само ако имате доверие на този документ. Адресът може да пренася информация от документа, например въведеното във формуляра му.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Отпечатайте едностранно. Запазете реда на листовете, изрежете по маркировките, след което подредете купчините отляво надясно и отгоре надолу.
+	Menu	Меню
+	File	Файл
+	Edit	Редактиране
+	Pages	Страници
+	View	Изглед
+	Help	Помощ
+	Preferences	Настройки
+	Preferences…	Настройки…
+	Interface language	Език на интерфейса
+	Identity	Самоличност
+	Name on new comments	Име в новите коментари
+	Open…	Отвори…
+	Open Recent	Последно отваряни
+	Pin folder to Home…	Закачи папка в Начало…
+	Folders	Папки
+	Pin a folder…	Закачи папка…
+	Pin a folder to Home	Закачи папка в Начало
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Закачете папка, за да виждате тук най-новите PDF файлове в нея – например папката, в която записва скенерът ви или синхронизирано облачно хранилище.
+	Unpin	Откачи
+	Unpin {folder}	Откачи {folder}
+	Looking for PDFs…	Търсене на PDF файлове…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Тази папка в момента не е достъпна. Може да е преместена или дискът, на който е, или облачната синхронизация да не са на линия.
+	No PDFs in this folder yet	В тази папка все още няма PDF файлове
+	Show less	Покажи по-малко
+	Show {n} more	Покажи още {n}
+	The newest {n} of {total} PDFs	Най-новите {n} от {total} PDF файла
+	Pinned folders need the desktop app	Закачените папки изискват настолното приложение
+	Choose a folder on this computer to pin	Изберете папка на този компютър, която да закачите
+	{folder} is already pinned to Home	{folder} вече е закачена в Начало
+	You can pin up to {n} folders. Unpin one first.	Можете да закачите до {n} папки. Първо откачете една.
+	Pinned {folder} to Home	{folder} е закачена в Начало
+	No recent files	Няма последни файлове
+	Open	Отвори
+	Open file	Отвори файл
+	Home	Начало
+	New blank PDF	Нов празен PDF
+	Create PDF from file…	Създай PDF от файл…
+	Create PDF from images…	Създай PDF от изображения…
+	Create PDF from multiple files…	Създай PDF от няколко файла…
+	Create PDF from clipboard	Създай PDF от клипборда
+	Combine files…	Обедини файлове…
+	Save	Запиши
+	Save as…	Запиши като…
+	Close file	Затвори файла
+	Close all	Затвори всички
+	Revert	Върни последно записаното
+	Print…	Отпечатай…
+	Document properties…	Свойства на документа…
+	Undo	Отмени
+	Redo	Повтори
+	Find…	Намери…
+	Advanced search…	Разширено търсене…
+	Copy pages	Копирай страниците
+	Cut pages	Изрежи страниците
+	Paste pages	Постави страниците
+	Fit visible	Побери видимото
+	Fit to height	Побери по височина
+	Marquee zoom	Мащабиране с рамка
+	Zoom in	Увеличи
+	Zoom out	Намали
+	Rotate view clockwise	Завърти изгледа по часовниковата стрелка
+	Rotate view counterclockwise	Завърти изгледа обратно на часовниковата стрелка
+	Take a snapshot	Направи моментна снимка
+	Full screen mode	Цял екран
+	Read mode	Режим на четене
+	Switch light / dark theme	Превключи светла / тъмна тема
+	Comments panel	Панел с коментари
+	Form fields panel	Панел с полета на формуляра
+	Signatures panel	Панел с подписи
+	Clear form	Изчисти формуляра
+	Find tools and commands…	Намери инструменти и команди…
+	Find tools and commands	Намери инструменти и команди
+	Zoom	Мащаб
+	Actual size	Действителен размер
+	Zoom to page level	Мащаб до ниво страница
+	Fit to width	Побери по ширина
+	Display theme	Тема на показване
+	Side panels	Странични панели
+	Enable Acrobat JavaScript	Включи Acrobat JavaScript
+	OK	OK
+	Cancel	Отказ
+	Close	Затвори
+	Don't save	Не записвай
+	Delete	Изтрий
+	Apply	Приложи
+	Run	Изпълни
+	Clear	Изчисти
+	Sanitize	Почисти
+	Mark all	Маркирай всички
+	Save changes to “{name}” before closing?	Да се запишат ли промените в „{name}“ преди затваряне?
+	Your changes will be lost if you don't save them.	Промените ви ще бъдат загубени, ако не ги запишете.
+	Password required	Изисква се парола
+	“{name}” is protected. Enter a password to open it.	„{name}“ е защитен. Въведете парола, за да го отворите.
+	Password	Парола
+	Incorrect password. Try again.	Грешна парола. Опитайте отново.
+	Export a PDF	Експортирай PDF
+	Fill & Sign	Попълни и подпиши
+	Edit a PDF	Редактирай PDF
+	Create a PDF	Създай PDF
+	Combine files	Обедини файлове
+	Add comments	Добави коментари
+	Scan & OCR	Сканиране и OCR
+	Protect a PDF	Защити PDF
+	Redact a PDF	Заличи в PDF
+	Compress a PDF	Компресирай PDF
+	Add a stamp	Добави печат
+	Use a certificate	Използвай сертификат
+	Use print production	Подготовка за печат
+	Measure objects	Измерване на обекти
+	Compare files	Сравни файлове
+	Use guided actions	Използвай напътствани действия
+	Prepare for accessibility	Подготви за достъпност
+	Apply PDF standards	Приложи PDF стандарти
+	Add search index	Добави индекс за търсене
+	Use JavaScript	Използвай JavaScript
+	AI assistant	AI асистент
+	Export to	Експортирай в
+	Fill	Попълни
+	Modify page	Промени страница
+	Add content	Добави съдържание
+	Create from	Създай от
+	Combine	Обедини
+	Page options	Опции на страницата
+	More	Още
+	Markup	Маркировка
+	Drawing	Рисуване
+	Review	Преглед
+	Recognize text	Разпознай текст
+	Recognize Text	Разпознаване на текст
+	Delete selected fields	Изтрий избраните полета
+	Password protection will be applied when you save	Защитата с парола ще бъде приложена при записване
+	Saved the print-ready PDF to {path}	Готовият за печат PDF е записан в {path}
+	Could not save: {e}	Неуспешно записване: {e}
+	Earlier in tab order	По-напред в реда на табулация
+	Later in tab order	По-назад в реда на табулация
+	From:	От:
+	To:	До:
+	High Resolution	Висока резолюция
+	Print	Печат
+	Save as PDF/A	Запиши като PDF/A
+	Verify to see what the document needs.	Проверете, за да видите от какво се нуждае документът.
+	Set Page Boxes	Задай полета на страницата
+	Signature panel	Панел с подписи
+	{month} {day}, {y}	{day} {month} {y} г.
+	The document's security settings don't allow filling in form fields	Настройките за защита на документа не позволяват попълване на полетата на формуляра
+	{name} is read-only	{name} е само за четене
+	{name} has no action	{name} няма действие
+	Previous month	Предишен месец
+	Next month	Следващ месец
+	January	Януари
+	February	Февруари
+	March	Март
+	April	Април
+	May	Май
+	June	Юни
+	July	Юли
+	August	Август
+	September	Септември
+	October	Октомври
+	November	Ноември
+	December	Декември
+	Done	Готово
+	This certificate is in your list of trusted certificates.	Този сертификат е в списъка ви с надеждни сертификати.
+	This certificate is trusted through a certificate above it in the chain.	Този сертификат е надежден чрез сертификат над него във веригата.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Този сертификат не е надежден. Подписите, направени с него, показват неизвестна самоличност.
+	Add to Trusted Certificates	Добави към надеждните сертификати
+	Export…	Експортирай…
+	PDF Optimizer	PDF оптимизатор
+	Discard Objects	Премахване на обекти
+	Discard User Data	Премахване на потребителски данни
+	Clean Up	Почистване
+	Color Images	Цветни изображения
+	Grayscale Images	Изображения в сива скала
+	Bicubic downsampling to	Бикубично понижаване на резолюцията до
+	for images above	за изображения над
+	Compression	Компресия
+	ZIP	ZIP
+	Retain existing	Запази съществуващата
+	Minimum	Минимално
+	Low	Ниско
+	High	Високо
+	Maximum	Максимално
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Всяко изображение се измерва там, където страниците го изобразяват; изображението се заменя само ако резултатът е по-малък.
+	Discard all links, actions and JavaScript	Премахни всички връзки, действия и JavaScript
+	Discard alternate images	Премахни алтернативните изображения
+	Discard embedded page thumbnails	Премахни вградените миниатюри на страниците
+	Discard document tags	Премахни таговете на документа
+	Discard embedded print settings	Премахни вградените настройки за печат
+	Discard bookmarks	Премахни отметките
+	Discard hidden layer content	Премахни съдържанието на скритите слоеве
+	Discard all comments, forms and multimedia	Премахни всички коментари, формуляри и мултимедия
+	Discard document information and metadata	Премахни информацията за документа и метаданните
+	Discard all object data (file attachments)	Премахни всички данни на обекти (прикачени файлове)
+	Discard private data of other applications	Премахни частните данни на други приложения
+	Discard hidden text	Премахни скрития текст
+	Use Flate to encode streams that are not encoded	Кодирай с Flate некодираните потоци
+	Remove invalid links and bookmarks	Премахни невалидните връзки и отметки
+	Remove unreferenced named destinations	Премахни неизползваните именувани местоназначения
+	Compress document structure (object streams)	Компресирай структурата на документа (потоци от обекти)
+	Remove unused objects and merge identical ones	Премахни неизползваните обекти и обедини еднаквите
+	Audit space usage…	Анализ на използваното място…
+	Space Audit	Анализ на мястото
+	Bytes	Байтове
+	Content Streams	Потоци на съдържанието
+	X Object Forms	Форми X Object
+	Structure Info	Информация за структурата
+	Thumbnails	Миниатюри
+	Named Destinations	Именувани местоназначения
+	Color Spaces	Цветови пространства
+	Shadings	Преливания
+	Patterns (graphics objects)	Шарки (графични обекти)
+	Extended Graphics States	Разширени графични състояния
+	Embedded Files	Вградени файлове
+	Document Overhead	Служебни данни на документа
+	Total	Общо
+	Text Field Properties	Свойства на текстово поле
+	Check Box Properties	Свойства на отметка
+	Radio Button Properties	Свойства на радиобутон
+	Dropdown Properties	Свойства на падащ списък
+	List Box Properties	Свойства на списъчно поле
+	Button Properties	Свойства на бутон
+	Digital Signature Properties	Свойства на цифров подпис
+	Position	Позиция
+	Options	Опции
+	Validate	Проверка
+	Calculate	Изчисляване
+	Actions	Действия
+	This field is locked. Unlock it to change its properties.	Това поле е заключено. Отключете го, за да промените свойствата му.
+	Tooltip:	Подсказка:
+	Common Properties	Общи свойства
+	Read Only	Само за четене
+	Required	Задължително
+	Font Size:	Размер на шрифта:
+	Auto	Автоматично
+	Text Color:	Цвят на текста:
+	Borders and Colors	Рамки и цветове
+	Border Color:	Цвят на рамката:
+	Fill Color:	Цвят на запълване:
+	No color	Без цвят
+	Beveled	Скосена
+	Left:	Ляво:
+	Bottom:	Долу:
+	Width:	Ширина:
+	Height:	Височина:
+	Points from the page's bottom-left corner.	Точки от долния ляв ъгъл на страницата.
+	Alignment:	Подравняване:
+	Default Value:	Стойност по подразбиране:
+	Multi-line	Многоредово
+	Scroll long text	Превъртай дълъг текст
+	Allow Rich Text Formatting	Разреши форматиране на текста
+	Limit of	Ограничение от
+	characters	знака
+	Field is used for file selection	Полето се използва за избор на файл
+	Check spelling	Проверка на правописа
+	Comb of	Разделено на
+	Export Value: {on}	Стойност за експорт: {on}
+	Check box is checked by default	Отметката е поставена по подразбиране
+	Button is checked by default	Бутонът е избран по подразбиране
+	Buttons with the same name and value are selected in unison	Бутоните с еднакви име и стойност се избират едновременно
+	Item:	Елемент:
+	Item List	Списък с елементи
+	Up	Нагоре
+	Delete {o}	Изтрий {o}
+	Add the choices people pick from.	Добавете възможностите, от които потребителите избират.
+	Default:	По подразбиране:
+	(none)	(няма)
+	Sort items	Сортирай елементите
+	Allow user to enter custom text	Разреши на потребителя да въвежда собствен текст
+	Multiple selection	Множествен избор
+	Commit selected value immediately	Приеми избраната стойност веднага
+	Number	Число
+	Percentage	Процент
+	Time	Час
+	Special	Специален
+	Select format category:	Изберете категория формат:
+	The value is shown as typed.	Стойността се показва както е въведена.
+	Decimal places:	Знаци след десетичната запетая:
+	Separator style:	Стил на разделителя:
+	Currency symbol:	Символ за валута:
+	Before the number	Пред числото
+	Negative number style:	Стил на отрицателните числа:
+	Format:	Формат:
+	Custom:	Персонализиран:
+	Zip Code	Пощенски код
+	Zip Code + 4	Пощенски код + 4
+	Phone Number	Телефонен номер
+	Social Security Number	Номер на социално осигуряване (САЩ)
+	Arbitrary Mask	Произволна маска
+	Mask:	Маска:
+	9 digit, A letter, O letter or digit, X any character	9 цифра, A буква, O буква или цифра, X произволен знак
+	Example: {sample}	Пример: {sample}
+	Field value is not validated	Стойността на полето не се проверява
+	Field value is in range:	Стойността на полето е в диапазона:
+	Add an Action	Добави действие
+	Select Trigger:	Изберете задействане:
+	Mouse Up	Отпускане на бутона на мишката
+	Mouse Down	Натискане на бутона на мишката
+	Mouse Enter	Влизане на мишката
+	Mouse Exit	Излизане на мишката
+	On Focus	При фокусиране
+	On Blur	При загуба на фокус
+	Select Action:	Изберете действие:
+	Open a web link	Отвори уеб връзка
+	Reset a form	Нулирай формуляр
+	Execute a menu item	Изпълни елемент от менюто
+	Show a field	Покажи поле
+	Hide a field	Скрий поле
+	Submit a form	Изпрати формуляр
+	Fields to reset (comma-separated; empty: all)	Полета за нулиране (разделени със запетая; празно: всички)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage или LastPage
+	Field names (comma-separated)	Имена на полета (разделени със запетая)
+	URL to submit to	URL за изпращане
+	Script:	Скрипт:
+	Value:	Стойност:
+	No actions	Няма действия
+	Value is not calculated	Стойността не се изчислява
+	Value is the	Стойността е
+	sum (+)	сумата (+)
+	product (x)	произведението (x)
+	average	средното
+	minimum	минимума
+	maximum	максимума
+	of the following fields:	на следните полета:
+	Simplified field notation:	Опростен запис с полета:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Имена на полета с + - * / и скоби; поставете \\ пред интервалите в имената.
+	Format text	Форматирай текст
+	Bold	Удебелен
+	Italic	Курсив
+	Align left	Подравни вляво
+	Centre	Центрирай
+	Align right	Подравни вдясно
+	Justify	Двустранно подравняване
+	Standard fonts; text outside Windows-1252 isn't supported yet.	Стандартни шрифтове; текст извън Windows-1252 все още не се поддържа.
+	Edit image	Редактирай изображение
+	Rotate counterclockwise	Завърти обратно на часовниковата стрелка
+	Rotate clockwise	Завърти по часовниковата стрелка
+	Flip horizontal	Обърни хоризонтално
+	Flip vertical	Обърни вертикално
+	Replace image	Замени изображението
+	Crop (% trimmed from each side)	Изрязване (% отрязани от всяка страна)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Щракнете върху страницата, за да добавите текст; всяко щракване създава ново поле, а ✓ завършва. Плъзнете елементите, за да ги преместите, плъзнете ъгъл, за да промените размера, щракнете двукратно върху текст, за да го редактирате.
+	Choose an image	Изберете изображение
+	Export to Image	Експортиране като изображение
+	Export to Text	Експортиране като текст
+	Export All Images	Експортиране на всички изображения
+	Resolution	Резолюция
+	Format	Формат
+	Quality	Качество
+	One {f} file per page, named after the document.	По един {f} файл на страница, именуван по документа.
+	Exclude images smaller than	Изключи изображения, по-малки от
+	No limit	Без ограничение
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Всяко изображение веднъж, именувано по документа и страницата. JPEG изображенията се записват непроменени, а останалите – като PNG.
+	Plain text in reading order; pages are separated by form feeds.	Обикновен текст в реда на четене; страниците се разделят със знаци за нова страница.
+	Create {what}	Създай {what}
+	initials	инициали
+	signature	подпис
+	Create Custom Stamp	Създаване на персонализиран печат
+	From {file}	От {file}
+	Category:	Категория:
+	e.g. My stamps	напр. Моите печати
+	Name:	Име:
+	Custom	Персонализиран
+	Delete stamp	Изтрий печата
+	Create custom stamp…	Създай персонализиран печат…
+	From a PDF page or an image	От страница на PDF или изображение
+	Line spacing	Междуредие
+	Character spacing	Разредка между знаците
+	Horizontal scale	Хоризонтален мащаб
+	Rotate Clockwise	Завърти по часовниковата стрелка
+	Rotate Counterclockwise	Завърти обратно на часовниковата стрелка
+	Flip Horizontal	Обърни хоризонтално
+	Flip Vertical	Обърни вертикално
+	Replace Image…	Замени изображението…
+	Save Image As…	Запиши изображението като…
+	Check for updates	Провери за актуализации
+	No check has run yet.	Още не е извършвана проверка.
+	Checking for a newer version…	Проверка за по-нова версия…
+	PdfCraft {v} is available.	Налична е PdfCraft {v}.
+	You have version {c}. Download the new version from its release page.	Имате версия {c}. Изтеглете новата версия от страницата на изданието.
+	PdfCraft {c} is up to date.	PdfCraft {c} е актуална.
+	Couldn't check for updates: {e}	Неуспешна проверка за актуализации: {e}
+	You have version {c}. All releases are listed at {page}.	Имате версия {c}. Всички издания са изброени на {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Запитва GitHub за най-новото издание. Нищо не се изтегля и не се инсталира автоматично.
+	Download	Изтегли
+	Later	По-късно
+	none	няма
+	Declared conformance: {shown}	Декларирано съответствие: {shown}
+	Output intent: {list}	Изходно предназначение: {list}
+	Conformance level:	Ниво на съответствие:
+	No problems found: the document conforms to {level}.	Не са открити проблеми: документът съответства на {level}.
+	 (page {p})	 (страница {p})
+	  · not fixable here	  · не може да се поправи тук
+	Verify	Провери
+	Box	Поле
+	Units	Мерни единици
+	Set to zero	Задай нула
+	Current page ({n})	Текуща страница ({n})
+	Subset	Подмножество
+	Update	Актуализирай
+	Add	Добави
+	{verb} Header and Footer	{verb} горен и долен колонтитул
+	{verb} Watermark	{verb} воден знак
+	{verb} Background	{verb} фон
+	Left Header Text	Текст на горния колонтитул вляво
+	Center Header Text	Текст на горния колонтитул в центъра
+	Right Header Text	Текст на горния колонтитул вдясно
+	Left Footer Text	Текст на долния колонтитул вляво
+	Center Footer Text	Текст на долния колонтитул в центъра
+	Right Footer Text	Текст на долния колонтитул вдясно
+	Insert Page Number	Вмъкни номер на страница
+	Insert Date	Вмъкни дата
+	Start page number	Начален номер на страница
+	Source	Източник
+	Fit to page	Побери в страницата
+	Rotation	Завъртане
+	Appear behind page	Под съдържанието на страницата
+	Appear on top of page	Над съдържанието на страницата
+	From colour	От цвят
+	Page Range Options	Опции за диапазон на страниците
+	Preview: page {p} of {n}	Преглед: страница {p} от {n}
+	Applies to 1 page	Прилага се към 1 страница
+	Applies to {n} pages	Прилага се към {n} страници
+	Replaces the existing one on those pages.	Заменя съществуващия на тези страници.
+	PDF or image	PDF или изображение
+	No file chosen	Не е избран файл
+	Page number	Номер на страница
+	Scale relative to target page	Мащабирай спрямо целевата страница
+	Link Properties	Свойства на връзката
+	Create Link	Създай връзка
+	Link Appearance	Външен вид на връзката
+	Link Type:	Тип на връзката:
+	Visible Rectangle	Видим правоъгълник
+	Invisible Rectangle	Невидим правоъгълник
+	Highlight Style:	Стил на маркиране:
+	Invert	Инвертиране
+	Outline	Контур
+	Inset	Вдлъбнато
+	Line Thickness:	Дебелина на линията:
+	Thin	Тънка
+	Thick	Дебела
+	Line Style:	Стил на линията:
+	Solid	Плътна
+	Dashed	Пунктирна
+	Color:	Цвят:
+	Link Action	Действие на връзката
+	Open a web page	Отвори уеб страница
+	Go to a page view	Отиди на изглед на страница
+	Type the web address.	Въведете уеб адреса.
+	This document has no signatures.	Този документ няма подписи.
+	The Keychain's digital IDs couldn't be listed: {e}	Цифровите идентификатори от Keychain не можаха да бъдат изброени: {e}
+	Signed and saved to {path}	Подписано и записано в {path}
+	Couldn't open revision {n}: {e}	Неуспешно отваряне на редакция {n}: {e}
+	Couldn't open the signed version: {e}	Неуспешно отваряне на подписаната версия: {e}
+	Sign with a Digital ID	Подпиши с цифров идентификатор
+	Choose the digital ID that you want to use for signing:	Изберете цифровия идентификатор, с който искате да подпишете:
+	Keychain  ·  	Keychain  ·  
+	Windows store  ·  	Хранилище на Windows  ·  
+	Issued by: 	Издаден от: 
+	, Expires: 	, валиден до: 
+	No digital IDs yet.	Все още няма цифрови идентификатори.
+	Configure New Digital ID	Конфигурирай нов цифров идентификатор
+	Continue	Продължи
+	Configure a Digital ID for Signing	Конфигуриране на цифров идентификатор за подписване
+	Use a Digital ID from a file	Използвай цифров идентификатор от файл
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Създай нов цифров идентификатор (самоподписан, записан във файл, защитен с парола)
+	Name	Име
+	Organizational Unit	Организационна единица
+	Organization Name	Име на организацията
+	Email Address	Имейл адрес
+	Country/Region	Държава/регион
+	Key Algorithm	Алгоритъм на ключа
+	Confirm Password	Потвърдете паролата
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Валиден 5 години, за цифрови подписи. Самоподписаните идентификатори обикновено не се ползват с доверие от другите.
+	File (.p12, .pfx)	Файл (.p12, .pfx)
+	Digital ID	Цифров идентификатор
+	Browse…	Преглед…
+	{verb} as "{name}"	{verb} като „{name}“
+	Certify	Сертифицирай
+	The signature will be invisible.	Подписът ще бъде невидим.
+	Distinguished name	Отличително име
+	Labels	Етикети
+	Permitted actions after certifying	Разрешени действия след сертифициране
+	No changes allowed	Не се разрешават промени
+	Annotations, form fill-in, and digital signatures	Анотации, попълване на формуляри и цифрови подписи
+	Form fill-in and digital signatures	Попълване на формуляри и цифрови подписи
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	Ключът е в macOS Keychain, който може да поиска разрешение PdfCraft да го използва.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	Ключът е в хранилището за сертификати на Windows, което може да поиска разрешение PdfCraft да го използва.
+	Digital ID password	Парола за цифровия идентификатор
+	Back	Назад
+	Validate all	Провери всички
+	Sign this field…	Подпиши това поле…
+	Signature is valid:	Подписът е валиден:
+	Signature validity is UNKNOWN:	Валидността на подписа е НЕИЗВЕСТНА:
+	Signature is INVALID:	Подписът е НЕВАЛИДЕН:
+	Signature Details	Подробности за подписа
+	Reason	Причина
+	Signing time	Час на подписване
+	Algorithm	Алгоритъм
+	Signer	Подписал
+	Issued by	Издаден от
+	Valid	Валиден
+	Field	Поле
+	Field: {field} on page {p}	Поле: {field} на страница {p}
+	Add to trusted certificates	Добави към надеждните сертификати
+	View signed version	Покажи подписаната версия
+	Show certificate…	Покажи сертификата…
+	Export certificate…	Експортирай сертификата…
+	Certificate Viewer	Преглед на сертификати
+	This dialog shows the details of a certificate and its chain.	Този диалог показва подробностите за сертификат и неговата верига.
+	Trust	Доверие
+	Issued to	Издаден на
+	Valid from	Валиден от
+	Valid to	Валиден до
+	Intended usage	Предназначение
+	Any	Всяко
+	Version	Версия
+	Serial number	Сериен номер
+	Issuer	Издател
+	Validity starts	Начало на валидността
+	Validity ends	Край на валидността
+	Public key	Публичен ключ
+	Key usage	Употреба на ключа
+	Not present	Няма
+	Self-signed	Самоподписан
+	Edit Action	Редактиране на действие
+	New Action	Ново действие
+	Action name:	Име на действието:
+	Description:	Описание:
+	Steps	Стъпки
+	Add the steps this action runs, in order.	Добавете стъпките, които това действие изпълнява, по ред.
+	Add Step	Добави стъпка
+	An action with this name already exists.	Вече съществува действие с това име.
+	New Action…	Ново действие…
+	Edit…	Редактирай…
+	Add watermark	Добави воден знак
+	Add header	Добави горен колонтитул
+	Add footer	Добави долен колонтитул
+	Set document title	Задай заглавие на документа
+	Run a JavaScript	Изпълни JavaScript
+	Prepare for Distribution	Подготовка за разпространение
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Премахва скритата информация и сплесква коментарите и полетата на формуляри, така че получателите да виждат само страниците.
+	Optimize Scanned Documents	Оптимизиране на сканирани документи
+	Make scans searchable, then make them smaller.	Прави сканираните документи търсими, след което ги смалява.
+	Add Page Numbers	Добавяне на номера на страници
+	Number every page in the footer.	Номерира всяка страница в долния колонтитул.
+	Mark as Confidential	Маркиране като поверително
+	A diagonal CONFIDENTIAL watermark on every page.	Диагонален воден знак CONFIDENTIAL на всяка страница.
+	Sanitize Documents	Почистване на документи
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Премахва скритата информация, метаданните, скриптовете и вграденото съдържание и презаписва файловете.
+	Type text	Въведете текст
+	Text to insert	Текст за вмъкване
+	Replacement text	Заместващ текст
+	Edit text…	Редактирай текста…
+	Add a sticky note here	Добави бележка тук
+	{kind} Properties	Свойства: {kind}
+	Appearance	Външен вид
+	General	Общи
+	Review History	История на прегледа
+	This comment's appearance can't be changed yet.	Външният вид на този коментар все още не може да се променя.
+	Icon	Икона
+	Thickness	Дебелина
+	Modified	Променено
+	No status has been set.	Не е зададено състояние.
+	Compare Files	Сравняване на файлове
+	Old file:	Стар файл:
+	Open the older version first	Първо отворете по-старата версия
+	New file:	Нов файл:
+	Text is compared word by word; the differences are shown on the new file.	Текстът се сравнява дума по дума; разликите се показват в новия файл.
+	Compare this file with an older version: Compare files… in All tools.	Сравнете този файл с по-стара версия: „Сравни файлове…“ във „Всички инструменти“.
+	No differences in the text.	Няма разлики в текста.
+	{n} {kind}	{n} {kind}
+	Inserted	Вмъкнато
+	Deleted	Изтрито
+	Replaced	Заменено
+	Visual	Визуално
+	Mark as comments	Маркирай като коментари
+	Report…	Отчет…
+	{kind} · page {p}	{kind} · страница {p}
+	Set Alternate Text	Задаване на алтернативен текст
+	This document has no tagged figures.	Този документ няма етикетирани фигури.
+	 on page {p}	 на страница {p}
+	Figure {i} of {n}{page}	Фигура {i} от {n}{page}
+	No preview	Няма преглед
+	Alternate text	Алтернативен текст
+	Describe the figure	Опишете фигурата
+	Decorative figure	Декоративна фигура
+	Previous figure	Предишна фигура
+	Next figure	Следваща фигура
+	Save & Close	Запиши и затвори
+	Accessibility Checker Options	Опции на проверката за достъпност
+	Report Options	Опции на отчета
+	Create accessibility report	Създай отчет за достъпност
+	Page Range	Диапазон на страниците
+	All pages in document	Всички страници в документа
+	Checking Options ({on} of 32 in all categories)	Опции за проверка ({on} от 32 във всички категории)
+	Show this dialog when the Checker starts	Показвай този диалог при стартиране на проверката
+	Select All	Избери всички
+	Clear All	Изчисти всички
+	Start Checking	Започни проверката
+	This document hasn't been checked yet.	Този документ все още не е проверен.
+	No issues found	Не са открити проблеми
+	1 issue	1 проблем
+	{n} issues	{n} проблема
+	{label} (1 issue)	{label} (1 проблем)
+	{label} ({n} issues)	{label} ({n} проблема)
+	Check again	Провери отново
+	Report	Отчет
+	Show the accessibility report	Покажи отчета за достъпност
+	Collapse	Свий
+	Expand	Разгъни
+	{rule} - {status}	{rule} - {status}
+	Passed	Успешно
+	Failed	Неуспешно
+	Needs manual check	Нужна е ръчна проверка
+	Skipped	Пропуснато
+	Fix	Поправи
+	Skip Rule	Пропусни правилото
+	Explain	Обясни
+	Check Again	Провери отново
+	Show Report	Покажи отчета
+	Options…	Опции…
+	Go to the page	Отиди на страницата
+	Page Content	Съдържание на страниците
+	Forms	Формуляри
+	Alternate Text	Алтернативен текст
+	Tables	Таблици
+	Lists	Списъци
+	Headings	Заглавия
+	Accessibility permission flag	Флаг за разрешение за достъпност
+	Accessibility permission flag is set	Флагът за разрешение за достъпност е зададен
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Настройките за защита трябва да позволяват на помощните технологии да четат съдържанието („Разреши достъп до текста за екранни четци“). Променете защитата на документа, за да го позволите.
+	Image-only PDF	PDF само с изображения
+	Document is not image-only PDF	Документът не е PDF само с изображения
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Страниците, които са само снимки на текст, не могат да се четат на глас или да се търсят. Разпознайте текста (OCR), за да добавите текстов слой.
+	Document is tagged PDF	Документът е етикетиран PDF
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	Етикетите придават на документа логическа структура, която помощните технологии следват. Етикетирайте документа („Автоматично етикетиране на PDF“).
+	Logical Reading Order	Логически ред на четене
+	Document structure provides a logical reading order	Структурата на документа осигурява логически ред на четене
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Проверете дали етикетите се четат в реда, в който би чел зрящ читател. Използвайте инструмента „Ред на четене“ или панела „Етикети“, за да го коригирате.
+	Primary language	Основен език
+	Text language is specified	Езикът на текста е зададен
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	Екранните четци избират гласа си според езика на документа. Задайте го в „Свойства на документа > Разширени > Език“.
+	Document title is showing in title bar	Заглавието на документа се показва в заглавната лента
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Прозорецът трябва да показва смислено заглавие вместо името на файла. Задайте заглавие и „Начален изглед > Показване: Заглавие на документа“.
+	Bookmarks are present in large documents	В големите документи има отметки
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	Документите с повече от 20 страници се нуждаят от отметки за навигация. Добавете отметки за основните раздели.
+	Color contrast	Цветови контраст
+	Document has appropriate color contrast	Документът има подходящ цветови контраст
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	Текстът трябва да контрастира достатъчно с фона си за хора с намалено зрение. Проверете цветовете на око или с инструмент за контраст.
+	Tagged content	Етикетирано съдържание
+	All page content is tagged	Цялото съдържание на страниците е етикетирано
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Всичко на страницата трябва да е етикетирано или маркирано като артефакт (украса, горни и долни колонтитули). Етикетирайте неетикетираното съдържание.
+	Tagged annotations	Етикетирани анотации
+	All annotations are tagged	Всички анотации са етикетирани
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Коментарите, връзките и полетата трябва да са в дървото на етикетите, за да бъдат обявявани. Етикетирайте анотациите.
+	Tab order	Ред на табулация
+	Tab order is consistent with structure order	Редът на табулация съответства на реда на структурата
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Страниците с връзки, коментари или полета трябва да се обхождат с Tab по реда на структурата. Поправката задава реда на табулация на всяка страница на „Използвай структурата на документа“.
+	Character encoding	Кодиране на знаците
+	Reliable character encoding is provided	Осигурено е надеждно кодиране на знаците
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	Шрифтовете трябва да съпоставят знаците си с Unicode, за да може текстът да се чете и копира. Поправете шрифтовете или създайте PDF файла наново.
+	Tagged multimedia	Етикетирана мултимедия
+	All multimedia objects are tagged	Всички мултимедийни обекти са етикетирани
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	Видеото, звукът и мултимедийното съдържание трябва да са етикетирани, за да бъдат обявявани. Етикетирайте мултимедийните анотации.
+	Screen flicker	Трептене на екрана
+	Page will not cause screen flicker	Страницата няма да предизвика трептене на екрана
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	Мигащата анимация може да предизвика пристъпи. Проверете скриптовете и мултимедията за трептене.
+	Scripts	Скриптове
+	No inaccessible scripts	Няма недостъпни скриптове
+	Timed responses	Времеви ограничения за отговор
+	Page does not require timed responses	Страницата не изисква отговор в ограничено време
+	People may need more time to respond. Check that nothing has a time limit.	Някои хора може да се нуждаят от повече време за отговор. Проверете дали нищо няма времево ограничение.
+	Navigation links	Навигационни връзки
+	Navigation links are not repetitive	Навигационните връзки не се повтарят
+	Repeated navigation links should be skippable. Check links that appear on every page.	Повтарящите се навигационни връзки трябва да могат да се пропускат. Проверете връзките, които се появяват на всяка страница.
+	Tagged form fields	Етикетирани полета на формуляри
+	All form fields are tagged	Всички полета на формуляри са етикетирани
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Полетата на формуляри трябва да са в дървото на етикетите (етикети Form), за да бъдат обявявани. Етикетирайте полетата на формуляра.
+	Field descriptions	Описания на полетата
+	All form fields have description	Всички полета на формуляри имат описание
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Всяко поле се нуждае от подсказка, която казва какво да се въведе. Добавете я в „Свойства на полето > Общи > Подсказка“.
+	Figures alternate text	Алтернативен текст на фигурите
+	Figures require alternate text	Фигурите изискват алтернативен текст
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	Изображенията се нуждаят от алтернативен текст, който ги описва, или трябва да са маркирани като декоративни. Добавете алтернативен текст към всяка фигура.
+	Nested alternate text	Вложен алтернативен текст
+	Alternate text that will never be read	Алтернативен текст, който никога няма да бъде прочетен
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Алтернативен текст в елемент, който вече има алтернативен текст, никога не се прочита. Премахнете вътрешния алтернативен текст.
+	Associated with content	Свързан със съдържание
+	Alternate text must be associated with some content	Алтернативният текст трябва да е свързан с някакво съдържание
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Алтернативен текст в елемент без съдържание на страницата никога не се достига. Премахнете го или свържете елемента със съдържание.
+	Hides annotation	Скрива анотация
+	Alternate text should not hide annotation	Алтернативният текст не трябва да скрива анотация
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Алтернативен текст в елемент, който съдържа връзка или поле, скрива тази анотация от помощните технологии. Преместете алтернативния текст.
+	Other elements alternate text	Алтернативен текст на други елементи
+	Other elements that require alternate text	Други елементи, които изискват алтернативен текст
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Формулите и подобни нетекстови елементи се нуждаят от алтернативен текст. Добавете им алтернативен текст.
+	Rows	Редове
+	TR must be a child of Table, THead, TBody, or TFoot	TR трябва да е дъщерен елемент на Table, THead, TBody или TFoot
+	Table cells belong in a row. Fix the table's tags.	Клетките на таблица трябва да са в ред. Поправете етикетите на таблицата.
+	Headers	Заглавни клетки
+	Tables should have headers	Таблиците трябва да имат заглавни клетки
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	Заглавните клетки (TH) казват на слушателите какво съдържа всяка колона или ред. Маркирайте заглавните клетки.
+	Regularity	Регулярност
+	Tables must contain the same number of columns in each row and rows in each column	Таблиците трябва да имат еднакъв брой колони във всеки ред и редове във всяка колона
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	Неравномерните таблици объркват навигацията по клетки. Дайте на всеки ред еднакъв брой клетки (като броите обединените).
+	Summary	Резюме
+	Tables must have a summary	Таблиците трябва да имат резюме
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Резюмето описва предназначението и оформлението на таблицата. Добавете атрибут Summary към всяка таблица.
+	List items	Елементи на списък
+	LI must be a child of L	LI трябва да е дъщерен елемент на L
+	List items belong in a list. Fix the list's tags.	Елементите на списък трябва да са в списък. Поправете етикетите на списъка.
+	Lbl and LBody	Lbl и LBody
+	Lbl and LBody must be children of LI	Lbl и LBody трябва да са дъщерни елементи на LI
+	List labels and bodies belong in a list item. Fix the list's tags.	Етикетите и телата на списъка трябва да са в елемент на списък. Поправете етикетите на списъка.
+	Appropriate nesting	Правилно влагане
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	Нивата на заглавията не трябва да се прескачат (H1, последвано от H3). Етикетирайте заглавията наново.
+	TH and TD	TH и TD
+	TH and TD must be children of TR	TH и TD трябва да са дъщерни елементи на TR
+	Mark Page Range	Маркирай диапазон от страници
+	Pages from	Страници от
+	Single word or phrase	Отделна дума или фраза
+	Text to find	Текст за търсене
+	Patterns	Шаблони
+	Phone Numbers	Телефонни номера
+	Email Addresses	Имейл адреси
+	Credit Cards	Кредитни карти
+	Social Security Numbers	Номера на социално осигуряване (САЩ)
+	Dates	Дати
+	Text in images isn't found; recognise text (OCR) first.	Текстът в изображения не се открива; първо разпознайте текста (OCR).
+	No matches.	Няма съвпадения.
+	{n} match(es) marked for redaction.	{n} съвпадение(я) маркирани за заличаване.
+	Redaction Tool Properties	Свойства на инструмента за заличаване
+	Redacted area fill colour:	Цвят на запълване на заличената област:
+	Use overlay text	Използвай текст върху заличаването
+	Custom text:	Потребителски текст:
+	Font:	Шрифт:
+	Font size:	Размер на шрифта:
+	Auto-size text to fit redaction region	Автоматично оразмеряване на текста според областта на заличаване
+	Font colour:	Цвят на шрифта:
+	Repeat overlay text	Повтаряй текста върху заличаването
+	Text alignment:	Подравняване на текста:
+	Center	Центрирано
+	Apply redactions	Приложи заличаванията
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	На път сте да приложите 1 маркировка за заличаване. Текстът, изображенията и чертежите под маркировките, както и коментарите и полетата на формуляри, които ги припокриват, се премахват завинаги.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	На път сте да приложите {n} маркировки за заличаване. Текстът, изображенията и чертежите под маркировките, както и коментарите и полетата на формуляри, които ги припокриват, се премахват завинаги.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	След това запишете документа: записването презаписва целия файл, така че в него да не остане следа от премахнатото съдържание.
+	Select the items to remove from this document.	Изберете елементите, които да се премахнат от документа.
+	Metadata	Метаданни
+	File attachments	Прикачени файлове
+	Comments and markups	Коментари и маркировки
+	Hidden text	Скрит текст
+	Hidden layers	Скрити слоеве
+	Links, actions and JavaScripts	Връзки, действия и JavaScript скриптове
+	Private data of other applications	Лични данни на други приложения
+	None found	Няма открити
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Полетата на формуляри се сплескват: стойностите им остават видими. Записването презаписва целия файл.
+	Remove	Премахни
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	Почистването премахва скритата информация от документа: метаданни, прикачени файлове, коментари, полета на формуляри (сплескани), скрит текст и слоеве, отметки, връзки, действия и скриптове, както и лични данни на приложения.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	След това запишете документа; записването презаписва целия файл, така че в него да не остане нищо от премахнатото.
+	Printer:	Принтер:
+	Save as PDF	Запиши като PDF
+	{name} (default)	{name} (по подразбиране)
+	Copies:	Копия:
+	Collate	Подреди по копия
+	Print in grayscale	Печат в сива скала
+	Two-sided:	Двустранен печат:
+	Off	Изключено
+	Flip on long edge	Обръщане по дългия ръб
+	Flip on short edge	Обръщане по късия ръб
+	Paper:	Хартия:
+	Pages to Print	Страници за печат
+	More options:	Още опции:
+	All pages in range	Всички страници в диапазона
+	Odd pages only	Само нечетните страници
+	Even pages only	Само четните страници
+	Reverse pages	Обърнат ред на страниците
+	Page Sizing & Handling	Размер и обработка на страниците
+	Size	Размер
+	Poster	Плакат
+	Multiple	Няколко
+	Booklet	Брошура
+	Fit	Побери
+	Shrink oversized pages	Смали прекалено големите страници
+	Custom scale:	Потребителски мащаб:
+	Tile scale:	Мащаб на плочките:
+	Overlap:	Застъпване:
+	Cut marks	Маркери за рязане
+	Pages per sheet:	Страници на лист:
+	Page order:	Ред на страниците:
+	Horizontal	Хоризонтално
+	Horizontal reversed	Хоризонтално обратно
+	Vertical	Вертикално
+	Vertical reversed	Вертикално обратно
+	Print page border	Отпечатай рамка на страницата
+	Auto-rotate pages	Автоматично завъртане на страниците
+	Booklet subset:	Част от брошурата:
+	Both sides	И двете страни
+	Front side only	Само лицева страна
+	Back side only	Само обратна страна
+	Binding:	Подвързване:
+	Left	Ляво
+	Right	Дясно
+	Orientation:	Ориентация:
+	Auto portrait/landscape	Автоматично портрет/пейзаж
+	Portrait	Портрет
+	Landscape	Пейзаж
+	Comments & Forms	Коментари и формуляри
+	Document	Документ
+	Document and markups	Документ и маркировки
+	Document and stamps	Документ и печати
+	Form fields only	Само полета на формуляр
+	Previous sheet	Предишен лист
+	Next sheet	Следващ лист
+	No sheets	Няма листове
+	Sheet {s} of {n}	Лист {s} от {n}
+	Removed 1 hidden item. Save to remove them from the file.	Премахнат е 1 скрит елемент. Запишете, за да ги премахнете от файла.
+	Removed {n} hidden items. Save to remove them from the file.	Премахнати са {n} скрити елемента. Запишете, за да ги премахнете от файла.
+	Document sanitized. Save to finish: saving rewrites the whole file.	Документът е почистен. Запишете, за да завършите: записването пренаписва целия файл.
+	Applied 1 redaction mark. Save to remove the content from the file.	Приложена е 1 маркировка за заличаване. Запишете, за да премахнете съдържанието от файла.
+	Applied {n} redaction marks. Save to remove the content from the file.	Приложени са {n} маркировки за заличаване. Запишете, за да премахнете съдържанието от файла.
+	JavaScript Console	Конзола за JavaScript
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript е изключен (Настройки > JavaScript).
+	Output appears here.	Резултатът се показва тук.
+	Document JavaScripts	JavaScript скриптове на документа
+	Script Name:	Име на скрипта:
+	This document has no document-level scripts.	Този документ няма скриптове на ниво документ.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Скриптовете се изпълняват в изолирана среда без достъп до файлове и мрежа. При изключен JavaScript стандартните функции на Acrobat за форматиране, проверка и изчисление продължават да работят.
+	No form fields were detected	Не са открити полета на формуляр
+	Detected 1 form field	Открито е 1 поле на формуляр
+	Detected {n} form fields	Открити са {n} полета на формуляр
+	{field}: {e}	{field}: {e}
+	Page navigation	Навигация по страниците
+	Previous view	Предишен изглед
+	Next view	Следващ изглед
+	Page display	Показване на страниците
+	Continuous scrolling	Непрекъснато превъртане
+	Two-page view	Изглед с две страници
+	Single page	Единична страница
+	Show cover page in two-page view	Показвай корицата в изглед с две страници
+	Use system setting	Използвай системната настройка
+	Light gray	Светлосиво
+	Dark gray	Тъмносиво
+	Current page	Текуща страница
+	Selected pages	Избрани страници
+	Document language	Език на документа
+	Output	Резултат
+	Searchable Image (Exact)	Изображение с възможност за търсене (точно)
+	Adds invisible text over each word; the page image is not changed	Добавя невидим текст върху всяка дума; изображението на страницата не се променя
+	Downsample to	Намали разделителната способност до
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Разпознаването на текст не е инсталирано: моделите му липсват (изпълнете `cargo xtask models` или задайте PRINTCRAFT_MODELS).
+	Settings	Настройки
+	Protect	Защита
+	Advanced options	Разширени опции
+	Redact	Заличаване
+	Optimize	Оптимизиране
+	Fields	Полета
+	Add form components	Добавяне на компоненти на формуляр
+	Stamps	Печати
+	Certificates	Сертификати
+	Print production	Печатна подготовка
+	Measure	Измерване
+	Compare	Сравняване
+	Actions list	Списък с действия
+	Accessibility	Достъпност
+	Standards	Стандарти
+	Index	Индекс
+	Bring your own model (off by default)	Използвайте собствен модел (изключено по подразбиране)
+	Single file	Един файл
+	Multiple files	Няколко файла
+	Images	Изображения
+	Clipboard	Клипборд
+	Blank page	Празна страница
+	Add files to combine	Добавете файлове за обединяване
+	Page grid	Мрежа от страници
+	Rotate	Завърти
+	Insert	Вмъкни
+	Replace	Замени
+	Split	Раздели
+	Set page boxes	Задай полета на страницата
+	Page labels	Етикети на страниците
+	Page transitions	Преходи между страниците
+	Sticky note	Бележка
+	Highlight text	Маркирай текст
+	Underline	Подчертаване
+	Strikethrough	Зачертаване
+	Squiggly underline	Вълнообразно подчертаване
+	Text box	Текстово поле
+	Draw freehand	Рисувай свободно
+	Rectangle	Правоъгълник
+	Oval	Овал
+	Line	Линия
+	Arrow	Стрелка
+	Cloud	Облак
+	Stamp	Печат
+	Comment list	Списък с коментари
+	Flatten comments	Сплескай коментарите
+	In this file	В този файл
+	In multiple files	В няколко файла
+	Enhance scanned file	Подобри сканиран файл
+	Correct recognized text	Коригирай разпознатия текст
+	Protect with password	Защити с парола
+	Remove hidden information	Премахни скритата информация
+	Encrypt with certificate	Шифровай със сертификат
+	Security properties	Свойства на защитата
+	Redact text and images	Заличи текст и изображения
+	Redact pages	Заличи страници
+	Find text and redact	Намери текст и заличи
+	Set properties	Задай свойства
+	Sanitize document	Почисти документа
+	Reduce file size	Намали размера на файла
+	Advanced optimization	Разширена оптимизация
+	Audit space usage	Анализ на използваното пространство
+	Field list	Списък с полета
+	Field properties	Свойства на полето
+	Tab order by rows	Ред на табулация по редове
+	Tab order by columns	Ред на табулация по колони
+	Flatten form fields	Сплескай полетата на формуляра
+	Import data	Импортирай данни
+	Export data	Експортирай данни
+	Text field	Текстово поле
+	Checkbox	Отметка (квадратче)
+	Radio button	Радиобутон
+	Drop-down list	Падащ списък
+	List box	Списъчно поле
+	Button	Бутон
+	Image field	Поле за изображение
+	Date field	Поле за дата
+	Digital signature	Цифров подпис
+	Stamp palette	Палитра с печати
+	Timestamp	Времеви печат
+	Validate all signatures	Провери всички подписи
+	Certify (visible signature)	Сертифицирай (видим подпис)
+	Certify (invisible signature)	Сертифицирай (невидим подпис)
+	Output preview	Преглед на изхода
+	Preflight	Предпечатна проверка
+	Convert colors	Преобразувай цветовете
+	Add printer marks	Добави печатарски маркери
+	Fix hairlines	Поправи тънките линии
+	Measuring tool	Инструмент за измерване
+	Geospatial location	Геопространствено местоположение
+	Select files to compare	Изберете файлове за сравняване
+	Action Wizard	Съветник за действия
+	Make accessible	Направи достъпен
+	Prepare for distribution	Подготви за разпространение
+	Optimize scanned documents	Оптимизирай сканирани документи
+	Archive documents	Архивирай документи
+	Automatically tag PDF	Автоматично тагване на PDF
+	Change reading options	Промени опциите за четене
+	Open accessibility report	Отвори отчета за достъпност
+	Add alternate text	Добави алтернативен текст
+	Fix reading order	Поправи реда на четене
+	Manage embedded index	Управлявай вградения индекс
+	Console	Конзола
+	Document actions	Действия на документа
+	Summarize	Обобщи
+	Ask about this document	Попитай за този документ
+	Translate	Преведи
+	Optional	По избор
+	Ready	Готово
+	Available	Налично
+	Planned · {m}	Планирано · {m}
+	Planned for milestone {m} — open to see what it will include	Планирано за етап {m} — отворете, за да видите какво ще включва
+	Optional: needs an AI provider you configure	По избор: изисква доставчик на ИИ, който сами конфигурирате
+	Coming in milestone {m}. Items marked Ready work today.	Очаква се в етап {m}. Елементите, отбелязани като готови, работят още днес.
+	1 mark	1 маркировка
+	{n} marks	{n} маркировки
+	Back to all tools	Назад към всички инструменти
+	Close panel	Затвори панела
+	View more	Покажи повече
+	View less	Покажи по-малко
+	Edit fields	Редактирай полетата
+	Preview	Преглед
+	Try the form as people filling it in will see it	Изпробвайте формуляра така, както ще го виждат попълващите го
+	Dynamic	Динамични
+	Sign Here	Подпишете тук
+	Standard Business	Стандартни бизнес
+	Choose a stamp, then click on the page to place it.	Изберете печат, след което щракнете върху страницата, за да го поставите.
+	Redact all	Заличи всичко
+	Clear all	Изчисти всичко
+	Add text	Добави текст
+	Checkmark	Отметка
+	Cross	Кръстче
+	Dot	Точка
+	Date	Дата
+	Signature	Подпис
+	Initials	Инициали
+	Rotate pages	Завърти страници
+	Insert pages	Вмъкни страници
+	Extract pages	Извлечи страници
+	Extract	Извлечи
+	Edit text & images	Редактирай текст и изображения
+	Text	Текст
+	Image	Изображение
+	Header and footer	Горен и долен колонтитул
+	Watermark	Воден знак
+	Link	Връзка
+	Bates numbering	Номериране на Бейтс
+	Background	Фон
+	Attach file	Прикачи файл
+	Export all images	Експортирай всички изображения
+	Image (PNG)	Изображение (PNG)
+	Text (plain)	Текст (обикновен)
+	HTML web page	HTML уеб страница
+	Rich Text Format (.rtf)	Rich Text Format (.rtf)
+	Comments	Коментари
+	Bookmarks	Отметки
+	Page thumbnails	Миниатюри на страниците
+	Form fields	Полета на формуляр
+	Layers	Слоеве
+	Attachments	Прикачени файлове
+	Signatures	Подписи
+	Accessibility Checker	Проверка на достъпността
+	Zoom out (⌘−)	Намали мащаба (⌘−)
+	Zoom in (⌘+)	Увеличи мащаба (⌘+)
+	Rotate view clockwise (⇧⌘+)	Завърти изгледа по часовниковата стрелка (⇧⌘+)
+	Toggle fit page / fit width	Превключи между „побери страницата“ и „побери по ширина“
+	Next page	Следваща страница
+	Previous page	Предишна страница
+	Current page — type a page number or label (such as iv) and press Enter	Текуща страница — въведете номер или етикет на страница (например iv) и натиснете Enter
+	Open a PDF (⌘O)	Отвори PDF файл (⌘O)
+	Dark gray theme	Тъмносива тема
+	Light theme	Светла тема
+	Print (⌘P)	Печат (⌘P)
+	Save (M4)	Запиши (M4)
+	Document properties (⌘D)	Свойства на документа (⌘D)
+	Action Wizard…	Съветник за действия…
+	Add Bates numbering…	Добави номериране на Бейтс…
+	Add a button	Добави бутон
+	Add a callout	Добави изнесена бележка
+	Add a checkbox	Добави отметка (квадратче)
+	Add a date field	Добави поле за дата
+	Add a digital signature field	Добави поле за цифров подпис
+	Add a drop-down list	Добави падащ списък
+	Add a list box	Добави списъчно поле
+	Add a radio button	Добави радиобутон
+	Add a sticky note	Добави бележка
+	Add a text box	Добави текстово поле
+	Add a text field	Добави текстово поле за попълване
+	Add alternate text…	Добави алтернативен текст…
+	Add an image field	Добави поле за изображение
+	Add image…	Добави изображение…
+	Add or edit links	Добави или редактирай връзки
+	Apply redactions…	Приложи заличаванията…
+	Attach a file	Прикачи файл
+	Change reading options…	Промени опциите за четене…
+	Check for accessibility	Провери за достъпност
+	Clear redaction marks	Изчисти маркировките за заличаване
+	Compare files…	Сравни файлове…
+	Create links from URLs	Създай връзки от URL адреси
+	Detect form fields	Открий полета на формуляр
+	Draw a cloud	Нарисувай облак
+	Draw a line	Нарисувай линия
+	Draw a polygon	Нарисувай многоъгълник
+	Draw a rectangle	Нарисувай правоъгълник
+	Draw an arrow	Нарисувай стрелка
+	Draw an oval	Нарисувай овал
+	Draw connected lines	Нарисувай свързани линии
+	Erase drawings	Изтрий рисунките
+	Export all comments to data file…	Експортирай всички коментари във файл с данни…
+	Export form data…	Експортирай данните от формуляра…
+	Field properties…	Свойства на полето…
+	Fill & Sign: add text	Попълни и подпиши: добави текст
+	Fill & Sign: checkmark	Попълни и подпиши: отметка
+	Fill & Sign: cross	Попълни и подпиши: кръстче
+	Fill & Sign: date	Попълни и подпиши: дата
+	Fill & Sign: dot	Попълни и подпиши: точка
+	Fill & Sign: initials	Попълни и подпиши: инициали
+	Fill & Sign: line	Попълни и подпиши: линия
+	Fill & Sign: sign	Попълни и подпиши: подпиши
+	Find text and redact…	Намери текст и заличи…
+	Hide all comments	Скрий всички коментари
+	Import comments…	Импортирай коментари…
+	Import form data…	Импортирай данни за формуляр…
+	Insert text	Вмъкни текст
+	Merge data files into spreadsheet…	Обедини файлове с данни в електронна таблица…
+	Optimize scanned documents…	Оптимизирай сканирани документи…
+	Prepare for distribution…	Подготви за разпространение…
+	Recognize text in multiple files…	Разпознай текст в няколко файла…
+	Redact pages…	Заличи страници…
+	Redaction properties…	Свойства на заличаването…
+	Remove all links	Премахни всички връзки
+	Remove background	Премахни фона
+	Remove header & footer	Премахни горния и долния колонтитул
+	Remove hidden information…	Премахни скритата информация…
+	Remove watermark	Премахни водния знак
+	Replace text	Замени текст
+	Sanitize document…	Почисти документа…
+	Squiggly underline text	Подчертай текст с вълнообразна линия
+	Strikethrough text	Зачертай текст
+	Summarize comments	Обобщи коментарите
+	Tab order: by columns	Ред на табулация: по колони
+	Tab order: by document structure	Ред на табулация: по структурата на документа
+	Tab order: by rows	Ред на табулация: по редове
+	Underline text	Подчертай текст
+	Update background…	Актуализирай фона…
+	Update header & footer…	Актуализирай горния и долния колонтитул…
+	Update watermark…	Актуализирай водния знак…
+	Note	Бележка
+	Polyline	Начупена линия
+	Attachment	Прикачен файл
+	Callout	Изнесена бележка
+	Typewriter	Пишеща машина
+	Checked	Отметнато
+	Unchecked	Неотметнато
+	Marked	Маркирано
+	Locked	Заключено
+	Search comments	Търсене в коментарите
+	Add a comment	Добави коментар
+	No comments yet.	Все още няма коментари.
+	Pick a tool in the quick bar, or type above.	Изберете инструмент от бързата лента или пишете по-горе.
+	No comments match.	Няма съвпадащи коментари.
+	Unknown author	Неизвестен автор
+	No colour	Без цвят
+	Remove checkmark	Премахни отметката
+	Mark with checkmark	Отбележи с отметка
+	Reply	Отговор
+	Add a reply	Добави отговор
+	Post	Публикувай
+	Page {label}	Страница {label}
+	{kind} — click to show it on the page	{kind} — щракнете, за да го покажете на страницата
+	Set status	Задай състояние
+	Copy text	Копирай текста
+	Properties…	Свойства…
+	Make Current Properties Default	Направи текущите свойства подразбиращи се
+	More options	Още опции
+	Sort by	Сортиране по
+	Author	Автор
+	Type	Тип
+	Colour	Цвят
+	Show all comments	Покажи всички коментари
+	Create PDF comment summary…	Създай обобщение на коментарите в PDF…
+	Export all to data file…	Експортирай всички във файл с данни…
+	Filter comments	Филтрирай коментарите
+	Status	Състояние
+	Accepted	Прието
+	Rejected	Отхвърлено
+	Cancelled	Отменено
+	Completed	Завършено
+	Show all	Покажи всички
+	Yellow	Жълто
+	Orange	Оранжево
+	Red	Червено
+	Pink	Розово
+	Purple	Лилаво
+	Blue	Синьо
+	Light blue	Светлосиньо
+	Green	Зелено
+	Gray	Сиво
+	Black	Черно
+	Search	Търсене
+	Bookmark options	Опции за отметки
+	Expand all bookmarks	Разгъни всички отметки
+	Expand top-level bookmarks	Разгъни отметките от първо ниво
+	Collapse all bookmarks	Свий всички отметки
+	New bookmark (⌘B)	Нова отметка (⌘B)
+	This document has no bookmarks.	Този документ няма отметки.
+	This document has no layers.	Този документ няма слоеве.
+	This document has no attachments.	Този документ няма прикачени файлове.
+	Hide layer	Скрий слоя
+	Show layer	Покажи слоя
+	Set layer visibility	Задай видимост на слоя
+	on page {label}	на страница {label}
+	Save attachment…	Запиши прикачения файл…
+	Open in a new tab	Отвори в нов раздел
+	This document has no pages.	Този документ няма страници.
+	Find text	Намери текст
+	No matches	Няма съвпадения
+	Searching… {s}/{p}	Търсене… {s}/{p}
+	{c} of {n}{more}	{c} от {n}{more}
+	Previous (⇧⌘G)	Предишно (⇧⌘G)
+	Next (⌘G)	Следващо (⌘G)
+	Find options	Опции за търсене
+	Whole words only	Само цели думи
+	Case-sensitive	Чувствително към регистъра
+	Close (Esc)	Затвори (Esc)
+	Align	Подравни
+	Top	Горе
+	Bottom	Долу
+	Center horizontally	Центрирай хоризонтално
+	Center vertically	Центрирай вертикално
+	Distribute	Разпредели
+	Horizontally	Хоризонтално
+	Vertically	Вертикално
+	Set Fields to Same Size	Задай еднакъв размер на полетата
+	Height	Височина
+	Width	Ширина
+	Both	И двете
+	Duplicate…	Дублирай…
+	All pages	Всички страници
+	Odd pages	Нечетни страници
+	Even pages	Четни страници
+	Landscape pages	Пейзажни страници
+	Portrait pages	Портретни страници
+	Move earlier	Премести по-напред
+	Move later	Премести по-назад
+	Back to the document	Обратно към документа
+	Protect Using Password	Защита с парола
+	Requires user to enter a password for:	Изисква от потребителя да въведе парола за:
+	Viewing	Преглед
+	Editing	Редактиране
+	Type Password	Въведете парола
+	Re-type Password	Повторете паролата
+	Strength: {s}	Надеждност: {s}
+	Strong	Силна
+	Medium	Средна
+	Weak	Слаба
+	Advanced Options {chevron}	Разширени опции {chevron}
+	Compatibility	Съвместимост
+	Acrobat X and later (256-bit AES)	Acrobat X и по-нови (256-битов AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 и по-нови (128-битов AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 и по-нови (128-битов RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 и по-нови (40-битов RC4)
+	Encrypt	Шифровай
+	All document contents	Цялото съдържание на документа
+	All document contents except metadata	Цялото съдържание на документа без метаданните
+	Printing allowed	Разрешен печат
+	Low Resolution (150 dpi)	Ниска разделителна способност (150 dpi)
+	Changes allowed	Разрешени промени
+	Inserting, deleting, and rotating pages	Вмъкване, изтриване и завъртане на страници
+	Filling in form fields and signing existing signature fields	Попълване на полета на формуляр и подписване в съществуващи полета за подпис
+	Commenting, filling in form fields, and signing existing signature fields	Коментиране, попълване на полета на формуляр и подписване в съществуващи полета за подпис
+	Any except extracting pages	Всички без извличане на страници
+	Enable copying of text, images, and other content	Разреши копиране на текст, изображения и друго съдържание
+	Enable text access for screen reader devices for the visually impaired	Разреши достъп до текста за екранни четци за хора със зрителни увреждания
+	Type a password.	Въведете парола.
+	The passwords don't match.	Паролите не съвпадат.
+	This compatibility level supports only plain ASCII passwords.	Това ниво на съвместимост поддържа само пароли с обикновени ASCII знаци.
+	Anyone opening the document will need this password. It's applied when you save.	Всеки, който отваря документа, ще се нуждае от тази парола. Тя се прилага при записване.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	Документът се отваря без парола; тази парола е нужна за промяна на ограниченията. Тя се прилага при записване.
+	Recover unsaved documents?	Да се възстановят ли незаписаните документи?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft не беше затворен нормално. Тези документи имат автоматично записани промени:
+	just now	току-що
+	{n} min ago	преди {n} мин
+	{n} h ago	преди {n} ч
+	 · password-protected	 · защитен с парола
+	Recover	Възстанови
+	Discard	Отхвърли
+	Next / previous match	Следващо / предишно съвпадение
+	Copy selected text	Копирай избрания текст
+	Select a word	Избери дума
+	Clear selection / close find	Изчисти избора / затвори търсенето
+	Zoom in / out (also pinch or ⌘-scroll)	Увеличи / намали (също с щипване или ⌘ + превъртане)
+	Rotate view	Завърти изгледа
+	First / last page	Първа / последна страница
+	Previous / next page	Предишна / следваща страница
+	Delete selected pages (Organize)	Изтрий избраните страници (Организиране)
+	Select all pages (Organize)	Избери всички страници (Организиране)
+	Version {v}	Версия {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Независимо разработено PDF приложение с отворен код, написано на Rust. MIT OR Apache-2.0.
+	Part of	Част от
+	Summarize Options	Опции за обобщение
+	Choose a layout:	Изберете оформление:
+	Comments only	Само коментари
+	Sort comments by:	Сортирай коментарите по:
+	Create PDF Comment Summary	Създай PDF обобщение на коментарите
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Да се върне ли последната записана версия на „{name}“? Промените след нея няма да могат да бъдат отменени.
+	Number pages	Номерирай страниците
+	Style	Стил
+	None (prefix only)	Без (само префикс)
+	Prefix	Префикс
+	Start	Начало
+	Labels: {preview}. Later pages keep their labels.	Етикети: {preview}. Следващите страници запазват етикетите си.
+	Even and Odd Pages	Четни и нечетни страници
+	Even Pages Only	Само четни страници
+	Odd Pages Only	Само нечетни страници
+	Landscape and Portrait Pages	Пейзажни и портретни страници
+	Landscape Pages	Пейзажни страници
+	Portrait Pages	Портретни страници
+	Duplicate Field	Дублиране на поле
+	Duplicate "{name}" onto:	Дублирай „{name}“ върху:
+	1 page selected.	Избрана е 1 страница.
+	{n} pages selected.	Избрани са {n} страници.
+	Delete pages after extracting	Изтрий страниците след извличане
+	Extract pages as separate files	Извлечи страниците като отделни файлове
+	Rotate Pages	Завъртане на страници
+	Direction:	Посока:
+	Clockwise 90 degrees	По часовниковата стрелка на 90 градуса
+	Counterclockwise 90 degrees	Обратно на часовниковата стрелка на 90 градуса
+	180 degrees	180 градуса
+	Pages:	Страници:
+	All	Всички
+	Selection	Избраните
+	From	От
+	Rotate:	Завърти:
+	Repairs	Поправки
+	Repair log	Дневник на поправките
+	Split document	Разделяне на документ
+	Number of pages	Брой страници
+	Pages per file	Страници на файл
+	File size	Размер на файла
+	At most	Най-много
+	Top-level bookmarks ({n})	Отметки от най-горно ниво ({n})
+	Before each selected page (select pages in Organize)	Преди всяка избрана страница (изберете страници в Организиране)
+	Creates 1 file from {n} pages.	Създава 1 файл от {n} страници.
+	Creates {f} files from {n} pages.	Създава {f} файла от {n} страници.
+	Each file holds as many of the {n} pages as fit.	Всеки файл съдържа толкова от общо {n} страници, колкото се поберат.
+	Replace Pages	Замяна на страници
+	Original: replace pages	Оригинал: замени страниците
+	to	до
+	to {n}	до {n}
+	Replacement: pages of {name}	Заместител: страници от {name}
+	of {name}	от {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Променя се само съдържанието на страниците: връзките, коментарите, полетата на формуляра и отметките на оригиналните страници остават.
+	The replacement file doesn't have that many pages.	Заместващият файл няма толкова страници.
+	Tagged PDF	PDF с етикети
+	Document Properties	Свойства на документа
+	Description	Описание
+	Initial View	Начален изглед
+	Security	Защита
+	Fonts	Шрифтове
+	Advanced	Разширени
+	Title	Заглавие
+	Subject	Тема
+	Keywords	Ключови думи
+	Application	Приложение
+	PDF producer	PDF генератор
+	Layout and Magnification	Оформление и мащаб
+	Navigation tab	Навигационен раздел
+	Page Only	Само страница
+	Bookmarks Panel and Page	Панел „Отметки“ и страница
+	Pages Panel and Page	Панел „Страници“ и страница
+	Attachments Panel and Page	Панел „Прикачени файлове“ и страница
+	Layers Panel and Page	Панел „Слоеве“ и страница
+	Page layout	Оформление на страниците
+	Default	По подразбиране
+	Single Page	Единична страница
+	Single Page Continuous	Единична страница, непрекъснато
+	Two-Up (Facing)	Две страници (една срещу друга)
+	Two-Up Continuous (Facing)	Две страници, непрекъснато (една срещу друга)
+	Two-Up (Cover Page)	Две страници (с корица)
+	Two-Up Continuous (Cover Page)	Две страници, непрекъснато (с корица)
+	Magnification	Мащаб
+	Actual Size	Действителен размер
+	Fit Page	Побери страницата
+	Fit Width	Побери по ширина
+	Fit Height	Побери по височина
+	Fit Visible	Побери видимото
+	Open to page	Отвори на страница
+	of {pages}	от {pages}
+	Window Options	Опции на прозореца
+	Resize window to initial page	Преоразмери прозореца спрямо началната страница
+	Center window on screen	Центрирай прозореца на екрана
+	Open in Full Screen mode	Отвори в режим на цял екран
+	Show:	Показвай:
+	File Name	Име на файла
+	Document Title	Заглавие на документа
+	User Interface Options	Опции на потребителския интерфейс
+	Hide menu bar	Скрий лентата с менюта
+	Hide toolbars	Скрий лентите с инструменти
+	Hide window controls	Скрий контролите на прозореца
+	Security method	Метод на защита
+	No security	Без защита
+	Restrictions	Ограничения
+	None — everything is allowed	Няма — всичко е разрешено
+	Password security	Защита с парола
+	Encryption	Шифроване
+	Opened with	Отворен с
+	— (protection is applied when you save)	— (защитата се прилага при записване)
+	Owner password (no restrictions apply)	Парола на собственика (без ограничения)
+	User password	Потребителска парола
+	Change settings…	Промени настройките…
+	Printing	Печат
+	Not allowed	Не е разрешено
+	Allowed	Разрешено
+	High resolution	Висока разделителна способност
+	Low resolution	Ниска разделителна способност
+	Changing the document	Промяна на документа
+	Document assembly	Сглобяване на документа
+	Content copying	Копиране на съдържание
+	Content copying for accessibility	Копиране на съдържание за достъпност
+	Commenting	Коментиране
+	Filling of form fields	Попълване на полета на формуляр
+	No fonts are referenced by the pages.	Страниците не използват шрифтове.
+	PDF version	Версия на PDF
+	Location	Местоположение
+	Page size	Размер на страницата
+	Yes	Да
+	No	Не
+	Revisions	Редакции
+	View revision {n}	Покажи редакция {n}
+	Open the file as it was saved then	Отвори файла във вида, в който е записан тогава
+	Binding	Подвързване
+	Left Edge	Ляв ръб
+	Right Edge	Десен ръб
+	Language	Език
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Записано {place}: {before} → {after} (с {pct}% по-малко){detail}
+	Couldn't save the image: {e}	Изображението не можа да бъде записано: {e}
+	Adding images arrives on the web with file pickers for images	Добавянето на изображения в уеб версията ще стане достъпно с инструментите за избор на файлове с изображения
+	Replacing images on page {p} arrives on the web with image pickers ({i})	Замяната на изображения на страница {p} в уеб версията ще стане достъпна с инструментите за избор на изображения ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: изборът на изображения в уеб версията ще стане достъпен с инструментите за избор на файлове с изображения
+	Replacing images arrives on the web with image file pickers	Замяната на изображения в уеб версията ще стане достъпна с инструментите за избор на файлове с изображения
+	Couldn't create a PDF: {e}	Не можа да се създаде PDF файл: {e}
+	The clipboard has no image or text	В клипборда няма изображение или текст
+	On the web, open or drop an image to convert it	В уеб версията отворете или пуснете изображение, за да го конвертирате
+	Couldn't optimize the file: {e}	Файлът не можа да бъде оптимизиран: {e}
+	Couldn't write {path}: {e}	Не можа да се запише {path}: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Формулярът изисква да бъде изпратен до {u}; PdfCraft не изпраща данни от формуляри. Запишете документа, за да запазите въведеното.
+	{s} actions run in the JavaScript engine (M6)	Действията {s} се изпълняват в JavaScript машината (M6)
+	{name}: the {other} action isn't supported yet	{name}: действието {other} все още не се поддържа
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} изпраща формуляра до {url}; PdfCraft не изпраща данни от формуляри. Запишете документа, за да запазите въведеното.
+	Export stopped: {e}	Експортирането е спряно: {e}
+	Exported 1 image	Експортирано е 1 изображение
+	Exported {n} images	Експортирани са {n} изображения
+	 ({s} not exported: {first})	 ({s} не са експортирани: {first})
+	Exported the text of 1 page	Експортиран е текстът на 1 страница
+	Exported the text of {n} pages	Експортиран е текстът на {n} страници
+	{msg} to {dir}	{msg} в {dir}
+	Exporting… {d} of {t}	Експортиране… {d} от {t}
+	Choose a folder for the exported files	Изберете папка за експортираните файлове
+	New {tool} comments will look like this one	Новите коментари от тип {tool} ще изглеждат като този
+	This document can't be checked: it couldn't be read for editing	Този документ не може да бъде проверен: не можа да бъде прочетен за редактиране
+	The checker found no problems in this document.	Проверката не откри проблеми в този документ.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Проверката откри 1 проблем, който може да попречи документът да бъде напълно достъпен.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Проверката откри {n} проблема, които могат да попречат документът да бъде напълно достъпен.
+	The text is the same	Текстът е същият
+	1 difference found	Открита е 1 разлика
+	{n} differences found	Открити са {n} разлики
+	Added 1 comment	Добавен е 1 коментар
+	Added {n} comments	Добавени са {n} коментара
+	Choose a folder for the results	Изберете папка за резултатите
+	Files for {name}	Файлове за {name}
+	An action is already running	Вече се изпълнява действие
+	Running action… file {d} of {t}	Изпълнение на действие… файл {d} от {t}
+	No unlinked web addresses were found in the text	В текста не са открити уеб адреси без връзка
+	Created 1 link	Създадена е 1 връзка
+	Created {n} links	Създадени са {n} връзки
+	Text recognition is already running	Разпознаването на текст вече се изпълнява
+	Optimizing… removing user data	Оптимизиране… премахване на потребителски данни
+	Optimizing… image {d} of {t}	Оптимизиране… изображение {d} от {t}
+	Optimizing… cleaning up	Оптимизиране… почистване
+	Optimizing… merging identical objects	Оптимизиране… сливане на еднакви обекти
+	Optimizing… writing the copy	Оптимизиране… записване на копието
+	Cancelling…	Отказване…
+	Optimization is already running	Оптимизирането вече се изпълнява
+	Optimization cancelled	Оптимизирането е отказано
+	Couldn't optimize the file	Файлът не можа да бъде оптимизиран
+	Recognizing text… file {d} of {t}	Разпознаване на текст… файл {d} от {t}
+	Recognizing text… page {d} of {t}	Разпознаване на текст… страница {d} от {t}
+	Recognized 1 word	Разпозната е 1 дума
+	Recognized {n} words	Разпознати са {n} думи
+	{words} on {pages}	{words} на {pages}
+	; 1 page already had text	; 1 страница вече съдържаше текст
+	; {n} pages already had text	; {n} страници вече съдържаха текст
+	Recognized {w} words in 1 file	Разпознати са {w} думи в 1 файл
+	Recognized {w} words in {n} files	Разпознати са {w} думи в {n} файла
+	; failed: {list}	; неуспешни: {list}
+	1 file done	Обработен е 1 файл
+	{n} files done	Обработени са {n} файла
+	The selected area has been copied ({w} × {h} pixels)	Избраната област е копирана ({w} × {h} пиксела)
+	Couldn't take the snapshot: {e}	Не можа да се направи моментна снимка: {e}
+	Couldn't recover {name}: {e}	{name} не можа да бъде възстановен: {e}
+	The document now conforms to {level}; save it to keep the changes	Документът вече отговаря на {level}; запишете го, за да запазите промените
+	Fixed what could be fixed; 1 problem remains	Поправено е всичко възможно; остава 1 проблем
+	Fixed what could be fixed; {n} problems remain	Поправено е всичко възможно; остават {n} проблема
+	Custom stamps arrive on the web with file pickers for images	Потребителските печати в уеб версията ще станат достъпни с инструментите за избор на файлове с изображения
+	{file} is too large for a stamp (at most {n} MB)	{file} е твърде голям за печат (най-много {n} MB)
+	Sent to {printer}	Изпратено до {printer}
+	Sent to {printer}: {msg}	Изпратено до {printer}: {msg}
+	Choose a folder for the searchable files	Изберете папка за файловете с възможност за търсене
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Файловете се обединяват отгоре надолу. Оставете „Страници“ празно, за да се вземат всички страници.
+	Unlock…	Отключи…
+	Select a password-protected file first	Първо изберете файл, защитен с парола
+	Enter the permissions password to allow combining	Въведете паролата за разрешения, за да позволите обединяването
+	Enter the password that opens it	Въведете паролата за отваряне
+	Unlock {name}	Отключи {name}
+	Unlock {n} files	Отключи {n} файла
+	The same password is tried on each file.	Една и съща парола се опитва за всеки файл.
+	Hide password	Скрий паролата
+	Show password	Покажи паролата
+	Wrong password	Грешна парола
+	The password is only used to read the file; it isn't saved.	Паролата се използва само за четене на файла; тя не се запазва.
+	Unlock	Отключи
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Файлът е отворен, но настройките му за защита не позволяват обединяване. Въведете паролата за разрешения.
+	Unlocked: the combined file won't be password-protected	Отключен: обединеният файл няма да бъде защитен с парола
+	Unlocked {n} of {m} files	Отключени са {n} от {m} файла
+	Drop PDFs or folders here, or choose them.	Пуснете тук PDF файлове или папки или ги изберете.
+	Add folder…	Добави папка…
+	Add folder and subfolders…	Добави папка и подпапки…
+	More ways to add files	Още начини за добавяне на файлове
+	Every PDF in the folder	Всички PDF файлове в папката
+	Every PDF in the folder and the folders inside it	Всички PDF файлове в папката и в папките в нея
+	Add folder	Добави папка
+	Add folder and subfolders	Добави папка и подпапки
+	No PDFs found in {folder}	Не са открити PDF файлове в {folder}
+	Added the first {n} PDFs in {folder}	Добавени са първите {n} PDF файла от {folder}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Щракнете за сортиране, плъзнете, за да преместите колоната. Плъзнете ръба на колоната, за да промените размера.
+	Reset columns	Нулирай колоните
+	Remove {n} files	Премахни {n} файла
+	{n} selected	Избрани: {n}
+	sorted ascending	сортирано във възходящ ред
+	sorted descending	сортирано в низходящ ред
+	Protected: the combined file won't keep its security settings	Защитен: обединеният файл няма да запази настройките за защита
+	Add open documents	Добави отворените документи
+	All open documents	Всички отворени документи
+	No documents are open	Няма отворени документи
+	Select a file first	Първо изберете файл
+	1 file	1 файл
+	{n} files	{n} файла
+	1 file needs attention	1 файл изисква внимание
+	{n} files need attention	{n} файла изискват внимание
+	{name} can't be combined: {why}	{name} не може да бъде обединен: {why}
+	Check the pages of {name}: {why}	Проверете страниците на {name}: {why}
+	Add the PDFs to combine	Добавете PDF файловете за обединяване
+	File name	Име на файла
+	Warnings	Предупреждения
+	Drag to reorder	Плъзнете, за да пренаредите
+	{k} of {n}	{k} от {n}
+	? of {n}	? от {n}
+	Added more than once	Добавен повече от веднъж
+	yesterday	вчера
+	{n} days ago	преди {n} дни
+	No pages selected	Няма избрани страници
+	Password-protected	Защитен с парола
+	Its security settings don't allow copying pages	Настройките му за защита не позволяват копиране на страници
+	Can't be read: {e}	Не може да бъде прочетен: {e}
+	Includes unsaved changes	Съдържа незаписани промени
+	Pages of {name} to combine, e.g. 1-3, 6	Страници от {name} за обединяване, напр. 1-3, 6
+	Remove {name}	Премахни {name}
+	Add files…	Добави файлове…
+	Add at least two files	Добавете поне два файла
+	Couldn't add {name}: {e}	{name} не можа да бъде добавен: {e}
+	Couldn't combine files: {e}	Файловете не можаха да бъдат обединени: {e}
+	Export comments	Експортирай коментарите
+	Export form data	Експортирай данните от формуляра
+	Comment and form data	Данни от коментари и формуляри
+	Export	Експортирай
+	Select data files to merge	Изберете файлове с данни за сливане
+	Form data and PDF forms	Данни от формуляри и PDF формуляри
+	Save the spreadsheet	Запиши електронната таблица
+	Save the accessibility report	Запиши отчета за достъпност
+	Save image	Запиши изображението
+	Export certificate	Експортирай сертификата
+	Choose a folder for the extracted pages	Изберете папка за извлечените страници
+	Choose a folder for the split files	Изберете папка за разделените файлове
+	Couldn't use {name}: {e}	{name} не можа да бъде използван: {e}
+	Couldn't extract pages: {e}	Страниците не можаха да бъдат извлечени: {e}
+	Couldn't write {name}: {e}	{name} не можа да бъде записан: {e}
+	Wrote 1 file to {dir}	Записан е 1 файл в {dir}
+	Wrote {n} files to {dir}	Записани са {n} файла в {dir}
+	No pages match those choices	Няма страници, отговарящи на този избор
+	Couldn't split: {e}	Разделянето не бе успешно: {e}
+	Couldn't summarize comments: {e}	Коментарите не можаха да бъдат обобщени: {e}
+	Couldn't open the result: {e}	Резултатът не можа да бъде отворен: {e}
+	Importing data arrives on the web with file pickers for data files	Импортирането на данни в уеб версията ще стане достъпно с инструментите за избор на файлове с данни
+	Exported to {path}	Експортирано в {path}
+	Merging data files needs the desktop app	Сливането на файлове с данни изисква настолното приложение
+	Merged 1 file into {path}	Слят е 1 файл в {path}
+	Merged {n} files into {path}	Слети са {n} файла в {path}
+	Combined {n} files	Обединени са {n} файла
+	Extracted 1 page	Извлечена е 1 страница
+	Extracted {n} pages	Извлечени са {n} страници
+	Created a comment summary	Създадено е обобщение на коментарите
+	Couldn't open {name}: {e}	{name} не можа да бъде отворен: {e}
+	Couldn't read {name}: {e}	{name} не можа да бъде прочетен: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Преносимият режим е изключен: в {folder} не може да се записва ({error}). Вместо това настройките се пазят в потребителската ви папка.
+	Couldn't save: {e}	Записването не бе успешно: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Изтеглянето на прикачени файлове в уеб версията ще стане достъпно с M3.10 ({n} байта готови)
+	`{command}` {when}	`{command}` {when}
+	ships in milestone {m}	ще бъде включено в етап {m}
+	needs an AI provider (off by default)	изисква доставчик на ИИ (изключено по подразбиране)
+	is available	е налично
+	is not available yet	все още не е налично
+	{label} failed: {e}	{label} — неуспешно: {e}
+	Undid {label}	Отменено: {label}
+	Redid {label}	Повторено: {label}
+	A document needs at least one page: copy instead	Документът трябва да има поне една страница: използвайте копиране
+	Cut {what}	Изрязано: {what}
+	Copied {what}	Копирано: {what}
+	1 page	1 страница
+	{n} pages	{n} страници
+	Copy or cut pages first	Първо копирайте или изрежете страници
+	Couldn't save {name}: {e}	{name} не можа да бъде записан: {e}
+	Saved {name}	Записан: {name}
+	Saved, but reopening failed: {e}	Записано, но повторното отваряне не бе успешно: {e}
+	Downloaded {name}	Изтеглен: {name}
+	Couldn't download {name}: {e}	{name} не можа да бъде изтеглен: {e}
+	Reverted to the last saved version	Възстановена е последната записана версия
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Действието не бе успешно: прекъсна го вътрешна грешка ({m}). Документите ви не са променени.
+	Nothing to undo	Няма какво да се отмени
+	Nothing to redo	Няма какво да се повтори
+	This document has no form fields you can fill in	Този документ няма полета на формуляр, които могат да се попълнят
+	This document has no comments to flatten	Този документ няма коментари за сплескване
+	This document has no form fields to flatten	Този документ няма полета на формуляр за сплескване
+	There are no redaction marks (mark text, areas or pages first)	Няма маркировки за заличаване (първо маркирайте текст, области или страници)
+	This document has no {kind} to change	Този документ няма {kind} за промяна
+	header or footer	горен или долен колонтитул
+	watermark	воден знак
+	background	фон
+	This document isn't password-protected	Този документ не е защитен с парола
+	Only the document's owner can change its security (open it with the permissions password)	Само собственикът на документа може да промени защитата му (отворете го с паролата за разрешения)
+	The document's security settings don't allow this change	Настройките за защита на документа не позволяват тази промяна
+	Open a document first	Първо отворете документ
+	Security will be removed when you save	Защитата ще бъде премахната при записване
+	Click text or an image to edit it	Щракнете върху текст или изображение, за да го редактирате
+	Drag a rectangle to create a link; double-click a link to edit it	Очертайте правоъгълник, за да създадете връзка; щракнете двукратно върху връзка, за да я редактирате
+	There are no redaction marks to apply	Няма маркировки за заличаване, които да бъдат приложени
+	Drag to draw the area where the signature should appear.	Плъзнете, за да очертаете областта, където да се появи подписът.
+	Couldn't fit the visible content: {e}	Видимото съдържание не може да бъде побрано: {e}
+	Drag a rectangle around the area to copy	Очертайте правоъгълник около областта за копиране
+	Click on the page to add a {tool}, or drag to set its size	Щракнете върху страницата, за да добавите {tool}, или плъзнете, за да зададете размера
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Очертайте правоъгълник върху страница, за да я изрежете; щракнете двукратно върху страница за „Задай полета на страницата“
+	Keep tool selected: on	Запази инструмента избран: вкл.
+	Keep tool selected	Запази инструмента избран
+	Opacity	Непрозрачност
+	Line thickness	Дебелина на линията
+	What word or phrase would you like to search for?	Каква дума или фраза искате да търсите?
+	Searching… {s} of {p} pages	Търсене… {s} от {p} страници
+	 (searching… {s} of {p} pages)	 (търсене… {s} от {p} страници)
+	1 instance	1 съвпадение
+	{n} instances	{n} съвпадения
+	Go to this result	Към този резултат
+	Highlight	Маркиране
+	Draw	Рисуване
+	Polygon	Многоъгълник
+	Connected lines	Свързани линии
+	Eraser	Гумичка
+	Sign	Подпиши
+	Certified by {by}	Сертифициран от {by}
+	At least one signature is invalid.	Поне един подпис е невалиден.
+	Signed and all signatures are valid.	Подписан, всички подписи са валидни.
+	At least one signature has problems.	Поне един подпис има проблеми.
+	This document is secured. Some changes are restricted by its security settings.	Този документ е защитен. Някои промени са ограничени от настройките му за защита.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Това е динамичен XFA формуляр, който PdfCraft все още не може да показва. Виждате заместващата страница на файла.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Този формуляр съдържа и XFA данни, които PdfCraft все още не чете. Можете да попълвате полетата му, но Acrobat може да покаже вместо това XFA стойностите.
+	This document contains {n} interactive form fields.	Този документ съдържа {n} интерактивни полета на формуляр.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Този файл беше повреден и е поправен. При записване се запазва поправената версия.
+	Dismiss	Скрий
+	Hide field highlights	Скрий маркирането на полетата
+	Highlight fields	Маркирай полетата
+	Security settings	Настройки за защита
+	Details	Подробности
+	Select (V)	Избиране (V)
+	Hand (H)	Ръка (H)
+	Delete pages (Delete)	Изтрий страниците (Delete)
+	Insert a blank page after the selection	Вмъкни празна страница след избраното
+	Insert pages from a file…	Вмъкни страници от файл…
+	Extract pages to a new document	Извлечи страниците в нов документ
+	Split into files…	Раздели на файлове…
+	Select pages	Избери страници
+	Cut	Изрежи
+	Copy	Копирай
+	Paste after	Постави след
+	Rename	Преименувай
+	Set to current page ({n})	Задай текущата страница ({n})
+	Move up	Премести нагоре
+	Move down	Премести надолу
+	Indent	Увеличи отстъпа
+	Outdent	Намали отстъпа
+	This document has no form fields.	Този документ няма полета на формуляр.
+	Tab order: move a field with its arrows.	Ред на обхождане: преместете поле със стрелките му.
+	Unplaced	Неразположени
+	Has JavaScript actions (run in M6)	Има JavaScript действия (изпълняват се в M6)
+	Page	Страница
+	None	Няма
+	Tool	Инструмент
+	Command	Команда
+	Search tools and commands…	Търсене на инструменти и команди…
+	No matching tools	Няма съответстващи инструменти
+	All tools	Всички инструменти
+	Read	Четене
+	Convert	Конвертиране
+	E-Sign	Е-подпис
+	Welcome to PdfCraft	Добре дошли в PdfCraft
+	An open-source PDF workbench — local, private, and scriptable.	PDF работна среда с отворен код — локална, поверителна и програмируема.
+	Recommended tools	Препоръчани инструменти
+	Use now	Използвай сега
+	Recent	Последни
+	Privacy	Поверителност
+	Export to image…	Експортирай като изображение…
+	Reduce file size…	Намали размера на файла…
+	Optimize PDF…	Оптимизирай PDF…
+	Export to text…	Експортирай като текст…
+	Export to Word…	Експортирай в Word…
+	Export to HTML…	Експортирай в HTML…
+	Export to RTF…	Експортирай в RTF…
+	Export all images…	Експортирай всички изображения…
+	Protect using password…	Защити с парола…
+	Remove security	Премахни защитата
+	Security properties…	Свойства на защитата…
+	Organize pages	Организиране на страници
+	New bookmark	Нова отметка
+	Rotate pages clockwise	Завърти страниците по часовниковата стрелка
+	Rotate pages counterclockwise	Завърти страниците обратно на часовниковата стрелка
+	Delete pages	Изтрий страници
+	Insert blank page	Вмъкни празна страница
+	Rotate pages…	Завърти страници…
+	Duplicate pages	Дублирай страници
+	Crop pages	Изрежи страници
+	Set page boxes…	Задай полета на страницата…
+	Insert pages from file…	Вмъкни страници от файл…
+	Replace pages…	Замени страници…
+	Extract pages…	Извлечи страници…
+	Split document…	Раздели документа…
+	Number pages…	Номерирай страниците…
+	Keyboard shortcuts	Клавишни комбинации
+	Join the ArtCraft Discord	Присъедини се към ArtCraft в Discord
+	Join the ArtCraft community	Присъедини се към общността на ArtCraft
+	Get help, share feedback and follow development on Discord.	Получете помощ, споделете мнение и следете разработката в Discord.
+	Join our Discord	Присъедини се към нашия Discord
+	PdfCraft web page	Уебстраница на PdfCraft
+	PdfCraft on GitHub	PdfCraft в GitHub
+	ArtCraft website	Уебсайт на ArtCraft
+	Check for updates…	Провери за актуализации…
+	About PdfCraft	За PdfCraft
+	JavaScript console…	JavaScript конзола…
+	Document JavaScripts…	JavaScript на документа…
+	Recognize text…	Разпознай текст…
+	Check for accessibility…	Провери достъпността…
+	Add header & footer…	Добави горен и долен колонтитул…
+	Add watermark…	Добави воден знак…
+	Add background…	Добави фон…
+	Prepare a form	Подготви формуляр
+	Digitally sign	Подпиши цифрово
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	Файловете, които отваряте в PdfCraft, се показват тук. Пуснете PDF файл където и да е, за да го отворите.
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft работи офлайн. Без телеметрия, без акаунт и без обработка в облака, освен ако не добавите доставчик.
+	Measure distance	Измери разстояние
+	Measure perimeter	Измери периметър
+	Measure area	Измери площ
+	Set measurement scale	Задай мащаб на измерване
+	Measurement information	Информация за измерването
+	Measurement snapping	Прилепване при измерване
+	Export measurements as CSV	Експортирай измерванията като CSV
+	Distance	Разстояние
+	Perimeter	Периметър
+	Area	Площ
+	Drawing scale	Мащаб на чертежа
+	Snapping	Прилепване
+	Export measurements	Експортирай измерванията
+	Open a PDF to measure it.	Отворете PDF файл, за да го измервате.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Щракнете върху върховете. Enter или двукратно щракване завършва периметър или площ. Щракнете върху първата точка, за да затворите площ.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift ограничава до 45 градуса. Backspace премахва връх. Escape отменя.
+	Angle	Ъгъл
+	Click the first point to begin.	Щракнете върху първата точка, за да започнете.
+	Snap to drawing	Прилепване към чертежа
+	Endpoints	Крайни точки
+	Midpoints	Средни точки
+	Intersections	Пресечни точки
+	Paths	Контури
+	Sensitivity	Чувствителност
+	Unit	Единица
+	Decimals	Десетични знаци
+	Calibrate from two points	Калибрирай по две точки
+	Entire page	Цялата страница
+	Viewport rectangle in page points (x, y, width, height)	Правоъгълник на изгледа в точки на страницата (x, y, ширина, височина)
+	Viewport	Област на изгледа
+	Apply scale	Приложи мащаба
+	Saved measurements	Запазени измервания
+	Saved measurements.	Измерванията са запазени.
+	Endpoint	Крайна точка
+	Midpoint	Средна точка
+	Intersection	Пресечна точка
+	Path	Контур
+	This drawing exceeds the snapping limit; only the first paths are used.	Този чертеж надвишава ограничението за прилепване; използват се само първите контури.
+	Some page content couldn't be read; snapping uses the rest.	Част от съдържанието на страницата не може да бъде прочетена; прилепването използва останалото.
+	Unsupported measurements	Неподдържани измервания
+	Label	Етикет
+	{n} measurements use an unsupported format and are left out.	{n} измервания използват неподдържан формат и са пропуснати.
+	This area has too many overlapping paths; intersection snapping is limited.	Тази област има твърде много припокриващи се контури; прилепването към пресечни точки е ограничено.
+	This measurement needs at least {n} points.	Това измерване изисква поне {n} точки.
+	{0}: {1}	{0}: {1}
+	{dpi} pixels/inch	{dpi} пиксела/инч
+	{kind} field	Поле {kind}
+	{month} {y}	{month} {y}
+	{n} pages selected	Избрани страници: {n}
+	{name} — unsaved changes	{name} — незаписани промени
+	{s} action	Действие {s}
+	1 page selected	Избрана е 1 страница
+	a bookmark cannot be moved inside itself	отметка не може да бъде преместена в самата себе си
+	a document must keep at least one page	документът трябва да съдържа поне една страница
+	A form field has additional actions	Поле на формуляр има допълнителни действия
+	A stream refers to an external file	Поток препраща към външен файл
+	A stream uses LZW compression	Поток използва LZW компресия
+	Add arrow	Добави стрелка
+	Add background	Добави фон
+	Add bookmark	Добави отметка
+	Add callout	Добави изнесен надпис
+	Add checkmark	Добави знак за отметка
+	Add cloud	Добави облак
+	Add connected lines	Добави свързани линии
+	Add cross	Добави кръстче
+	Add dot	Добави точка
+	Add drawing	Добави рисунка
+	Add field	Добави поле
+	Add file attachment	Добави прикачен файл
+	Add header & footer	Добави горен и долен колонтитул
+	Add highlight	Добави маркиране
+	Add image	Добави изображение
+	Add inserted text	Добави вмъкнат текст
+	Add line	Добави линия
+	Add link	Добави връзка
+	Add oval	Добави овал
+	Add polygon	Добави многоъгълник
+	Add rectangle	Добави правоъгълник
+	Add redaction mark	Добави маркировка за заличаване
+	Add signature	Добави подпис
+	Add squiggly underline	Добави вълнообразно подчертаване
+	Add stamp	Добави печат
+	Add sticky note	Добави бележка
+	Add strikethrough	Добави зачертаване
+	Add text box	Добави текстово поле
+	Add underline	Добави подчертаване
+	An embedded file has no AFRelationship	Вграден файл няма AFRelationship
+	An image asks to be interpolated	Изображение изисква интерполация
+	An image has alternates or OPI information	Изображение има алтернативи или OPI информация
+	Button Style:	Стил на бутона:
+	Change {key}	Промени {key}
+	Change comment properties	Промени свойствата на коментара
+	Change field properties	Промени свойствата на полето
+	Change initial view	Промени началния изглед
+	Change initials	Промени инициалите
+	Change link properties	Промени свойствата на връзката
+	Change signature	Промени подписа
+	Check	Отметка
+	Check Box Style:	Стил на квадратчето за отметка:
+	Choose images	Избери изображения
+	Circle	Кръг
+	Combo	Комбиниран списък
+	Coming in milestone	Очаква се в етап
+	Crop page	Изрежи страницата
+	Delete bookmark	Изтрий отметката
+	Delete comment	Изтрий коментара
+	Delete content	Изтрий съдържанието
+	Delete document JavaScript	Изтрий JavaScript на документа
+	Delete field	Изтрий полето
+	Delete image	Изтрий изображението
+	Delete link	Изтрий връзката
+	Delete page	Изтрий страницата
+	Device colour is used, but there is no PDF/A output intent	Използва се цвят, зависим от устройството, но няма изходно намерение за PDF/A
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	Използва се DeviceCMYK: необходимо е CMYK изходно намерение (не се добавя автоматично)
+	Diagnostic details	Диагностични подробности
+	Diamond	Ромб
+	Double-click	Двукратно щракване
+	Draw your {what} below.	Нарисувайте {what} по-долу.
+	Duplicate page	Дублирай страницата
+	e.g. en-US	напр. en-US
+	Edit comment	Редактирай коментара
+	Edit content	Редактирай съдържанието
+	Edit document JavaScript	Редактирай JavaScript на документа
+	Edit script of {name}	Редактирай скрипта на {name}
+	Edit text	Редактирай текста
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	Вградените файлове трябва също да са PDF/A файлове (за други използвайте PDF/A-3)
+	Erase	Изтриване
+	Fill & Sign: change initials	Попълни и подпиши: промяна на инициалите
+	Fill & Sign: change signature	Попълни и подпиши: промяна на подписа
+	Fill & Sign: remove saved initials	Попълни и подпиши: премахване на запазените инициали
+	Fill & Sign: remove saved signature	Попълни и подпиши: премахване на запазения подпис
+	Fill in {name}	Попълни {name}
+	Flatten	Сплескай
+	Flip image	Обърни изображението
+	Font: Helvetica	Шрифт: Helvetica
+	Go to page {p}	Отиди на страница {p}
+	Images and text	Изображения и текст
+	Images and text (converted to PDF)	Изображения и текст (конвертирани в PDF)
+	Import {name}	Импортирай {name}
+	Insert pages from {name}	Вмъкни страници от {name}
+	Items marked Ready work today.	Елементите, отбелязани като „Готово“, работят още сега.
+	JavaScript	JavaScript
+	JavaScript, e.g. getField("total").value	JavaScript, напр. getField("total").value
+	List	Списък
+	Lock comment	Заключи коментара
+	Mark figure as decorative	Отбележи фигурата като декоративна
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Move bookmark	Премести отметката
+	Move comment	Премести коментара
+	Move image	Премести изображението
+	Move page	Премести страницата
+	Move pages	Премести страниците
+	no such document	няма такъв документ
+	nothing in the file matches this document	нищо във файла не съответства на този документ
+	open to see what it will include	отворете, за да видите какво ще включва
+	Page {p} of {n}	Страница {p} от {n}
+	PDF/A…	PDF/A…
+	Planned	Планирано
+	Planned for milestone	Планирано за етап
+	PostScript / EPS	PostScript / EPS
+	PostScript XObjects aren't allowed	PostScript XObject обекти не са разрешени
+	Presentation (.pptx)	Презентация (.pptx)
+	PushButton	Бутон
+	Radio	Радиобутон
+	Remove redaction marks	Премахни маркировките за заличаване
+	Rename bookmark	Преименувай отметката
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Изобразяване: hayro (bootstrap) · Интерфейс: egui · Икони: Lucide (ISC) · Шрифтове: Inter, JetBrains Mono, Dancing Script (OFL)
+	Replace page	Замени страницата
+	Resize comment	Преоразмери коментара
+	Rotate image	Завърти изображението
+	Rotate page	Завърти страницата
+	Run JavaScript	Изпълни JavaScript
+	Save as PDF/A-1b	Запиши като PDF/A-1b
+	Save as PDF/A-2b	Запиши като PDF/A-2b
+	Save as PDF/A-3b	Запиши като PDF/A-3b
+	Save as PDF/UA	Запиши като PDF/UA
+	Save as PDF/X	Запиши като PDF/X
+	Select a file for the stamp	Изберете файл за печата
+	Select Icon	Избери икона
+	Set bookmark destination	Задай местоназначение на отметката
+	Set status Accepted	Задай състояние „Прието“
+	Set status Cancelled	Задай състояние „Отменено“
+	Set status Completed	Задай състояние „Завършено“
+	Set status None	Задай състояние „Няма“
+	Set status Rejected	Задай състояние „Отхвърлено“
+	Set status Unmarked	Задай състояние „Неотбелязано“
+	Set tab order	Задай реда на обхождане
+	Set the image of {name}	Задай изображението на {name}
+	Spreadsheet (.xlsx)	Електронна таблица (.xlsx)
+	Square	Квадрат
+	Star	Звезда
+	The document has additional actions (/AA)	Документът има допълнителни действия (/AA)
+	The document has document-level JavaScript	Документът съдържа JavaScript на ниво документ
+	the document has no form fields	документът няма полета на формуляр
+	the document has no page tree	документът няма дърво на страниците
+	the document has no tags	документът няма тагове
+	The document has no XMP metadata	Документът няма XMP метаданни
+	The document is encrypted	Документът е шифрован
+	the document is protected by a password	документът е защитен с парола
+	The form asks viewers to make appearances (NeedAppearances)	Формулярът изисква от програмите за преглед да генерират изгледите на полетата (NeedAppearances)
+	the image is empty	изображението е празно
+	The operation failed.	Операцията е неуспешна.
+	the password is incorrect	паролата е грешна
+	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	моделите за разпознаване на текст не са инсталирани (изпълнете `cargo xtask models` или задайте PRINTCRAFT_MODELS)
+	The title in the metadata and the document information differ	Заглавието в метаданните и в информацията за документа се различават
+	the title must not be empty	заглавието не може да е празно
+	there are no pages to print	няма страници за печат
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	този документ е подписан: презаписването му би обезсилило подписите (вместо това го запишете инкрементално)
+	this file isn't XFDF, FDF, XML or text form data	този файл не е XFDF, FDF, XML или текстови данни на формуляр
+	This page couldn't be displayed.\n{e}	Тази страница не може да бъде показана.\n{e}
+	Type your {what}.	Въведете {what}.
+	Unknown	Неизвестно
+	Unlock comment	Отключи коментара
+	Update background	Актуализирай фона
+	Update header & footer	Актуализирай горния и долния колонтитул
+	Update watermark	Актуализирай водния знак
+	Your name	Вашето име
+	Change {what}	Промени {what}
+	Cut and stack	Изрежи и подреди
+	Default workspace mode	Режим на работното пространство по подразбиране
+	Default page display	Показване на страниците по подразбиране
+	Default zoom	Мащаб по подразбиране
+	Documents and view	Документи и изглед
+	Fit one full page	Побери една цяла страница
+	Fit to width scrolling	Побери по ширина с превъртане
+	Open email app	Отвори имейл приложението
+	Open link	Отвори връзката
+	Open this web page?	Да се отвори ли тази уебстраница?
+	Page display: {layout}	Показване на страниците: {layout}
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Скриптовете се изпълняват в изолирана среда без достъп до файлове или мрежа. Скрипт, който иска да отвори уебстраница, първо се нуждае от вашето разрешение. При изключен JavaScript стандартните функции на Acrobat за форматиране, валидиране и изчисляване продължават да работят.
+	Sign yourself	Подпишете сами
+	Switch to two-page view first to show the cover page	Първо превключете към изглед с две страници, за да се покаже корицата
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Разпознаването на текст не е инсталирано: моделите му липсват (изпълнете `cargo xtask models` или задайте PDFCRAFT_MODELS).
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Използва се при отваряне на PDF файлове. Изрично зададен режим при стартиране или управление има предимство за сесията.
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Използва се, когато PDF файлът не задава оформление или мащаб. Непрекъснатото превъртане никога не спира на границите между страниците.
+	Write this email?	Да се напише ли този имейл?
+	{who} in this document wants to open this address in your browser:	{who} в този документ иска да отвори този адрес в браузъра ви:
+	{who} in this document wants to open your email app with this address:	{who} в този документ иска да отвори имейл приложението ви с този адрес:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Този уеб адрес смесва букви от различни азбуки — често използван начин за имитиране на името на друг сайт.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Този уеб адрес използва букви от друга азбука, които може да изглеждат като познати.
+	CheckBox	Квадратче за отметка
+	Create link	Създай връзка
+	Duplicate field	Дублирай полето
+	Replace pages	Замени страници
+	Set alternate text	Задай алтернативен текст
+	nothing to redo	няма какво да се повтори
+	nothing to undo	няма какво да се отмени
+	pages	страници
+	there are no redaction marks to apply	няма маркировки за заличаване, които да бъдат приложени
+	Create PDF from images	Създай PDF от изображения
+	Selected image files: {count}	Избрани файлове с изображения: {count}
+	Use image resolution	Използвай разделителната способност на изображението
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Използва се вградената DPI стойност на всяко изображение; при липса се използва 72 DPI.
+	Use 72 DPI (one point per pixel)	Използвай 72 DPI (една точка на пиксел)
+	Use custom DPI	Използвай потребителска DPI стойност
+	DPI sets the printed page size without resampling the image.	DPI определя размера на отпечатаната страница без преизчисляване на изображението.
+	Create	Създай
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Динамичен XFA формуляр, оформен по своя шаблон: {pages}, {fields}.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA формуляр: полетата и XFA данните му се поддържат синхронизирани, така че другите програми за преглед показват попълненото от вас.
+@plural	{n} page|{n} pages	{n} страница|{n} страници
+@plural	{n} field|{n} fields	{n} поле|{n} полета
+	Created a PDF from {n} files	Създаден е PDF от {n} файла
+	PDF, images and text	PDF, изображения и текст
+	Insert a file before page {label}	Вмъкни файл преди страница {label}
+	Insert a file at the end	Вмъкни файл в края
+	Save pages	Запиши страниците
+	Save these pages as one PDF	Запиши тези страници като един PDF файл
+	No changes to save	Няма промени за записване
+	Created a PDF from {n} files; left out: {names}	Създаден е PDF от {n} файла; пропуснати: {names}
+	Created a PDF from the first {n} files	Създаден е PDF от първите {n} файла
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Нито един от тези файлове не може да бъде превърнат в PDF; използвайте PDF файлове, изображения или .txt файлове
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Изберете PNG или JPEG изображение (до 4 MiB). Прозрачността се запазва.
+	Couldn't import the signature image: {e}	Изображението на подписа не може да бъде импортирано: {e}
+	Go to page…	Отиди на страница…
+	Files are combined in this order. Leave Pages empty to take every page.	Файловете се обединяват в този ред. Оставете „Страници“ празно, за да се вземат всички страници.
+comment menu	Edit	Редактирай
+	Undo {action}	Отмени {action}
+	Redo {action}	Повтори {action}
+signature pad	Type	Въвеждане
+action wizard	Start	Старт
+	Margins (in)	Полета (in)
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 8eb90b02..0e823cf9 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -87,7 +87,7 @@ fn plural_russian(n: u64) -> usize {
 }
 
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 10] = [
+pub static LANGUAGES: [LangInfo; 11] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -104,6 +104,8 @@ pub static LANGUAGES: [LangInfo; 10] = [
     LangInfo { code: "fr", name: "Français", source: include_str!("fr.tsv"), plural: plural_fr, catalog: OnceLock::new() },
     // Russian; every `ru-*` locale (`ru-RU`, `ru-BY`, `ru-KZ` ...) resolves here.
     LangInfo { code: "ru", name: "Русский", source: include_str!("ru.tsv"), plural: plural_russian, catalog: OnceLock::new() },
+    // Bulgarian; every `bg-*` locale (`bg-BG`) resolves here.
+    LangInfo { code: "bg", name: "Български", source: include_str!("bg.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
     // Telugu; every `te-*` locale (`te-IN`) resolves here.
     LangInfo { code: "te", name: "తెలుగు", source: include_str!("te.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
 ];
@@ -1229,6 +1231,109 @@ mod tests {
         set_current(Lang::EN);
     }
 
+    #[test]
+    fn bulgarian_is_registered() {
+        let bg = Lang::from_code("bg").expect("bg registered");
+        assert_eq!(bg.name(), "Български");
+        assert_eq!(normalize_pref("BG"), Some("bg"));
+        assert_eq!(lang_from_tag("bg_BG.UTF-8"), Some(bg));
+        assert_eq!(lang_from_tag("bg-BG"), Some(bg));
+        assert_eq!(first_supported("bg-BG\r\nen-US"), Some(bg));
+        assert_eq!(tr(bg, "File"), "Файл");
+        assert_eq!(tr(bg, "Save as…"), "Запиши като…");
+        assert_eq!(tr(bg, "Bookmarks"), "Отметки");
+        assert_eq!(tr(bg, "Layers"), "Слоеве");
+        assert_eq!(tr(bg, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
+        // one (1), other (0, 2+)
+        assert_eq!((0..=3).map(|n| (bg.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+        assert_eq!(trn(bg, 0, "{n} page", "{n} pages"), "0 страници");
+        assert_eq!(trn(bg, 1, "{n} page", "{n} pages"), "1 страница");
+        assert_eq!(trn(bg, 2, "{n} page", "{n} pages"), "2 страници");
+        assert_eq!(trn(bg, 21, "{n} page", "{n} pages"), "21 страници");
+        assert_eq!(trn(bg, 1, "{n} field", "{n} fields"), "1 поле");
+        assert_eq!(trn(bg, 5, "{n} field", "{n} fields"), "5 полета");
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", "bg").unwrap();
+        assert_eq!(app.language, "bg");
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, "bg");
+    }
+
+    /// Bulgarian translates every registered command and every All tools group, section and item.
+    #[test]
+    fn bulgarian_covers_commands_and_catalogue() {
+        let bg = Lang::from_code("bg").expect("bg registered");
+        for command in pdfcraft_engine::commands::COMMANDS {
+            assert!(has(bg, command.label), "missing command: {}", command.label);
+            if let Some(menu) = command.menu {
+                assert!(has(bg, menu), "missing menu: {menu}");
+            }
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            assert!(has(bg, group.label), "missing group: {}", group.label);
+            for section in group.sections {
+                assert!(has(bg, section.title), "missing section: {}", section.title);
+                for item in section.items {
+                    assert!(has(bg, item.label), "missing item: {}", item.label);
+                }
+            }
+        }
+    }
+
+    /// New tl!("literal") labels must not silently fall back to English.
+    #[test]
+    fn bulgarian_covers_ui_literals() {
+        let bg = Lang::from_code("bg").expect("bg registered");
+        let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+        let mut literals = std::collections::BTreeSet::new();
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(dir).expect("UI source directory") {
+                let path = entry.expect("UI source entry").path();
+                if path.is_dir() {
+                    if path.file_name().is_some_and(|name| name != "i18n") {
+                        stack.push(path);
+                    }
+                } else if path.extension().is_some_and(|ext| ext == "rs") {
+                    let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n");
+                    let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+                    while let Some((_, after)) = rest.split_once("tl!(\"") {
+                        let mut escaped = false;
+                        let end = after
+                            .char_indices()
+                            .find_map(|(i, c)| {
+                                if c == '"' && !escaped {
+                                    return Some(i);
+                                }
+                                escaped = c == '\\' && !escaped;
+                                None
+                            })
+                            .expect("closed tl! literal");
+                        let (raw, tail) = after.split_at(end);
+                        if tail.starts_with("\")") {
+                            let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
+                            literals.insert(label);
+                        }
+                        rest = tail.strip_prefix('"').expect("closing quote");
+                    }
+                }
+            }
+        }
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(bg, label)).collect();
+        assert!(missing.is_empty(), "untranslated Bulgarian UI literals: {missing:#?}");
+    }
+
+    #[test]
+    fn bulgarian_diagnostics_preserve_user_values() {
+        let bg = Lang::from_code("bg").expect("bg registered");
+        set_current(bg);
+        assert_eq!(action_label("Custom action {n}"), "Custom action {n}");
+        assert_eq!(fmt(t("{n} pages selected"), &[("n", "3")]), "Избрани страници: 3");
+        assert_eq!(tr(bg, "CheckBox"), "Квадратче за отметка");
+        set_current(Lang::EN);
+    }
+
     /// Every bundled catalog is well-formed and consistent with its sources.
     #[test]
     fn bundled_catalogs_are_consistent() {
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index 60c3f3c2..460de28a 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -162,7 +162,7 @@ fn ui_fonts_work_without_craft_fonts() {
     theme::install_fonts(&ctx);
 }
 
-/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, Spanish, French, Russian) are drawn entirely by the app's own faces
+/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, Spanish, French, Russian, Bulgarian) are drawn entirely by the app's own faces
 /// (Inter, JetBrains Mono): no letter falls through to egui's defaults or a CJK fallback. (egui's
 /// `has_glyphs` can't answer this: with only the primary face it is also the replacement face.)
 #[test]
@@ -175,6 +175,7 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
         ("es", include_str!("../src/i18n/es.tsv")),
         ("fr", include_str!("../src/i18n/fr.tsv")),
         ("ru", include_str!("../src/i18n/ru.tsv")),
+        ("bg", include_str!("../src/i18n/bg.tsv")),
     ] {
         let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜ¿¡«»…");
         for line in catalog.lines().filter(|l| !l.starts_with('#')) {
diff --git a/docs/localization.md b/docs/localization.md
index d8cff091..ceefd815 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,8 +1,8 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Čeština**, **Português (Brasil)**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, and Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
@@ -10,11 +10,11 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `cs`, `pt-br`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `cs`, `pt-br`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Czech, Brazilian Portuguese, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
+Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 
 There is no right-to-left interface language yet. File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
 

From 8c90a8d1fd4b2a843680136ce5cacf387f0e51ed Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Fri, 9 Oct 2026 15:21:21 +0200
Subject: [PATCH 061/149] M2: bound lopdf predictor scratch to available
 samples (#470)

* M2: bound lopdf predictor scratch to available samples

Return empty PNG predictor frames before allocating row buffers. Reject
overflowing packed TIFF row dimensions and bound component scratch to the
samples present in the input, aligning with the existing lopdf#589 fix.

Cover hostile dimensions and valid packed rows with synthetic regressions
and record the vendored patch and its upstream proposal.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* Keep main's M1 roadmap row after merging main

---------

Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                      |  3 +-
 crates/render/src/inspect.rs    | 59 +++++++++++++++++++++++++++++++++
 vendor/README.md                |  2 +-
 vendor/lopdf/src/filters/png.rs |  7 +++-
 vendor/lopdf/src/object.rs      | 12 +++++--
 5 files changed, 77 insertions(+), 6 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index a7fc14b1..f3ded5ca 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -90,8 +90,8 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M | Milestone | Est. hours | Done | Remaining (h) | Notes |
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 92% | 2–4 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
+| M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input. Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
@@ -138,6 +138,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, document inspection):** Annotation dates preserve non-date Unicode text instead of panicking while opening; failed auxiliary structure inspection keeps renderer page geometry and reports a warning. Synthetic UTF16BE annotation, UTF8-boundary and independent panic regressions cover the fix. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, Home pinned folders):** Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 03af9fa2..5ff23cb9 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -1013,6 +1013,65 @@ mod tests {
         assert_eq!(lopdf::filters::png::decode_frame(&[0, 1, 2, 3, 2, 1, 1, 1], 1, 3).unwrap(), [1, 2, 3, 2, 3, 4]);
     }
 
+    #[test]
+    fn empty_png_predictor_frames_do_not_allocate_rows() {
+        // usize::MAX cannot be reserved, so the old code safely errors before allocating.
+        // An empty frame needs no rows regardless of the declared width.
+        assert!(lopdf::filters::png::decode_frame(&[], 1, usize::MAX).unwrap().is_empty());
+    }
+
+    fn tiff_predictor_stream(data: Vec<u8>, columns: i64, colors: i64, bits: i64) -> lopdf::Stream {
+        let mut params = lopdf::Dictionary::new();
+        params.set("Predictor", 2i64);
+        params.set("Columns", columns);
+        params.set("Colors", colors);
+        params.set("BitsPerComponent", bits);
+        let mut dict = lopdf::Dictionary::new();
+        dict.set("DecodeParms", params);
+        let mut stream = lopdf::Stream::new(dict, data);
+        stream.compress().unwrap();
+        assert_eq!(stream.dict.get(b"Filter").unwrap().as_name().unwrap(), b"FlateDecode");
+        stream
+    }
+
+    #[test]
+    fn tiff_subbyte_predictor_row_width_overflow_is_refused() {
+        // Each multiplication overflows before any scratch allocation in the old debug build.
+        for bits in [1, 2, 4] {
+            let stream = tiff_predictor_stream(vec![0; 64], i64::MAX, 3, bits);
+            assert!(
+                matches!(stream.decompressed_content_with_limit(64), Err(lopdf::Error::Decompress(lopdf::DecompressError::Predictor(_)))),
+                "{bits}-bit row"
+            );
+        }
+    }
+
+    #[test]
+    fn tiff_subbyte_predictor_scratch_is_bounded_by_available_samples() {
+        // 1/2-bit row widths fit usize on 32- and 64-bit hosts; Colors previously made Vec<u16>
+        // reject the capacity before allocating. A partial row has no preceding pixel.
+        for bits in [1, 2] {
+            let data = vec![0b1010_0110; 64];
+            let stream = tiff_predictor_stream(data.clone(), 1, i64::try_from(isize::MAX).unwrap(), bits);
+            assert_eq!(stream.decompressed_content_with_limit(64).unwrap(), data, "{bits}-bit row");
+        }
+    }
+
+    #[test]
+    fn tiff_subbyte_predictors_keep_components_rows_and_padding() {
+        // Repeated tiny rows compress through the public Stream API. Rows remain independent,
+        // differences wrap at each component depth, and trailing padding bits survive.
+        for (columns, colors, bits, encoded, decoded) in [
+            (16, 1, 1, vec![255, 170, 8, 255], vec![170, 204, 15, 85]),
+            (6, 1, 2, vec![85, 179], vec![108, 147]),
+            (3, 1, 4, vec![25, 16], vec![26, 176]),
+            (2, 2, 4, vec![18, 34], vec![18, 52]),
+        ] {
+            let stream = tiff_predictor_stream(encoded.repeat(32), columns, colors, bits);
+            assert_eq!(stream.decompressed_content_with_limit(128).unwrap(), decoded.repeat(32), "{bits}-bit, {colors} colours");
+        }
+    }
+
     #[test]
     fn view_and_user_space_round_trip_for_every_rotation() {
         for rotation in [0u16, 90, 180, 270] {
diff --git a/vendor/README.md b/vendor/README.md
index bfa7029a..e791b914 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -11,7 +11,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second |
-| lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows); (2) predictor row widths use saturating arithmetic | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating` |
+| lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream` |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
diff --git a/vendor/lopdf/src/filters/png.rs b/vendor/lopdf/src/filters/png.rs
index e9390799..027097f4 100644
--- a/vendor/lopdf/src/filters/png.rs
+++ b/vendor/lopdf/src/filters/png.rs
@@ -86,10 +86,15 @@ pub fn decode_row(filter: FilterType, bpp: usize, previous: &[u8], current: &mut
 }
 
 pub fn decode_frame(content: &[u8], bpp: usize, bytes_per_row: usize) -> Result<Vec<u8>> {
+    // PdfCraft patch: an empty frame needs no row buffers, even for an absurd declared width.
+    if content.is_empty() {
+        return Ok(Vec::new());
+    }
+
     // PdfCraft patch: each row is a filter byte plus `bytes_per_row` bytes, so a row longer
     // than the data can never be read (`read_exact` below fails). Refuse it before allocating:
     // a fuzzed `/Columns 4294967295` allocated two 4 GiB rows here.
-    if !content.is_empty() && bytes_per_row >= content.len() {
+    if bytes_per_row >= content.len() {
         return Err(Error::new(ErrorKind::InvalidData, "PNG predictor row is longer than the data"));
     }
     let mut previous = Vec::new();
diff --git a/vendor/lopdf/src/object.rs b/vendor/lopdf/src/object.rs
index 843d80ac..a406e44d 100644
--- a/vendor/lopdf/src/object.rs
+++ b/vendor/lopdf/src/object.rs
@@ -1277,7 +1277,12 @@ impl Stream {
                 }
             }
             1 | 2 | 4 => {
-                let stride = (columns * colors * bits).div_ceil(8);
+                // PdfCraft patch: reject overflowing packed row widths (lopdf#589).
+                let stride = columns
+                    .checked_mul(colors)
+                    .and_then(|samples| samples.checked_mul(bits))
+                    .ok_or(DecompressError::Predictor("predictor row size overflows"))?
+                    .div_ceil(8);
                 if stride > 0 {
                     for row in data.chunks_mut(stride) {
                         Self::reverse_tiff_predictor2_subbyte(row, columns, colors, bits);
@@ -1299,8 +1304,9 @@ impl Stream {
     /// `2^bits`, then repacked MSB-first; the row's trailing padding bits are kept.
     fn reverse_tiff_predictor2_subbyte(row: &mut [u8], columns: usize, colors: usize, bits: usize) {
         let mask = (1u16 << bits) - 1;
-        let samples = columns.saturating_mul(colors).min(row.len() * 8 / bits); // PdfCraft patch: saturating
-        let mut acc = vec![0u16; colors];
+        // PdfCraft patch: bound scratch to the samples present in the input (lopdf#589).
+        let samples = columns.saturating_mul(colors).min(row.len().saturating_mul(8 / bits));
+        let mut acc = vec![0u16; colors.min(samples)];
         let mut out = vec![0u8; row.len()];
         let mut in_bit = 0usize;
         let mut out_buf = 0u32;

From 32fbef684a00c352868988a70d77b9e39f5f1833 Mon Sep 17 00:00:00 2001
From: midasdf <205497066+midasdf@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:21:31 +0900
Subject: [PATCH 062/149] M5.7: keep natural image stamps upright on rotated
 pages (#473)

Refs #434 (partial). Preserve displayed bounds and standard appearance orientation through stamp edits; image signatures and explicit rectangles remain outside this fix.

Assisted-by: OpenAI GPT-6.1 (gpt-6.1-sol)

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                            |  1 +
 crates/annot/README.md                |  4 ++
 crates/annot/src/lib.rs               | 41 ++++++++++++++++-
 crates/automation/tests/automation.rs | 41 +++++++++++++++++
 crates/engine/src/lib.rs              |  9 ++--
 crates/engine/src/tests.rs            | 64 +++++++++++++++++++++++++++
 crates/organize/src/lib.rs            |  7 +++
 crates/organize/src/tests.rs          | 12 +++++
 crates/ui-egui/tests/stamps.rs        | 42 ++++++++++++++++++
 9 files changed, 217 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index f3ded5ca..cad37c68 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -125,6 +125,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 ## Log
 
+- **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
 
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
diff --git a/crates/annot/README.md b/crates/annot/README.md
index 38ad68b5..4d0fa7c9 100644
--- a/crates/annot/README.md
+++ b/crates/annot/README.md
@@ -40,6 +40,10 @@ deterministic; the engine supplies them.
   never paint a second icon.
 - Resizing a stamp changes its `/Rect` and preserves its original appearance and resources;
   viewers scale that appearance into the new rectangle. Locked stamps refuse the edit.
+- Natural-size image stamps placed by the engine counterrotate their appearance on rotated
+  pages. Image restyling retains that appearance matrix. Explicit rectangles, image signatures
+  and PDF-page stamps still use their existing placement behavior; page-rotation support for
+  those paths is not complete.
 
 ## Not yet
 
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index 18174c58..ff553ac2 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -1096,12 +1096,51 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
     Ok(index)
 }
 
+/// Counterrotate a newly placed image stamp's appearance into displayed-page axes.
+/// The normal appearance's transformed bounding box is fitted to `/Rect` by PDF viewers.
+pub fn orient_image_stamp(doc: &mut Document, page: usize, index: usize, rotation: i64) -> Result<(), AnnotError> {
+    let matrix = match rotation {
+        90 => [0.0, 1.0, -1.0, 0.0, 0.0, 0.0],
+        180 => [-1.0, 0.0, 0.0, -1.0, 0.0, 0.0],
+        270 => [0.0, -1.0, 1.0, 0.0, 0.0, 0.0],
+        _ => return Ok(()),
+    };
+    let (_, r) = annot_ref(doc, page, index)?;
+    let d = annot_dict(doc, r);
+    if d.name(b"Subtype") != Some(b"Stamp") || !matches!(d.get(b"PCPictureImage"), Some(Object::Bool(true))) {
+        return Err(AnnotError::Invalid("only an image stamp can be oriented".into()));
+    }
+    let normal = d
+        .get(b"AP")
+        .map(|ap| doc.resolve(ap))
+        .and_then(|ap| ap.as_dict().and_then(|ap| ap.reference(b"N")))
+        .ok_or_else(|| AnnotError::Invalid("the stamp has no normal appearance".into()))?;
+    let Object::Stream(mut stream) = doc.get(normal).as_ref().clone() else {
+        return Err(AnnotError::Invalid("the stamp's normal appearance is not a stream".into()));
+    };
+    stream.dict.set(b"Matrix".to_vec(), num_array(&matrix));
+    doc.set(normal, Object::Stream(stream));
+    Ok(())
+}
+
 /// (Re)generate `/AP /N` for the annotation `r` from its dictionary.
 /// Regenerate an annotation's normal appearance from its dictionary.
 pub fn set_appearance(doc: &mut Document, r: ObjRef) -> Result<(), AnnotError> {
     let d = annot_dict(doc, r);
     let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
-    let Some(stream) = appearance::build(&d) else { return Err(AnnotError::Unsupported(subtype)) };
+    let Some(mut stream) = appearance::build(&d) else { return Err(AnnotError::Unsupported(subtype)) };
+    // Image stamp restyling must retain the placement's page-axis correction.
+    if matches!(d.get(b"PCPictureImage"), Some(Object::Bool(true))) {
+        let matrix = d.get(b"AP").and_then(|ap| {
+            let ap = doc.resolve(ap);
+            let normal = doc.resolve(ap.as_dict()?.get(b"N")?);
+            let Object::Stream(normal) = normal.as_ref() else { return None };
+            normal.dict.get(b"Matrix").cloned()
+        });
+        if let Some(matrix) = matrix {
+            stream.dict.set(b"Matrix".to_vec(), matrix);
+        }
+    }
     let ap = doc.add(Object::Stream(stream));
     let mut apd = Dict::new();
     apd.set(b"N".to_vec(), Object::Ref(ap));
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index c287d7c4..b935a6f5 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1883,6 +1883,47 @@ fn comments_and_form_data_travel_as_xfdf_fdf_and_text() {
     assert_eq!(r["undo"], "Import all.xfdf");
 }
 
+#[test]
+fn natural_image_stamps_through_tools_on_rotated_pages() {
+    for degrees in [0, 90, 180, 270] {
+        let dir = workdir(&format!("natural-stamps-{degrees}"));
+        let mut bytes = Vec::new();
+        {
+            let mut encoder = png::Encoder::new(&mut bytes, 80, 40);
+            encoder.set_color(png::ColorType::Rgb);
+            encoder.set_depth(png::BitDepth::Eight);
+            let pixels: Vec<u8> = (0..40)
+                .flat_map(|y| {
+                    (0..80).flat_map(move |x| {
+                        [[240, 20, 20], [20, 180, 20], [20, 20, 240], [230, 180, 20]][usize::from(y >= 20) * 2 + usize::from(x >= 40)]
+                    })
+                })
+                .collect();
+            encoder.write_header().unwrap().write_image_data(&pixels).unwrap();
+        }
+        std::fs::write(dir.join("quadrants.png"), bytes).unwrap();
+        let mut a = auto(&dir);
+        let doc = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+        ok(&mut a, "page_rotate", json!({"doc":doc,"pages":[1],"degrees":degrees}));
+        ok(&mut a, "stamp_custom", json!({"doc":doc,"page":1,"path":"quadrants.png","at":[100,100]}));
+        let rendered = a.call("page_render", &json!({"doc":doc,"page":1,"dpi":72})).unwrap();
+        let Content::Png { data, .. } = &rendered[0] else { panic!("expected PNG") };
+        let mut reader = png::Decoder::new(std::io::Cursor::new(data)).read_info().unwrap();
+        let mut pixels = vec![0; reader.output_buffer_size().unwrap()];
+        let info = reader.next_frame(&mut pixels).unwrap();
+        assert_eq!(info.color_type, png::ColorType::Rgba);
+        for ((x, y), colour) in [(80, 90), (120, 90), (80, 110), (120, 110)].into_iter().zip([
+            [240, 20, 20, 255],
+            [20, 180, 20, 255],
+            [20, 20, 240, 255],
+            [230, 180, 20, 255],
+        ]) {
+            let offset = ((y * info.width + x) * 4) as usize;
+            assert_eq!(&pixels[offset..offset + 4], &colour, "page rotation {degrees}");
+        }
+    }
+}
+
 #[test]
 fn stamps_through_tools() {
     let dir = workdir("stamps");
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 22dd3d4c..fb68ea93 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -1451,9 +1451,11 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
         Edit::AddCustomStamp { page, rect, name, file, author } => {
             let src = mark_source(doc, file)?;
             let (sw, sh) = (src.size.0.max(1.0), src.size.1.max(1.0));
-            let rect = if rect[2] == rect[0] && rect[3] == rect[1] {
+            let natural = rect[2] == rect[0] && rect[3] == rect[1];
+            let rotation = if natural && src.image { pdfcraft_organize::page_rotation(doc, *page)? } else { 0 };
+            let rect = if natural {
                 let k = (200.0 / sw.max(sh)).min(1.0);
-                let (w, h) = (sw * k, sh * k);
+                let (w, h) = if matches!(rotation, 90 | 270) { (sh * k, sw * k) } else { (sw * k, sh * k) };
                 [rect[0] - w / 2.0, rect[1] - h / 2.0, rect[0] + w / 2.0, rect[1] + h / 2.0]
             } else {
                 *rect
@@ -1461,7 +1463,8 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             let shape = Shape::CustomStamp { rect, name: name.clone(), picture: src.xobject, image: src.image, size: (sw, sh) };
             let style = pdfcraft_annot::Style::default_for(&shape);
             let new = NewAnnotation { page: *page, shape, style, contents: name.clone(), author: author.clone() };
-            pdfcraft_annot::add_annotation(doc, &new, &cx.meta())?;
+            let index = pdfcraft_annot::add_annotation(doc, &new, &cx.meta())?;
+            pdfcraft_annot::orient_image_stamp(doc, *page, index, rotation)?;
         }
         Edit::DeleteAnnotation { page, index } => pdfcraft_annot::delete_annotation(doc, *page, *index)?,
         Edit::SetAnnotationContents { page, index, text } => pdfcraft_annot::set_contents(doc, *page, *index, text, &cx.meta())?,
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index a5815229..308c5aed 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -36,6 +36,70 @@ fn session_with(n: usize) -> (Session, DocId) {
     (s, id)
 }
 
+#[test]
+fn custom_image_stamp_keeps_displayed_orientation_on_rotated_pages() {
+    let colours = [[240, 20, 20, 255], [20, 180, 20, 255], [20, 20, 240, 255], [230, 180, 20, 255]];
+    let image = image::RgbaImage::from_fn(80, 40, |x, y| image::Rgba(colours[usize::from(y >= 20) * 2 + usize::from(x >= 40)]));
+    let mut png = std::io::Cursor::new(Vec::new());
+    image.write_to(&mut png, image::ImageFormat::Png).unwrap();
+    let bytes = Arc::new(png.into_inner());
+    for degrees in [0, 90, 180, 270] {
+        let (mut session, id) = session_with(1);
+        session.apply(id, Edit::RotatePages { pages: vec![0], degrees }).unwrap();
+        let at = session.get(id).unwrap().info.pages[0].view_to_user(100.0, 100.0).map(f64::from);
+        session
+            .apply(
+                id,
+                Edit::AddCustomStamp {
+                    page: 0,
+                    rect: [at[0], at[1], at[0], at[1]],
+                    name: "Original quadrants".into(),
+                    file: MarkFile { name: "quadrants.png".into(), bytes: bytes.clone(), page: 0 },
+                    author: "Test".into(),
+                },
+            )
+            .unwrap();
+        let check = |session: &Session, points: [(u32, u32); 4]| {
+            let doc = session.get(id).unwrap();
+            let mut renderer = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), doc.config.clone());
+            let rendered = renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+            assert!(rendered.error.is_none(), "{:?}", rendered.error);
+            for ((x, y), colour) in points.into_iter().zip(colours) {
+                let offset = ((y * rendered.width + x) * 4) as usize;
+                assert_eq!(&rendered.rgba[offset..offset + 4], &colour, "page rotation {degrees}; displayed point ({x}, {y})");
+            }
+        };
+        let points = [(80, 90), (120, 90), (80, 110), (120, 110)];
+        check(&session, points);
+        let info = session.get(id).unwrap().info.pages[0].clone();
+        let rect = session.get(id).unwrap().info.annotations[0].rect;
+        let a = info.user_to_view(rect[0], rect[1]);
+        let b = info.user_to_view(rect[2], rect[3]);
+        let bounds = [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])];
+        for (actual, expected) in bounds.into_iter().zip([60.0, 80.0, 140.0, 120.0]) {
+            assert!((actual - expected).abs() < 0.0001, "displayed bounds {bounds:?}");
+        }
+        session.apply(id, Edit::StyleAnnotation { page: 0, index: 0, color: None, opacity: Some(1.0), width: None }).unwrap();
+        check(&session, points);
+        let resized = info.view_rect_to_user([40.0, 70.0, 160.0, 130.0]).map(f64::from);
+        session.apply(id, Edit::ResizeAnnotation { page: 0, index: 0, rect: resized }).unwrap();
+        let resized_points = [(70, 85), (130, 85), (70, 115), (130, 115)];
+        check(&session, resized_points);
+        session.undo(id).unwrap();
+        check(&session, points);
+        session.redo(id).unwrap();
+        check(&session, resized_points);
+        let from = info.view_to_user(100.0, 100.0);
+        let to = info.view_to_user(110.0, 115.0);
+        session.apply(id, Edit::MoveAnnotation { page: 0, index: 0, dx: f64::from(to[0] - from[0]), dy: f64::from(to[1] - from[1]) }).unwrap();
+        check(&session, [(80, 100), (140, 100), (80, 130), (140, 130)]);
+        session.undo(id).unwrap();
+        check(&session, resized_points);
+        session.redo(id).unwrap();
+        check(&session, [(80, 100), (140, 100), (80, 130), (140, 130)]);
+    }
+}
+
 fn page_texts(s: &Session, id: DocId) -> Vec<String> {
     let doc = s.get(id).unwrap();
     let config = pdfcraft_render::RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() };
diff --git a/crates/organize/src/lib.rs b/crates/organize/src/lib.rs
index 1b5d8347..59db2611 100644
--- a/crates/organize/src/lib.rs
+++ b/crates/organize/src/lib.rs
@@ -100,6 +100,13 @@ pub fn pages(doc: &Document) -> Result<Vec<PageRef>, OrganizeError> {
     Ok(walk(doc)?.into_iter().map(|(obj, _)| PageRef { obj }).collect())
 }
 
+/// Effective inherited page rotation, clockwise in degrees.
+pub fn page_rotation(doc: &Document, index: usize) -> Result<i64, OrganizeError> {
+    let pages = walk(doc)?;
+    let (_, attrs) = pages.get(index).ok_or(OrganizeError::NoSuchPage(index))?;
+    Ok(attrs.int(b"Rotate").unwrap_or(0).rem_euclid(360))
+}
+
 pub fn page_count(doc: &Document) -> Result<usize, OrganizeError> {
     Ok(walk(doc)?.len())
 }
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index cff9f984..a7b12af3 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -4,6 +4,18 @@ use pdfcraft_cos::{Document, Object, SaveOptions, write_full, write_incremental}
 
 use super::*;
 
+#[test]
+fn page_rotation_resolves_inheritance_overrides_and_missing_pages() {
+    let mut doc = Document::open(Arc::new(fixture())).unwrap();
+    for page in 0..3 {
+        assert_eq!(page_rotation(&doc, page).unwrap(), 90);
+    }
+    rotate_pages(&mut doc, &[1], -180).unwrap();
+    assert_eq!(page_rotation(&doc, 1).unwrap(), 270);
+    assert_eq!(page_rotation(&doc, 0).unwrap(), 90);
+    assert_eq!(page_rotation(&doc, 3), Err(OrganizeError::NoSuchPage(3)));
+}
+
 /// A 3-page document with a nested page tree. MediaBox and Rotate are inherited from the root,
 /// Resources from an intermediate node; each page's content says which page it is.
 fn fixture() -> Vec<u8> {
diff --git a/crates/ui-egui/tests/stamps.rs b/crates/ui-egui/tests/stamps.rs
index ddb24e6a..66144da5 100644
--- a/crates/ui-egui/tests/stamps.rs
+++ b/crates/ui-egui/tests/stamps.rs
@@ -44,6 +44,48 @@ fn choosing_and_placing_stamps() {
     }
 }
 
+#[test]
+fn natural_image_stamps_keep_displayed_bounds_on_rotated_pages() {
+    for degrees in [0, 90, 180, 270] {
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+            let mut app = PdfCraftApp::new();
+            app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
+            let id = app.views[0].id;
+            app.session.apply(id, pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees }).unwrap();
+            app.set_option("zoom", "100").unwrap();
+            app
+        });
+        h.run_steps(6);
+        assert!(h.state_mut().execute("comment.stamp"));
+        let mut png = Vec::new();
+        image::RgbImage::from_pixel(80, 40, image::Rgb([20, 120, 220]))
+            .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+            .unwrap();
+        h.state_mut().start_custom_stamp("rectangle.png".into(), png);
+        h.run_steps(2);
+        h.get_by_label("OK").click();
+        h.run_steps(2);
+        let page = h.state().views[0].page_screen_rect(0).unwrap();
+        let at = page.min + egui::vec2(page.width() * 0.5, page.height() * 0.6);
+        h.hover_at(at);
+        h.run_steps(1);
+        h.drag_at(at);
+        h.run_steps(1);
+        h.drop_at(at);
+        h.run_steps(4);
+        let app = h.state();
+        let doc = app.session.get(app.views[0].id).unwrap();
+        assert_eq!(app.quick_tool, QuickTool::Select);
+        let stamp = doc.info.annotations.iter().find(|a| a.subtype == "Stamp").unwrap();
+        let info = &doc.info.pages[0];
+        let a = info.user_to_view(stamp.rect[0], stamp.rect[1]);
+        let b = info.user_to_view(stamp.rect[2], stamp.rect[3]);
+        assert!(((a[0] - b[0]).abs() - 80.0).abs() < 0.001, "rotation {degrees}: {a:?}, {b:?}");
+        assert!(((a[1] - b[1]).abs() - 40.0).abs() < 0.001, "rotation {degrees}: {a:?}, {b:?}");
+        assert_eq!(doc.can_undo(), Some("Add stamp"));
+    }
+}
+
 #[test]
 fn creating_placing_and_keeping_custom_stamps() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {

From 49fb1b1b356e88b64a6d5e5a90543146e482c18a Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 09:21:57 -0400
Subject: [PATCH 063/149] Tests: one wgpu device compiles shaders at a time in
 fill_sign.rs (WARP ARM64 crash) (#395)

The image-signature tests (#335, #355) render pixels in parallel; on the
Windows 11 ARM64 runner WARP's pixel-shader JIT then crashes the test process
with STATUS_ACCESS_VIOLATION (3 of the last 4 main runs). Take the same GPU
lock tests/view.rs uses (d341651) in every fill_sign test that renders.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/tests/fill_sign.rs | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 2e85ff76..87dc0d59 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -13,6 +13,16 @@ const FIXTURE: &[u8] = b"%PDF-1.7
 trailer << /Root 1 0 R >>
 %%EOF";
 
+/// Tests that render pixels (`h.render()`) take this first, so only one wgpu device compiles
+/// shaders at a time: WARP's ARM64 pixel-shader JIT crashes when two do (see `tests/view.rs`).
+/// Declared before the harness, so it is released after the device is dropped.
+static GPU: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+fn gpu() -> std::sync::MutexGuard<'static, ()> {
+    // A test that panicked while holding it leaves nothing to clean up.
+    GPU.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+}
+
 fn harness() -> Harness<'static, PdfCraftApp> {
     harness_bytes(FIXTURE)
 }
@@ -361,6 +371,7 @@ fn browse_image(h: &mut Harness<'static, PdfCraftApp>, path: &std::path::Path) {
 
 #[test]
 fn image_signatures_and_initials_can_be_imported_placed_and_remembered() {
+    let _gpu = gpu();
     let path = signature_file("import");
     let mut h = harness();
     for (command, y, initials) in [("sign.fill.signature", 250.0, false), ("sign.fill.initials", 150.0, true)] {
@@ -426,6 +437,7 @@ fn image_signatures_and_initials_can_be_imported_placed_and_remembered() {
 
 #[test]
 fn image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation() {
+    let _gpu = gpu();
     // The block above the stroke is at its right end, away from the pointer's own cursor.
     let path = signature_file_with_mark("pointer", 100..110);
     let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
@@ -495,6 +507,7 @@ fn image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation()
 
 #[test]
 fn image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat() {
+    let _gpu = gpu();
     let path = signature_file("resize");
     let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
     let mut h = harness();
@@ -568,6 +581,7 @@ fn has_blue_near(pixels: &image::RgbaImage, p: Pos2) -> bool {
 
 #[test]
 fn image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles() {
+    let _gpu = gpu();
     // Original synthetic page content; a white patch over the old image would fail this test.
     const GREEN_PAGE: &[u8] = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n4 0 obj << /Length 36 >> stream\n0.8 1 0.7 rg 0 0 300 400 re f\nendstream\nendobj\ntrailer << /Root 1 0 R >>\n%%EOF";
     let mut h = harness_bytes(GREEN_PAGE);
@@ -680,6 +694,7 @@ fn image_signature_live_resize_and_move_preserve_background_and_hide_moving_hand
 
 #[test]
 fn embedded_image_signature_live_gestures_follow_document_and_view_rotation() {
+    let _gpu = gpu();
     let path = signature_file("live-rotations");
     let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
     for (document_rotation, view_rotation) in [(90, 0), (0, 90), (90, 270)] {
@@ -745,6 +760,7 @@ fn embedded_image_signature_live_gestures_follow_document_and_view_rotation() {
 
 #[test]
 fn image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen() {
+    let _gpu = gpu();
     let path = signature_file("aspect");
     let image = pdfcraft_engine::SignatureImage::read(std::fs::File::open(&path).unwrap()).unwrap();
     let mut h = harness();

From ee065835230ec1679983cddb8846624d629f69c2 Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 06:22:21 -0700
Subject: [PATCH 064/149] Never crash: JBIG2 symbol dictionaries can't loop
 without end (#408)

`cargo xtask fuzz` found a 1.1 KB page whose JBIG2 image never finished
decoding (over two minutes, flat memory). It differs from a valid file by
one byte inside a symbol dictionary's arithmetic-coded data. Past the end
of its data the arithmetic decoder keeps returning values, and two loops
in symbol.rs only move on when those values make progress:

- Export runs (6.5.10): a run of length 0 doesn't advance, and the
  decoder returned 0 for ever. This was the fuzz finding.
- Height classes (6.5.5): a class whose first width is already the
  end-of-class marker decodes no symbol. A read-only sweep of the crate
  found this one. In a synthetic dictionary every class after the first
  symbol adds 13 to the height and decodes nothing, so it only fails
  when the height overflows u32, after 330 million classes (about five
  seconds per image, logged); a delta of 0 would never end.

The sweep found every other loop in hayro-jbig2 bounded by a symbol,
instance or pixel cap or by the end of the data. Bounded is not cheap
everywhere: refinement bitmaps in text regions and aggregate symbols
(up to 10,000 instances of up to 2^28 pixels each) are not changed
here.

Vendored hayro-jbig2 patch (3): a valid dictionary needs at most one
height class per new symbol and `2 x symbols + 1` export runs (they
alternate, so at most one zero-length run before each symbol's). Both
loops get that budget plus `EXTRA_EMPTY_STEPS` (1024), then fail the
dictionary as invalid. Encoders don't write empty steps back to back,
so the slack only tolerates oddities.

The fuzz finding now renders in 0.2 s. Synthetic regression test in
render: two dictionaries of a few arbitrary bytes each, found by
searching for streams that decode the same way (no corpus bytes). The
height-class one is drawn as twenty images so that it stalls well past
the 20 s timeout without the patch on any machine. Each case is red
with its own budget removed and green with it.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/render/src/raster.rs             | 64 +++++++++++++++++++++++++
 vendor/README.md                        |  2 +-
 vendor/hayro-jbig2/src/decode/symbol.rs | 22 +++++++++
 3 files changed, 87 insertions(+), 1 deletion(-)

diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index f9512df4..cb6b4b8d 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1613,6 +1613,70 @@ trailer << /Root 1 0 R >>
         assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
     }
 
+    /// From `cargo xtask fuzz`: one changed byte in a symbol dictionary's arithmetic-coded data
+    /// hung the renderer. Two of its loops can stop advancing: an export run of length 0, and a
+    /// height class whose first width is already the end-of-class marker. Past the end of its
+    /// data the decoder can return those for ever. Vendored hayro-jbig2 patch: at most one height
+    /// class per new symbol and `2 × symbols + 1` export runs, each plus `EXTRA_EMPTY_STEPS`.
+    /// These synthetic dictionaries (two new symbols each, a few bytes of arbitrary data) decode
+    /// the same way. In the second every class after the first symbol adds 13 to the height, so it
+    /// only fails when the height overflows `u32`, after 330 million empty classes (about five
+    /// seconds; a delta of 0 would never end). The page draws it as twenty images, so that the
+    /// stall without the patch is well past the timeout on any machine.
+    #[test]
+    fn jbig2_symbol_dictionaries_that_never_advance_terminate() {
+        for (what, data, copies) in
+            [("zero-length export runs", &[0x05, 0x70, 0x05, 0x14, 0x02, 0x1d, 0x56, 0x3f][..], 1), ("empty height classes", &[0x06, 0x99][..], 20)]
+        {
+            // Embedded JBIG2 segments (ISO 14492 §7.2): page information, then a symbol dictionary.
+            let mut jbig2 = Vec::new();
+            let mut segment = |number: u32, kind: u8, data: &[u8]| {
+                jbig2.extend_from_slice(&number.to_be_bytes());
+                jbig2.extend_from_slice(&[kind, 0, 1]);
+                jbig2.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
+                jbig2.extend_from_slice(data);
+            };
+            let mut page = Vec::new();
+            page.extend_from_slice(&8u32.to_be_bytes());
+            page.extend_from_slice(&8u32.to_be_bytes());
+            page.extend_from_slice(&[0; 8]); // resolution
+            page.extend_from_slice(&[0, 0, 0]); // flags, striping
+            segment(0, 48, &page);
+            let mut dictionary = vec![0, 0]; // arithmetic coding, template 0, no refinement
+            dictionary.extend_from_slice(&[3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // AT pixels
+            dictionary.extend_from_slice(&1u32.to_be_bytes()); // exported symbols
+            dictionary.extend_from_slice(&2u32.to_be_bytes()); // new symbols
+            dictionary.extend_from_slice(data);
+            segment(1, 0, &dictionary);
+            // Each copy is its own image XObject (5, 6, …), all drawn by the page.
+            let images: Vec<usize> = (5..5 + copies).collect();
+            let mut content: String = images.iter().map(|n| format!("q 20 0 0 20 5 5 cm /Im{n} Do Q ")).collect();
+            content.push_str("1 0 0 rg 0 0 4 4 re f");
+            let names: String = images.iter().map(|n| format!("/Im{n} {n} 0 R ")).collect();
+            let mut pdf = format!("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << {names}>> >> >> endobj\n").into_bytes();
+            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+            for n in &images {
+                pdf.extend_from_slice(
+                    format!("{n} 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 8 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n", jbig2.len())
+                        .as_bytes(),
+                );
+                pdf.extend_from_slice(&jbig2);
+                pdf.extend_from_slice(b"\nendstream endobj\n");
+            }
+            pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+            let (tx, rx) = std::sync::mpsc::channel();
+            std::thread::spawn(move || {
+                let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+            });
+            let page = rx
+                .recv_timeout(std::time::Duration::from_secs(20))
+                .unwrap_or_else(|_| panic!("{what}: a JBIG2 symbol dictionary must not stall the renderer"));
+            assert!(page.error.is_none(), "{what}: {:?}", page.error);
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{what}: the rest of the page draws");
+        }
+    }
+
     /// From the nightly `cargo xtask fuzz`: an embedded Type 1 font program holding a long run of
     /// integers. read-fonts 0.39 (through skrifa 0.42) looked ahead after every integer by
     /// parsing the next token, which looked ahead again, recursing through the whole run: a long
diff --git a/vendor/README.md b/vendor/README.md
index e791b914..89f9a1fd 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -10,7 +10,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it when dropped, after an edit or on closing, so its renders in progress stop instead of running to the end for answers nobody can receive) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders` |
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid` |
-| hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second |
+| hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream` |
 
diff --git a/vendor/hayro-jbig2/src/decode/symbol.rs b/vendor/hayro-jbig2/src/decode/symbol.rs
index ad804252..f1aa8a66 100644
--- a/vendor/hayro-jbig2/src/decode/symbol.rs
+++ b/vendor/hayro-jbig2/src/decode/symbol.rs
@@ -29,6 +29,15 @@ const MAX_SYMBOLS: u32 = u16::MAX as u32;
 /// file decoding for minutes; real dictionaries hold about a million pixels.
 const MAX_DICTIONARY_PIXELS: u64 = 1 << 26;
 
+/// PdfCraft patch: decoding steps that decode nothing, allowed beyond what a valid dictionary can
+/// need. A height class without a symbol and an export run of length 0 don't move their loops
+/// on, and past the end of its data the arithmetic decoder can decode them for ever: one changed
+/// byte in a symbol dictionary hung the renderer. A valid dictionary needs at most one height
+/// class per new symbol, and `2 × symbols + 1` export runs (they alternate between exported and
+/// not, so at most one zero-length run before each symbol's). Encoders don't write empty steps
+/// back to back; this tolerates a thousand.
+const EXTRA_EMPTY_STEPS: u64 = 1024;
+
 /// Decode a symbol dictionary segment (7.4.2, 6.5).
 pub(crate) fn decode(
     header: &SymbolDictionaryHeader<'_>,
@@ -79,7 +88,14 @@ pub(crate) fn decode(
         }
     };
 
+    // PdfCraft patch: see `EXTRA_EMPTY_STEPS`.
+    let mut height_classes_left = u64::from(num_new_symbols) + EXTRA_EMPTY_STEPS;
+
     while ctx.symbols_decoded_count < num_new_symbols {
+        if height_classes_left == 0 {
+            bail!(SymbolError::Invalid);
+        }
+        height_classes_left -= 1;
         let height_class_delta =
             read_height_class_delta(&mut ctx)?.ok_or(SymbolError::UnexpectedOob)?;
 
@@ -694,8 +710,14 @@ fn export_symbols(ctx: &mut SymbolDecodeContext<'_>) -> Result<Vec<Bitmap>> {
     let mut exported = Vec::with_capacity(ctx.header.num_exported_symbols as usize);
     let mut index: u32 = 0;
     let mut should_export = false;
+    // PdfCraft patch: see `EXTRA_EMPTY_STEPS`.
+    let mut runs_left = u64::from(total_symbols) * 2 + 1 + EXTRA_EMPTY_STEPS;
 
     while index < total_symbols {
+        if runs_left == 0 {
+            bail!(SymbolError::Invalid);
+        }
+        runs_left -= 1;
         let run_length = read_run_length()?;
 
         let end_index = index.checked_add(run_length).ok_or(OverflowError::Index)?;

From 21a96245854cdc42d302997e261bd60bdc25bc54 Mon Sep 17 00:00:00 2001
From: fares111111122 <fares.ali.haisan@gmail.com>
Date: Fri, 9 Oct 2026 16:22:50 +0300
Subject: [PATCH 065/149] M7: Arabic in added text (shaping, bidi order,
 searchable Type 3 glyphs) (#403)

Add text wrote Arabic as "?" (standard-14 fonts, WinAnsi). Items with
Arabic are now shaped with the craft-fonts Arab face through harfrust
(already in the tree via egui) and laid out line by line in display
order with unicode-bidi (UAX #9), so Arabic mixed with Latin, digits and
brackets reads correctly. Each cluster (a letter with its dots or marks)
is one glyph of a Type 3 font drawn from the face's outlines, with a
ToUnicode entry, so text extraction, copy and search get every letter
once and no font file is embedded.

- fonts: shape_arabic / arabic_glyph / arabic_has / document_arabic_font;
  japanese_glyph's bounded outline code is shared as bounded_outline.
- edit: draw_arabic and type3_arabic; wrapping measures shaped words.
  Fonts get names free on the page (a full save renumbers objects, not
  resource names) and are removed when the item is updated or deleted.
  Outlines are read before anything is written.
- Without the face, adding Arabic is a clear error that changes nothing;
  an existing item holding Arabic still moves, drawn as "?" as before.
- Non-Arabic items are drawn exactly as before.

Refs #250, #280, #369.

Co-authored-by: fares <aw674860@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                   |   2 +
 ROADMAP.md                   |   1 +
 crates/edit/Cargo.toml       |   2 +
 crates/edit/src/added.rs     | 372 ++++++++++++++++++++++++++++++++++-
 crates/edit/src/tests.rs     | 126 ++++++++++++
 crates/fonts/Cargo.toml      |   2 +
 crates/fonts/README.md       |   4 +
 crates/fonts/src/arabic.rs   | 171 ++++++++++++++++
 crates/fonts/src/craft.rs    |   6 +
 crates/fonts/src/lib.rs      |   6 +-
 crates/fonts/src/script.rs   |   9 +-
 parity/acrobat-features.toml |   4 +-
 12 files changed, 690 insertions(+), 15 deletions(-)
 create mode 100644 crates/fonts/src/arabic.rs

diff --git a/Cargo.lock b/Cargo.lock
index d43c0e0b..e4a8c911 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3568,6 +3568,7 @@ dependencies = [
  "pdfcraft-fonts",
  "pdfcraft-model",
  "thiserror 2.0.21",
+ "unicode-bidi",
 ]
 
 [[package]]
@@ -3626,6 +3627,7 @@ dependencies = [
 name = "pdfcraft-fonts"
 version = "0.4.0"
 dependencies = [
+ "harfrust",
  "pdfcraft-cos",
  "skrifa 0.44.0",
 ]
diff --git a/ROADMAP.md b/ROADMAP.md
index cad37c68..101b8eed 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -139,6 +139,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (community, M7, Arabic added text):** Add text writes Arabic into the PDF instead of `?`. The text is shaped with the craft-fonts `Arab` face through harfrust (already in the tree via egui): joining forms, ligatures and mark positions. Each line is laid out in display order by the Unicode bidirectional algorithm, so Arabic mixed with Latin words, European or Arabic-Indic digits and brackets reads correctly; justified right-to-left paragraphs end at the right edge. Each cluster (a letter with its dots or marks) becomes one glyph of a Type 3 font built from the face's outlines, with a ToUnicode entry, so `text_extract`, copy and search get every letter once and no font file is embedded. Wrapping measures shaped words. Each item has its own fonts under names free on the page (a full save renumbers objects but not resource names); updating or deleting the item removes them. Without the face, adding Arabic text returns a clear error and changes nothing, while an existing item holding Arabic still moves and retypes, drawn as `?` as before. Tests cover shaping, display order, ToUnicode, font names and clean-up on one page, and odd input (empty lines, direction controls, lone marks, 18,000 characters). Not yet: bold/italic Arabic, Hebrew, right-to-left typing in the box (misc.rtl-ui), editing existing Arabic text (edit.rtl-cjk-editing). The craft-fonts revision pinned for releases predates its Arabic face, so release builds report the missing font until the pin moves. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, document inspection):** Annotation dates preserve non-date Unicode text instead of panicking while opening; failed auxiliary structure inspection keeps renderer page geometry and reports a warning. Synthetic UTF16BE annotation, UTF8-boundary and independent panic regressions cover the fix. Overall estimate unchanged (about 30–35%).
 
diff --git a/crates/edit/Cargo.toml b/crates/edit/Cargo.toml
index 1aadd633..42733780 100644
--- a/crates/edit/Cargo.toml
+++ b/crates/edit/Cargo.toml
@@ -14,6 +14,8 @@ pdfcraft-content = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-model = { workspace = true }
 thiserror = { workspace = true }
+# Display order of right-to-left lines in added text; already in the tree via the interface.
+unicode-bidi = "0.3"
 
 [dev-dependencies]
 hayro-syntax = { workspace = true }
diff --git a/crates/edit/src/added.rs b/crates/edit/src/added.rs
index d189dedf..6537f92d 100644
--- a/crates/edit/src/added.rs
+++ b/crates/edit/src/added.rs
@@ -7,8 +7,11 @@
 //! content. Boxes are in display space (origin at the bottom-left of the page as shown, after
 //! `/Rotate`), so items stay upright on rotated pages.
 
+use std::collections::HashMap;
+
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
-use pdfcraft_fonts::{helvetica_width, literal, win_ansi};
+use pdfcraft_fonts::{GlyphError, GlyphOutline, ShapedCluster, arabic_glyph, helvetica_width, literal, shape_arabic, win_ansi};
+use unicode_bidi::{Level, ParagraphBidiInfo};
 
 use crate::{EditError, check, contents, n, page_list, place_tagged};
 
@@ -195,24 +198,139 @@ fn norm(r: [f64; 4]) -> [f64; 4] {
 
 /// The lines of a text item after wrapping to its box width.
 pub fn lines(t: &AddedText) -> Vec<String> {
+    wrapped(t).into_iter().map(|(line, _)| line).collect()
+}
+
+/// [`lines`], each with whether its paragraph runs right to left (its first strong character
+/// does).
+fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
     let width = (t.rect[2] - t.rect[0]).max(t.size);
     let mut out = Vec::new();
     for para in t.text.split('\n') {
-        let mut line = String::new();
+        let arabic = para.chars().any(is_arabic);
+        let rtl = arabic && unicode_bidi::get_base_direction(para) == unicode_bidi::Direction::Rtl;
+        // Arabic words are shaped one by one (joining stops at spaces), so a line's width is the
+        // sum of its words' and shaping stays linear in the paragraph's length. The space is the
+        // paragraph's; a space between Latin words is drawn in the item's font, a few hundredths
+        // of an em apart.
+        let measure = |s: &str| if arabic { arabic_width(t, s, rtl) } else { t.family.width(s, t.size, t.bold) };
+        let space = measure(" ");
+        let (mut line, mut line_w) = (String::new(), 0.0);
         for word in para.split(' ') {
             let candidate = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
-            if !line.is_empty() && t.family.width(&candidate, t.size, t.bold) > width {
-                out.push(std::mem::take(&mut line));
+            let candidate_w = if arabic { if line.is_empty() { measure(word) } else { line_w + space + measure(word) } } else { measure(&candidate) };
+            if !line.is_empty() && candidate_w > width {
+                out.push((std::mem::take(&mut line), rtl));
                 line = word.to_string();
+                line_w = measure(word);
             } else {
                 line = candidate;
+                line_w = candidate_w;
             }
         }
-        out.push(line);
+        out.push((line, rtl));
     }
     out
 }
 
+/// Arabic letters, marks, digits and punctuation: an item with any of them is shaped with the
+/// craft-fonts Arabic face.
+fn is_arabic(c: char) -> bool {
+    matches!(u32::from(c), 0x0600..=0x06FF | 0x0750..=0x077F | 0x0870..=0x08FF | 0xFB50..=0xFDFF | 0xFE70..=0xFEFC)
+}
+
+/// Direction marks, embeddings, overrides and isolates: they steer the order and are not drawn.
+fn is_bidi_control(c: char) -> bool {
+    matches!(c, '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}')
+}
+
+fn mirrored(c: char) -> char {
+    match c {
+        '(' => ')',
+        ')' => '(',
+        '[' => ']',
+        ']' => '[',
+        '{' => '}',
+        '}' => '{',
+        '<' => '>',
+        '>' => '<',
+        '«' => '»',
+        '»' => '«',
+        other => other,
+    }
+}
+
+/// A piece of a line with Arabic text, in drawing order.
+enum Piece {
+    /// Shown in the item's own standard font.
+    Latin(String),
+    Arabic(Vec<ShapedCluster>),
+}
+
+/// A line of an Arabic item in drawing order (the Unicode bidirectional algorithm, UAX #9), and
+/// its width at the item's size. `rtl` is its paragraph's direction.
+fn arabic_layout(t: &AddedText, line: &str, rtl: bool) -> Result<(Vec<Piece>, f64), EditError> {
+    // unicode-bidi indexes the first level of a line, so an empty one would panic.
+    if line.is_empty() {
+        return Ok((Vec::new(), 0.0));
+    }
+    let base = if rtl { Level::rtl() } else { Level::ltr() };
+    let info = ParagraphBidiInfo::new(line, Some(base));
+    let (levels, runs) = info.visual_runs(0..line.len());
+    let mut pieces = Vec::new();
+    for run in runs {
+        let run_rtl = levels.get(run.start).is_some_and(Level::is_rtl);
+        // Runs lie on character boundaries; a missing slice is skipped, never a panic.
+        let Some(text) = line.get(run) else { continue };
+        // Arabic letters take the Arabic face; so do spaces and punctuation between them, which the
+        // shaper then mirrors. Latin text (and what the face lacks) keeps the item's font.
+        let mut segments: Vec<(bool, String)> = Vec::new();
+        for c in text.chars().filter(|c| !is_bidi_control(*c)) {
+            let arabic = is_arabic(c) || (run_rtl && !c.is_alphanumeric() && pdfcraft_fonts::arabic_has(c));
+            match segments.last_mut() {
+                Some((kind, s)) if *kind == arabic => s.push(c),
+                _ => segments.push((arabic, c.to_string())),
+            }
+        }
+        if run_rtl {
+            segments.reverse();
+        }
+        for (arabic, s) in segments {
+            pieces.push(if arabic {
+                Piece::Arabic(shape_arabic(&s, run_rtl).map_err(|e| arabic_error(e, &s))?)
+            } else if run_rtl {
+                Piece::Latin(s.chars().rev().map(mirrored).collect())
+            } else {
+                Piece::Latin(s)
+            });
+        }
+    }
+    let width = pieces
+        .iter()
+        .map(|p| match p {
+            Piece::Latin(s) => t.family.width(s, t.size, t.bold),
+            Piece::Arabic(clusters) => clusters.iter().map(|c| c.advance).sum::<f64>() * t.size,
+        })
+        .sum();
+    Ok((pieces, width))
+}
+
+/// The width of `s` in an Arabic item; the item's font's estimate if it can't be shaped (drawing
+/// then reports why).
+fn arabic_width(t: &AddedText, s: &str, rtl: bool) -> f64 {
+    arabic_layout(t, s, rtl).map(|(_, w)| w).unwrap_or_else(|_| t.family.width(s, t.size, t.bold))
+}
+
+fn arabic_error(e: GlyphError, text: &str) -> EditError {
+    EditError::Invalid(match e {
+        GlyphError::NoFont => "Arabic text needs PdfCraft's Arabic font, which this build doesn't include \
+                               (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has an Arab face)"
+            .into(),
+        GlyphError::Missing => format!("the Arabic font can't show \"{text}\""),
+        GlyphError::TooComplex => format!("the Arabic font's glyphs for \"{text}\" are too complex"),
+    })
+}
+
 /// The box a text item occupies (height from its lines).
 pub fn text_rect(t: &AddedText) -> [f64; 4] {
     let r = norm(t.rect);
@@ -224,8 +342,196 @@ fn font_name(base: &str) -> String {
     format!("PCF{}", base.replace('-', ""))
 }
 
-/// Content and resources for an item; `view` maps display space to user space.
-fn draw(doc: &Document, c: &Content, view: [f64; 6]) -> Result<(Vec<u8>, Dict), EditError> {
+/// Most glyphs in one Type 3 font: its codes are single bytes, 1–240.
+const GLYPHS_PER_FONT: usize = 240;
+/// Most Type 3 fonts one item may use, which bounds the objects it adds (ordinary text needs one
+/// or two).
+const MAX_ARABIC_FONTS: usize = 16;
+
+/// Draw a text item that has Arabic in it. Each line is laid out in display order; Arabic glyphs
+/// come from Type 3 fonts drawn from the craft-fonts face's outlines (no font file is embedded),
+/// with a ToUnicode map for copy and search. Other text uses the item's standard font `latin`.
+fn draw_arabic(doc: &mut Document, t: &AddedText, latin: &str, taken: &Dict, fonts: &mut Dict, out: &mut Vec<u8>) -> Result<(), EditError> {
+    let r = text_rect(t);
+    let lines = wrapped(t);
+    let laid = lines.iter().map(|(line, rtl)| arabic_layout(t, line, *rtl)).collect::<Result<Vec<_>, _>>()?;
+    // Every distinct cluster (a letter with its dots and the text it stands for) is one glyph of
+    // one of the fonts, so copy and search get each character exactly once.
+    let mut keys: Vec<&ShapedCluster> = Vec::new();
+    let mut index: HashMap<ClusterKey, usize> = HashMap::new();
+    for c in laid.iter().flat_map(|(pieces, _)| pieces).flat_map(|p| match p {
+        Piece::Arabic(clusters) => clusters.as_slice(),
+        Piece::Latin(_) => &[],
+    }) {
+        index.entry(cluster_key(c)).or_insert_with(|| {
+            keys.push(c);
+            keys.len() - 1
+        });
+    }
+    if keys.len() > GLYPHS_PER_FONT * MAX_ARABIC_FONTS {
+        return Err(EditError::Invalid("the text uses too many different Arabic glyphs; split it into several boxes".into()));
+    }
+    // Every outline is read before anything is written, so a failure leaves the document as it was.
+    let mut outlines = HashMap::new();
+    for c in &keys {
+        for (id, _) in &c.glyphs {
+            if !outlines.contains_key(id) {
+                outlines.insert(*id, arabic_glyph(*id).map_err(|e| arabic_error(e, &c.text))?);
+            }
+        }
+    }
+    let mut names = Vec::new();
+    for chunk in keys.chunks(GLYPHS_PER_FONT) {
+        let font = type3_arabic(doc, chunk, &outlines);
+        // A name no font on the page has, so items never replace each other's fonts (object
+        // numbers alone don't do: a full save renumbers objects but keeps resource names).
+        let mut name = format!("PCAr{}", font.num);
+        let mut suffix = 0usize;
+        while taken.contains(name.as_bytes()) || fonts.contains(name.as_bytes()) {
+            suffix = suffix.saturating_add(1);
+            name = format!("PCAr{}_{suffix}", font.num);
+        }
+        fonts.set(name.clone().into_bytes(), Object::Ref(font));
+        names.push(name);
+    }
+    let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
+    out.extend(format!("BT {} {} {} rg\n", n(cr), n(cg), n(cb)).bytes());
+    for (i, ((line, rtl), (pieces, w))) in lines.iter().zip(&laid).enumerate() {
+        let spaces = line.matches(' ').count();
+        // Justified: the spaces of every line but the last stretch to fill the box.
+        let tw = if t.align == Align::Justify && i + 1 < lines.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
+        let x = match t.align {
+            // A right-to-left paragraph's unstretched last line ends at the right edge.
+            Align::Justify if *rtl => r[2] - w - tw * spaces as f64,
+            Align::Left | Align::Justify => r[0],
+            Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
+            Align::Right => r[2] - w,
+        };
+        let y = r[3] - (i as f64 * 1.2 + 0.95) * t.size;
+        let mut pen = x;
+        let mut current: Option<&str> = None;
+        for piece in pieces {
+            match piece {
+                Piece::Latin(s) => {
+                    out.extend(format!("/{latin} {} Tf {} Tw 1 0 0 1 {} {} Tm ", n(t.size), n(tw), n(pen), n(y)).bytes());
+                    out.extend(literal(&win_ansi(s)));
+                    out.extend_from_slice(b" Tj\n");
+                    current = Some(latin);
+                    pen += t.family.width(s, t.size, t.bold) + tw * s.matches(' ').count() as f64;
+                }
+                Piece::Arabic(clusters) => {
+                    for c in clusters {
+                        let Some(&k) = index.get(&cluster_key(c)) else { continue };
+                        let Some(name) = names.get(k / GLYPHS_PER_FONT) else { continue };
+                        // Codes start at 1; k % 240 + 1 is at most 240.
+                        let code = u8::try_from(k % GLYPHS_PER_FONT + 1).unwrap_or(1);
+                        if current != Some(name.as_str()) {
+                            out.extend(format!("/{name} {} Tf ", n(t.size)).bytes());
+                            current = Some(name.as_str());
+                        }
+                        out.extend(format!("1 0 0 1 {} {} Tm ", n(pen), n(y)).bytes());
+                        out.extend(literal(&[code]));
+                        out.extend_from_slice(b" Tj\n");
+                        pen += c.advance * t.size + if c.text == " " { tw } else { 0.0 };
+                    }
+                }
+            }
+        }
+    }
+    out.extend_from_slice(b"ET\n");
+    Ok(())
+}
+
+/// What makes two clusters the same Type 3 glyph: text, glyphs, offsets and advance (bit for bit;
+/// equal clusters come from the same font units).
+type ClusterKey<'a> = (&'a str, Vec<(u32, u64, u64)>, u64);
+
+fn cluster_key(c: &ShapedCluster) -> ClusterKey<'_> {
+    (c.text.as_str(), c.glyphs.iter().map(|(id, [x, y])| (*id, x.to_bits(), y.to_bits())).collect(), c.advance.to_bits())
+}
+
+/// A Type 3 font with `clusters` as codes 1…, each drawn from the Arabic face's glyph `outlines`.
+fn type3_arabic(doc: &mut Document, clusters: &[&ShapedCluster], outlines: &HashMap<u32, GlyphOutline>) -> ObjRef {
+    let mut charprocs = Dict::new();
+    let mut differences = vec![Object::Int(1)];
+    let mut widths = Vec::with_capacity(clusters.len());
+    let mut bbox = [0.0f64; 4];
+    let mut to_unicode = Vec::new();
+    for (i, c) in clusters.iter().enumerate() {
+        let code = i + 1;
+        // Glyph space is 1000 units per em.
+        let mut paths = Vec::new();
+        let mut ink: Option<[f64; 4]> = None;
+        for (id, [dx, dy]) in &c.glyphs {
+            let Some(g) = outlines.get(id) else { continue };
+            for contour in &g.contours {
+                for (j, p) in contour.iter().enumerate() {
+                    paths.extend(format!("{} {} {}\n", n((p[0] + dx) * 1000.0), n((p[1] + dy) * 1000.0), if j == 0 { "m" } else { "l" }).bytes());
+                }
+                paths.extend_from_slice(b"h\n");
+                let b = [g.bbox[0] + dx, g.bbox[1] + dy, g.bbox[2] + dx, g.bbox[3] + dy];
+                ink = Some(ink.map_or(b, |a| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]));
+            }
+        }
+        // Rounded outwards so no ink is clipped.
+        let [x0, y0, x1, y1] =
+            ink.map_or([0.0; 4], |b| [(b[0] * 1000.0).floor(), (b[1] * 1000.0).floor(), (b[2] * 1000.0).ceil(), (b[3] * 1000.0).ceil()]);
+        bbox = [bbox[0].min(x0), bbox[1].min(y0), bbox[2].max(x1), bbox[3].max(y1)];
+        let mut proc = format!("{} 0 {} {} {} {} d1\n", n(c.advance * 1000.0), n(x0), n(y0), n(x1), n(y1)).into_bytes();
+        if !paths.is_empty() {
+            proc.extend(paths);
+            proc.extend_from_slice(b"f\n");
+        }
+        let glyph = format!("g{code:02X}");
+        charprocs.set(glyph.clone().into_bytes(), Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), &proc)))));
+        differences.push(Object::name(&glyph));
+        widths.push(Object::Real((c.advance * 1000.0).round()));
+        if !c.text.is_empty() {
+            let hex: String = c.text.encode_utf16().map(|u| format!("{u:04X}")).collect();
+            to_unicode.push(format!("<{code:02X}> <{hex}>\n"));
+        }
+    }
+    let mut cmap = String::from(
+        "/CIDInit /ProcSet findresource begin\n12 dict begin\nbegincmap\n/CMapType 2 def\n1 begincodespacerange\n<01> <FF>\nendcodespacerange\n",
+    );
+    // A CMap block holds at most 100 entries.
+    for block in to_unicode.chunks(100) {
+        cmap.push_str(&format!("{} beginbfchar\n{}endbfchar\n", block.len(), block.concat()));
+    }
+    cmap.push_str("endcmap\nCMapName currentdict /CMap defineresource pop\nend\nend\n");
+    let cmap = doc.add(Object::Stream(Stream::flate(Dict::new(), cmap.as_bytes())));
+    let family = pdfcraft_fonts::document_arabic_font().map_or("Arabic", |f| f.family);
+    let mut descriptor = Dict::new();
+    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+    descriptor.set(b"FontName".to_vec(), Object::name(&family.replace(' ', "")));
+    descriptor.set(b"FontFamily".to_vec(), Object::String(PdfString::literal(family.as_bytes().to_vec())));
+    descriptor.set(b"Flags".to_vec(), Object::Int(4));
+    descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
+    let mut encoding = Dict::new();
+    encoding.set(b"Type".to_vec(), Object::name("Encoding"));
+    encoding.set(b"Differences".to_vec(), Object::Array(differences));
+    let mut font = Dict::new();
+    font.set(b"Type".to_vec(), Object::name("Font"));
+    font.set(b"Subtype".to_vec(), Object::name("Type3"));
+    font.set(b"FontDescriptor".to_vec(), Object::Ref(doc.add(Object::Dict(descriptor))));
+    font.set(b"FontBBox".to_vec(), Object::Array(bbox.iter().map(|v| Object::Real(*v)).collect()));
+    font.set(
+        b"FontMatrix".to_vec(),
+        Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
+    );
+    font.set(b"FirstChar".to_vec(), Object::Int(1));
+    font.set(b"LastChar".to_vec(), Object::Int(clusters.len() as i64));
+    font.set(b"Widths".to_vec(), Object::Array(widths));
+    font.set(b"Encoding".to_vec(), Object::Dict(encoding));
+    font.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
+    font.set(b"ToUnicode".to_vec(), Object::Ref(cmap));
+    doc.add(Object::Dict(font))
+}
+
+/// Content and resources for an item; `view` maps display space to user space. `taken` holds the
+/// page's font names. `existing`: the item is being replaced, so a build without the Arabic face
+/// keeps drawing its Arabic as `?`, as before Arabic was supported, rather than refusing to move it.
+fn draw(doc: &mut Document, c: &Content, view: [f64; 6], taken: &Dict, existing: bool) -> Result<(Vec<u8>, Dict), EditError> {
     let mut res = Dict::new();
     let mut out = format!("q {} {} {} {} {} {} cm\n", n(view[0]), n(view[1]), n(view[2]), n(view[3]), n(view[4]), n(view[5])).into_bytes();
     match c {
@@ -241,6 +547,12 @@ fn draw(doc: &Document, c: &Content, view: [f64; 6]) -> Result<(Vec<u8>, Dict),
             }
             let mut fonts = Dict::new();
             fonts.set(name.clone().into_bytes(), Object::Dict(font));
+            if t.text.chars().any(is_arabic) && (pdfcraft_fonts::document_arabic_font().is_some() || !existing) {
+                draw_arabic(doc, t, &name, taken, &mut fonts, &mut out)?;
+                res.set(b"Font".to_vec(), Object::Dict(fonts));
+                out.extend_from_slice(b"Q\n");
+                return Ok((out, res));
+            }
             res.set(b"Font".to_vec(), Object::Dict(fonts));
             let r = text_rect(t);
             let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
@@ -410,9 +722,15 @@ fn write(doc: &mut Document, page: usize, c: &Content, obj: Option<ObjRef>) -> R
     let all = page_list(doc);
     check(&[page], all.len())?;
     let p = &all[page];
-    let (content, res) = draw(doc, c, p.view_matrix(doc))?;
-    // The page gets its own copy of its resources with the item's fonts and images added.
+    let view = p.view_matrix(doc);
+    // The page gets its own copy of its resources with the item's fonts and images added, and
+    // without the Arabic fonts of the version it replaces.
     let mut pres = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    if let Some(r) = obj {
+        drop_fonts(doc, &mut pres, &own_fonts(doc, r));
+    }
+    let taken = pres.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+    let (content, res) = draw(doc, c, view, &taken, obj.is_some())?;
     for (k, v) in res.iter() {
         let mut sub = pres.get(k).map(|s| doc.resolve(s)).and_then(|s| s.as_dict().cloned()).unwrap_or_default();
         for (n2, o) in v.as_dict().into_iter().flat_map(|d| d.iter()) {
@@ -497,6 +815,40 @@ pub fn delete_content(doc: &mut Document, page: usize, index: usize) -> Result<(
     let a = find(doc, page, index)?;
     let p = page_list(doc).swap_remove(page);
     let list: Vec<Object> = contents(doc, &p)?.into_iter().filter(|o| o.as_ref() != Some(a.obj)).collect();
-    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    let fonts = own_fonts(doc, a.obj);
+    // Only the page's own resources carry an item's fonts (`write` gives the page a copy).
+    let res = match p.dict.get(b"Resources") {
+        Some(Object::Dict(d)) if !fonts.is_empty() => Some(d.clone()),
+        _ => None,
+    };
+    let res = res.map(|mut r| {
+        drop_fonts(doc, &mut r, &fonts);
+        r
+    });
+    doc.update_dict(p.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Array(list));
+        if let Some(r) = res {
+            d.set(b"Resources".to_vec(), Object::Dict(r));
+        }
+    })?;
     Ok(())
 }
+
+/// The Type 3 fonts an Arabic item's stream shows text with. Each item has its own (`draw_arabic`
+/// names them so), so they go when the item is replaced or deleted.
+fn own_fonts(doc: &Document, obj: ObjRef) -> Vec<Vec<u8>> {
+    let Object::Stream(s) = &*doc.get(obj) else { return Vec::new() };
+    let Ok(data) = s.decoded() else { return Vec::new() };
+    data.split(u8::is_ascii_whitespace).filter_map(|w| w.strip_prefix(b"/")).filter(|w| w.starts_with(b"PCAr")).map(<[u8]>::to_vec).collect()
+}
+
+fn drop_fonts(doc: &Document, res: &mut Dict, names: &[Vec<u8>]) {
+    if names.is_empty() {
+        return;
+    }
+    let Some(mut fonts) = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()) else { return };
+    for name in names {
+        fonts.remove(name);
+    }
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 6711ba4a..edba41fc 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -227,6 +227,132 @@ fn added_text_and_images_are_page_content_that_stays_editable() {
     assert!(marks_present(&doc).is_empty());
 }
 
+#[test]
+fn added_arabic_text_is_shaped_in_display_order_and_stays_searchable() {
+    let mut doc = fixture();
+    let text =
+        AddedText { rect: [72.0, 600.0, 400.0, 700.0], text: "مرحبا World".into(), size: 14.0, align: Align::Right, ..AddedText::default() };
+    if pdfcraft_fonts::document_arabic_font().is_none() {
+        eprintln!("skipping the Arabic drawing checks: built without a craft-fonts Arab face (set CRAFT_FONTS_DIR)");
+        let err = add_content(&mut doc, 0, &Content::Text(text)).unwrap_err();
+        assert!(matches!(&err, EditError::Invalid(m) if m.contains("CRAFT_FONTS_DIR")), "{err:?}");
+        assert!(!doc.is_modified(), "nothing is written when the font is missing");
+        return;
+    }
+    add_content(&mut doc, 0, &Content::Text(text.clone())).unwrap();
+    // A second Arabic item on the same page keeps its own fonts.
+    add_content(&mut doc, 0, &Content::Text(AddedText { text: "شكرا".into(), rect: [72.0, 500.0, 400.0, 520.0], ..text.clone() })).unwrap();
+    let doc = reopen(&doc);
+    let added = list_added(&doc);
+    let Content::Text(t) = &added[0].content else { panic!() };
+    assert_eq!(t.text, "مرحبا World", "the logical text is kept for editing");
+    let s = streams(&doc, 0);
+    let item = s.iter().find(|s| s.contains("(World) Tj")).unwrap();
+    // A right-to-left paragraph: "World" is drawn left of the Arabic word.
+    let x_before = |s: &str, at: usize| -> f64 {
+        let tm = s[..at].rfind("1 0 0 1 ").unwrap() + 8;
+        s[tm..].split(' ').next().unwrap().parse().unwrap()
+    };
+    let latin_x = x_before(item, item.find("(World) Tj").unwrap());
+    let arabic_at = item.find("/PCAr").unwrap();
+    let arabic_x = x_before(item, item[arabic_at..].find(" Tj").unwrap() + arabic_at);
+    assert!(latin_x < arabic_x, "{item}");
+    // The Arabic glyphs come from Type 3 fonts whose ToUnicode maps give back each letter.
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let res = doc.resolve(p.dict.get(b"Resources").unwrap());
+    let fonts = doc.resolve(res.as_dict().unwrap().get(b"Font").unwrap()).as_dict().unwrap().clone();
+    let arabic: Vec<_> = fonts.iter().filter(|(k, _)| k.starts_with(b"PCAr")).map(|(_, v)| doc.resolve(v).as_dict().unwrap().clone()).collect();
+    assert_eq!(arabic.len(), 2, "one font per item");
+    let mut mapped = String::new();
+    for f in &arabic {
+        assert_eq!(f.name(b"Subtype"), Some(&b"Type3"[..]));
+        mapped += &String::from_utf8_lossy(&stream_bytes(&doc, f.get(b"ToUnicode").unwrap()).unwrap());
+    }
+    for letter in ["0645", "0631", "062D", "0628", "0627", "0634", "0643"] {
+        assert!(mapped.contains(&format!("<{letter}>")), "{letter} in {mapped}");
+    }
+}
+
+/// The `PCAr` font names in page `page`'s resources.
+fn arabic_font_names(doc: &Document, page: usize) -> Vec<String> {
+    let p = &pdfcraft_model::pages(doc)[page];
+    let Some(res) = p.dict.get(b"Resources").map(|r| doc.resolve(r)) else { return vec![] };
+    let Some(fonts) = res.as_dict().and_then(|r| r.get(b"Font")).map(|f| doc.resolve(f)) else { return vec![] };
+    fonts.as_dict().unwrap().iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).filter(|k| k.starts_with("PCAr")).collect()
+}
+
+#[test]
+fn arabic_items_keep_their_own_fonts_through_saves_updates_and_deletes() {
+    let mut doc = fixture();
+    let text = AddedText { rect: [72.0, 600.0, 400.0, 700.0], text: "مرحبا".into(), size: 14.0, ..AddedText::default() };
+    if pdfcraft_fonts::document_arabic_font().is_none() {
+        // An item that already holds Arabic (stored by an older version, drawn as "?") can still
+        // be moved and retyped without the face.
+        add_content(&mut doc, 0, &Content::Text(AddedText { text: "x".into(), ..text.clone() })).unwrap();
+        update_content(&mut doc, 0, 0, &Content::Text(text)).unwrap();
+        assert!(streams(&doc, 0).join("").contains("(?????) Tj"));
+        return;
+    }
+    // A full save renumbers objects but keeps resource names, so a font named after its object
+    // number may meet a name already on the page: here, every name it could take.
+    let mut taken = Dict::new();
+    for num in 1..2_000 {
+        taken.set(format!("PCAr{num}").into_bytes(), Object::name("Taken"));
+    }
+    let mut res = Dict::new();
+    res.set(b"Font".to_vec(), Object::Dict(taken));
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    doc.update_dict(page, |d| d.set(b"Resources".to_vec(), Object::Dict(res))).unwrap();
+    add_content(&mut doc, 0, &Content::Text(text.clone())).unwrap();
+    add_content(&mut doc, 0, &Content::Text(AddedText { text: "شكرا".into(), rect: [72.0, 500.0, 400.0, 520.0], ..text.clone() })).unwrap();
+    let names = arabic_font_names(&doc, 0);
+    assert_eq!(names.len(), 1_999 + 2, "nothing replaced");
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let fonts = doc.resolve(p.dict.get(b"Resources").unwrap()).as_dict().unwrap().get(b"Font").cloned().unwrap();
+    let fonts = doc.resolve(&fonts).as_dict().unwrap().clone();
+    assert_eq!(fonts.iter().filter(|(_, v)| v.as_name() == Some(&b"Taken"[..])).count(), 1_999);
+    let first = own(&doc, 0);
+    assert!(first.len() == 1 && first[0].contains('_'), "a free name, not a taken one: {first:?}");
+    // Updating an item swaps its fonts; deleting it removes them.
+    update_content(&mut doc, 0, 0, &Content::Text(AddedText { text: "أهلا".into(), ..text })).unwrap();
+    let names = arabic_font_names(&doc, 0);
+    assert!(names.len() == 2_001 && !names.contains(&first[0]), "the replaced item's font is gone");
+    delete_content(&mut doc, 0, 0).unwrap();
+    delete_content(&mut doc, 0, 0).unwrap();
+    assert_eq!(arabic_font_names(&doc, 0).len(), 1_999, "only the page's own names are left");
+    reopen(&doc);
+}
+
+/// The `PCAr` fonts the stream of added item `index` on page 0 shows text with.
+fn own(doc: &Document, index: usize) -> Vec<String> {
+    let s = String::from_utf8_lossy(&stream_bytes(doc, &Object::Ref(list_added(doc)[index].obj)).unwrap()).into_owned();
+    let mut names: Vec<String> =
+        s.split_whitespace().filter_map(|w| w.strip_prefix('/')).filter(|w| w.starts_with("PCAr")).map(String::from).collect();
+    names.dedup();
+    names
+}
+
+#[test]
+fn odd_arabic_text_never_panics() {
+    let mut doc = fixture();
+    let long = "بسم الله ".repeat(2_000);
+    for s in
+        ["\u{202E}ب\u{064B}\u{064B} (]", "\u{064B}", "ا\u{200F}\u{2067}b\u{2069}", "ا\n\nب\tc", "ا\u{2029}ب\rc\u{85}د\n", "ﷺ ١٢٣ 456", long.as_str()]
+    {
+        let r = add_content(&mut doc, 0, &Content::Text(AddedText { rect: [0.0, 800.0, 300.0, 780.0], text: s.into(), ..AddedText::default() }));
+        assert_eq!(r.is_ok(), pdfcraft_fonts::document_arabic_font().is_some(), "{:?}: {r:?}", s.chars().take(12).collect::<String>());
+    }
+    // A character the face lacks is an error that names it, not a box or a crash.
+    if pdfcraft_fonts::document_arabic_font().is_some() && !pdfcraft_fonts::arabic_has('\u{FDFD}') {
+        let r = add_content(
+            &mut doc,
+            0,
+            &Content::Text(AddedText { rect: [0.0, 800.0, 300.0, 780.0], text: "ب \u{FDFD}".into(), ..AddedText::default() }),
+        );
+        assert!(matches!(&r, Err(EditError::Invalid(m)) if m.contains('\u{FDFD}')), "{r:?}");
+    }
+}
+
 /// One page with Helvetica (WinAnsi) and a subset font that has only the glyphs it uses.
 fn text_page(content: &str) -> Document {
     let objs: Vec<String> = vec![
diff --git a/crates/fonts/Cargo.toml b/crates/fonts/Cargo.toml
index e2b38801..2e863845 100644
--- a/crates/fonts/Cargo.toml
+++ b/crates/fonts/Cargo.toml
@@ -12,3 +12,5 @@ workspace = true
 pdfcraft-cos = { workspace = true }
 # Glyph outlines of the bundled script font (typed signatures); already in the tree via egui.
 skrifa = "0.44"
+# Arabic shaping for text written into PDFs; already in the tree via egui, on the same read-fonts.
+harfrust = "0.12"
diff --git a/crates/fonts/README.md b/crates/fonts/README.md
index 0f59dd6b..aa717449 100644
--- a/crates/fonts/README.md
+++ b/crates/fonts/README.md
@@ -33,6 +33,10 @@ set). Without that variable `CRAFT_FONTS` is empty and everything below copes:
   keep Mincho. Type 3 paths and advances both come from that selected face. Missing weights
   fall back to a real Regular face, never synthetic bold; no italic face is supplied. The
   default `document_japanese_font` / `japanese_glyph` APIs still use regular document Mincho.
+- `document_arabic_font` / `shape_arabic` / `arabic_glyph`: the first `Arab` face, shaped with
+  harfrust (joining forms, ligatures, mark positions) into clusters for Arabic text written into
+  PDFs; the editor draws each cluster as one Type 3 glyph with a ToUnicode entry. Without the face
+  they return `GlyphError::NoFont` and the editor reports a clear error.
 - `document_japanese_fonts_for_style`: every `Jpan` face in that order of preference, so the
   editor can use the first one that has all of the replacement's glyphs (the faces differ in
   coverage, e.g. of Cyrillic).
diff --git a/crates/fonts/src/arabic.rs b/crates/fonts/src/arabic.rs
new file mode 100644
index 00000000..6a4a53a6
--- /dev/null
+++ b/crates/fonts/src/arabic.rs
@@ -0,0 +1,171 @@
+//! Arabic text written into PDFs: shaping (joining forms, lam-alef ligatures, mark placement) with
+//! the craft-fonts `Arab` face, and that face's glyph outlines.
+
+use std::sync::OnceLock;
+
+use harfrust::{BufferClusterLevel, Direction, ShapeOptions, ShaperData, UnicodeBuffer, script};
+use skrifa::instance::{LocationRef, Size};
+use skrifa::raw::TableProvider;
+use skrifa::{FontRef, GlyphId, MetadataProvider};
+
+use crate::{GlyphError, GlyphOutline};
+
+/// One cluster of shaped Arabic text: the glyphs that show one character (a letter's body and
+/// dots, say), or several characters for a ligature. Em units.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ShapedCluster {
+    /// Glyph ids, each with its offset from the cluster's pen position (marks sit above or below).
+    pub glyphs: Vec<(u32, [f64; 2])>,
+    pub advance: f64,
+    /// The characters it shows, in logical order.
+    pub text: String,
+}
+
+fn face() -> Option<&'static (FontRef<'static>, ShaperData)> {
+    static FACE: OnceLock<Option<(FontRef<'static>, ShaperData)>> = OnceLock::new();
+    FACE.get_or_init(|| {
+        let font = FontRef::new(crate::document_arabic_font()?.bytes).ok()?;
+        let data = ShaperData::new(&font);
+        Some((font, data))
+    })
+    .as_ref()
+}
+
+/// Whether the Arabic document face has a glyph for `c` (false without the face).
+pub fn arabic_has(c: char) -> bool {
+    face().is_some_and(|(font, _)| font.charmap().map(c).is_some())
+}
+
+/// Shape one directional run of `text` with the Arabic document face. The clusters come in
+/// drawing order, left to right. [`GlyphError::NoFont`] without the face;
+/// [`GlyphError::Missing`] when it lacks a character.
+pub fn shape_arabic(text: &str, rtl: bool) -> Result<Vec<ShapedCluster>, GlyphError> {
+    let (font, data) = face().ok_or(GlyphError::NoFont)?;
+    let shaper = data.shaper(font).build();
+    let scale = 1.0 / f64::from(shaper.units_per_em().max(1));
+    let mut buffer = UnicodeBuffer::new();
+    buffer.push_str(text);
+    buffer.set_direction(if rtl { Direction::RightToLeft } else { Direction::LeftToRight });
+    buffer.set_script(script::ARABIC);
+    // One cluster per character, so marks keep their own text for copy and search.
+    buffer.set_cluster_level(BufferClusterLevel::Characters);
+    let shaped = shaper.shape(buffer, ShapeOptions::new());
+    // Clusters are byte offsets into `text`; a cluster shows the characters up to the next one.
+    let mut starts: Vec<usize> = shaped.glyph_infos().iter().map(|g| g.cluster as usize).collect();
+    starts.sort_unstable();
+    starts.dedup();
+    let mut out: Vec<(usize, ShapedCluster)> = Vec::new();
+    for (info, pos) in shaped.glyph_infos().iter().zip(shaped.glyph_positions()) {
+        if info.glyph_id == 0 {
+            return Err(GlyphError::Missing);
+        }
+        let start = info.cluster as usize;
+        // A cluster's glyphs are adjacent in the shaped run.
+        let cluster = match out.last_mut() {
+            Some((s, c)) if *s == start => c,
+            _ => {
+                let end = starts.get(starts.partition_point(|s| *s <= start)).copied().unwrap_or(text.len());
+                let text = text.get(start..end).unwrap_or_default().to_string();
+                out.push((start, ShapedCluster { glyphs: Vec::new(), advance: 0.0, text }));
+                // Just pushed.
+                let Some((_, c)) = out.last_mut() else { continue };
+                c
+            }
+        };
+        let at = [cluster.advance + f64::from(pos.x_offset) * scale, f64::from(pos.y_offset) * scale];
+        cluster.glyphs.push((info.glyph_id, at));
+        cluster.advance += f64::from(pos.x_advance) * scale;
+    }
+    Ok(out.into_iter().map(|(_, c)| c).collect())
+}
+
+/// Glyph `id` of the Arabic document face, bounded like [`crate::japanese_glyph`]. Glyphs without
+/// outlines (spaces) come back empty.
+pub fn arabic_glyph(id: u32) -> Result<GlyphOutline, GlyphError> {
+    let (font, _) = face().ok_or(GlyphError::NoFont)?;
+    if font.maxp().map_or(true, |m| id >= u32::from(m.num_glyphs())) {
+        return Err(GlyphError::Missing);
+    }
+    let gid = GlyphId::new(id);
+    let loc = LocationRef::default();
+    let scale = 1.0 / font.metrics(Size::unscaled(), loc).units_per_em.max(1) as f64;
+    let width = font.glyph_metrics(Size::unscaled(), loc).advance_width(gid).unwrap_or(0.0) as f64 * scale;
+    // Marks have no advance; the widest ligatures (U+FDFD) span a few em.
+    if !width.is_finite() || !(0.0..=8.0).contains(&width) {
+        return Err(GlyphError::Missing);
+    }
+    if font.outline_glyphs().get(gid).is_none() {
+        return Ok(GlyphOutline { contours: Vec::new(), width, bbox: [0.0, 0.0, width, 0.0] });
+    }
+    crate::script::bounded_outline(font, gid, width)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn face_or_skip() -> bool {
+        if crate::document_arabic_font().is_none() {
+            eprintln!("skipping the Arabic shaping checks: built without a craft-fonts Arab face (set CRAFT_FONTS_DIR)");
+            assert_eq!(shape_arabic("ب", true), Err(GlyphError::NoFont));
+            assert_eq!(arabic_glyph(1).map(|_| ()), Err(GlyphError::NoFont));
+            assert!(!arabic_has('ب'));
+            return false;
+        }
+        true
+    }
+
+    #[test]
+    fn letters_take_their_joining_forms() {
+        if !face_or_skip() {
+            return;
+        }
+        let ids =
+            |s: &str| shape_arabic(s, true).unwrap().iter().flat_map(|c| c.glyphs.iter().map(|g| g.0)).collect::<std::collections::BTreeSet<_>>();
+        let (isolated, joined) = (ids("ب"), ids("ببب"));
+        // Initial, medial and final forms are glyphs the isolated letter doesn't use.
+        assert!(joined.difference(&isolated).count() >= 2, "{isolated:?} {joined:?}");
+        // One cluster per letter, however many glyphs the face draws it with (Noto Sans Arabic:
+        // body and dots).
+        let c = shape_arabic("ببب", true).unwrap();
+        assert!(c.len() == 3 && c.iter().all(|c| c.text == "ب" && c.advance > 0.0 && !c.glyphs.is_empty()), "{c:?}");
+    }
+
+    #[test]
+    fn right_to_left_runs_are_drawn_from_their_last_letter() {
+        if !face_or_skip() {
+            return;
+        }
+        let g = shape_arabic("سلام", true).unwrap();
+        let drawn: String = g.iter().map(|g| g.text.as_str()).collect();
+        assert_eq!(drawn.chars().rev().collect::<String>(), "سلام");
+        assert!(shape_arabic("سلام", false).unwrap().iter().map(|g| g.text.as_str()).collect::<String>() == "سلام");
+    }
+
+    #[test]
+    fn marks_keep_their_own_text_and_no_advance() {
+        if !face_or_skip() {
+            return;
+        }
+        let c = shape_arabic("بَ", true).unwrap();
+        assert_eq!(c.len(), 2, "{c:?}");
+        let mark = c.iter().find(|c| c.text == "\u{064E}").unwrap();
+        assert_eq!(mark.advance, 0.0);
+        let outline = arabic_glyph(mark.glyphs[0].0).unwrap();
+        assert!(!outline.contours.is_empty() && outline.bbox[1] > 0.0, "the fatha sits above the baseline");
+    }
+
+    #[test]
+    fn spaces_and_missing_characters() {
+        if !face_or_skip() {
+            return;
+        }
+        let space = shape_arabic(" ", true).unwrap();
+        assert!(space[0].advance > 0.0);
+        assert!(arabic_glyph(space[0].glyphs[0].0).unwrap().contours.is_empty());
+        assert!(arabic_has('ب') && !arabic_has('日'));
+        assert_eq!(shape_arabic("日", true), Err(GlyphError::Missing));
+        assert_eq!(arabic_glyph(u32::MAX).map(|_| ()), Err(GlyphError::Missing));
+        assert!(shape_arabic("", true).unwrap().is_empty());
+    }
+}
diff --git a/crates/fonts/src/craft.rs b/crates/fonts/src/craft.rs
index 84bc0d04..36d45002 100644
--- a/crates/fonts/src/craft.rs
+++ b/crates/fonts/src/craft.rs
@@ -49,6 +49,12 @@ pub fn ui_arabic_fonts() -> Vec<&'static CraftFont> {
     arabic(CRAFT_FONTS.iter())
 }
 
+/// The face for Arabic text written into PDFs: the first `Arab` face. `None` when built without
+/// craft-fonts or when its revision has no Arabic face.
+pub fn document_arabic_font() -> Option<&'static CraftFont> {
+    ui_arabic_fonts().into_iter().next()
+}
+
 fn arabic<'a>(faces: impl IntoIterator<Item = &'a CraftFont>) -> Vec<&'a CraftFont> {
     faces.into_iter().filter(|f| f.covers("Arab")).collect()
 }
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index 1dc6ced2..749ef53a 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -5,13 +5,15 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+mod arabic;
 mod craft;
 mod encodings;
 pub mod pdf;
 mod script;
+pub use arabic::{ShapedCluster, arabic_glyph, arabic_has, shape_arabic};
 pub use craft::{
-    CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_japanese_font, document_japanese_font_for_style, document_japanese_fonts_for_style,
-    ui_arabic_fonts, ui_chinese_fonts, ui_cjk_fonts, ui_japanese_fonts, ui_telugu_fonts,
+    CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_arabic_font, document_japanese_font, document_japanese_font_for_style,
+    document_japanese_fonts_for_style, ui_arabic_fonts, ui_chinese_fonts, ui_cjk_fonts, ui_japanese_fonts, ui_telugu_fonts,
 };
 pub use script::{GlyphError, GlyphOutline, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, japanese_glyph_from, script_outline};
 
diff --git a/crates/fonts/src/script.rs b/crates/fonts/src/script.rs
index 1247ca25..04695ebe 100644
--- a/crates/fonts/src/script.rs
+++ b/crates/fonts/src/script.rs
@@ -2,7 +2,7 @@
 
 use skrifa::instance::{LocationRef, Size};
 use skrifa::outline::{DrawSettings, OutlinePen};
-use skrifa::{FontRef, MetadataProvider};
+use skrifa::{FontRef, GlyphId, MetadataProvider};
 
 static FONT: &[u8] = include_bytes!("../../../assets/fonts/DancingScript.ttf");
 
@@ -145,6 +145,13 @@ pub fn japanese_glyph_from(face: &crate::CraftFont, ch: char) -> Result<GlyphOut
     if !width.is_finite() || width <= 0.0 || width > 2.0 {
         return Err(GlyphError::Missing);
     }
+    bounded_outline(&font, gid, width)
+}
+
+/// Glyph `gid` of `font` in em units with advance `width`, bounded like [`japanese_glyph`].
+pub(crate) fn bounded_outline(font: &FontRef, gid: GlyphId, width: f64) -> Result<GlyphOutline, GlyphError> {
+    let loc = LocationRef::default();
+    let scale = 1.0 / font.metrics(Size::unscaled(), loc).units_per_em.max(1) as f64;
     let Some(glyph) = font.outline_glyphs().get(gid) else { return Err(GlyphError::Missing) };
     let mut pen = Flatten::new(scale);
     let _ = glyph.draw(DrawSettings::unhinted(Size::unscaled(), loc), &mut pen);
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 19698c15..21ab60ae 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1950,8 +1950,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.text"]
 tools = ["page_add_text", "content_update"]
-evidence = ["crates/ui-egui/tests/content.rs::typing_moving_styling_and_deleting_added_content", "crates/ui-egui/tests/content.rs::clicking_elsewhere_keeps_the_text_and_starts_a_new_box", "crates/automation/tests/automation.rs::adding_content_through_tools", "crates/edit/src/tests.rs::added_text_and_images_are_page_content_that_stays_editable", "crates/engine/src/tests.rs::added_text_and_images_render_and_stay_editable"]
-notes = "page content, editable later (retype, move, restyle); standard fonts, Windows-1252 text. Each click on the page keeps the box being typed and starts a new one; Done and Discard beside the box"
+evidence = ["crates/ui-egui/tests/content.rs::typing_moving_styling_and_deleting_added_content", "crates/ui-egui/tests/content.rs::clicking_elsewhere_keeps_the_text_and_starts_a_new_box", "crates/automation/tests/automation.rs::adding_content_through_tools", "crates/edit/src/tests.rs::added_text_and_images_are_page_content_that_stays_editable", "crates/engine/src/tests.rs::added_text_and_images_render_and_stay_editable", "crates/edit/src/tests.rs::added_arabic_text_is_shaped_in_display_order_and_stays_searchable"]
+notes = "page content, editable later (retype, move, restyle); standard fonts, Windows-1252 text. Arabic text is shaped with the craft-fonts Arab face (Type 3 outlines with ToUnicode) and laid out in bidirectional display order; it is drawn regular whatever the bold/italic setting, Hebrew and other right-to-left scripts are not covered, and typing in the box is still left to right (misc.rtl-ui). Each click on the page keeps the box being typed and starts a new one; Done and Discard beside the box"
 
 [[feature]]
 id = "edit.find-replace"

From 7c358099ffd8abdb0f7e92fe026745e871184080 Mon Sep 17 00:00:00 2001
From: Christian Schiffer <32165814+schiffer-soft@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:26:15 +0200
Subject: [PATCH 066/149] M14: German interface catalog (de) (#471)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M14: German interface catalog (de)

Deutsch (`de`) joins the interface languages as a complete catalog of
2,035 entries: every command, All tools entry, dialog, panel and notice.
It is selected from Preferences, and Auto picks it for `de`, `de_DE`,
`de_AT`, `de_CH` and other German locales. Wording uses the informal
"du" and the infinitive for commands; translations are clean-room, written
from the meaning of the English labels.

- de.tsv registered in LANGUAGES (plural rule one|other)
- tests: registration and locale mapping, plurals, coverage of every
  command, All tools label and tl! literal, history labels keeping user
  values; the Latin UI faces cover umlauts, ß and German quotes; the
  control-channel language switch includes `de`
- ATTRIBUTION.toml/.md entry (kind = "translation"), docs/localization.md,
  ROADMAP and parity notes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* M14: register German as the 12th language; translate the reopen-session preference (de, bg)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.md                  |    3 +-
 ATTRIBUTION.toml                |   13 +-
 ROADMAP.md                      |    5 +-
 crates/ui-egui/src/i18n/bg.tsv  |    1 +
 crates/ui-egui/src/i18n/de.tsv  | 2047 +++++++++++++++++++++++++++++++
 crates/ui-egui/src/i18n/mod.rs  |  113 +-
 crates/ui-egui/tests/control.rs |    2 +-
 crates/ui-egui/tests/fonts.rs   |    5 +-
 docs/localization.md            |   12 +-
 parity/acrobat-features.toml    |    2 +-
 10 files changed, 2188 insertions(+), 15 deletions(-)
 create mode 100644 crates/ui-egui/src/i18n/de.tsv

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 45353f1b..007e0330 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (254)
+## In this repository (255)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -14,6 +14,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/pt-br.tsv` | Brazilian Portuguese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/es.tsv` | Spanish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/fr.tsv` | French interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/de.tsv` | German interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ru.tsv` | Russian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/bg.tsv` | Bulgarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 9fe3bb10..5261bc97 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -76,6 +76,17 @@ kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
 sha256 = "dbf725ffc9177a435e894f4405834e87c70b6fe31a34f1be533c60c356510b97"
 
+[[asset]]
+path = "crates/ui-egui/src/i18n/de.tsv"
+title = "German interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "3827d04146f65a02e9d5e69336a97efc46862a48b18a16acbbc023ee0c8b7e1b"
+
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
 title = "Telugu interface translation catalog"
@@ -107,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "121c3881bf6ba69682ca6acae32303e3bf425479a8c2cb3e875c6598f5ffef7d"
+sha256 = "e71f683e410618200c0abe66a362a720cb8ded5bfd155bf825f92644373c54b5"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
diff --git a/ROADMAP.md b/ROADMAP.md
index 101b8eed..062e8417 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -79,7 +79,7 @@ The gaps that matter most, in priority order. Agents: prefer these over adding P
 3. **Measure fidelity against Acrobat.** Build a side-by-side harness (render, text, form behaviour) over synthetic fixtures (`plan/acrobat/`, clean-room rules apply). Until then, parity numbers count features, not quality.
 4. **Editing existing content (M7).** Fonts, subsets, reflow and CJK. The most visible gap for Pro users.
 5. **Pro workflows.** Signatures with timestamps and LTV (M9), OCR beyond Latin (M10), Office import/export (M10), preflight and PDF/A/X/UA (M11), XFA (M12).
-6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, Spanish, Japanese, Russian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
+6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, German, Spanish, Japanese, Russian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
 
 Decided against for now (owner, 2026-10-05): self-installing updates and an update check at start. Help ▸ Check for updates is manual only.
 
@@ -103,7 +103,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 165–290 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 23% | 155–295 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 33–66 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Spanish and French catalogs have ≈1,800 entries each; Simplified Chinese and French coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog. Missing: more catalogs filled in, installers, performance budgets |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, German, Spanish and French catalogs have ≈1,800 entries each; Simplified Chinese, French and German coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog. Missing: more catalogs filled in, installers, performance budgets |
 | | **Total (original plan sizing)** | **2,085–3,840** | **≈ 35%** | **≈ 1,350–2,500 at the planned rate; ≈ 600–1,100 at the measured rate** | |
 
 **Overall progress: about 30–35% of the effort (51.0% of features shipped).** The viewer and the core are far ahead of the editing features, because the viewer was built first so progress could be seen; rendering itself is still borrowed from `hayro`. See [Honest assessment](#honest-assessment-2026-10-05).
@@ -139,6 +139,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (community, M14, German):** Deutsch (`de`) is a complete interface catalog (2,035 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `de`, `de_DE`, `de_AT`, `de_CH` and other German locales, and from Preferences. Informal "du", infinitive for commands. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover umlauts, ß and German quotes. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, M7, Arabic added text):** Add text writes Arabic into the PDF instead of `?`. The text is shaped with the craft-fonts `Arab` face through harfrust (already in the tree via egui): joining forms, ligatures and mark positions. Each line is laid out in display order by the Unicode bidirectional algorithm, so Arabic mixed with Latin words, European or Arabic-Indic digits and brackets reads correctly; justified right-to-left paragraphs end at the right edge. Each cluster (a letter with its dots or marks) becomes one glyph of a Type 3 font built from the face's outlines, with a ToUnicode entry, so `text_extract`, copy and search get every letter once and no font file is embedded. Wrapping measures shaped words. Each item has its own fonts under names free on the page (a full save renumbers objects but not resource names); updating or deleting the item removes them. Without the face, adding Arabic text returns a clear error and changes nothing, while an existing item holding Arabic still moves and retypes, drawn as `?` as before. Tests cover shaping, display order, ToUnicode, font names and clean-up on one page, and odd input (empty lines, direction controls, lone marks, 18,000 characters). Not yet: bold/italic Arabic, Hebrew, right-to-left typing in the box (misc.rtl-ui), editing existing Arabic text (edit.rtl-cjk-editing). The craft-fonts revision pinned for releases predates its Arabic face, so release builds report the missing font until the pin moves. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, document inspection):** Annotation dates preserve non-date Unicode text instead of panicking while opening; failed auxiliary structure inspection keeps renderer page geometry and reports a warning. Synthetic UTF16BE annotation, UTF8-boundary and independent panic regressions cover the fix. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 08d8775b..d260b886 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2042,3 +2042,4 @@ comment menu	Edit	Редактирай
 signature pad	Type	Въвеждане
 action wizard	Start	Старт
 	Margins (in)	Полета (in)
+	Reopen the files that were open when PdfCraft last closed	Отваряй отново файловете, които бяха отворени при последното затваряне на PdfCraft
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
new file mode 100644
index 00000000..a8497fc9
--- /dev/null
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -0,0 +1,2047 @@
+# German (de) catalog. Format: see the header of ja.tsv
+# (context <TAB> source <TAB> translation; @id, @plural and other contexts; escapes \n \t \\).
+# Plural forms (see `plural_one_other` in i18n/mod.rs): one (1) | other (0, 2, 3 ...).
+#
+# Clean-room: every entry was written from the plain meaning of the English label using ordinary
+# German computing vocabulary (informal lowercase "du", infinitive for commands). No proprietary
+# localisation resource, string table or product UI (Acrobat's included) was consulted or copied;
+# add entries the same way.
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
+# the trailing "…" of dialog commands is kept.
+
+	Menu	Menü
+	File	Datei
+	Edit	Bearbeiten
+	Pages	Seiten
+	View	Ansicht
+	Help	Hilfe
+	Preferences	Einstellungen
+	Preferences…	Einstellungen…
+	Interface language	Sprache der Oberfläche
+	Identity	Identität
+	Name on new comments	Name für neue Kommentare
+	Open…	Öffnen…
+	New blank PDF	Neues leeres PDF
+	Create PDF from file…	PDF aus Datei erstellen…
+	Create PDF from images…	PDF aus Bildern erstellen…
+	Create PDF from multiple files…	PDF aus mehreren Dateien erstellen…
+	Create PDF from clipboard	PDF aus Zwischenablage erstellen
+	Combine files…	Dateien kombinieren…
+	Save	Speichern
+	Save as…	Speichern unter…
+	Close file	Datei schließen
+	Close all	Alle schließen
+	Revert	Zurücksetzen
+	Print…	Drucken…
+	Document properties…	Dokumenteigenschaften…
+	Undo	Rückgängig
+	Redo	Wiederholen
+	Find…	Suchen…
+	Advanced search…	Erweiterte Suche…
+	Copy pages	Seiten kopieren
+	Cut pages	Seiten ausschneiden
+	Paste pages	Seiten einfügen
+	Fit visible	Sichtbaren Inhalt einpassen
+	Marquee zoom	Auswahlrahmen-Zoom
+	Take a snapshot	Schnappschuss erstellen
+	Full screen mode	Vollbildmodus
+	Read mode	Lesemodus
+	Switch light / dark theme	Helles / dunkles Design umschalten
+	Comments panel	Kommentarbereich
+	Form fields panel	Formularfeldbereich
+	Clear form	Formular leeren
+	Find tools and commands…	Werkzeuge und Befehle suchen…
+	Zoom	Zoom
+	Actual size	Originalgröße
+	Zoom to page level	Ganze Seite
+	Fit to width	Seitenbreite
+	Display theme	Design
+	Side panels	Seitenleisten
+	Enable Acrobat JavaScript	Acrobat-JavaScript aktivieren
+	OK	OK
+	Join our Discord	Unserem Discord beitreten
+	Close	Schließen
+	Next / previous match	Nächster / vorheriger Treffer
+	Copy selected text	Ausgewählten Text kopieren
+	Double-click	Doppelklick
+	Select a word	Wort auswählen
+	Clear selection / close find	Auswahl aufheben / Suche schließen
+	Zoom in / out (also pinch or ⌘-scroll)	Vergrößern / Verkleinern (auch per Pinch-Geste oder ⌘ + Scrollen)
+	Rotate view	Ansicht drehen
+	First / last page	Erste / letzte Seite
+	Previous / next page	Vorherige / nächste Seite
+	Delete selected pages (Organize)	Ausgewählte Seiten löschen (Organisieren)
+	Select all pages (Organize)	Alle Seiten auswählen (Organisieren)
+	Home	Start
+	Open	Öffnen
+	Open a PDF (⌘O)	PDF öffnen (⌘O)
+	Dark gray theme	Dunkelgraues Design
+	Light theme	Helles Design
+	All tools	Alle Werkzeuge
+	Read	Lesen
+	Convert	Konvertieren
+	E-Sign	E-Signatur
+	Print (⌘P)	Drucken (⌘P)
+	Save (M4)	Speichern (M4)
+	Document properties (⌘D)	Dokumenteigenschaften (⌘D)
+	Find tools and commands	Werkzeuge und Befehle suchen
+	Fit to height	Seitenhöhe
+	Zoom in	Vergrößern
+	Zoom out	Verkleinern
+	Rotate view clockwise	Ansicht im Uhrzeigersinn drehen
+	Rotate view counterclockwise	Ansicht gegen den Uhrzeigersinn drehen
+	Page navigation	Seitennavigation
+	Previous view	Vorherige Ansicht
+	Next view	Nächste Ansicht
+	Page display	Seitenanzeige
+	Continuous scrolling	Fortlaufend blättern
+	Two-page view	Doppelseitenansicht
+	Single page	Einzelseite
+	Show cover page in two-page view	Deckblatt in Doppelseitenansicht anzeigen
+	Use system setting	Systemeinstellung verwenden
+	Light gray	Hellgrau
+	Dark gray	Dunkelgrau
+	Comments	Kommentare
+	Bookmarks	Lesezeichen
+	Fields	Felder
+	Layers	Ebenen
+	Attachments	Anhänge
+	Signatures	Signaturen
+	Accessibility Checker	Barrierefreiheitsprüfung
+	Search	Suchen
+	Compare	Vergleichen
+	Page thumbnails	Seitenminiaturen
+	Form fields	Formularfelder
+	Zoom out (⌘−)	Verkleinern (⌘−)
+	Zoom in (⌘+)	Vergrößern (⌘+)
+	Rotate view clockwise (⇧⌘+)	Ansicht im Uhrzeigersinn drehen (⇧⌘+)
+	Toggle fit page / fit width	Ganze Seite / Seitenbreite umschalten
+	Next page	Nächste Seite
+	Previous page	Vorherige Seite
+	Current page — type a page number or label (such as iv) and press Enter	Aktuelle Seite – gib eine Seitenzahl oder -beschriftung ein (z. B. iv) und drücke die Eingabetaste
+	Welcome to PdfCraft	Willkommen bei PdfCraft
+	An open-source PDF workbench — local, private, and scriptable.	Eine Open-Source-PDF-Werkbank – lokal, privat und skriptfähig.
+	Join the ArtCraft community	Tritt der ArtCraft-Community bei
+	Get help, share feedback and follow development on Discord.	Hol dir Hilfe, gib Feedback und verfolge die Entwicklung auf Discord.
+	Recommended tools	Empfohlene Werkzeuge
+	Use now	Jetzt verwenden
+	Open file	Datei öffnen
+	Recent	Zuletzt geöffnet
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	Dateien, die du in PdfCraft öffnest, erscheinen hier. Zieh ein PDF an eine beliebige Stelle, um es zu öffnen.
+	Privacy	Datenschutz
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft funktioniert offline. Keine Telemetrie, kein Konto und keine Cloud-Verarbeitung, solange du keinen Anbieter hinzufügst.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Skripte laufen in einer Sandbox ohne Datei- oder Netzwerkzugriff. Auch bei deaktiviertem JavaScript funktionieren die Acrobat-Standardfunktionen zum Formatieren, Prüfen und Berechnen weiterhin.
+	Back to all tools	Zurück zu allen Werkzeugen
+	Close panel	Bereich schließen
+	View less	Weniger anzeigen
+	View more	Mehr anzeigen
+	Available	Verfügbar
+	Ready	Bereit
+	Search tools and commands…	Werkzeuge und Befehle suchen…
+	No matching tools	Keine passenden Werkzeuge
+	Tool	Werkzeug
+	Command	Befehl
+	Add a sticky note	Notiz hinzufügen
+	Add a text box	Textfeld hinzufügen
+	Highlight text	Text hervorheben
+	Underline text	Text unterstreichen
+	Strikethrough text	Text durchstreichen
+	Squiggly underline text	Text mit Schlangenlinie unterstreichen
+	Draw freehand	Freihand zeichnen
+	Draw a line	Linie zeichnen
+	Draw an arrow	Pfeil zeichnen
+	Draw a rectangle	Rechteck zeichnen
+	Draw an oval	Ellipse zeichnen
+	Draw a polygon	Polygon zeichnen
+	Draw connected lines	Verbundene Linien zeichnen
+	Draw a cloud	Wolke zeichnen
+	Add a callout	Legende hinzufügen
+	Insert text	Text einfügen
+	Replace text	Text ersetzen
+	Attach a file	Datei anhängen
+	Erase drawings	Zeichnungen radieren
+	Flatten comments	Kommentare reduzieren
+	Import comments…	Kommentare importieren…
+	Add a stamp	Stempel hinzufügen
+	Export all comments to data file…	Alle Kommentare in Datendatei exportieren…
+	Hide all comments	Alle Kommentare ausblenden
+	Summarize comments	Kommentare zusammenfassen
+	Import form data…	Formulardaten importieren…
+	Export form data…	Formulardaten exportieren…
+	PDF/A…	PDF/A…
+	Action Wizard…	Aktionsassistent…
+	Prepare for distribution…	Für Weitergabe vorbereiten…
+	Optimize scanned documents…	Gescannte Dokumente optimieren…
+	Compare files…	Dateien vergleichen…
+	Detect form fields	Formularfelder erkennen
+	Merge data files into spreadsheet…	Datendateien in Tabelle zusammenführen…
+	Flatten form fields	Formularfelder reduzieren
+	Prepare a form	Formular vorbereiten
+	Tab order: by rows	Tab-Reihenfolge: nach Zeilen
+	Tab order: by columns	Tab-Reihenfolge: nach Spalten
+	Tab order: by document structure	Tab-Reihenfolge: nach Dokumentstruktur
+	Add text	Text hinzufügen
+	Edit text & images	Text und Bilder bearbeiten
+	Add or edit links	Links hinzufügen oder bearbeiten
+	Create links from URLs	Links aus URLs erstellen
+	Remove all links	Alle Links entfernen
+	Add Bates numbering…	Bates-Nummerierung hinzufügen…
+	Add image…	Bild hinzufügen…
+	Redact text and images	Text und Bilder schwärzen
+	Redact pages…	Seiten schwärzen…
+	Find text and redact…	Text suchen und schwärzen…
+	Redaction properties…	Schwärzungseigenschaften…
+	Apply redactions…	Schwärzungen anwenden…
+	Clear redaction marks	Schwärzungsmarkierungen entfernen
+	Remove hidden information…	Ausgeblendete Informationen entfernen…
+	Sanitize document…	Dokument bereinigen…
+	Field properties…	Feldeigenschaften…
+	Add a text field	Textfeld hinzufügen
+	Add a checkbox	Kontrollkästchen hinzufügen
+	Add a radio button	Optionsfeld hinzufügen
+	Add a drop-down list	Dropdown-Liste hinzufügen
+	Add a list box	Listenfeld hinzufügen
+	Add a button	Schaltfläche hinzufügen
+	Add an image field	Bildfeld hinzufügen
+	Add a date field	Datumsfeld hinzufügen
+	Add a digital signature field	Feld für digitale Signatur hinzufügen
+	Digitally sign	Digital signieren
+	Certify (visible signature)	Zertifizieren (sichtbare Signatur)
+	Certify (invisible signature)	Zertifizieren (unsichtbare Signatur)
+	Validate all signatures	Alle Signaturen validieren
+	Signatures panel	Signaturbereich
+	Fill & Sign: add text	Ausfüllen und unterschreiben: Text hinzufügen
+	Fill & Sign: checkmark	Ausfüllen und unterschreiben: Häkchen
+	Fill & Sign: cross	Ausfüllen und unterschreiben: Kreuz
+	Fill & Sign: dot	Ausfüllen und unterschreiben: Punkt
+	Fill & Sign: line	Ausfüllen und unterschreiben: Linie
+	Fill & Sign: date	Ausfüllen und unterschreiben: Datum
+	Fill & Sign: sign	Ausfüllen und unterschreiben: Unterschreiben
+	Fill & Sign: initials	Ausfüllen und unterschreiben: Initialen
+	Export to image…	Als Bild exportieren…
+	Reduce file size…	Dateigröße reduzieren…
+	Optimize PDF…	PDF optimieren…
+	Export to text…	Als Text exportieren…
+	Export to Word…	Nach Word exportieren…
+	Export to HTML…	Als HTML exportieren…
+	Export to RTF…	Als RTF exportieren…
+	JavaScript console…	JavaScript-Konsole…
+	Document JavaScripts…	Dokument-JavaScripts…
+	Recognize text…	Text erkennen…
+	Recognize text in multiple files…	Text in mehreren Dateien erkennen…
+	Check for accessibility…	Barrierefreiheit prüfen…
+	Open accessibility report	Barrierefreiheitsbericht öffnen
+	Change reading options…	Leseoptionen ändern…
+	Add alternate text…	Alternativtext hinzufügen…
+	Export all images…	Alle Bilder exportieren…
+	Add header & footer…	Kopf- und Fußzeile hinzufügen…
+	Update header & footer…	Kopf- und Fußzeile aktualisieren…
+	Remove header & footer	Kopf- und Fußzeile entfernen
+	Add watermark…	Wasserzeichen hinzufügen…
+	Update watermark…	Wasserzeichen aktualisieren…
+	Remove watermark	Wasserzeichen entfernen
+	Add background…	Hintergrund hinzufügen…
+	Update background…	Hintergrund aktualisieren…
+	Remove background	Hintergrund entfernen
+	Protect using password…	Mit Passwort schützen…
+	Remove security	Sicherheit entfernen
+	Security properties…	Sicherheitseigenschaften…
+	Organize pages	Seiten organisieren
+	New bookmark	Neues Lesezeichen
+	Rotate pages clockwise	Seiten im Uhrzeigersinn drehen
+	Rotate pages counterclockwise	Seiten gegen den Uhrzeigersinn drehen
+	Delete pages	Seiten löschen
+	Insert blank page	Leere Seite einfügen
+	Rotate pages…	Seiten drehen…
+	Duplicate pages	Seiten duplizieren
+	Crop pages	Seiten zuschneiden
+	Set page boxes…	Seitenrahmen festlegen…
+	Insert pages from file…	Seiten aus Datei einfügen…
+	Replace pages…	Seiten ersetzen…
+	Extract pages…	Seiten extrahieren…
+	Split document…	Dokument teilen…
+	Number pages…	Seiten nummerieren…
+	Keyboard shortcuts	Tastenkürzel
+	Join the ArtCraft Discord	Dem ArtCraft-Discord beitreten
+	PdfCraft web page	PdfCraft-Webseite
+	PdfCraft on GitHub	PdfCraft auf GitHub
+	ArtCraft website	ArtCraft-Website
+	Check for updates…	Nach Updates suchen…
+	About PdfCraft	Über PdfCraft
+	Export a PDF	PDF exportieren
+	Export to	Exportieren nach
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Spreadsheet (.xlsx)	Tabelle (.xlsx)
+	Presentation (.pptx)	Präsentation (.pptx)
+	Image (PNG)	Bild (PNG)
+	Export all images	Alle Bilder exportieren
+	HTML web page	HTML-Webseite
+	Rich Text Format (.rtf)	Rich Text Format (.rtf)
+	Text (plain)	Text (unformatiert)
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	Ausfüllen und unterschreiben
+	Fill	Ausfüllen
+	Checkmark	Häkchen
+	Cross	Kreuz
+	Dot	Punkt
+	Line	Linie
+	Date	Datum
+	Signature	Unterschrift
+	Initials	Initialen
+	Edit a PDF	PDF bearbeiten
+	Modify page	Seite ändern
+	Rotate pages	Seiten drehen
+	Insert pages	Seiten einfügen
+	Extract pages	Seiten extrahieren
+	Add content	Inhalt hinzufügen
+	Text	Text
+	Image	Bild
+	Header and footer	Kopf- und Fußzeile
+	Watermark	Wasserzeichen
+	Link	Link
+	Bates numbering	Bates-Nummerierung
+	Background	Hintergrund
+	Attach file	Datei anhängen
+	Create a PDF	PDF erstellen
+	Create from	Erstellen aus
+	Single file	Einzelne Datei
+	Multiple files	Mehrere Dateien
+	Images	Bilder
+	Clipboard	Zwischenablage
+	Blank page	Leere Seite
+	Combine files	Dateien kombinieren
+	Combine	Kombinieren
+	Add files to combine	Dateien zum Kombinieren hinzufügen
+	Page options	Seitenoptionen
+	Page grid	Seitenraster
+	Rotate	Drehen
+	Delete	Löschen
+	Extract	Extrahieren
+	Insert	Einfügen
+	Replace	Ersetzen
+	Split	Teilen
+	More	Mehr
+	Set page boxes	Seitenrahmen festlegen
+	Page labels	Seitenbeschriftungen
+	Page transitions	Seitenübergänge
+	Add comments	Kommentare hinzufügen
+	Markup	Markierungen
+	Sticky note	Notiz
+	Underline	Unterstreichen
+	Strikethrough	Durchstreichen
+	Squiggly underline	Schlangenlinie
+	Text box	Textfeld
+	Drawing	Zeichnen
+	Rectangle	Rechteck
+	Oval	Ellipse
+	Arrow	Pfeil
+	Cloud	Wolke
+	Stamp	Stempel
+	Review	Überprüfen
+	Comment list	Kommentarliste
+	Scan & OCR	Scan und OCR
+	Recognize text	Text erkennen
+	In this file	In dieser Datei
+	In multiple files	In mehreren Dateien
+	Enhance scanned file	Gescannte Datei verbessern
+	Correct recognized text	Erkannten Text korrigieren
+	Protect a PDF	PDF schützen
+	Protect	Schützen
+	Protect with password	Mit Passwort schützen
+	Remove hidden information	Ausgeblendete Informationen entfernen
+	Advanced options	Erweiterte Optionen
+	Encrypt with certificate	Mit Zertifikat verschlüsseln
+	Security properties	Sicherheitseigenschaften
+	Redact a PDF	PDF schwärzen
+	Redact	Schwärzen
+	Redact pages	Seiten schwärzen
+	Find text and redact	Text suchen und schwärzen
+	Set properties	Eigenschaften festlegen
+	Sanitize document	Dokument bereinigen
+	Compress a PDF	PDF komprimieren
+	Optimize	Optimieren
+	Reduce file size	Dateigröße reduzieren
+	Advanced optimization	Erweiterte Optimierung
+	Audit space usage	Speicherbelegung prüfen
+	Field list	Feldliste
+	Field properties	Feldeigenschaften
+	Tab order by rows	Tab-Reihenfolge nach Zeilen
+	Tab order by columns	Tab-Reihenfolge nach Spalten
+	Import data	Daten importieren
+	Export data	Daten exportieren
+	Add form components	Formularelemente hinzufügen
+	Text field	Textfeld
+	Checkbox	Kontrollkästchen
+	Radio button	Optionsfeld
+	Drop-down list	Dropdown-Liste
+	List box	Listenfeld
+	Button	Schaltfläche
+	Image field	Bildfeld
+	Date field	Datumsfeld
+	Digital signature	Digitale Signatur
+	Stamps	Stempel
+	Stamp palette	Stempelpalette
+	Use a certificate	Zertifikat verwenden
+	Certificates	Zertifikate
+	Timestamp	Zeitstempel
+	Use print production	Druckproduktion verwenden
+	Print production	Druckproduktion
+	Output preview	Ausgabevorschau
+	Preflight	Preflight
+	Convert colors	Farben konvertieren
+	Add printer marks	Druckermarken hinzufügen
+	Fix hairlines	Haarlinien korrigieren
+	Measure objects	Objekte messen
+	Measure	Messen
+	Measuring tool	Messwerkzeug
+	Geospatial location	Geografische Position
+	Compare files	Dateien vergleichen
+	Select files to compare	Dateien zum Vergleichen auswählen
+	Use guided actions	Geführte Aktionen verwenden
+	Actions list	Aktionsliste
+	Action Wizard	Aktionsassistent
+	Make accessible	Barrierefrei machen
+	Prepare for distribution	Für Weitergabe vorbereiten
+	Optimize scanned documents	Gescannte Dokumente optimieren
+	Archive documents	Dokumente archivieren
+	Prepare for accessibility	Für Barrierefreiheit vorbereiten
+	Accessibility	Barrierefreiheit
+	Automatically tag PDF	PDF automatisch taggen
+	Change reading options	Leseoptionen ändern
+	Check for accessibility	Barrierefreiheit prüfen
+	Add alternate text	Alternativtext hinzufügen
+	Fix reading order	Lesereihenfolge korrigieren
+	Apply PDF standards	PDF-Standards anwenden
+	Standards	Standards
+	Save as PDF/A	Als PDF/A speichern
+	Save as PDF/X	Als PDF/X speichern
+	Save as PDF/UA	Als PDF/UA speichern
+	Add search index	Suchindex hinzufügen
+	Index	Index
+	Manage embedded index	Eingebetteten Index verwalten
+	Use JavaScript	JavaScript verwenden
+	JavaScript	JavaScript
+	Console	Konsole
+	Document JavaScripts	Dokument-JavaScripts
+	Document actions	Dokumentaktionen
+	AI assistant	KI-Assistent
+	Bring your own model (off by default)	Eigenes Modell nutzen (standardmäßig aus)
+	Summarize	Zusammenfassen
+	Ask about this document	Fragen zu diesem Dokument stellen
+	Translate	Übersetzen
+	pages	Seiten
+	Planned	Geplant
+	Planned for milestone	Geplant für Meilenstein
+	open to see what it will include	öffne es, um zu sehen, was enthalten sein wird
+	Optional: needs an AI provider you configure	Optional: erfordert einen von dir eingerichteten KI-Anbieter
+	Coming in milestone	Kommt mit Meilenstein
+	Items marked Ready work today.	Als „Bereit“ markierte Einträge funktionieren schon heute.
+	Preview	Vorschau
+	Edit fields	Felder bearbeiten
+	Try the form as people filling it in will see it	Teste das Formular so, wie es Ausfüllende sehen
+	Redact all	Alle schwärzen
+	Clear all	Alle entfernen
+	Rotate page	Seite drehen
+	Delete page	Seite löschen
+	Move page	Seite verschieben
+	Move pages	Seiten verschieben
+	Duplicate page	Seite duplizieren
+	Replace page	Seite ersetzen
+	Replace pages	Seiten ersetzen
+	Crop page	Seite zuschneiden
+	Cancel	Abbrechen
+	Don't save	Nicht speichern
+	Apply	Anwenden
+	Run	Ausführen
+	Clear	Leeren
+	Sanitize	Bereinigen
+	Mark all	Alle markieren
+	Save changes to “{name}” before closing?	Änderungen an „{name}“ vor dem Schließen speichern?
+	Your changes will be lost if you don't save them.	Deine Änderungen gehen verloren, wenn du sie nicht speicherst.
+	Password required	Passwort erforderlich
+	“{name}” is protected. Enter a password to open it.	„{name}“ ist geschützt. Gib ein Passwort ein, um es zu öffnen.
+	Password	Passwort
+	Incorrect password. Try again.	Falsches Passwort. Versuch es noch einmal.
+	Recognize Text	Text erkennen
+	Password protection will be applied when you save	Der Passwortschutz wird beim Speichern angewendet
+	Saved the print-ready PDF to {path}	Druckfertiges PDF unter {path} gespeichert
+	Could not save: {e}	Speichern fehlgeschlagen: {e}
+	Earlier in tab order	Früher in der Tab-Reihenfolge
+	Later in tab order	Später in der Tab-Reihenfolge
+	From:	Von:
+	To:	Bis:
+	High Resolution	Hohe Auflösung
+	Print	Drucken
+	Verify to see what the document needs.	Führe eine Prüfung durch, um zu sehen, was das Dokument benötigt.
+	Set Page Boxes	Seitenrahmen festlegen
+	Signature panel	Signaturbereich
+	{month} {day}, {y}	{day}. {month} {y}
+	The document's security settings don't allow filling in form fields	Die Sicherheitseinstellungen des Dokuments erlauben kein Ausfüllen von Formularfeldern
+	{name} is read-only	{name} ist schreibgeschützt
+	{name} has no action	{name} hat keine Aktion
+	Previous month	Vorheriger Monat
+	Next month	Nächster Monat
+	January	Januar
+	February	Februar
+	March	März
+	April	April
+	May	Mai
+	June	Juni
+	July	Juli
+	August	August
+	September	September
+	October	Oktober
+	November	November
+	December	Dezember
+	Done	Fertig
+	This certificate is in your list of trusted certificates.	Dieses Zertifikat steht in deiner Liste vertrauenswürdiger Zertifikate.
+	This certificate is trusted through a certificate above it in the chain.	Diesem Zertifikat wird über ein übergeordnetes Zertifikat in der Kette vertraut.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Diesem Zertifikat wird nicht vertraut. Damit erstellte Signaturen zeigen eine unbekannte Identität.
+	Add to Trusted Certificates	Zu vertrauenswürdigen Zertifikaten hinzufügen
+	Export…	Exportieren…
+	PDF Optimizer	PDF-Optimierung
+	Discard Objects	Objekte verwerfen
+	Discard User Data	Benutzerdaten verwerfen
+	Clean Up	Aufräumen
+	Color Images	Farbbilder
+	Grayscale Images	Graustufenbilder
+	Bicubic downsampling to	Bikubische Neuberechnung auf
+	for images above	für Bilder über
+	Compression	Komprimierung
+	ZIP	ZIP
+	Retain existing	Bestehende beibehalten
+	Minimum	Minimal
+	Low	Niedrig
+	High	Hoch
+	Maximum	Maximal
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Jedes Bild wird in der Größe gemessen, in der es auf den Seiten erscheint; ersetzt wird es nur, wenn das Ergebnis kleiner ist.
+	Discard all links, actions and JavaScript	Alle Links, Aktionen und JavaScript verwerfen
+	Discard alternate images	Alternative Bilder verwerfen
+	Discard embedded page thumbnails	Eingebettete Seitenminiaturen verwerfen
+	Discard document tags	Dokument-Tags verwerfen
+	Discard embedded print settings	Eingebettete Druckeinstellungen verwerfen
+	Discard bookmarks	Lesezeichen verwerfen
+	Discard hidden layer content	Inhalt ausgeblendeter Ebenen verwerfen
+	Discard all comments, forms and multimedia	Alle Kommentare, Formulare und Multimedia-Inhalte verwerfen
+	Discard document information and metadata	Dokumentinformationen und Metadaten verwerfen
+	Discard all object data (file attachments)	Alle Objektdaten (Dateianhänge) verwerfen
+	Discard private data of other applications	Private Daten anderer Anwendungen verwerfen
+	Discard hidden text	Ausgeblendeten Text verwerfen
+	Use Flate to encode streams that are not encoded	Nicht codierte Streams mit Flate codieren
+	Remove invalid links and bookmarks	Ungültige Links und Lesezeichen entfernen
+	Remove unreferenced named destinations	Nicht referenzierte benannte Ziele entfernen
+	Compress document structure (object streams)	Dokumentstruktur komprimieren (Objekt-Streams)
+	Remove unused objects and merge identical ones	Unbenutzte Objekte entfernen und identische zusammenführen
+	Audit space usage…	Speicherbelegung prüfen…
+	Space Audit	Speicherbelegung
+	Bytes	Bytes
+	Content Streams	Inhalts-Streams
+	X Object Forms	XObject-Formulare
+	Structure Info	Strukturinformationen
+	Thumbnails	Miniaturansichten
+	Named Destinations	Benannte Ziele
+	Color Spaces	Farbräume
+	Shadings	Verläufe
+	Patterns (graphics objects)	Muster (Grafikobjekte)
+	Extended Graphics States	Erweiterte Grafikzustände
+	Embedded Files	Eingebettete Dateien
+	Document Overhead	Dokument-Overhead
+	Total	Gesamt
+	Text Field Properties	Textfeld-Eigenschaften
+	Check Box Properties	Kontrollkästchen-Eigenschaften
+	Radio Button Properties	Optionsfeld-Eigenschaften
+	Dropdown Properties	Dropdown-Liste-Eigenschaften
+	List Box Properties	Listenfeld-Eigenschaften
+	Button Properties	Schaltflächen-Eigenschaften
+	Digital Signature Properties	Eigenschaften der digitalen Signatur
+	Position	Position
+	Options	Optionen
+	Validate	Prüfen
+	Calculate	Berechnen
+	Actions	Aktionen
+	This field is locked. Unlock it to change its properties.	Dieses Feld ist gesperrt. Entsperre es, um seine Eigenschaften zu ändern.
+	Tooltip:	Tooltip:
+	Common Properties	Allgemeine Eigenschaften
+	Read Only	Schreibgeschützt
+	Required	Erforderlich
+	Font Size:	Schriftgröße:
+	Auto	Automatisch
+	Text Color:	Textfarbe:
+	Borders and Colors	Rahmen und Farben
+	Border Color:	Rahmenfarbe:
+	Fill Color:	Füllfarbe:
+	No color	Keine Farbe
+	Beveled	Abgeschrägt
+	Left:	Links:
+	Bottom:	Unten:
+	Width:	Breite:
+	Height:	Höhe:
+	Points from the page's bottom-left corner.	Punkte ab der unteren linken Ecke der Seite.
+	Alignment:	Ausrichtung:
+	Default Value:	Standardwert:
+	Multi-line	Mehrzeilig
+	Scroll long text	Langen Text scrollen
+	Allow Rich Text Formatting	Rich-Text-Formatierung zulassen
+	Limit of	Begrenzen auf
+	characters	Zeichen
+	Field is used for file selection	Feld dient zur Dateiauswahl
+	Check spelling	Rechtschreibung prüfen
+	Comb of	Kammfeld mit
+	Export Value: {on}	Exportwert: {on}
+	Check box is checked by default	Kontrollkästchen ist standardmäßig aktiviert
+	Button is checked by default	Schaltfläche ist standardmäßig aktiviert
+	Buttons with the same name and value are selected in unison	Schaltflächen mit gleichem Namen und Wert werden gemeinsam ausgewählt
+	Item:	Eintrag:
+	Item List	Eintragsliste
+	Up	Nach oben
+	Delete {o}	{o} löschen
+	Add the choices people pick from.	Füge die Auswahlmöglichkeiten hinzu, aus denen gewählt werden kann.
+	Default:	Standard:
+	(none)	(keine)
+	Sort items	Einträge sortieren
+	Allow user to enter custom text	Eingabe eigener Texte erlauben
+	Multiple selection	Mehrfachauswahl
+	Commit selected value immediately	Ausgewählten Wert sofort übernehmen
+	Number	Zahl
+	Percentage	Prozent
+	Time	Uhrzeit
+	Special	Spezial
+	Select format category:	Formatkategorie auswählen:
+	The value is shown as typed.	Der Wert wird so angezeigt, wie er eingegeben wurde.
+	Decimal places:	Dezimalstellen:
+	Separator style:	Trennzeichen:
+	Currency symbol:	Währungssymbol:
+	Before the number	Vor der Zahl
+	Negative number style:	Darstellung negativer Zahlen:
+	Format:	Format:
+	Custom:	Benutzerdefiniert:
+	Zip Code	US-Postleitzahl
+	Zip Code + 4	US-Postleitzahl + 4
+	Phone Number	Telefonnummer
+	Social Security Number	US-Sozialversicherungsnummer
+	Arbitrary Mask	Beliebige Maske
+	Mask:	Maske:
+	9 digit, A letter, O letter or digit, X any character	9 Ziffer, A Buchstabe, O Buchstabe oder Ziffer, X beliebiges Zeichen
+	Example: {sample}	Beispiel: {sample}
+	Field value is not validated	Feldwert wird nicht geprüft
+	Field value is in range:	Feldwert liegt im Bereich:
+	Add an Action	Aktion hinzufügen
+	Select Trigger:	Auslöser auswählen:
+	Mouse Up	Maustaste loslassen
+	Mouse Down	Maustaste drücken
+	Mouse Enter	Maus hinein
+	Mouse Exit	Maus heraus
+	On Focus	Fokus erhalten
+	On Blur	Fokus verlieren
+	Select Action:	Aktion auswählen:
+	Open a web link	Weblink öffnen
+	Reset a form	Formular zurücksetzen
+	Execute a menu item	Menübefehl ausführen
+	Show a field	Feld einblenden
+	Hide a field	Feld ausblenden
+	Submit a form	Formular senden
+	Fields to reset (comma-separated; empty: all)	Zurückzusetzende Felder (kommagetrennt; leer: alle)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage oder LastPage
+	Field names (comma-separated)	Feldnamen (kommagetrennt)
+	URL to submit to	Ziel-URL zum Senden
+	Script:	Skript:
+	Value:	Wert:
+	No actions	Keine Aktionen
+	Value is not calculated	Wert wird nicht berechnet
+	Value is the	Wert ist
+	sum (+)	Summe (+)
+	product (x)	Produkt (x)
+	average	Durchschnitt
+	minimum	Minimum
+	maximum	Maximum
+	of the following fields:	der folgenden Felder:
+	Simplified field notation:	Vereinfachte Feldschreibweise:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Feldnamen mit + - * / und Klammern; setze \\ vor Leerzeichen in Namen.
+	Format text	Text formatieren
+	Bold	Fett
+	Italic	Kursiv
+	Align left	Linksbündig
+	Centre	Zentriert
+	Align right	Rechtsbündig
+	Justify	Blocksatz
+	Standard fonts; text outside Windows-1252 isn't supported yet.	Standardschriften; Text außerhalb von Windows-1252 wird noch nicht unterstützt.
+	Edit image	Bild bearbeiten
+	Rotate counterclockwise	Gegen den Uhrzeigersinn drehen
+	Rotate clockwise	Im Uhrzeigersinn drehen
+	Flip horizontal	Horizontal spiegeln
+	Flip vertical	Vertikal spiegeln
+	Replace image	Bild ersetzen
+	Crop (% trimmed from each side)	Zuschneiden (% je Seite entfernt)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Klicke auf die Seite, um Text hinzuzufügen; jeder Klick beginnt ein neues Feld, ✓ schließt ab. Ziehe Elemente, um sie zu verschieben, ziehe an einer Ecke, um die Größe zu ändern, und doppelklicke auf Text, um ihn zu bearbeiten.
+	Choose an image	Bild auswählen
+	Export to Image	Als Bild exportieren
+	Export to Text	Als Text exportieren
+	Export All Images	Alle Bilder exportieren
+	Resolution	Auflösung
+	Format	Format
+	Quality	Qualität
+	One {f} file per page, named after the document.	Eine {f}-Datei pro Seite, benannt nach dem Dokument.
+	Exclude images smaller than	Bilder ausschließen, die kleiner sind als
+	No limit	Keine Grenze
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Jedes Bild einmal, benannt nach Dokument und Seite. JPEG-Bilder werden unverändert gespeichert, alle anderen als PNG.
+	Plain text in reading order; pages are separated by form feeds.	Reiner Text in Lesereihenfolge; Seiten werden durch Seitenvorschübe getrennt.
+	Create {what}	{what} erstellen
+	initials	Initialen
+	signature	Unterschrift
+	Create Custom Stamp	Eigenen Stempel erstellen
+	From {file}	Aus {file}
+	Category:	Kategorie:
+	e.g. My stamps	z. B. Meine Stempel
+	Name:	Name:
+	Custom	Benutzerdefiniert
+	Delete stamp	Stempel löschen
+	Create custom stamp…	Eigenen Stempel erstellen…
+	From a PDF page or an image	Aus einer PDF-Seite oder einem Bild
+	Line spacing	Zeilenabstand
+	Character spacing	Zeichenabstand
+	Horizontal scale	Horizontale Skalierung
+	Rotate Clockwise	Im Uhrzeigersinn drehen
+	Rotate Counterclockwise	Gegen den Uhrzeigersinn drehen
+	Flip Horizontal	Horizontal spiegeln
+	Flip Vertical	Vertikal spiegeln
+	Replace Image…	Bild ersetzen…
+	Save Image As…	Bild speichern unter…
+	Check for updates	Nach Updates suchen
+	No check has run yet.	Es wurde noch nicht gesucht.
+	Checking for a newer version…	Suche nach einer neueren Version…
+	PdfCraft {v} is available.	PdfCraft {v} ist verfügbar.
+	You have version {c}. Download the new version from its release page.	Du hast Version {c}. Lade die neue Version von ihrer Release-Seite herunter.
+	PdfCraft {c} is up to date.	PdfCraft {c} ist auf dem neuesten Stand.
+	Couldn't check for updates: {e}	Updates konnten nicht gesucht werden: {e}
+	You have version {c}. All releases are listed at {page}.	Du hast Version {c}. Alle Releases findest du unter {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Fragt GitHub nach dem neuesten Release. Es wird nichts automatisch heruntergeladen oder installiert.
+	Download	Herunterladen
+	Later	Später
+	none	keine
+	Declared conformance: {shown}	Angegebene Konformität: {shown}
+	Output intent: {list}	Output Intent: {list}
+	Conformance level:	Konformitätsstufe:
+	No problems found: the document conforms to {level}.	Keine Probleme gefunden: Das Dokument entspricht {level}.
+	 (page {p})	 (Seite {p})
+	  · not fixable here	  · hier nicht korrigierbar
+	Verify	Prüfen
+	Box	Rahmen
+	Units	Einheiten
+	Set to zero	Auf null setzen
+	Current page ({n})	Aktuelle Seite ({n})
+	Subset	Teilmenge
+	Update	Aktualisieren
+	Add	Hinzufügen
+	{verb} Header and Footer	Kopf- und Fußzeile: {verb}
+	{verb} Watermark	Wasserzeichen: {verb}
+	{verb} Background	Hintergrund: {verb}
+	Margins (in)	Ränder (Zoll)
+	Left Header Text	Kopfzeile links
+	Center Header Text	Kopfzeile Mitte
+	Right Header Text	Kopfzeile rechts
+	Left Footer Text	Fußzeile links
+	Center Footer Text	Fußzeile Mitte
+	Right Footer Text	Fußzeile rechts
+	Insert Page Number	Seitenzahl einfügen
+	Insert Date	Datum einfügen
+	Start page number	Erste Seitenzahl
+	Source	Quelle
+	Fit to page	An Seite anpassen
+	Rotation	Drehung
+	Appear behind page	Hinter der Seite anzeigen
+	Appear on top of page	Vor der Seite anzeigen
+	From colour	Aus Farbe
+	Page Range Options	Optionen für Seitenbereich
+	Preview: page {p} of {n}	Vorschau: Seite {p} von {n}
+	Applies to 1 page	Gilt für 1 Seite
+	Applies to {n} pages	Gilt für {n} Seiten
+	Replaces the existing one on those pages.	Ersetzt das vorhandene auf diesen Seiten.
+	PDF or image	PDF oder Bild
+	No file chosen	Keine Datei ausgewählt
+	Page number	Seitenzahl
+	Scale relative to target page	Relativ zur Zielseite skalieren
+	Link Properties	Link-Eigenschaften
+	Create Link	Link erstellen
+	Link Appearance	Link-Darstellung
+	Link Type:	Link-Typ:
+	Visible Rectangle	Sichtbares Rechteck
+	Invisible Rectangle	Unsichtbares Rechteck
+	Highlight Style:	Hervorhebungsstil:
+	Invert	Invertieren
+	Outline	Kontur
+	Inset	Eingedrückt
+	Line Thickness:	Linienstärke:
+	Thin	Dünn
+	Thick	Dick
+	Line Style:	Linienstil:
+	Solid	Durchgezogen
+	Dashed	Gestrichelt
+	Color:	Farbe:
+	Link Action	Link-Aktion
+	Open a web page	Webseite öffnen
+	Go to a page view	Zu einer Seitenansicht wechseln
+	Type the web address.	Gib die Webadresse ein.
+	This document has no signatures.	Dieses Dokument hat keine Signaturen.
+	The Keychain's digital IDs couldn't be listed: {e}	Die digitalen IDs im Schlüsselbund konnten nicht aufgelistet werden: {e}
+	Signed and saved to {path}	Signiert und gespeichert unter {path}
+	Couldn't open revision {n}: {e}	Revision {n} konnte nicht geöffnet werden: {e}
+	Couldn't open the signed version: {e}	Die signierte Version konnte nicht geöffnet werden: {e}
+	Sign with a Digital ID	Mit digitaler ID signieren
+	Choose the digital ID that you want to use for signing:	Wähle die digitale ID aus, mit der du signieren möchtest:
+	Keychain  ·  	Schlüsselbund  ·
+	Windows store  ·  	Windows-Zertifikatspeicher  ·
+	Issued by: 	Ausgestellt von:
+	, Expires: 	, läuft ab:
+	No digital IDs yet.	Noch keine digitalen IDs.
+	Configure New Digital ID	Neue digitale ID einrichten
+	Continue	Weiter
+	Configure a Digital ID for Signing	Digitale ID zum Signieren einrichten
+	Use a Digital ID from a file	Digitale ID aus einer Datei verwenden
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Neue digitale ID erstellen (selbstsigniert, in einer passwortgeschützten Datei gespeichert)
+	Name	Name
+	Organizational Unit	Organisationseinheit
+	Organization Name	Organisation
+	Email Address	E-Mail-Adresse
+	Country/Region	Land/Region
+	Key Algorithm	Schlüsselalgorithmus
+	Confirm Password	Passwort bestätigen
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Gültig für 5 Jahre, für digitale Signaturen. Selbstsignierten IDs vertrauen andere meist nicht.
+	File (.p12, .pfx)	Datei (.p12, .pfx)
+	Digital ID	Digitale ID
+	Browse…	Durchsuchen…
+	{verb} as "{name}"	{verb} als „{name}“
+	Certify	Zertifizieren
+	The signature will be invisible.	Die Signatur wird unsichtbar sein.
+	Distinguished name	Distinguished Name
+	Labels	Beschriftungen
+	Permitted actions after certifying	Erlaubte Aktionen nach dem Zertifizieren
+	No changes allowed	Keine Änderungen erlaubt
+	Annotations, form fill-in, and digital signatures	Anmerkungen, Ausfüllen von Formularen und digitale Signaturen
+	Form fill-in and digital signatures	Ausfüllen von Formularen und digitale Signaturen
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	Der Schlüssel liegt im macOS-Schlüsselbund, der dich eventuell fragt, ob PdfCraft ihn verwenden darf.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	Der Schlüssel liegt im Windows-Zertifikatspeicher, der dich eventuell fragt, ob PdfCraft ihn verwenden darf.
+	Digital ID password	Passwort der digitalen ID
+	Back	Zurück
+	Validate all	Alle validieren
+	Sign this field…	Dieses Feld signieren…
+	Signature is valid:	Signatur ist gültig:
+	Signature validity is UNKNOWN:	Gültigkeit der Signatur ist UNBEKANNT:
+	Signature is INVALID:	Signatur ist UNGÜLTIG:
+	Signature Details	Signaturdetails
+	Reason	Grund
+	Signing time	Signaturzeitpunkt
+	Algorithm	Algorithmus
+	Signer	Unterzeichner
+	Issued by	Ausgestellt von
+	Valid	Gültig
+	Field	Feld
+	Field: {field} on page {p}	Feld: {field} auf Seite {p}
+	Add to trusted certificates	Zu vertrauenswürdigen Zertifikaten hinzufügen
+	View signed version	Signierte Version anzeigen
+	Show certificate…	Zertifikat anzeigen…
+	Export certificate…	Zertifikat exportieren…
+	Certificate Viewer	Zertifikatanzeige
+	This dialog shows the details of a certificate and its chain.	Dieser Dialog zeigt die Details eines Zertifikats und seiner Kette.
+	Trust	Vertrauen
+	Issued to	Ausgestellt für
+	Valid from	Gültig ab
+	Valid to	Gültig bis
+	Intended usage	Vorgesehene Verwendung
+	Any	Beliebig
+	Version	Version
+	Serial number	Seriennummer
+	Issuer	Aussteller
+	Validity starts	Gültigkeitsbeginn
+	Validity ends	Gültigkeitsende
+	Public key	Öffentlicher Schlüssel
+	Key usage	Schlüsselverwendung
+	Not present	Nicht vorhanden
+	Self-signed	Selbstsigniert
+	Edit Action	Aktion bearbeiten
+	New Action	Neue Aktion
+	Action name:	Name der Aktion:
+	Description:	Beschreibung:
+	Steps	Schritte
+	Add the steps this action runs, in order.	Füge die Schritte hinzu, die diese Aktion der Reihe nach ausführt.
+	Add Step	Schritt hinzufügen
+	An action with this name already exists.	Es gibt bereits eine Aktion mit diesem Namen.
+	New Action…	Neue Aktion…
+	Edit…	Bearbeiten…
+	Add watermark	Wasserzeichen hinzufügen
+	Add header	Kopfzeile hinzufügen
+	Add footer	Fußzeile hinzufügen
+	Set document title	Dokumenttitel festlegen
+	Run a JavaScript	JavaScript ausführen
+	Prepare for Distribution	Für die Weitergabe vorbereiten
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Ausgeblendete Informationen entfernen und Kommentare sowie Formularfelder reduzieren, damit Empfänger nur die Seiten sehen.
+	Optimize Scanned Documents	Gescannte Dokumente optimieren
+	Make scans searchable, then make them smaller.	Scans durchsuchbar machen und anschließend verkleinern.
+	Add Page Numbers	Seitenzahlen hinzufügen
+	Number every page in the footer.	Jede Seite in der Fußzeile nummerieren.
+	Mark as Confidential	Als vertraulich kennzeichnen
+	A diagonal CONFIDENTIAL watermark on every page.	Ein diagonales Wasserzeichen „VERTRAULICH“ auf jeder Seite.
+	Sanitize Documents	Dokumente bereinigen
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Ausgeblendete Informationen, Metadaten, Skripte und eingebettete Inhalte entfernen und die Dateien neu schreiben.
+	Type text	Text eingeben
+	Text to insert	Einzufügender Text
+	Replacement text	Ersatztext
+	Edit text…	Text bearbeiten…
+	Add a sticky note here	Hier eine Notiz hinzufügen
+	{kind} Properties	Eigenschaften: {kind}
+	Appearance	Darstellung
+	General	Allgemein
+	Review History	Prüfverlauf
+	This comment's appearance can't be changed yet.	Die Darstellung dieses Kommentars kann noch nicht geändert werden.
+	Icon	Symbol
+	Thickness	Stärke
+	Modified	Geändert
+	No status has been set.	Es wurde kein Status festgelegt.
+	Compare Files	Dateien vergleichen
+	Old file:	Alte Datei:
+	Open the older version first	Öffne zuerst die ältere Version
+	New file:	Neue Datei:
+	Text is compared word by word; the differences are shown on the new file.	Der Text wird Wort für Wort verglichen; die Unterschiede werden in der neuen Datei angezeigt.
+	Compare this file with an older version: Compare files… in All tools.	Vergleiche diese Datei mit einer älteren Version: „Dateien vergleichen…“ unter „Alle Werkzeuge“.
+	No differences in the text.	Keine Unterschiede im Text.
+	{n} {kind}	{n} {kind}
+	Inserted	Eingefügt
+	Deleted	Gelöscht
+	Replaced	Ersetzt
+	Visual	Visuell
+	Mark as comments	Als Kommentare markieren
+	Report…	Bericht…
+	{kind} · page {p}	{kind} · Seite {p}
+	Set Alternate Text	Alternativtext festlegen
+	This document has no tagged figures.	Dieses Dokument enthält keine getaggten Abbildungen.
+	 on page {p}	 auf Seite {p}
+	Figure {i} of {n}{page}	Abbildung {i} von {n}{page}
+	No preview	Keine Vorschau
+	Alternate text	Alternativtext
+	Describe the figure	Beschreibe die Abbildung
+	Decorative figure	Dekorative Abbildung
+	Previous figure	Vorherige Abbildung
+	Next figure	Nächste Abbildung
+	Save & Close	Speichern und schließen
+	Accessibility Checker Options	Optionen der Barrierefreiheitsprüfung
+	Report Options	Berichtsoptionen
+	Create accessibility report	Bericht zur Barrierefreiheit erstellen
+	Page Range	Seitenbereich
+	All pages in document	Alle Seiten im Dokument
+	Checking Options ({on} of 32 in all categories)	Prüfoptionen ({on} von 32 in allen Kategorien)
+	Show this dialog when the Checker starts	Diesen Dialog beim Start der Prüfung anzeigen
+	Select All	Alles auswählen
+	Clear All	Alle abwählen
+	Start Checking	Prüfung starten
+	This document hasn't been checked yet.	Dieses Dokument wurde noch nicht geprüft.
+	No issues found	Keine Probleme gefunden
+	1 issue	1 Problem
+	{n} issues	{n} Probleme
+	{label} (1 issue)	{label} (1 Problem)
+	{label} ({n} issues)	{label} ({n} Probleme)
+	Check again	Erneut prüfen
+	Report	Bericht
+	Show the accessibility report	Bericht zur Barrierefreiheit anzeigen
+	Collapse	Einklappen
+	Expand	Ausklappen
+	{rule} - {status}	{rule} – {status}
+	Passed	Bestanden
+	Failed	Fehlgeschlagen
+	Needs manual check	Manuelle Prüfung nötig
+	Skipped	Übersprungen
+	Fix	Korrigieren
+	Skip Rule	Regel überspringen
+	Explain	Erklären
+	Check Again	Erneut prüfen
+	Show Report	Bericht anzeigen
+	Options…	Optionen…
+	Go to the page	Zur Seite wechseln
+	Page Content	Seiteninhalt
+	Forms	Formulare
+	Alternate Text	Alternativtext
+	Tables	Tabellen
+	Lists	Listen
+	Headings	Überschriften
+	Accessibility permission flag	Berechtigung für Barrierefreiheit
+	Accessibility permission flag is set	Berechtigung für Barrierefreiheit ist gesetzt
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Die Sicherheitseinstellungen müssen Hilfstechnologien das Lesen des Inhalts erlauben („Textzugriff für Screenreader aktivieren“). Ändere die Sicherheit des Dokuments, um dies zu erlauben.
+	Image-only PDF	Reines Bild-PDF
+	Document is not image-only PDF	Dokument ist kein reines Bild-PDF
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Seiten, die nur aus Bildern von Text bestehen, können weder vorgelesen noch durchsucht werden. Führe Text erkennen (OCR) aus, um eine Textebene hinzuzufügen.
+	Document is tagged PDF	Dokument ist ein getaggtes PDF
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	Tags geben dem Dokument eine logische Struktur, der Hilfstechnologien folgen. Tagge das Dokument (PDF automatisch taggen).
+	Logical Reading Order	Logische Lesereihenfolge
+	Document structure provides a logical reading order	Dokumentstruktur bietet eine logische Lesereihenfolge
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Prüfe, ob die Tags in der Reihenfolge gelesen werden, in der eine sehende Person lesen würde. Korrigiere sie mit dem Werkzeug „Lesereihenfolge“ oder im Tags-Bedienfeld.
+	Primary language	Hauptsprache
+	Text language is specified	Textsprache ist angegeben
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	Screenreader wählen ihre Stimme anhand der Dokumentsprache. Lege sie unter Dokumenteigenschaften > Erweitert > Sprache fest.
+	Document title is showing in title bar	Dokumenttitel wird in der Titelleiste angezeigt
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Das Fenster sollte einen aussagekräftigen Titel statt des Dateinamens zeigen. Lege einen Titel fest und wähle Anfangsansicht > Anzeigen: Dokumenttitel.
+	Bookmarks are present in large documents	Große Dokumente enthalten Lesezeichen
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	Dokumente mit mehr als 20 Seiten brauchen Lesezeichen zur Navigation. Füge Lesezeichen für die Hauptabschnitte hinzu.
+	Color contrast	Farbkontrast
+	Document has appropriate color contrast	Dokument hat ausreichenden Farbkontrast
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	Text muss sich für Menschen mit Sehschwäche ausreichend vom Hintergrund abheben. Prüfe die Farben mit bloßem Auge oder mit einem Kontrastwerkzeug.
+	Tagged content	Getaggter Inhalt
+	All page content is tagged	Gesamter Seiteninhalt ist getaggt
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Alles auf einer Seite muss getaggt oder als Artefakt markiert sein (Dekoration, Kopf- und Fußzeilen). Tagge den ungetaggten Inhalt.
+	Tagged annotations	Getaggte Anmerkungen
+	All annotations are tagged	Alle Anmerkungen sind getaggt
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Kommentare, Links und Felder müssen im Tag-Baum stehen, damit sie vorgelesen werden. Tagge die Anmerkungen.
+	Tab order	Tab-Reihenfolge
+	Tab order is consistent with structure order	Tab-Reihenfolge entspricht der Strukturreihenfolge
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Auf Seiten mit Links, Kommentaren oder Feldern sollte die Tab-Reihenfolge der Struktur folgen. Die Korrektur setzt die Tab-Reihenfolge jeder Seite auf „Dokumentstruktur verwenden“.
+	Character encoding	Zeichenkodierung
+	Reliable character encoding is provided	Zuverlässige Zeichenkodierung ist vorhanden
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	Schriften müssen ihre Zeichen Unicode zuordnen, damit Text gelesen und kopiert werden kann. Korrigiere die Schriften oder erstelle das PDF neu.
+	Tagged multimedia	Getaggte Multimedia-Inhalte
+	All multimedia objects are tagged	Alle Multimedia-Objekte sind getaggt
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	Video, Ton und Rich Media müssen getaggt sein, damit sie vorgelesen werden. Tagge die Multimedia-Anmerkungen.
+	Screen flicker	Bildschirmflackern
+	Page will not cause screen flicker	Seite verursacht kein Bildschirmflackern
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	Blinkende Animationen können Anfälle auslösen. Prüfe Skripte und Medien auf Flackern.
+	Scripts	Skripte
+	No inaccessible scripts	Keine nicht barrierefreien Skripte
+	Timed responses	Zeitgesteuerte Antworten
+	Page does not require timed responses	Seite erfordert keine zeitgesteuerten Antworten
+	People may need more time to respond. Check that nothing has a time limit.	Manche Menschen brauchen mehr Zeit zum Reagieren. Prüfe, dass nichts ein Zeitlimit hat.
+	Navigation links	Navigationslinks
+	Navigation links are not repetitive	Navigationslinks wiederholen sich nicht
+	Repeated navigation links should be skippable. Check links that appear on every page.	Wiederholte Navigationslinks sollten übersprungen werden können. Prüfe Links, die auf jeder Seite erscheinen.
+	Tagged form fields	Getaggte Formularfelder
+	All form fields are tagged	Alle Formularfelder sind getaggt
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Formularfelder müssen im Tag-Baum stehen (Form-Tags), damit sie vorgelesen werden. Tagge die Formularfelder.
+	Field descriptions	Feldbeschreibungen
+	All form fields have description	Alle Formularfelder haben eine Beschreibung
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Jedes Feld braucht einen Tooltip, der sagt, was einzugeben ist. Füge ihn unter Feldeigenschaften > Allgemein > Tooltip hinzu.
+	Figures alternate text	Alternativtext für Abbildungen
+	Figures require alternate text	Abbildungen benötigen Alternativtext
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	Bilder brauchen einen beschreibenden Alternativtext oder müssen als dekorativ markiert sein. Füge jeder Abbildung Alternativtext hinzu.
+	Nested alternate text	Verschachtelter Alternativtext
+	Alternate text that will never be read	Alternativtext, der nie gelesen wird
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Alternativtext in einem Element, das bereits Alternativtext hat, wird nie gelesen. Entferne den inneren Alternativtext.
+	Associated with content	Mit Inhalt verknüpft
+	Alternate text must be associated with some content	Alternativtext muss mit Inhalt verknüpft sein
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Alternativtext an einem Element ohne Seiteninhalt wird nie erreicht. Entferne ihn oder verknüpfe das Element mit Inhalt.
+	Hides annotation	Verdeckt Anmerkung
+	Alternate text should not hide annotation	Alternativtext sollte keine Anmerkung verdecken
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Alternativtext an einem Element, das einen Link oder ein Feld enthält, verbirgt diese Anmerkung vor Hilfstechnologien. Verschiebe den Alternativtext.
+	Other elements alternate text	Alternativtext für andere Elemente
+	Other elements that require alternate text	Andere Elemente, die Alternativtext benötigen
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formeln und ähnliche Nicht-Text-Elemente brauchen Alternativtext. Füge ihnen Alternativtext hinzu.
+	Rows	Zeilen
+	TR must be a child of Table, THead, TBody, or TFoot	TR muss ein untergeordnetes Element von Table, THead, TBody oder TFoot sein
+	Table cells belong in a row. Fix the table's tags.	Tabellenzellen gehören in eine Zeile. Korrigiere die Tags der Tabelle.
+	Headers	Kopfzellen
+	Tables should have headers	Tabellen sollten Kopfzellen haben
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	Kopfzellen (TH) sagen Zuhörenden, was jede Spalte oder Zeile enthält. Markiere die Kopfzellen.
+	Regularity	Regelmäßigkeit
+	Tables must contain the same number of columns in each row and rows in each column	Tabellen müssen in jeder Zeile gleich viele Spalten und in jeder Spalte gleich viele Zeilen enthalten
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	Unregelmäßige Tabellen stören die Zellnavigation. Gib jeder Zeile gleich viele Zellen (verbundene Zellen mitgezählt).
+	Summary	Zusammenfassung
+	Tables must have a summary	Tabellen müssen eine Zusammenfassung haben
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Eine Zusammenfassung beschreibt Zweck und Aufbau der Tabelle. Füge jeder Tabelle ein Summary-Attribut hinzu.
+	List items	Listeneinträge
+	LI must be a child of L	LI muss ein untergeordnetes Element von L sein
+	List items belong in a list. Fix the list's tags.	Listeneinträge gehören in eine Liste. Korrigiere die Tags der Liste.
+	Lbl and LBody	Lbl und LBody
+	Lbl and LBody must be children of LI	Lbl und LBody müssen untergeordnete Elemente von LI sein
+	List labels and bodies belong in a list item. Fix the list's tags.	Listenbeschriftungen und -inhalte gehören in einen Listeneintrag. Korrigiere die Tags der Liste.
+	Appropriate nesting	Korrekte Verschachtelung
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	Überschriftenebenen sollten nicht übersprungen werden (z. B. H1 gefolgt von H3). Tagge die Überschriften neu.
+	TH and TD	TH und TD
+	TH and TD must be children of TR	TH und TD müssen untergeordnete Elemente von TR sein
+	Mark Page Range	Seitenbereich markieren
+	Pages from	Seiten von
+	Single word or phrase	Einzelnes Wort oder Ausdruck
+	Text to find	Zu suchender Text
+	Patterns	Muster
+	Phone Numbers	Telefonnummern
+	Email Addresses	E-Mail-Adressen
+	Credit Cards	Kreditkarten
+	Social Security Numbers	Sozialversicherungsnummern
+	Dates	Datumsangaben
+	Text in images isn't found; recognise text (OCR) first.	Text in Bildern wird nicht gefunden; führe zuerst Text erkennen (OCR) aus.
+	No matches.	Keine Treffer.
+	{n} match(es) marked for redaction.	{n} Treffer zum Schwärzen markiert.
+	Redaction Tool Properties	Eigenschaften des Schwärzungswerkzeugs
+	Redacted area fill colour:	Füllfarbe geschwärzter Bereiche:
+	Use overlay text	Überlagerungstext verwenden
+	Custom text:	Eigener Text:
+	Font:	Schrift:
+	Font size:	Schriftgröße:
+	Auto-size text to fit redaction region	Textgröße automatisch an Schwärzungsbereich anpassen
+	Font colour:	Schriftfarbe:
+	Repeat overlay text	Überlagerungstext wiederholen
+	Text alignment:	Textausrichtung:
+	Center	Zentriert
+	Apply redactions	Schwärzungen anwenden
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Du bist dabei, 1 Schwärzungsmarkierung anzuwenden. Text, Bilder und Zeichnungen unter der Markierung sowie Kommentare und Formularfelder, die sie überlappen, werden dauerhaft entfernt.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Du bist dabei, {n} Schwärzungsmarkierungen anzuwenden. Text, Bilder und Zeichnungen unter den Markierungen sowie Kommentare und Formularfelder, die sie überlappen, werden dauerhaft entfernt.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	Speichere das Dokument danach: Beim Speichern wird die gesamte Datei neu geschrieben, sodass keine Spur des entfernten Inhalts darin bleibt.
+	Select the items to remove from this document.	Wähle die Elemente aus, die aus diesem Dokument entfernt werden sollen.
+	Metadata	Metadaten
+	File attachments	Dateianhänge
+	Comments and markups	Kommentare und Markierungen
+	Hidden text	Ausgeblendeter Text
+	Hidden layers	Ausgeblendete Ebenen
+	Links, actions and JavaScripts	Links, Aktionen und JavaScripts
+	Private data of other applications	Private Daten anderer Anwendungen
+	None found	Nichts gefunden
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Formularfelder werden reduziert, ihre Werte bleiben sichtbar. Beim Speichern wird die gesamte Datei neu geschrieben.
+	Remove	Entfernen
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	Beim Bereinigen werden ausgeblendete Informationen aus dem Dokument entfernt: Metadaten, Dateianhänge, Kommentare, Formularfelder (reduziert), ausgeblendeter Text und Ebenen, Lesezeichen, Links, Aktionen und Skripte sowie private Anwendungsdaten.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	Speichere das Dokument anschließend. Beim Speichern wird die gesamte Datei neu geschrieben, sodass nichts Entferntes darin verbleibt.
+	Printer:	Drucker:
+	Save as PDF	Als PDF speichern
+	{name} (default)	{name} (Standard)
+	Copies:	Exemplare:
+	Collate	Sortieren
+	Print in grayscale	In Graustufen drucken
+	Two-sided:	Beidseitig:
+	Off	Aus
+	Flip on long edge	An langer Kante wenden
+	Flip on short edge	An kurzer Kante wenden
+	Paper:	Papier:
+	Pages to Print	Zu druckende Seiten
+	More options:	Weitere Optionen:
+	All pages in range	Alle Seiten im Bereich
+	Odd pages only	Nur ungerade Seiten
+	Even pages only	Nur gerade Seiten
+	Reverse pages	Seiten umkehren
+	Page Sizing & Handling	Seitengröße und -handhabung
+	Size	Größe
+	Poster	Poster
+	Multiple	Mehrere
+	Booklet	Broschüre
+	Fit	Einpassen
+	Shrink oversized pages	Übergroße Seiten verkleinern
+	Custom scale:	Eigener Maßstab:
+	Tile scale:	Kachelmaßstab:
+	Overlap:	Überlappung:
+	Cut marks	Schnittmarken
+	Pages per sheet:	Seiten pro Blatt:
+	Page order:	Seitenreihenfolge:
+	Horizontal	Horizontal
+	Horizontal reversed	Horizontal umgekehrt
+	Vertical	Vertikal
+	Vertical reversed	Vertikal umgekehrt
+	Print page border	Seitenrahmen drucken
+	Auto-rotate pages	Seiten automatisch drehen
+	Booklet subset:	Broschürenteil:
+	Both sides	Beide Seiten
+	Front side only	Nur Vorderseite
+	Back side only	Nur Rückseite
+	Binding:	Bindung:
+	Left	Links
+	Right	Rechts
+	Orientation:	Ausrichtung:
+	Auto portrait/landscape	Hoch-/Querformat automatisch
+	Portrait	Hochformat
+	Landscape	Querformat
+	Comments & Forms	Kommentare und Formulare
+	Document	Dokument
+	Document and markups	Dokument und Markierungen
+	Document and stamps	Dokument und Stempel
+	Form fields only	Nur Formularfelder
+	Previous sheet	Vorheriges Blatt
+	Next sheet	Nächstes Blatt
+	No sheets	Keine Blätter
+	Sheet {s} of {n}	Blatt {s} von {n}
+	Removed 1 hidden item. Save to remove them from the file.	1 ausgeblendetes Element entfernt. Speichere, um es aus der Datei zu entfernen.
+	Removed {n} hidden items. Save to remove them from the file.	{n} ausgeblendete Elemente entfernt. Speichere, um sie aus der Datei zu entfernen.
+	Document sanitized. Save to finish: saving rewrites the whole file.	Dokument bereinigt. Speichere zum Abschließen: Beim Speichern wird die gesamte Datei neu geschrieben.
+	Applied 1 redaction mark. Save to remove the content from the file.	1 Schwärzungsmarkierung angewendet. Speichere, um den Inhalt aus der Datei zu entfernen.
+	Applied {n} redaction marks. Save to remove the content from the file.	{n} Schwärzungsmarkierungen angewendet. Speichere, um den Inhalt aus der Datei zu entfernen.
+	JavaScript Console	JavaScript-Konsole
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript ist ausgeschaltet (Einstellungen > JavaScript).
+	Output appears here.	Die Ausgabe erscheint hier.
+	Script Name:	Skriptname:
+	This document has no document-level scripts.	Dieses Dokument hat keine Skripte auf Dokumentebene.
+	No form fields were detected	Es wurden keine Formularfelder erkannt
+	Detected 1 form field	1 Formularfeld erkannt
+	Detected {n} form fields	{n} Formularfelder erkannt
+	{field}: {e}	{field}: {e}
+	Current page	Aktuelle Seite
+	Selected pages	Ausgewählte Seiten
+	Document language	Dokumentsprache
+	Output	Ausgabe
+	Searchable Image (Exact)	Durchsuchbares Bild (exakt)
+	Adds invisible text over each word; the page image is not changed	Legt unsichtbaren Text über jedes Wort; das Seitenbild bleibt unverändert
+	Downsample to	Herunterrechnen auf
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Die Texterkennung ist nicht installiert, ihre Modelle fehlen (führe `cargo xtask models` aus oder setze PRINTCRAFT_MODELS).
+	Settings	Einstellungen
+	Optional	Optional
+	Planned · {m}	Geplant · {m}
+	Planned for milestone {m} — open to see what it will include	Geplant für Meilenstein {m} – öffnen, um zu sehen, was enthalten sein wird
+	Coming in milestone {m}. Items marked Ready work today.	Kommt in Meilenstein {m}. Als „Bereit“ markierte Elemente funktionieren schon heute.
+	1 mark	1 Markierung
+	{n} marks	{n} Markierungen
+	Dynamic	Dynamisch
+	Sign Here	Hier unterschreiben
+	Standard Business	Standard-Geschäftsstempel
+	Choose a stamp, then click on the page to place it.	Wähle einen Stempel und klicke dann auf die Seite, um ihn zu platzieren.
+	Note	Notiz
+	Polyline	Polylinie
+	Attachment	Anhang
+	Callout	Legende
+	Typewriter	Schreibmaschine
+	Checked	Abgehakt
+	Unchecked	Nicht abgehakt
+	Marked	Markiert
+	Locked	Gesperrt
+	Search comments	Kommentare durchsuchen
+	Add a comment	Kommentar hinzufügen
+	No comments yet.	Noch keine Kommentare.
+	Pick a tool in the quick bar, or type above.	Wähle ein Werkzeug in der Schnellleiste oder tippe oben.
+	No comments match.	Keine passenden Kommentare.
+	Unknown author	Unbekannter Verfasser
+	No colour	Keine Farbe
+	Remove checkmark	Häkchen entfernen
+	Mark with checkmark	Mit Häkchen markieren
+	Reply	Antworten
+	Add a reply	Antwort hinzufügen
+	Post	Senden
+	Page {label}	Seite {label}
+	{kind} — click to show it on the page	{kind} – klicken, um es auf der Seite anzuzeigen
+	Set status	Status festlegen
+	Copy text	Text kopieren
+	Properties…	Eigenschaften…
+	Make Current Properties Default	Aktuelle Eigenschaften als Standard festlegen
+	More options	Weitere Optionen
+	Sort by	Sortieren nach
+	Author	Verfasser
+	Type	Typ
+	Colour	Farbe
+	Show all comments	Alle Kommentare anzeigen
+	Create PDF comment summary…	PDF-Kommentarzusammenfassung erstellen…
+	Export all to data file…	Alle in Datendatei exportieren…
+	Filter comments	Kommentare filtern
+	Status	Status
+	Accepted	Angenommen
+	Rejected	Abgelehnt
+	Cancelled	Abgebrochen
+	Completed	Abgeschlossen
+	Show all	Alle anzeigen
+	Yellow	Gelb
+	Orange	Orange
+	Red	Rot
+	Pink	Rosa
+	Purple	Lila
+	Blue	Blau
+	Light blue	Hellblau
+	Green	Grün
+	Gray	Grau
+	Black	Schwarz
+	Bookmark options	Lesezeichenoptionen
+	Expand all bookmarks	Alle Lesezeichen erweitern
+	Expand top-level bookmarks	Lesezeichen der obersten Ebene erweitern
+	Collapse all bookmarks	Alle Lesezeichen reduzieren
+	New bookmark (⌘B)	Neues Lesezeichen (⌘B)
+	This document has no bookmarks.	Dieses Dokument hat keine Lesezeichen.
+	This document has no layers.	Dieses Dokument hat keine Ebenen.
+	This document has no attachments.	Dieses Dokument hat keine Anhänge.
+	Hide layer	Ebene ausblenden
+	Show layer	Ebene einblenden
+	on page {label}	auf Seite {label}
+	Save attachment…	Anhang speichern…
+	Open in a new tab	In neuem Tab öffnen
+	This document has no pages.	Dieses Dokument hat keine Seiten.
+	Find text	Text suchen
+	No matches	Keine Treffer
+	Searching… {s}/{p}	Suche läuft… {s}/{p}
+	{c} of {n}{more}	{c} von {n}{more}
+	Previous (⇧⌘G)	Vorheriger (⇧⌘G)
+	Next (⌘G)	Nächster (⌘G)
+	Find options	Suchoptionen
+	Whole words only	Nur ganze Wörter
+	Case-sensitive	Groß-/Kleinschreibung beachten
+	Close (Esc)	Schließen (Esc)
+	Align	Ausrichten
+	Top	Oben
+	Bottom	Unten
+	Center horizontally	Horizontal zentrieren
+	Center vertically	Vertikal zentrieren
+	Distribute	Verteilen
+	Horizontally	Horizontal
+	Vertically	Vertikal
+	Set Fields to Same Size	Felder auf gleiche Größe setzen
+	Height	Höhe
+	Width	Breite
+	Both	Beide
+	Duplicate…	Duplizieren…
+	All pages	Alle Seiten
+	Odd pages	Ungerade Seiten
+	Even pages	Gerade Seiten
+	Landscape pages	Seiten im Querformat
+	Portrait pages	Seiten im Hochformat
+	Move earlier	Nach vorne verschieben
+	Move later	Nach hinten verschieben
+	Back to the document	Zurück zum Dokument
+	Protect Using Password	Mit Passwort schützen
+	Requires user to enter a password for:	Passworteingabe erforderlich zum:
+	Viewing	Anzeigen
+	Editing	Bearbeiten
+	Type Password	Passwort eingeben
+	Re-type Password	Passwort wiederholen
+	Strength: {s}	Stärke: {s}
+	Strong	Stark
+	Medium	Mittel
+	Weak	Schwach
+	Advanced Options {chevron}	Erweiterte Optionen {chevron}
+	Compatibility	Kompatibilität
+	Acrobat X and later (256-bit AES)	Acrobat X und neuer (256-Bit-AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 und neuer (128-Bit-AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 und neuer (128-Bit-RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 und neuer (40-Bit-RC4)
+	Encrypt	Verschlüsseln
+	All document contents	Alle Dokumentinhalte
+	All document contents except metadata	Alle Dokumentinhalte außer Metadaten
+	Printing allowed	Drucken erlaubt
+	Low Resolution (150 dpi)	Niedrige Auflösung (150 dpi)
+	Changes allowed	Änderungen erlaubt
+	Inserting, deleting, and rotating pages	Seiten einfügen, löschen und drehen
+	Filling in form fields and signing existing signature fields	Formularfelder ausfüllen und vorhandene Signaturfelder signieren
+	Commenting, filling in form fields, and signing existing signature fields	Kommentieren, Formularfelder ausfüllen und vorhandene Signaturfelder signieren
+	Any except extracting pages	Alle außer Seiten extrahieren
+	Enable copying of text, images, and other content	Kopieren von Text, Bildern und anderen Inhalten erlauben
+	Enable text access for screen reader devices for the visually impaired	Textzugriff für Screenreader für Sehbehinderte erlauben
+	Type a password.	Gib ein Passwort ein.
+	The passwords don't match.	Die Passwörter stimmen nicht überein.
+	This compatibility level supports only plain ASCII passwords.	Diese Kompatibilitätsstufe unterstützt nur reine ASCII-Passwörter.
+	Anyone opening the document will need this password. It's applied when you save.	Jeder, der das Dokument öffnet, braucht dieses Passwort. Es wird beim Speichern angewendet.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	Das Dokument öffnet sich ohne Passwort; dieses Passwort wird benötigt, um die Einschränkungen zu ändern. Es wird beim Speichern angewendet.
+	Recover unsaved documents?	Nicht gespeicherte Dokumente wiederherstellen?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft wurde nicht ordnungsgemäß beendet. Diese Dokumente hatten automatisch gesicherte Änderungen:
+	just now	gerade eben
+	{n} min ago	vor {n} Min.
+	{n} h ago	vor {n} Std.
+	 · password-protected	 · passwortgeschützt
+	Recover	Wiederherstellen
+	Discard	Verwerfen
+	Version {v}	Version {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Eine in Clean-Room-Entwicklung entstandene Open-Source-PDF-Anwendung, geschrieben in Rust. MIT OR Apache-2.0.
+	Part of	Teil von
+	Summarize Options	Zusammenfassungsoptionen
+	Choose a layout:	Layout wählen:
+	Comments only	Nur Kommentare
+	Sort comments by:	Kommentare sortieren nach:
+	Create PDF Comment Summary	PDF-Kommentarzusammenfassung erstellen
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Zur zuletzt gespeicherten Version von „{name}“ zurückkehren? Seitdem vorgenommene Änderungen lassen sich danach nicht wiederherstellen.
+	Number pages	Seiten nummerieren
+	Style	Stil
+	None (prefix only)	Keiner (nur Präfix)
+	Prefix	Präfix
+	Start	Beginnen bei
+	Labels: {preview}. Later pages keep their labels.	Beschriftungen: {preview}. Spätere Seiten behalten ihre Beschriftungen.
+	Even and Odd Pages	Gerade und ungerade Seiten
+	Even Pages Only	Nur gerade Seiten
+	Odd Pages Only	Nur ungerade Seiten
+	Landscape and Portrait Pages	Seiten im Quer- und Hochformat
+	Landscape Pages	Seiten im Querformat
+	Portrait Pages	Seiten im Hochformat
+	Duplicate Field	Feld duplizieren
+	Duplicate "{name}" onto:	„{name}“ duplizieren auf:
+	1 page selected.	1 Seite ausgewählt.
+	{n} pages selected.	{n} Seiten ausgewählt.
+	Delete pages after extracting	Seiten nach dem Extrahieren löschen
+	Extract pages as separate files	Seiten als separate Dateien extrahieren
+	Rotate Pages	Seiten drehen
+	Direction:	Richtung:
+	Clockwise 90 degrees	90 Grad im Uhrzeigersinn
+	Counterclockwise 90 degrees	90 Grad gegen den Uhrzeigersinn
+	180 degrees	180 Grad
+	Pages:	Seiten:
+	All	Alle
+	Selection	Auswahl
+	From	Von
+	Rotate:	Drehen:
+	Repairs	Reparaturen
+	Repair log	Reparaturprotokoll
+	Split document	Dokument teilen
+	Number of pages	Seitenanzahl
+	Pages per file	Seiten pro Datei
+	File size	Dateigröße
+	At most	Höchstens
+	Top-level bookmarks ({n})	Lesezeichen der obersten Ebene ({n})
+	Before each selected page (select pages in Organize)	Vor jeder ausgewählten Seite (Seiten unter „Organisieren“ auswählen)
+	Creates 1 file from {n} pages.	Erstellt 1 Datei aus {n} Seiten.
+	Creates {f} files from {n} pages.	Erstellt {f} Dateien aus {n} Seiten.
+	Each file holds as many of the {n} pages as fit.	Jede Datei enthält so viele der {n} Seiten, wie hineinpassen.
+	Replace Pages	Seiten ersetzen
+	Original: replace pages	Original: Seiten ersetzen
+	to	bis
+	to {n}	bis {n}
+	Replacement: pages of {name}	Ersatz: Seiten aus {name}
+	of {name}	aus {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Nur der Seiteninhalt ändert sich: Links, Kommentare, Formularfelder und Lesezeichen auf den Originalseiten bleiben erhalten.
+	The replacement file doesn't have that many pages.	Die Ersatzdatei hat nicht so viele Seiten.
+	Tagged PDF	Getaggtes PDF
+	Document Properties	Dokumenteigenschaften
+	Description	Beschreibung
+	Initial View	Anfangsansicht
+	Security	Sicherheit
+	Fonts	Schriften
+	Advanced	Erweitert
+	Title	Titel
+	Subject	Thema
+	Keywords	Stichwörter
+	Application	Erstellt mit
+	PDF producer	PDF-Erzeuger
+	Layout and Magnification	Layout und Zoom
+	Navigation tab	Navigationsbereich
+	Page Only	Nur Seite
+	Bookmarks Panel and Page	Lesezeichenbereich und Seite
+	Pages Panel and Page	Seitenbereich und Seite
+	Attachments Panel and Page	Anhangsbereich und Seite
+	Layers Panel and Page	Ebenenbereich und Seite
+	Page layout	Seitenlayout
+	Default	Standard
+	Single Page	Einzelseite
+	Single Page Continuous	Einzelseite fortlaufend
+	Two-Up (Facing)	Doppelseite
+	Two-Up Continuous (Facing)	Doppelseite fortlaufend
+	Two-Up (Cover Page)	Doppelseite mit Deckblatt
+	Two-Up Continuous (Cover Page)	Doppelseite fortlaufend mit Deckblatt
+	Magnification	Zoom
+	Actual Size	Originalgröße
+	Fit Page	Ganze Seite
+	Fit Width	Seitenbreite
+	Fit Height	Seitenhöhe
+	Fit Visible	Sichtbarer Bereich
+	Open to page	Öffnen auf Seite
+	of {pages}	von {pages}
+	Window Options	Fensteroptionen
+	Resize window to initial page	Fenstergröße an Anfangsseite anpassen
+	Center window on screen	Fenster auf dem Bildschirm zentrieren
+	Open in Full Screen mode	Im Vollbildmodus öffnen
+	Show:	Anzeigen:
+	File Name	Dateiname
+	Document Title	Dokumenttitel
+	User Interface Options	Optionen der Oberfläche
+	Hide menu bar	Menüleiste ausblenden
+	Hide toolbars	Werkzeugleisten ausblenden
+	Hide window controls	Fenstersteuerelemente ausblenden
+	Security method	Sicherheitsmethode
+	No security	Keine Sicherheit
+	Restrictions	Einschränkungen
+	None — everything is allowed	Keine – alles ist erlaubt
+	Password security	Passwortschutz
+	Encryption	Verschlüsselung
+	Opened with	Geöffnet mit
+	— (protection is applied when you save)	— (der Schutz wird beim Speichern angewendet)
+	Owner password (no restrictions apply)	Berechtigungspasswort (keine Einschränkungen)
+	User password	Öffnen-Passwort
+	Change settings…	Einstellungen ändern…
+	Printing	Drucken
+	Not allowed	Nicht erlaubt
+	Allowed	Erlaubt
+	High resolution	Hohe Auflösung
+	Low resolution	Niedrige Auflösung
+	Changing the document	Ändern des Dokuments
+	Document assembly	Zusammenstellen des Dokuments
+	Content copying	Kopieren von Inhalten
+	Content copying for accessibility	Kopieren von Inhalten für Barrierefreiheit
+	Commenting	Kommentieren
+	Filling of form fields	Ausfüllen von Formularfeldern
+	No fonts are referenced by the pages.	Die Seiten verweisen auf keine Schriften.
+	PDF version	PDF-Version
+	Location	Ort
+	Page size	Seitengröße
+	Yes	Ja
+	No	Nein
+	Revisions	Revisionen
+	View revision {n}	Revision {n} anzeigen
+	Open the file as it was saved then	Die Datei so öffnen, wie sie damals gespeichert wurde
+	Binding	Bindung
+	Left Edge	Linker Rand
+	Right Edge	Rechter Rand
+	Language	Sprache
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	{place} gespeichert: {before} → {after} ({pct} % kleiner){detail}
+	Couldn't save the image: {e}	Das Bild konnte nicht gespeichert werden: {e}
+	Adding images arrives on the web with file pickers for images	Bilder hinzufügen kommt im Web zusammen mit der Bildauswahl
+	Replacing images on page {p} arrives on the web with image pickers ({i})	Bilder auf Seite {p} ersetzen kommt im Web zusammen mit der Bildauswahl ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: Bilder auswählen kommt im Web zusammen mit der Bildauswahl
+	Replacing images arrives on the web with image file pickers	Bilder ersetzen kommt im Web zusammen mit der Bildauswahl
+	Couldn't create a PDF: {e}	PDF konnte nicht erstellt werden: {e}
+	The clipboard has no image or text	Die Zwischenablage enthält weder Bild noch Text
+	On the web, open or drop an image to convert it	Öffne im Web ein Bild oder zieh es hierher, um es zu konvertieren
+	Couldn't optimize the file: {e}	Die Datei konnte nicht optimiert werden: {e}
+	Couldn't write {path}: {e}	{path} konnte nicht geschrieben werden: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Das Formular soll an {u} gesendet werden; PdfCraft sendet keine Formulardaten. Speichere das Dokument, um deine Eingaben zu behalten.
+	{s} actions run in the JavaScript engine (M6)	{s}-Aktionen laufen in der JavaScript-Engine (M6)
+	{name}: the {other} action isn't supported yet	{name}: Die Aktion {other} wird noch nicht unterstützt
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} sendet das Formular an {url}; PdfCraft sendet keine Formulardaten. Speichere das Dokument, um deine Eingaben zu behalten.
+	Export stopped: {e}	Export abgebrochen: {e}
+	Exported 1 image	1 Bild exportiert
+	Exported {n} images	{n} Bilder exportiert
+	 ({s} not exported: {first})	 ({s} nicht exportiert: {first})
+	Exported the text of 1 page	Text von 1 Seite exportiert
+	Exported the text of {n} pages	Text von {n} Seiten exportiert
+	{msg} to {dir}	{msg} nach {dir}
+	Exporting… {d} of {t}	Exportieren… {d} von {t}
+	Choose a folder for the exported files	Wähle einen Ordner für die exportierten Dateien
+	New {tool} comments will look like this one	Neue Kommentare vom Typ „{tool}“ sehen ab jetzt so aus
+	This document can't be checked: it couldn't be read for editing	Dieses Dokument kann nicht geprüft werden: Es konnte nicht zum Bearbeiten gelesen werden
+	The checker found no problems in this document.	Die Prüfung hat in diesem Dokument keine Probleme gefunden.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Die Prüfung hat 1 Problem gefunden, das die vollständige Barrierefreiheit des Dokuments verhindern kann.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Die Prüfung hat {n} Probleme gefunden, die die vollständige Barrierefreiheit des Dokuments verhindern können.
+	The text is the same	Der Text ist identisch
+	1 difference found	1 Unterschied gefunden
+	{n} differences found	{n} Unterschiede gefunden
+	Added 1 comment	1 Kommentar hinzugefügt
+	Added {n} comments	{n} Kommentare hinzugefügt
+	Choose a folder for the results	Wähle einen Ordner für die Ergebnisse
+	Files for {name}	Dateien für {name}
+	An action is already running	Es läuft bereits eine Aktion
+	Running action… file {d} of {t}	Aktion läuft… Datei {d} von {t}
+	No unlinked web addresses were found in the text	Im Text wurden keine unverlinkten Webadressen gefunden
+	Created 1 link	1 Link erstellt
+	Created {n} links	{n} Links erstellt
+	Text recognition is already running	Die Texterkennung läuft bereits
+	Optimizing… removing user data	Optimieren… Benutzerdaten werden entfernt
+	Optimizing… image {d} of {t}	Optimieren… Bild {d} von {t}
+	Optimizing… cleaning up	Optimieren… Aufräumen
+	Optimizing… merging identical objects	Optimieren… Identische Objekte werden zusammengeführt
+	Optimizing… writing the copy	Optimieren… Kopie wird geschrieben
+	Cancelling…	Wird abgebrochen…
+	Optimization is already running	Die Optimierung läuft bereits
+	Optimization cancelled	Optimierung abgebrochen
+	Couldn't optimize the file	Die Datei konnte nicht optimiert werden
+	Recognizing text… file {d} of {t}	Text wird erkannt… Datei {d} von {t}
+	Recognizing text… page {d} of {t}	Text wird erkannt… Seite {d} von {t}
+	Recognized 1 word	1 Wort erkannt
+	Recognized {n} words	{n} Wörter erkannt
+	{words} on {pages}	{words} auf {pages}
+	; 1 page already had text	; 1 Seite enthielt bereits Text
+	; {n} pages already had text	; {n} Seiten enthielten bereits Text
+	Recognized {w} words in 1 file	{w} Wörter in 1 Datei erkannt
+	Recognized {w} words in {n} files	{w} Wörter in {n} Dateien erkannt
+	; failed: {list}	; fehlgeschlagen: {list}
+	1 file done	1 Datei fertig
+	{n} files done	{n} Dateien fertig
+	The selected area has been copied ({w} × {h} pixels)	Der ausgewählte Bereich wurde kopiert ({w} × {h} Pixel)
+	Couldn't take the snapshot: {e}	Der Schnappschuss konnte nicht erstellt werden: {e}
+	Couldn't recover {name}: {e}	{name} konnte nicht wiederhergestellt werden: {e}
+	The document now conforms to {level}; save it to keep the changes	Das Dokument entspricht jetzt {level}; speichere es, um die Änderungen zu behalten
+	Fixed what could be fixed; 1 problem remains	Alles Behebbare wurde behoben; 1 Problem bleibt bestehen
+	Fixed what could be fixed; {n} problems remain	Alles Behebbare wurde behoben; {n} Probleme bleiben bestehen
+	Custom stamps arrive on the web with file pickers for images	Eigene Stempel kommen im Web zusammen mit der Bildauswahl
+	{file} is too large for a stamp (at most {n} MB)	{file} ist zu groß für einen Stempel (höchstens {n} MB)
+	Sent to {printer}	An {printer} gesendet
+	Sent to {printer}: {msg}	An {printer} gesendet: {msg}
+	Choose a folder for the searchable files	Wähle einen Ordner für die durchsuchbaren Dateien
+	Files are combined in this order. Leave Pages empty to take every page.	Die Dateien werden in dieser Reihenfolge kombiniert. Lass „Seiten“ leer, um alle Seiten zu übernehmen.
+	Pages of {name} to combine, e.g. 1-3, 6	Zu kombinierende Seiten von {name}, z. B. 1-3, 6
+	Remove {name}	{name} entfernen
+	Add files…	Dateien hinzufügen…
+	Add at least two files	Füge mindestens zwei Dateien hinzu
+	Couldn't add {name}: {e}	{name} konnte nicht hinzugefügt werden: {e}
+	Couldn't combine files: {e}	Dateien konnten nicht kombiniert werden: {e}
+	Export comments	Kommentare exportieren
+	Export form data	Formulardaten exportieren
+	Comment and form data	Kommentar- und Formulardaten
+	Export	Exportieren
+	Select data files to merge	Datendateien zum Zusammenführen auswählen
+	Form data and PDF forms	Formulardaten und PDF-Formulare
+	Save the spreadsheet	Tabelle speichern
+	Save the accessibility report	Barrierefreiheitsbericht speichern
+	Save image	Bild speichern
+	Export certificate	Zertifikat exportieren
+	Choose a folder for the extracted pages	Wähle einen Ordner für die extrahierten Seiten
+	Choose a folder for the split files	Wähle einen Ordner für die geteilten Dateien
+	Couldn't use {name}: {e}	{name} konnte nicht verwendet werden: {e}
+	Couldn't extract pages: {e}	Seiten konnten nicht extrahiert werden: {e}
+	Couldn't write {name}: {e}	{name} konnte nicht geschrieben werden: {e}
+	Wrote 1 file to {dir}	1 Datei nach {dir} geschrieben
+	Wrote {n} files to {dir}	{n} Dateien nach {dir} geschrieben
+	No pages match those choices	Keine Seiten entsprechen dieser Auswahl
+	Couldn't split: {e}	Teilen fehlgeschlagen: {e}
+	Couldn't summarize comments: {e}	Kommentare konnten nicht zusammengefasst werden: {e}
+	Couldn't open the result: {e}	Das Ergebnis konnte nicht geöffnet werden: {e}
+	Importing data arrives on the web with file pickers for data files	Daten importieren kommt im Web zusammen mit der Dateiauswahl für Datendateien
+	Exported to {path}	Nach {path} exportiert
+	Merging data files needs the desktop app	Zum Zusammenführen von Datendateien brauchst du die Desktop-App
+	Merged 1 file into {path}	1 Datei in {path} zusammengeführt
+	Merged {n} files into {path}	{n} Dateien in {path} zusammengeführt
+	Combined {n} files	{n} Dateien kombiniert
+	Extracted 1 page	1 Seite extrahiert
+	Extracted {n} pages	{n} Seiten extrahiert
+	Created a comment summary	Kommentarzusammenfassung erstellt
+	Couldn't open {name}: {e}	{name} konnte nicht geöffnet werden: {e}
+	Couldn't read {name}: {e}	{name} konnte nicht gelesen werden: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Der portable Modus ist aus: In {folder} kann nicht geschrieben werden ({error}). Die Einstellungen werden stattdessen in deinem Benutzerordner gespeichert.
+	Couldn't save: {e}	Speichern fehlgeschlagen: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Anhänge herunterladen kommt im Web mit M3.10 ({n} Bytes bereit)
+	`{command}` {when}	`{command}` {when}
+	ships in milestone {m}	erscheint mit Meilenstein {m}
+	needs an AI provider (off by default)	benötigt einen KI-Anbieter (standardmäßig aus)
+	is available	ist verfügbar
+	is not available yet	ist noch nicht verfügbar
+	{label} failed: {e}	{label} fehlgeschlagen: {e}
+	Undid {label}	{label} rückgängig gemacht
+	Redid {label}	{label} wiederholt
+	A document needs at least one page: copy instead	Ein Dokument braucht mindestens eine Seite: Kopiere stattdessen
+	Cut {what}	{what} ausgeschnitten
+	Copied {what}	{what} kopiert
+	1 page	1 Seite
+	{n} pages	{n} Seiten
+	Copy or cut pages first	Kopiere oder schneide zuerst Seiten aus
+	Couldn't save {name}: {e}	{name} konnte nicht gespeichert werden: {e}
+	Saved {name}	{name} gespeichert
+	Saved, but reopening failed: {e}	Gespeichert, aber erneutes Öffnen fehlgeschlagen: {e}
+	Downloaded {name}	{name} heruntergeladen
+	Couldn't download {name}: {e}	{name} konnte nicht heruntergeladen werden: {e}
+	Reverted to the last saved version	Auf die zuletzt gespeicherte Version zurückgesetzt
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Das hat nicht geklappt: Ein interner Fehler ist aufgetreten ({m}). Deine Dokumente sind unverändert.
+	Nothing to undo	Nichts rückgängig zu machen
+	Nothing to redo	Nichts zu wiederholen
+	This document has no form fields you can fill in	Dieses Dokument hat keine ausfüllbaren Formularfelder
+	This document has no comments to flatten	Dieses Dokument hat keine Kommentare zum Reduzieren
+	This document has no form fields to flatten	Dieses Dokument hat keine Formularfelder zum Reduzieren
+	There are no redaction marks (mark text, areas or pages first)	Keine Schwärzungsmarkierungen vorhanden (markiere zuerst Text, Bereiche oder Seiten)
+	This document has no {kind} to change	Dieses Dokument hat keine Elemente vom Typ „{kind}“ zum Ändern
+	header or footer	Kopf- oder Fußzeile
+	watermark	Wasserzeichen
+	background	Hintergrund
+	This document isn't password-protected	Dieses Dokument ist nicht passwortgeschützt
+	Only the document's owner can change its security (open it with the permissions password)	Nur der Eigentümer des Dokuments kann die Sicherheit ändern (öffne es mit dem Berechtigungspasswort)
+	The document's security settings don't allow this change	Die Sicherheitseinstellungen des Dokuments erlauben diese Änderung nicht
+	Open a document first	Öffne zuerst ein Dokument
+	Security will be removed when you save	Die Sicherheit wird beim Speichern entfernt
+	Click text or an image to edit it	Klicke auf Text oder ein Bild, um es zu bearbeiten
+	Drag a rectangle to create a link; double-click a link to edit it	Ziehe ein Rechteck auf, um einen Link zu erstellen; doppelklicke auf einen Link, um ihn zu bearbeiten
+	There are no redaction marks to apply	Keine Schwärzungsmarkierungen zum Anwenden vorhanden
+	Drag to draw the area where the signature should appear.	Ziehe den Bereich auf, in dem die Signatur erscheinen soll.
+	Couldn't fit the visible content: {e}	Der sichtbare Inhalt konnte nicht eingepasst werden: {e}
+	Drag a rectangle around the area to copy	Ziehe ein Rechteck um den zu kopierenden Bereich
+	Click on the page to add a {tool}, or drag to set its size	Klicke auf die Seite, um „{tool}“ hinzuzufügen, oder ziehe, um die Größe festzulegen
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Ziehe ein Rechteck auf einer Seite auf, um sie zuzuschneiden; doppelklicke auf eine Seite für „Seitenrahmen festlegen“
+	Keep tool selected: on	Werkzeug ausgewählt lassen: ein
+	Keep tool selected	Werkzeug ausgewählt lassen
+	Opacity	Deckkraft
+	Line thickness	Linienstärke
+	What word or phrase would you like to search for?	Nach welchem Wort oder Ausdruck möchtest du suchen?
+	Searching… {s} of {p} pages	Suche läuft… {s} von {p} Seiten
+	 (searching… {s} of {p} pages)	 (Suche läuft… {s} von {p} Seiten)
+	1 instance	1 Treffer
+	{n} instances	{n} Treffer
+	Go to this result	Zu diesem Ergebnis springen
+	Highlight	Hervorheben
+	Draw	Zeichnen
+	Polygon	Polygon
+	Connected lines	Verbundene Linien
+	Eraser	Radierer
+	Sign	Signieren
+	Certified by {by}	Zertifiziert von {by}
+	At least one signature is invalid.	Mindestens eine Signatur ist ungültig.
+	Signed and all signatures are valid.	Signiert, alle Signaturen sind gültig.
+	At least one signature has problems.	Mindestens eine Signatur weist Probleme auf.
+	This document is secured. Some changes are restricted by its security settings.	Dieses Dokument ist geschützt. Einige Änderungen sind durch seine Sicherheitseinstellungen eingeschränkt.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Dies ist ein dynamisches XFA-Formular, das PdfCraft noch nicht anzeigen kann. Du siehst die Platzhalterseite der Datei.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Dieses Formular enthält auch XFA-Daten, die PdfCraft noch nicht liest. Du kannst die Felder ausfüllen, aber Acrobat zeigt eventuell stattdessen die XFA-Werte an.
+	This document contains {n} interactive form fields.	Dieses Dokument enthält {n} interaktive Formularfelder.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Diese Datei war beschädigt und wurde repariert. Beim Speichern bleibt die reparierte Version erhalten.
+	Dismiss	Ausblenden
+	Hide field highlights	Feldhervorhebung ausblenden
+	Highlight fields	Felder hervorheben
+	Security settings	Sicherheitseinstellungen
+	Details	Details
+	Select (V)	Auswählen (V)
+	Hand (H)	Hand (H)
+	Delete pages (Delete)	Seiten löschen (Entf)
+	Insert a blank page after the selection	Leere Seite nach der Auswahl einfügen
+	Insert pages from a file…	Seiten aus Datei einfügen…
+	Extract pages to a new document	Seiten in neues Dokument extrahieren
+	Split into files…	In Dateien teilen…
+	Select pages	Seiten auswählen
+	Cut	Ausschneiden
+	Copy	Kopieren
+	Paste after	Danach einfügen
+	Rename	Umbenennen
+	Set to current page ({n})	Auf aktuelle Seite setzen ({n})
+	Move up	Nach oben
+	Move down	Nach unten
+	Indent	Einrücken
+	Outdent	Ausrücken
+	This document has no form fields.	Dieses Dokument hat keine Formularfelder.
+	Tab order: move a field with its arrows.	Tab-Reihenfolge: Verschiebe ein Feld mit seinen Pfeilen.
+	Unplaced	Nicht platziert
+	Has JavaScript actions (run in M6)	Hat JavaScript-Aktionen (Ausführung in M6)
+	Page	Seite
+	None	Keine
+	Delete selected fields	Ausgewählte Felder löschen
+	Diagnostic details	Diagnosedetails
+	The operation failed.	Der Vorgang ist fehlgeschlagen.
+	no such document	Dokument nicht vorhanden
+	nothing to undo	nichts rückgängig zu machen
+	nothing to redo	nichts zu wiederholen
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	dieses Dokument ist signiert: Ein Neuschreiben würde seine Signaturen ungültig machen (speichere es stattdessen inkrementell)
+	the document is protected by a password	das Dokument ist durch ein Passwort geschützt
+	the password is incorrect	das Passwort ist falsch
+	the document has no page tree	das Dokument hat keinen Seitenbaum
+	a document must keep at least one page	ein Dokument muss mindestens eine Seite behalten
+	a bookmark cannot be moved inside itself	ein Lesezeichen kann nicht in sich selbst verschoben werden
+	the title must not be empty	der Titel darf nicht leer sein
+	the document has no form fields	das Dokument hat keine Formularfelder
+	there are no redaction marks to apply	keine Schwärzungsmarkierungen zum Anwenden vorhanden
+	there are no pages to print	keine Seiten zum Drucken vorhanden
+	the document has no tags	das Dokument hat keine Tags
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	die Modelle für die Texterkennung sind nicht installiert (führe `cargo xtask models` aus oder setze PRINTCRAFT_MODELS)
+	the image is empty	das Bild ist leer
+	this file isn't XFDF, FDF, XML or text form data	diese Datei enthält keine Formulardaten als XFDF, FDF, XML oder Text
+	nothing in the file matches this document	nichts in der Datei passt zu diesem Dokument
+	This page couldn't be displayed.\n{e}	Diese Seite konnte nicht angezeigt werden.\n{e}
+	Go to page {p}	Gehe zu Seite {p}
+	{s} action	Aktion „{s}“
+	Page {p} of {n}	Seite {p} von {n}
+	1 page selected	1 Seite ausgewählt
+	{n} pages selected	{n} Seiten ausgewählt
+	{name} — unsaved changes	{name} – ungespeicherte Änderungen
+	{kind} field	Feld vom Typ {kind}
+	Select a file for the stamp	Wähle eine Datei für den Stempel
+	JavaScript, e.g. getField("total").value	JavaScript, z. B. getField("total").value
+	Font: Helvetica	Schrift: Helvetica
+	e.g. en-US	z. B. de-DE
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Darstellung: hayro (Bootstrap) · Oberfläche: egui · Symbole: Lucide (ISC) · Schriften: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	Kontrollkästchen
+	Radio	Optionsfeld
+	PushButton	Schaltfläche
+	Combo	Kombinationsfeld
+	List	Listenfeld
+	Unknown	Unbekannt
+	The document has no XMP metadata	Das Dokument hat keine XMP-Metadaten
+	The title in the metadata and the document information differ	Der Titel in den Metadaten und in den Dokumentinformationen weicht voneinander ab
+	The document is encrypted	Das Dokument ist verschlüsselt
+	Device colour is used, but there is no PDF/A output intent	Gerätefarben werden verwendet, aber es gibt keinen PDF/A-Output-Intent
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	DeviceCMYK wird verwendet: Dafür ist ein CMYK-Output-Intent nötig (wird nicht automatisch hinzugefügt)
+	The document has additional actions (/AA)	Das Dokument hat zusätzliche Aktionen (/AA)
+	The document has document-level JavaScript	Das Dokument enthält JavaScript auf Dokumentebene
+	The form asks viewers to make appearances (NeedAppearances)	Das Formular fordert Anzeigeprogramme auf, Darstellungen zu erzeugen (NeedAppearances)
+	A form field has additional actions	Ein Formularfeld hat zusätzliche Aktionen
+	A stream uses LZW compression	Ein Stream verwendet LZW-Komprimierung
+	A stream refers to an external file	Ein Stream verweist auf eine externe Datei
+	An image asks to be interpolated	Ein Bild verlangt Interpolation
+	An image has alternates or OPI information	Ein Bild hat Alternativbilder oder OPI-Informationen
+	PostScript XObjects aren't allowed	PostScript-XObjects sind nicht zulässig
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	Eingebettete Dateien müssen selbst PDF/A-Dateien sein (verwende PDF/A-3 für andere)
+	An embedded file has no AFRelationship	Eine eingebettete Datei hat keine AFRelationship
+	Select Icon	Symbol auswählen
+	Choose images	Bilder auswählen
+	{dpi} pixels/inch	{dpi} Pixel/Zoll
+	Type your {what}.	Gib deine {what} ein.
+	Draw your {what} below.	Zeichne deine {what} unten.
+	Your name	Dein Name
+	Images and text (converted to PDF)	Bilder und Text (in PDF konvertiert)
+	Images and text	Bilder und Text
+	Check Box Style:	Stil des Kontrollkästchens:
+	Button Style:	Stil der Schaltfläche:
+	Check	Häkchen
+	Circle	Kreis
+	Diamond	Raute
+	Square	Quadrat
+	Star	Stern
+	{month} {y}	{month} {y}
+	Change {key}	{key} ändern
+	Insert pages from {name}	Seiten aus {name} einfügen
+	Fill in {name}	{name} ausfüllen
+	Set the image of {name}	Bild von {name} festlegen
+	Edit script of {name}	Skript von {name} bearbeiten
+	Import {name}	{name} importieren
+	Add bookmark	Lesezeichen hinzufügen
+	Rename bookmark	Lesezeichen umbenennen
+	Delete bookmark	Lesezeichen löschen
+	Move bookmark	Lesezeichen verschieben
+	Set bookmark destination	Lesezeichenziel festlegen
+	Add stamp	Stempel hinzufügen
+	Delete comment	Kommentar löschen
+	Edit comment	Kommentar bearbeiten
+	Erase	Radieren
+	Lock comment	Kommentar sperren
+	Unlock comment	Kommentar entsperren
+	Move comment	Kommentar verschieben
+	Resize comment	Kommentargröße ändern
+	Change comment properties	Kommentareigenschaften ändern
+	Add field	Feld hinzufügen
+	Change field properties	Feldeigenschaften ändern
+	Delete field	Feld löschen
+	Duplicate field	Feld duplizieren
+	Set tab order	Tab-Reihenfolge festlegen
+	Change initial view	Anfangsansicht ändern
+	Set alternate text	Alternativtext festlegen
+	Mark figure as decorative	Abbildung als dekorativ markieren
+	Run JavaScript	JavaScript ausführen
+	Delete document JavaScript	Dokument-JavaScript löschen
+	Edit document JavaScript	Dokument-JavaScript bearbeiten
+	Edit text	Text bearbeiten
+	Move image	Bild verschieben
+	Rotate image	Bild drehen
+	Flip image	Bild spiegeln
+	Delete image	Bild löschen
+	Add header & footer	Kopf- und Fußzeile hinzufügen
+	Update header & footer	Kopf- und Fußzeile aktualisieren
+	Update watermark	Wasserzeichen aktualisieren
+	Add background	Hintergrund hinzufügen
+	Update background	Hintergrund aktualisieren
+	Add image	Bild hinzufügen
+	Edit content	Inhalt bearbeiten
+	Delete content	Inhalt löschen
+	Remove redaction marks	Schwärzungsmarkierungen entfernen
+	Add link	Link hinzufügen
+	Change link properties	Linkeigenschaften ändern
+	Delete link	Link löschen
+	Create link	Link erstellen
+	Flatten	Reduzieren
+	Add sticky note	Notiz hinzufügen
+	Add highlight	Hervorhebung hinzufügen
+	Add underline	Unterstreichung hinzufügen
+	Add strikethrough	Durchstreichung hinzufügen
+	Add squiggly underline	Schlangenlinie hinzufügen
+	Add rectangle	Rechteck hinzufügen
+	Add oval	Oval hinzufügen
+	Add arrow	Pfeil hinzufügen
+	Add line	Linie hinzufügen
+	Add drawing	Zeichnung hinzufügen
+	Add text box	Textfeld hinzufügen
+	Add checkmark	Häkchen hinzufügen
+	Add cross	Kreuz hinzufügen
+	Add dot	Punkt hinzufügen
+	Add signature	Unterschrift hinzufügen
+	Add redaction mark	Schwärzungsmarkierung hinzufügen
+	Add cloud	Wolke hinzufügen
+	Add polygon	Polygon hinzufügen
+	Add connected lines	Verbundene Linien hinzufügen
+	Add callout	Legende hinzufügen
+	Add inserted text	Eingefügten Text hinzufügen
+	Add file attachment	Dateianhang hinzufügen
+	Set status Accepted	Status „Angenommen“ festlegen
+	Set status Rejected	Status „Abgelehnt“ festlegen
+	Set status Cancelled	Status „Abgebrochen“ festlegen
+	Set status Completed	Status „Abgeschlossen“ festlegen
+	Set status None	Status „Keine“ festlegen
+	Set status Unmarked	Status „Nicht markiert“ festlegen
+	Save as PDF/A-1b	Als PDF/A-1b speichern
+	Save as PDF/A-2b	Als PDF/A-2b speichern
+	Save as PDF/A-3b	Als PDF/A-3b speichern
+	Fill & Sign: change signature	Ausfüllen und unterschreiben: Unterschrift ändern
+	Fill & Sign: change initials	Ausfüllen und unterschreiben: Initialen ändern
+	Fill & Sign: remove saved signature	Ausfüllen und unterschreiben: Gespeicherte Unterschrift entfernen
+	Fill & Sign: remove saved initials	Ausfüllen und unterschreiben: Gespeicherte Initialen entfernen
+	Change signature	Unterschrift ändern
+	Change initials	Initialen ändern
+	Measure distance	Abstand messen
+	Measure perimeter	Umfang messen
+	Measure area	Fläche messen
+	Set measurement scale	Messmaßstab festlegen
+	Measurement information	Messinformationen
+	Measurement snapping	Einrasten beim Messen
+	Export measurements as CSV	Messungen als CSV exportieren
+	Distance	Abstand
+	Perimeter	Umfang
+	Area	Fläche
+	Drawing scale	Zeichnungsmaßstab
+	Snapping	Einrasten
+	Export measurements	Messungen exportieren
+	Open a PDF to measure it.	Öffne ein PDF, um es zu messen.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Klicke Eckpunkte an. Enter oder Doppelklick schließt einen Umfang oder eine Fläche ab. Klicke auf den ersten Punkt, um eine Fläche zu schließen.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift beschränkt auf 45 Grad. Rücktaste entfernt einen Eckpunkt. Escape bricht ab.
+	Angle	Winkel
+	Click the first point to begin.	Klicke auf den ersten Punkt, um zu beginnen.
+	Snap to drawing	An Zeichnung einrasten
+	Endpoints	Endpunkte
+	Midpoints	Mittelpunkte
+	Intersections	Schnittpunkte
+	Paths	Pfade
+	Sensitivity	Empfindlichkeit
+	Unit	Einheit
+	Decimals	Nachkommastellen
+	Calibrate from two points	Anhand zweier Punkte kalibrieren
+	Entire page	Ganze Seite
+	Viewport rectangle in page points (x, y, width, height)	Ausschnittsrechteck in Seitenpunkten (x, y, Breite, Höhe)
+	Viewport	Ausschnitt
+	Apply scale	Maßstab anwenden
+	Saved measurements	Gespeicherte Messungen
+	Saved measurements.	Messungen gespeichert.
+	Endpoint	Endpunkt
+	Midpoint	Mittelpunkt
+	Intersection	Schnittpunkt
+	Path	Pfad
+	This drawing exceeds the snapping limit; only the first paths are used.	Diese Zeichnung überschreitet das Einrastlimit; nur die ersten Pfade werden verwendet.
+	Some page content couldn't be read; snapping uses the rest.	Ein Teil des Seiteninhalts konnte nicht gelesen werden; das Einrasten nutzt den Rest.
+	Unsupported measurements	Nicht unterstützte Messungen
+	Label	Beschriftung
+	{n} measurements use an unsupported format and are left out.	{n} Messungen verwenden ein nicht unterstütztes Format und werden ausgelassen.
+	This area has too many overlapping paths; intersection snapping is limited.	Dieser Bereich hat zu viele überlappende Pfade; das Einrasten an Schnittpunkten ist eingeschränkt.
+	This measurement needs at least {n} points.	Diese Messung braucht mindestens {n} Punkte.
+	Change {what}	{what} ändern
+	Cut and stack	Schneiden und stapeln
+	Default workspace mode	Standardmodus des Arbeitsbereichs
+	Documents and view	Dokumente und Ansicht
+	Open email app	E-Mail-App öffnen
+	Open link	Link öffnen
+	Open this web page?	Diese Webseite öffnen?
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Skripte laufen in einer Sandbox ohne Datei- oder Netzwerkzugriff. Ein Skript, das eine Webseite öffnen will, braucht zuerst deine Erlaubnis. Bei deaktiviertem JavaScript funktionieren die Standardfunktionen von Acrobat zum Formatieren, Prüfen und Berechnen weiterhin.
+	Sign yourself	Selbst unterschreiben
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Die Texterkennung ist nicht installiert, ihre Modelle fehlen (führe `cargo xtask models` aus oder setze PDFCRAFT_MODELS).
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Wird beim Öffnen von PDFs verwendet. Ein ausdrücklich gewählter Start- oder Steuermodus hat für die Sitzung Vorrang.
+	Write this email?	Diese E-Mail schreiben?
+	{who} in this document wants to open this address in your browser:	{who} in diesem Dokument möchte diese Adresse in deinem Browser öffnen:
+	{who} in this document wants to open your email app with this address:	{who} in diesem Dokument möchte deine E-Mail-App mit dieser Adresse öffnen:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Diese Webadresse mischt Buchstaben aus verschiedenen Alphabeten – ein häufiger Trick, um den Namen einer anderen Website nachzuahmen.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Diese Webadresse verwendet Buchstaben aus einem anderen Alphabet, die bekannten Buchstaben ähneln können.
+	Create PDF from images	PDF aus Bildern erstellen
+	Selected image files: {count}	Ausgewählte Bilddateien: {count}
+	Use image resolution	Bildauflösung verwenden
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Die eingebettete DPI jedes Bildes verwenden; 72 DPI, wenn keine vorhanden ist.
+	Use 72 DPI (one point per pixel)	72 DPI verwenden (ein Punkt pro Pixel)
+	Use custom DPI	Eigene DPI verwenden
+	DPI sets the printed page size without resampling the image.	Die DPI bestimmt die gedruckte Seitengröße, ohne das Bild neu zu berechnen.
+	Create	Erstellen
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Dynamisches XFA-Formular, aus seiner Vorlage aufgebaut: {pages}, {fields}.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA-Formular: Seine Felder und XFA-Daten werden synchron gehalten, damit andere Viewer anzeigen, was du ausfüllst.
+@plural	{n} page|{n} pages	{n} Seite|{n} Seiten
+@plural	{n} field|{n} fields	{n} Feld|{n} Felder
+	Switch to two-page view first to show the cover page	Wechsle zuerst zur Doppelseitenansicht, um das Deckblatt anzuzeigen
+	Page display: {layout}	Seitenanzeige: {layout}
+	Fit to width scrolling	An Breite anpassen und scrollen
+	Fit one full page	Eine ganze Seite einpassen
+	Default page display	Standard-Seitenanzeige
+	Default zoom	Standardzoom
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Wird verwendet, wenn ein PDF kein Layout und keinen Zoom vorgibt. Fortlaufendes Scrollen rastet nie zwischen Seiten ein.
+	Show	Anzeigen
+	Sort	Sortieren
+	Reverse the order	Reihenfolge umkehren
+	Grab bag	Bunt gemischt
+	Table	Tabelle
+	Username	Benutzername
+	Display name	Anzeigename
+	Real name	Echter Name
+	Name (A–Z)	Name (A–Z)
+	Merged PRs	Gemergte PRs
+	PRs	PRs
+	Commits	Commits
+	Lines added	Hinzugefügte Zeilen
+	+LOC	+LOC
+	Lines deleted	Gelöschte Zeilen
+	−LOC	−LOC
+	Line delta	Zeilendifferenz
+	ΔLOC	ΔLOC
+	Binary assets added	Hinzugefügte Binärdateien
+	+Bin	+Bin
+	Binary assets removed	Entfernte Binärdateien
+	−Bin	−Bin
+	First commit	Erster Commit
+	First	Erster
+	Last commit	Letzter Commit
+	Last	Letzter
+	No contributor data was built into this copy.	In diese Version wurden keine Mitwirkendendaten eingebaut.
+	No model credits were built into this copy.	In diese Version wurden keine Modellnachweise eingebaut.
+	{n} contributors · {c} commits	{n} Mitwirkende · {c} Commits
+	Company	Unternehmen
+	Model	Modell
+	% of all commits	% aller Commits
+	Lines +/−	Zeilen +/−
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: {prs} PRs, {commits} Commits, +{added} / −{deleted} Zeilen (Δ {delta}), +{bin_added} / −{bin_deleted} Binärdateien, {first} – {last}
+	Set layer visibility	Sichtbarkeit der Ebene festlegen
+	Created a PDF from {n} files	PDF aus {n} Dateien erstellt
+	PDF, images and text	PDF, Bilder und Text
+	Insert a file before page {label}	Datei vor Seite {label} einfügen
+	Insert a file at the end	Datei am Ende einfügen
+	Save pages	Seiten speichern
+	Save these pages as one PDF	Diese Seiten als ein PDF speichern
+	No changes to save	Keine Änderungen zu speichern
+	Created a PDF from {n} files; left out: {names}	PDF aus {n} Dateien erstellt; ausgelassen: {names}
+	Created a PDF from the first {n} files	PDF aus den ersten {n} Dateien erstellt
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Keine dieser Dateien lässt sich in ein PDF umwandeln; verwende PDFs, Bilder oder .txt-Dateien
+	1 file	1 Datei
+	1 file needs attention	1 Datei erfordert Aufmerksamkeit
+	? of {n}	? von {n}
+	Add folder	Ordner hinzufügen
+	Add folder and subfolders	Ordner mit Unterordnern hinzufügen
+	Add folder and subfolders…	Ordner mit Unterordnern hinzufügen…
+	Add folder…	Ordner hinzufügen…
+	Add open documents	Geöffnete Dokumente hinzufügen
+	Add the PDFs to combine	Füge die zu kombinierenden PDFs hinzu
+	Added more than once	Mehrfach hinzugefügt
+	All open documents	Alle geöffneten Dokumente
+	Can't be read: {e}	Kann nicht gelesen werden: {e}
+	Check the pages of {name}: {why}	Prüfe die Seiten von {name}: {why}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Klicke zum Sortieren, ziehe zum Verschieben der Spalte. Ziehe ihren Rand, um die Breite zu ändern.
+	Drag to reorder	Ziehen zum Umsortieren
+	Drop PDFs or folders here, or choose them.	Lege PDFs oder Ordner hier ab oder wähle sie aus.
+	Enter the password that opens it	Gib das Passwort zum Öffnen ein
+	Enter the permissions password to allow combining	Gib das Berechtigungspasswort ein, um das Kombinieren zu erlauben
+	Every PDF in the folder	Jedes PDF im Ordner
+	Every PDF in the folder and the folders inside it	Jedes PDF im Ordner und in seinen Unterordnern
+	File name	Dateiname
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Dateien werden von oben nach unten kombiniert. Lass „Seiten“ leer, um alle Seiten zu übernehmen.
+	Hide password	Passwort ausblenden
+	Includes unsaved changes	Enthält ungespeicherte Änderungen
+	Its security settings don't allow copying pages	Die Sicherheitseinstellungen erlauben kein Kopieren von Seiten
+	More ways to add files	Weitere Möglichkeiten zum Hinzufügen
+	No documents are open	Keine Dokumente geöffnet
+	No pages selected	Keine Seiten ausgewählt
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Geöffnet, aber die Sicherheitseinstellungen erlauben kein Kombinieren. Gib das Berechtigungspasswort ein.
+	Password-protected	Passwortgeschützt
+	Protected: the combined file won't keep its security settings	Geschützt: Die kombinierte Datei behält die Sicherheitseinstellungen nicht bei
+	Remove {n} files	{n} Dateien entfernen
+	Reset columns	Spalten zurücksetzen
+	Select a file first	Wähle zuerst eine Datei aus
+	Select a password-protected file first	Wähle zuerst eine passwortgeschützte Datei aus
+	Show password	Passwort anzeigen
+	The password is only used to read the file; it isn't saved.	Das Passwort wird nur zum Lesen der Datei verwendet und nicht gespeichert.
+	The same password is tried on each file.	Dasselbe Passwort wird bei jeder Datei versucht.
+	Unlock	Entsperren
+	Unlock {name}	{name} entsperren
+	Unlock {n} files	{n} Dateien entsperren
+	Unlocked: the combined file won't be password-protected	Entsperrt: Die kombinierte Datei wird nicht passwortgeschützt sein
+	Unlock…	Entsperren…
+	Warnings	Warnungen
+	Wrong password	Falsches Passwort
+	sorted ascending	aufsteigend sortiert
+	sorted descending	absteigend sortiert
+	yesterday	gestern
+	{k} of {n}	{k} von {n}
+	{name} can't be combined: {why}	{name} kann nicht kombiniert werden: {why}
+	{n} days ago	vor {n} Tagen
+	{n} files	{n} Dateien
+	{n} files need attention	{n} Dateien erfordern Aufmerksamkeit
+	{n} selected	{n} ausgewählt
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Wähle ein PNG- oder JPEG-Bild (bis 4 MiB). Transparenz bleibt erhalten.
+	Couldn't import the signature image: {e}	Das Unterschriftsbild konnte nicht importiert werden: {e}
+	Open Recent	Zuletzt geöffnet
+	Pin folder to Home…	Ordner an Start anheften…
+	Folders	Ordner
+	Pin a folder…	Ordner anheften…
+	Pin a folder to Home	Ordner an Start anheften
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Hefte einen Ordner an, um hier seine neuesten PDFs aufzulisten – etwa den, in dem dein Scanner oder ein synchronisierter Cloud-Speicher sie ablegt.
+	Unpin	Lösen
+	Unpin {folder}	{folder} lösen
+	Looking for PDFs…	PDFs werden gesucht…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Dieser Ordner ist gerade nicht verfügbar. Er wurde vielleicht verschoben, oder sein Laufwerk bzw. die Cloud-Synchronisierung ist offline.
+	No PDFs in this folder yet	Noch keine PDFs in diesem Ordner
+	Show less	Weniger anzeigen
+	Show {n} more	{n} weitere anzeigen
+	The newest {n} of {total} PDFs	Die neuesten {n} von {total} PDFs
+	Pinned folders need the desktop app	Angeheftete Ordner erfordern die Desktop-App
+	Choose a folder on this computer to pin	Wähle einen Ordner auf diesem Computer zum Anheften
+	{folder} is already pinned to Home	{folder} ist bereits an Start angeheftet
+	You can pin up to {n} folders. Unpin one first.	Du kannst bis zu {n} Ordner anheften. Löse zuerst einen.
+	Pinned {folder} to Home	{folder} an Start angeheftet
+	No recent files	Keine zuletzt geöffneten Dateien
+	Go to page…	Gehe zu Seite…
+	About	Über
+	Contributors	Mitwirkende
+	Models	Modelle
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Fahre nur fort, wenn du diesem Dokument vertraust. Eine Adresse kann Informationen aus dem Dokument übermitteln, etwa was du in sein Formular eingegeben hast.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Einseitig drucken. Halte die Blätter in Reihenfolge, schneide an den Marken und lege die Stapel dann von links nach rechts, von oben nach unten aufeinander.
+	Unlocked {n} of {m} files	{n} von {m} Dateien entsperrt
+	No PDFs found in {folder}	Keine PDFs in {folder} gefunden
+	Added the first {n} PDFs in {folder}	Die ersten {n} PDFs aus {folder} hinzugefügt
+comment menu	Edit	Bearbeiten
+	Undo {action}	{action} rückgängig machen
+	Redo {action}	{action} wiederholen
+signature pad	Type	Tippen
+action wizard	Start	Starten
+	Reopen the files that were open when PdfCraft last closed	Beim Start die Dateien wieder öffnen, die beim letzten Beenden von PdfCraft geöffnet waren
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 0e823cf9..818fbee8 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -87,7 +87,7 @@ fn plural_russian(n: u64) -> usize {
 }
 
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 11] = [
+pub static LANGUAGES: [LangInfo; 12] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -98,6 +98,8 @@ pub static LANGUAGES: [LangInfo; 11] = [
     LangInfo { code: "cs", name: "Čeština", source: include_str!("cs.tsv"), plural: plural_cs, catalog: OnceLock::new() },
     // Brazilian Portuguese; `pt`, `pt-BR` and `pt-PT` locales all resolve here (see `candidates`).
     LangInfo { code: "pt-br", name: "Português (Brasil)", source: include_str!("pt-br.tsv"), plural: plural_pt, catalog: OnceLock::new() },
+    // German (informal "du"); every `de-*` locale (`de-DE`, `de-AT`, `de-CH` ...) resolves here.
+    LangInfo { code: "de", name: "Deutsch", source: include_str!("de.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
     // Spanish (European vocabulary); every `es-*` locale (`es-ES`, `es-MX`, `es-419` ...) resolves here.
     LangInfo { code: "es", name: "Español", source: include_str!("es.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
     // French; every `fr-*` locale (`fr-FR`, `fr-CA`, `fr-BE` ...) resolves here.
@@ -1120,6 +1122,115 @@ mod tests {
         set_current(Lang::EN);
     }
 
+    #[test]
+    fn german_is_registered() {
+        let de = Lang::from_code("de").expect("de registered");
+        assert_eq!(de.name(), "Deutsch");
+        assert_eq!(normalize_pref("DE"), Some("de"));
+        assert_eq!(lang_from_tag("de_DE.UTF-8"), Some(de));
+        assert_eq!(lang_from_tag("de-AT"), Some(de));
+        assert_eq!(lang_from_tag("de_CH"), Some(de));
+        assert_eq!(first_supported("de-DE\r\nen-US"), Some(de));
+        assert_eq!(tr(de, "File"), "Datei");
+        assert_eq!(tr(de, "Save as…"), "Speichern unter…");
+        assert_eq!(tr(de, "Bookmarks"), "Lesezeichen");
+        assert_eq!(tr(de, "Layers"), "Ebenen");
+        assert_eq!(tr(de, "Bericht des Nutzers.pdf"), "Bericht des Nutzers.pdf");
+        assert_eq!((0..=3).map(|n| (de.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+        assert_eq!(trn(de, 0, "{n} page", "{n} pages"), "0 Seiten");
+        assert_eq!(trn(de, 1, "{n} page", "{n} pages"), "1 Seite");
+        assert_eq!(trn(de, 2, "{n} page", "{n} pages"), "2 Seiten");
+        assert_eq!(trn(de, 1, "{n} field", "{n} fields"), "1 Feld");
+        assert_eq!(trn(de, 2, "{n} field", "{n} fields"), "2 Felder");
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", "de").unwrap();
+        assert_eq!(app.language, "de");
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, "de");
+    }
+
+    /// German translates every registered command and every All tools group, section and item.
+    #[test]
+    fn german_covers_commands_and_catalogue() {
+        let de = Lang::from_code("de").expect("de registered");
+        for command in pdfcraft_engine::commands::COMMANDS {
+            assert!(has(de, command.label), "missing command: {}", command.label);
+            if let Some(menu) = command.menu {
+                assert!(has(de, menu), "missing menu: {menu}");
+            }
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            assert!(has(de, group.label), "missing group: {}", group.label);
+            for section in group.sections {
+                assert!(has(de, section.title), "missing section: {}", section.title);
+                for item in section.items {
+                    assert!(has(de, item.label), "missing item: {}", item.label);
+                }
+            }
+        }
+    }
+
+    /// New tl!("literal") labels must not silently fall back to English.
+    #[test]
+    fn german_covers_ui_literals() {
+        let de = Lang::from_code("de").expect("de registered");
+        let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+        let mut literals = std::collections::BTreeSet::new();
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(dir).expect("UI source directory") {
+                let path = entry.expect("UI source entry").path();
+                if path.is_dir() {
+                    if path.file_name().is_some_and(|name| name != "i18n") {
+                        stack.push(path);
+                    }
+                } else if path.extension().is_some_and(|ext| ext == "rs") {
+                    let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n");
+                    let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+                    while let Some((_, after)) = rest.split_once("tl!(\"") {
+                        let mut escaped = false;
+                        let end = after
+                            .char_indices()
+                            .find_map(|(i, c)| {
+                                if c == '"' && !escaped {
+                                    return Some(i);
+                                }
+                                escaped = c == '\\' && !escaped;
+                                None
+                            })
+                            .expect("closed tl! literal");
+                        let (raw, tail) = after.split_at(end);
+                        if tail.starts_with("\")") {
+                            let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
+                            literals.insert(label);
+                        }
+                        rest = tail.strip_prefix('"').expect("closing quote");
+                    }
+                }
+            }
+        }
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(de, label)).collect();
+        assert!(missing.is_empty(), "untranslated German UI literals: {missing:#?}");
+    }
+
+    #[test]
+    fn german_history_and_diagnostics_preserve_user_values() {
+        let de = Lang::from_code("de").expect("de registered");
+        set_current(de);
+        assert_eq!(command_label("Undo Insert pages from Rapport {n}.pdf"), "Seiten aus Rapport {n}.pdf einfügen rückgängig machen");
+        assert_eq!(command_label("Redo Fill in Contact {key}"), "Contact {key} ausfüllen wiederholen");
+        assert_eq!(action_label("Change Title"), "Titel ändern");
+        assert_eq!(action_label("Custom action {n}"), "Custom action {n}");
+        assert_eq!(
+            fmt(t("This page couldn't be displayed.\n{e}"), &[("e", "OS error {n}")]),
+            "Diese Seite konnte nicht angezeigt werden.\nOS error {n}"
+        );
+        assert_eq!(fmt(t("{n} pages selected"), &[("n", "3")]), "3 Seiten ausgewählt");
+        assert_eq!(tr(de, "CheckBox"), "Kontrollkästchen");
+        set_current(Lang::EN);
+    }
+
     #[test]
     fn russian_is_registered() {
         let ru = Lang::from_code("ru").expect("ru registered");
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 2ae7ed57..67662937 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -132,7 +132,7 @@ fn language_switch_preserves_document_and_command_ids() {
     let documents = ok(&mut h, &c, "ui.state", json!({}))["documents"].clone();
     assert_eq!(documents[0]["dirty"], true);
     let commands = ok(&mut h, &c, "ui.commands", json!({}));
-    for code in ["ja", "zh-hans", "fr", "en"] {
+    for code in ["ja", "zh-hans", "fr", "de", "en"] {
         ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": code }));
         h.run_steps(2);
         let state = ok(&mut h, &c, "ui.state", json!({}));
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index 460de28a..046cf1b9 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -162,7 +162,7 @@ fn ui_fonts_work_without_craft_fonts() {
     theme::install_fonts(&ctx);
 }
 
-/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, Spanish, French, Russian, Bulgarian) are drawn entirely by the app's own faces
+/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, German, Spanish, French, Russian, Bulgarian) are drawn entirely by the app's own faces
 /// (Inter, JetBrains Mono): no letter falls through to egui's defaults or a CJK fallback. (egui's
 /// `has_glyphs` can't answer this: with only the primary face it is also the replacement face.)
 #[test]
@@ -172,12 +172,13 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
     for (code, catalog) in [
         ("cs", include_str!("../src/i18n/cs.tsv")),
         ("pt-br", include_str!("../src/i18n/pt-br.tsv")),
+        ("de", include_str!("../src/i18n/de.tsv")),
         ("es", include_str!("../src/i18n/es.tsv")),
         ("fr", include_str!("../src/i18n/fr.tsv")),
         ("ru", include_str!("../src/i18n/ru.tsv")),
         ("bg", include_str!("../src/i18n/bg.tsv")),
     ] {
-        let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜ¿¡«»…");
+        let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜäÄöÖß„“¿¡«»…");
         for line in catalog.lines().filter(|l| !l.starts_with('#')) {
             if let Some(translation) = line.split('\t').nth(2) {
                 text.extend(translation.chars().filter(|c| !c.is_whitespace()));
diff --git a/docs/localization.md b/docs/localization.md
index ceefd815..621ba4db 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,8 +1,8 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, and Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, and Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
@@ -10,15 +10,15 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
+Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 
 There is no right-to-left interface language yet. File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
 
-Simplified Chinese and French coverage tests, following PhotoCraft's complete-catalog approach, check every registered command, All tools label and `tl!("literal")` in the UI source. Simplified Chinese also checks direct `i18n::t` calls and multiline literals, plus the About tabs, contributor name modes, sort options, table headers and model columns. Generated history labels, contributor summaries and diagnostics are tested with user-supplied names and error details. Catalog coverage does not guarantee glyph coverage: the release-pinned craft-fonts input currently has no `Hans` face, and the web build embeds only BIZ UDPGothic Regular. Chinese font delivery remains separate work, as discussed in [#112](https://github.com/storytold/pdfcraft/pull/112) and [#140](https://github.com/storytold/pdfcraft/pull/140).
+Simplified Chinese, French and German coverage tests, following PhotoCraft's complete-catalog approach, check every registered command, All tools label and `tl!("literal")` in the UI source. Simplified Chinese also checks direct `i18n::t` calls and multiline literals, plus the About tabs, contributor name modes, sort options, table headers and model columns. Generated history labels, contributor summaries and diagnostics are tested with user-supplied names and error details. Catalog coverage does not guarantee glyph coverage: the release-pinned craft-fonts input currently has no `Hans` face, and the web build embeds only BIZ UDPGothic Regular. Chinese font delivery remains separate work, as discussed in [#112](https://github.com/storytold/pdfcraft/pull/112) and [#140](https://github.com/storytold/pdfcraft/pull/140).
 
 ## How translations work
 
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 21ab60ae..90988421 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9819,7 +9819,7 @@ status = "partial"
 commands = ["app.preferences"]
 tools = []
 evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs"]
-notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/Spanish/French/Telugu and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|es|fr|te and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, Spanish and French cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
+notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish and French cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"

From bd5737743555147d0a62094e912c055111dc8e17 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 10:43:11 -0400
Subject: [PATCH 067/149] Fix #525 (item 4): phone pattern redacts
 international numbers whole (#543)

The Phone Numbers redaction pattern accepted only 10 digits (11 with a
country code), the North American form. For "+49 2151 123456" (12 digits)
the `+` candidate was rejected and the scan then matched "2151 123456",
leaving "+49" visible: a partial redaction in a document the user thinks
is clean.

The pattern now accepts, still grouped by at least one separator:
- E.164 numbers with a leading `+`: 8-15 digits in all;
- national numbers with a trunk 0 followed by 6-14 digits, whose first
  group has at least two digits (so decimals don't match) and which are
  not a day-first date (left to the date pattern);
- North American numbers as before.
A separator may now be followed by `(`, so "+49 (0) 2151 123456" is one
match instead of a partial "(0) 2151 123456".

Refs #525. The other items (page-number and date tokens, stamps) are not
addressed here.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/redact/src/patterns.rs | 45 +++++++++++++++++++++++++++++------
 parity/acrobat-features.toml  |  2 +-
 2 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/crates/redact/src/patterns.rs b/crates/redact/src/patterns.rs
index c031fbe8..e31a5ec2 100644
--- a/crates/redact/src/patterns.rs
+++ b/crates/redact/src/patterns.rs
@@ -56,7 +56,7 @@ fn digit_run(s: &[char], start: usize, seps: &[char], max_len: usize) -> (usize,
         let c = s[i];
         if c.is_ascii_digit() {
             n += 1;
-        } else if !(seps.contains(&c) && digit(s.get(i + 1)) || (c == '(' || c == ')') && seps.contains(&c)) {
+        } else if !(seps.contains(&c) && (digit(s.get(i + 1)) || s.get(i + 1) == Some(&'(')) || (c == '(' || c == ')') && seps.contains(&c)) {
             break;
         }
         i += 1;
@@ -73,14 +73,31 @@ fn phone(s: &[char], i: usize) -> Option<usize> {
     if !start_ok || word(i.checked_sub(1).and_then(|p| s.get(p))) || s.get(i.wrapping_sub(1)) == Some(&'+') {
         return None;
     }
-    let first = if s[i] == '+' { i + 1 } else { i };
-    let (end, n) = digit_run(s, first, &[' ', '-', '.', '(', ')'], 20);
-    let seps = s[first..end].iter().filter(|c| !c.is_ascii_digit()).count();
-    // 10 digits (11 with a country code), grouped by at least one separator.
-    if !(10..=11).contains(&n) || seps == 0 || digit(s.get(end)) {
+    let plus = s[i] == '+';
+    let first = if plus { i + 1 } else { i };
+    let (end, n) = digit_run(s, first, &[' ', '-', '.', '(', ')'], 28);
+    let run = s.get(first..end)?;
+    let seps = run.iter().filter(|c| !c.is_ascii_digit()).count();
+    // Always grouped by at least one separator, so plain numbers never match.
+    if seps == 0 || digit(s.get(end)) {
         return None;
     }
-    Some(end - i)
+    let ok = if plus {
+        // E.164: a `+` country code and up to 15 digits in all ("+49 2151 123456").
+        (8..=15).contains(&n)
+    } else {
+        // North American: 10 digits, 11 with a country code ("(555) 123-4567").
+        let nanp = (10..=11).contains(&n);
+        // National with a trunk 0 and 6–14 more digits ("0211 123456", "01 23 45 67 89").
+        // The first group needs two digits so decimals ("0.1234567") don't match, and
+        // day-first dates ("01.10.2026") are left to the date pattern.
+        let mut digits = run.iter().skip_while(|c| !c.is_ascii_digit());
+        let trunk_zero = digits.clone().next() == Some(&'0');
+        let lead = digits.by_ref().take_while(|c| c.is_ascii_digit()).count();
+        let trunk = trunk_zero && (7..=15).contains(&n) && lead >= 2 && date(s, i).is_none();
+        nanp || trunk
+    };
+    ok.then_some(end - i)
 }
 
 fn email(s: &[char], i: usize) -> Option<usize> {
@@ -255,6 +272,20 @@ mod tests {
             found(Pattern::Phone, "Call (555) 123-4567 or 555.987.6543, +1 555 222 3333; not 12345 or 5551234567890"),
             ["(555) 123-4567", "555.987.6543", "+1 555 222 3333"]
         );
+        // #525: international numbers match whole; "+49" used to stay visible.
+        assert_eq!(found(Pattern::Phone, "Tel. +49 2151 123456."), ["+49 2151 123456"]);
+        assert_eq!(
+            found(Pattern::Phone, "+44 20 7946 0018, +33 1 23 45 67 89, +49 (0) 2151 123456, (0211) 123456, 030 12345678, 01 23 45 67 89"),
+            ["+44 20 7946 0018", "+33 1 23 45 67 89", "+49 (0) 2151 123456", "(0211) 123456", "030 12345678", "01 23 45 67 89"]
+        );
+        // Not phone numbers: day-first dates, decimals, unseparated, too short or too long.
+        assert_eq!(
+            found(
+                Pattern::Phone,
+                "on 01.10.2026 or 09-10-2026, ratio 0.1234567, id 0211123456, +4921511234567, +1 234 567, 0211 12, +49 1234 5678 9012 3456"
+            ),
+            Vec::<String>::new()
+        );
     }
 
     #[test]
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 90988421..c59badfa 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5531,7 +5531,7 @@ status = "shipped"
 commands = ["redact.search"]
 tools = ["redact_mark"]
 evidence = ["crates/redact/src/patterns.rs::phone_numbers", "crates/redact/src/patterns.rs::credit_cards_need_a_valid_checksum", "crates/automation/tests/automation.rs::redacting_through_tools"]
-notes = "phone, e-mail, credit card (Luhn), SSN, dates (English US forms)"
+notes = "phone (North American, E.164 with + country code, national with trunk 0), e-mail, credit card (Luhn), SSN, dates (English US forms)"
 
 [[feature]]
 id = "protect.redact-pattern-locales"

From a59351270094c89656a68e5919199af1bfc664ab Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 10:45:28 -0400
Subject: [PATCH 068/149] =?UTF-8?q?Refs=20#347:=20encode=20the=20full=20Wi?=
 =?UTF-8?q?nAnsi=200x80-0x9F=20range=20(=C5=A0=20=C5=A1=20=C5=BD=20=C5=BE?=
 =?UTF-8?q?=20=C5=92=20=C5=93=20=C5=B8=20...)=20(#546)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pdfcraft_fonts::win_ansi, edit's is_win_ansi_char and the xtask demo
encoder each carried a hand-written subset of WinAnsiEncoding's 0x80-0x9F
row (quotes, dashes, euro, trademark) and left out Š š Ž ž Œ œ Ÿ ƒ † ‡ ˆ
˜ ‰ ‹ ›. Text editing therefore treated š/ž as non-WinAnsi and sent them
to the Type3 fallback font (or refused them without craft-fonts), and
every other generator (forms, annotations, OCR layer, redaction overlay,
signatures, create) wrote them as '?'.

win_ansi now goes through a new win_ansi_byte, which reads the 0x80-0x9F
codes from the same ISO 32000-2 Annex D table the text extractor decodes
with, and is_win_ansi_char reuses it. xtask doesn't depend on
pdfcraft-fonts, so its demo encoder gets the full row with a pointer to
the shared table. č/ć are not in WinAnsi and still use the fallback.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/edit/src/tests.rs  | 16 +++++++++++
 crates/edit/src/text.rs   |  2 +-
 crates/fonts/src/lib.rs   | 56 ++++++++++++++++++++++++---------------
 xtask/src/demo_pdf/pdf.rs | 40 ++++++++++++++++++++++++----
 4 files changed, 87 insertions(+), 27 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index edba41fc..6e746ca0 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -718,6 +718,22 @@ fn editing_text_keeps_the_tokens_a_stream_shares_with_its_neighbours() {
     assert_split_tokens_kept(&reopen(&doc), "Rewrapped");
 }
 
+#[test]
+fn win_ansi_high_glyphs_use_helvetica_not_the_fallback_font() {
+    // š ž Š Ž Œ Ÿ ƒ † ‰ (WinAnsi 0x80–0x9F) are standard-font glyphs (#347): no Type3 fallback.
+    let text = "Šumava žaba œuvre Ÿ ƒ † ‰ €";
+    let mut doc = text_page("BT /F2 10 Tf 72 600 Td (ab) Tj ET");
+    let r = text::replace_line(&mut doc, 0, 0, text).unwrap();
+    assert_eq!(r.substituted.as_deref(), Some("Helvetica"));
+    let lines = text::text_lines(&reopen(&doc), 0).unwrap();
+    assert_eq!((lines[0].text.as_str(), lines[0].base_font.as_str()), (text, "Helvetica"));
+    let mut doc = text_page("BT /F2 10 Tf 72 600 Td (ab) Tj ET");
+    let r = text::replace_block(&mut doc, 0, 0, text).unwrap();
+    assert!(r.substituted.as_deref().is_none_or(|s| !s.contains("Type3")), "{:?}", r.substituted);
+    let lines = text::text_lines(&reopen(&doc), 0).unwrap();
+    assert_eq!(lines.iter().map(|l| l.text.as_str()).collect::<Vec<_>>().join(" "), text);
+}
+
 #[test]
 fn missing_glyphs_substitute_helvetica_and_impossible_text_is_refused() {
     let mut doc = text_page("BT /F2 10 Tf 72 600 Td (ab) Tj ET");
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index bf74edfb..7eb31145 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -499,7 +499,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
 type Encoder = Box<dyn Fn(&str) -> Option<Vec<u8>>>;
 
 fn is_win_ansi_char(c: char) -> bool {
-    matches!(c, '\u{20}'..='\u{7e}' | '\u{a0}'..='\u{ff}' | '€' | '‚' | '„' | '…' | '‘' | '’' | '“' | '”' | '•' | '–' | '—' | '™' | '\t')
+    c == '\t' || pdfcraft_fonts::win_ansi_byte(c).is_some()
 }
 
 fn needs_type3(text: &str) -> bool {
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index 749ef53a..d5965f8b 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -66,28 +66,25 @@ pub fn wrap(text: &str, size: f64, width: f64) -> Vec<String> {
     lines
 }
 
-/// Encode text in WinAnsiEncoding (ISO 32000-2 Annex D); unmappable characters become `?`.
+/// The WinAnsiEncoding (ISO 32000-2 Annex D) code for `c`, if the encoding has one.
+///
+/// Codes 0x80–0x9F come from the same table the text extractor decodes with, so encoding and
+/// decoding agree (Š š Ž ž Œ œ Ÿ ƒ † ‡ ˆ ˜ ‰ ‹ › as well as quotes, dashes, € and ™).
+pub fn win_ansi_byte(c: char) -> Option<u8> {
+    match c {
+        '\u{20}'..='\u{7e}' | '\u{a0}'..='\u{ff}' => u8::try_from(u32::from(c)).ok(),
+        _ => {
+            let high = encodings::WIN_ANSI.get(0x80..0xa0)?;
+            let i = high.iter().position(|&u| u != 0 && u == u32::from(c))?;
+            u8::try_from(0x80 + i).ok()
+        }
+    }
+}
+
+/// Encode text in WinAnsiEncoding (ISO 32000-2 Annex D); tabs become spaces and unmappable
+/// characters become `?`.
 pub fn win_ansi(s: &str) -> Vec<u8> {
-    s.chars()
-        .map(|c| match c {
-            '\u{20}'..='\u{7e}' => c as u8,
-            '\u{a0}'..='\u{ff}' => c as u32 as u8,
-            '€' => 0x80,
-            '‚' => 0x82,
-            '„' => 0x84,
-            '…' => 0x85,
-            '‘' => 0x91,
-            '’' => 0x92,
-            '“' => 0x93,
-            '”' => 0x94,
-            '•' => 0x95,
-            '–' => 0x96,
-            '—' => 0x97,
-            '™' => 0x99,
-            '\t' => b' ',
-            _ => b'?',
-        })
-        .collect()
+    s.chars().map(|c| if c == '\t' { b' ' } else { win_ansi_byte(c).unwrap_or(b'?') }).collect()
 }
 
 /// Bytes as a PDF literal string, `(` … `)`, with delimiters escaped.
@@ -122,4 +119,21 @@ mod tests {
         assert_eq!(win_ansi("Café — 5€ ☃"), b"Caf\xe9 \x97 5\x80 ?");
         assert_eq!(literal(b"a(b)\\c"), b"(a\\(b\\)\\\\c)");
     }
+
+    #[test]
+    fn win_ansi_covers_the_0x80_to_0x9f_glyphs() {
+        // Every character in the WinAnsiEncoding table encodes to its code and back (#347).
+        for (code, &u) in encodings::WIN_ANSI.iter().enumerate() {
+            let Some(c) = char::from_u32(u).filter(|_| u != 0) else { continue };
+            assert_eq!(win_ansi_byte(c), Some(code as u8), "{c:?} (U+{u:04X})");
+            assert_eq!(win_ansi(&c.to_string()), [code as u8]);
+        }
+        assert_eq!(
+            win_ansi("Šta? žaba, œuvre — „ok“ ‰ ƒ † ‡ ˆ ˜ ‹›Ÿ"),
+            b"\x8ata? \x9eaba, \x9cuvre \x97 \x84ok\x93 \x89 \x83 \x86 \x87 \x88 \x98 \x8b\x9b\x9f"
+        );
+        // Not in WinAnsi: č ć still need the fallback font; undefined codes are never produced.
+        assert_eq!(win_ansi("čć\u{81}\u{8d}\t"), b"???? ");
+        assert_eq!(win_ansi_byte('\0'), None);
+    }
 }
diff --git a/xtask/src/demo_pdf/pdf.rs b/xtask/src/demo_pdf/pdf.rs
index 9f4b9cc5..297d4ce9 100644
--- a/xtask/src/demo_pdf/pdf.rs
+++ b/xtask/src/demo_pdf/pdf.rs
@@ -351,20 +351,41 @@ pub fn pdf_string(s: &str) -> String {
 }
 
 /// Map text to WinAnsiEncoding bytes (unmappable characters become `?`).
+///
+/// Mirrors `pdfcraft_fonts::win_ansi` (ISO 32000-2 Annex D), which xtask doesn't depend on;
+/// keep the 0x80–0x9F rows in step with `crates/fonts/src/encodings.rs`.
 pub fn winansi(s: &str) -> Vec<u8> {
     s.chars()
         .map(|c| match c {
             '\u{20}'..='\u{7e}' => c as u8,
             '\u{a0}'..='\u{ff}' => c as u32 as u8,
-            '\u{2022}' => 0x95,
-            '\u{2013}' => 0x96,
-            '\u{2014}' => 0x97,
+            '\u{20ac}' => 0x80,
+            '\u{201a}' => 0x82,
+            '\u{0192}' => 0x83,
+            '\u{201e}' => 0x84,
+            '\u{2026}' => 0x85,
+            '\u{2020}' => 0x86,
+            '\u{2021}' => 0x87,
+            '\u{02c6}' => 0x88,
+            '\u{2030}' => 0x89,
+            '\u{0160}' => 0x8a,
+            '\u{2039}' => 0x8b,
+            '\u{0152}' => 0x8c,
+            '\u{017d}' => 0x8e,
             '\u{2018}' => 0x91,
             '\u{2019}' => 0x92,
             '\u{201c}' => 0x93,
             '\u{201d}' => 0x94,
-            '\u{2026}' => 0x85,
-            '\u{20ac}' => 0x80,
+            '\u{2022}' => 0x95,
+            '\u{2013}' => 0x96,
+            '\u{2014}' => 0x97,
+            '\u{02dc}' => 0x98,
+            '\u{2122}' => 0x99,
+            '\u{0161}' => 0x9a,
+            '\u{203a}' => 0x9b,
+            '\u{0153}' => 0x9c,
+            '\u{017e}' => 0x9e,
+            '\u{0178}' => 0x9f,
             _ => b'?',
         })
         .collect()
@@ -415,4 +436,13 @@ mod tests {
         assert_eq!(pdf_string("a(b)\\"), "(a\\(b\\)\\\\)");
         assert_eq!(pdf_string("—"), "(\\227)");
     }
+
+    #[test]
+    fn winansi_covers_the_0x80_to_0x9f_glyphs() {
+        // The 27 defined codes of ISO 32000-2 Annex D WinAnsiEncoding between 0x80 and 0x9F.
+        let high = "€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ";
+        let want: Vec<u8> = (0x80..=0x9f).filter(|b| ![0x81, 0x8d, 0x8f, 0x90, 0x9d].contains(b)).collect();
+        assert_eq!(winansi(high), want);
+        assert_eq!(winansi("č"), b"?");
+    }
 }

From 2aca0692fc4ad1a9daa602eed5e5f1398e8a90af Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 10:49:21 -0400
Subject: [PATCH 069/149] Fix #526: keep text colour in Word, HTML and RTF
 export (#547)

The export model (`pdfcraft_export::Block`/`Cell`) had no colour, so
`export_pages` dropped the fill colour that `edit::TextBlock` already
carries and every run came out black.

Block and Cell now carry an sRGB colour, mapped from TextBlock.color.
Word runs get `<w:color w:val="RRGGBB"/>`, HTML paragraphs, headings and
cells a `style="color:#RRGGBB"`, and RTF a colour table with `\cfN`.
Black text keeps each format's default; NaN and out-of-range components
clamp.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/engine/src/compare.rs |   1 +
 crates/engine/src/tests.rs   |  33 ++++++++++
 crates/export/src/lib.rs     | 121 +++++++++++++++++++++++++++++++----
 parity/acrobat-features.toml |  12 ++--
 4 files changed, 147 insertions(+), 20 deletions(-)

diff --git a/crates/engine/src/compare.rs b/crates/engine/src/compare.rs
index bfcf578b..7da14c82 100644
--- a/crates/engine/src/compare.rs
+++ b/crates/engine/src/compare.rs
@@ -170,6 +170,7 @@ impl crate::Document {
                             size: b.size,
                             bold: f.contains("bold") || f.contains("black") || f.contains("heavy"),
                             italic: f.contains("italic") || f.contains("oblique"),
+                            color: b.color,
                         }
                     })
                     .collect();
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 308c5aed..e885a9bd 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1651,6 +1651,39 @@ fn exporting_office_files_keeps_images() {
     assert!(String::from_utf8(d.export_office(compare::OfficeFormat::Html)).unwrap().contains("data:image/png;base64,"));
 }
 
+#[test]
+fn exporting_office_files_keeps_text_colour() {
+    // #526: a dark green heading came out black in Word.
+    let content = "BT /F1 24 Tf 0.05 0.23 0.18 rg 72 700 Td (Annual Report) Tj ET \
+BT /F1 11 Tf 0 g 72 650 Td (Black body text that is long enough to be the body size.) Tj ET";
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica-Bold >>".into(),
+    ];
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut s = Session::new();
+    let id = s.open("c.pdf", None, Arc::new(pdf), None).unwrap();
+    let d = s.get(id).unwrap();
+    let html = String::from_utf8(d.export_office(compare::OfficeFormat::Html)).unwrap();
+    assert!(html.contains("style=\"color:#0D3B2E\">Annual Report"), "{html}");
+    let blocks = &d.export_pages()[0].blocks;
+    assert!(blocks.iter().any(|b| b.text == "Annual Report" && b.color == [0.05, 0.23, 0.18]), "{blocks:?}");
+}
+
 #[test]
 fn guard_turns_a_panic_into_an_error() {
     assert_eq!(guard(|| 7), Ok(7));
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index ba165b09..5e78640a 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -21,6 +21,8 @@ pub struct Block {
     pub size: f64,
     pub bold: bool,
     pub italic: bool,
+    /// Text fill colour as sRGB components in 0..=1 (black when unknown).
+    pub color: [f64; 3],
 }
 
 /// An image of a page.
@@ -48,6 +50,8 @@ pub struct Cell {
     pub size: f64,
     pub bold: bool,
     pub italic: bool,
+    /// Text fill colour as sRGB components in 0..=1.
+    pub color: [f64; 3],
     pub span: usize,
 }
 
@@ -199,7 +203,7 @@ fn tables(blocks: &[Block]) -> (Vec<Table>, Vec<bool>) {
                 let b = &blocks[bi];
                 let Some(slot) = edges.iter().position(|e| (*e - b.rect[0]).abs() <= COL_TOL) else { continue };
                 let span = edges[slot + 1..].iter().filter(|e| **e > b.rect[0] + COL_TOL && **e < b.rect[2] - COL_TOL).count() + 1;
-                let cell = Cell { text: b.text.trim().to_string(), size: b.size, bold: b.bold, italic: b.italic, span };
+                let cell = Cell { text: b.text.trim().to_string(), size: b.size, bold: b.bold, italic: b.italic, color: b.color, span };
                 match &mut slots[slot] {
                     Some(c) => {
                         c.text.push(' ');
@@ -220,7 +224,7 @@ fn tables(blocks: &[Block]) -> (Vec<Table>, Vec<bool>) {
                     }
                     None => {
                         column += 1;
-                        materialized.push(Cell { text: String::new(), size: 11.0, bold: false, italic: false, span: 1 });
+                        materialized.push(Cell { text: String::new(), size: 11.0, bold: false, italic: false, color: [0.0; 3], span: 1 });
                     }
                 }
             }
@@ -361,9 +365,10 @@ table{{border-collapse:collapse;margin:1em 0}}td,th{{border:1px solid #999;paddi
                 if b.bold && lvl == 0 {
                     t = format!("<strong>{t}</strong>");
                 }
+                let style = hex(b.color).map_or(String::new(), |h| format!(" style=\"color:#{h}\""));
                 match lvl {
-                    0 => s.push_str(&format!("<p>{t}</p>\n")),
-                    l => s.push_str(&format!("<h{l}>{t}</h{l}>\n")),
+                    0 => s.push_str(&format!("<p{style}>{t}</p>\n")),
+                    l => s.push_str(&format!("<h{l}{style}>{t}</h{l}>\n")),
                 }
             }
             Item::Table(t) => {
@@ -379,7 +384,8 @@ table{{border-collapse:collapse;margin:1em 0}}td,th{{border:1px solid #999;paddi
                             body = format!("<strong>{body}</strong>");
                         }
                         let span = if c.span > 1 { format!(" colspan=\"{}\"", c.span) } else { String::new() };
-                        s.push_str(&format!("<td{span}>{body}</td>"));
+                        let style = hex(c.color).map_or(String::new(), |h| format!(" style=\"color:#{h}\""));
+                        s.push_str(&format!("<td{span}{style}>{body}</td>"));
                     }
                     s.push_str("</tr>\n");
                 }
@@ -396,8 +402,20 @@ table{{border-collapse:collapse;margin:1em 0}}td,th{{border:1px solid #999;paddi
     s
 }
 
+/// A colour's 8-bit sRGB components (NaN and out-of-range values clamp; NaN reads as 0).
+fn rgb8(c: [f64; 3]) -> [u8; 3] {
+    // The value is clamped to 0..=255 before the cast, so it cannot truncate.
+    c.map(|v| if v.is_finite() { (v.clamp(0.0, 1.0) * 255.0).round() as u8 } else { 0 })
+}
+
+/// The colour as `RRGGBB`, or `None` for black (the default every format already uses).
+fn hex(c: [f64; 3]) -> Option<String> {
+    let [r, g, b] = rgb8(c);
+    (r | g | b != 0).then(|| format!("{r:02X}{g:02X}{b:02X}"))
+}
+
 /// A formatted text run (shared by paragraphs and table cells).
-fn run_xml(text: &str, size: f64, bold: bool, italic: bool) -> String {
+fn run_xml(text: &str, size: f64, bold: bool, italic: bool, color: [f64; 3]) -> String {
     let mut rpr = String::new();
     if bold {
         rpr.push_str("<w:b/>");
@@ -405,6 +423,9 @@ fn run_xml(text: &str, size: f64, bold: bool, italic: bool) -> String {
     if italic {
         rpr.push_str("<w:i/>");
     }
+    if let Some(h) = hex(color) {
+        rpr.push_str(&format!("<w:color w:val=\"{h}\"/>"));
+    }
     let half_points = if size.is_finite() { (size * 2.0).round().clamp(2.0, 3276.0) as i64 } else { 24 };
     rpr.push_str(&format!("<w:sz w:val=\"{half_points}\"/>"));
     format!("<w:r><w:rPr>{rpr}</w:rPr><w:t xml:space=\"preserve\">{}</w:t></w:r>", esc(text))
@@ -440,7 +461,7 @@ fn docx_table(t: &Table) -> String {
             let w: i64 = widths.iter().take(c.span.min(widths.len())).sum();
             s.push_str(&format!(
                 "<w:tc><w:tcPr><w:tcW w:w=\"{w}\" w:type=\"dxa\"/>{span}</w:tcPr><w:p>{}</w:p></w:tc>",
-                run_xml(&c.text, c.size, c.bold, c.italic)
+                run_xml(&c.text, c.size, c.bold, c.italic, c.color)
             ));
         }
         // Pad the grid so every row covers all columns (Word rejects short rows).
@@ -468,7 +489,7 @@ pub fn docx(pages: &[Page], title: &str) -> Vec<u8> {
     let mut media: Vec<(String, &Image)> = Vec::new();
     // Word needs a paragraph between adjacent tables and after the last one in the body.
     let mut after_table = false;
-    let run = |b: &Block| run_xml(&b.text, b.size, b.bold, b.italic);
+    let run = |b: &Block| run_xml(&b.text, b.size, b.bold, b.italic, b.color);
     for it in items(pages) {
         match &it {
             Item::Para(b, lvl) => {
@@ -586,8 +607,36 @@ fn rtf_text(s: &str) -> String {
 /// Rich Text Format: paragraphs with their sizes and bold/italic, real table rows, page breaks
 /// between pages (images are left out).
 pub fn rtf(pages: &[Page]) -> String {
+    let items = items(pages);
+    // The colour table: entry 0 is the default (auto) colour, then each non-black colour once.
+    let mut colors: Vec<[u8; 3]> = Vec::new();
+    let mut note = |c: [f64; 3]| {
+        let c = rgb8(c);
+        if c != [0, 0, 0] && !colors.contains(&c) {
+            colors.push(c);
+        }
+    };
+    for it in &items {
+        match it {
+            Item::Para(b, _) => note(b.color),
+            Item::Table(t) => t.rows.iter().flatten().for_each(|c| note(c.color)),
+            Item::Img(_) | Item::PageBreak => {}
+        }
+    }
+    // `\cfN` for a colour (nothing for black, which keeps the default).
+    let cf = |c: [f64; 3]| {
+        let c = rgb8(c);
+        colors.iter().position(|e| *e == c).map_or(String::new(), |i| format!("\\cf{}", i + 1))
+    };
     let mut s = String::from("{\\rtf1\\ansi\\deff0{\\fonttbl{\\f0 Helvetica;}}\n");
-    for it in items(pages) {
+    if !colors.is_empty() {
+        s.push_str("{\\colortbl;");
+        for [r, g, b] in &colors {
+            s.push_str(&format!("\\red{r}\\green{g}\\blue{b};"));
+        }
+        s.push_str("}\n");
+    }
+    for it in items {
         match it {
             Item::Para(b, _) => {
                 let mut fmt = format!("\\fs{}", (b.size * 2.0).round() as i64);
@@ -597,6 +646,7 @@ pub fn rtf(pages: &[Page]) -> String {
                 if b.italic {
                     fmt.push_str("\\i");
                 }
+                fmt.push_str(&cf(b.color));
                 s.push_str(&format!("{{\\pard{fmt} {}\\par}}\n", rtf_text(&b.text)));
             }
             Item::Table(t) => {
@@ -622,6 +672,7 @@ pub fn rtf(pages: &[Page]) -> String {
                         if c.italic {
                             fmt.push_str("\\i");
                         }
+                        fmt.push_str(&cf(c.color));
                         s.push_str(&format!("{{{fmt} {}}}\\cell", rtf_text(&c.text)));
                     }
                     s.push_str("\\row\n");
@@ -640,7 +691,14 @@ mod tests {
     use super::*;
 
     fn page() -> Page {
-        let b = |t: &str, y: f64, size: f64, bold: bool| Block { text: t.into(), rect: [72.0, y, 500.0, y + size], size, bold, italic: false };
+        let b = |t: &str, y: f64, size: f64, bold: bool| Block {
+            text: t.into(),
+            rect: [72.0, y, 500.0, y + size],
+            size,
+            bold,
+            italic: false,
+            color: [0.0; 3],
+        };
         Page {
             width: 612.0,
             height: 792.0,
@@ -712,6 +770,7 @@ mod tests {
             size: f64::NAN,
             bold: false,
             italic: false,
+            color: [0.0; 3],
         });
         let xml = part(&docx(&[p.clone()], "Receipt\u{1}"), "word/document.xml");
         assert!(xml.contains(">Total 4.50\tGBP</w:t>"), "{xml}");
@@ -725,10 +784,35 @@ mod tests {
         assert!(xml.contains("<w:pgMar w:top=\"500\" w:right=\"250\" w:bottom=\"500\" w:left=\"250\""), "{xml}");
     }
 
+    #[test]
+    fn text_colour_survives_every_format() {
+        // #526: a dark green heading (0.05 0.23 0.18 rg) came out black in Word.
+        let mut p = page();
+        p.blocks[1].color = [0.05, 0.23, 0.18];
+        p.blocks[3].color = [f64::NAN, 2.0, -1.0];
+        let xml = part(&docx(&[p.clone()], "Colour"), "word/document.xml");
+        assert!(xml.contains("<w:color w:val=\"0D3B2E\"/>"), "{xml}");
+        assert!(xml.contains("<w:color w:val=\"00FF00\"/>"), "out-of-range values clamp: {xml}");
+        // Black text keeps Word's default colour.
+        assert_eq!(xml.matches("<w:color ").count(), 2, "{xml}");
+        let h = html(&[p.clone()], "Colour");
+        assert!(h.contains("<h1 style=\"color:#0D3B2E\">Annual Report</h1>"), "{h}");
+        assert!(h.contains("<p style=\"color:#00FF00\">"), "{h}");
+        let r = rtf(&[p]);
+        assert!(r.contains("{\\colortbl;\\red13\\green59\\blue46;\\red0\\green255\\blue0;}"), "{r}");
+        assert!(r.contains("\\cf1 Annual Report"), "{r}");
+        // A table cell keeps its colour too.
+        let mut t = table_page();
+        t.blocks[0].color = [1.0, 0.0, 0.0];
+        let xml = part(&docx(&[t.clone()], "Grid"), "word/document.xml");
+        assert!(xml.contains("<w:color w:val=\"FF0000\"/>"), "{xml}");
+        assert!(html(&[t], "Grid").contains("style=\"color:#FF0000\""));
+    }
+
     #[test]
     fn rtf_escapes_and_sizes() {
         let mut p = page();
-        p.blocks.push(Block { text: "Café {x}".into(), rect: [72.0, 100.0, 200.0, 110.0], size: 10.0, bold: false, italic: true });
+        p.blocks.push(Block { text: "Café {x}".into(), rect: [72.0, 100.0, 200.0, 110.0], size: 10.0, bold: false, italic: true, color: [0.0; 3] });
         let r = rtf(&[p]);
         assert!(r.starts_with("{\\rtf1") && r.ends_with('}'));
         assert!(r.contains("\\fs48\\b Annual Report"));
@@ -737,7 +821,14 @@ mod tests {
 
     /// A 3-column table with a spanning header row and a hole in the last row.
     fn table_page() -> Page {
-        let cell = |t: &str, x: f64, y: f64, w: f64| Block { text: t.into(), rect: [x, y, x + w, y + 12.0], size: 11.0, bold: false, italic: false };
+        let cell = |t: &str, x: f64, y: f64, w: f64| Block {
+            text: t.into(),
+            rect: [x, y, x + w, y + 12.0],
+            size: 11.0,
+            bold: false,
+            italic: false,
+            color: [0.0; 3],
+        };
         Page {
             width: 612.0,
             height: 792.0,
@@ -758,6 +849,7 @@ mod tests {
                     size: 11.0,
                     bold: false,
                     italic: false,
+                    color: [0.0; 3],
                 },
             ],
             images: Vec::new(),
@@ -801,7 +893,7 @@ mod tests {
             .map(|i| {
                 let (row, col) = (i / 2, i / 2 + i % 2);
                 let (x, y) = (10.0 + col as f64 * 20.0, 10_000.0 - row as f64 * 14.0);
-                Block { text: "x".into(), rect: [x, y, x + 8.0, y + 12.0], size: 11.0, bold: false, italic: false }
+                Block { text: "x".into(), rect: [x, y, x + 8.0, y + 12.0], size: 11.0, bold: false, italic: false, color: [0.0; 3] }
             })
             .collect();
         let started = std::time::Instant::now();
@@ -820,7 +912,7 @@ mod tests {
                 .flat_map(|row| {
                     (0..n).map(move |col| {
                         let (x, y) = (20.0 + col as f64 * 22.0, 700.0 - row as f64 * 14.0);
-                        Block { text: (col + 1).to_string(), rect: [x, y, x + 8.0, y + 8.0], size: 8.0, bold: false, italic: false }
+                        Block { text: (col + 1).to_string(), rect: [x, y, x + 8.0, y + 8.0], size: 8.0, bold: false, italic: false, color: [0.0; 3] }
                     })
                 })
                 .collect(),
@@ -840,6 +932,7 @@ mod tests {
             size: 11.0,
             bold: false,
             italic: false,
+            color: [0.0; 3],
         };
         let p = Page {
             width: 612.0,
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c59badfa..f223feea 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -6874,8 +6874,8 @@ milestone = "M10"
 status = "partial"
 commands = ["export.docx"]
 tools = ["doc_export_office"]
-evidence = ["crates/export/src/lib.rs::docx_is_a_word_package", "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format", "crates/export/src/lib.rs::word_opens_text_with_control_characters_and_long_pages", "crates/engine/src/tests.rs::exporting_office_files_keeps_images", "crates/automation/tests/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/compare.rs::export_to_word_html_and_rtf"]
-notes = "Flowing Word document: paragraphs, Heading 1/2 from larger text, bold/italic, images inline, page breaks, and detected tables with spans/empty cells; checked with macOS textutil and opened in Microsoft Word (Windows). Characters XML forbids are dropped; the page size stays within Word's 22 in. Not yet: columns, fonts and colours, exact layout mode."
+evidence = ["crates/export/src/lib.rs::docx_is_a_word_package", "crates/export/src/lib.rs::text_colour_survives_every_format", "crates/engine/src/tests.rs::exporting_office_files_keeps_text_colour", "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format", "crates/export/src/lib.rs::word_opens_text_with_control_characters_and_long_pages", "crates/engine/src/tests.rs::exporting_office_files_keeps_images", "crates/automation/tests/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/compare.rs::export_to_word_html_and_rtf"]
+notes = "Flowing Word document: paragraphs, Heading 1/2 from larger text, bold/italic, text colour (fill as sRGB; gray/CMYK converted naively, colour spaces via cs/sc read as black), images inline, page breaks, and detected tables with spans/empty cells; checked with macOS textutil and opened in Microsoft Word (Windows). Characters XML forbids are dropped; the page size stays within Word's 22 in. Not yet: columns, fonts, colour per run within a paragraph, exact layout mode."
 
 [[feature]]
 id = "create.export-rtf"
@@ -6886,8 +6886,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.rtf"]
 tools = ["doc_export_office"]
-evidence = ["crates/export/src/lib.rs::rtf_escapes_and_sizes", "crates/export/src/lib.rs::word_opens_text_with_control_characters_and_long_pages", "crates/automation/tests/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/compare.rs::export_to_word_html_and_rtf"]
-notes = "Paragraphs with sizes, bold, italic, Unicode; page breaks. Images are left out."
+evidence = ["crates/export/src/lib.rs::rtf_escapes_and_sizes", "crates/export/src/lib.rs::text_colour_survives_every_format", "crates/export/src/lib.rs::word_opens_text_with_control_characters_and_long_pages", "crates/automation/tests/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/compare.rs::export_to_word_html_and_rtf"]
+notes = "Paragraphs with sizes, bold, italic, text colour (colortbl), Unicode; page breaks. Images are left out."
 
 [[feature]]
 id = "create.export-xlsx"
@@ -6970,8 +6970,8 @@ milestone = "M10"
 status = "partial"
 commands = ["export.html"]
 tools = ["doc_export_office"]
-evidence = ["crates/export/src/lib.rs::html_has_headings_paragraphs_and_images_in_order", "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format", "crates/automation/tests/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/compare.rs::export_to_word_html_and_rtf"]
-notes = "Single HTML file with headings, paragraphs, inline images, and detected tables with spans/empty cells. Not yet: multi-page folder output, CSS from fonts."
+evidence = ["crates/export/src/lib.rs::html_has_headings_paragraphs_and_images_in_order", "crates/export/src/lib.rs::text_colour_survives_every_format", "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format", "crates/automation/tests/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/compare.rs::export_to_word_html_and_rtf"]
+notes = "Single HTML file with headings, paragraphs (with text colour), inline images, and detected tables with spans/empty cells. Not yet: multi-page folder output, CSS from fonts."
 
 [[feature]]
 id = "create.export-text"

From 6fce73f9026c36171cdea1eeca5a2b0cdf8847bb Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 10:50:17 -0400
Subject: [PATCH 070/149] Fix #429: pen strokes stay unselected and show no
 author popup (#549)

Cause: apply_edit selected every new annotation after Edit::AddAnnotation,
so each stroke drawn with the Draw (ink) tool became selected and showed
its selection box over the page. With the pointer still resting on the
fresh stroke, the canvas hover popup also showed the comment's author,
covering where the next stroke goes.

Fix: a new Ink annotation made while the ink tool is active is left
unselected (other annotation types, and ink added any other way, are
still selected). The annotation hover popup is suppressed while the ink
or eraser tool is active, as it already was mid-gesture.

Test: kittest draws two pen strokes in a row and checks both exist,
nothing is selected, the pen stays on and no author popup appears; a
square drawn afterwards is still selected.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs     |  6 ++++--
 crates/ui-egui/src/editing.rs    |  8 ++++++++
 crates/ui-egui/tests/comments.rs | 24 ++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index beb88cc8..da2a0373 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1805,8 +1805,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                         }
                     }
                 }
-                // Annotation hover shows the comment, as Acrobat's popups do.
-                let gesturing = view.comments.gesture.is_some();
+                // Annotation hover shows the comment, as Acrobat's popups do; not while drawing
+                // freehand, where it would cover the next stroke (#429).
+                let freehand = matches!(tool, QuickTool::Comment(comments::CommentTool::Ink | comments::CommentTool::Eraser));
+                let gesturing = view.comments.gesture.is_some() || freehand;
                 for a in info.annotations.iter().filter(|a| a.page == i && a.in_reply_to.is_none() && !gesturing) {
                     let sr = xf.user_rect(info, i, a.rect);
                     if sr.contains(p) && hover_text.is_none() {
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 57c2fef2..fe1736b1 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -52,6 +52,14 @@ impl PdfCraftApp {
                     }
                     Edit::InsertBlankPage { at, .. } => view.select_pages(&[at.min(info.pages.len() - 1)]),
                     Edit::DeletePages { .. } => view.select_pages(&[]),
+                    // A stroke drawn with the pen stays unselected, so the selection box and
+                    // author popup don't sit over the next stroke (#429).
+                    Edit::AddAnnotation(a)
+                        if matches!(a.shape, pdfcraft_engine::Shape::Ink { .. })
+                            && self.quick_tool == crate::QuickTool::Comment(crate::comments::CommentTool::Ink) =>
+                    {
+                        view.comments.selected = None;
+                    }
                     Edit::AddAnnotation(a) => {
                         // Select the new comment (appended last among the page's comments).
                         let newest = info.annotations.iter().filter(|x| x.page == a.page && x.in_reply_to.is_none()).map(|x| x.index).max();
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index cb1dc9a3..ad36b6f4 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -171,6 +171,30 @@ fn shapes_and_ink_are_drawn_by_dragging() {
     assert!((r[0] - 40.0).abs() < 3.0 && (r[1] - 40.0).abs() < 3.0 && (r[2] - 140.0).abs() < 3.0 && (r[3] - 100.0).abs() < 3.0, "{r:?}");
 }
 
+#[test]
+fn pen_strokes_stay_unselected_so_writing_continues() {
+    let mut h = harness(|app| app.set_option("quick", "ink").unwrap());
+    // No Comments panel: the author's name should only show in a hover popup.
+    h.state_mut().set_option("panel", "none").unwrap();
+    h.run_steps(2);
+    drag_pt(&mut h, (40.0, 100.0), (140.0, 60.0));
+    assert_eq!(h.state().views[0].comments.selected, None, "the first stroke isn't selected");
+    // The pointer still rests on the stroke: no author popup covers it.
+    h.hover_at(at(&h, 140.0, 60.0));
+    h.run_steps(3);
+    assert!(h.query_by_label_contains("Tester").is_none(), "no author popup while drawing");
+    drag_pt(&mut h, (60.0, 100.0), (160.0, 60.0));
+    let c = comments(&h);
+    let kinds: Vec<&str> = c.iter().map(|a| a.subtype.as_str()).collect();
+    assert_eq!(kinds, ["Ink", "Ink"], "{c:?}");
+    assert_eq!(h.state().views[0].comments.selected, None, "nothing is selected after drawing");
+    assert_eq!(h.state().quick_tool, QuickTool::Comment(pdfcraft_ui_egui::comments::CommentTool::Ink), "the pen stays on");
+    // Other drawn shapes are still selected when made.
+    h.state_mut().set_option("quick", "square").unwrap();
+    drag_pt(&mut h, (180.0, 100.0), (260.0, 40.0));
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 2)));
+}
+
 #[test]
 fn sticky_note_composer_posts_and_returns_to_select() {
     let mut h = harness(|app| app.set_option("quick", "note").unwrap());

From 653f8268c28c43ec5fb4b42fff60123547e6d438 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 10:50:59 -0400
Subject: [PATCH 071/149] =?UTF-8?q?Fix=20#273:=20=E2=86=93=20/=20=E2=86=91?=
 =?UTF-8?q?=20turn=20pages=20in=20single-page=20view=20(#550)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In single-page view ↓ / ↑ only added to the pending keyboard scroll, so on a
page that fits the window (or once scrolled to the page's end) they did
nothing, while the mouse wheel turned the page there.

The page view now records, after each frame in single-page view, which page
it drew and whether it was at the top and at the bottom of it. ↓ at the
bottom (always, on a page that fits) steps to the next page; ↑ at the top
steps to the previous page and lands on its bottom, so holding ↑ keeps
scrolling back through the document. The edges only count when they belong
to the current page with no jump pending, so a stale frame can't turn two
pages for one press.

Tested by a kittest: Fit page in single-page view, ↓ / ↑ turn one page per
press; Fit width, ↓ scrolls through page 1 before turning, and ↑ from the
top of page 2 returns to the bottom of page 1.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs   | 34 ++++++++++++++++++++++++++--
 crates/ui-egui/tests/viewer.rs | 41 ++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml   |  2 +-
 3 files changed, 74 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index da2a0373..346f1d0f 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -203,6 +203,9 @@ pub struct DocView {
     /// Pending keyboard scrolling, in points down (negative: up): ↓ / ↑, and Page Down /
     /// Page Up where the pages scroll.
     pub key_scroll: f32,
+    /// Single-page view, as last drawn: the page shown and whether the view was at its top and
+    /// at its bottom, so ↑ / ↓ turn the page there instead of doing nothing (#273).
+    single_edges: Option<(usize, bool, bool)>,
     /// Briefly outline an annotation after navigating to it from a panel.
     pub flash: Option<(usize, [f32; 4], f64)>,
     /// Compare files: differences shaded on this document's pages (page, user-space box, colour).
@@ -353,6 +356,7 @@ impl DocView {
             forward: Vec::new(),
             goto: None,
             key_scroll: 0.0,
+            single_edges: None,
             flash: None,
             compare_marks: Vec::new(),
             pages: HashMap::new(),
@@ -1166,12 +1170,31 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
     if key(Key::ArrowLeft) || (key(Key::PageUp) && (command || !scrolls)) {
         view.step_page(false);
     }
-    // ↓ / ↑ scroll a line, and Page Down / Page Up a screen where the pages scroll.
+    // ↓ / ↑ scroll a line, and Page Down / Page Up a screen where the pages scroll. In
+    // single-page view, ↓ / ↑ turn the page once there is nothing left to scroll that way, as
+    // the wheel does (#273): always on a page that fits.
     if !command {
         let screen = (view.viewport_h - KEY_SCROLL_LINE).max(KEY_SCROLL_LINE);
         let steps = [(Key::ArrowDown, KEY_SCROLL_LINE), (Key::ArrowUp, -KEY_SCROLL_LINE), (Key::PageDown, screen), (Key::PageUp, -screen)];
         for (k, by) in steps {
-            if key(k) && (scrolls || matches!(k, Key::ArrowDown | Key::ArrowUp)) {
+            let arrow = matches!(k, Key::ArrowDown | Key::ArrowUp);
+            if !key(k) || !(scrolls || arrow) {
+                continue;
+            }
+            let forward = k == Key::ArrowDown;
+            // Only an up-to-date view counts: the page drawn is the current one, with no jump pending.
+            let at_end = !scrolls
+                && view.goto.is_none()
+                && view.single_edges.is_some_and(|(page, top, bottom)| page == view.current && if forward { bottom } else { top });
+            if at_end {
+                let before = view.current;
+                view.step_page(forward);
+                if !forward && view.current != before {
+                    // Going back up lands on the bottom of the previous page.
+                    view.goto = Some((view.current, 1.0));
+                }
+                view.single_edges = None;
+            } else {
                 view.key_scroll += by;
             }
         }
@@ -1910,6 +1933,13 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         });
         (wanted, visible_now)
     });
+    view.single_edges = visible_pages.first().copied().filter(|_| view.layout == PageLayout::Single).map(|page| {
+        // At the top once the page's top edge shows where going to a page puts it (a gap
+        // below the window's top). Within a point, as for wheel paging, so layout rounding
+        // can't hide an edge.
+        let max_y = (out.content_size.y - out.inner_rect.height()).max(0.0);
+        (page, out.state.offset.y <= MARGIN - GAP + 1.0, out.state.offset.y >= max_y - 1.0)
+    });
 
     view.auto_scroll.paint(ui, avail);
 
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index 67dcecb2..ffbabc10 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -475,6 +475,47 @@ fn arrow_and_page_keys_move_through_a_scrolling_document() {
     assert_eq!(press(&mut h, Key::PageDown, 1), 3);
 }
 
+#[test]
+fn up_and_down_turn_pages_in_single_page_view() {
+    // #273: in single-page view ↓ / ↑ only scrolled, so on a page that fits (or once scrolled to
+    // the end) they did nothing, while the wheel turned the page there.
+    use egui::Key;
+    use pdfcraft_ui_egui::canvas::{Fit, PageLayout};
+    let mut h = harness();
+    h.state_mut().active = Some(0);
+    h.state_mut().views[0].layout = PageLayout::Single;
+    h.state_mut().views[0].fit = Fit::Page;
+    h.run_steps(4);
+    let press = |h: &mut Harness<'static, PdfCraftApp>, key, times: usize| {
+        for _ in 0..times {
+            h.key_press(key);
+            h.run_steps(2);
+        }
+        h.run_steps(2);
+        h.state().views[0].current
+    };
+    // A page that fits: each press turns one page.
+    assert_eq!(press(&mut h, Key::ArrowDown, 1), 1);
+    assert_eq!(press(&mut h, Key::ArrowDown, 1), 2);
+    assert_eq!(press(&mut h, Key::ArrowUp, 1), 1);
+    assert_eq!(press(&mut h, Key::ArrowUp, 1), 0);
+    assert_eq!(press(&mut h, Key::ArrowUp, 1), 0, "nothing before the first page");
+    // A page taller than the window scrolls first, then turns at its bottom.
+    h.state_mut().views[0].fit = Fit::Width;
+    h.run_steps(4);
+    let mut lines = 0;
+    while press(&mut h, Key::ArrowDown, 1) == 0 {
+        lines += 1;
+        assert!(lines < 500, "↓ never reached page 2");
+    }
+    assert!(lines > 2, "↓ scrolled through page 1 before turning ({lines} lines)");
+    // ↑ at the top of page 2 goes back to the bottom of page 1, then scrolls up it.
+    assert_eq!(press(&mut h, Key::ArrowUp, 1), 0);
+    assert_eq!(press(&mut h, Key::ArrowDown, 1), 1, "back at the bottom of page 1");
+    assert_eq!(press(&mut h, Key::ArrowUp, 2), 0);
+    assert_eq!(press(&mut h, Key::ArrowDown, 1), 0, "scrolled up from the bottom of page 1");
+}
+
 #[test]
 fn v_h_and_space_pick_the_quick_tools() {
     // The toolbar's tooltips promise "Select (V)" and "Hand (H)", but the keys did nothing.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index f223feea..04ea2600 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1119,7 +1119,7 @@ status = "shipped"
 commands = []
 tools = []
 evidence = ["crates/ui-egui/tests/control.rs::state_and_view_options", "crates/ui-egui/tests/ui.rs::theme_and_view_options_apply", "crates/ui-egui/tests/viewer.rs::two_page_view_steps_a_spread_at_a_time", "crates/ui-egui/tests/viewer.rs::arrow_and_page_keys_move_through_a_scrolling_document"]
-notes = "in two-page view, next and previous page move a whole spread (with or without a cover page); → / ← turn pages in every layout, ↓ / ↑ scroll a line and Page Down / Page Up a screen (the page in single-page view), as in Acrobat"
+notes = "in two-page view, next and previous page move a whole spread (with or without a cover page); → / ← turn pages in every layout, ↓ / ↑ scroll a line and Page Down / Page Up a screen (the page in single-page view), as in Acrobat; in single-page view ↓ / ↑ turn the page once there is nothing left to scroll that way, like the wheel"
 
 [[feature]]
 id = "view.goto-page-label"

From e5b37b8b9e010cd86a8f0c7a46d661e7cbaa4a46 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 11:48:03 -0400
Subject: [PATCH 072/149] Fix #454: dependencies keep only line tables in dev
 builds (#559)

On Windows every integration-test binary links the whole app and gets its
own 500-600 MB PDB, mostly debug info for third-party crates, so one
`cargo test --workspace` needs ~38 GB of target dir.

[profile.dev.package."*"] now sets debug = "line-tables-only". "*"
matches only non-workspace packages (crates.io dependencies and the
vendored crates under vendor/, which are excluded from the workspace), so
our own crates keep full debug info and dependency frames still show file
and line in backtraces.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.toml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Cargo.toml b/Cargo.toml
index 37f8fe30..c713ac86 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -75,8 +75,14 @@ unsafe_code = "forbid"
 dbg_macro = "warn"
 todo = "warn"
 
+# `"*"` matches every non-workspace package: crates.io dependencies and the
+# vendored crates under `vendor/` (excluded from the workspace). Our own crates
+# keep full debug info. Dependencies keep only line tables, so backtraces still
+# show file and line, but debug info for the whole dependency graph stays out of
+# every test binary (each UI test binary had a 500-600 MB PDB on Windows, #454).
 [profile.dev.package."*"]
 opt-level = 2
+debug = "line-tables-only"
 
 [profile.dev]
 opt-level = 1

From 9acb29e4183ab66f9aa120a7c3ce78efbc8effd5 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 11:48:50 -0400
Subject: [PATCH 073/149] Fix #527: Shift+click extends the text selection
 (#560)

A plain click on a page cleared the text selection whatever modifiers were
held, so there was no way to extend a selection with Shift+click as in
Acrobat. Now, when Shift is held and there is a text selection on the
clicked page, the click moves the selection head to the nearest text
position and keeps the anchor. Without Shift, or with no selection on that
page, a click still clears the selection. Selections remain single-page:
cross-page selection (the issue's second request) is not part of this
change.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs        |  9 ++++-
 crates/ui-egui/tests/text_select.rs | 54 +++++++++++++++++++++++++++++
 parity/acrobat-features.toml        |  4 +--
 3 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 346f1d0f..a9b8faf4 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1758,7 +1758,14 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             view.selection = Some(Selection { page: i, anchor: first, head: last });
                         }
                     } else if resp.clicked() && !over_link {
-                        view.selection = None;
+                        // ⇧-click extends a selection on this page to the click, keeping its
+                        // anchor (#527). Otherwise (no shift, or no selection on this page; a
+                        // selection cannot yet span pages) a click clears the selection.
+                        let shift = ui.input(|inp| inp.modifiers.shift);
+                        match (view.selection.as_mut().filter(|s| shift && s.page == i), text.nearest(vx, vy)) {
+                            (Some(sel), Some(h)) => sel.head = h,
+                            _ => view.selection = None,
+                        }
                     }
                 }
             }
diff --git a/crates/ui-egui/tests/text_select.rs b/crates/ui-egui/tests/text_select.rs
index 683f391c..342668b5 100644
--- a/crates/ui-egui/tests/text_select.rs
+++ b/crates/ui-egui/tests/text_select.rs
@@ -85,3 +85,57 @@ fn quick_clicks_with_the_highlighter_mark_only_the_word() {
     assert_eq!(marks, [("Highlight", 1)], "one highlight, on the double-clicked word");
     assert!(app.views[0].selected_text().is_none());
 }
+
+/// Press at `from`, move to `to` and release there.
+fn drag(h: &mut Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2) {
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from + (to - from) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+}
+
+/// Click at `pos` with Shift held.
+fn shift_click(h: &mut Harness<'static, PdfCraftApp>, pos: Pos2) {
+    h.event(Event::ModifiersChanged(Modifiers::SHIFT));
+    h.hover_at(pos);
+    h.run_steps(1);
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::SHIFT });
+    }
+    h.run_steps(1);
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(1);
+}
+
+/// Issue #527: ⇧-click extends the text selection to the click, keeping its anchor.
+#[test]
+fn shift_click_extends_the_selection_from_its_anchor() {
+    let (mut h, _) = harness(|_| {});
+    let glyph = |h: &Harness<'static, PdfCraftApp>, g: usize| h.state().views[0].glyph_screen_pos(0, g).expect("glyph on screen");
+    // Drag over "quick" (glyphs 4..=8).
+    let (q, k) = (glyph(&h, 4), glyph(&h, 8));
+    drag(&mut h, q, k);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("quick"));
+    h.run_steps(60);
+    // ⇧-click on the "n" of "brown": the selection runs from the anchor to it.
+    let n = glyph(&h, 14);
+    shift_click(&mut h, n);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("quick brown"));
+    h.run_steps(60);
+    // ⇧-click before the anchor: the anchor stays, the selection now runs back to the click.
+    let t = glyph(&h, 0);
+    shift_click(&mut h, t);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("The q"));
+    h.run_steps(60);
+    // A plain click still clears it.
+    click(&mut h, n);
+    assert_eq!(h.state().views[0].selected_text(), None);
+    h.run_steps(60);
+    // ⇧-click with nothing selected selects nothing.
+    shift_click(&mut h, n);
+    assert_eq!(h.state().views[0].selected_text(), None);
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 04ea2600..d711938d 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1478,8 +1478,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui.rs::selection_works_in_every_view_rotation", "crates/ui-egui/tests/text_select.rs::quick_clicks_select_a_word_then_the_line_then_the_page", "crates/ui-egui/tests/text_select.rs::quick_clicks_with_the_highlighter_mark_only_the_word"]
-notes = "Drag to select; with the Select tool, quick clicks select a word (two), the line (three) or all the text on the page (four). The markup and Redact tools mark a double-clicked word and stop there. Missing: paragraph selection, and ⌘A across the whole document (it selects the current page)."
+evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui.rs::selection_works_in_every_view_rotation", "crates/ui-egui/tests/text_select.rs::quick_clicks_select_a_word_then_the_line_then_the_page", "crates/ui-egui/tests/text_select.rs::quick_clicks_with_the_highlighter_mark_only_the_word", "crates/ui-egui/tests/text_select.rs::shift_click_extends_the_selection_from_its_anchor"]
+notes = "Drag to select; ⇧-click extends the selection to the click, keeping its anchor (same page only); with the Select tool, quick clicks select a word (two), the line (three) or all the text on the page (four). The markup and Redact tools mark a double-clicked word and stop there. Missing: selection across pages (dragging or ⇧-clicking onto another page), paragraph selection, and ⌘A across the whole document (it selects the current page)."
 
 [[feature]]
 id = "view.copy-text"

From 28804d55d76b0adff4427c4b3466fbde1c837fdc Mon Sep 17 00:00:00 2001
From: pauliusiv123-rgb <235694617+pauliusiv123-rgb@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:53:34 +0300
Subject: [PATCH 074/149] Issue #430: clear the recent-files list, or remove
 one file from it (#557)

---
 ATTRIBUTION.toml                    | 22 +++++++--------
 crates/engine/src/commands.rs       |  2 ++
 crates/ui-egui/src/commands.rs      | 15 +++++++++-
 crates/ui-egui/src/home.rs          | 38 +++++++++++++++++++++++--
 crates/ui-egui/src/i18n/bg.tsv      |  3 ++
 crates/ui-egui/src/i18n/cs.tsv      |  4 +++
 crates/ui-egui/src/i18n/de.tsv      |  3 ++
 crates/ui-egui/src/i18n/es.tsv      |  3 ++
 crates/ui-egui/src/i18n/fr.tsv      |  3 ++
 crates/ui-egui/src/i18n/ja.tsv      |  3 ++
 crates/ui-egui/src/i18n/pt-br.tsv   |  4 +++
 crates/ui-egui/src/i18n/ru.tsv      |  3 ++
 crates/ui-egui/src/i18n/te.tsv      |  3 ++
 crates/ui-egui/src/i18n/zh-hans.tsv |  3 ++
 crates/ui-egui/src/i18n/zh-hant.tsv |  3 ++
 crates/ui-egui/tests/commands.rs    | 43 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/ui.rs          | 25 +++++++++++++++++
 parity/acrobat-features.toml        |  6 ++--
 18 files changed, 168 insertions(+), 18 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 5261bc97..6fcd39e5 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8444a3bd135d61feb6c5b559a9eb0babb50de2ebbd1d86b1e87ccb064e2d3f0b"
+sha256 = "6bed3ae5e307b0a225c49bb6a4c688911869f4bbf5df527a3bf84d0997e6baaf"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8771d80405b8fba9da4a909fdd97b760f6b25a822807ca83ff20dc5cec83a73c"
+sha256 = "42c3498eac138f95ac700f71332742658ed59bec171460aa675b1cb67e97ca36"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "bf1ab8079af725264f9c4298b9737359ba831170dcba76a6bd39228239c87e83"
+sha256 = "fb315c0c3dfbafd35d73e7dedd1260daa1da919b0b30db53d16725cbd0f0ae12"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b23b03cf4ac163e7a63e49a0900a125507c05ad4fc7930468b859acf32b09ecd"
+sha256 = "20043dd4e64d6a8405dbf3167e9f315f68d4894c3d76c0b2b68e9c7e2879c06f"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1b3371f239ca89a658e2c9b80cc070be5cd941dd1ecd3e7a247696716f25721d"
+sha256 = "4c576bf5573a127ba2565980623e92b104699e7e03ac68dc3eddf4e788c7e8a4"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "dbf725ffc9177a435e894f4405834e87c70b6fe31a34f1be533c60c356510b97"
+sha256 = "66ea8fd85159745626643bfce304dbe7ae0f9ae45a006a5d3834c3cad181080b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3827d04146f65a02e9d5e69336a97efc46862a48b18a16acbbc023ee0c8b7e1b"
+sha256 = "4ba9f2bfc1cca7e819dde79d09c3b128b19a289faf7caa32f6925791683e9538"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f7a5ab0bcbdb8641b1bd4ae25db54ef187757dde3e4fe372e433a9e5c0fc4f3a"
+sha256 = "2c399d16589f2d0c3659c87406cb45d27792e7286774ededaa6578a224e2fae9"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "259f795a3cdc032aa670693d2ebff010c5dd3bcf57dda11548d5bd46e78969b8"
+sha256 = "1782bfb95566a44e9cc3e22a595ff158965c55b67936d994a8dae9b3e51975a2"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e71f683e410618200c0abe66a362a720cb8ded5bfd155bf825f92644373c54b5"
+sha256 = "eb0b3fa525198152d7cf514284460ff904bcb9af091142ddd1c09deb8461ed69"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cdcdba828efea9d402cb9ce8be2b52ab1d58c8f7837d75d3b9c86f2a05e7fb2e"
+sha256 = "2bfcb94d72df43a6146e45e971950433a13bb008fc18c68463c096089f715466"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index eb53cfd2..35576137 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -150,6 +150,8 @@ const HELP: Option<&str> = Some("Help");
 pub const COMMANDS: &[CommandSpec] = &[
     c("file.open", "Open…", FILE, Some(Shortcut::cmd("O")), Nothing, "folder-open"),
     c("file.open_recent", "Open Recent", FILE, None, Nothing, "clock"),
+    // Shown at the foot of File ▸ Open Recent and on Home, not as its own File menu item.
+    c("file.clear_recent", "Clear Recent Files", None, None, Nothing, "trash-2"),
     c("file.pin_folder", "Pin folder to Home…", FILE, None, Nothing, "folder-plus"),
     c("create.blank", "New blank PDF", FILE, None, Nothing, "file-plus-2"),
     c("measure.distance", "Measure distance", None, None, Annotate, "ruler"),
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 126b7f31..4cf9d338 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -85,6 +85,8 @@ impl PdfCraftApp {
                 Some(p) => self.open_recent(&p),
                 None => self.notify_tr("No recent files"),
             },
+            "file.clear_recent" if self.recent.is_empty() => self.notify_tr("No recent files"),
+            "file.clear_recent" => self.recent.clear(),
             "file.pin_folder" => self.pin_folder_dialog(),
             "page.combine" => self.open_combine_tab(),
             "file.save" => {
@@ -570,13 +572,15 @@ pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str
         let label = commands::current_label(spec, &app.session, app.active_ids().map(|(_, id)| id));
         let label = crate::i18n::menu_label(spec.id, &label);
         // Open Recent is a submenu of the live recent list, not one action: disabled while the
-        // list is empty, otherwise each entry opens its file (or focuses the tab showing it).
+        // list is empty, otherwise each entry opens its file (or focuses the tab showing it), and
+        // Clear Recent Files at the foot empties the list (#430).
         if spec.id == "file.open_recent" {
             if app.recent.is_empty() {
                 ui.add_enabled(false, egui::Button::new(label));
                 continue;
             }
             let mut open: Option<String> = None;
+            let mut clear = false;
             ui.menu_button(label, |ui| {
                 for r in &app.recent {
                     if ui.button(&r.name).on_hover_text(&r.path).clicked() {
@@ -584,11 +588,20 @@ pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str
                         ui.close();
                     }
                 }
+                ui.separator();
+                if ui.button(tl!("Clear Recent Files")).clicked() {
+                    clear = true;
+                    ui.close();
+                }
             });
             if let Some(p) = open {
                 app.open_recent(&p);
                 ui.close();
             }
+            if clear {
+                app.execute("file.clear_recent");
+                ui.close();
+            }
             continue;
         }
         let shortcut = spec.shortcut.map(|s| s.label(mac)).unwrap_or_default();
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 35f4efb6..048aacdd 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -104,17 +104,42 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             }
 
             ui.add_space(26.0);
-            ui.label(egui::RichText::new(tl!("Recent")).font(theme::semibold(17.0)));
+            let mut clear = false;
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!("Recent")).font(theme::semibold(17.0)));
+                if !app.recent.is_empty() {
+                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                        let resp = widgets::ghost_button(ui, "trash-2", tl!("Clear"));
+                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Clear Recent Files")));
+                        clear = resp.on_hover_text(tl!("Clear Recent Files")).clicked();
+                    });
+                }
+            });
             ui.add_space(8.0);
             if app.recent.is_empty() {
                 ui.label(egui::RichText::new(tl!("Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.")).color(t.text_muted));
             }
             let mut open = None;
+            let mut remove = None;
             for r in &app.recent {
                 let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 46.0), Sense::click());
                 resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &r.name));
-                if resp.hovered() {
+                // The row, not its response: the pointer stays "in" the row over its remove button.
+                let hovered = ui.rect_contains_pointer(rect);
+                if hovered {
                     ui.painter().rect_filled(rect, CornerRadius::same(8), t.hover);
+                    // Remove just this file from the list (#430); the file itself is untouched.
+                    let x_rect = Rect::from_center_size(rect.right_center() - vec2(26.0, 0.0), vec2(28.0, 28.0));
+                    let x = ui.interact(x_rect, ui.id().with(("remove-recent", &r.path)), Sense::click());
+                    let label = crate::i18n::fmt(tl!("Remove {name} from Recent"), &[("name", &r.name)]);
+                    x.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &label));
+                    if x.hovered() {
+                        ui.painter().rect_filled(x_rect, CornerRadius::same(6), t.pressed);
+                    }
+                    icons::paint(ui, x_rect.shrink(6.0), "x", 16.0, t.icon);
+                    if x.on_hover_text(tl!("Remove from Recent")).clicked() {
+                        remove = Some(r.path.clone());
+                    }
                 }
                 icons::paint(
                     ui,
@@ -123,8 +148,9 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     22.0,
                     egui::Color32::from_rgb(0xE0, 0x3E, 0x3E),
                 );
+                // Room on the right for the remove button.
                 let detail = ui.painter().text(
-                    rect.right_center() - vec2(12.0, 0.0),
+                    rect.right_center() - vec2(48.0, 0.0),
                     Align2::RIGHT_CENTER,
                     format!("{} {}  ·  {}", r.pages, tl!("pages"), human_size(r.size)),
                     theme::regular(12.0),
@@ -141,6 +167,12 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             if let Some(p) = open {
                 app.open_recent(&p);
             }
+            if let Some(p) = remove {
+                app.recent.retain(|r| r.path != p);
+            }
+            if clear {
+                app.execute("file.clear_recent");
+            }
             ui.add_space(20.0);
             widgets::section_title(ui, tl!("Privacy"));
             ui.label(
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index d260b886..ec604567 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2043,3 +2043,6 @@ signature pad	Type	Въвеждане
 action wizard	Start	Старт
 	Margins (in)	Полета (in)
 	Reopen the files that were open when PdfCraft last closed	Отваряй отново файловете, които бяха отворени при последното затваряне на PdfCraft
+	Clear Recent Files	Изчисти последно отваряните файлове
+	Remove from Recent	Премахни от последно отваряните
+	Remove {name} from Recent	Премахни {name} от последно отваряните
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index af17a38f..d9a78a03 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -29,6 +29,10 @@
 	OK	OK
 	Open…	Otevřít…
 	Open Recent	Otevřít nedávné soubory
+	Clear Recent Files	Vymazat nedávné soubory
+	Remove from Recent	Odebrat z nedávných souborů
+	Remove {name} from Recent	Odebrat {name} z nedávných souborů
+	Clear	Vymazat
 	Pin folder to Home…	Připnout složku na úvodní stránku…
 	No recent files	Žádné nedávné soubory
 	New blank PDF	Nový prázdný dokument PDF
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index a8497fc9..cd242d2c 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2045,3 +2045,6 @@ comment menu	Edit	Bearbeiten
 signature pad	Type	Tippen
 action wizard	Start	Starten
 	Reopen the files that were open when PdfCraft last closed	Beim Start die Dateien wieder öffnen, die beim letzten Beenden von PdfCraft geöffnet waren
+	Clear Recent Files	Liste „Zuletzt geöffnet“ leeren
+	Remove from Recent	Aus „Zuletzt geöffnet“ entfernen
+	Remove {name} from Recent	{name} aus „Zuletzt geöffnet“ entfernen
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index c1e3d2fd..80a87c11 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -22,6 +22,9 @@
 	Name on new comments	Nombre en los comentarios nuevos
 	Open…	Abrir…
 	Open Recent	Abrir recientes
+	Clear Recent Files	Borrar archivos recientes
+	Remove from Recent	Quitar de recientes
+	Remove {name} from Recent	Quitar {name} de recientes
 	Pin folder to Home…	Anclar carpeta en Inicio…
 	Folders	Carpetas
 	Pin a folder…	Anclar una carpeta…
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 1d27e04f..771ba74b 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2014,6 +2014,9 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Choisissez une image PNG ou JPEG (jusqu’à 4 Mio). La transparence est conservée.
 	Couldn't import the signature image: {e}	Impossible d’importer l’image de la signature : {e}
 	Open Recent	Ouvrir un fichier récent
+	Clear Recent Files	Effacer les fichiers récents
+	Remove from Recent	Retirer des fichiers récents
+	Remove {name} from Recent	Retirer {name} des fichiers récents
 	Pin folder to Home…	Épingler un dossier à l'Accueil…
 	Folders	Dossiers
 	Pin a folder…	Épingler un dossier…
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index bd36ccd7..fc737888 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -28,6 +28,9 @@
 	Name on new comments	新しい注釈の作成者名
 	Open…	開く…
 	Open Recent	最近のファイルを開く
+	Clear Recent Files	最近のファイルをクリア
+	Remove from Recent	最近のファイルから外す
+	Remove {name} from Recent	{name} を最近のファイルから外す
 	Pin folder to Home…	フォルダーをホームにピン留め…
 	Folders	フォルダー
 	Pin a folder…	フォルダーをピン留め…
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 8e38337d..2bd64c7d 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -21,6 +21,10 @@
 	Name on new comments	Nome nos novos comentários
 	Open…	Abrir…
 	Open Recent	Abrir recentes
+	Clear Recent Files	Limpar arquivos recentes
+	Remove from Recent	Remover dos recentes
+	Remove {name} from Recent	Remover {name} dos recentes
+	Clear	Limpar
 	Pin folder to Home…	Fixar pasta no Início…
 	No recent files	Nenhum arquivo recente
 	New blank PDF	Novo PDF em branco
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 167525de..10ce91df 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -21,6 +21,9 @@
 	Name on new comments	Имя в новых комментариях
 	Open…	Открыть…
 	Open Recent	Открыть недавние
+	Clear Recent Files	Очистить недавние файлы
+	Remove from Recent	Убрать из недавних
+	Remove {name} from Recent	Убрать {name} из недавних
 	Pin folder to Home…	Закрепить папку на главной…
 	Folders	Папки
 	Pin a folder…	Закрепить папку…
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 81f47b47..79c09709 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2017,6 +2017,9 @@ action wizard	Start	ప్రారంభించు
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG లేదా JPEG చిత్రాన్ని ఎంచుకోండి (గరిష్ఠంగా 4 MiB). పారదర్శకత అలాగే ఉంటుంది.
 	Couldn't import the signature image: {e}	సంతకం చిత్రాన్ని దిగుమతి చేయడం సాధ్యం కాలేదు: {e}
 	Open Recent	ఇటీవలివి తెరువు
+	Clear Recent Files	ఇటీవలి ఫైళ్లను క్లియర్ చేయి
+	Remove from Recent	ఇటీవలి ఫైళ్ల నుండి తీసివేయి
+	Remove {name} from Recent	{name}ను ఇటీవలి ఫైళ్ల నుండి తీసివేయి
 	Pin folder to Home…	ఫోల్డర్‌ను హోమ్‌కు పిన్ చేయి…
 	No recent files	ఇటీవలి ఫైళ్లు లేవు
 	Go to page…	పేజీకి వెళ్లు…
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 5b66f382..6b0650f7 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -62,6 +62,9 @@
 	Name on new comments	新注释的作者姓名
 	Open…	打开…
 	Open Recent	打开最近的文件
+	Clear Recent Files	清除最近的文件
+	Remove from Recent	从最近的文件中移除
+	Remove {name} from Recent	从最近的文件中移除{name}
 	Pin folder to Home…	将文件夹固定到主页…
 	Folders	文件夹
 	Pin a folder…	固定文件夹…
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 9a9e1e85..98f4893f 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -21,6 +21,9 @@
 	Name on new comments	新註解的作者名稱
 	Open…	開啟…
 	Open Recent	開啟最近的檔案
+	Clear Recent Files	清除最近的檔案
+	Remove from Recent	從最近的檔案中移除
+	Remove {name} from Recent	從最近的檔案中移除{name}
 	Pin folder to Home…	將資料夾釘選到首頁…
 	Folders	資料夾
 	Pin a folder…	釘選資料夾…
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index 27ac8304..7119821e 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -243,6 +243,49 @@ fn the_open_recent_menu_is_disabled_while_the_list_is_empty() {
     );
 }
 
+fn recent_file(name: &str) -> pdfcraft_ui_egui::RecentFile {
+    pdfcraft_ui_egui::RecentFile { name: name.into(), path: format!("/nowhere/{name}"), pages: 1, size: 0 }
+}
+
+#[test]
+fn clear_recent_files_at_the_foot_of_open_recent_empties_the_list() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
+        app.recent.extend([recent_file("first.pdf"), recent_file("second.pdf")]);
+        app
+    });
+    h.run_steps(4);
+    h.get_by_label("Menu").click();
+    h.run_steps(2);
+    h.get_by_label("File ⏵").hover();
+    h.run_steps(3);
+    h.get_by_label("Open Recent ⏵").hover();
+    h.run_steps(3);
+    h.get_by_label("Clear Recent Files").click();
+    h.run_steps(3);
+    assert!(h.state().recent.is_empty(), "the list is empty");
+    h.get_by_label("Menu").click();
+    h.run_steps(2);
+    h.get_by_label("File ⏵").hover();
+    h.run_steps(3);
+    assert!(h.query_by(|n| n.label().as_deref() == Some("Open Recent") && n.is_disabled()).is_some(), "and Open Recent is disabled");
+}
+
+#[test]
+fn clear_recent_files_runs_from_the_palette_and_is_saved() {
+    let mut app = PdfCraftApp::new();
+    app.recent.extend([recent_file("first.pdf"), recent_file("second.pdf")]);
+    assert!(app.execute("file.clear_recent"));
+    assert!(app.recent.is_empty());
+    let mut restarted = PdfCraftApp::new();
+    restarted.recent.push(recent_file("stale.pdf"));
+    restarted.restore(&app.persist());
+    assert!(restarted.recent.is_empty(), "the empty list is what's saved");
+    app.execute("file.clear_recent");
+    assert!(app.toast.as_ref().is_some_and(|(m, _)| m.contains("No recent files")), "nothing to clear is said, not silent");
+}
+
 #[test]
 fn the_shortcuts_dialog_lists_the_real_bindings() {
     let mut h = harness();
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 819adaea..970c5173 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -67,6 +67,31 @@ fn long_recent_names_and_paths_are_cut_before_the_page_count() {
     }
 }
 
+#[test]
+fn home_removes_one_recent_file_or_clears_them_all() {
+    // Tall enough that the Recent list is on screen without scrolling.
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1600.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        for name in ["first.pdf", "second.pdf", "third.pdf"] {
+            app.recent.push(pdfcraft_ui_egui::RecentFile { name: name.into(), path: format!("/nowhere/{name}"), pages: 1, size: 0 });
+        }
+        app
+    });
+    h.run_steps(4);
+    assert!(h.query_by_label("Remove second.pdf from Recent").is_none(), "the remove button shows only over its row");
+    h.get_by_label("second.pdf").hover();
+    h.run_steps(2);
+    h.get_by_label("Remove second.pdf from Recent").click();
+    h.run_steps(2);
+    let names: Vec<String> = h.state().recent.iter().map(|r| r.name.clone()).collect();
+    assert_eq!(names, ["first.pdf", "third.pdf"], "only that file left the list");
+    h.get_by_label("Clear Recent Files").click();
+    h.run_steps(2);
+    assert!(h.state().recent.is_empty(), "Clear empties the list");
+    h.get_by_label_contains("Files you open in PdfCraft appear here");
+    assert!(h.query_by_label("Clear Recent Files").is_none(), "and goes away with nothing left to clear");
+}
+
 #[test]
 fn every_catalog_tool_is_listed_after_view_more() {
     let mut h = harness(|_| {});
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index d711938d..1108c789 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -656,10 +656,10 @@ area = "A"
 tier = "P1"
 milestone = "M3"
 status = "shipped"
-commands = ["file.open_recent"]
+commands = ["file.open_recent", "file.clear_recent"]
 tools = []
-evidence = ["crates/ui-egui/tests/ui.rs::persistence_round_trips_and_tolerates_garbage", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_lists_files_and_opens_one", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_is_disabled_while_the_list_is_empty"]
-notes = "never reads other apps' lists; File ▸ Open Recent lists them (#290), an already-open file focuses its tab instead of reopening it"
+evidence = ["crates/ui-egui/tests/ui.rs::persistence_round_trips_and_tolerates_garbage", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_lists_files_and_opens_one", "crates/ui-egui/tests/commands.rs::the_open_recent_menu_is_disabled_while_the_list_is_empty", "crates/ui-egui/tests/commands.rs::clear_recent_files_at_the_foot_of_open_recent_empties_the_list", "crates/ui-egui/tests/commands.rs::clear_recent_files_runs_from_the_palette_and_is_saved", "crates/ui-egui/tests/ui.rs::home_removes_one_recent_file_or_clears_them_all"]
+notes = "never reads other apps' lists; File ▸ Open Recent lists them (#290), an already-open file focuses its tab instead of reopening it; Clear Recent Files at the foot of Open Recent, on Home and in the palette, and a remove button on each Home row (#430); missing: the row's remove button shows on pointer hover only (keyboard users clear the whole list)"
 
 [[feature]]
 id = "core.reopen-last-session"

From 5ddf33ccf5759bfebeef204337338fe7302d9564 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 11:54:07 -0400
Subject: [PATCH 075/149] Fix #299: typed and drawn signatures stay upright on
 rotated pages (#562)

On a page with /Rotate 90, 180 or 270, Fill & Sign placed typed and drawn
signatures and initials sideways or upside down: their box and their
strokes/outlines were laid out along user-space axes, which the page turns,
while the click (or fill_sign_add's "at") is a displayed point. Only image
signatures were counter-rotated (#485).

Both now use the same displayed axes as image signatures
(pdfcraft_model::view_matrix_for without its offset): the box's left edge and
vertical centre are at the displayed point, a drawn signature's ink points are
mapped through the displayed right/up vectors, and a typed signature's
normalised outlines are turned back inside a user-space box laid out along the
turned page (the shared signature_image::upright_box, now also used by
SignatureImage::rect). The appearance is plain geometry, so every viewer shows
it upright without relying on a form /Matrix. Unturned pages are unchanged
(the mapping is the identity there).

typed_signature_shape and fill_sign::{signature_at, typed_signature_at} take
the page rotation; fill_sign::place and fill_sign_add pass it.

Tests: a kittest-file test places a drawn, typed signature and typed initials
on /Rotate 0/90/180/270 pages through fill_sign::place, renders them and checks
each displayed ink box is wider than tall, anchored at the point, identical to
the unturned page, and that an asymmetric drawn stroke is not mirrored; an
automation test does the same for fill_sign_add typed signatures and initials,
before and after save/reopen.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/comments.rs     |  6 +-
 crates/automation/tests/automation.rs | 56 +++++++++++++++++++
 crates/engine/src/lib.rs              | 16 ++++--
 crates/engine/src/signature_image.rs  | 30 ++++++----
 crates/ui-egui/src/fill_sign.rs       | 30 +++++++---
 crates/ui-egui/tests/fill_sign.rs     | 80 +++++++++++++++++++++++++++
 parity/acrobat-features.toml          |  4 +-
 7 files changed, 194 insertions(+), 28 deletions(-)

diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index 094bf498..4483f0ca 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -406,12 +406,12 @@ impl Automation {
                 let t = format!("{m}/{d}/{yy}");
                 (text_at(&t), t)
             }
-            // A typed signature or initials in the script font, left edge at `at`.
+            // A typed signature or initials in the script font, left edge at `at`, upright as displayed.
             kind @ ("signature" | "initials") => {
                 let t = a.str("text")?;
                 let h = if kind == "initials" { 24.0 } else { 32.0 };
-                let shape =
-                    pdfcraft_engine::typed_signature_shape(at, t, h).ok_or_else(|| ToolError::InvalidArgs("text has nothing to draw".into()))?;
+                let shape = pdfcraft_engine::typed_signature_shape(at, t, h, i64::from(info.rotation))
+                    .ok_or_else(|| ToolError::InvalidArgs("text has nothing to draw".into()))?;
                 (shape, String::new())
             }
             kind => {
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index b935a6f5..ead2321c 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -2132,6 +2132,62 @@ fn image_signatures_stay_upright_on_rotated_pages() {
     check(&mut a, reopened);
 }
 
+/// Issue #299: a typed signature and initials read across, as displayed, on every `/Rotate`,
+/// anchored at the displayed point, and look the same as on an unturned page.
+#[test]
+fn typed_signatures_stay_upright_on_rotated_pages() {
+    let dir = workdir("typed-upright");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_create", json!({ "from": "blank", "width": 200, "height": 300, "pages": 4 }))["doc"].as_u64().unwrap();
+    for (page, degrees) in [(2, 90), (3, 180), (4, 270)] {
+        ok(&mut a, "page_rotate", json!({ "doc": doc, "pages": [page], "degrees": degrees }));
+    }
+    for page in 1..=4 {
+        ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": page, "type": "signature", "at": [30, 60], "text": "Ada Lovelace" }));
+        ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": page, "type": "initials", "at": [30, 140], "text": "AL" }));
+    }
+    let check = |a: &mut Automation, doc: u64| {
+        let mut upright = Vec::new();
+        for page in 1..=4 {
+            let output = a.call("page_render", &json!({ "doc": doc, "page": page, "dpi": 72 })).unwrap();
+            let Content::Png { data, .. } = &output[0] else { panic!() };
+            let pixels = image::load_from_memory(data).unwrap().to_rgba8();
+            assert_eq!(pixels.dimensions(), if page % 2 == 1 { (200, 300) } else { (300, 200) }, "page {page}");
+            let dark: Vec<bool> = pixels.pixels().map(|p| p.0[..3].iter().all(|v| *v < 128)).collect();
+            for y in [60, 140] {
+                let mut b = [u32::MAX, u32::MAX, 0, 0];
+                for (x, py, p) in pixels.enumerate_pixels() {
+                    if py.abs_diff(y) < 40 && p.0[..3].iter().all(|v| *v < 128) {
+                        b = [b[0].min(x), b[1].min(py), b[2].max(x), b[3].max(py)];
+                    }
+                }
+                assert!(b[0] <= b[2], "page {page}: no ink near y = {y}");
+                assert!(b[2] - b[0] > b[3] - b[1], "page {page}: the name reads across: {b:?}");
+                assert!(b[0].abs_diff(30) <= 2 && b[1] < y && b[3] > y, "page {page}: anchored at (30, {y}): {b:?}");
+            }
+            if page == 1 {
+                upright = dark;
+                continue;
+            }
+            // Same pixels as the unturned page where both pages are (pages 2 and 4 are wider).
+            let width = pixels.width();
+            let (mut differ, mut ink) = (0, 0);
+            for y in 0..200 {
+                for x in 0..200 {
+                    let (want, got) = (upright[(y * 200 + x) as usize], dark[(y * width + x) as usize]);
+                    ink += usize::from(want);
+                    differ += usize::from(want != got);
+                }
+            }
+            assert!(differ * 10 < ink, "page {page}: {differ} of {ink} ink pixels differ from the unturned page");
+        }
+    };
+    check(&mut a, doc);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "placed.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "placed.pdf" }))["doc"].as_u64().unwrap();
+    check(&mut a, reopened);
+}
+
 #[test]
 fn comment_checkmarks_locks_hiding_and_summaries_through_tools() {
     let dir = workdir("comment-polish");
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index fb68ea93..1b17908d 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -69,17 +69,25 @@ pub use pdfcraft_fonts::{MAX_SIGNATURE_CHARS, ScriptOutline, script_outline};
 
 /// Fill & Sign: `text` in the script font as a typed signature, its left edge at `at` (user
 /// space, vertically centred) and `height` points tall. `None` for text with no outlines.
-pub fn typed_signature_shape(at: [f64; 2], text: &str, height: f64) -> Option<Shape> {
+///
+/// Left, centred and upright are as displayed on a page turned by `rotation` (its `/Rotate`):
+/// the box runs along the displayed axes, like an image signature's
+/// ([`SignatureImage::rect`]), and the outlines are turned back so the name reads across.
+pub fn typed_signature_shape(at: [f64; 2], text: &str, height: f64, rotation: i64) -> Option<Shape> {
     let o = script_outline(text);
     let [left, bottom, right, top] = o.bounds();
     let span = (top - bottom).max(0.1);
     let width = right - left;
-    if o.contours.is_empty() || o.width <= 0.0 {
+    if o.contours.is_empty() || o.width <= 0.0 || !(width > 0.0 && height > 0.0) {
         return None;
     }
     let k = height / span;
-    let rect = [at[0], at[1] - height / 2.0, at[0] + width * k, at[1] + height / 2.0];
-    let contours = o.contours.iter().map(|c| c.iter().map(|p| [(p[0] - left) / width, (p[1] - bottom) / span]).collect()).collect();
+    let rect = signature_image::upright_box(rotation, at, width * k, height)?;
+    // Displayed right and up as user-space unit vectors: a point at (nx, ny) of the displayed box
+    // is at this fraction of the user-space box. Exact for an unturned page.
+    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
+    let to_user = |nx: f64, ny: f64| [a * nx + c * ny + (-a).max(0.0) + (-c).max(0.0), b * nx + d * ny + (-b).max(0.0) + (-d).max(0.0)];
+    let contours = o.contours.iter().map(|c| c.iter().map(|p| to_user((p[0] - left) / width, (p[1] - bottom) / span)).collect()).collect();
     Some(Shape::TypedSignature { rect, contours })
 }
 /// Comment geometry helpers (text-box line breaking) for frontends.
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index fc4c53ea..d1e3ad5b 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -68,6 +68,25 @@ impl Document {
     }
 }
 
+/// The user-space box `width` x `height` points as displayed on a page turned by `rotation` (its
+/// `/Rotate`), with its left edge at `at` (a user-space point) and vertically centred on it. On a
+/// quarter-turned page it is `height` wide and `width` tall in user space. `None` for a non-finite
+/// point.
+pub fn upright_box(rotation: i64, at: [f64; 2], width: f64, height: f64) -> Option<[f64; 4]> {
+    if !at.iter().chain(&[width, height]).all(|v| v.is_finite()) {
+        return None;
+    }
+    // Right and up as displayed, as user-space vectors: the page's view matrix without its offset.
+    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
+    let (right, up) = ([a * width, b * width], [c * height / 2.0, d * height / 2.0]);
+    Some([
+        at[0] + right[0].min(0.0) - up[0].abs(),
+        at[1] + right[1].min(0.0) - up[1].abs(),
+        at[0] + right[0].max(0.0) + up[0].abs(),
+        at[1] + right[1].max(0.0) + up[1].abs(),
+    ])
+}
+
 /// Saved signatures live in settings, so both source and normalized PNG are bounded.
 pub const MAX_SIGNATURE_IMAGE_BYTES: usize = 4 << 20;
 const MAX_PIXELS: u64 = 4 << 20;
@@ -154,16 +173,7 @@ impl SignatureImage {
         }
         let [w, h] = self.size;
         let scale = (150.0 / w as f64).min(if initials { 24.0 } else { 32.0 } / h as f64);
-        let (width, height) = (w as f64 * scale, h as f64 * scale);
-        // Right and up as displayed, as user-space vectors: the page's view matrix without its offset.
-        let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(i64::from(page.rotation), [0.0; 4]);
-        let (right, up) = ([a * width, b * width], [c * height / 2.0, d * height / 2.0]);
-        Some([
-            at[0] + right[0].min(0.0) - up[0].abs(),
-            at[1] + right[1].min(0.0) - up[1].abs(),
-            at[0] + right[0].max(0.0) + up[0].abs(),
-            at[1] + right[1].max(0.0) + up[1].abs(),
-        ])
+        upright_box(i64::from(page.rotation), at, w as f64 * scale, h as f64 * scale)
     }
 
     pub fn edit(&self, page: usize, info: &PageInfo, at: [f64; 2], initials: bool, author: &str) -> Option<Edit> {
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index eb620426..825b9574 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -190,38 +190,50 @@ pub fn typed(page: usize, at: [f64; 2], text: &str, author: &str) -> Edit {
 }
 
 /// Place a saved signature (strokes normalised to a 0–1 box, y up) with its left edge at `at`,
-/// 150 pt wide.
-pub fn signature_at(page: usize, at: [f64; 2], strokes: &[Vec<[f32; 2]>], author: &str) -> Option<Edit> {
+/// 150 pt wide. Left, centred and upright are as displayed on a page turned by `rotation` (its
+/// `/Rotate`), so the strokes are turned back into user space.
+pub fn signature_at(page: usize, at: [f64; 2], strokes: &[Vec<[f32; 2]>], rotation: i64, author: &str) -> Option<Edit> {
     let w = 150.0;
     let (min_y, max_y) = strokes.iter().flatten().fold((f32::MAX, f32::MIN), |(a, b), p| (a.min(p[1]), b.max(p[1])));
     if !min_y.is_finite() {
         return None;
     }
     let h = f64::from(max_y - min_y).max(0.05) * w;
+    // Displayed right and up as user-space unit vectors (the identity on an unturned page).
+    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
     let strokes: Vec<Vec<[f64; 2]>> = strokes
         .iter()
         .filter(|s| !s.is_empty())
-        .map(|s| s.iter().map(|p| [at[0] + f64::from(p[0]) * w, at[1] - h / 2.0 + f64::from(p[1] - min_y) * w]).collect())
+        .map(|s| {
+            s.iter()
+                .map(|p| {
+                    let (dx, dy) = (f64::from(p[0]) * w, f64::from(p[1] - min_y) * w - h / 2.0);
+                    [at[0] + a * dx + c * dy, at[1] + b * dx + d * dy]
+                })
+                .collect()
+        })
         .collect();
     (!strokes.is_empty()).then(|| new(page, Shape::Signature { strokes }, String::new(), author))
 }
 
-/// Place typed text in the script font with its left edge at `at`, `height` points tall.
-pub fn typed_signature_at(page: usize, at: [f64; 2], text: &str, height: f64, author: &str) -> Option<Edit> {
-    pdfcraft_engine::typed_signature_shape(at, text, height).map(|shape| new(page, shape, String::new(), author))
+/// Place typed text in the script font with its left edge at `at`, `height` points tall, upright
+/// as displayed on a page turned by `rotation`.
+pub fn typed_signature_at(page: usize, at: [f64; 2], text: &str, height: f64, rotation: i64, author: &str) -> Option<Edit> {
+    pdfcraft_engine::typed_signature_shape(at, text, height, rotation).map(|shape| new(page, shape, String::new(), author))
 }
 
-/// Place a saved signature or initials.
+/// Place a saved signature or initials, upright as `info`'s page is displayed.
 pub fn place(page: usize, info: &PageInfo, at: [f64; 2], sig: &SavedSig, initials: bool, author: &str) -> Option<Edit> {
+    let rotation = i64::from(info.rotation);
     match sig {
-        SavedSig::Drawn(strokes) => signature_at(page, at, strokes, author),
+        SavedSig::Drawn(strokes) => signature_at(page, at, strokes, rotation, author),
         SavedSig::Image(image) => image.edit(page, info, at, initials, author),
         SavedSig::Typed(text) => {
             let [left, bottom, right, top] = pdfcraft_engine::script_outline(text).bounds();
             let height = if initials { 24.0_f64 } else { 32.0_f64 };
             // Keep long names within the same placement width as drawn signatures.
             let height = height.min(150.0 * (top - bottom).max(0.1) / (right - left).max(0.01));
-            typed_signature_at(page, at, text, height, author)
+            typed_signature_at(page, at, text, height, rotation, author)
         }
     }
 }
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 87dc0d59..9ba0cc55 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -877,3 +877,83 @@ fn image_import_cancel_clear_and_errors_preserve_saved_signatures() {
     assert!(again.initials.is_none());
     std::fs::remove_file(path).unwrap();
 }
+
+/// Issue #299: drawn and typed signatures and initials are upright as displayed on pages with
+/// `/Rotate` 90, 180 and 270, anchored at the displayed point, exactly as on an unturned page.
+#[test]
+fn drawn_and_typed_signatures_stay_upright_on_rotated_pages() {
+    // An "L": a long stroke along the bottom and a tick up at its left end, so a turned or
+    // mirrored signature shows.
+    let drawn = SavedSig::Drawn(vec![vec![[0.0, 0.0], [1.0, 0.0]], vec![[0.0, 0.0], [0.0, 0.2]]]);
+    let typed = SavedSig::Typed("Ada Lovelace".into());
+    // (signature, initials, displayed left-centre point)
+    let cases = [(&drawn, false, [40.0_f32, 60.0]), (&typed, false, [40.0, 140.0]), (&typed, true, [40.0, 230.0])];
+    let ink_mask = |rotation: i64| {
+        let mut session = pdfcraft_engine::Session::new();
+        let blank = session.create_blank(300.0, 400.0, 1).unwrap();
+        let id = session.open_new("form.pdf", blank).unwrap();
+        if rotation != 0 {
+            session.apply(id, pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: rotation }).unwrap();
+        }
+        let page = session.get(id).unwrap().info.pages[0].clone();
+        assert_eq!(i64::from(page.rotation), rotation);
+        for (sig, initials, shown) in cases {
+            let at = page.view_to_user(shown[0], shown[1]);
+            let edit = pdfcraft_ui_egui::fill_sign::place(0, &page, [f64::from(at[0]), f64::from(at[1])], sig, initials, "Ada").unwrap();
+            session.apply(id, edit).unwrap();
+        }
+        let annotations = &session.get(id).unwrap().info.annotations;
+        assert_eq!(annotations.len(), cases.len());
+        let bytes = session.get(id).unwrap().bytes.clone();
+        let mut renderer = pdfcraft_render::PageRenderer::new(bytes, Default::default());
+        let out = renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+        assert!(out.error.is_none(), "{:?}", out.error);
+        let shown_size = if rotation % 180 == 0 { (300, 400) } else { (400, 300) };
+        assert_eq!((out.width, out.height), shown_size, "rendered as displayed");
+        let dark: Vec<bool> = out.rgba.as_chunks::<4>().0.iter().map(|p| p[..3].iter().all(|v| *v < 128)).collect();
+        // The displayed ink box of each signature, in the band around its point.
+        let boxes: Vec<[u32; 4]> = cases
+            .iter()
+            .map(|(_, _, shown)| {
+                let (top, bottom) = ((shown[1] - 35.0) as u32, (shown[1] + 35.0) as u32);
+                let mut b = [u32::MAX, u32::MAX, 0, 0];
+                for y in top..bottom {
+                    for x in 0..out.width {
+                        if dark[(y * out.width + x) as usize] {
+                            b = [b[0].min(x), b[1].min(y), b[2].max(x), b[3].max(y)];
+                        }
+                    }
+                }
+                assert!(b[0] <= b[2], "rotation {rotation}: no ink near {shown:?}");
+                b
+            })
+            .collect();
+        (dark, out.width, boxes)
+    };
+    let (upright, _, upright_boxes) = ink_mask(0);
+    for (b, (sig, _, shown)) in upright_boxes.iter().zip(cases) {
+        assert!(b[2] - b[0] > b[3] - b[1], "{sig:?} reads across: {b:?}");
+        assert!(b[0].abs_diff(shown[0] as u32) <= 2, "{sig:?} starts at the point: {b:?}");
+        assert!(b[1] < shown[1] as u32 && b[3] > shown[1] as u32, "{sig:?} is centred on the point: {b:?}");
+    }
+    // The drawn "L" has its tick at the top left, not mirrored or upside down.
+    let at = |x: u32, y: u32| upright[(y * 300 + x) as usize];
+    let b = upright_boxes[0];
+    assert!(at(b[0] + 1, b[1] + 2) && !at(b[2] - 2, b[1] + 2) && at(b[2] - 2, b[3] - 1), "the drawn L is upright: {b:?}");
+    for rotation in [90, 180, 270] {
+        let (dark, width, boxes) = ink_mask(rotation);
+        for (got, want) in boxes.iter().zip(&upright_boxes) {
+            assert!(got.iter().zip(want).all(|(g, w)| g.abs_diff(*w) <= 1), "rotation {rotation}: displayed box {got:?}, upright {want:?}");
+        }
+        // Compare where both pages are shown (the turned ones are 400 x 300).
+        let (mut differ, mut ink) = (0, 0);
+        for y in 0..300 {
+            for x in 0..300 {
+                let (want, got) = (upright[(y * 300 + x) as usize], dark[(y * width + x) as usize]);
+                ink += usize::from(want);
+                differ += usize::from(want != got);
+            }
+        }
+        assert!(differ * 10 < ink, "rotation {rotation}: {differ} of {ink} ink pixels differ from the unturned page");
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 1108c789..26371f1b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5226,8 +5226,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.signature", "sign.fill.initials", "sign.fill.signature.change", "sign.fill.initials.change", "sign.fill.signature.remove", "sign.fill.initials.remove"]
 tools = ["fill_sign_add", "comment_edit", "comment_image_preview"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save"]
-notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save"]
+notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
 
 [[feature]]
 id = "form.fill-sign-flatten"

From 8ddcf63ff8b88cab9ef8919fbc7940f81a746884 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 12:06:22 -0400
Subject: [PATCH 076/149] Fix #445: prefer the discrete GPU on desktops with a
 monitor on each GPU (#558)

On Linux, `pick_adapter` preferred the integrated GPU whenever it drove
any display, to keep hybrid laptops (#8) on their low-power GPU. A desktop
with one monitor on the Intel iGPU and one on an NVIDIA card looked the
same, so wgpu picked the iGPU, which accepted the Wayland surface but then
failed to configure it, and egui-wgpu panicked.

`linux_display_gpus` now also records whether a GPU drives a built-in
panel connector (eDP, LVDS or DSI). When several GPUs drive a display,
the one driving the built-in panel wins (laptops, unchanged); with no
built-in panel anywhere, the discrete GPU wins. Tests cover the desktop
topology from the issue, the laptop case, connector classification and
reading the panel flag from a fake /sys/class/drm tree.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/pdfcraft/src/main.rs | 130 ++++++++++++++++++++++++++++++--------
 1 file changed, 102 insertions(+), 28 deletions(-)

diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 3d7f61a5..de88d640 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -297,7 +297,9 @@ fn write_control_file(path: &str, port: u16, token: &str) -> std::io::Result<()>
 ///   It also saves battery. Machines with one GPU are unaffected.
 /// - On Linux, draw on a GPU that a monitor is plugged into. On a desktop whose monitors all hang
 ///   off the discrete GPU, drawing on the integrated one leaves the window black under Wayland
-///   compositors on NVIDIA. Among the GPUs that drive a display, the integrated one still wins.
+///   compositors on NVIDIA. When several GPUs drive a display, the one driving a built-in panel
+///   wins (a hybrid laptop, issue #8); without a built-in panel (a desktop with a monitor on each
+///   GPU, issue #445) the discrete one wins, as the integrated one may fail to present there.
 /// - On Windows, use Direct3D 12, falling back to OpenGL, and never load Vulkan drivers unless
 ///   `WGPU_BACKEND` asks for them. Creating a Vulkan instance loads every installed Vulkan driver
 ///   into the process, and a faulty one (an Intel driver in issue #37) crashed PdfCraft before
@@ -333,52 +335,78 @@ fn configure_gpu(native: &mut eframe::NativeOptions) {
     }
 }
 
-/// PCI `(vendor, device)` ids of the GPUs with a connected monitor, read from the DRM connectors
-/// under `drm` (`card1-DP-3/status` is `connected`, `card1/device/{vendor,device}` hold `0x10de`).
+/// A GPU with a connected monitor.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+struct DisplayGpu {
+    /// PCI `(vendor, device)` ids.
+    pci: (u32, u32),
+    /// Whether one of its connected connectors is a built-in panel (`eDP`, `LVDS` or `DSI`).
+    internal_panel: bool,
+}
+
+/// Whether a DRM connector name (`eDP-1`, `LVDS-1`, `DSI-1`) is a laptop's built-in panel.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn is_internal_panel(connector: &str) -> bool {
+    ["eDP", "LVDS", "DSI"].iter().any(|kind| connector.starts_with(kind))
+}
+
+/// The GPUs with a connected monitor, read from the DRM connectors under `drm` (`card1-DP-3/status`
+/// is `connected`, `card1/device/{vendor,device}` hold `0x10de`).
 #[cfg(target_os = "linux")]
-fn linux_display_gpus(drm: &std::path::Path) -> Vec<(u32, u32)> {
+fn linux_display_gpus(drm: &std::path::Path) -> Vec<DisplayGpu> {
     let read_hex = |p: std::path::PathBuf| -> Option<u32> {
         let s = std::fs::read_to_string(p).ok()?;
         u32::from_str_radix(s.trim().trim_start_matches("0x"), 16).ok()
     };
-    let mut gpus = Vec::new();
+    let mut gpus: Vec<DisplayGpu> = Vec::new();
     let Ok(entries) = std::fs::read_dir(drm) else { return gpus };
     // A machine has a handful of connectors; the cap only bounds a pathological sysfs.
     for entry in entries.flatten().take(256) {
         let name = entry.file_name();
-        let Some((card, _connector)) = name.to_str().and_then(|n| n.split_once('-')) else { continue };
+        let Some((card, connector)) = name.to_str().and_then(|n| n.split_once('-')) else { continue };
         let connected = std::fs::read_to_string(entry.path().join("status")).is_ok_and(|s| s.trim() == "connected");
         if !connected {
             continue;
         }
         let device = drm.join(card).join("device");
-        if let (Some(v), Some(d)) = (read_hex(device.join("vendor")), read_hex(device.join("device")))
-            && !gpus.contains(&(v, d))
-        {
-            gpus.push((v, d));
+        let (Some(v), Some(d)) = (read_hex(device.join("vendor")), read_hex(device.join("device"))) else { continue };
+        let internal_panel = is_internal_panel(connector);
+        match gpus.iter_mut().find(|g| g.pci == (v, d)) {
+            Some(gpu) => gpu.internal_panel |= internal_panel,
+            None => gpus.push(DisplayGpu { pci: (v, d), internal_panel }),
         }
     }
     gpus
 }
 
-/// Index of the adapter to draw with: one that drives a display (by PCI ids) first, then the most
-/// frugal kind — integrated, discrete, other, virtual, software.
+/// Index of the adapter to draw with: one that drives a display (by PCI ids) first. Among several
+/// of those, the one driving a built-in panel (a hybrid laptop, #8), or else, with no built-in
+/// panel anywhere (a desktop with a monitor on each GPU, #445), the discrete one. Otherwise the
+/// most frugal kind: integrated, discrete, other, virtual, software.
 #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
-fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[(u32, u32)]) -> Option<usize> {
+fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[DisplayGpu]) -> Option<usize> {
     use eframe::wgpu::DeviceType;
+    let display = |pci: (u32, u32)| displays.iter().find(|g| g.pci == pci);
+    let multi_gpu_desktop = displays.len() > 1 && !displays.iter().any(|g| g.internal_panel);
     adapters
         .iter()
         .enumerate()
         .min_by_key(|(_, (vendor, device, kind))| {
-            let drives_display = displays.contains(&(*vendor, *device));
-            let frugality = match kind {
-                DeviceType::IntegratedGpu => 0,
-                DeviceType::DiscreteGpu => 1,
-                DeviceType::Other => 2,
-                DeviceType::VirtualGpu => 3,
-                DeviceType::Cpu => 4,
+            let shown = display((*vendor, *device));
+            let drives_display = shown.is_some();
+            let drives_panel = shown.is_some_and(|g| g.internal_panel);
+            let rank = match kind {
+                // On a desktop with monitors on both, the integrated GPU can accept the window and
+                // still fail to present to it (#445).
+                DeviceType::DiscreteGpu if drives_display && multi_gpu_desktop => 0,
+                DeviceType::IntegratedGpu => 1,
+                DeviceType::DiscreteGpu => 2,
+                DeviceType::Other => 3,
+                DeviceType::VirtualGpu => 4,
+                DeviceType::Cpu => 5,
             };
-            (!drives_display, frugality)
+            (!drives_display, !drives_panel, rank)
         })
         .map(|(i, _)| i)
 }
@@ -431,29 +459,65 @@ mod tests {
         vec![(NVIDIA.0, NVIDIA.1, DeviceType::DiscreteGpu), (AMD_IGPU.0, AMD_IGPU.1, DeviceType::IntegratedGpu), (0, 0, DeviceType::Cpu)]
     }
 
+    const INTEL_IGPU: (u32, u32) = (0x8086, 0xa780);
+
+    fn monitor(pci: (u32, u32)) -> super::DisplayGpu {
+        super::DisplayGpu { pci, internal_panel: false }
+    }
+
+    fn panel(pci: (u32, u32)) -> super::DisplayGpu {
+        super::DisplayGpu { pci, internal_panel: true }
+    }
+
     #[test]
     fn pick_adapter_prefers_the_gpu_driving_the_monitors() {
         // A desktop whose monitors are all on the discrete GPU: the integrated one shows black.
-        assert_eq!(super::pick_adapter(&adapters(), &[NVIDIA]), Some(0));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA)]), Some(0));
     }
 
     #[test]
     fn pick_adapter_keeps_the_integrated_gpu_on_hybrid_laptops() {
         // Issue #8: the panel is on the integrated GPU, an external monitor on the discrete one.
-        assert_eq!(super::pick_adapter(&adapters(), &[NVIDIA, AMD_IGPU]), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[AMD_IGPU]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA), panel(AMD_IGPU)]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU)]), Some(1));
+    }
+
+    #[test]
+    fn pick_adapter_prefers_the_discrete_gpu_on_desktops_with_a_monitor_on_each() {
+        // Issue #445: one monitor on the Intel iGPU, one on the NVIDIA card, no built-in panel.
+        use eframe::wgpu::DeviceType;
+        let desktop =
+            [(INTEL_IGPU.0, INTEL_IGPU.1, DeviceType::IntegratedGpu), (NVIDIA.0, NVIDIA.1, DeviceType::DiscreteGpu), (0, 0, DeviceType::Cpu)];
+        assert_eq!(super::pick_adapter(&desktop, &[monitor(INTEL_IGPU), monitor(NVIDIA)]), Some(1));
+        assert_eq!(super::pick_adapter(&desktop, &[monitor(NVIDIA), monitor(INTEL_IGPU)]), Some(1));
+        // A GPU driving no display still loses to one that does.
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), monitor(INTEL_IGPU)]), Some(1));
     }
 
     #[test]
     fn pick_adapter_falls_back_to_low_power_without_a_match() {
-        assert_eq!(super::pick_adapter(&adapters(), &[(0x8086, 0x1234)]), Some(1));
-        assert_eq!(super::pick_adapter(&[], &[NVIDIA]), None);
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234))]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234)), monitor((0x8086, 0x5678))]), Some(1));
+        assert_eq!(super::pick_adapter(&[], &[monitor(NVIDIA)]), None);
+    }
+
+    #[test]
+    fn internal_panels_are_edp_lvds_and_dsi_connectors() {
+        for name in ["eDP-1", "LVDS-1", "DSI-1"] {
+            assert!(super::is_internal_panel(name), "{name}");
+        }
+        for name in ["DP-3", "HDMI-A-1", "DVI-D-1", "VGA-1", "Writeback-1", ""] {
+            assert!(!super::is_internal_panel(name), "{name}");
+        }
     }
 
     #[cfg(target_os = "linux")]
     #[test]
     fn linux_display_gpus_reads_connected_connectors() -> std::io::Result<()> {
         let dir = std::env::temp_dir().join(format!("pdfcraft-drm-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
         let card = |name: &str, (vendor, device): (u32, u32)| -> std::io::Result<()> {
             std::fs::create_dir_all(dir.join(name).join("device"))?;
             std::fs::write(dir.join(name).join("device/vendor"), format!("{vendor:#06x}\n"))?;
@@ -469,9 +533,19 @@ mod tests {
         connector("card1-DP-4", "connected")?;
         connector("card2-HDMI-A-1", "disconnected")?;
         connector("card2-Writeback-1", "unknown")?;
-        let gpus = super::linux_display_gpus(&dir);
+        let desktop = super::linux_display_gpus(&dir);
+        // Issue #445: a monitor on the integrated GPU too, still no built-in panel.
+        connector("card2-HDMI-A-1", "connected")?;
+        let mut both = super::linux_display_gpus(&dir);
+        // A hybrid laptop: the integrated GPU drives the built-in panel as well.
+        connector("card2-eDP-1", "connected")?;
+        let mut laptop = super::linux_display_gpus(&dir);
         std::fs::remove_dir_all(&dir)?;
-        assert_eq!(gpus, vec![NVIDIA]);
+        assert_eq!(desktop, vec![monitor(NVIDIA)]);
+        both.sort_by_key(|g| g.pci);
+        assert_eq!(both, vec![monitor(AMD_IGPU), monitor(NVIDIA)]);
+        laptop.sort_by_key(|g| g.pci);
+        assert_eq!(laptop, vec![panel(AMD_IGPU), monitor(NVIDIA)]);
         assert!(super::linux_display_gpus(std::path::Path::new("/nonexistent/drm")).is_empty());
         Ok(())
     }

From b98505c810b4eccc8a216c507dc9c984e36c34b5 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Sat, 10 Oct 2026 01:18:59 +0900
Subject: [PATCH 077/149] M1: full saves are allocated at their exact size
 (#523)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`write_full` can't know the output size in advance, so its buffer grows by
doubling and the result kept up to as much again unused: 28 % for a 100 MB
save, 99 % for a 5 MB one. The result is often kept for as long as a document
is open. It becomes the working bytes after edits that need a full rewrite
(repaired files, security changes, redaction) through `write_incremental`, and
it backs Save As ▸ optimized and every new document from Create, Combine,
Extract and Split.

`shrink_to_fit` at the end drops the unused capacity. The bytes are the same.
On macOS the shrink happens in place (2 µs for 100 MB, the buffer doesn't
move), and full-save times are unchanged.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/cos/src/writer.rs   |  3 +++
 crates/cos/tests/writer.rs | 23 +++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index 73311d22..418891b3 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -335,6 +335,9 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
         write_dict(&trailer, &mut out);
         let _ = write!(out, "\nstartxref\n{xref_at}\n%%EOF\n");
     }
+    // The size isn't known until the end, and the buffer grew by doubling. The result is often
+    // kept as a document's working bytes for as long as it's open: drop the unused capacity.
+    out.shrink_to_fit();
     Ok(out)
 }
 
diff --git a/crates/cos/tests/writer.rs b/crates/cos/tests/writer.rs
index 41158f10..6ba65375 100644
--- a/crates/cos/tests/writer.rs
+++ b/crates/cos/tests/writer.rs
@@ -112,6 +112,29 @@ fn incremental_saves_are_allocated_at_their_exact_size() {
     }
 }
 
+/// A full save grows its buffer as it writes, so it used to end with up to as much again unused,
+/// kept alive with the document's working bytes. It now ends at its exact size.
+#[test]
+fn full_saves_are_allocated_at_their_exact_size() {
+    let mut doc = Document::open(Arc::new(fixture())).unwrap();
+    let data: Vec<u8> = (0..100_000u32).map(|i| (i % 251) as u8).collect();
+    let added = doc.add(Object::Stream(Stream { dict: Dict::new(), raw: Arc::new(data.clone()) }));
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |d| d.set(b"Extra".to_vec(), Object::Ref(added))).unwrap();
+    for object_streams in [true, false] {
+        let full = write_full(&doc, &SaveOptions { object_streams, ..SaveOptions::default() }).unwrap();
+        assert_eq!(full.capacity(), full.len(), "object streams: {object_streams}");
+        let back = Document::open(Arc::new(full.clone())).unwrap();
+        assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
+        let extra = back.dict(&Object::Ref(back.root().unwrap())).and_then(|d| d.get(b"Extra").cloned()).unwrap();
+        match &*back.resolve(&extra) {
+            Object::Stream(s) => assert_eq!(*s.raw, data),
+            other => panic!("{other:?}"),
+        }
+        assert_eq!(hayro_pages(&full), 4);
+    }
+}
+
 #[test]
 fn qpdf_accepts_object_stream_output() {
     let Ok(out) = std::process::Command::new("qpdf").arg("--version").output() else {

From cc17deb63419df0592d4bb7d328e75c96d2ec1b4 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Sat, 10 Oct 2026 01:19:04 +0900
Subject: [PATCH 078/149] M3: the watchdog stops the render it gives up on
 (#522)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a render runs past `stuck_after`, the watchdog answers with an error,
starts a replacement worker and drops the late result. The abandoned worker
still rendered the page to the end: #409's stop flag belonged to the whole
pool and was only set when the pool was dropped.

Each worker now has its own stop flag. Dropping the pool sets every worker's
flag, as before. The watchdog sets the flag of the worker it gives up on, so
that render stops at its next content operator. Its answer was already thrown
away, so nothing the user sees changes. Live workers are never stopped.

After giving up on 4 heavy renders, the process used 11.2–11.6 s of CPU in
the next 3 s with nothing left to do; now it uses none.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/render/src/raster.rs | 77 ++++++++++++++++++++++++++++---------
 vendor/README.md            |  2 +-
 2 files changed, 59 insertions(+), 20 deletions(-)

diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index cb6b4b8d..8d80b1bd 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -306,9 +306,10 @@ struct Shared {
     /// Pages (and request kinds) the watchdog gave up on: answered with an error at once, so a
     /// pathological page cannot trap every worker in turn.
     stuck: Mutex<std::collections::HashSet<(usize, RequestKind)>>,
-    /// Set when the pool is dropped: the workers' renders stop at their next content operator,
-    /// since nobody can receive their answers any more.
-    dropped: Arc<std::sync::atomic::AtomicBool>,
+    /// Per worker id: set to stop that worker's render at its next content operator once nobody
+    /// can receive its answer (the pool was dropped, or the watchdog gave up on the render).
+    /// Lock `busy` first when holding both.
+    stop: Mutex<Vec<Arc<std::sync::atomic::AtomicBool>>>,
     /// Test hook: make one page slow.
     #[cfg(test)]
     slow_page: Mutex<Option<(usize, std::time::Duration)>>,
@@ -342,9 +343,11 @@ fn take_next(shared: &Shared) -> Option<RenderRequest> {
 ///
 /// **Watchdog:** a render running longer than `stuck_after` (default [`STUCK_AFTER`]) is reported
 /// as an error for that page, the page is not attempted again, and a replacement worker takes
-/// the stuck one's place (threads cannot be killed; the stuck one exits when its render
-/// finally returns, and its late result is dropped). At most `threads` replacements are started
-/// per pool, so a document full of pathological pages cannot spawn threads without bound.
+/// the stuck one's place (threads cannot be killed: the stuck one is told to stop at its next
+/// content operator, exits when its render returns, and its late result is dropped; a single
+/// long operator, such as decoding a huge image, still runs to its end). At most `threads`
+/// replacements are started per pool, so a document full of pathological pages cannot spawn
+/// threads without bound.
 pub struct RenderPool {
     shared: Arc<Shared>,
     wake: Mutex<Vec<Sender<()>>>,
@@ -394,14 +397,16 @@ impl RenderPool {
         return false;
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let id = {
+            let (id, stop) = {
                 let mut busy = lock(&self.shared.busy);
                 busy.push(None);
-                busy.len() - 1
+                let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
+                lock(&self.shared.stop).push(stop.clone());
+                (busy.len() - 1, stop)
             };
             let (wtx, wrx) = channel::<()>();
             let (shared, out, bytes, config) = (self.shared.clone(), self.results_tx.clone(), self.bytes.clone(), self.config.clone());
-            match std::thread::Builder::new().name(format!("pdfcraft-render-{id}")).spawn(move || worker(id, bytes, config, shared, wrx, out)) {
+            match std::thread::Builder::new().name(format!("pdfcraft-render-{id}")).spawn(move || worker(id, bytes, config, shared, wrx, out, stop)) {
                 Ok(h) => {
                     lock(&self.wake).push(wtx);
                     lock(&self._workers).push(h);
@@ -473,11 +478,15 @@ impl RenderPool {
             let mut gave_up = Vec::new();
             {
                 let mut busy = lock(&self.shared.busy);
-                for slot in busy.iter_mut() {
+                let stop = lock(&self.shared.stop);
+                for (id, slot) in busy.iter_mut().enumerate() {
                     if let Some((req, since)) = *slot
                         && since.elapsed() > self.stuck_after
                     {
                         *slot = None; // the worker sees this and exits when it returns
+                        if let Some(s) = stop.get(id) {
+                            s.store(true, std::sync::atomic::Ordering::Relaxed);
+                        }
                         gave_up.push(req);
                     }
                 }
@@ -510,19 +519,29 @@ impl RenderPool {
 
 impl Drop for RenderPool {
     fn drop(&mut self) {
-        self.shared.dropped.store(true, std::sync::atomic::Ordering::Relaxed);
+        for s in lock(&self.shared.stop).iter() {
+            s.store(true, std::sync::atomic::Ordering::Relaxed);
+        }
     }
 }
 
-/// A worker's interpreter settings: the document's, stopping once the pool is dropped.
+/// A worker's interpreter settings: the document's, stopping once `stop` is set.
 #[cfg(not(target_arch = "wasm32"))]
-fn worker_settings(config: &RenderConfig, shared: &Shared) -> InterpreterSettings {
-    InterpreterSettings { cancelled: Some(shared.dropped.clone()), ..config.settings() }
+fn worker_settings(config: &RenderConfig, stop: &Arc<std::sync::atomic::AtomicBool>) -> InterpreterSettings {
+    InterpreterSettings { cancelled: Some(stop.clone()), ..config.settings() }
 }
 
 #[cfg(not(target_arch = "wasm32"))]
-fn worker(id: usize, bytes: Arc<Vec<u8>>, config: RenderConfig, shared: Arc<Shared>, wake: Receiver<()>, out: Sender<RenderedPage>) {
-    let settings = worker_settings(&config, &shared);
+fn worker(
+    id: usize,
+    bytes: Arc<Vec<u8>>,
+    config: RenderConfig,
+    shared: Arc<Shared>,
+    wake: Receiver<()>,
+    out: Sender<RenderedPage>,
+    stop: Arc<std::sync::atomic::AtomicBool>,
+) {
+    let settings = worker_settings(&config, &stop);
     // Outer loop: (re)build parser + cache; rebuilt after a renderer panic.
     loop {
         let pdf = parse(&bytes, config.password.as_deref());
@@ -1154,9 +1173,9 @@ endstream endobj
 trailer << /Root 1 0 R >>
 %%EOF";
         let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
-        let settings = worker_settings(&pool.config, &pool.shared);
-        let flag = settings.cancelled.clone().expect("workers can be cancelled");
-        assert!(Arc::ptr_eq(&flag, &pool.shared.dropped));
+        let flag = lock(&pool.shared.stop).first().cloned().expect("one worker");
+        let settings = worker_settings(&pool.config, &flag);
+        assert!(settings.cancelled.as_ref().is_some_and(|c| Arc::ptr_eq(c, &flag)));
         let shapes = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
         let text = Pdf::new(Arc::new(TEXT.to_vec())).expect("parses");
         let pages = shapes.pages();
@@ -1173,6 +1192,26 @@ trailer << /Root 1 0 R >>
         assert!(!blue(&settings) && glyphs(&settings) == 0, "once the pool is gone, interpretation stops before drawing");
     }
 
+    #[test]
+    fn the_watchdog_stops_the_render_it_gives_up_on() {
+        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+        pool.set_stuck_after(std::time::Duration::from_millis(100));
+        *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_millis(1500)));
+        pool.set_queue(vec![RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0 }]);
+        let t = std::time::Instant::now();
+        let first = loop {
+            if let Some(p) = pool.try_recv() {
+                break p;
+            }
+            assert!(t.elapsed() < std::time::Duration::from_secs(8), "no answer");
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        };
+        assert!(first.error.as_deref().is_some_and(|e| e.contains("took longer")), "{:?}", first.error);
+        // The abandoned worker is told to stop at its next operator; its replacement isn't.
+        let stop: Vec<bool> = lock(&pool.shared.stop).iter().map(|s| s.load(std::sync::atomic::Ordering::Relaxed)).collect();
+        assert_eq!(stop, vec![true, false]);
+    }
+
     #[test]
     fn extracts_text_with_positions() {
         let pdf = b"%PDF-1.7
diff --git a/vendor/README.md b/vendor/README.md
index 89f9a1fd..deab4532 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -7,7 +7,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it when dropped, after an edit or on closing, so its renders in progress stop instead of running to the end for answers nobody can receive) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on` |
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |

From 19625d40a83d5be9837a63b7075eefa456aba332 Mon Sep 17 00:00:00 2001
From: LloydNicholson <34131158+LloydNicholson@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:19:10 +0200
Subject: [PATCH 079/149] M3: a newly opened document starts at the top, not
 where the last session scrolled (#554)

Opening a PDF after a restart showed it part-way down, at the page some
other document had been left on in the previous session.

Since #259 (#189) the page view's ScrollArea is salted with the
document's DocId, so each tab keeps its own offset. eframe persists
egui's memory (persist_egui_memory defaults to true) to app.ron every
30 s and on quit, scroll offsets included, and restores it at the next
launch. DocIds start again at 1 every launch, so the first document
opened inherited the offset stored under id 1 last time, the second the
one under id 2, and so on.

A DocView now notes when its page view is first shown, and that frame
sets the scroll offset to zero. Navigation queued before the first frame
still wins: a zoom anchor or `goto` (--page, the PDF's open action,
reopening the last session's files at their pages, #462) is applied on
top. Tabs that were already shown keep their own position, as #189
needs. egui's other persisted memory (panel sizes and the like) is
untouched.

- canvas: `DocView::shown`, reset of the offset on the first frame
- tests/viewer.rs: a_new_document_opens_at_the_top_after_a_relaunch
  saves egui's memory through eframe's own RON storage path after
  scrolling a.pdf to page 4, restores it in a new app, opens c.pdf
  (DocId 1) and checks it starts on page 1 (it opened on page 4 before
  the fix) and then keeps its own position
- parity: the test is evidence on view.document-tabs

Refs #189, #259, #462.

Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs   |  9 ++++++
 crates/ui-egui/tests/viewer.rs | 53 ++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml   |  4 +--
 3 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index a9b8faf4..2be17018 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -240,6 +240,8 @@ pub struct DocView {
     viewport_screen: Rect,
     /// Pending zoom anchor: page, position within it (0..1), and offset from the viewport corner.
     zoom_anchor: Option<(usize, f32, f32, Vec2)>,
+    /// The page view has been shown, so its scroll offset in egui's memory is this document's.
+    shown: bool,
     /// Turns wheel input into page turns in single-page view.
     wheel: crate::wheel_pager::WheelPager,
     pub(crate) auto_scroll: crate::autoscroll::AutoScroll,
@@ -379,6 +381,7 @@ impl DocView {
             screen_xforms: Vec::new(),
             viewport_screen: Rect::NOTHING,
             zoom_anchor: None,
+            shown: false,
             wheel: Default::default(),
             auto_scroll: Default::default(),
             selected: BTreeSet::new(),
@@ -1326,6 +1329,12 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     });
     // Each document keeps its own scroll position when switching tabs (#189).
     scroll = scroll.id_salt(("page-view", view.id));
+    // A newly opened document starts at the top. eframe saves egui's memory with the settings
+    // and document ids start again at 1 every launch, so the offset stored under this id can be
+    // where an earlier session left another document.
+    if !std::mem::replace(&mut view.shown, true) {
+        scroll = scroll.scroll_offset(Vec2::ZERO);
+    }
     if let Some((page, fx, fy, rel)) = view.zoom_anchor.take() {
         let r = rects[page.min(rects.len() - 1)];
         let point = pos2(r.left() + fx * r.width(), r.top() - y_shift + fy * r.height());
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index ffbabc10..312f6b35 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -427,6 +427,59 @@ fn each_document_keeps_its_own_scroll_position() {
     assert_eq!(show(&mut h, 1), 1);
 }
 
+#[test]
+fn a_new_document_opens_at_the_top_after_a_relaunch() {
+    // eframe saves egui's memory, scroll offsets included, with the settings and restores it at
+    // the next launch, where document ids start again at 1: the first document opened then
+    // started at the offset the previous session's first document was left at.
+    use pdfcraft_ui_egui::canvas::Fit;
+    let mut h = harness();
+    for v in &mut h.state_mut().views {
+        v.fit = Fit::Width;
+    }
+    h.state_mut().active = Some(0);
+    h.run_steps(4);
+    h.state_mut().views[0].goto = Some((3, 0.0));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 3, "a.pdf scrolled to page 4");
+    // Quit: eframe writes egui's memory to app.ron, as below, and reads it back at the next launch.
+    #[derive(Default)]
+    struct Settings(std::collections::HashMap<String, String>);
+    impl eframe::Storage for Settings {
+        fn get_string(&self, key: &str) -> Option<String> {
+            self.0.get(key).cloned()
+        }
+        fn set_string(&mut self, key: &str, value: String) {
+            self.0.insert(key.into(), value);
+        }
+        fn remove_string(&mut self, key: &str) {
+            self.0.remove(key);
+        }
+        fn flush(&mut self) {}
+    }
+    let mut settings = Settings::default();
+    h.ctx.memory(|m| eframe::set_value(&mut settings, "egui", m));
+    let memory: egui::Memory = eframe::get_value(&settings, "egui").expect("egui's memory round-trips");
+    // Next launch: a document never seen before, which gets a.pdf's old id.
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|cc| {
+        cc.egui_ctx.memory_mut(|m| *m = memory);
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("c.pdf", None, fixture(5)).unwrap();
+        app.views[0].fit = Fit::Width;
+        app
+    });
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].id, pdfcraft_engine::DocId(1));
+    assert_eq!(h.state().views[0].current, 0, "c.pdf opens on page 1");
+    // It is still a scroll position of its own from then on.
+    h.state_mut().views[0].goto = Some((2, 0.0));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 2);
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 2, "c.pdf stays on page 3");
+}
+
 #[test]
 fn arrow_and_page_keys_move_through_a_scrolling_document() {
     // #185: in the continuous (default) and two-page views the arrow keys and Page Down / Up did
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 26371f1b..eec71e9e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1178,8 +1178,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = ["doc_list"]
-evidence = ["crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/control.rs::state_and_view_options", "crates/ui-egui/tests/viewer.rs::each_document_keeps_its_own_scroll_position"]
-notes = "each tab keeps its own scroll position (#189)"
+evidence = ["crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/control.rs::state_and_view_options", "crates/ui-egui/tests/viewer.rs::each_document_keeps_its_own_scroll_position", "crates/ui-egui/tests/viewer.rs::a_new_document_opens_at_the_top_after_a_relaunch"]
+notes = "each tab keeps its own scroll position (#189), and a newly opened one starts at the top, not where an earlier session left the scroll"
 
 [[feature]]
 id = "view.multiple-windows"

From 4e725dcee21bc945038c932def42d7db7597b2a4 Mon Sep 17 00:00:00 2001
From: LloydNicholson <34131158+LloydNicholson@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:19:14 +0200
Subject: [PATCH 080/149] Bookmarks and links go to their destination's
 position and zoom (#556)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every destination was reduced to a page index (`dest_page` in the
inspector), so a bookmark written as [p1 /XYZ 0 420 0] went to the top
of page 1 instead of putting y 420 at the top of the window, and /FitH,
/FitV, /FitR and an /XYZ zoom were ignored.

Destinations now keep their view (ISO 32000-2 §12.3.2.2):
- render: `DestView` (Top, Xyz, Fit, FitH, FitV, FitR) parsed from
  explicit arrays, /D dictionaries and named destinations (/Names
  /Dests and /Dests). `OutlineItem` gains `view`; `LinkTarget::Page`
  carries it. Missing, wrong-typed or non-finite operands are null, a
  zoom that isn't positive keeps the zoom, and an unknown type or a
  /FitR without four numbers falls back to the page top.
  `PageInfo::dest_fraction` maps a user-space point to the displayed
  page through the crop box origin, /Rotate and the view rotation,
  clamped to the page.
- ui: `DocView::go_to_dest` applies it for bookmark and link clicks
  (and so for `ui.click` on the control channel): /XYZ puts (left, top)
  at the window's top-left (beside the quick-action gutter) at its
  zoom; /Fit, /FitH and /FitV switch to fit page, width and height with
  top/left at the edge; /FitR zooms so the rectangle fits, centred. The
  /FitB* content box is read as the whole page.

Tests: operand parsing incl. hostile values, a fixture with every form
(named, GoTo, wrong types, huge numbers, no page), point mapping under
crop offsets and rotations, go_to_dest state, and kittest bookmark and
link clicks checking the point lands at the window's top.

Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                   |   2 +
 crates/automation/src/lib.rs |   2 +-
 crates/render/src/inspect.rs | 215 +++++++++++++++++++++++++++++++++--
 crates/render/src/lib.rs     |   4 +-
 crates/ui-egui/src/canvas.rs | 129 ++++++++++++++++++++-
 crates/ui-egui/src/panels.rs |   8 +-
 crates/ui-egui/tests/view.rs |  99 ++++++++++++++++
 parity/acrobat-features.toml |   8 +-
 8 files changed, 445 insertions(+), 22 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 062e8417..a9d1a6ce 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -139,6 +139,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (community, M14, German):** Deutsch (`de`) is a complete interface catalog (2,035 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `de`, `de_DE`, `de_AT`, `de_CH` and other German locales, and from Preferences. Informal "du", infinitive for commands. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover umlauts, ß and German quotes. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, M7, Arabic added text):** Add text writes Arabic into the PDF instead of `?`. The text is shaped with the craft-fonts `Arab` face through harfrust (already in the tree via egui): joining forms, ligatures and mark positions. Each line is laid out in display order by the Unicode bidirectional algorithm, so Arabic mixed with Latin words, European or Arabic-Indic digits and brackets reads correctly; justified right-to-left paragraphs end at the right edge. Each cluster (a letter with its dots or marks) becomes one glyph of a Type 3 font built from the face's outlines, with a ToUnicode entry, so `text_extract`, copy and search get every letter once and no font file is embedded. Wrapping measures shaped words. Each item has its own fonts under names free on the page (a full save renumbers objects but not resource names); updating or deleting the item removes them. Without the face, adding Arabic text returns a clear error and changes nothing, while an existing item holding Arabic still moves and retypes, drawn as `?` as before. Tests cover shaping, display order, ToUnicode, font names and clean-up on one page, and odd input (empty lines, direction controls, lone marks, 18,000 characters). Not yet: bold/italic Arabic, Hebrew, right-to-left typing in the box (misc.rtl-ui), editing existing Arabic text (edit.rtl-cjk-editing). The craft-fonts revision pinned for releases predates its Arabic face, so release builds report the missing font until the pin moves. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 8563e94d..1444b313 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -1690,7 +1690,7 @@ fn info(d: &Document) -> Value {
         "links": i.links.iter().map(|l| json!({
             "page": page1(l.page), "rect": view_rect(i, l.page, l.rect),
             "target": match &l.target {
-                pdfcraft_render::LinkTarget::Page(p) => json!({ "page": page1(*p) }),
+                pdfcraft_render::LinkTarget::Page(p, _) => json!({ "page": page1(*p) }),
                 pdfcraft_render::LinkTarget::Uri(u) => json!({ "uri": u }),
                 pdfcraft_render::LinkTarget::SetLayers { changes, preserve_rb } => json!({
                     "layers": changes.iter().map(|(op, ocg)| json!({
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 5ff23cb9..2ce2d986 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -112,6 +112,27 @@ impl PageInfo {
         [a * self.width, b * self.height]
     }
 
+    /// A destination's user-space point (each coordinate possibly unspecified) → the same point
+    /// as a fraction of the displayed page `[x, y]` (0..1 from its top-left corner, y down),
+    /// after `/Rotate` and a further clockwise `view_rotation` (0, 90, 180 or 270). On a page
+    /// turned a quarter, the user `x` decides the displayed `y` and vice versa, so each output
+    /// is `None` when the input it comes from is (or is not finite). Points off the page are
+    /// clamped to its edge.
+    pub fn dest_fraction(&self, x: Option<f32>, y: Option<f32>, view_rotation: u16) -> [Option<f32>; 2] {
+        let [cx0, cy0, cx1, cy1] = self.crop;
+        let frac = |v: f32| if v.is_finite() { Some(v.clamp(0.0, 1.0)) } else { None };
+        // Unrotated fractions across (u, from the crop's left) and down (v, from its top).
+        let u = x.and_then(|x| frac((x - cx0) / (cx1 - cx0).max(1e-3)));
+        let v = y.and_then(|y| frac((cy1 - y) / (cy1 - cy0).max(1e-3)));
+        let flip = |f: Option<f32>| f.map(|f| 1.0 - f);
+        match (u32::from(self.rotation) + u32::from(view_rotation)) % 360 {
+            90 => [flip(v), u],
+            180 => [flip(u), flip(v)],
+            270 => [v, flip(u)],
+            _ => [u, v],
+        }
+    }
+
     /// A view-space rectangle → the normalized user-space rectangle covering the same area of the
     /// page (`[x0, y0, x1, y1]`, `x0 <= x1`, `y0 <= y1`). Under `/Rotate` the corners swap roles,
     /// so a view rectangle's top-left is not in general the user rectangle's `[x0, y1]`.
@@ -143,7 +164,8 @@ pub struct Link {
 
 #[derive(Clone, Debug, PartialEq)]
 pub enum LinkTarget {
-    Page(usize),
+    /// A destination in this document: the 0-based page and where on it the view goes.
+    Page(usize, DestView),
     Uri(String),
     /// A set-layer-visibility action (`SetOCGState`, ISO 32000-2 §12.6.4.13): each change in
     /// order, naming the layer by its optional content group. With `preserve_rb`, a layer turned
@@ -163,10 +185,55 @@ pub enum LayerOp {
     Toggle,
 }
 
+/// Where an explicit destination (ISO 32000-2 §12.3.2.2, Table 149) places its page in the
+/// window. Coordinates are PDF user space; `None` is a `null` (or unusable) operand, which keeps
+/// that part of the view as it is.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub enum DestView {
+    /// The top of the page at the current zoom: a destination with no position, or one whose
+    /// type is missing or unknown.
+    #[default]
+    Top,
+    /// `/XYZ left top zoom`: the point (left, top) at the window's upper-left corner, at `zoom`
+    /// (1.0 = 100%; 0 or null keeps the current zoom).
+    Xyz { left: Option<f32>, top: Option<f32>, zoom: Option<f32> },
+    /// `/Fit`, and `/FitB` (fit the page's content box; read as the whole page).
+    Fit,
+    /// `/FitH top`, and `/FitBH`: fit the width, with `top` at the window's top edge.
+    FitH { top: Option<f32> },
+    /// `/FitV left`, and `/FitBV`: fit the height, with `left` at the window's left edge.
+    FitV { left: Option<f32> },
+    /// `/FitR left bottom right top`: fit the rectangle `[x0, y0, x1, y1]` (normalized).
+    FitR { rect: [f32; 4] },
+}
+
+impl DestView {
+    /// The view an explicit destination array asks for, from its elements after the page
+    /// (`/XYZ left top zoom`, `/FitH top`, …). Hostile input never fails: a missing or unknown
+    /// type, or a `/FitR` without four usable numbers, is [`DestView::Top`]; a non-numeric,
+    /// non-finite or missing operand is `None`; a zoom that is not positive is `None`.
+    pub fn from_operands(kind: Option<&[u8]>, operands: &[Option<f32>]) -> Self {
+        let n = |i: usize| operands.get(i).copied().flatten().filter(|v| v.is_finite());
+        match kind {
+            Some(b"XYZ") => Self::Xyz { left: n(0), top: n(1), zoom: n(2).filter(|z| *z > 0.0) },
+            Some(b"Fit" | b"FitB") => Self::Fit,
+            Some(b"FitH" | b"FitBH") => Self::FitH { top: n(0) },
+            Some(b"FitV" | b"FitBV") => Self::FitV { left: n(0) },
+            Some(b"FitR") => match (n(0), n(1), n(2), n(3)) {
+                (Some(x0), Some(y0), Some(x1), Some(y1)) => Self::FitR { rect: [x0.min(x1), y0.min(y1), x0.max(x1), y0.max(y1)] },
+                _ => Self::Top,
+            },
+            _ => Self::Top,
+        }
+    }
+}
+
 #[derive(Clone, Debug)]
 pub struct OutlineItem {
     pub title: String,
     pub page: Option<usize>,
+    /// Where on `page` the bookmark goes ([`DestView::Top`] for a bookmark without a page).
+    pub view: DestView,
     pub children: Vec<OutlineItem>,
     pub open: bool,
 }
@@ -449,14 +516,21 @@ impl<'a> Inspector<'a> {
 
     // ── destinations ────────────────────────────────────────────────────────────────────────
 
-    fn dest_page(&self, dest: &Object, depth: u32) -> Option<usize> {
+    /// The page and view of a destination: an explicit array (`[page /XYZ left top zoom]`, …),
+    /// a dictionary with `/D`, or a named destination that resolves to one.
+    fn dest(&self, dest: &Object, depth: u32) -> Option<(usize, DestView)> {
         if depth > 8 {
             return None;
         }
         match self.resolve(dest) {
-            Object::Array(a) => a.first().and_then(|p| self.page_of(p)),
-            Object::Dictionary(d) => d.get(b"D").ok().and_then(|d| self.dest_page(d, depth + 1)),
-            Object::String(key, _) | Object::Name(key) => self.named_dest(key).and_then(|d| self.dest_page(d, depth + 1)),
+            Object::Array(a) => {
+                let page = a.first().and_then(|p| self.page_of(p))?;
+                let kind = a.get(1).map(|k| self.resolve(k)).and_then(|k| k.as_name().ok());
+                let operands: Vec<Option<f32>> = a.iter().skip(2).take(4).map(|o| self.resolve(o).as_float().ok()).collect();
+                Some((page, DestView::from_operands(kind, &operands)))
+            }
+            Object::Dictionary(d) => d.get(b"D").ok().and_then(|d| self.dest(d, depth + 1)),
+            Object::String(key, _) | Object::Name(key) => self.named_dest(key).and_then(|d| self.dest(d, depth + 1)),
             _ => None,
         }
     }
@@ -531,17 +605,18 @@ impl<'a> Inspector<'a> {
                 break; // cycle
             }
             let Some(d) = self.dict(o) else { break };
-            let page = d
+            let dest = d
                 .get(b"Dest")
                 .ok()
-                .and_then(|dest| self.dest_page(dest, 0))
-                .or_else(|| d.get(b"A").ok().and_then(|a| self.dict(a)).and_then(|a| a.get(b"D").ok()).and_then(|dest| self.dest_page(dest, 0)));
+                .and_then(|dest| self.dest(dest, 0))
+                .or_else(|| d.get(b"A").ok().and_then(|a| self.dict(a)).and_then(|a| a.get(b"D").ok()).and_then(|dest| self.dest(dest, 0)));
+            let (page, view) = dest.map_or((None, DestView::Top), |(p, v)| (Some(p), v));
             let children = match (d.get(b"First").ok(), depth < 32) {
                 (Some(f), true) => self.outline_siblings(f, seen, depth + 1),
                 _ => Vec::new(),
             };
             let open = d.get(b"Count").ok().and_then(|c| c.as_i64().ok()).is_some_and(|c| c > 0);
-            items.push(OutlineItem { title: self.text(d, b"Title").unwrap_or_default(), page, children, open });
+            items.push(OutlineItem { title: self.text(d, b"Title").unwrap_or_default(), page, view, children, open });
             cur = d.get(b"Next").ok();
             if items.len() > 100_000 {
                 break;
@@ -672,11 +747,15 @@ impl<'a> Inspector<'a> {
     fn link(&self, page: usize, d: &Dictionary) -> Option<Link> {
         let rect = rect4(self.resolve(d.get(b"Rect").ok()?));
         let target = if let Ok(dest) = d.get(b"Dest") {
-            LinkTarget::Page(self.dest_page(dest, 0)?)
+            let (page, view) = self.dest(dest, 0)?;
+            LinkTarget::Page(page, view)
         } else {
             let a = d.get(b"A").ok().and_then(|a| self.dict(a))?;
             match self.name(a, b"S").as_deref() {
-                Some("GoTo") => LinkTarget::Page(self.dest_page(a.get(b"D").ok()?, 0)?),
+                Some("GoTo") => {
+                    let (page, view) = self.dest(a.get(b"D").ok()?, 0)?;
+                    LinkTarget::Page(page, view)
+                }
                 Some("URI") => {
                     LinkTarget::Uri(a.get(b"URI").ok().and_then(|u| self.resolve(u).as_str().ok()).map(|b| String::from_utf8_lossy(b).into_owned())?)
                 }
@@ -1171,6 +1250,120 @@ trailer << /Root 1 0 R >>
         );
     }
 
+    #[test]
+    fn destination_operands_become_views() {
+        use DestView::*;
+        let v = |kind: &[u8], ops: &[Option<f32>]| DestView::from_operands(Some(kind), ops);
+        // ISO 32000-2 Table 149, each type.
+        assert_eq!(v(b"XYZ", &[Some(0.0), Some(420.0), Some(0.0)]), Xyz { left: Some(0.0), top: Some(420.0), zoom: None });
+        assert_eq!(v(b"XYZ", &[Some(72.0), Some(500.0), Some(1.5)]), Xyz { left: Some(72.0), top: Some(500.0), zoom: Some(1.5) });
+        assert_eq!(v(b"Fit", &[]), Fit);
+        assert_eq!(v(b"FitB", &[]), Fit);
+        assert_eq!(v(b"FitH", &[Some(250.0)]), FitH { top: Some(250.0) });
+        assert_eq!(v(b"FitBH", &[None]), FitH { top: None });
+        assert_eq!(v(b"FitV", &[Some(120.0)]), FitV { left: Some(120.0) });
+        assert_eq!(v(b"FitBV", &[Some(5.0)]), FitV { left: Some(5.0) });
+        // FitR's corners are normalized.
+        assert_eq!(v(b"FitR", &[Some(110.0), Some(220.0), Some(10.0), Some(20.0)]), FitR { rect: [10.0, 20.0, 110.0, 220.0] });
+        // Missing operands are null; so are non-finite ones, and a zoom that isn't positive.
+        assert_eq!(v(b"XYZ", &[]), Xyz { left: None, top: None, zoom: None });
+        assert_eq!(v(b"XYZ", &[Some(f32::NAN), Some(f32::INFINITY), Some(f32::NEG_INFINITY)]), Xyz { left: None, top: None, zoom: None });
+        assert_eq!(v(b"XYZ", &[None, Some(-5.0), Some(-1.0)]), Xyz { left: None, top: Some(-5.0), zoom: None });
+        assert_eq!(v(b"XYZ", &[None, None, Some(f32::NAN)]), Xyz { left: None, top: None, zoom: None });
+        assert_eq!(v(b"FitH", &[Some(f32::NAN)]), FitH { top: None });
+        // A FitR without four usable numbers, an unknown type or no type: the top of the page.
+        assert_eq!(v(b"FitR", &[Some(1.0), Some(2.0)]), Top);
+        assert_eq!(v(b"FitR", &[Some(1.0), Some(2.0), Some(f32::INFINITY), Some(4.0)]), Top);
+        assert_eq!(v(b"Zoom", &[Some(3.0)]), Top);
+        assert_eq!(v(b"xyz", &[Some(3.0)]), Top);
+        assert_eq!(DestView::from_operands(None, &[Some(1.0)]), Top);
+    }
+
+    /// Two 300×400 pages. Bookmarks and links on page 1 go to page 2 in every destination form,
+    /// named (`/Names /Dests` and the PDF 1.1 `/Dests`) and malformed.
+    const DESTS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R /Names << /Dests 40 0 R >> /Dests << /old << /D [4 0 R /FitV 120] >> >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Annots [30 0 R 31 0 R 32 0 R 33 0 R] >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R >> endobj
+10 0 obj << /Type /Outlines /First 11 0 R /Last 20 0 R /Count 10 >> endobj
+11 0 obj << /Title (xyz) /Parent 10 0 R /Next 12 0 R /Dest [4 0 R /XYZ 0 420 0] >> endobj
+12 0 obj << /Title (fith) /Parent 10 0 R /Next 13 0 R /Dest [4 0 R /FitH 250] >> endobj
+13 0 obj << /Title (named) /Parent 10 0 R /Next 14 0 R /Dest (sec) >> endobj
+14 0 obj << /Title (old named) /Parent 10 0 R /Next 15 0 R /Dest /old >> endobj
+15 0 obj << /Title (action) /Parent 10 0 R /Next 16 0 R /A << /S /GoTo /D [4 0 R /FitR 110 220 10 20] >> >> endobj
+16 0 obj << /Title (wrong types) /Parent 10 0 R /Next 17 0 R /Dest [4 0 R /XYZ (left) /Top true] >> endobj
+17 0 obj << /Title (short) /Parent 10 0 R /Next 18 0 R /Dest [4 0 R /FitR 1 2] >> endobj
+18 0 obj << /Title (no type) /Parent 10 0 R /Next 19 0 R /Dest [4 0 R] >> endobj
+19 0 obj << /Title (huge) /Parent 10 0 R /Next 20 0 R /Dest [4 0 R /XYZ 1000000000000 -5 -1] >> endobj
+20 0 obj << /Title (no page) /Parent 10 0 R /Dest [/XYZ 0 420 0] >> endobj
+30 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 10 10] /Dest [4 0 R /XYZ 72 500 1.5] >> endobj
+31 0 obj << /Type /Annot /Subtype /Link /Rect [0 20 10 30] /A << /S /GoTo /D (sec) >> >> endobj
+32 0 obj << /Type /Annot /Subtype /Link /Rect [0 40 10 50] /Dest [4 0 R /FitBH 100] >> endobj
+33 0 obj << /Type /Annot /Subtype /Link /Rect [0 60 10 70] /Dest [4 0 R /Fit] >> endobj
+40 0 obj << /Names [(sec) << /D [4 0 R /XYZ null 300 2] >>] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+    #[test]
+    fn bookmarks_and_links_keep_their_destination_view() {
+        use DestView::*;
+        let info = inspect(Arc::new(DESTS.to_vec()), None).expect("opens");
+        let outline: Vec<_> = info.outline.iter().map(|o| (o.title.as_str(), o.page, o.view)).collect();
+        assert_eq!(
+            outline,
+            [
+                ("xyz", Some(1), Xyz { left: Some(0.0), top: Some(420.0), zoom: None }),
+                ("fith", Some(1), FitH { top: Some(250.0) }),
+                ("named", Some(1), Xyz { left: None, top: Some(300.0), zoom: Some(2.0) }),
+                ("old named", Some(1), FitV { left: Some(120.0) }),
+                ("action", Some(1), FitR { rect: [10.0, 20.0, 110.0, 220.0] }),
+                // Hostile operands fall back without failing the bookmark.
+                ("wrong types", Some(1), Xyz { left: None, top: None, zoom: None }),
+                ("short", Some(1), Top),
+                ("no type", Some(1), Top),
+                ("huge", Some(1), Xyz { left: Some(1e12), top: Some(-5.0), zoom: None }),
+                ("no page", None, Top),
+            ]
+        );
+        let links: Vec<_> = info.links.iter().map(|l| l.target.clone()).collect();
+        assert_eq!(
+            links,
+            [
+                LinkTarget::Page(1, Xyz { left: Some(72.0), top: Some(500.0), zoom: Some(1.5) }),
+                LinkTarget::Page(1, Xyz { left: None, top: Some(300.0), zoom: Some(2.0) }),
+                LinkTarget::Page(1, FitH { top: Some(100.0) }),
+                LinkTarget::Page(1, Fit),
+            ]
+        );
+    }
+
+    #[test]
+    fn destination_points_map_to_the_displayed_page() {
+        // A crop box away from the origin: x 100..400, y 50..450.
+        let mut p = PageInfo { width: 300.0, height: 400.0, label: "1".into(), crop: [100.0, 50.0, 400.0, 450.0], rotation: 0 };
+        assert_eq!(p.dest_fraction(Some(100.0), Some(450.0), 0), [Some(0.0), Some(0.0)]);
+        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.5), Some(0.25)]);
+        // Unspecified stays unspecified; off-page and huge values are clamped to the page.
+        assert_eq!(p.dest_fraction(None, Some(350.0), 0), [None, Some(0.25)]);
+        assert_eq!(p.dest_fraction(Some(-1e30), Some(1e30), 0), [Some(0.0), Some(0.0)]);
+        assert_eq!(p.dest_fraction(Some(f32::INFINITY), Some(f32::NAN), 0), [None, None]);
+        // /Rotate 90 (clockwise): user y runs left to right across the displayed page, user x
+        // top to bottom. A view rotation adds to it.
+        p.rotation = 90;
+        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.75), Some(0.5)]);
+        assert_eq!(p.dest_fraction(None, Some(350.0), 0), [Some(0.75), None]);
+        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 90), [Some(0.5), Some(0.75)]);
+        p.rotation = 180;
+        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.5), Some(0.75)]);
+        p.rotation = 270;
+        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.25), Some(0.5)]);
+        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 90), [Some(0.5), Some(0.25)]);
+        // A degenerate crop box never divides by zero.
+        let flat = PageInfo { crop: [0.0, 0.0, 0.0, 0.0], rotation: 0, ..p };
+        assert!(flat.dest_fraction(Some(5.0), Some(-5.0), 0).iter().all(|f| f.is_some_and(|f| (0.0..=1.0).contains(&f))));
+    }
+
     #[test]
     fn structure_failure_preserves_renderer_pages() {
         for crash in [true, false] {
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index 503e6561..580f0f86 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -13,8 +13,8 @@ mod raster;
 pub mod text;
 
 pub use inspect::{
-    Annotation, Attachment, AttachmentSource, DocInfo, Field, FieldKind, FontInfo, Layer, LayerOp, Link, LinkTarget, OutlineItem, PageInfo, Xfa,
-    attachment_data, inspect, pretty_date,
+    Annotation, Attachment, AttachmentSource, DestView, DocInfo, Field, FieldKind, FontInfo, Layer, LayerOp, Link, LinkTarget, OutlineItem, PageInfo,
+    Xfa, attachment_data, inspect, pretty_date,
 };
 pub use raster::{
     MAX_PIXELS, MAX_SIDE, PageRenderer, RenderConfig, RenderPool, RenderRequest, RenderedPage, RequestKind, Tile, device_pixels, effective_scale,
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 2be17018..5bca9d99 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -10,7 +10,7 @@ use std::sync::Arc;
 
 use egui::{Align2, Color32, CornerRadius, Pos2, Rect, Sense, Stroke, TextureHandle, TextureOptions, Vec2, pos2, vec2};
 use pdfcraft_engine::{DocId, Edit};
-use pdfcraft_render::{DocInfo, LayerOp, LinkTarget, PageText, RenderPool, RenderRequest, RequestKind, Tile, device_pixels};
+use pdfcraft_render::{DestView, DocInfo, LayerOp, LinkTarget, PageText, RenderPool, RenderRequest, RequestKind, Tile, device_pixels};
 
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, QuickTool, RightPanel, comments, icons, widgets};
@@ -200,6 +200,10 @@ pub struct DocView {
     pub forward: Vec<usize>,
     /// Pending navigation: page and fraction down the page to align with the viewport top.
     pub goto: Option<(usize, f32)>,
+    /// Pending position within that page from a destination ([`Self::go_to_dest`]): the point
+    /// (fractions of the displayed page; `None` leaves that axis to `goto`) to put `rel` points
+    /// from the viewport's top-left corner.
+    goto_point: Option<(usize, Option<f32>, Option<f32>, Vec2)>,
     /// Pending keyboard scrolling, in points down (negative: up): ↓ / ↑, and Page Down /
     /// Page Up where the pages scroll.
     pub key_scroll: f32,
@@ -357,6 +361,7 @@ impl DocView {
             back: Vec::new(),
             forward: Vec::new(),
             goto: None,
+            goto_point: None,
             key_scroll: 0.0,
             single_edges: None,
             flash: None,
@@ -428,6 +433,7 @@ impl DocView {
             self.select_anchor = None;
         }
         self.goto = None;
+        self.goto_point = None;
         self.zoom_anchor = None;
         self.flash = None;
     }
@@ -675,6 +681,67 @@ impl DocView {
         self.page_input = (page + 1).to_string();
     }
 
+    /// Go to a destination, a bookmark's or a link's (ISO 32000-2 §12.3.2.2): its page, scrolled
+    /// and zoomed as `dest` asks, as Acrobat does. `/XYZ` puts (left, top) at the window's
+    /// top-left at its zoom (null or 0 keeps the zoom); `/Fit`, `/FitH` and `/FitV` switch to fit
+    /// page, width and height with `top` or `left` at the window's edge; `/FitR` zooms so the
+    /// rectangle fits, centred. The `B` (content box) forms are read as the page. A null
+    /// coordinate keeps that scroll position (null `top` on a new page: its top), and a point
+    /// past the end of the document scrolls as far as it can.
+    pub fn go_to_dest(&mut self, page: usize, dest: DestView, info: &DocInfo) {
+        self.go_to_page(page);
+        let page = self.current;
+        self.goto_point = None;
+        let Some(p) = info.pages.get(page) else { return };
+        let point = |x: Option<f32>, y: Option<f32>| p.dest_fraction(x, y, self.rotation);
+        // The window's top-left as far as pages go: its left edge is the gutter that keeps them
+        // clear of the floating quick-action bar, so `left` 0 shows the page's edge beside it.
+        let corner = vec2(SIDE, 0.0);
+        let (fx, fy, rel) = match dest {
+            DestView::Top => return,
+            DestView::Xyz { left, top, zoom } => {
+                if let Some(z) = zoom {
+                    self.zoom = z.clamp(0.08, 64.0);
+                    self.fit = Fit::None;
+                    self.zoom_anchor = None;
+                }
+                let [fx, fy] = point(left, top);
+                (fx, fy, corner)
+            }
+            DestView::Fit => {
+                self.fit = Fit::Page;
+                return;
+            }
+            DestView::FitH { top } => {
+                self.fit = Fit::Width;
+                let [fx, fy] = point(None, top);
+                (fx, fy, corner)
+            }
+            DestView::FitV { left } => {
+                self.fit = Fit::Height;
+                let [fx, fy] = point(left, None);
+                (fx, fy, corner)
+            }
+            DestView::FitR { rect } => {
+                let ([Some(ax), Some(ay)], [Some(bx), Some(by)]) = (point(Some(rect[0]), Some(rect[3])), point(Some(rect[2]), Some(rect[1]))) else {
+                    return;
+                };
+                // The rectangle as displayed, in points (it can be turned a quarter).
+                let (dw, dh) = self.display_size(p);
+                let (w, h) = ((ax - bx).abs() * dw, (ay - by).abs() * dh);
+                if w >= 1.0 && h >= 1.0 && self.viewport_w >= 1.0 && self.viewport_h >= 1.0 {
+                    self.zoom = (self.viewport_w / (w * PT)).min(self.viewport_h / (h * PT)).clamp(0.08, 64.0);
+                    self.fit = Fit::None;
+                    self.zoom_anchor = None;
+                }
+                (Some((ax + bx) / 2.0), Some((ay + by) / 2.0), vec2(self.viewport_w, self.viewport_h) / 2.0)
+            }
+        };
+        if fx.is_some() || fy.is_some() {
+            self.goto_point = Some((page, fx, fy, rel));
+        }
+    }
+
     /// Next page (`true`) or previous page. In two-page view this moves a whole spread: the other
     /// page of the spread is already on screen, so stepping to it wouldn't move the view (#70).
     pub fn step_page(&mut self, forward: bool) {
@@ -1409,6 +1476,19 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         view.content.selected = None;
     }
 
+    // A destination's position (bookmarks, links) refines `goto`: its point at the window's
+    // top-left, or the centre of a /FitR rectangle at the window's centre.
+    if let Some((page, fx, fy, rel)) = view.goto_point.take() {
+        let r = rects[page.min(rects.len() - 1)];
+        // Within the content, so an unreachable point never shows a frame scrolled past the end.
+        let (max_x, max_y) = ((content_w - avail.width()).max(0.0), (content_h - avail.height()).max(0.0));
+        if let Some(fx) = fx {
+            scroll = scroll.horizontal_scroll_offset((r.left() + fx * r.width() - rel.x).clamp(0.0, max_x));
+        }
+        if let Some(fy) = fy {
+            scroll = scroll.vertical_scroll_offset((r.top() - y_shift + fy * r.height() - rel.y).clamp(0.0, max_y));
+        }
+    }
     let out = scroll.show_viewport(ui, |ui, viewport| {
         // egui's drag responses accept every pointer button. Keep a wheel gesture from also
         // selecting text, drawing a mark, or panning with the Hand tool.
@@ -1831,7 +1911,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     if sr.contains(p) {
                         ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
                         let label = match &l.target {
-                            LinkTarget::Page(n) => {
+                            LinkTarget::Page(n, _) => {
                                 crate::i18n::fmt(tl!("Go to page {p}"), &[("p", info.pages.get(*n).map(|p| p.label.as_str()).unwrap_or("?"))])
                             }
                             LinkTarget::Uri(u) => u.clone(),
@@ -2065,7 +2145,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         None => {}
     }
     match clicked_link {
-        Some(LinkTarget::Page(p)) => view.go_to_page(p),
+        Some(LinkTarget::Page(p, dest)) => view.go_to_dest(p, dest, info),
         Some(LinkTarget::Uri(u)) => app.request_document_url(&u, crate::LinkOrigin::Link),
         Some(LinkTarget::SetLayers { changes, preserve_rb }) => set_layers(app, index, &changes, preserve_rb),
         Some(LinkTarget::Other(s)) => app.notify_fmt("{s} actions run in the JavaScript engine (M6)", &[("s", &s)]),
@@ -3043,4 +3123,47 @@ mod tests {
         assert_eq!(PageLayout::try_parse(" Two-Up "), Some(PageLayout::TwoUp));
         assert_eq!(PageLayout::try_parse("facing"), None);
     }
+
+    #[test]
+    fn destinations_set_the_zoom_mode_and_the_point_to_show() {
+        let info = pdfcraft_render::DocInfo {
+            pages: (0..3)
+                .map(|_| pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 })
+                .collect(),
+            ..Default::default()
+        };
+        let mut v = view(3, PageLayout::Continuous);
+        v.fit = Fit::Width;
+        // No position (or a malformed one): the top of the page, zoom as it was.
+        v.go_to_dest(1, DestView::Top, &info);
+        assert_eq!((v.current, v.goto, v.goto_point, v.fit), (1, Some((1, 0.0)), None, Fit::Width));
+        // /XYZ with a null zoom keeps the zoom mode; its point is a quarter down page 3.
+        v.go_to_dest(2, DestView::Xyz { left: None, top: Some(300.0), zoom: None }, &info);
+        assert_eq!((v.current, v.fit, v.goto_point), (2, Fit::Width, Some((2, None, Some(0.25), vec2(SIDE, 0.0)))));
+        v.go_to_dest(0, DestView::Xyz { left: Some(150.0), top: None, zoom: Some(2.5) }, &info);
+        assert_eq!((v.fit, v.zoom, v.goto_point), (Fit::None, 2.5, Some((0, Some(0.5), None, vec2(SIDE, 0.0)))));
+        // A zoom beyond the view's range is clamped to it.
+        v.go_to_dest(0, DestView::Xyz { left: None, top: None, zoom: Some(1e30) }, &info);
+        assert_eq!((v.zoom, v.goto_point), (64.0, None));
+        v.go_to_dest(0, DestView::Fit, &info);
+        assert_eq!((v.fit, v.goto_point), (Fit::Page, None));
+        v.go_to_dest(0, DestView::FitH { top: Some(100.0) }, &info);
+        assert_eq!((v.fit, v.goto_point), (Fit::Width, Some((0, None, Some(0.75), vec2(SIDE, 0.0)))));
+        v.go_to_dest(0, DestView::FitV { left: Some(75.0) }, &info);
+        assert_eq!((v.fit, v.goto_point), (Fit::Height, Some((0, Some(0.25), None, vec2(SIDE, 0.0)))));
+        // /FitR: the zoom that fits a 100×50 pt rectangle in an 800×600 window, centred.
+        (v.viewport_w, v.viewport_h) = (800.0, 600.0);
+        v.go_to_dest(0, DestView::FitR { rect: [0.0, 300.0, 100.0, 350.0] }, &info);
+        assert_eq!(v.fit, Fit::None);
+        assert!((v.zoom - 8.0 / PT).abs() < 1e-4, "{}", v.zoom);
+        let (page, fx, fy, rel) = v.goto_point.expect("a point to show");
+        assert_eq!((page, rel), (0, vec2(400.0, 300.0)));
+        assert!((fx.unwrap_or(-1.0) - 50.0 / 300.0).abs() < 1e-4 && (fy.unwrap_or(-1.0) - 75.0 / 400.0).abs() < 1e-4, "{fx:?} {fy:?}");
+        // A page past the end goes to the last page; a page the document info lacks, to its top.
+        v.go_to_dest(usize::MAX, DestView::FitH { top: Some(100.0) }, &info);
+        assert_eq!((v.current, v.goto_point.map(|g| g.0)), (2, Some(2)));
+        let empty = pdfcraft_render::DocInfo::default();
+        v.go_to_dest(1, DestView::FitH { top: Some(100.0) }, &empty);
+        assert_eq!((v.current, v.goto_point), (1, None));
+    }
 }
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 20ab7003..377636f4 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -378,6 +378,8 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
 
 pub(crate) enum Nav {
     Page(usize),
+    /// A bookmark's destination: its page and where on it.
+    Dest(usize, pdfcraft_render::DestView),
     Flash(usize, [f32; 4]),
 }
 
@@ -673,6 +675,10 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     }
     match nav {
         Some(Nav::Page(p)) => app.views[index].go_to_page(p),
+        Some(Nav::Dest(p, dest)) => match app.session.get(id) {
+            Some(doc) => app.views[index].go_to_dest(p, dest, &doc.info),
+            None => app.views[index].go_to_page(p),
+        },
         Some(Nav::Flash(p, r)) => {
             let v = &mut app.views[index];
             v.go_to_page(p);
@@ -850,7 +856,7 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
         if resp.clicked()
             && let Some(p) = item.page
         {
-            *cx.nav = Some(Nav::Page(p));
+            *cx.nav = Some(Nav::Dest(p, item.view));
         }
         if resp.double_clicked() && cx.editable {
             *cx.action = Some(BmAction::StartRename(path.to_vec()));
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index 2d8881ea..a85daa48 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -451,6 +451,105 @@ fn clicking_a_link_goes_to_its_destination() {
     assert!((target.min.y - vp.min.y).abs() < 40.0, "page 3 is scrolled to the top: {target:?} in {vp:?}");
 }
 
+/// Bookmarks and a link with positioned destinations (ISO 32000-2 §12.3.2.2). Page 2's crop box
+/// is away from the origin (x 50..350, y 100..500), so its user-space y 420 is 20% down the page.
+const DESTS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Annots [20 0 R] >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 400 600] /CropBox [50 100 350 500] >> endobj
+5 0 obj << /Type /Page /Parent 2 0 R >> endobj
+10 0 obj << /Type /Outlines /First 11 0 R /Last 13 0 R /Count 3 >> endobj
+11 0 obj << /Title (Section 1.1 Shapes) /Parent 10 0 R /Next 12 0 R /Dest [4 0 R /XYZ 0 420 0] >> endobj
+12 0 obj << /Title (Zoomed in) /Parent 10 0 R /Next 13 0 R /Dest [4 0 R /XYZ 125 300 3] >> endobj
+13 0 obj << /Title (Broken) /Parent 10 0 R /Dest [5 0 R /XYZ (left) /top true] >> endobj
+20 0 obj << /Type /Annot /Subtype /Link /Rect [50 300 250 350] /Border [0 0 0] /Dest [4 0 R /FitH 420] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+fn dests_harness() -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("dests.pdf", None, DESTS.to_vec()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("panel", "bookmarks").unwrap();
+        app
+    });
+    // The Bookmarks panel widens to fit its titles over many frames; fit-width zoom follows it.
+    // Positions are checked once the window's layout holds still.
+    let mut width = 0.0;
+    for _ in 0..400 {
+        h.run_steps(1);
+        let w = h.state().views[0].viewport_rect().width();
+        if w == width {
+            break;
+        }
+        width = w;
+    }
+    h
+}
+
+/// Where the point a fraction (`fx`, `fy`) across and down `page` is on screen, relative to the
+/// viewport's top-left corner.
+fn from_viewport_corner(h: &Harness<'static, PdfCraftApp>, page: usize, fx: f32, fy: f32) -> egui::Vec2 {
+    let (r, vp) = (rect(h, page).expect("page on screen"), h.state().views[0].viewport_rect());
+    egui::pos2(r.min.x + fx * r.width(), r.min.y + fy * r.height()) - vp.min
+}
+
+#[test]
+fn bookmark_destinations_scroll_to_their_position() {
+    use egui_kittest::kittest::Queryable;
+    use pdfcraft_ui_egui::canvas::Fit;
+    let mut h = dests_harness();
+    // Fit width: the pages are taller than the window, so any point of them can reach its top.
+    h.get_by_label("Section 1.1 Shapes").click();
+    h.run_steps(6);
+    let v = &h.state().views[0];
+    assert_eq!(v.current, 1, "the bookmark targets page 2");
+    assert_eq!(v.fit, Fit::Width, "/XYZ with zoom 0 keeps the zoom");
+    let d = from_viewport_corner(&h, 1, 0.0, 0.2);
+    assert!(d.y.abs() < 2.0, "y 420 on page 2 is at the top of the window, not the page top: {d:?}");
+
+    // /XYZ left top zoom: 300%, with (125, 300), a quarter across and half way down, at the
+    // window's top-left (the page is now wider than the window): its left is the edge of the
+    // gutter that keeps pages clear of the quick-action bar.
+    h.get_by_label("Zoomed in").click();
+    h.run_steps(6);
+    let v = &h.state().views[0];
+    assert_eq!((v.current, v.fit, v.zoom), (1, Fit::None, 3.0));
+    let d = from_viewport_corner(&h, 1, 0.25, 0.5);
+    assert!((d.x - 70.0).abs() < 2.0 && d.y.abs() < 2.0, "the destination point is at the window's top-left: {d:?}");
+
+    // Malformed operands fall back to the top of the page at the current zoom.
+    h.get_by_label("Broken").click();
+    h.run_steps(6);
+    let v = &h.state().views[0];
+    assert_eq!((v.current, v.zoom), (2, 3.0));
+    let d = from_viewport_corner(&h, 2, 0.0, 0.0);
+    assert!(d.y > 0.0 && d.y < 40.0, "page 3 is scrolled to its top: {d:?}");
+}
+
+#[test]
+fn link_destinations_scroll_to_their_position() {
+    use pdfcraft_ui_egui::canvas::Fit;
+    let mut h = dests_harness();
+    h.state_mut().set_option("zoom", "100%").unwrap();
+    h.run_steps(4);
+    let r = rect(&h, 0).expect("page 1");
+    // The link spans x 50..250, y 300..350 in PDF space on the 300×400 page 1.
+    let at = egui::pos2(r.min.x + r.width() * (150.0 / 300.0), r.min.y + r.height() * (1.0 - 325.0 / 400.0));
+    h.hover_at(at);
+    h.run_steps(2);
+    h.drag_at(at); // press
+    h.drop_at(at); // release
+    h.run_steps(8);
+    let v = &h.state().views[0];
+    assert_eq!((v.current, v.fit), (1, Fit::Width), "/FitH goes to page 2 and fits its width");
+    let d = from_viewport_corner(&h, 1, 0.0, 0.2);
+    assert!(d.y.abs() < 2.0, "y 420 on page 2 is at the top of the window: {d:?}");
+}
+
 /// Two pages with a text field on each and a non-embedded Helvetica.
 const FORM: &[u8] = b"%PDF-1.7
 1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R 7 0 R] >> >> endobj
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index eec71e9e..4f114286 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1154,8 +1154,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/view.rs::clicking_a_link_goes_to_its_destination"]
-notes = "GoTo and URI links; other action types (JavaScript, Launch, named actions) arrive with M6"
+evidence = ["crates/ui-egui/tests/view.rs::clicking_a_link_goes_to_its_destination", "crates/ui-egui/tests/view.rs::link_destinations_scroll_to_their_position", "crates/render/src/inspect.rs::bookmarks_and_links_keep_their_destination_view"]
+notes = "GoTo and URI links; other action types (JavaScript, Launch, named actions) arrive with M6. Destinations keep their position and zoom (/XYZ, /Fit, /FitH, /FitV, /FitR, named); the /FitB* content box is read as the whole page"
 
 [[feature]]
 id = "view.annotation-hover"
@@ -1250,8 +1250,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = ["doc_info"]
-evidence = ["crates/ui-egui/tests/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/control.rs::state_and_view_options"]
-notes = ""
+evidence = ["crates/ui-egui/tests/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/control.rs::state_and_view_options", "crates/ui-egui/tests/view.rs::bookmark_destinations_scroll_to_their_position"]
+notes = "A bookmark goes to its destination's position and zoom, not just its page"
 
 [[feature]]
 id = "view.highlight-current-bookmark"

From bd275555193ee76c3a952182b7589aa2831fab42 Mon Sep 17 00:00:00 2001
From: Dimitar <bulgaria_mitko@yahoo.com>
Date: Fri, 9 Oct 2026 19:19:20 +0300
Subject: [PATCH 081/149] M7: Type 3 fallback glyphs get a well-formed d1, so
 Acrobat draws them (#548)

type3_path wrote `wx 0 0 0 0 1000 1000 d1`: seven operands where d1 takes six
(wx wy llx lly urx ury). Lenient renderers (pdfium, Quartz, MuPDF, poppler) ignore the
extra one, but Acrobat treats the glyph as unusable and draws a bullet for every
character of edited Japanese (or other fallback) text. The box is now the glyph's own
bounds, rounded outward; empty glyphs (spaces) get a zero box.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/edit/src/tests.rs | 28 ++++++++++++++++++++++++++++
 crates/edit/src/text.rs  | 13 ++++++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 6e746ca0..fca770b5 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -574,6 +574,34 @@ fn japanese_paragraph_uses_unicode_type3_fallback() {
     assert_eq!(text::text_blocks(&reopened, 0).unwrap()[0].text, replacement);
 }
 
+/// Every Type 3 fallback glyph starts with a well-formed `d1`: six operands, the second 0, and a
+/// box that encloses every point of the glyph. Acrobat shows a bullet for a glyph whose `d1`
+/// has the wrong operand count.
+#[test]
+fn type3_fallback_glyphs_declare_a_well_formed_d1() {
+    if without_craft_fonts("type3_fallback_glyphs_declare_a_well_formed_d1") {
+        return;
+    }
+    let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    text::replace_line(&mut doc, 0, 0, "見本商会 御中").unwrap();
+    let glyphs = fallback_paths(&reopen(&doc));
+    assert!(!glyphs.is_empty());
+    for glyph in glyphs {
+        let text = String::from_utf8(glyph).unwrap();
+        let mut lines = text.lines();
+        let d1: Vec<&str> = lines.next().unwrap().split_whitespace().collect();
+        assert_eq!(d1.len(), 7, "six operands and d1: {d1:?}");
+        assert_eq!(d1[6], "d1");
+        let n: Vec<f64> = d1[..6].iter().map(|v| v.parse().unwrap()).collect();
+        assert_eq!(n[1], 0.0, "wy");
+        assert!(n[2] <= n[4] && n[3] <= n[5], "box: {n:?}");
+        for line in lines.filter(|l| l.ends_with(" m") || l.ends_with(" l")) {
+            let p: Vec<f64> = line.split_whitespace().take(2).map(|v| v.parse().unwrap()).collect();
+            assert!(p[0] >= n[2] && p[0] <= n[4] && p[1] >= n[3] && p[1] <= n[5], "{line} outside {n:?}");
+        }
+    }
+}
+
 #[test]
 fn japanese_paragraph_keeps_ideographic_spaces() {
     if without_craft_fonts("japanese_paragraph_keeps_ideographic_spaces") {
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 7eb31145..7753b56f 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -542,7 +542,18 @@ fn type3_path(face: &CraftFont, ch: char) -> Result<(Vec<u8>, f64), EditError> {
         GlyphError::TooComplex => EditError::Invalid(format!("Japanese fallback glyph U+{:04X} is too complex", ch as u32)),
     })?;
     let scale = 1000.0;
-    let mut out = format!("{} 0 0 0 0 1000 1000 d1\n", pdf_num(glyph.width * scale)).into_bytes();
+    // d1 is `wx wy llx lly urx ury` (ISO 32000-2 §9.6.4) with a box enclosing the glyph;
+    // Acrobat draws a bullet in place of a glyph whose d1 is malformed.
+    let b = if glyph.contours.is_empty() { [0.0; 4] } else { glyph.bbox };
+    let mut out = format!(
+        "{} 0 {} {} {} {} d1\n",
+        pdf_num(glyph.width * scale),
+        pdf_num((b[0] * scale).floor()),
+        pdf_num((b[1] * scale).floor()),
+        pdf_num((b[2] * scale).ceil()),
+        pdf_num((b[3] * scale).ceil())
+    )
+    .into_bytes();
     for contour in glyph.contours {
         let Some(first) = contour.first() else { continue };
         out.extend_from_slice(format!("{} {} m\n", pdf_num(first[0] * scale), pdf_num(first[1] * scale)).as_bytes());

From 36af4afb198fc1c2b84a5b95e6aa48a186f57be0 Mon Sep 17 00:00:00 2001
From: Hal Goff <henry@tollitt.com>
Date: Fri, 9 Oct 2026 17:19:26 +0100
Subject: [PATCH 082/149] Never crash: fall back to OpenGL when wgpu can't
 start (#461, #435, #392) (#530)

When wgpu can't get a GPU device or surface (old Intel Macs, some Windows
drivers), run_native returned an error and PdfCraft quit before showing a
window. Now, when wgpu fails while starting (eframe::Error::Wgpu, before the
app is created), the error is logged and the app starts again on eframe's
OpenGL (glow) renderer, which the web build already uses.

- PDFCRAFT_RENDERER=gl (opengl, glow) starts on OpenGL; =wgpu never falls
  back; unset or anything else tries wgpu, then OpenGL.
- Window and app set-up move into native_options/app_creator so the second
  run starts exactly like the first; eframe reuses its event loop.
- Page rasters and their tiled backdrop stay within the GPU's
  max_texture_side (OpenGL can report 2048; an oversized upload aborts).


Claude-Session: https://claude.ai/code/session_01VNJqS2dEQawHJn1qTRJiKp

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/pdfcraft/Cargo.toml     |   4 +-
 apps/pdfcraft/src/main.rs    | 242 +++++++++++++++++++++++++----------
 crates/ui-egui/src/canvas.rs |   7 +-
 3 files changed, 181 insertions(+), 72 deletions(-)

diff --git a/apps/pdfcraft/Cargo.toml b/apps/pdfcraft/Cargo.toml
index 78d9fb5c..2400fe9e 100644
--- a/apps/pdfcraft/Cargo.toml
+++ b/apps/pdfcraft/Cargo.toml
@@ -14,7 +14,9 @@ workspace = true
 ureq = { version = "3.4", default-features = false, features = ["rustls-no-provider", "_ring"] }
 rustls-native-certs = "0.8"
 pdfcraft-ui-egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "persistence", "links"] }
+# wgpu draws; OpenGL (glow) is the fallback when wgpu can't start on an old or unusual GPU or
+# driver (#461, #435, #392), and can be chosen with PDFCRAFT_RENDERER=gl.
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "glow", "accesskit", "wayland", "x11", "persistence", "links"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 # Records from every crate go to standard error and the log file (src/logging.rs).
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index de88d640..3509a7dc 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -19,6 +19,9 @@
 #![cfg_attr(all(windows, not(debug_assertions)), windows_subsystem = "windows")]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+use std::cell::Cell;
+use std::rc::Rc;
+
 use pdfcraft_ui_egui::PdfCraftApp;
 
 #[cfg(target_os = "macos")]
@@ -150,6 +153,85 @@ fn main() -> eframe::Result {
         }
     }
     let integrated = cfg!(target_os = "macos");
+    migrate_legacy_folders();
+    // The log file lives in the settings folder; opened after the arguments (so `--version` leaves
+    // no file behind) and after the PrintCraft migration (which a fresh folder would block).
+    // Records logged until now are written to it first.
+    if let (Some(logger), Some(dir)) = (logger, settings_dir()) {
+        match logger.attach_dir(&dir.join("logs")) {
+            Ok(path) => log::info!("PdfCraft {}, log file {}", env!("CARGO_PKG_VERSION"), path.display()),
+            // Standard error only by now (`attach_dir` gave up on the file); unlike `eprintln!`, never panics.
+            Err(e) => log::warn!("no log file: {e}"),
+        }
+    }
+    let choice = renderer_choice(std::env::var("PDFCRAFT_RENDERER").ok().as_deref());
+    let launch = Launch { files, options, control_file, create_images, integrated };
+    // Finder, Open With and the Dock deliver files as Apple events, not arguments; catch the one
+    // that launched us as well as later ones. Lives until the event loop returns.
+    #[cfg(target_os = "macos")]
+    let apple_events = apple_events::AppleEvents::install();
+    // Set once the app is created, which is after the renderer has started.
+    let started = Rc::new(Cell::new(false));
+    let first = if choice == RendererChoice::Gl { eframe::Renderer::Glow } else { eframe::Renderer::Wgpu };
+    let result = eframe::run_native(
+        "PdfCraft",
+        native_options(integrated, first),
+        app_creator(
+            launch.clone(),
+            Rc::clone(&started),
+            #[cfg(target_os = "macos")]
+            &apple_events,
+        ),
+    );
+    match result {
+        // Only a renderer that couldn't start: without a window or display at all, OpenGL can't
+        // help either, and winit's own error says more.
+        Err(e @ eframe::Error::Wgpu(_)) if retry_with_gl(choice, started.get()) => {
+            // Old or unusual GPUs and drivers (#461, #435, #392) can't give wgpu a device; OpenGL
+            // usually still works there, so that's better than quitting.
+            log::error!("the GPU renderer (wgpu) didn't start: {e}. Starting with OpenGL instead; set PDFCRAFT_RENDERER=gl to skip wgpu.");
+            eframe::run_native(
+                "PdfCraft",
+                native_options(integrated, eframe::Renderer::Glow),
+                app_creator(
+                    launch,
+                    started,
+                    #[cfg(target_os = "macos")]
+                    &apple_events,
+                ),
+            )
+        }
+        other => other,
+    }
+}
+
+/// Which renderer to start with, from `PDFCRAFT_RENDERER`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum RendererChoice {
+    /// wgpu, then OpenGL if wgpu can't start (unset, or anything unrecognised).
+    Auto,
+    /// wgpu only (`wgpu`): a failure is reported, not worked around.
+    Wgpu,
+    /// OpenGL only (`gl`, `opengl` or `glow`): for drivers where wgpu starts but misbehaves.
+    Gl,
+}
+
+fn renderer_choice(value: Option<&str>) -> RendererChoice {
+    match value.map(|v| v.trim().to_ascii_lowercase()).as_deref() {
+        Some("wgpu") => RendererChoice::Wgpu,
+        Some("gl" | "opengl" | "glow") => RendererChoice::Gl,
+        _ => RendererChoice::Auto,
+    }
+}
+
+/// Whether a failed run should be retried with OpenGL: only when wgpu was tried first by choice of
+/// nobody, and it failed before the app was created (so while starting the renderer, not later).
+fn retry_with_gl(choice: RendererChoice, app_started: bool) -> bool {
+    choice == RendererChoice::Auto && !app_started
+}
+
+/// The window and renderer settings for one run.
+fn native_options(integrated: bool, renderer: eframe::Renderer) -> eframe::NativeOptions {
     let mut viewport = egui::ViewportBuilder::default()
         .with_title("PdfCraft")
         .with_inner_size([1440.0, 920.0])
@@ -165,80 +247,82 @@ fn main() -> eframe::Result {
     if integrated {
         viewport = viewport.with_fullsize_content_view(true).with_titlebar_shown(false).with_title_shown(false);
     }
-    migrate_legacy_folders();
-    // The log file lives in the settings folder; opened after the arguments (so `--version` leaves
-    // no file behind) and after the PrintCraft migration (which a fresh folder would block).
-    // Records logged until now are written to it first.
-    if let (Some(logger), Some(dir)) = (logger, settings_dir()) {
-        match logger.attach_dir(&dir.join("logs")) {
-            Ok(path) => log::info!("PdfCraft {}, log file {}", env!("CARGO_PKG_VERSION"), path.display()),
-            // Standard error only by now (`attach_dir` gave up on the file); unlike `eprintln!`, never panics.
-            Err(e) => log::warn!("no log file: {e}"),
-        }
-    }
     let persistence_path = settings_dir().map(|d| d.join("app.ron"));
-    let mut native = eframe::NativeOptions { viewport, persistence_path, ..Default::default() };
-    configure_gpu(&mut native);
-    // Finder, Open With and the Dock deliver files as Apple events, not arguments; catch the one
-    // that launched us as well as later ones. Lives until the event loop returns.
-    #[cfg(target_os = "macos")]
-    let apple_events = apple_events::AppleEvents::install();
-    #[cfg(target_os = "macos")]
-    let apple_events = &apple_events;
-    eframe::run_native(
-        "PdfCraft",
-        native,
-        Box::new(move |cc| {
-            let mut app = PdfCraftApp::new();
-            if let Some(json) = cc.storage.and_then(|s| s.get_string("pdfcraft").or_else(|| s.get_string(LEGACY_STORAGE_KEY))) {
-                app.restore(&json);
+    // Set explicitly, so the renderer never depends on which one eframe defaults to.
+    let mut native = eframe::NativeOptions { viewport, persistence_path, renderer, ..Default::default() };
+    if renderer == eframe::Renderer::Wgpu {
+        configure_gpu(&mut native);
+    }
+    native
+}
+
+/// What the command line asked for, kept so a second run (with OpenGL) can start the same way.
+#[derive(Clone)]
+struct Launch {
+    files: Vec<String>,
+    options: Vec<(String, String)>,
+    control_file: Option<String>,
+    create_images: bool,
+    integrated: bool,
+}
+
+fn app_creator<'a>(
+    launch: Launch,
+    started: Rc<Cell<bool>>,
+    #[cfg(target_os = "macos")] apple_events: &'a apple_events::AppleEvents,
+) -> eframe::AppCreator<'a> {
+    let Launch { files, options, control_file, create_images, integrated } = launch;
+    Box::new(move |cc| {
+        started.set(true);
+        let mut app = PdfCraftApp::new();
+        if let Some(json) = cc.storage.and_then(|s| s.get_string("pdfcraft").or_else(|| s.get_string(LEGACY_STORAGE_KEY))) {
+            app.restore(&json);
+        }
+        app.integrated_titlebar = integrated;
+        app.update_source = Some(std::sync::Arc::new(updates::latest_release));
+        app.os_key_store_ids = cfg!(any(target_os = "macos", target_os = "windows"));
+        #[cfg(target_os = "macos")]
+        {
+            app.os_events = Some(apple_events.connect(&cc.egui_ctx));
+        }
+        if let Some(file) = &control_file {
+            let client = app.attach_control(&cc.egui_ctx);
+            match pdfcraft_ui_egui::control::serve(client).and_then(|ep| write_control_file(file, ep.port, &ep.token).map(|()| ep.port)) {
+                // Never the token (AGENTS.md §3): it stays in the owner-only file.
+                Ok(port) => log::info!("UI control channel on 127.0.0.1:{port} (connection details in {file})"),
+                Err(e) => log::error!("--control {file}: {e}"),
             }
-            app.integrated_titlebar = integrated;
-            app.update_source = Some(std::sync::Arc::new(updates::latest_release));
-            app.os_key_store_ids = cfg!(any(target_os = "macos", target_os = "windows"));
-            #[cfg(target_os = "macos")]
-            {
-                app.os_events = Some(apple_events.connect(&cc.egui_ctx));
+        }
+        // Autosave unsaved changes; offer to recover documents a crashed session left behind.
+        if let Some(dir) = pdfcraft_ui_egui::RecoveryStore::default_dir() {
+            app.enable_recovery(pdfcraft_ui_egui::RecoveryStore::new(dir));
+        }
+        // A portable marker whose data folder can't be written (#157): say where settings went.
+        if let Some(w) = &pdfcraft_ui_egui::portable::current().unwritable {
+            app.notify_fmt(
+                "Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.",
+                &[("folder", &w.folder.display().to_string()), ("error", &w.error)],
+            );
+        }
+        if create_images {
+            if let Err(e) = app.begin_image_import_paths(&files) {
+                app.notify(e);
             }
-            if let Some(file) = &control_file {
-                let client = app.attach_control(&cc.egui_ctx);
-                match pdfcraft_ui_egui::control::serve(client).and_then(|ep| write_control_file(file, ep.port, &ep.token).map(|()| ep.port)) {
-                    // Never the token (AGENTS.md §3): it stays in the owner-only file.
-                    Ok(port) => log::info!("UI control channel on 127.0.0.1:{port} (connection details in {file})"),
-                    Err(e) => log::error!("--control {file}: {e}"),
-                }
+        } else {
+            // With the preference on, last session's files come back first; files named on
+            // the command line open after them, in front (#442).
+            app.reopen_last_files(&files);
+            for f in files {
+                app.open_path(&f);
             }
-            // Autosave unsaved changes; offer to recover documents a crashed session left behind.
-            if let Some(dir) = pdfcraft_ui_egui::RecoveryStore::default_dir() {
-                app.enable_recovery(pdfcraft_ui_egui::RecoveryStore::new(dir));
+        }
+        for (k, v) in options {
+            if let Err(e) = app.set_option(&k, &v) {
+                log::warn!("--{k} {v}: {e}");
             }
-            // A portable marker whose data folder can't be written (#157): say where settings went.
-            if let Some(w) = &pdfcraft_ui_egui::portable::current().unwritable {
-                app.notify_fmt(
-                    "Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.",
-                    &[("folder", &w.folder.display().to_string()), ("error", &w.error)],
-                );
-            }
-            if create_images {
-                if let Err(e) = app.begin_image_import_paths(&files) {
-                    app.notify(e);
-                }
-            } else {
-                // With the preference on, last session's files come back first; files named on
-                // the command line open after them, in front (#442).
-                app.reopen_last_files(&files);
-                for f in files {
-                    app.open_path(&f);
-                }
-            }
-            for (k, v) in options {
-                if let Err(e) = app.set_option(&k, &v) {
-                    log::warn!("--{k} {v}: {e}");
-                }
-            }
-            Ok(Box::new(app))
-        }),
-    )
+        }
+        Ok(Box::new(app))
+    })
 }
 
 /// Write the control endpoint so that only the current user can read the token.
@@ -434,6 +518,26 @@ mod tests {
         assert_eq!(super::path_from_arg("file://".to_string()), "file://");
     }
 
+    #[test]
+    fn opengl_is_the_fallback_unless_a_renderer_was_chosen() {
+        use super::{RendererChoice, native_options, renderer_choice, retry_with_gl};
+        assert_eq!(renderer_choice(None), RendererChoice::Auto);
+        assert_eq!(renderer_choice(Some("")), RendererChoice::Auto);
+        assert_eq!(renderer_choice(Some("vulkan")), RendererChoice::Auto);
+        assert_eq!(renderer_choice(Some(" WGPU ")), RendererChoice::Wgpu);
+        for gl in ["gl", "OpenGL", "glow"] {
+            assert_eq!(renderer_choice(Some(gl)), RendererChoice::Gl);
+        }
+        // Retried with OpenGL only when wgpu failed to start by default, never after the app ran.
+        assert!(retry_with_gl(RendererChoice::Auto, false));
+        assert!(!retry_with_gl(RendererChoice::Auto, true));
+        assert!(!retry_with_gl(RendererChoice::Wgpu, false));
+        assert!(!retry_with_gl(RendererChoice::Gl, false));
+        // Each run states its renderer rather than relying on eframe's default.
+        assert_eq!(native_options(false, eframe::Renderer::Wgpu).renderer, eframe::Renderer::Wgpu);
+        assert_eq!(native_options(false, eframe::Renderer::Glow).renderer, eframe::Renderer::Glow);
+    }
+
     #[test]
     fn gpu_backends_avoid_vulkan_on_windows_and_prefer_low_power() {
         let mut native = eframe::NativeOptions::default();
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 5bca9d99..ac94f775 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1567,10 +1567,13 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 painter.galley(pos2(r.center().x - msg.size().x / 2.0, r.center().y), msg, Color32::BLACK);
             } else {
                 let (pw_pt, ph_pt) = (info.pages[i].width.max(1.0), info.pages[i].height.max(1.0));
-                let tiled = pw_pt.max(ph_pt) * scale > TILE_THRESHOLD;
+                // A GPU may take smaller textures than these (OpenGL drivers report as little as
+                // 2048 pixels, and uploading a bigger one aborts), so both stay within its limit.
+                let max_side = ui.ctx().input(|inp| inp.max_texture_side) as f32;
+                let tiled = pw_pt.max(ph_pt) * scale > TILE_THRESHOLD.min(max_side);
                 // Whole-page raster: sharp when small, a low-res backdrop when tiled.
                 let (want_scale, want_tag) = if tiled {
-                    let bs = BASE_SIDE / pw_pt.max(ph_pt);
+                    let bs = BASE_SIDE.min(max_side) / pw_pt.max(ph_pt);
                     (bs, scale_tag(bs))
                 } else {
                     (scale, tag)

From 5deb42199ce3a475188787aa9682de982f5985ab Mon Sep 17 00:00:00 2001
From: LloydNicholson <34131158+LloydNicholson@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:19:31 +0200
Subject: [PATCH 083/149] Issue #537: pdfcraft-cli --help prints the full usage
 (#540)

The per-command options lived only in main.rs's doc header, so a packaged
binary had no way to show them. They move into a USAGE constant (one copy,
no drift) that `--help`, `-h`, `help` and `<command> --help` print to stdout,
exiting 0. No command prints the usage to stderr and fails; an unknown
command is named and points to --help.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/pdfcraft-cli/src/main.rs   | 84 ++++++++++++++++++---------------
 apps/pdfcraft-cli/tests/help.rs | 44 +++++++++++++++++
 2 files changed, 90 insertions(+), 38 deletions(-)
 create mode 100644 apps/pdfcraft-cli/tests/help.rs

diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index 3fe28824..e3f1c7a3 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -1,23 +1,6 @@
 //! pdfcraft-cli — headless PdfCraft.
 //!
-//! ```text
-//! pdfcraft-cli info   <file.pdf> [--password PW]            document summary as JSON
-//! pdfcraft-cli render <file.pdf> --page N [--dpi 96] --out x.png   (.png, .jpg, .tif or .pam)
-//! pdfcraft-cli text   <file.pdf> [--page N]                  extracted text (pages separated by form feeds)
-//! pdfcraft-cli edit   <in.pdf> --out out.pdf [--rotate 1,3:90] [--delete 2,4] [--move 5:1]
-//!                       [--insert-blank 1] [--title T] [--author A] [--full]
-//! pdfcraft-cli combine <a.pdf> <b.pdf> … --out combined.pdf
-//! pdfcraft-cli extract <in.pdf> --pages 1,3,5 --out out.pdf
-//! pdfcraft-cli split   <in.pdf> (--every N | --before 3,7) [--out-dir DIR]
-//! pdfcraft-cli check  <files or dirs…> [--timeout 20] [--dpi 36] [--json out.json]
-//! pdfcraft-cli tools                                       automation tools and their JSON Schemas
-//! pdfcraft-cli run    <tool> [key=value …] [--root DIR] [--out image.png]
-//! pdfcraft-cli run    --script steps.json [--root DIR]      [{"tool": "doc_open", "args": {…}}, …]
-//! pdfcraft-cli mcp    [--root DIR] [--compact]              MCP server on stdin/stdout (opt-in)
-//!                                                            --compact lists a core set of tools plus tool_search and tool_call
-//! pdfcraft-cli ui     --control FILE <method> [key=value …] [--out shot.png]
-//!                                                            drive a running app started with --control FILE
-//! ```
+//! Usage: `pdfcraft-cli --help`, which prints `USAGE` below.
 //!
 //! `run` and `mcp` drive the same tool table (`pdfcraft-automation`). In `run`, values parse as
 //! JSON when they can (`pages=[1,3]`, `degrees=90`) and are strings otherwise. A script runs its
@@ -43,28 +26,53 @@ use std::time::{Duration, Instant};
 use pdfcraft_engine::export::ImageFormat;
 use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind, inspect};
 
+/// The full usage, printed by `--help` (also after a command, e.g. `render --help`).
+const USAGE: &str = "\
+pdfcraft-cli info   <file.pdf> [--password PW]            document summary as JSON
+pdfcraft-cli render <file.pdf> --page N [--dpi 96] --out x.png   (.png, .jpg, .tif or .pam)
+pdfcraft-cli text   <file.pdf> [--page N]                  extracted text (pages separated by form feeds)
+pdfcraft-cli edit   <in.pdf> --out out.pdf [--rotate 1,3:90] [--delete 2,4] [--move 5:1]
+                      [--insert-blank 1] [--title T] [--author A] [--full]
+pdfcraft-cli combine <a.pdf> <b.pdf> … --out combined.pdf
+pdfcraft-cli extract <in.pdf> --pages 1,3,5 --out out.pdf
+pdfcraft-cli split   <in.pdf> (--every N | --before 3,7) [--out-dir DIR]
+pdfcraft-cli check  <files or dirs…> [--timeout 20] [--dpi 36] [--json out.json]
+pdfcraft-cli tools                                       automation tools and their JSON Schemas
+pdfcraft-cli run    <tool> [key=value …] [--root DIR] [--out image.png]
+pdfcraft-cli run    --script steps.json [--root DIR]      [{\"tool\": \"doc_open\", \"args\": {…}}, …]
+pdfcraft-cli mcp    [--root DIR] [--compact]              MCP server on stdin/stdout (opt-in)
+                                                           --compact lists a core set of tools plus tool_search and tool_call
+pdfcraft-cli ui     --control FILE <method> [key=value …] [--out shot.png]
+                                                           drive a running app started with --control FILE
+help and feedback: https://discord.gg/artcraft";
+
 fn main() -> ExitCode {
     let args: Vec<String> = std::env::args().skip(1).collect();
-    let result =
-        match args.first().map(String::as_str) {
-            Some("info") => info(&args[1..]),
-            Some("render") => render(&args[1..]),
-            Some("text") => text(&args[1..]),
-            Some("edit") => edit(&args[1..]),
-            Some("combine") => combine(&args[1..]),
-            Some("extract") => extract(&args[1..]),
-            Some("split") => split(&args[1..]),
-            Some("check") => check(&args[1..]),
-            Some("check-one") => check_one(&args[1..]),
-            Some("tools") => tools(),
-            Some("run") => run(&args[1..]),
-            Some("ui") => ui(&args[1..]),
-            #[cfg(feature = "mcp")]
-            Some("mcp") => mcp(&args[1..]),
-            Some("--version") => version(),
-            _ => Err("usage: pdfcraft-cli <info|render|text|edit|combine|extract|split|check|tools|run|mcp|ui> …  (see source header for options)\nhelp and feedback: https://discord.gg/artcraft"
-                .into()),
-        };
+    // `<command> --help` too; only right after the command, so a later `-h` (a value) still reaches it.
+    let command = match args.get(1).map(String::as_str) {
+        Some("--help" | "-h") => Some("--help"),
+        _ => args.first().map(String::as_str),
+    };
+    let result = match command {
+        Some("--help" | "-h" | "help") => stdout_line(format_args!("{USAGE}")),
+        None => Err(format!("usage:\n{USAGE}").into()),
+        Some("info") => info(&args[1..]),
+        Some("render") => render(&args[1..]),
+        Some("text") => text(&args[1..]),
+        Some("edit") => edit(&args[1..]),
+        Some("combine") => combine(&args[1..]),
+        Some("extract") => extract(&args[1..]),
+        Some("split") => split(&args[1..]),
+        Some("check") => check(&args[1..]),
+        Some("check-one") => check_one(&args[1..]),
+        Some("tools") => tools(),
+        Some("run") => run(&args[1..]),
+        Some("ui") => ui(&args[1..]),
+        #[cfg(feature = "mcp")]
+        Some("mcp") => mcp(&args[1..]),
+        Some("--version") => version(),
+        Some(other) => Err(format!("unknown command '{other}'; see pdfcraft-cli --help").into()),
+    };
     match result {
         Ok(()) => ExitCode::SUCCESS,
         Err(CliError::Stdout(e)) if e.kind() == std::io::ErrorKind::BrokenPipe => ExitCode::SUCCESS,
diff --git a/apps/pdfcraft-cli/tests/help.rs b/apps/pdfcraft-cli/tests/help.rs
new file mode 100644
index 00000000..3a124322
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/help.rs
@@ -0,0 +1,44 @@
+//! `--help` prints the full usage to stdout and succeeds; a missing or unknown command fails with
+//! the usage (or a pointer to `--help`) on stderr.
+
+use std::process::{Command, Output};
+
+const BIN: &str = env!("CARGO_BIN_EXE_pdfcraft-cli");
+
+fn run(args: &[&str]) -> Output {
+    Command::new(BIN).args(args).output().unwrap()
+}
+
+fn text(bytes: &[u8]) -> String {
+    String::from_utf8_lossy(bytes).into_owned()
+}
+
+#[test]
+fn help_flags_print_full_usage_to_stdout() {
+    for args in [&["--help"][..], &["-h"], &["help"], &["render", "--help"], &["check", "-h"]] {
+        let out = run(args);
+        assert!(out.status.success(), "{args:?} exited {:?}", out.status);
+        let stdout = text(&out.stdout);
+        // Per-command options, not just the command list.
+        assert!(stdout.contains("pdfcraft-cli render <file.pdf> --page N"), "{args:?}: {stdout}");
+        assert!(stdout.contains("--every N"), "{args:?}: {stdout}");
+        assert!(out.stderr.is_empty(), "{args:?}: {}", text(&out.stderr));
+    }
+}
+
+#[test]
+fn no_command_fails_with_usage_on_stderr() {
+    let out = run(&[]);
+    assert!(!out.status.success());
+    assert!(out.stdout.is_empty());
+    assert!(text(&out.stderr).contains("pdfcraft-cli render <file.pdf> --page N"));
+}
+
+#[test]
+fn unknown_command_names_it_and_points_to_help() {
+    let out = run(&["frobnicate"]);
+    assert!(!out.status.success());
+    let stderr = text(&out.stderr);
+    assert!(stderr.contains("unknown command 'frobnicate'"), "{stderr}");
+    assert!(stderr.contains("pdfcraft-cli --help"), "{stderr}");
+}

From d9047d4d5b8cf6db63b68f2ed7e75be3acf287e7 Mon Sep 17 00:00:00 2001
From: martinjohuber <106869689+martinjohuber@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:19:36 +0200
Subject: [PATCH 084/149] Forms: radio groups and check boxes accept their /Opt
 export values (#532)

pdf-lib and other writers give radio groups and check boxes an /Opt array
(PDF 1.4, one export value per widget) and name the on states by position
(/0, /1 ...). Filling such a field by its export value ("Pick-up") failed with
"has no option", and form_fields listed the options as 0, 1.

- Field::export_of / state_for / export_for_state map between a widget, its
  /Opt export value and its on-state name; fields without /Opt are unchanged
- set_value accepts an export value for radio groups and check boxes; the
  "has no option" error lists the export values
- form_fields reports a radio group's options and selected value as export
  values
- Test: opt_export_values_select_button_states

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/forms.rs |  3 ++-
 crates/forms/src/lib.rs        | 35 ++++++++++++++++++++++++++++--
 crates/forms/src/tests.rs      | 39 ++++++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+), 3 deletions(-)

diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 0203934b..4775bed2 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -189,6 +189,7 @@ impl Automation {
                     "value": match f.kind {
                         FormFieldKind::CheckBox => json!(!f.value.is_empty()),
                         FormFieldKind::List if f.has(field_flags::MULTI_SELECT) => json!(f.value),
+                        FormFieldKind::Radio => json!(f.value.first().map(|v| f.export_for_state(v))),
                         _ => json!(f.value.first()),
                     },
                     "page": w.and_then(|w| w.page).map(|p| p + 1),
@@ -225,7 +226,7 @@ impl Automation {
                 }
                 match f.kind {
                     FormFieldKind::Radio => {
-                        o.insert("options".into(), json!(f.widgets.iter().filter_map(|w| w.on_state.clone()).collect::<Vec<_>>()));
+                        o.insert("options".into(), json!((0..f.widgets.len()).filter_map(|i| f.export_of(i)).collect::<Vec<_>>()));
                     }
                     FormFieldKind::Combo | FormFieldKind::List => {
                         o.insert("options".into(), f.options.iter().map(|(e, d)| json!({ "value": e, "label": d })).collect());
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index 41ce2198..8d99b62c 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -144,6 +144,35 @@ impl Field {
         self.widgets.iter().any(|w| w.locked)
     }
 
+    /// Check boxes and radio groups with `/Opt` (PDF 1.4): one export value per widget, in widget
+    /// order. Their on states are then often just positions (`/0`, `/1` …), as pdf-lib writes them.
+    fn button_exports(&self) -> Option<&[(String, String)]> {
+        (matches!(self.kind, FieldKind::CheckBox | FieldKind::Radio) && !self.options.is_empty() && self.options.len() == self.widgets.len())
+            .then_some(self.options.as_slice())
+    }
+
+    /// The export value of widget `i` of a check box or radio group: its `/Opt` entry when the
+    /// field has one per widget, otherwise the widget's on-state name.
+    pub fn export_of(&self, i: usize) -> Option<&str> {
+        let on = self.widgets.get(i)?.on_state.as_deref()?;
+        Some(self.button_exports().and_then(|o| o.get(i)).map_or(on, |(e, _)| e.as_str()))
+    }
+
+    /// The on-state name that selects `choice` in a check box or radio group, where `choice` is an
+    /// on-state name or an export value from `/Opt`.
+    pub fn state_for(&self, choice: &str) -> Option<&str> {
+        self.widgets.iter().filter_map(|w| w.on_state.as_deref()).find(|s| *s == choice).or_else(|| {
+            let i = (0..self.widgets.len()).find(|&i| self.export_of(i) == Some(choice))?;
+            self.widgets.get(i)?.on_state.as_deref()
+        })
+    }
+
+    /// The export value for an on-state name such as the field's value; the name itself when the
+    /// field has no `/Opt`.
+    pub fn export_for_state<'a>(&'a self, state: &'a str) -> &'a str {
+        self.widgets.iter().position(|w| w.on_state.as_deref() == Some(state)).and_then(|i| self.export_of(i)).unwrap_or(state)
+    }
+
     /// The value as one string: text, the state name, or the selected display texts.
     pub fn display_value(&self) -> String {
         match self.kind {
@@ -780,7 +809,7 @@ fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut
                 // The on-state name or a yes/no word also work (agents, FDF-style data).
                 FieldValue::Text(t) | FieldValue::Radio(Some(t)) => {
                     let t = t.trim();
-                    if t == state || ["yes", "true", "on", "1", "x", "checked"].contains(&t.to_lowercase().as_str()) {
+                    if t == state || f.state_for(t).is_some() || ["yes", "true", "on", "1", "x", "checked"].contains(&t.to_lowercase().as_str()) {
                         true
                     } else if t.is_empty() || ["no", "false", "off", "0", "unchecked"].contains(&t.to_lowercase().as_str()) {
                         false
@@ -801,10 +830,12 @@ fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut
                 FieldValue::Check(false) => None,
                 _ => return invalid(format!("{:?} is a radio group: choose one of its options", f.name)),
             };
+            // An export value from /Opt selects its widget's on state.
+            let choice = choice.map(|c| f.state_for(&c).map(str::to_owned).unwrap_or(c));
             if let Some(c) = &choice
                 && !f.widgets.iter().any(|w| w.on_state.as_deref() == Some(c.as_str()))
             {
-                let opts: Vec<&str> = f.widgets.iter().filter_map(|w| w.on_state.as_deref()).collect();
+                let opts: Vec<&str> = (0..f.widgets.len()).filter_map(|i| f.export_of(i)).collect();
                 return invalid(format!("{:?} has no option {c:?} (options: {})", f.name, opts.join(", ")));
             }
             if choice.is_none() && f.has(flags::NO_TOGGLE_TO_OFF) && !f.value.is_empty() {
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 8cdc8d37..38fcfd8d 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -36,6 +36,11 @@ fn fixture() -> Document {
         "<< /Type /Annot /Subtype /Widget /FT /Btn /T (go) /Ff 65536 /Rect [300 450 380 470] /P 3 0 R >>".into(), // 25
         "<< /Type /Annot /Subtype /Widget /FT /Btn /T (bare) /Rect [400 700 415 715] /P 3 0 R /Foo (kept) >>".into(), // 26 check box without AP
     ];
+    document(&objs)
+}
+
+/// A PDF of the given objects (numbered from 1).
+fn document(objs: &[String]) -> Document {
     let mut out = b"%PDF-1.7\n".to_vec();
     let mut offsets = Vec::new();
     for (i, o) in objs.iter().enumerate() {
@@ -90,6 +95,40 @@ fn the_field_tree_is_read_with_inheritance() {
     assert_eq!(field(&all, "address.city").quadding, 1);
 }
 
+/// pdf-lib and other writers give radio groups and check boxes an `/Opt` array and name the on
+/// states by position (`/0`, `/1`): the export values select them, as in Acrobat.
+#[test]
+fn opt_export_values_select_button_states() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),                                                // 1
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),                                 // 2
+        "<< /Type /Page /Parent 2 0 R /Annots [6 0 R 7 0 R 8 0 R] >>".into(),                                       // 3
+        "<< /Fields [5 0 R 8 0 R] /DA (/Helv 0 Tf 0 g) >>".into(),                                                 // 4
+        "<< /FT /Btn /T (ship) /Ff 49152 /Opt [(Post) (Pick-up)] /V /Off /Kids [6 0 R 7 0 R] >>".into(),            // 5 radio
+        "<< /Type /Annot /Subtype /Widget /Parent 5 0 R /AS /Off /Rect [100 700 115 715] /P 3 0 R /AP << /N << /0 9 0 R /Off 10 0 R >> >> >>".into(), // 6
+        "<< /Type /Annot /Subtype /Widget /Parent 5 0 R /AS /Off /Rect [200 700 215 715] /P 3 0 R /AP << /N << /1 9 0 R /Off 10 0 R >> >> >>".into(), // 7
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (terms) /Opt [(Accepted)] /V /Off /AS /Off /Rect [100 650 115 665] /P 3 0 R /AP << /N << /0 9 0 R /Off 10 0 R >> >> >>".into(), // 8 check box
+        "<< /Length 0 >>\nstream\n\nendstream".into(),                                                              // 9
+        "<< /Length 0 >>\nstream\n\nendstream".into(),                                                              // 10
+    ];
+    let mut doc = document(&objs);
+    let all = fields(&doc);
+    let ship = field(&all, "ship");
+    assert_eq!((0..2).map(|i| ship.export_of(i)).collect::<Vec<_>>(), [Some("Post"), Some("Pick-up")]);
+    assert_eq!((ship.state_for("Pick-up"), ship.state_for("1"), ship.state_for("Courier")), (Some("1"), Some("1"), None));
+    set_value(&mut doc, "ship", &FieldValue::Radio(Some("Pick-up".into()))).unwrap();
+    set_value(&mut doc, "terms", &FieldValue::Text("Accepted".into())).unwrap();
+    let mut doc = reopen(&doc);
+    let all = fields(&doc);
+    let ship = field(&all, "ship");
+    assert_eq!(ship.value, ["1"]);
+    assert_eq!(ship.export_for_state("1"), "Pick-up");
+    assert_eq!(ship.widgets.iter().map(|w| w.state.as_deref()).collect::<Vec<_>>(), [Some("Off"), Some("1")]);
+    assert_eq!(field(&all, "terms").value, ["0"]);
+    let err = set_value(&mut doc, "ship", &FieldValue::Radio(Some("Courier".into()))).unwrap_err();
+    assert!(err.to_string().contains("options: Post, Pick-up"), "{err}");
+}
+
 #[test]
 fn text_fields_get_new_appearances() {
     let mut doc = fixture();

From 24ba8385f89b3772a2eb4cad8787515527d374c8 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Sat, 10 Oct 2026 01:19:41 +0900
Subject: [PATCH 085/149] Issue #324: on Windows 11, a window dragged to
 another monitor takes its scale (#544)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Issue #324: vendor winit 0.30.13 as published

The crate as released on crates.io, without its asset files (docs/res/*.svg and
examples/data/*.png, AGENTS.md §1). Not used yet: the next commit patches it and
adds it to [patch.crates-io].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Issue #324: on Windows 11, a window dragged to another monitor takes its scale

winit 0.30.13 handles WM_DPICHANGED by checking that the new window rect is on
the monitor `MonitorFromWindow` names. During a drag that is still the monitor
being left, so winit nudged the window back onto it, which sent another
WM_DPICHANGED: the window grew and stayed on the wrong monitor at the wrong
scale. From Windows 11 (build 22000) on, apply the rect Windows suggests, as
winit master does since 488c036a (rust-windowing/winit#4341); no 0.30 release
has it. Windows 10 keeps the old adjustment, as on winit master.

The vendored copy goes in [patch.crates-io]; a test fails if winit resolves
from crates.io again or the vendored copy loses the patch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                    |    2 -
 Cargo.toml                                    |    1 +
 apps/pdfcraft/src/main.rs                     |   17 +
 vendor/README.md                              |    1 +
 vendor/winit/.cargo-ok                        |    1 +
 vendor/winit/.cargo_vcs_info.json             |    6 +
 vendor/winit/Cargo.lock                       | 2187 ++++++++++++++
 vendor/winit/Cargo.toml                       |  553 ++++
 vendor/winit/Cargo.toml.orig                  |  378 +++
 vendor/winit/FEATURES.md                      |  248 ++
 vendor/winit/LICENSE                          |  201 ++
 vendor/winit/README.md                        |   70 +
 vendor/winit/build.rs                         |   27 +
 vendor/winit/examples/child_window.rs         |   88 +
 vendor/winit/examples/control_flow.rs         |  148 +
 vendor/winit/examples/pump_events.rs          |   80 +
 vendor/winit/examples/run_on_demand.rs        |   99 +
 vendor/winit/examples/util/fill.rs            |  117 +
 vendor/winit/examples/util/tracing.rs         |   25 +
 vendor/winit/examples/window.rs               | 1110 +++++++
 vendor/winit/examples/x11_embed.rs            |   69 +
 vendor/winit/src/application.rs               |  339 +++
 vendor/winit/src/changelog/mod.rs             |   77 +
 vendor/winit/src/changelog/unreleased.md      |   41 +
 vendor/winit/src/changelog/v0.10.md           |   13 +
 vendor/winit/src/changelog/v0.11.md           |   27 +
 vendor/winit/src/changelog/v0.12.md           |    8 +
 vendor/winit/src/changelog/v0.13.md           |   20 +
 vendor/winit/src/changelog/v0.14.md           |   21 +
 vendor/winit/src/changelog/v0.15.md           |   42 +
 vendor/winit/src/changelog/v0.16.md           |   32 +
 vendor/winit/src/changelog/v0.17.md           |   23 +
 vendor/winit/src/changelog/v0.18.md           |   52 +
 vendor/winit/src/changelog/v0.19.md           |   27 +
 vendor/winit/src/changelog/v0.20.md           |  200 ++
 vendor/winit/src/changelog/v0.21.md           |   16 +
 vendor/winit/src/changelog/v0.22.md           |   37 +
 vendor/winit/src/changelog/v0.23.md           |   65 +
 vendor/winit/src/changelog/v0.24.md           |   28 +
 vendor/winit/src/changelog/v0.25.md           |   31 +
 vendor/winit/src/changelog/v0.26.md           |   36 +
 vendor/winit/src/changelog/v0.27.md           |  107 +
 vendor/winit/src/changelog/v0.28.md           |  100 +
 vendor/winit/src/changelog/v0.29.md           |  289 ++
 vendor/winit/src/changelog/v0.30.md           |  413 +++
 vendor/winit/src/changelog/v0.8.md            |   33 +
 vendor/winit/src/changelog/v0.9.md            |   22 +
 vendor/winit/src/cursor.rs                    |  263 ++
 vendor/winit/src/error.rs                     |  131 +
 vendor/winit/src/event.rs                     | 1183 ++++++++
 vendor/winit/src/event_loop.rs                |  651 ++++
 vendor/winit/src/icon.rs                      |  117 +
 vendor/winit/src/keyboard.rs                  | 1804 +++++++++++
 vendor/winit/src/lib.rs                       |  217 ++
 vendor/winit/src/monitor.rs                   |  167 +
 vendor/winit/src/platform/android.rs          |  188 ++
 vendor/winit/src/platform/ios.rs              |  435 +++
 vendor/winit/src/platform/macos.rs            |  531 ++++
 vendor/winit/src/platform/mod.rs              |   55 +
 .../winit/src/platform/modifier_supplement.rs |   35 +
 vendor/winit/src/platform/orbital.rs          |    6 +
 vendor/winit/src/platform/pump_events.rs      |  143 +
 vendor/winit/src/platform/run_on_demand.rs    |  111 +
 vendor/winit/src/platform/scancode.rs         |   50 +
 vendor/winit/src/platform/startup_notify.rs   |   99 +
 vendor/winit/src/platform/wayland.rs          |  131 +
 vendor/winit/src/platform/web.rs              |  465 +++
 vendor/winit/src/platform/windows.rs          |  767 +++++
 vendor/winit/src/platform/x11.rs              |  254 ++
 .../src/platform_impl/android/keycodes.rs     |  608 ++++
 vendor/winit/src/platform_impl/android/mod.rs | 1141 +++++++
 .../winit/src/platform_impl/ios/app_state.rs  |  925 ++++++
 .../winit/src/platform_impl/ios/event_loop.rs |  494 +++
 vendor/winit/src/platform_impl/ios/mod.rs     |   52 +
 vendor/winit/src/platform_impl/ios/monitor.rs |  277 ++
 .../platform_impl/ios/notification_center.rs  |   27 +
 vendor/winit/src/platform_impl/ios/view.rs    |  607 ++++
 .../src/platform_impl/ios/view_controller.rs  |  176 ++
 vendor/winit/src/platform_impl/ios/window.rs  |  750 +++++
 .../src/platform_impl/linux/common/mod.rs     |    1 +
 .../platform_impl/linux/common/xkb/compose.rs |  123 +
 .../platform_impl/linux/common/xkb/keymap.rs  | 1044 +++++++
 .../src/platform_impl/linux/common/xkb/mod.rs |  416 +++
 .../platform_impl/linux/common/xkb/state.rs   |  189 ++
 vendor/winit/src/platform_impl/linux/mod.rs   | 1044 +++++++
 .../linux/wayland/event_loop/mod.rs           |  810 +++++
 .../linux/wayland/event_loop/proxy.rs         |   28 +
 .../linux/wayland/event_loop/sink.rs          |   53 +
 .../src/platform_impl/linux/wayland/mod.rs    |   85 +
 .../src/platform_impl/linux/wayland/output.rs |  163 +
 .../linux/wayland/seat/keyboard/mod.rs        |  380 +++
 .../platform_impl/linux/wayland/seat/mod.rs   |  235 ++
 .../linux/wayland/seat/pointer/mod.rs         |  502 +++
 .../wayland/seat/pointer/relative_pointer.rs  |   83 +
 .../linux/wayland/seat/text_input/mod.rs      |  201 ++
 .../linux/wayland/seat/touch/mod.rs           |  220 ++
 .../src/platform_impl/linux/wayland/state.rs  |  435 +++
 .../linux/wayland/types/cursor.rs             |   59 +
 .../linux/wayland/types/kwin_blur.rs          |   68 +
 .../platform_impl/linux/wayland/types/mod.rs  |    7 +
 .../wayland/types/wp_fractional_scaling.rs    |   78 +
 .../linux/wayland/types/wp_viewporter.rs      |   65 +
 .../linux/wayland/types/xdg_activation.rs     |  103 +
 .../platform_impl/linux/wayland/window/mod.rs |  763 +++++
 .../linux/wayland/window/state.rs             | 1220 ++++++++
 .../src/platform_impl/linux/x11/activation.rs |  194 ++
 .../src/platform_impl/linux/x11/atoms.rs      |  117 +
 .../winit/src/platform_impl/linux/x11/dnd.rs  |  174 ++
 .../linux/x11/event_processor.rs              | 1883 ++++++++++++
 .../winit/src/platform_impl/linux/x11/ffi.rs  |    5 +
 .../platform_impl/linux/x11/ime/callbacks.rs  |  206 ++
 .../platform_impl/linux/x11/ime/context.rs    |  376 +++
 .../src/platform_impl/linux/x11/ime/inner.rs  |   74 +
 .../linux/x11/ime/input_method.rs             |  345 +++
 .../src/platform_impl/linux/x11/ime/mod.rs    |  233 ++
 .../winit/src/platform_impl/linux/x11/mod.rs  | 1064 +++++++
 .../src/platform_impl/linux/x11/monitor.rs    |  355 +++
 .../linux/x11/tests/xsettings.dat             |    1 +
 .../linux/x11/util/client_msg.rs              |   31 +
 .../platform_impl/linux/x11/util/cookie.rs    |   55 +
 .../platform_impl/linux/x11/util/cursor.rs    |  174 ++
 .../platform_impl/linux/x11/util/geometry.rs  |  265 ++
 .../src/platform_impl/linux/x11/util/hint.rs  |  169 ++
 .../src/platform_impl/linux/x11/util/icon.rs  |   36 +
 .../src/platform_impl/linux/x11/util/input.rs |  106 +
 .../src/platform_impl/linux/x11/util/keys.rs  |   75 +
 .../platform_impl/linux/x11/util/memory.rs    |   42 +
 .../src/platform_impl/linux/x11/util/mod.rs   |   77 +
 .../platform_impl/linux/x11/util/modifiers.rs |  187 ++
 .../src/platform_impl/linux/x11/util/mouse.rs |   49 +
 .../src/platform_impl/linux/x11/util/randr.rs |  186 ++
 .../linux/x11/util/window_property.rs         |  196 ++
 .../src/platform_impl/linux/x11/util/wm.rs    |  137 +
 .../platform_impl/linux/x11/util/xmodmap.rs   |   56 +
 .../src/platform_impl/linux/x11/window.rs     | 1938 ++++++++++++
 .../src/platform_impl/linux/x11/xdisplay.rs   |  356 +++
 .../src/platform_impl/linux/x11/xsettings.rs  |  325 ++
 vendor/winit/src/platform_impl/macos/app.rs   |  195 ++
 .../src/platform_impl/macos/app_state.rs      |  446 +++
 .../winit/src/platform_impl/macos/cursor.rs   |  225 ++
 vendor/winit/src/platform_impl/macos/event.rs |  616 ++++
 .../src/platform_impl/macos/event_handler.rs  |  139 +
 .../src/platform_impl/macos/event_loop.rs     |  523 ++++
 vendor/winit/src/platform_impl/macos/ffi.rs   |  256 ++
 vendor/winit/src/platform_impl/macos/menu.rs  |  107 +
 vendor/winit/src/platform_impl/macos/mod.rs   |   61 +
 .../winit/src/platform_impl/macos/monitor.rs  |  409 +++
 .../winit/src/platform_impl/macos/observer.rs |  312 ++
 vendor/winit/src/platform_impl/macos/util.rs  |   27 +
 vendor/winit/src/platform_impl/macos/view.rs  | 1142 +++++++
 .../winit/src/platform_impl/macos/window.rs   |  126 +
 .../platform_impl/macos/window_delegate.rs    | 1910 ++++++++++++
 vendor/winit/src/platform_impl/mod.rs         |   78 +
 .../src/platform_impl/orbital/event_loop.rs   |  829 +++++
 vendor/winit/src/platform_impl/orbital/mod.rs |  255 ++
 .../winit/src/platform_impl/orbital/window.rs |  509 ++++
 .../src/platform_impl/web/async/abortable.rs  |   96 +
 .../platform_impl/web/async/atomic_waker.rs   |   35 +
 .../src/platform_impl/web/async/channel.rs    |  113 +
 .../web/async/concurrent_queue.rs             |   52 +
 .../src/platform_impl/web/async/dispatcher.rs |  106 +
 .../winit/src/platform_impl/web/async/mod.rs  |   19 +
 .../src/platform_impl/web/async/notifier.rs   |   72 +
 .../src/platform_impl/web/async/waker.rs      |  131 +
 .../src/platform_impl/web/async/wrapper.rs    |   89 +
 vendor/winit/src/platform_impl/web/cursor.rs  |  730 +++++
 vendor/winit/src/platform_impl/web/device.rs  |    8 +
 vendor/winit/src/platform_impl/web/error.rs   |   10 +
 .../src/platform_impl/web/event_loop/mod.rs   |  119 +
 .../src/platform_impl/web/event_loop/proxy.rs |   29 +
 .../platform_impl/web/event_loop/runner.rs    |  808 +++++
 .../src/platform_impl/web/event_loop/state.rs |   18 +
 .../web/event_loop/window_target.rs           |  685 +++++
 .../winit/src/platform_impl/web/keyboard.rs   |  522 ++++
 .../src/platform_impl/web/main_thread.rs      |   96 +
 vendor/winit/src/platform_impl/web/mod.rs     |   50 +
 vendor/winit/src/platform_impl/web/monitor.rs |   53 +
 .../web/web_sys/animation_frame.rs            |   60 +
 .../src/platform_impl/web/web_sys/canvas.rs   |  565 ++++
 .../src/platform_impl/web/web_sys/event.rs    |  270 ++
 .../platform_impl/web/web_sys/event_handle.rs |   38 +
 .../platform_impl/web/web_sys/fullscreen.rs   |  103 +
 .../web/web_sys/intersection_handle.rs        |   33 +
 .../web/web_sys/media_query_handle.rs         |   48 +
 .../src/platform_impl/web/web_sys/mod.rs      |  233 ++
 .../src/platform_impl/web/web_sys/pointer.rs  |  244 ++
 .../web/web_sys/resize_scaling.rs             |  302 ++
 .../src/platform_impl/web/web_sys/schedule.rs |  342 +++
 .../src/platform_impl/web/web_sys/worker.js   |   10 +
 .../platform_impl/web/web_sys/worker.min.js   |    1 +
 vendor/winit/src/platform_impl/web/window.rs  |  477 +++
 .../src/platform_impl/windows/dark_mode.rs    |  171 ++
 .../src/platform_impl/windows/definitions.rs  |  148 +
 vendor/winit/src/platform_impl/windows/dpi.rs |  112 +
 .../src/platform_impl/windows/drop_handler.rs |  237 ++
 .../src/platform_impl/windows/event_loop.rs   | 2684 +++++++++++++++++
 .../windows/event_loop/runner.rs              |  406 +++
 .../winit/src/platform_impl/windows/icon.rs   |  265 ++
 vendor/winit/src/platform_impl/windows/ime.rs |  162 +
 .../src/platform_impl/windows/keyboard.rs     | 1243 ++++++++
 .../platform_impl/windows/keyboard_layout.rs  |  986 ++++++
 .../src/platform_impl/windows/minimal_ime.rs  |   67 +
 vendor/winit/src/platform_impl/windows/mod.rs |  196 ++
 .../src/platform_impl/windows/monitor.rs      |  256 ++
 .../src/platform_impl/windows/raw_input.rs    |  301 ++
 .../winit/src/platform_impl/windows/util.rs   |  280 ++
 .../winit/src/platform_impl/windows/window.rs | 1575 ++++++++++
 .../src/platform_impl/windows/window_state.rs |  545 ++++
 vendor/winit/src/utils.rs                     |   28 +
 vendor/winit/src/window.rs                    | 1876 ++++++++++++
 vendor/winit/tests/send_objects.rs            |   36 +
 vendor/winit/tests/serde_objects.rs           |   38 +
 vendor/winit/tests/sync_object.rs             |   28 +
 213 files changed, 64619 insertions(+), 2 deletions(-)
 create mode 100644 vendor/winit/.cargo-ok
 create mode 100644 vendor/winit/.cargo_vcs_info.json
 create mode 100644 vendor/winit/Cargo.lock
 create mode 100644 vendor/winit/Cargo.toml
 create mode 100644 vendor/winit/Cargo.toml.orig
 create mode 100644 vendor/winit/FEATURES.md
 create mode 100644 vendor/winit/LICENSE
 create mode 100644 vendor/winit/README.md
 create mode 100644 vendor/winit/build.rs
 create mode 100644 vendor/winit/examples/child_window.rs
 create mode 100644 vendor/winit/examples/control_flow.rs
 create mode 100644 vendor/winit/examples/pump_events.rs
 create mode 100644 vendor/winit/examples/run_on_demand.rs
 create mode 100644 vendor/winit/examples/util/fill.rs
 create mode 100644 vendor/winit/examples/util/tracing.rs
 create mode 100644 vendor/winit/examples/window.rs
 create mode 100644 vendor/winit/examples/x11_embed.rs
 create mode 100644 vendor/winit/src/application.rs
 create mode 100644 vendor/winit/src/changelog/mod.rs
 create mode 100644 vendor/winit/src/changelog/unreleased.md
 create mode 100644 vendor/winit/src/changelog/v0.10.md
 create mode 100644 vendor/winit/src/changelog/v0.11.md
 create mode 100644 vendor/winit/src/changelog/v0.12.md
 create mode 100644 vendor/winit/src/changelog/v0.13.md
 create mode 100644 vendor/winit/src/changelog/v0.14.md
 create mode 100644 vendor/winit/src/changelog/v0.15.md
 create mode 100644 vendor/winit/src/changelog/v0.16.md
 create mode 100644 vendor/winit/src/changelog/v0.17.md
 create mode 100644 vendor/winit/src/changelog/v0.18.md
 create mode 100644 vendor/winit/src/changelog/v0.19.md
 create mode 100644 vendor/winit/src/changelog/v0.20.md
 create mode 100644 vendor/winit/src/changelog/v0.21.md
 create mode 100644 vendor/winit/src/changelog/v0.22.md
 create mode 100644 vendor/winit/src/changelog/v0.23.md
 create mode 100644 vendor/winit/src/changelog/v0.24.md
 create mode 100644 vendor/winit/src/changelog/v0.25.md
 create mode 100644 vendor/winit/src/changelog/v0.26.md
 create mode 100644 vendor/winit/src/changelog/v0.27.md
 create mode 100644 vendor/winit/src/changelog/v0.28.md
 create mode 100644 vendor/winit/src/changelog/v0.29.md
 create mode 100644 vendor/winit/src/changelog/v0.30.md
 create mode 100644 vendor/winit/src/changelog/v0.8.md
 create mode 100644 vendor/winit/src/changelog/v0.9.md
 create mode 100644 vendor/winit/src/cursor.rs
 create mode 100644 vendor/winit/src/error.rs
 create mode 100644 vendor/winit/src/event.rs
 create mode 100644 vendor/winit/src/event_loop.rs
 create mode 100644 vendor/winit/src/icon.rs
 create mode 100644 vendor/winit/src/keyboard.rs
 create mode 100644 vendor/winit/src/lib.rs
 create mode 100644 vendor/winit/src/monitor.rs
 create mode 100644 vendor/winit/src/platform/android.rs
 create mode 100644 vendor/winit/src/platform/ios.rs
 create mode 100644 vendor/winit/src/platform/macos.rs
 create mode 100644 vendor/winit/src/platform/mod.rs
 create mode 100644 vendor/winit/src/platform/modifier_supplement.rs
 create mode 100644 vendor/winit/src/platform/orbital.rs
 create mode 100644 vendor/winit/src/platform/pump_events.rs
 create mode 100644 vendor/winit/src/platform/run_on_demand.rs
 create mode 100644 vendor/winit/src/platform/scancode.rs
 create mode 100644 vendor/winit/src/platform/startup_notify.rs
 create mode 100644 vendor/winit/src/platform/wayland.rs
 create mode 100644 vendor/winit/src/platform/web.rs
 create mode 100644 vendor/winit/src/platform/windows.rs
 create mode 100644 vendor/winit/src/platform/x11.rs
 create mode 100644 vendor/winit/src/platform_impl/android/keycodes.rs
 create mode 100644 vendor/winit/src/platform_impl/android/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/app_state.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/event_loop.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/monitor.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/notification_center.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/view.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/view_controller.rs
 create mode 100644 vendor/winit/src/platform_impl/ios/window.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/common/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/common/xkb/compose.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/common/xkb/keymap.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/common/xkb/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/common/xkb/state.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/event_loop/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/event_loop/proxy.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/event_loop/sink.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/output.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/seat/keyboard/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/seat/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/seat/pointer/relative_pointer.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/seat/text_input/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/seat/touch/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/state.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/types/cursor.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/types/kwin_blur.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/types/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/types/wp_fractional_scaling.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/types/wp_viewporter.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/types/xdg_activation.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/window/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/wayland/window/state.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/activation.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/atoms.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/dnd.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/event_processor.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/ffi.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/ime/callbacks.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/ime/context.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/ime/inner.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/ime/input_method.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/ime/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/monitor.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/tests/xsettings.dat
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/client_msg.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/cookie.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/cursor.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/geometry.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/hint.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/icon.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/input.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/keys.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/memory.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/modifiers.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/mouse.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/randr.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/window_property.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/wm.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/util/xmodmap.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/window.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/xdisplay.rs
 create mode 100644 vendor/winit/src/platform_impl/linux/x11/xsettings.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/app.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/app_state.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/cursor.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/event.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/event_handler.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/event_loop.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/ffi.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/menu.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/monitor.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/observer.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/util.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/view.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/window.rs
 create mode 100644 vendor/winit/src/platform_impl/macos/window_delegate.rs
 create mode 100644 vendor/winit/src/platform_impl/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/orbital/event_loop.rs
 create mode 100644 vendor/winit/src/platform_impl/orbital/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/orbital/window.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/abortable.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/atomic_waker.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/channel.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/concurrent_queue.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/dispatcher.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/notifier.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/waker.rs
 create mode 100644 vendor/winit/src/platform_impl/web/async/wrapper.rs
 create mode 100644 vendor/winit/src/platform_impl/web/cursor.rs
 create mode 100644 vendor/winit/src/platform_impl/web/device.rs
 create mode 100644 vendor/winit/src/platform_impl/web/error.rs
 create mode 100644 vendor/winit/src/platform_impl/web/event_loop/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/web/event_loop/proxy.rs
 create mode 100644 vendor/winit/src/platform_impl/web/event_loop/runner.rs
 create mode 100644 vendor/winit/src/platform_impl/web/event_loop/state.rs
 create mode 100644 vendor/winit/src/platform_impl/web/event_loop/window_target.rs
 create mode 100644 vendor/winit/src/platform_impl/web/keyboard.rs
 create mode 100644 vendor/winit/src/platform_impl/web/main_thread.rs
 create mode 100644 vendor/winit/src/platform_impl/web/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/web/monitor.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/animation_frame.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/canvas.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/event.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/event_handle.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/fullscreen.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/intersection_handle.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/media_query_handle.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/pointer.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/resize_scaling.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/schedule.rs
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/worker.js
 create mode 100644 vendor/winit/src/platform_impl/web/web_sys/worker.min.js
 create mode 100644 vendor/winit/src/platform_impl/web/window.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/dark_mode.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/definitions.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/dpi.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/drop_handler.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/event_loop.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/event_loop/runner.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/icon.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/ime.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/keyboard.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/keyboard_layout.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/minimal_ime.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/mod.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/monitor.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/raw_input.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/util.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/window.rs
 create mode 100644 vendor/winit/src/platform_impl/windows/window_state.rs
 create mode 100644 vendor/winit/src/utils.rs
 create mode 100644 vendor/winit/src/window.rs
 create mode 100644 vendor/winit/tests/send_objects.rs
 create mode 100644 vendor/winit/tests/serde_objects.rs
 create mode 100644 vendor/winit/tests/sync_object.rs

diff --git a/Cargo.lock b/Cargo.lock
index e4a8c911..848d311a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6589,8 +6589,6 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 [[package]]
 name = "winit"
 version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
 dependencies = [
  "ahash",
  "android-activity",
diff --git a/Cargo.toml b/Cargo.toml
index c713ac86..e80a0b46 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -98,3 +98,4 @@ hayro = { path = "vendor/hayro" }
 hayro-syntax = { path = "vendor/hayro-syntax" }
 hayro-jbig2 = { path = "vendor/hayro-jbig2" }
 lopdf = { path = "vendor/lopdf" }
+winit = { path = "vendor/winit" }
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 3509a7dc..5d567b81 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -555,6 +555,23 @@ mod tests {
         }
     }
 
+    #[test]
+    fn winit_carries_the_windows_11_monitor_scale_fix() {
+        // Issue #324: winit 0.30.13 as released nudges a window dragged onto a monitor with another
+        // scale factor back onto the one it is leaving, so on Windows 11 it ends up on the wrong
+        // monitor, at the wrong size and scale. vendor/winit carries the fix from winit master. A
+        // dependency bump that resolves winit from crates.io again, or a re-vendored copy without
+        // the patch, would silently bring the bug back: re-apply the patch, or drop the copy once a
+        // winit 0.30 release has the fix (vendor/README.md).
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+        let lock = std::fs::read_to_string(root.join("Cargo.lock")).unwrap();
+        let winit = lock.split("[[package]]").find(|p| p.contains("\nname = \"winit\"\n")).expect("winit is in Cargo.lock");
+        assert!(!winit.contains("\nsource = "), "winit must resolve to vendor/winit, not:{winit}");
+        let dpi_changed = std::fs::read_to_string(root.join("vendor/winit/src/platform_impl/windows/event_loop.rs")).unwrap();
+        let patch = "if !WIN10_BUILD_VERSION.is_some_and(|build| build < 22000) {\n                new_outer_rect = suggested_rect;";
+        assert!(dpi_changed.contains(patch), "vendor/winit lost its WM_DPICHANGED patch");
+    }
+
     const NVIDIA: (u32, u32) = (0x10de, 0x2684);
     const AMD_IGPU: (u32, u32) = (0x1002, 0x164e);
 
diff --git a/vendor/README.md b/vendor/README.md
index deab4532..9674a825 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -13,6 +13,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream` |
+| winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
 
diff --git a/vendor/winit/.cargo-ok b/vendor/winit/.cargo-ok
new file mode 100644
index 00000000..5f8b7958
--- /dev/null
+++ b/vendor/winit/.cargo-ok
@@ -0,0 +1 @@
+{"v":1}
\ No newline at end of file
diff --git a/vendor/winit/.cargo_vcs_info.json b/vendor/winit/.cargo_vcs_info.json
new file mode 100644
index 00000000..6a632833
--- /dev/null
+++ b/vendor/winit/.cargo_vcs_info.json
@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "e9809ef54b18499bb4f2cac945719ecc2a61061b"
+  },
+  "path_in_vcs": ""
+}
\ No newline at end of file
diff --git a/vendor/winit/Cargo.lock b/vendor/winit/Cargo.lock
new file mode 100644
index 00000000..fa62c188
--- /dev/null
+++ b/vendor/winit/Cargo.lock
@@ -0,0 +1,2187 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ab_glyph"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79faae4620f45232f599d9bc7b290f88247a0834162c4495ab2f02d60004adfb"
+dependencies = [
+ "ab_glyph_rasterizer",
+ "owned_ttf_parser",
+]
+
+[[package]]
+name = "ab_glyph_rasterizer"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c71b1793ee61086797f5c80b6efa2b8ffa6d5dd703f118545808a7f2e27f7046"
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android-activity"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef6978589202a00cd7e118380c448a08b6ed394c3a8df3a430d0898e3a42d046"
+dependencies = [
+ "android-properties",
+ "bitflags 2.6.0",
+ "cc",
+ "cesu8",
+ "jni",
+ "jni-sys",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-context",
+ "ndk-sys",
+ "num_enum",
+ "thiserror",
+]
+
+[[package]]
+name = "android-properties"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7eb209b1518d6bb87b283c20095f5228ecda460da70b44f0802523dea6da04"
+
+[[package]]
+name = "arrayref"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d151e35f61089500b617991b791fc8bfd237ae50cd5950803758a179b41e67a"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
+name = "as-raw-xcb-connection"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+
+[[package]]
+name = "block2"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c132eebf10f5cad5289222520a4a058514204aed6d791f1cf4fe8088b82d15f"
+dependencies = [
+ "objc2",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+
+[[package]]
+name = "bytemuck"
+version = "1.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b236fc92302c97ed75b38da1f4917b5cdda4984745740f153a5d3059e48d725e"
+
+[[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
+[[package]]
+name = "bytes"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a12916984aab3fa6e39d655a33e09c0071eb36d6ab3aea5c2d78551f1df6d952"
+
+[[package]]
+name = "calloop"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b99da2f8558ca23c71f4fd15dc57c906239752dd27ff3c00a1d56b685b7cbfec"
+dependencies = [
+ "bitflags 2.6.0",
+ "log",
+ "polling",
+ "rustix 0.38.44",
+ "slab",
+ "thiserror",
+]
+
+[[package]]
+name = "calloop-wayland-source"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20"
+dependencies = [
+ "calloop",
+ "rustix 0.38.44",
+ "wayland-backend",
+ "wayland-client",
+]
+
+[[package]]
+name = "cc"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2aba8f4e9906c7ce3c73463f62a7f0c65183ada1a2d47e397cc8810827f9694f"
+dependencies = [
+ "jobserver",
+ "libc",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "console_error_panic_hook"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06aeb73f470f66dcdbf7223caeebb85984942f22f1adb2a088cf9668146bbbc"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-graphics"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation 0.9.4",
+ "core-graphics-types 0.1.3",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa95a34622365fa5bbf40b20b75dba8dfa8c94c734aea8ac9a5ca38af14316f1"
+dependencies = [
+ "bitflags 2.6.0",
+ "core-foundation 0.10.0",
+ "core-graphics-types 0.2.0",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation 0.9.4",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
+dependencies = [
+ "bitflags 2.6.0",
+ "core-foundation 0.10.0",
+ "libc",
+]
+
+[[package]]
+name = "core-text"
+version = "20.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9d2790b5c08465d49f8dc05c8bcae9fea467855947db39b0f8145c091aaced5"
+dependencies = [
+ "core-foundation 0.9.4",
+ "core-graphics 0.23.2",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+
+[[package]]
+name = "crossfont"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a650099c323679b4d6fb6858c2c512660ff5118f6b0ffb1bfc6cadcd54002b14"
+dependencies = [
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "core-graphics 0.23.2",
+ "core-text",
+ "dwrote",
+ "foreign-types",
+ "freetype-rs",
+ "libc",
+ "log",
+ "objc2",
+ "objc2-foundation",
+ "once_cell",
+ "pkg-config",
+ "winapi",
+ "yeslogic-fontconfig-sys",
+]
+
+[[package]]
+name = "cstr"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68523903c8ae5aacfa32a0d9ae60cadeb764e1da14ee0d26b1f3089f13a54636"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "ctor-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f791803201ab277ace03903de1594460708d2d54df6053f2d9e82f592b19e3b"
+
+[[package]]
+name = "cty"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b365fabc795046672053e29c954733ec3b05e4be654ab130fe8f1f94d7051f35"
+
+[[package]]
+name = "cursor-icon"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "dispatch"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b"
+
+[[package]]
+name = "dlib"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330c60081dcc4c72131f8eb70510f1ac07223e5d4163db481a04a0befcffa412"
+dependencies = [
+ "libloading",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+
+[[package]]
+name = "dpi"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
+dependencies = [
+ "mint",
+ "serde",
+]
+
+[[package]]
+name = "dwrote"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439a1c2ba5611ad3ed731280541d36d2e9c4ac5e7fb818a27b604bdc5a6aa65b"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "serde",
+ "serde_derive",
+ "winapi",
+ "wio",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "errno"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f9bfee30e4dedf0ab8b422f03af778d9612b63f502710fc500a334ebe2de645"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
+[[package]]
+name = "freetype-rs"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5442dee36ca09604133580dc0553780e867936bb3cbef3275859e889026d2b17"
+dependencies = [
+ "bitflags 2.6.0",
+ "freetype-sys",
+ "libc",
+]
+
+[[package]]
+name = "freetype-sys"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7edc5b9669349acfda99533e9e0bcf26a51862ab43b08ee7745c55d28eb134"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "gethostname"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0176e0459c2e4a1fe232f984bca6890e681076abb9934f6cea7c326f3fc47818"
+dependencies = [
+ "libc",
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "hermit-abi"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
+
+[[package]]
+name = "image"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99314c8a2152b8ddb211f924cdae532d8c5e4c8bb54728e12fff1b0cd5963a10"
+dependencies = [
+ "bytemuck",
+ "byteorder-lite",
+ "num-traits",
+ "png",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.172"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+
+[[package]]
+name = "libloading"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
+dependencies = [
+ "cfg-if",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "libredox"
+version = "0.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3af92c55d7d839293953fcd0fda5ecfe93297cfde6ffbdec13b41d99c0ba6607"
+dependencies = [
+ "bitflags 2.6.0",
+ "libc",
+ "redox_syscall 0.4.1",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+
+[[package]]
+name = "log"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+
+[[package]]
+name = "matchers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+dependencies = [
+ "regex-automata 0.1.10",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memmap2"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe751422e4a8caa417e13c3ea66452215d7d63e19e604f4980461212f3ae1322"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
+dependencies = [
+ "adler",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mint"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e53debba6bda7a793e5f99b8dacf19e626084f525f7829104ba9898f367d85ff"
+
+[[package]]
+name = "ndk"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.6.0",
+ "jni-sys",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle 0.4.3",
+ "raw-window-handle 0.5.2",
+ "raw-window-handle 0.6.2",
+ "thiserror",
+]
+
+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "ndk-sys"
+version = "0.6.0+11769913"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+dependencies = [
+ "jni-sys",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02339744ee7253741199f897151b38e72257d13802d4ee837285cc2990a90845"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "681030a937600a36906c185595136d26abfebb4aa9c65701cefcaf8578bb982b"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "objc-sys"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb91bdd390c7ce1a8607f35f3ca7151b65afc0ff5ff3b34fa350f7d7c7e4310"
+
+[[package]]
+name = "objc2"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46a785d4eeff09c14c487497c162e92766fbb3e4059a71840cecc03d9a50b804"
+dependencies = [
+ "objc-sys",
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "libc",
+ "objc2",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-foundation",
+ "objc2-quartz-core",
+]
+
+[[package]]
+name = "objc2-cloud-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74dd3b56391c7a0596a295029734d3c1c5e7e510a4cb30245f8221ccea96b009"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "objc2",
+ "objc2-core-location",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-contacts"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5ff520e9c33812fd374d8deecef01d4a840e7b41862d849513de77e44aa4889"
+dependencies = [
+ "block2",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-image"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55260963a527c99f1819c4f8e3b47fe04f9650694ef348ffd2227e8196d34c80"
+dependencies = [
+ "block2",
+ "objc2",
+ "objc2-foundation",
+ "objc2-metal",
+]
+
+[[package]]
+name = "objc2-core-location"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "000cfee34e683244f284252ee206a27953279d370e309649dc3ee317b37e5781"
+dependencies = [
+ "block2",
+ "objc2",
+ "objc2-contacts",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-foundation"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "dispatch",
+ "libc",
+ "objc2",
+]
+
+[[package]]
+name = "objc2-link-presentation"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1a1ae721c5e35be65f01a03b6d2ac13a54cb4fa70d8a5da293d7b0020261398"
+dependencies = [
+ "block2",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-metal"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "objc2",
+ "objc2-foundation",
+ "objc2-metal",
+]
+
+[[package]]
+name = "objc2-symbols"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a684efe3dec1b305badae1a28f6555f6ddd3bb2c2267896782858d5a78404dc"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8bb46798b20cd6b91cbd113524c490f1686f4c4e8f49502431415f3512e2b6f"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "objc2",
+ "objc2-cloud-kit",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-foundation",
+ "objc2-link-presentation",
+ "objc2-quartz-core",
+ "objc2-symbols",
+ "objc2-uniform-type-identifiers",
+ "objc2-user-notifications",
+]
+
+[[package]]
+name = "objc2-uniform-type-identifiers"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44fa5f9748dbfe1ca6c0b79ad20725a11eca7c2218bceb4b005cb1be26273bfe"
+dependencies = [
+ "block2",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-user-notifications"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76cfcbf642358e8689af64cee815d139339f3ed8ad05103ed5eaf73db8d84cb3"
+dependencies = [
+ "bitflags 2.6.0",
+ "block2",
+ "objc2",
+ "objc2-core-location",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "orbclient"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f0d54bde9774d3a51dcf281a5def240c71996bc6ca05d2c847ec8b2b216166"
+dependencies = [
+ "libredox",
+]
+
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
+[[package]]
+name = "owned_ttf_parser"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490d3a563d3122bf7c911a59b0add9389e5ec0f5f0c3ac6b91ff235a0e6a7f90"
+dependencies = [
+ "ttf-parser",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+
+[[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+
+[[package]]
+name = "png"
+version = "0.17.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06e4b0d3d1312775e782c86c91a111aa1f910cbb65e1337f9975b5f9a554b5e1"
+dependencies = [
+ "bitflags 1.3.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "polling"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3ed00ed3fbf728b5816498ecd316d1716eecaced9c0c8d2c5a6740ca214985b"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix 0.38.44",
+ "tracing",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d37c51ca738a55da99dc0c4a34860fd675453b8b36209178c2249bb13651284"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.37.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "raw-window-handle"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b800beb9b6e7d2df1fe337c9e3d04e3af22a124460fb4c30fcc22c9117cefb41"
+dependencies = [
+ "cty",
+]
+
+[[package]]
+name = "raw-window-handle"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ff9a1f06a88b01621b7ae906ef0211290d1c8a168a15542486a8f61c0833b9"
+
+[[package]]
+name = "raw-window-handle"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
+
+[[package]]
+name = "redox_syscall"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
+dependencies = [
+ "bitflags 2.6.0",
+]
+
+[[package]]
+name = "regex"
+version = "1.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.4.7",
+ "regex-syntax 0.8.4",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax 0.6.29",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.4",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.14",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11181fbabf243db407ef8df94a6ce0b2f9a733bd8be4ad02b4eda9602296cac8"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.9.4",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "sctk-adwaita"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec"
+dependencies = [
+ "ab_glyph",
+ "crossfont",
+ "log",
+ "memmap2",
+ "smithay-client-toolkit",
+ "tiny-skia",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+
+[[package]]
+name = "slab"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
+dependencies = [
+ "bitflags 2.6.0",
+ "calloop",
+ "calloop-wayland-source",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix 0.38.44",
+ "thiserror",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
+
+[[package]]
+name = "smol_str"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "softbuffer"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18051cdd562e792cad055119e0cdb2cfc137e44e3987532e0f9659a77931bb08"
+dependencies = [
+ "as-raw-xcb-connection",
+ "bytemuck",
+ "cfg_aliases",
+ "core-graphics 0.24.0",
+ "fastrand",
+ "foreign-types",
+ "js-sys",
+ "log",
+ "memmap2",
+ "objc2",
+ "objc2-foundation",
+ "objc2-quartz-core",
+ "raw-window-handle 0.6.2",
+ "redox_syscall 0.5.8",
+ "rustix 0.38.44",
+ "tiny-xlib",
+ "wasm-bindgen",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-sys",
+ "web-sys",
+ "windows-sys 0.59.0",
+ "x11rb",
+]
+
+[[package]]
+name = "strict-num"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6637bab7722d379c8b41ba849228d680cc12d0a45ba1fa2b48f2a30577a06731"
+
+[[package]]
+name = "syn"
+version = "2.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
+[[package]]
+name = "tiny-skia"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "bytemuck",
+ "cfg-if",
+ "log",
+ "tiny-skia-path",
+]
+
+[[package]]
+name = "tiny-skia-path"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
+dependencies = [
+ "arrayref",
+ "bytemuck",
+ "strict-num",
+]
+
+[[package]]
+name = "tiny-xlib"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d52f22673960ad13af14ff4025997312def1223bfa7c8e4949d099e6b3d5d1c"
+dependencies = [
+ "as-raw-xcb-connection",
+ "ctor-lite",
+ "libloading",
+ "pkg-config",
+ "tracing",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4badfd56924ae69bcc9039335b2e017639ce3f9b001c393c1b2d1ef846ce2cbf"
+
+[[package]]
+name = "toml_edit"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8534fd7f78b5405e860340ad6575217ce99f38d4d5c8f2442cb5ecb50090e1"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "tracing-web"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e6a141feebd51f8d91ebfd785af50fca223c570b86852166caa3b141defe7c"
+dependencies = [
+ "js-sys",
+ "tracing-core",
+ "tracing-subscriber",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "ttf-parser"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8686b91785aff82828ed725225925b33b4fde44c4bb15876e5f7c832724c420a"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
+
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
+dependencies = [
+ "bumpalo",
+ "log",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38176d9b44ea84e9184eff0bc34cc167ed044f816accfe5922e54d84cf48eca2"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6"
+
+[[package]]
+name = "wayland-backend"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673a33c33048a5ade91a6b139580fa174e19fb0d23f396dca9fa15f2e1e49b35"
+dependencies = [
+ "cc",
+ "downcast-rs",
+ "rustix 1.0.8",
+ "scoped-tls",
+ "smallvec",
+ "wayland-sys",
+]
+
+[[package]]
+name = "wayland-client"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c66a47e840dc20793f2264eb4b3e4ecb4b75d91c0dd4af04b456128e0bdd449d"
+dependencies = [
+ "bitflags 2.6.0",
+ "rustix 1.0.8",
+ "wayland-backend",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-csd-frame"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
+dependencies = [
+ "bitflags 2.6.0",
+ "cursor-icon",
+ "wayland-backend",
+]
+
+[[package]]
+name = "wayland-cursor"
+version = "0.31.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ef9489a8df197ebf3a8ce8a7a7f0a2320035c3743f3c1bd0bdbccf07ce64f95"
+dependencies = [
+ "rustix 0.38.44",
+ "wayland-client",
+ "xcursor",
+]
+
+[[package]]
+name = "wayland-protocols"
+version = "0.32.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "efa790ed75fbfd71283bd2521a1cfdc022aabcc28bdcff00851f9e4ae88d9901"
+dependencies = [
+ "bitflags 2.6.0",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-plasma"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fd38cdad69b56ace413c6bcc1fbf5acc5e2ef4af9d5f8f1f9570c0c83eae175"
+dependencies = [
+ "bitflags 2.6.0",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-wlr"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd993de54a40a40fbe5601d9f1fbcaef0aebcc5fda447d7dc8f6dcbaae4f8953"
+dependencies = [
+ "bitflags 2.6.0",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-scanner"
+version = "0.31.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54cb1e9dc49da91950bdfd8b848c49330536d9d1fb03d4bfec8cae50caa50ae3"
+dependencies = [
+ "proc-macro2",
+ "quick-xml",
+ "quote",
+]
+
+[[package]]
+name = "wayland-sys"
+version = "0.31.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34949b42822155826b41db8e5d0c1be3a2bd296c747577a43a3e6daefc296142"
+dependencies = [
+ "dlib",
+ "log",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04dd7223427d52553d3702c004d3b2fe07c148165faa56313cb00211e31c12bc"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winit"
+version = "0.30.13"
+dependencies = [
+ "ahash",
+ "android-activity",
+ "atomic-waker",
+ "bitflags 2.6.0",
+ "block2",
+ "bytemuck",
+ "calloop",
+ "cfg_aliases",
+ "concurrent-queue",
+ "console_error_panic_hook",
+ "core-foundation 0.9.4",
+ "core-graphics 0.23.2",
+ "cursor-icon",
+ "dpi",
+ "image",
+ "js-sys",
+ "libc",
+ "memmap2",
+ "ndk",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "orbclient",
+ "percent-encoding",
+ "pin-project",
+ "raw-window-handle 0.4.3",
+ "raw-window-handle 0.5.2",
+ "raw-window-handle 0.6.2",
+ "redox_syscall 0.4.1",
+ "rustix 0.38.44",
+ "sctk-adwaita",
+ "serde",
+ "smithay-client-toolkit",
+ "smol_str",
+ "softbuffer",
+ "tracing",
+ "tracing-subscriber",
+ "tracing-web",
+ "unicode-segmentation",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-plasma",
+ "web-sys",
+ "web-time",
+ "windows-sys 0.52.0",
+ "x11-dl",
+ "x11rb",
+ "xkbcommon-dl",
+]
+
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wio"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d129932f4644ac2396cb456385cbf9e63b5b30c6e8dc4820bdca4eb082037a5"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "x11-dl"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "x11rb"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d91ffca73ee7f68ce055750bf9f6eca0780b8c85eff9bc046a3b0da41755e12"
+dependencies = [
+ "as-raw-xcb-connection",
+ "gethostname",
+ "libc",
+ "libloading",
+ "once_cell",
+ "rustix 0.38.44",
+ "x11rb-protocol",
+]
+
+[[package]]
+name = "x11rb-protocol"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec107c4503ea0b4a98ef47356329af139c0a4f7750e621cf2973cd3385ebcb3d"
+
+[[package]]
+name = "xcursor"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d491ee231a51ae64a5b762114c3ac2104b967aadba1de45c86ca42cf051513b7"
+
+[[package]]
+name = "xkbcommon-dl"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d039de8032a9a8856a6be89cea3e5d12fdd82306ab7c94d74e6deab2460651c5"
+dependencies = [
+ "bitflags 2.6.0",
+ "dlib",
+ "log",
+ "once_cell",
+ "xkeysym",
+]
+
+[[package]]
+name = "xkeysym"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
+
+[[package]]
+name = "yeslogic-fontconfig-sys"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffb6b23999a8b1a997bf47c7bb4d19ad4029c3327bb3386ebe0a5ff584b33c7a"
+dependencies = [
+ "cstr",
+ "dlib",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/vendor/winit/Cargo.toml b/vendor/winit/Cargo.toml
new file mode 100644
index 00000000..4bfded8a
--- /dev/null
+++ b/vendor/winit/Cargo.toml
@@ -0,0 +1,553 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2021"
+rust-version = "1.70.0"
+name = "winit"
+version = "0.30.13"
+authors = [
+    "The winit contributors",
+    "Pierre Krieger <pierre.krieger1708@gmail.com>",
+]
+build = "build.rs"
+include = [
+    "/build.rs",
+    "/docs",
+    "/examples",
+    "/FEATURES.md",
+    "/LICENSE",
+    "/src",
+    "!/src/platform_impl/web/script",
+    "/src/platform_impl/web/script/**/*.min.js",
+    "/tests",
+]
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "Cross-platform window creation library."
+documentation = "https://docs.rs/winit"
+readme = "README.md"
+keywords = ["windowing"]
+categories = ["gui"]
+license = "Apache-2.0"
+repository = "https://github.com/rust-windowing/winit"
+
+[package.metadata.docs.rs]
+features = [
+    "rwh_04",
+    "rwh_05",
+    "rwh_06",
+    "serde",
+    "mint",
+    "android-native-activity",
+]
+targets = [
+    "i686-pc-windows-msvc",
+    "x86_64-pc-windows-msvc",
+    "x86_64-apple-darwin",
+    "i686-unknown-linux-gnu",
+    "x86_64-unknown-linux-gnu",
+    "x86_64-apple-ios",
+    "aarch64-linux-android",
+    "wasm32-unknown-unknown",
+]
+rustdoc-args = [
+    "--cfg",
+    "docsrs",
+]
+
+[features]
+android-game-activity = ["android-activity/game-activity"]
+android-native-activity = ["android-activity/native-activity"]
+default = [
+    "rwh_06",
+    "x11",
+    "wayland",
+    "wayland-dlopen",
+    "wayland-csd-adwaita",
+]
+mint = ["dpi/mint"]
+rwh_04 = [
+    "dep:rwh_04",
+    "ndk/rwh_04",
+]
+rwh_05 = [
+    "dep:rwh_05",
+    "ndk/rwh_05",
+]
+rwh_06 = [
+    "dep:rwh_06",
+    "ndk/rwh_06",
+]
+serde = [
+    "dep:serde",
+    "cursor-icon/serde",
+    "smol_str/serde",
+    "dpi/serde",
+]
+wayland = [
+    "wayland-client",
+    "wayland-backend",
+    "wayland-protocols",
+    "wayland-protocols-plasma",
+    "sctk",
+    "ahash",
+    "memmap2",
+]
+wayland-csd-adwaita = [
+    "sctk-adwaita",
+    "sctk-adwaita/ab_glyph",
+]
+wayland-csd-adwaita-crossfont = [
+    "sctk-adwaita",
+    "sctk-adwaita/crossfont",
+]
+wayland-csd-adwaita-notitle = ["sctk-adwaita"]
+wayland-dlopen = ["wayland-backend/dlopen"]
+x11 = [
+    "x11-dl",
+    "bytemuck",
+    "percent-encoding",
+    "xkbcommon-dl/x11",
+    "x11rb",
+]
+
+[lib]
+name = "winit"
+path = "src/lib.rs"
+
+[[example]]
+name = "child_window"
+path = "examples/child_window.rs"
+
+[[example]]
+name = "control_flow"
+path = "examples/control_flow.rs"
+
+[[example]]
+name = "pump_events"
+path = "examples/pump_events.rs"
+
+[[example]]
+name = "run_on_demand"
+path = "examples/run_on_demand.rs"
+
+[[example]]
+name = "window"
+path = "examples/window.rs"
+doc-scrape-examples = true
+
+[[example]]
+name = "x11_embed"
+path = "examples/x11_embed.rs"
+
+[[test]]
+name = "send_objects"
+path = "tests/send_objects.rs"
+
+[[test]]
+name = "serde_objects"
+path = "tests/serde_objects.rs"
+
+[[test]]
+name = "sync_object"
+path = "tests/sync_object.rs"
+
+[dependencies.bitflags]
+version = "2"
+
+[dependencies.cursor-icon]
+version = "1.1.0"
+
+[dependencies.dpi]
+version = "0.1.1"
+
+[dependencies.rwh_04]
+version = "0.4"
+optional = true
+package = "raw-window-handle"
+
+[dependencies.rwh_05]
+version = "0.5.2"
+features = ["std"]
+optional = true
+package = "raw-window-handle"
+
+[dependencies.rwh_06]
+version = "0.6"
+features = ["std"]
+optional = true
+package = "raw-window-handle"
+
+[dependencies.serde]
+version = "1"
+features = ["serde_derive"]
+optional = true
+
+[dependencies.smol_str]
+version = "0.2.0"
+
+[dependencies.tracing]
+version = "0.1.40"
+default-features = false
+
+[dev-dependencies.image]
+version = "0.25.0"
+features = ["png"]
+default-features = false
+
+[dev-dependencies.tracing]
+version = "0.1.40"
+features = ["log"]
+default-features = false
+
+[dev-dependencies.tracing-subscriber]
+version = "0.3.18"
+features = ["env-filter"]
+
+[build-dependencies.cfg_aliases]
+version = "0.2.1"
+
+[target.'cfg(all(target_family = "wasm", target_feature = "atomics"))'.dependencies.atomic-waker]
+version = "1"
+
+[target.'cfg(all(target_family = "wasm", target_feature = "atomics"))'.dependencies.concurrent-queue]
+version = "2"
+default-features = false
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.ahash]
+version = "0.8.7"
+features = ["no-rng"]
+optional = true
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.bytemuck]
+version = "1.13.1"
+optional = true
+default-features = false
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.calloop]
+version = "0.13.0"
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.libc]
+version = "0.2.64"
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.memmap2]
+version = "0.9.0"
+optional = true
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.percent-encoding]
+version = "2.0"
+optional = true
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.rustix]
+version = "0.38.4"
+features = [
+    "std",
+    "system",
+    "thread",
+    "process",
+]
+default-features = false
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.sctk]
+version = "0.19.2"
+features = ["calloop"]
+optional = true
+default-features = false
+package = "smithay-client-toolkit"
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.sctk-adwaita]
+version = "0.10.1"
+optional = true
+default-features = false
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.wayland-backend]
+version = "0.3.10"
+features = ["client_system"]
+optional = true
+default-features = false
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.wayland-client]
+version = "0.31.10"
+optional = true
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.wayland-protocols]
+version = "0.32.8"
+features = ["staging"]
+optional = true
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.wayland-protocols-plasma]
+version = "0.3.8"
+features = ["client"]
+optional = true
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.x11-dl]
+version = "2.19.1"
+optional = true
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.x11rb]
+version = "0.13.0"
+features = [
+    "allow-unsafe-code",
+    "dl-libxcb",
+    "randr",
+    "resource_manager",
+    "xinput",
+    "xkb",
+]
+optional = true
+default-features = false
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies.xkbcommon-dl]
+version = "0.4.2"
+
+[target.'cfg(any(target_os = "ios", target_os = "macos"))'.dependencies.block2]
+version = "0.5.1"
+
+[target.'cfg(any(target_os = "ios", target_os = "macos"))'.dependencies.core-foundation]
+version = "0.9.3"
+
+[target.'cfg(any(target_os = "ios", target_os = "macos"))'.dependencies.objc2]
+version = "0.5.2"
+features = ["relax-sign-encoding"]
+
+[target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dev-dependencies.softbuffer]
+version = "0.4.0"
+features = [
+    "x11",
+    "x11-dlopen",
+    "wayland",
+    "wayland-dlopen",
+]
+default-features = false
+
+[target.'cfg(target_family = "wasm")'.dependencies.js-sys]
+version = "0.3.70"
+
+[target.'cfg(target_family = "wasm")'.dependencies.pin-project]
+version = "1"
+
+[target.'cfg(target_family = "wasm")'.dependencies.wasm-bindgen]
+version = "0.2.93"
+
+[target.'cfg(target_family = "wasm")'.dependencies.wasm-bindgen-futures]
+version = "0.4.43"
+
+[target.'cfg(target_family = "wasm")'.dependencies.web-time]
+version = "1"
+
+[target.'cfg(target_family = "wasm")'.dependencies.web_sys]
+version = "0.3.70"
+features = [
+    "AbortController",
+    "AbortSignal",
+    "Blob",
+    "BlobPropertyBag",
+    "console",
+    "CssStyleDeclaration",
+    "Document",
+    "DomException",
+    "DomRect",
+    "DomRectReadOnly",
+    "Element",
+    "Event",
+    "EventTarget",
+    "FocusEvent",
+    "HtmlCanvasElement",
+    "HtmlElement",
+    "HtmlImageElement",
+    "ImageBitmap",
+    "ImageBitmapOptions",
+    "ImageBitmapRenderingContext",
+    "ImageData",
+    "IntersectionObserver",
+    "IntersectionObserverEntry",
+    "KeyboardEvent",
+    "MediaQueryList",
+    "MessageChannel",
+    "MessagePort",
+    "Navigator",
+    "Node",
+    "OrientationLockType",
+    "OrientationType",
+    "PageTransitionEvent",
+    "Permissions",
+    "PermissionState",
+    "PermissionStatus",
+    "PointerEvent",
+    "PremultiplyAlpha",
+    "ResizeObserver",
+    "ResizeObserverBoxOptions",
+    "ResizeObserverEntry",
+    "ResizeObserverOptions",
+    "ResizeObserverSize",
+    "Screen",
+    "ScreenOrientation",
+    "Url",
+    "VisibilityState",
+    "WheelEvent",
+    "Window",
+    "Worker",
+]
+package = "web-sys"
+
+[target.'cfg(target_family = "wasm")'.dev-dependencies.console_error_panic_hook]
+version = "0.1"
+
+[target.'cfg(target_family = "wasm")'.dev-dependencies.tracing-web]
+version = "0.1"
+
+[target.'cfg(target_os = "android")'.dependencies.android-activity]
+version = "0.6.0"
+
+[target.'cfg(target_os = "android")'.dependencies.ndk]
+version = "0.9.0"
+default-features = false
+
+[target.'cfg(target_os = "ios")'.dependencies.objc2-foundation]
+version = "0.2.2"
+features = [
+    "block2",
+    "dispatch",
+    "NSArray",
+    "NSEnumerator",
+    "NSGeometry",
+    "NSObjCRuntime",
+    "NSOperation",
+    "NSString",
+    "NSProcessInfo",
+    "NSThread",
+    "NSSet",
+]
+
+[target.'cfg(target_os = "ios")'.dependencies.objc2-ui-kit]
+version = "0.2.2"
+features = [
+    "UIApplication",
+    "UIDevice",
+    "UIEvent",
+    "UIGeometry",
+    "UIGestureRecognizer",
+    "UITextInput",
+    "UITextInputTraits",
+    "UIOrientation",
+    "UIPanGestureRecognizer",
+    "UIPinchGestureRecognizer",
+    "UIResponder",
+    "UIRotationGestureRecognizer",
+    "UIScreen",
+    "UIScreenMode",
+    "UITapGestureRecognizer",
+    "UITouch",
+    "UITraitCollection",
+    "UIView",
+    "UIViewController",
+    "UIWindow",
+]
+
+[target.'cfg(target_os = "macos")'.dependencies.core-graphics]
+version = "0.23.1"
+
+[target.'cfg(target_os = "macos")'.dependencies.objc2-app-kit]
+version = "0.2.2"
+features = [
+    "NSAppearance",
+    "NSApplication",
+    "NSBitmapImageRep",
+    "NSButton",
+    "NSColor",
+    "NSControl",
+    "NSCursor",
+    "NSDragging",
+    "NSEvent",
+    "NSGraphics",
+    "NSGraphicsContext",
+    "NSImage",
+    "NSImageRep",
+    "NSMenu",
+    "NSMenuItem",
+    "NSOpenGLView",
+    "NSPasteboard",
+    "NSResponder",
+    "NSRunningApplication",
+    "NSScreen",
+    "NSTextInputClient",
+    "NSTextInputContext",
+    "NSView",
+    "NSWindow",
+    "NSWindowScripting",
+    "NSWindowTabGroup",
+]
+
+[target.'cfg(target_os = "macos")'.dependencies.objc2-foundation]
+version = "0.2.2"
+features = [
+    "block2",
+    "dispatch",
+    "NSArray",
+    "NSAttributedString",
+    "NSData",
+    "NSDictionary",
+    "NSDistributedNotificationCenter",
+    "NSEnumerator",
+    "NSKeyValueObserving",
+    "NSNotification",
+    "NSObjCRuntime",
+    "NSPathUtilities",
+    "NSProcessInfo",
+    "NSRunLoop",
+    "NSString",
+    "NSThread",
+    "NSValue",
+]
+
+[target.'cfg(target_os = "redox")'.dependencies.orbclient]
+version = "0.3.47"
+default-features = false
+
+[target.'cfg(target_os = "redox")'.dependencies.redox_syscall]
+version = "0.4.1"
+
+[target.'cfg(target_os = "windows")'.dependencies.unicode-segmentation]
+version = "1.7.1"
+
+[target.'cfg(target_os = "windows")'.dependencies.windows-sys]
+version = "0.52.0"
+features = [
+    "Win32_Devices_HumanInterfaceDevice",
+    "Win32_Foundation",
+    "Win32_Globalization",
+    "Win32_Graphics_Dwm",
+    "Win32_Graphics_Gdi",
+    "Win32_Media",
+    "Win32_System_Com_StructuredStorage",
+    "Win32_System_Com",
+    "Win32_System_LibraryLoader",
+    "Win32_System_Ole",
+    "Win32_Security",
+    "Win32_System_SystemInformation",
+    "Win32_System_SystemServices",
+    "Win32_System_Threading",
+    "Win32_System_WindowsProgramming",
+    "Win32_UI_Accessibility",
+    "Win32_UI_Controls",
+    "Win32_UI_HiDpi",
+    "Win32_UI_Input_Ime",
+    "Win32_UI_Input_KeyboardAndMouse",
+    "Win32_UI_Input_Pointer",
+    "Win32_UI_Input_Touch",
+    "Win32_UI_Shell",
+    "Win32_UI_TextServices",
+    "Win32_UI_WindowsAndMessaging",
+]
diff --git a/vendor/winit/Cargo.toml.orig b/vendor/winit/Cargo.toml.orig
new file mode 100644
index 00000000..71f7c581
--- /dev/null
+++ b/vendor/winit/Cargo.toml.orig
@@ -0,0 +1,378 @@
+[package]
+name = "winit"
+version = "0.30.13"
+authors = [
+    "The winit contributors",
+    "Pierre Krieger <pierre.krieger1708@gmail.com>",
+]
+description = "Cross-platform window creation library."
+keywords = ["windowing"]
+readme = "README.md"
+documentation = "https://docs.rs/winit"
+categories = ["gui"]
+rust-version.workspace = true
+repository.workspace = true
+license.workspace = true
+edition.workspace = true
+include = [
+    "/build.rs",
+    "/docs",
+    "/examples",
+    "/FEATURES.md",
+    "/LICENSE",
+    "/src",
+    "!/src/platform_impl/web/script",
+    "/src/platform_impl/web/script/**/*.min.js",
+    "/tests",
+]
+
+[package.metadata.docs.rs]
+features = [
+    "rwh_04",
+    "rwh_05",
+    "rwh_06",
+    "serde",
+    "mint",
+    # Enabled to get docs to compile
+    "android-native-activity",
+]
+# These are all tested in CI
+targets = [
+    # Windows
+    "i686-pc-windows-msvc",
+    "x86_64-pc-windows-msvc",
+    # macOS
+    "x86_64-apple-darwin",
+    # Unix (X11 & Wayland)
+    "i686-unknown-linux-gnu",
+    "x86_64-unknown-linux-gnu",
+    # iOS
+    "x86_64-apple-ios",
+    # Android
+    "aarch64-linux-android",
+    # Web
+    "wasm32-unknown-unknown",
+]
+rustdoc-args = ["--cfg", "docsrs"]
+
+# Features are documented in either `lib.rs` or under `winit::platform`.
+[features]
+default = ["rwh_06", "x11", "wayland", "wayland-dlopen", "wayland-csd-adwaita"]
+x11 = ["x11-dl", "bytemuck", "percent-encoding", "xkbcommon-dl/x11", "x11rb"]
+wayland = [
+    "wayland-client",
+    "wayland-backend",
+    "wayland-protocols",
+    "wayland-protocols-plasma",
+    "sctk",
+    "ahash",
+    "memmap2",
+]
+wayland-dlopen = ["wayland-backend/dlopen"]
+wayland-csd-adwaita = ["sctk-adwaita", "sctk-adwaita/ab_glyph"]
+wayland-csd-adwaita-crossfont = ["sctk-adwaita", "sctk-adwaita/crossfont"]
+wayland-csd-adwaita-notitle = ["sctk-adwaita"]
+android-native-activity = ["android-activity/native-activity"]
+android-game-activity = ["android-activity/game-activity"]
+serde = ["dep:serde", "cursor-icon/serde", "smol_str/serde", "dpi/serde"]
+mint = ["dpi/mint"]
+rwh_04 = ["dep:rwh_04", "ndk/rwh_04"]
+rwh_05 = ["dep:rwh_05", "ndk/rwh_05"]
+rwh_06 = ["dep:rwh_06", "ndk/rwh_06"]
+
+[build-dependencies]
+cfg_aliases = "0.2.1"
+
+[dependencies]
+bitflags = "2"
+cursor-icon = "1.1.0"
+dpi = { version = "0.1.1", path = "dpi" }
+rwh_04 = { package = "raw-window-handle", version = "0.4", optional = true }
+rwh_05 = { package = "raw-window-handle", version = "0.5.2", features = [
+    "std",
+], optional = true }
+rwh_06 = { package = "raw-window-handle", version = "0.6", features = [
+    "std",
+], optional = true }
+serde = { workspace = true, optional = true }
+smol_str = "0.2.0"
+tracing = { version = "0.1.40", default-features = false }
+
+[dev-dependencies]
+image = { version = "0.25.0", default-features = false, features = ["png"] }
+tracing = { version = "0.1.40", default-features = false, features = ["log"] }
+tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
+winit = { path = ".", features = ["rwh_05"] }
+
+[target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dev-dependencies]
+softbuffer = { version = "0.4.0", default-features = false, features = [
+    "x11",
+    "x11-dlopen",
+    "wayland",
+    "wayland-dlopen",
+] }
+
+[target.'cfg(target_os = "android")'.dependencies]
+android-activity = "0.6.0"
+ndk = { version = "0.9.0", default-features = false }
+
+[target.'cfg(any(target_os = "ios", target_os = "macos"))'.dependencies]
+block2 = "0.5.1"
+core-foundation = "0.9.3"
+objc2 = { version = "0.5.2", features = ["relax-sign-encoding"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+core-graphics = "0.23.1"
+
+[target.'cfg(target_os = "macos")'.dependencies.objc2-foundation]
+version = "0.2.2"
+features = [
+    "block2",
+    "dispatch",
+    "NSArray",
+    "NSAttributedString",
+    "NSData",
+    "NSDictionary",
+    "NSDistributedNotificationCenter",
+    "NSEnumerator",
+    "NSKeyValueObserving",
+    "NSNotification",
+    "NSObjCRuntime",
+    "NSPathUtilities",
+    "NSProcessInfo",
+    "NSRunLoop",
+    "NSString",
+    "NSThread",
+    "NSValue",
+]
+
+[target.'cfg(target_os = "macos")'.dependencies.objc2-app-kit]
+version = "0.2.2"
+features = [
+    "NSAppearance",
+    "NSApplication",
+    "NSBitmapImageRep",
+    "NSButton",
+    "NSColor",
+    "NSControl",
+    "NSCursor",
+    "NSDragging",
+    "NSEvent",
+    "NSGraphics",
+    "NSGraphicsContext",
+    "NSImage",
+    "NSImageRep",
+    "NSMenu",
+    "NSMenuItem",
+    "NSOpenGLView",
+    "NSPasteboard",
+    "NSResponder",
+    "NSRunningApplication",
+    "NSScreen",
+    "NSTextInputClient",
+    "NSTextInputContext",
+    "NSView",
+    "NSWindow",
+    "NSWindowScripting",
+    "NSWindowTabGroup",
+]
+
+[target.'cfg(target_os = "ios")'.dependencies.objc2-foundation]
+version = "0.2.2"
+features = [
+    "block2",
+    "dispatch",
+    "NSArray",
+    "NSEnumerator",
+    "NSGeometry",
+    "NSObjCRuntime",
+    "NSOperation",
+    "NSString",
+    "NSProcessInfo",
+    "NSThread",
+    "NSSet",
+]
+
+[target.'cfg(target_os = "ios")'.dependencies.objc2-ui-kit]
+version = "0.2.2"
+features = [
+    "UIApplication",
+    "UIDevice",
+    "UIEvent",
+    "UIGeometry",
+    "UIGestureRecognizer",
+    "UITextInput",
+    "UITextInputTraits",
+    "UIOrientation",
+    "UIPanGestureRecognizer",
+    "UIPinchGestureRecognizer",
+    "UIResponder",
+    "UIRotationGestureRecognizer",
+    "UIScreen",
+    "UIScreenMode",
+    "UITapGestureRecognizer",
+    "UITouch",
+    "UITraitCollection",
+    "UIView",
+    "UIViewController",
+    "UIWindow",
+]
+
+[target.'cfg(target_os = "windows")'.dependencies]
+unicode-segmentation = "1.7.1"
+
+[target.'cfg(target_os = "windows")'.dependencies.windows-sys]
+version = "0.52.0"
+features = [
+    "Win32_Devices_HumanInterfaceDevice",
+    "Win32_Foundation",
+    "Win32_Globalization",
+    "Win32_Graphics_Dwm",
+    "Win32_Graphics_Gdi",
+    "Win32_Media",
+    "Win32_System_Com_StructuredStorage",
+    "Win32_System_Com",
+    "Win32_System_LibraryLoader",
+    "Win32_System_Ole",
+    "Win32_Security",
+    "Win32_System_SystemInformation",
+    "Win32_System_SystemServices",
+    "Win32_System_Threading",
+    "Win32_System_WindowsProgramming",
+    "Win32_UI_Accessibility",
+    "Win32_UI_Controls",
+    "Win32_UI_HiDpi",
+    "Win32_UI_Input_Ime",
+    "Win32_UI_Input_KeyboardAndMouse",
+    "Win32_UI_Input_Pointer",
+    "Win32_UI_Input_Touch",
+    "Win32_UI_Shell",
+    "Win32_UI_TextServices",
+    "Win32_UI_WindowsAndMessaging",
+]
+
+[target.'cfg(all(unix, not(any(target_os = "redox", target_family = "wasm", target_os = "android", target_os = "ios", target_os = "macos"))))'.dependencies]
+ahash = { version = "0.8.7", features = ["no-rng"], optional = true }
+bytemuck = { version = "1.13.1", default-features = false, optional = true }
+calloop = "0.13.0"
+libc = "0.2.64"
+memmap2 = { version = "0.9.0", optional = true }
+percent-encoding = { version = "2.0", optional = true }
+rustix = { version = "0.38.4", default-features = false, features = [
+    "std",
+    "system",
+    "thread",
+    "process",
+] }
+sctk = { package = "smithay-client-toolkit", version = "0.19.2", default-features = false, features = [
+    "calloop",
+], optional = true }
+sctk-adwaita = { version = "0.10.1", default-features = false, optional = true }
+wayland-backend = { version = "0.3.10", default-features = false, features = [
+    "client_system",
+], optional = true }
+wayland-client = { version = "0.31.10", optional = true }
+wayland-protocols = { version = "0.32.8", features = [
+    "staging",
+], optional = true }
+wayland-protocols-plasma = { version = "0.3.8", features = [
+    "client",
+], optional = true }
+x11-dl = { version = "2.19.1", optional = true }
+x11rb = { version = "0.13.0", default-features = false, features = [
+    "allow-unsafe-code",
+    "dl-libxcb",
+    "randr",
+    "resource_manager",
+    "xinput",
+    "xkb",
+], optional = true }
+xkbcommon-dl = "0.4.2"
+
+[target.'cfg(target_os = "redox")'.dependencies]
+orbclient = { version = "0.3.47", default-features = false }
+redox_syscall = "0.4.1"
+
+[target.'cfg(target_family = "wasm")'.dependencies]
+js-sys = "0.3.70"
+pin-project = "1"
+wasm-bindgen = "0.2.93"
+wasm-bindgen-futures = "0.4.43"
+web-time = "1"
+web_sys = { package = "web-sys", version = "0.3.70", features = [
+    "AbortController",
+    "AbortSignal",
+    "Blob",
+    "BlobPropertyBag",
+    "console",
+    "CssStyleDeclaration",
+    "Document",
+    "DomException",
+    "DomRect",
+    "DomRectReadOnly",
+    "Element",
+    "Event",
+    "EventTarget",
+    "FocusEvent",
+    "HtmlCanvasElement",
+    "HtmlElement",
+    "HtmlImageElement",
+    "ImageBitmap",
+    "ImageBitmapOptions",
+    "ImageBitmapRenderingContext",
+    "ImageData",
+    "IntersectionObserver",
+    "IntersectionObserverEntry",
+    "KeyboardEvent",
+    "MediaQueryList",
+    "MessageChannel",
+    "MessagePort",
+    "Navigator",
+    "Node",
+    "OrientationLockType",
+    "OrientationType",
+    "PageTransitionEvent",
+    "Permissions",
+    "PermissionState",
+    "PermissionStatus",
+    "PointerEvent",
+    "PremultiplyAlpha",
+    "ResizeObserver",
+    "ResizeObserverBoxOptions",
+    "ResizeObserverEntry",
+    "ResizeObserverOptions",
+    "ResizeObserverSize",
+    "Screen",
+    "ScreenOrientation",
+    "Url",
+    "VisibilityState",
+    "WheelEvent",
+    "Window",
+    "Worker",
+] }
+
+[target.'cfg(all(target_family = "wasm", target_feature = "atomics"))'.dependencies]
+atomic-waker = "1"
+concurrent-queue = { version = "2", default-features = false }
+
+[target.'cfg(target_family = "wasm")'.dev-dependencies]
+console_error_panic_hook = "0.1"
+tracing-web = "0.1"
+
+[[example]]
+doc-scrape-examples = true
+name = "window"
+
+[workspace]
+resolver = "2"
+members = ["dpi"]
+
+[workspace.package]
+rust-version = "1.70.0"
+repository = "https://github.com/rust-windowing/winit"
+license = "Apache-2.0"
+edition = "2021"
+
+[workspace.dependencies]
+serde = { version = "1", features = ["serde_derive"] }
+mint = "0.5.6"
diff --git a/vendor/winit/FEATURES.md b/vendor/winit/FEATURES.md
new file mode 100644
index 00000000..2ae94770
--- /dev/null
+++ b/vendor/winit/FEATURES.md
@@ -0,0 +1,248 @@
+# Winit Scope
+
+Winit aims to expose an interface that abstracts over window creation and input handling and can
+be used to create both games and applications. It supports the following main graphical platforms:
+- Desktop
+  - Windows
+  - macOS
+  - Unix
+    - via X11
+    - via Wayland
+  - Redox OS, via Orbital
+- Mobile
+  - iOS
+  - Android
+- Web
+
+Most platforms expose capabilities that cannot be meaningfully transposed onto others. Winit does not
+aim to support every single feature of every platform, but rather to abstract over the common features
+available everywhere. In this context, APIs exposed in winit can be split into different "support tiers":
+
+- **Core:** Features that are essential to providing a well-formed abstraction over each platform's
+  windowing and input APIs.
+- **Platform:** Platform-specific features that can't be meaningfully exposed through a common API and
+  cannot be implemented outside of Winit without exposing a significant amount of Winit's internals
+  or interfering with Winit's abstractions.
+- **Usability:** Features that are not strictly essential to Winit's functionality, but provide meaningful
+  usability improvements and cannot be reasonably implemented in an external crate. These are
+  generally optional and exposed through Cargo features.
+
+Core features are taken care of by the core Winit maintainers. Platform features are not.
+When a platform feature is submitted, the submitter is considered the expert in the
+feature and may be asked to support the feature should it break in the future.
+
+Winit ***does not*** directly expose functionality for drawing inside windows or creating native
+menus, but ***does*** commit to providing APIs that higher-level crates can use to implement that
+functionality.
+
+## `1.0` and stability
+
+When all core features are implemented to the satisfaction of the Winit maintainers, Winit 1.0 will
+be released and the library will enter maintenance mode. For the most part, new core features will not
+be added past this point. New platform features may be accepted and exposed through point releases.
+
+### Tier upgrades
+Some platform features could, in theory, be exposed across multiple platforms, but have not gone
+through the implementation work necessary to function on all platforms. When one of these features
+gets implemented across all platforms, a PR can be opened to upgrade the feature to a core feature.
+If that gets accepted, the platform-specific functions get deprecated and become permanently
+exposed through the core, cross-platform API.
+
+# Features
+
+## Extending this section
+
+If your PR makes notable changes to Winit's features, please update this section as follows:
+
+- If your PR adds a new feature, add a brief description to the relevant section. If the feature is a core
+  feature, add a row to the feature matrix and describe what platforms the feature has been implemented on.
+
+- If your PR begins a new API rework, add a row to the `Pending API Reworks` table. If the PR implements the
+  API rework on all relevant platforms, please move it to the `Completed API Reworks` table.
+
+- If your PR implements an already-existing feature on a new platform, either mark the feature as *completed*,
+  or mark it as *mostly completed* and link to an issue describing the problems with the implementation.
+
+## Core
+
+### Windowing
+- **Window initialization**: Winit allows the creation of a window
+- **Providing pointer to init OpenGL**: Winit provides the necessary pointers to initialize a working opengl context
+- **Providing pointer to init Vulkan**: Same as OpenGL but for Vulkan
+- **Window decorations**: The windows created by winit are properly decorated, and the decorations can
+  be deactivated
+- **Window decorations toggle**: Decorations can be turned on or off after window creation
+- **Window resizing**: The windows created by winit can be resized and generate the appropriate events
+  when they are. The application can precisely control its window size if desired.
+- **Window resize increments**: When the window gets resized, the application can choose to snap the window's
+  size to specific values.
+- **Window transparency**: Winit allows the creation of windows with a transparent background.
+- **Window maximization**: The windows created by winit can be maximized upon creation.
+- **Window maximization toggle**: The windows created by winit can be maximized and unmaximized after
+  creation.
+- **Window minimization**: The windows created by winit can be minimized after creation.
+- **Fullscreen**: The windows created by winit can be put into fullscreen mode.
+- **Fullscreen toggle**: The windows created by winit can be switched to and from fullscreen after
+  creation.
+- **Exclusive fullscreen**: Winit allows changing the video mode of the monitor
+  for fullscreen windows and, if applicable, captures the monitor for exclusive
+  use by this application.
+- **HiDPI support**: Winit assists developers in appropriately scaling HiDPI content.
+- **Popup / modal windows**: Windows can be created relative to the client area of other windows, and parent
+  windows can be disabled in favor of popup windows. This feature also guarantees that popup windows
+  get drawn above their owner.
+
+
+### System Information
+- **Monitor list**: Retrieve the list of monitors and their metadata, including which one is primary.
+- **Video mode query**: Monitors can be queried for their supported fullscreen video modes (consisting of resolution, refresh rate, and bit depth).
+
+### Input Handling
+- **Mouse events**: Generating mouse events associated with pointer motion, click, and scrolling events.
+- **Mouse set location**: Forcibly changing the location of the pointer.
+- **Cursor locking**: Locking the cursor inside the window so it cannot move.
+- **Cursor confining**: Confining the cursor to the window bounds so it cannot leave them.
+- **Cursor icon**: Changing the cursor icon or hiding the cursor.
+- **Cursor image**: Changing the cursor to your own image.
+- **Cursor hittest**: Handle or ignore mouse events for a window.
+- **Touch events**: Single-touch events.
+- **Touch pressure**: Touch events contain information about the amount of force being applied.
+- **Multitouch**: Multi-touch events, including cancellation of a gesture.
+- **Keyboard events**: Properly processing keyboard events using the user-specified keymap and
+  translating keypresses into UTF-8 characters, handling dead keys and IMEs.
+- **Drag & Drop**: Dragging content into winit, detecting when content enters, drops, or if the drop is cancelled.
+- **Raw Device Events**: Capturing input from input devices without any OS filtering.
+- **Gamepad/Joystick events**: Capturing input from gamepads and joysticks.
+- **Device movement events**: Capturing input from the device gyroscope and accelerometer.
+
+## Platform
+### Windows
+* Setting the name of the internal window class
+* Setting the taskbar icon
+* Setting the parent window
+* Setting a menu bar
+* `WS_EX_NOREDIRECTIONBITMAP` support
+* Theme the title bar according to Windows 10 Dark Mode setting or set a preferred theme
+* Changing a system-drawn backdrop
+* Setting the window border color
+* Setting the title bar background color
+* Setting the title color
+* Setting the corner rounding preference
+
+### macOS
+* Window activation policy
+* Window movable by background
+* Transparent titlebar
+* Hidden titlebar
+* Hidden titlebar buttons
+* Full-size content view
+* Accepts first mouse
+* Set a preferred theme and get current theme.
+
+### Unix
+* Window urgency
+* X11 Window Class
+* X11 Override Redirect Flag
+* GTK Theme Variant
+* Base window size
+* Setting the X11 parent window
+
+### iOS
+* Get the `UIScreen` object pointer
+* Setting the `UIView` hidpi factor
+* Valid orientations
+* Home indicator visibility
+* Status bar visibility and style
+* Deferring system gestures
+* Getting the device idiom
+* Getting the preferred video mode
+
+### Web
+* Get if the systems preferred color scheme is "dark"
+
+## Compatibility Matrix
+
+Legend:
+
+- ✔️: Works as intended
+- ▢: Mostly works, but some bugs are known
+- ❌: Missing feature or large bugs making it unusable
+- **N/A**: Not applicable for this platform
+- ❓: Unknown status
+
+### Windowing
+|Feature                          |Windows|MacOS   |Linux x11   |Linux Wayland  |Android|iOS    |Web      |Redox OS|
+|-------------------------------- | ----- | ----   | -------    | -----------   | ----- | ----- | -------- | ------ |
+|Window initialization            |✔️     |✔️     |▢[#5]      |✔️             |▢[#33]|▢[#33] |✔️        |✔️      |
+|Providing pointer to init OpenGL |✔️     |✔️     |✔️         |✔️             |✔️     |✔️    |**N/A**|✔️      |
+|Providing pointer to init Vulkan |✔️     |✔️     |✔️         |✔️             |✔️     |❓     |**N/A**|**N/A** |
+|Window decorations               |✔️     |✔️     |✔️         |✔️             |**N/A**|**N/A**|**N/A**|✔️      |
+|Window decorations toggle        |✔️     |✔️     |✔️         |✔️             |**N/A**|**N/A**|**N/A**|**N/A** |
+|Window resizing                  |✔️     |✔️     |✔️         |✔️        |**N/A**|**N/A**|✔️        |✔️      |
+|Window resize increments         |✔️     |✔️     |✔️         |❌             |**N/A**|**N/A**|**N/A**|**N/A** |
+|Window transparency              |✔️     |✔️     |✔️         |✔️             |**N/A**|**N/A**|N/A        |✔️      |
+|Window blur                      |❌    |❌    |❌        |✔️             |**N/A**|**N/A**|N/A        |❌     |
+|Window maximization              |✔️     |✔️     |✔️         |✔️             |**N/A**|**N/A**|**N/A**|**N/A** |
+|Window maximization toggle       |✔️     |✔️     |✔️         |✔️             |**N/A**|**N/A**|**N/A**|**N/A** |
+|Window minimization              |✔️     |✔️     |✔️         |✔️             |**N/A**|**N/A**|**N/A**|**N/A** |
+|Fullscreen                       |✔️     |✔️     |✔️         |✔️             |**N/A**|✔️     |✔️        |**N/A** |
+|Fullscreen toggle                |✔️     |✔️     |✔️         |✔️             |**N/A**|✔️     |✔️        |**N/A** |
+|Exclusive fullscreen             |✔️     |✔️     |✔️         |**N/A**         |❌    |✔️     |**N/A**|**N/A** |
+|HiDPI support                    |✔️     |✔️     |✔️         |✔️             |✔️     |✔️    |✔️    |❌      |
+|Popup windows                    |❌     |❌     |❌         |❌             |❌    |❌     |**N/A**|**N/A** |
+
+### System information
+|Feature          |Windows|MacOS |Linux x11|Linux Wayland|Android|iOS      |Web      |Redox OS|
+|---------------- | ----- | ---- | ------- | ----------- | ----- | ------- | -------- | ------ |
+|Monitor list     |✔️    |✔️    |✔️       |✔️          |✔️     |✔️      |**N/A**|❌      |
+|Video mode query |✔️    |✔️    |✔️       |✔️          |✔️     |✔️      |**N/A**|❌      |
+
+### Input handling
+|Feature                 |Windows   |MacOS   |Linux x11|Linux Wayland|Android|iOS    |Web      |Redox OS|
+|----------------------- | -----    | ----   | ------- | ----------- | ----- | ----- | -------- | ------ |
+|Mouse events            |✔️       |▢[#63]  |✔️       |✔️          |**N/A**|**N/A**|✔️        |✔️      |
+|Mouse set location      |✔️       |✔️      |✔️       |✔️(when locked)  |**N/A**|**N/A**|**N/A**|**N/A** |
+|Cursor locking          |❌       |✔️      |❌       |✔️          |**N/A**|**N/A**|✔️        |❌      |
+|Cursor confining        |✔️       |❌      |✔️       |✔️          |**N/A**|**N/A**|❌       |❌      |
+|Cursor icon             |✔️       |✔️      |✔️       |✔️          |**N/A**|**N/A**|✔️        |**N/A** |
+|Cursor image            |✔️       |✔️      |✔️       |✔️          |**N/A**|**N/A**|✔️        |**N/A** |
+|Cursor hittest          |✔️       |✔️      |✔️       |✔️          |**N/A**|**N/A**|❌        |❌      |
+|Touch events            |✔️       |❌      |✔️       |✔️          |✔️    |✔️     |✔️        |**N/A** |
+|Touch pressure          |✔️       |❌      |❌       |❌          |❌    |✔️     |✔️        |**N/A** |
+|Multitouch              |✔️       |❌      |✔️       |✔️          |✔️    |✔️     |❌        |**N/A** |
+|Keyboard events         |✔️       |✔️      |✔️       |✔️          |✔️    |❌     |✔️        |✔️      |
+|Drag & Drop             |▢[#720]  |▢[#720] |▢[#720]  |▢[#720]   |**N/A**|**N/A**|❓        |**N/A** |
+|Raw Device Events       |▢[#750]  |▢[#750] |▢[#750]  |❌          |❌    |❌     |❓        |**N/A** |
+|Gamepad/Joystick events |❌[#804] |❌      |❌       |❌          |❌    |❌     |❓        |**N/A** |
+|Device movement events  |❓        |❓       |❓       |❓           |❌    |❌     |❓        |**N/A** |
+|Drag window with cursor |✔️       |✔️      |✔️       |✔️          |**N/A**|**N/A**|**N/A**   |**N/A** |
+|Resize with cursor      |✔️       |❌       |✔️       |✔️       |**N/A**|**N/A**|**N/A**   |**N/A** |
+
+### Pending API Reworks
+Changes in the API that have been agreed upon but aren't implemented across all platforms.
+
+|Feature                             |Windows|MacOS |Linux x11|Linux Wayland|Android|iOS    |Web      |Redox OS|
+|------------------------------      | ----- | ---- | ------- | ----------- | ----- | ----- | -------- | ------ |
+|New API for HiDPI ([#315] [#319])   |✔️      |✔️     |✔️        |✔️            |✔️      |✔️      |❓        |❓      |
+|Event Loop 2.0 ([#459])             |✔️      |✔️     |✔️        |✔️            |✔️      |✔️      |❓        |✔️       |
+|Keyboard Input 2.0 ([#753])         |✔️      |✔️     |✔️        |✔️            |✔️      |❌     |✔️         |✔️       |
+
+### Completed API Reworks
+|Feature                             |Windows|MacOS |Linux x11|Linux Wayland|Android|iOS    |Web      |Redox OS|
+|------------------------------      | ----- | ---- | ------- | ----------- | ----- | ----- | -------- | ------ |
+
+[#165]: https://github.com/rust-windowing/winit/issues/165
+[#219]: https://github.com/rust-windowing/winit/issues/219
+[#242]: https://github.com/rust-windowing/winit/issues/242
+[#306]: https://github.com/rust-windowing/winit/issues/306
+[#315]: https://github.com/rust-windowing/winit/issues/315
+[#319]: https://github.com/rust-windowing/winit/issues/319
+[#33]: https://github.com/rust-windowing/winit/issues/33
+[#459]: https://github.com/rust-windowing/winit/issues/459
+[#5]: https://github.com/rust-windowing/winit/issues/5
+[#63]: https://github.com/rust-windowing/winit/issues/63
+[#720]: https://github.com/rust-windowing/winit/issues/720
+[#721]: https://github.com/rust-windowing/winit/issues/721
+[#750]: https://github.com/rust-windowing/winit/issues/750
+[#753]: https://github.com/rust-windowing/winit/issues/753
+[#804]: https://github.com/rust-windowing/winit/issues/804
diff --git a/vendor/winit/LICENSE b/vendor/winit/LICENSE
new file mode 100644
index 00000000..ad410e11
--- /dev/null
+++ b/vendor/winit/LICENSE
@@ -0,0 +1,201 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/vendor/winit/README.md b/vendor/winit/README.md
new file mode 100644
index 00000000..ab958874
--- /dev/null
+++ b/vendor/winit/README.md
@@ -0,0 +1,70 @@
+# winit - Cross-platform window creation and management in Rust
+
+[![Crates.io](https://img.shields.io/crates/v/winit.svg)](https://crates.io/crates/winit)
+[![Docs.rs](https://docs.rs/winit/badge.svg)](https://docs.rs/winit)
+[![Master Docs](https://img.shields.io/github/actions/workflow/status/rust-windowing/winit/docs.yml?branch=master&label=master%20docs
+)](https://rust-windowing.github.io/winit/winit/index.html)
+[![CI Status](https://github.com/rust-windowing/winit/workflows/CI/badge.svg)](https://github.com/rust-windowing/winit/actions)
+
+```toml
+[dependencies]
+winit = "0.30.13"
+```
+
+## [Documentation](https://docs.rs/winit)
+
+For features _within_ the scope of winit, see [FEATURES.md](FEATURES.md).
+
+For features _outside_ the scope of winit, see [Are we GUI Yet?](https://areweguiyet.com/) and [Are we game yet?](https://arewegameyet.rs/), depending on what kind of project you're looking to do.
+
+## Contact Us
+
+Join us in our [![Matrix](https://img.shields.io/badge/Matrix-%23rust--windowing%3Amatrix.org-blueviolet.svg)](https://matrix.to/#/#rust-windowing:matrix.org) room.
+
+The maintainers have a meeting every friday at UTC 15. The meeting notes can be found [here](https://hackmd.io/@winit-meetings).
+
+## Usage
+
+Winit is a window creation and management library. It can create windows and lets you handle
+events (for example: the window being resized, a key being pressed, a mouse movement, etc.)
+produced by the window.
+
+Winit is designed to be a low-level brick in a hierarchy of libraries. Consequently, in order to
+show something on the window you need to use the platform-specific getters provided by winit, or
+another library.
+
+## CONTRIBUTING
+
+For contributing guidelines see [CONTRIBUTING.md](./CONTRIBUTING.md).
+
+## MSRV Policy
+
+This crate's Minimum Supported Rust Version (MSRV) is **1.70**. Changes to
+the MSRV will be accompanied by a minor version bump.
+
+As a **tentative** policy, the upper bound of the MSRV is given by the following
+formula:
+
+```
+min(sid, stable - 3)
+```
+
+Where `sid` is the current version of `rustc` provided by [Debian Sid], and
+`stable` is the latest stable version of Rust. This bound may be broken in case of a major ecosystem shift or a security vulnerability.
+
+[Debian Sid]: https://packages.debian.org/sid/rustc
+
+The exception is for the Android platform, where a higher Rust version
+must be used for certain Android features. In this case, the MSRV will be
+capped at the latest stable version of Rust minus three. This inconsistency is
+not reflected in Cargo metadata, as it is not powerful enough to expose this
+restriction.
+
+All crates in the [`rust-windowing`] organizations have the
+same MSRV policy.
+
+[`rust-windowing`]: https://github.com/rust-windowing
+
+### Platform-specific usage
+
+Check out the [`winit::platform`](https://rust-windowing.github.io/winit/winit/platform/index.html) module for platform-specific usage.
diff --git a/vendor/winit/build.rs b/vendor/winit/build.rs
new file mode 100644
index 00000000..6a4528b3
--- /dev/null
+++ b/vendor/winit/build.rs
@@ -0,0 +1,27 @@
+use cfg_aliases::cfg_aliases;
+
+fn main() {
+    // The script doesn't depend on our code.
+    println!("cargo:rerun-if-changed=build.rs");
+
+    // Setup cfg aliases.
+    cfg_aliases! {
+        // Systems.
+        android_platform: { target_os = "android" },
+        web_platform: { all(target_family = "wasm", target_os = "unknown") },
+        macos_platform: { target_os = "macos" },
+        ios_platform: { target_os = "ios" },
+        windows_platform: { target_os = "windows" },
+        apple: { any(target_os = "ios", target_os = "macos") },
+        free_unix: { all(unix, not(apple), not(android_platform), not(target_os = "emscripten")) },
+        redox: { target_os = "redox" },
+
+        // Native displays.
+        x11_platform: { all(feature = "x11", free_unix, not(redox)) },
+        wayland_platform: { all(feature = "wayland", free_unix, not(redox)) },
+        orbital_platform: { redox },
+    }
+
+    // Winit defined cfgs.
+    println!("cargo:rustc-check-cfg=cfg(unreleased_changelogs)");
+}
diff --git a/vendor/winit/examples/child_window.rs b/vendor/winit/examples/child_window.rs
new file mode 100644
index 00000000..715996eb
--- /dev/null
+++ b/vendor/winit/examples/child_window.rs
@@ -0,0 +1,88 @@
+#[cfg(all(feature = "rwh_06", any(x11_platform, macos_platform, windows_platform)))]
+#[allow(deprecated)]
+fn main() -> Result<(), impl std::error::Error> {
+    use std::collections::HashMap;
+
+    use winit::dpi::{LogicalPosition, LogicalSize, Position};
+    use winit::event::{ElementState, Event, KeyEvent, WindowEvent};
+    use winit::event_loop::{ActiveEventLoop, EventLoop};
+    use winit::raw_window_handle::HasRawWindowHandle;
+    use winit::window::Window;
+
+    #[path = "util/fill.rs"]
+    mod fill;
+
+    fn spawn_child_window(parent: &Window, event_loop: &ActiveEventLoop) -> Window {
+        let parent = parent.raw_window_handle().unwrap();
+        let mut window_attributes = Window::default_attributes()
+            .with_title("child window")
+            .with_inner_size(LogicalSize::new(200.0f32, 200.0f32))
+            .with_position(Position::Logical(LogicalPosition::new(0.0, 0.0)))
+            .with_visible(true);
+        // `with_parent_window` is unsafe. Parent window must be a valid window.
+        window_attributes = unsafe { window_attributes.with_parent_window(Some(parent)) };
+
+        event_loop.create_window(window_attributes).unwrap()
+    }
+
+    let mut windows = HashMap::new();
+
+    let event_loop: EventLoop<()> = EventLoop::new().unwrap();
+    let mut parent_window_id = None;
+
+    event_loop.run(move |event: Event<()>, event_loop| {
+        match event {
+            Event::Resumed => {
+                let attributes = Window::default_attributes()
+                    .with_title("parent window")
+                    .with_position(Position::Logical(LogicalPosition::new(0.0, 0.0)))
+                    .with_inner_size(LogicalSize::new(640.0f32, 480.0f32));
+                let window = event_loop.create_window(attributes).unwrap();
+
+                parent_window_id = Some(window.id());
+
+                println!("Parent window id: {parent_window_id:?})");
+                windows.insert(window.id(), window);
+            },
+            Event::WindowEvent { window_id, event } => match event {
+                WindowEvent::CloseRequested => {
+                    windows.clear();
+                    event_loop.exit();
+                },
+                WindowEvent::CursorEntered { device_id: _ } => {
+                    // On x11, println when the cursor entered in a window even if the child window
+                    // is created by some key inputs.
+                    // the child windows are always placed at (0, 0) with size (200, 200) in the
+                    // parent window, so we also can see this log when we move
+                    // the cursor around (200, 200) in parent window.
+                    println!("cursor entered in the window {window_id:?}");
+                },
+                WindowEvent::KeyboardInput {
+                    event: KeyEvent { state: ElementState::Pressed, .. },
+                    ..
+                } => {
+                    let parent_window = windows.get(&parent_window_id.unwrap()).unwrap();
+                    let child_window = spawn_child_window(parent_window, event_loop);
+                    let child_id = child_window.id();
+                    println!("Child window created with id: {child_id:?}");
+                    windows.insert(child_id, child_window);
+                },
+                WindowEvent::RedrawRequested => {
+                    if let Some(window) = windows.get(&window_id) {
+                        fill::fill_window(window);
+                    }
+                },
+                _ => (),
+            },
+            _ => (),
+        }
+    })
+}
+
+#[cfg(all(feature = "rwh_06", not(any(x11_platform, macos_platform, windows_platform))))]
+fn main() {
+    panic!(
+        "This example is supported only on x11, macOS, and Windows, with the `rwh_06` feature \
+         enabled."
+    );
+}
diff --git a/vendor/winit/examples/control_flow.rs b/vendor/winit/examples/control_flow.rs
new file mode 100644
index 00000000..13cc9477
--- /dev/null
+++ b/vendor/winit/examples/control_flow.rs
@@ -0,0 +1,148 @@
+#![allow(clippy::single_match)]
+
+use std::thread;
+#[cfg(not(web_platform))]
+use std::time;
+
+use ::tracing::{info, warn};
+#[cfg(web_platform)]
+use web_time as time;
+
+use winit::application::ApplicationHandler;
+use winit::event::{ElementState, KeyEvent, StartCause, WindowEvent};
+use winit::event_loop::{ActiveEventLoop, ControlFlow, EventLoop};
+use winit::keyboard::{Key, NamedKey};
+use winit::window::{Window, WindowId};
+
+#[path = "util/fill.rs"]
+mod fill;
+#[path = "util/tracing.rs"]
+mod tracing;
+
+const WAIT_TIME: time::Duration = time::Duration::from_millis(100);
+const POLL_SLEEP_TIME: time::Duration = time::Duration::from_millis(100);
+
+#[derive(Default, Debug, Clone, Copy, PartialEq, Eq)]
+enum Mode {
+    #[default]
+    Wait,
+    WaitUntil,
+    Poll,
+}
+
+fn main() -> Result<(), impl std::error::Error> {
+    #[cfg(web_platform)]
+    console_error_panic_hook::set_once();
+
+    tracing::init();
+
+    info!("Press '1' to switch to Wait mode.");
+    info!("Press '2' to switch to WaitUntil mode.");
+    info!("Press '3' to switch to Poll mode.");
+    info!("Press 'R' to toggle request_redraw() calls.");
+    info!("Press 'Esc' to close the window.");
+
+    let event_loop = EventLoop::new().unwrap();
+
+    let mut app = ControlFlowDemo::default();
+    event_loop.run_app(&mut app)
+}
+
+#[derive(Default)]
+struct ControlFlowDemo {
+    mode: Mode,
+    request_redraw: bool,
+    wait_cancelled: bool,
+    close_requested: bool,
+    window: Option<Window>,
+}
+
+impl ApplicationHandler for ControlFlowDemo {
+    fn new_events(&mut self, _event_loop: &ActiveEventLoop, cause: StartCause) {
+        info!("new_events: {cause:?}");
+
+        self.wait_cancelled = match cause {
+            StartCause::WaitCancelled { .. } => self.mode == Mode::WaitUntil,
+            _ => false,
+        }
+    }
+
+    fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+        let window_attributes = Window::default_attributes().with_title(
+            "Press 1, 2, 3 to change control flow mode. Press R to toggle redraw requests.",
+        );
+        self.window = Some(event_loop.create_window(window_attributes).unwrap());
+    }
+
+    fn window_event(
+        &mut self,
+        _event_loop: &ActiveEventLoop,
+        _window_id: WindowId,
+        event: WindowEvent,
+    ) {
+        info!("{event:?}");
+
+        match event {
+            WindowEvent::CloseRequested => {
+                self.close_requested = true;
+            },
+            WindowEvent::KeyboardInput {
+                event: KeyEvent { logical_key: key, state: ElementState::Pressed, .. },
+                ..
+            } => match key.as_ref() {
+                // WARNING: Consider using `key_without_modifiers()` if available on your platform.
+                // See the `key_binding` example
+                Key::Character("1") => {
+                    self.mode = Mode::Wait;
+                    warn!("mode: {:?}", self.mode);
+                },
+                Key::Character("2") => {
+                    self.mode = Mode::WaitUntil;
+                    warn!("mode: {:?}", self.mode);
+                },
+                Key::Character("3") => {
+                    self.mode = Mode::Poll;
+                    warn!("mode: {:?}", self.mode);
+                },
+                Key::Character("r") => {
+                    self.request_redraw = !self.request_redraw;
+                    warn!("request_redraw: {}", self.request_redraw);
+                },
+                Key::Named(NamedKey::Escape) => {
+                    self.close_requested = true;
+                },
+                _ => (),
+            },
+            WindowEvent::RedrawRequested => {
+                let window = self.window.as_ref().unwrap();
+                window.pre_present_notify();
+                fill::fill_window(window);
+            },
+            _ => (),
+        }
+    }
+
+    fn about_to_wait(&mut self, event_loop: &ActiveEventLoop) {
+        if self.request_redraw && !self.wait_cancelled && !self.close_requested {
+            self.window.as_ref().unwrap().request_redraw();
+        }
+
+        match self.mode {
+            Mode::Wait => event_loop.set_control_flow(ControlFlow::Wait),
+            Mode::WaitUntil => {
+                if !self.wait_cancelled {
+                    event_loop
+                        .set_control_flow(ControlFlow::WaitUntil(time::Instant::now() + WAIT_TIME));
+                }
+            },
+            Mode::Poll => {
+                thread::sleep(POLL_SLEEP_TIME);
+                event_loop.set_control_flow(ControlFlow::Poll);
+            },
+        };
+
+        if self.close_requested {
+            event_loop.exit();
+        }
+    }
+}
diff --git a/vendor/winit/examples/pump_events.rs b/vendor/winit/examples/pump_events.rs
new file mode 100644
index 00000000..ad198cfa
--- /dev/null
+++ b/vendor/winit/examples/pump_events.rs
@@ -0,0 +1,80 @@
+#![allow(clippy::single_match)]
+
+// Limit this example to only compatible platforms.
+#[cfg(any(windows_platform, macos_platform, x11_platform, wayland_platform, android_platform,))]
+fn main() -> std::process::ExitCode {
+    use std::process::ExitCode;
+    use std::thread::sleep;
+    use std::time::Duration;
+
+    use winit::application::ApplicationHandler;
+    use winit::event::WindowEvent;
+    use winit::event_loop::{ActiveEventLoop, EventLoop};
+    use winit::platform::pump_events::{EventLoopExtPumpEvents, PumpStatus};
+    use winit::window::{Window, WindowId};
+
+    #[path = "util/fill.rs"]
+    mod fill;
+
+    #[derive(Default)]
+    struct PumpDemo {
+        window: Option<Window>,
+    }
+
+    impl ApplicationHandler for PumpDemo {
+        fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+            let window_attributes = Window::default_attributes().with_title("A fantastic window!");
+            self.window = Some(event_loop.create_window(window_attributes).unwrap());
+        }
+
+        fn window_event(
+            &mut self,
+            event_loop: &ActiveEventLoop,
+            _window_id: WindowId,
+            event: WindowEvent,
+        ) {
+            println!("{event:?}");
+
+            let window = match self.window.as_ref() {
+                Some(window) => window,
+                None => return,
+            };
+
+            match event {
+                WindowEvent::CloseRequested => event_loop.exit(),
+                WindowEvent::RedrawRequested => {
+                    fill::fill_window(window);
+                    window.request_redraw();
+                },
+                _ => (),
+            }
+        }
+    }
+
+    let mut event_loop = EventLoop::new().unwrap();
+
+    tracing_subscriber::fmt::init();
+
+    let mut app = PumpDemo::default();
+
+    loop {
+        let timeout = Some(Duration::ZERO);
+        let status = event_loop.pump_app_events(timeout, &mut app);
+
+        if let PumpStatus::Exit(exit_code) = status {
+            break ExitCode::from(exit_code as u8);
+        }
+
+        // Sleep for 1/60 second to simulate application work
+        //
+        // Since `pump_events` doesn't block it will be important to
+        // throttle the loop in the app somehow.
+        println!("Update()");
+        sleep(Duration::from_millis(16));
+    }
+}
+
+#[cfg(any(ios_platform, web_platform, orbital_platform))]
+fn main() {
+    println!("This platform doesn't support pump_events.");
+}
diff --git a/vendor/winit/examples/run_on_demand.rs b/vendor/winit/examples/run_on_demand.rs
new file mode 100644
index 00000000..5a277de1
--- /dev/null
+++ b/vendor/winit/examples/run_on_demand.rs
@@ -0,0 +1,99 @@
+#![allow(clippy::single_match)]
+
+// Limit this example to only compatible platforms.
+#[cfg(any(windows_platform, macos_platform, x11_platform, wayland_platform,))]
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    use std::time::Duration;
+
+    use winit::application::ApplicationHandler;
+    use winit::event::WindowEvent;
+    use winit::event_loop::{ActiveEventLoop, EventLoop};
+    use winit::platform::run_on_demand::EventLoopExtRunOnDemand;
+    use winit::window::{Window, WindowId};
+
+    #[path = "util/fill.rs"]
+    mod fill;
+
+    #[derive(Default)]
+    struct App {
+        idx: usize,
+        window_id: Option<WindowId>,
+        window: Option<Window>,
+    }
+
+    impl ApplicationHandler for App {
+        fn about_to_wait(&mut self, _event_loop: &ActiveEventLoop) {
+            if let Some(window) = self.window.as_ref() {
+                window.request_redraw();
+            }
+        }
+
+        fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+            let window_attributes = Window::default_attributes()
+                .with_title("Fantastic window number one!")
+                .with_inner_size(winit::dpi::LogicalSize::new(128.0, 128.0));
+            let window = event_loop.create_window(window_attributes).unwrap();
+            self.window_id = Some(window.id());
+            self.window = Some(window);
+        }
+
+        fn window_event(
+            &mut self,
+            event_loop: &ActiveEventLoop,
+            window_id: WindowId,
+            event: WindowEvent,
+        ) {
+            if event == WindowEvent::Destroyed && self.window_id == Some(window_id) {
+                println!(
+                    "--------------------------------------------------------- Window {} Destroyed",
+                    self.idx
+                );
+                self.window_id = None;
+                event_loop.exit();
+                return;
+            }
+
+            let window = match self.window.as_mut() {
+                Some(window) => window,
+                None => return,
+            };
+
+            match event {
+                WindowEvent::CloseRequested => {
+                    println!(
+                        "--------------------------------------------------------- Window {} \
+                         CloseRequested",
+                        self.idx
+                    );
+                    fill::cleanup_window(window);
+                    self.window = None;
+                },
+                WindowEvent::RedrawRequested => {
+                    fill::fill_window(window);
+                },
+                _ => (),
+            }
+        }
+    }
+
+    tracing_subscriber::fmt::init();
+
+    let mut event_loop = EventLoop::new().unwrap();
+
+    let mut app = App { idx: 1, ..Default::default() };
+    event_loop.run_app_on_demand(&mut app)?;
+
+    println!("--------------------------------------------------------- Finished first loop");
+    println!("--------------------------------------------------------- Waiting 5 seconds");
+    std::thread::sleep(Duration::from_secs(5));
+
+    app.idx += 1;
+    event_loop.run_app_on_demand(&mut app)?;
+    println!("--------------------------------------------------------- Finished second loop");
+    Ok(())
+}
+
+#[cfg(not(any(windows_platform, macos_platform, x11_platform, wayland_platform,)))]
+fn main() {
+    println!("This example is not supported on this platform");
+}
diff --git a/vendor/winit/examples/util/fill.rs b/vendor/winit/examples/util/fill.rs
new file mode 100644
index 00000000..31540c02
--- /dev/null
+++ b/vendor/winit/examples/util/fill.rs
@@ -0,0 +1,117 @@
+//! Fill the window buffer with a solid color.
+//!
+//! Launching a window without drawing to it has unpredictable results varying from platform to
+//! platform. In order to have well-defined examples, this module provides an easy way to
+//! fill the window buffer with a solid color.
+//!
+//! The `softbuffer` crate is used, largely because of its ease of use. `glutin` or `wgpu` could
+//! also be used to fill the window buffer, but they are more complicated to use.
+
+#[allow(unused_imports)]
+pub use platform::cleanup_window;
+pub use platform::fill_window;
+
+#[cfg(all(feature = "rwh_05", not(any(target_os = "android", target_os = "ios"))))]
+mod platform {
+    use std::cell::RefCell;
+    use std::collections::HashMap;
+    use std::mem;
+    use std::mem::ManuallyDrop;
+    use std::num::NonZeroU32;
+
+    use softbuffer::{Context, Surface};
+    use winit::window::{Window, WindowId};
+
+    thread_local! {
+        // NOTE: You should never do things like that, create context and drop it before
+        // you drop the event loop. We do this for brevity to not blow up examples. We use
+        // ManuallyDrop to prevent destructors from running.
+        //
+        // A static, thread-local map of graphics contexts to open windows.
+        static GC: ManuallyDrop<RefCell<Option<GraphicsContext>>> = const { ManuallyDrop::new(RefCell::new(None)) };
+    }
+
+    /// The graphics context used to draw to a window.
+    struct GraphicsContext {
+        /// The global softbuffer context.
+        context: RefCell<Context<&'static Window>>,
+
+        /// The hash map of window IDs to surfaces.
+        surfaces: HashMap<WindowId, Surface<&'static Window, &'static Window>>,
+    }
+
+    impl GraphicsContext {
+        fn new(w: &Window) -> Self {
+            Self {
+                context: RefCell::new(
+                    Context::new(unsafe { mem::transmute::<&'_ Window, &'static Window>(w) })
+                        .expect("Failed to create a softbuffer context"),
+                ),
+                surfaces: HashMap::new(),
+            }
+        }
+
+        fn create_surface(
+            &mut self,
+            window: &Window,
+        ) -> &mut Surface<&'static Window, &'static Window> {
+            self.surfaces.entry(window.id()).or_insert_with(|| {
+                Surface::new(&self.context.borrow(), unsafe {
+                    mem::transmute::<&'_ Window, &'static Window>(window)
+                })
+                .expect("Failed to create a softbuffer surface")
+            })
+        }
+
+        fn destroy_surface(&mut self, window: &Window) {
+            self.surfaces.remove(&window.id());
+        }
+    }
+
+    pub fn fill_window(window: &Window) {
+        GC.with(|gc| {
+            let size = window.inner_size();
+            let (Some(width), Some(height)) =
+                (NonZeroU32::new(size.width), NonZeroU32::new(size.height))
+            else {
+                return;
+            };
+
+            // Either get the last context used or create a new one.
+            let mut gc = gc.borrow_mut();
+            let surface =
+                gc.get_or_insert_with(|| GraphicsContext::new(window)).create_surface(window);
+
+            // Fill a buffer with a solid color.
+            const DARK_GRAY: u32 = 0xff181818;
+
+            surface.resize(width, height).expect("Failed to resize the softbuffer surface");
+
+            let mut buffer = surface.buffer_mut().expect("Failed to get the softbuffer buffer");
+            buffer.fill(DARK_GRAY);
+            buffer.present().expect("Failed to present the softbuffer buffer");
+        })
+    }
+
+    #[allow(dead_code)]
+    pub fn cleanup_window(window: &Window) {
+        GC.with(|gc| {
+            let mut gc = gc.borrow_mut();
+            if let Some(context) = gc.as_mut() {
+                context.destroy_surface(window);
+            }
+        });
+    }
+}
+
+#[cfg(not(all(feature = "rwh_05", not(any(target_os = "android", target_os = "ios")))))]
+mod platform {
+    pub fn fill_window(_window: &winit::window::Window) {
+        // No-op on mobile platforms.
+    }
+
+    #[allow(dead_code)]
+    pub fn cleanup_window(_window: &winit::window::Window) {
+        // No-op on mobile platforms.
+    }
+}
diff --git a/vendor/winit/examples/util/tracing.rs b/vendor/winit/examples/util/tracing.rs
new file mode 100644
index 00000000..bab7ced7
--- /dev/null
+++ b/vendor/winit/examples/util/tracing.rs
@@ -0,0 +1,25 @@
+#[cfg(not(web_platform))]
+pub fn init() {
+    use tracing_subscriber::filter::{EnvFilter, LevelFilter};
+
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            EnvFilter::builder().with_default_directive(LevelFilter::INFO.into()).from_env_lossy(),
+        )
+        .init();
+}
+
+#[cfg(web_platform)]
+pub fn init() {
+    use tracing_subscriber::layer::SubscriberExt;
+    use tracing_subscriber::util::SubscriberInitExt;
+
+    tracing_subscriber::registry()
+        .with(
+            tracing_subscriber::fmt::layer()
+                .with_ansi(false)
+                .without_time()
+                .with_writer(tracing_web::MakeWebConsoleWriter::new()),
+        )
+        .init();
+}
diff --git a/vendor/winit/examples/window.rs b/vendor/winit/examples/window.rs
new file mode 100644
index 00000000..48afadf9
--- /dev/null
+++ b/vendor/winit/examples/window.rs
@@ -0,0 +1,1110 @@
+//! Simple winit application.
+
+use std::collections::HashMap;
+use std::error::Error;
+use std::fmt::Debug;
+#[cfg(not(any(android_platform, ios_platform)))]
+use std::num::NonZeroU32;
+use std::sync::Arc;
+use std::{fmt, mem};
+
+use ::tracing::{error, info};
+use cursor_icon::CursorIcon;
+#[cfg(not(any(android_platform, ios_platform)))]
+use rwh_06::{DisplayHandle, HasDisplayHandle};
+#[cfg(not(any(android_platform, ios_platform)))]
+use softbuffer::{Context, Surface};
+
+use winit::application::ApplicationHandler;
+use winit::dpi::{LogicalSize, PhysicalPosition, PhysicalSize};
+use winit::event::{DeviceEvent, DeviceId, Ime, MouseButton, MouseScrollDelta, WindowEvent};
+use winit::event_loop::{ActiveEventLoop, EventLoop};
+use winit::keyboard::{Key, ModifiersState};
+use winit::window::{
+    Cursor, CursorGrabMode, CustomCursor, CustomCursorSource, Fullscreen, Icon, ResizeDirection,
+    Theme, Window, WindowId,
+};
+
+#[cfg(macos_platform)]
+use winit::platform::macos::{OptionAsAlt, WindowAttributesExtMacOS, WindowExtMacOS};
+#[cfg(any(x11_platform, wayland_platform))]
+use winit::platform::startup_notify::{
+    self, EventLoopExtStartupNotify, WindowAttributesExtStartupNotify, WindowExtStartupNotify,
+};
+#[cfg(x11_platform)]
+use winit::platform::x11::WindowAttributesExtX11;
+
+#[path = "util/tracing.rs"]
+mod tracing;
+
+/// The amount of points to around the window for drag resize direction calculations.
+const BORDER_SIZE: f64 = 20.;
+
+fn main() -> Result<(), Box<dyn Error>> {
+    #[cfg(web_platform)]
+    console_error_panic_hook::set_once();
+
+    tracing::init();
+
+    let event_loop = EventLoop::<UserEvent>::with_user_event().build()?;
+    let _event_loop_proxy = event_loop.create_proxy();
+
+    // Wire the user event from another thread.
+    #[cfg(not(web_platform))]
+    std::thread::spawn(move || {
+        // Wake up the `event_loop` once every second and dispatch a custom event
+        // from a different thread.
+        info!("Starting to send user event every second");
+        loop {
+            let _ = _event_loop_proxy.send_event(UserEvent::WakeUp);
+            std::thread::sleep(std::time::Duration::from_secs(1));
+        }
+    });
+
+    let mut state = Application::new(&event_loop);
+
+    event_loop.run_app(&mut state).map_err(Into::into)
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Clone, Copy)]
+enum UserEvent {
+    WakeUp,
+}
+
+/// Application state and event handling.
+struct Application {
+    /// Custom cursors assets.
+    custom_cursors: Vec<CustomCursor>,
+    /// Application icon.
+    icon: Icon,
+    windows: HashMap<WindowId, WindowState>,
+    /// Drawing context.
+    ///
+    /// With OpenGL it could be EGLDisplay.
+    #[cfg(not(any(android_platform, ios_platform)))]
+    context: Option<Context<DisplayHandle<'static>>>,
+}
+
+impl Application {
+    fn new<T>(event_loop: &EventLoop<T>) -> Self {
+        // SAFETY: we drop the context right before the event loop is stopped, thus making it safe.
+        #[cfg(not(any(android_platform, ios_platform)))]
+        let context = Some(
+            Context::new(unsafe {
+                std::mem::transmute::<DisplayHandle<'_>, DisplayHandle<'static>>(
+                    event_loop.display_handle().unwrap(),
+                )
+            })
+            .unwrap(),
+        );
+
+        // You'll have to choose an icon size at your own discretion. On X11, the desired size
+        // varies by WM, and on Windows, you still have to account for screen scaling. Here
+        // we use 32px, since it seems to work well enough in most cases. Be careful about
+        // going too high, or you'll be bitten by the low-quality downscaling built into the
+        // WM.
+        let icon = load_icon(include_bytes!("data/icon.png"));
+
+        info!("Loading cursor assets");
+        let custom_cursors = vec![
+            event_loop.create_custom_cursor(decode_cursor(include_bytes!("data/cross.png"))),
+            event_loop.create_custom_cursor(decode_cursor(include_bytes!("data/cross2.png"))),
+            event_loop.create_custom_cursor(decode_cursor(include_bytes!("data/gradient.png"))),
+        ];
+
+        Self {
+            #[cfg(not(any(android_platform, ios_platform)))]
+            context,
+            custom_cursors,
+            icon,
+            windows: Default::default(),
+        }
+    }
+
+    fn create_window(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        _tab_id: Option<String>,
+    ) -> Result<WindowId, Box<dyn Error>> {
+        // TODO read-out activation token.
+
+        #[allow(unused_mut)]
+        let mut window_attributes = Window::default_attributes()
+            .with_title("Winit window")
+            .with_transparent(true)
+            .with_window_icon(Some(self.icon.clone()));
+
+        #[cfg(any(x11_platform, wayland_platform))]
+        if let Some(token) = event_loop.read_token_from_env() {
+            startup_notify::reset_activation_token_env();
+            info!("Using token {:?} to activate a window", token);
+            window_attributes = window_attributes.with_activation_token(token);
+        }
+
+        #[cfg(x11_platform)]
+        match std::env::var("X11_VISUAL_ID") {
+            Ok(visual_id_str) => {
+                info!("Using X11 visual id {visual_id_str}");
+                let visual_id = visual_id_str.parse()?;
+                window_attributes = window_attributes.with_x11_visual(visual_id);
+            },
+            Err(_) => info!("Set the X11_VISUAL_ID env variable to request specific X11 visual"),
+        }
+
+        #[cfg(x11_platform)]
+        match std::env::var("X11_SCREEN_ID") {
+            Ok(screen_id_str) => {
+                info!("Placing the window on X11 screen {screen_id_str}");
+                let screen_id = screen_id_str.parse()?;
+                window_attributes = window_attributes.with_x11_screen(screen_id);
+            },
+            Err(_) => info!(
+                "Set the X11_SCREEN_ID env variable to place the window on non-default screen"
+            ),
+        }
+
+        #[cfg(macos_platform)]
+        if let Some(tab_id) = _tab_id {
+            window_attributes = window_attributes.with_tabbing_identifier(&tab_id);
+        }
+
+        #[cfg(web_platform)]
+        {
+            use winit::platform::web::WindowAttributesExtWebSys;
+            window_attributes = window_attributes.with_append(true);
+        }
+
+        let window = event_loop.create_window(window_attributes)?;
+
+        #[cfg(ios_platform)]
+        {
+            use winit::platform::ios::WindowExtIOS;
+            window.recognize_doubletap_gesture(true);
+            window.recognize_pinch_gesture(true);
+            window.recognize_rotation_gesture(true);
+            window.recognize_pan_gesture(true, 2, 2);
+        }
+
+        let window_state = WindowState::new(self, window)?;
+        let window_id = window_state.window.id();
+        info!("Created new window with id={window_id:?}");
+        self.windows.insert(window_id, window_state);
+        Ok(window_id)
+    }
+
+    fn handle_action(&mut self, event_loop: &ActiveEventLoop, window_id: WindowId, action: Action) {
+        // let cursor_position = self.cursor_position;
+        let window = self.windows.get_mut(&window_id).unwrap();
+        info!("Executing action: {action:?}");
+        match action {
+            Action::CloseWindow => {
+                let _ = self.windows.remove(&window_id);
+            },
+            Action::CreateNewWindow => {
+                #[cfg(any(x11_platform, wayland_platform))]
+                if let Err(err) = window.window.request_activation_token() {
+                    info!("Failed to get activation token: {err}");
+                } else {
+                    return;
+                }
+
+                if let Err(err) = self.create_window(event_loop, None) {
+                    error!("Error creating new window: {err}");
+                }
+            },
+            Action::ToggleResizeIncrements => window.toggle_resize_increments(),
+            Action::ToggleCursorVisibility => window.toggle_cursor_visibility(),
+            Action::ToggleResizable => window.toggle_resizable(),
+            Action::ToggleDecorations => window.toggle_decorations(),
+            Action::ToggleFullscreen => window.toggle_fullscreen(),
+            Action::ToggleMaximize => window.toggle_maximize(),
+            Action::ToggleImeInput => window.toggle_ime(),
+            Action::Minimize => window.minimize(),
+            Action::NextCursor => window.next_cursor(),
+            Action::NextCustomCursor => window.next_custom_cursor(&self.custom_cursors),
+            #[cfg(web_platform)]
+            Action::UrlCustomCursor => window.url_custom_cursor(event_loop),
+            #[cfg(web_platform)]
+            Action::AnimationCustomCursor => {
+                window.animation_custom_cursor(event_loop, &self.custom_cursors)
+            },
+            Action::CycleCursorGrab => window.cycle_cursor_grab(),
+            Action::DragWindow => window.drag_window(),
+            Action::DragResizeWindow => window.drag_resize_window(),
+            Action::ShowWindowMenu => window.show_menu(),
+            Action::PrintHelp => self.print_help(),
+            #[cfg(macos_platform)]
+            Action::CycleOptionAsAlt => window.cycle_option_as_alt(),
+            Action::SetTheme(theme) => {
+                window.window.set_theme(theme);
+                // Get the resulting current theme to draw with
+                let actual_theme = theme.or_else(|| window.window.theme()).unwrap_or(Theme::Dark);
+                window.set_draw_theme(actual_theme);
+            },
+            #[cfg(macos_platform)]
+            Action::CreateNewTab => {
+                let tab_id = window.window.tabbing_identifier();
+                if let Err(err) = self.create_window(event_loop, Some(tab_id)) {
+                    error!("Error creating new window: {err}");
+                }
+            },
+            Action::RequestResize => window.swap_dimensions(),
+        }
+    }
+
+    fn dump_monitors(&self, event_loop: &ActiveEventLoop) {
+        info!("Monitors information");
+        let primary_monitor = event_loop.primary_monitor();
+        for monitor in event_loop.available_monitors() {
+            let intro = if primary_monitor.as_ref() == Some(&monitor) {
+                "Primary monitor"
+            } else {
+                "Monitor"
+            };
+
+            if let Some(name) = monitor.name() {
+                info!("{intro}: {name}");
+            } else {
+                info!("{intro}: [no name]");
+            }
+
+            let PhysicalSize { width, height } = monitor.size();
+            info!(
+                "  Current mode: {width}x{height}{}",
+                if let Some(m_hz) = monitor.refresh_rate_millihertz() {
+                    format!(" @ {}.{} Hz", m_hz / 1000, m_hz % 1000)
+                } else {
+                    String::new()
+                }
+            );
+
+            let PhysicalPosition { x, y } = monitor.position();
+            info!("  Position: {x},{y}");
+
+            info!("  Scale factor: {}", monitor.scale_factor());
+
+            info!("  Available modes (width x height x bit-depth):");
+            for mode in monitor.video_modes() {
+                let PhysicalSize { width, height } = mode.size();
+                let bits = mode.bit_depth();
+                let m_hz = mode.refresh_rate_millihertz();
+                info!("    {width}x{height}x{bits} @ {}.{} Hz", m_hz / 1000, m_hz % 1000);
+            }
+        }
+    }
+
+    /// Process the key binding.
+    fn process_key_binding(key: &str, mods: &ModifiersState) -> Option<Action> {
+        KEY_BINDINGS
+            .iter()
+            .find_map(|binding| binding.is_triggered_by(&key, mods).then_some(binding.action))
+    }
+
+    /// Process mouse binding.
+    fn process_mouse_binding(button: MouseButton, mods: &ModifiersState) -> Option<Action> {
+        MOUSE_BINDINGS
+            .iter()
+            .find_map(|binding| binding.is_triggered_by(&button, mods).then_some(binding.action))
+    }
+
+    fn print_help(&self) {
+        info!("Keyboard bindings:");
+        for binding in KEY_BINDINGS {
+            info!(
+                "{}{:<10} - {} ({})",
+                modifiers_to_string(binding.mods),
+                binding.trigger,
+                binding.action,
+                binding.action.help(),
+            );
+        }
+        info!("Mouse bindings:");
+        for binding in MOUSE_BINDINGS {
+            info!(
+                "{}{:<10} - {} ({})",
+                modifiers_to_string(binding.mods),
+                mouse_button_to_string(binding.trigger),
+                binding.action,
+                binding.action.help(),
+            );
+        }
+    }
+}
+
+impl ApplicationHandler<UserEvent> for Application {
+    fn user_event(&mut self, _event_loop: &ActiveEventLoop, event: UserEvent) {
+        info!("User event: {event:?}");
+    }
+
+    fn window_event(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        window_id: WindowId,
+        event: WindowEvent,
+    ) {
+        let window = match self.windows.get_mut(&window_id) {
+            Some(window) => window,
+            None => return,
+        };
+
+        match event {
+            WindowEvent::Resized(size) => {
+                window.resize(size);
+            },
+            WindowEvent::Focused(focused) => {
+                if focused {
+                    info!("Window={window_id:?} focused");
+                } else {
+                    info!("Window={window_id:?} unfocused");
+                }
+            },
+            WindowEvent::ScaleFactorChanged { scale_factor, .. } => {
+                info!("Window={window_id:?} changed scale to {scale_factor}");
+            },
+            WindowEvent::ThemeChanged(theme) => {
+                info!("Theme changed to {theme:?}");
+                window.set_draw_theme(theme);
+            },
+            WindowEvent::RedrawRequested => {
+                if let Err(err) = window.draw() {
+                    error!("Error drawing window: {err}");
+                }
+            },
+            WindowEvent::Occluded(occluded) => {
+                window.set_occluded(occluded);
+            },
+            WindowEvent::CloseRequested => {
+                info!("Closing Window={window_id:?}");
+                self.windows.remove(&window_id);
+            },
+            WindowEvent::ModifiersChanged(modifiers) => {
+                window.modifiers = modifiers.state();
+                info!("Modifiers changed to {:?}", window.modifiers);
+            },
+            WindowEvent::MouseWheel { delta, .. } => match delta {
+                MouseScrollDelta::LineDelta(x, y) => {
+                    info!("Mouse wheel Line Delta: ({x},{y})");
+                },
+                MouseScrollDelta::PixelDelta(px) => {
+                    info!("Mouse wheel Pixel Delta: ({},{})", px.x, px.y);
+                },
+            },
+            WindowEvent::KeyboardInput { event, is_synthetic: false, .. } => {
+                let mods = window.modifiers;
+
+                // Dispatch actions only on press.
+                if event.state.is_pressed() {
+                    let action = if let Key::Character(ch) = event.logical_key.as_ref() {
+                        Self::process_key_binding(&ch.to_uppercase(), &mods)
+                    } else {
+                        None
+                    };
+
+                    if let Some(action) = action {
+                        self.handle_action(event_loop, window_id, action);
+                    }
+                }
+            },
+            WindowEvent::MouseInput { button, state, .. } => {
+                let mods = window.modifiers;
+                if let Some(action) =
+                    state.is_pressed().then(|| Self::process_mouse_binding(button, &mods)).flatten()
+                {
+                    self.handle_action(event_loop, window_id, action);
+                }
+            },
+            WindowEvent::CursorLeft { .. } => {
+                info!("Cursor left Window={window_id:?}");
+                window.cursor_left();
+            },
+            WindowEvent::CursorMoved { position, .. } => {
+                info!("Moved cursor to {position:?}");
+                window.cursor_moved(position);
+            },
+            WindowEvent::ActivationTokenDone { token: _token, .. } => {
+                #[cfg(any(x11_platform, wayland_platform))]
+                {
+                    startup_notify::set_activation_token_env(_token);
+                    if let Err(err) = self.create_window(event_loop, None) {
+                        error!("Error creating new window: {err}");
+                    }
+                }
+            },
+            WindowEvent::Ime(event) => match event {
+                Ime::Enabled => info!("IME enabled for Window={window_id:?}"),
+                Ime::Preedit(text, caret_pos) => {
+                    info!("Preedit: {}, with caret at {:?}", text, caret_pos);
+                },
+                Ime::Commit(text) => {
+                    info!("Committed: {}", text);
+                },
+                Ime::Disabled => info!("IME disabled for Window={window_id:?}"),
+            },
+            WindowEvent::PinchGesture { delta, .. } => {
+                window.zoom += delta;
+                let zoom = window.zoom;
+                if delta > 0.0 {
+                    info!("Zoomed in {delta:.5} (now: {zoom:.5})");
+                } else {
+                    info!("Zoomed out {delta:.5} (now: {zoom:.5})");
+                }
+            },
+            WindowEvent::RotationGesture { delta, .. } => {
+                window.rotated += delta;
+                let rotated = window.rotated;
+                if delta > 0.0 {
+                    info!("Rotated counterclockwise {delta:.5} (now: {rotated:.5})");
+                } else {
+                    info!("Rotated clockwise {delta:.5} (now: {rotated:.5})");
+                }
+            },
+            WindowEvent::PanGesture { delta, phase, .. } => {
+                window.panned.x += delta.x;
+                window.panned.y += delta.y;
+                info!("Panned ({delta:?})) (now: {:?}), {phase:?}", window.panned);
+            },
+            WindowEvent::DoubleTapGesture { .. } => {
+                info!("Smart zoom");
+            },
+            WindowEvent::TouchpadPressure { .. }
+            | WindowEvent::HoveredFileCancelled
+            | WindowEvent::KeyboardInput { .. }
+            | WindowEvent::CursorEntered { .. }
+            | WindowEvent::AxisMotion { .. }
+            | WindowEvent::DroppedFile(_)
+            | WindowEvent::HoveredFile(_)
+            | WindowEvent::Destroyed
+            | WindowEvent::Touch(_)
+            | WindowEvent::Moved(_) => (),
+        }
+    }
+
+    fn device_event(
+        &mut self,
+        _event_loop: &ActiveEventLoop,
+        device_id: DeviceId,
+        event: DeviceEvent,
+    ) {
+        info!("Device {device_id:?} event: {event:?}");
+    }
+
+    fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+        info!("Resumed the event loop");
+        self.dump_monitors(event_loop);
+
+        // Create initial window.
+        self.create_window(event_loop, None).expect("failed to create initial window");
+
+        self.print_help();
+    }
+
+    fn about_to_wait(&mut self, event_loop: &ActiveEventLoop) {
+        if self.windows.is_empty() {
+            info!("No windows left, exiting...");
+            event_loop.exit();
+        }
+    }
+
+    #[cfg(not(any(android_platform, ios_platform)))]
+    fn exiting(&mut self, _event_loop: &ActiveEventLoop) {
+        // We must drop the context here.
+        self.context = None;
+    }
+}
+
+/// State of the window.
+struct WindowState {
+    /// IME input.
+    ime: bool,
+    /// Render surface.
+    ///
+    /// NOTE: This surface must be dropped before the `Window`.
+    #[cfg(not(any(android_platform, ios_platform)))]
+    surface: Surface<DisplayHandle<'static>, Arc<Window>>,
+    /// The actual winit Window.
+    window: Arc<Window>,
+    /// The window theme we're drawing with.
+    theme: Theme,
+    /// Cursor position over the window.
+    cursor_position: Option<PhysicalPosition<f64>>,
+    /// Window modifiers state.
+    modifiers: ModifiersState,
+    /// Occlusion state of the window.
+    occluded: bool,
+    /// Current cursor grab mode.
+    cursor_grab: CursorGrabMode,
+    /// The amount of zoom into window.
+    zoom: f64,
+    /// The amount of rotation of the window.
+    rotated: f32,
+    /// The amount of pan of the window.
+    panned: PhysicalPosition<f32>,
+
+    #[cfg(macos_platform)]
+    option_as_alt: OptionAsAlt,
+
+    // Cursor states.
+    named_idx: usize,
+    custom_idx: usize,
+    cursor_hidden: bool,
+}
+
+impl WindowState {
+    fn new(app: &Application, window: Window) -> Result<Self, Box<dyn Error>> {
+        let window = Arc::new(window);
+
+        // SAFETY: the surface is dropped before the `window` which provided it with handle, thus
+        // it doesn't outlive it.
+        #[cfg(not(any(android_platform, ios_platform)))]
+        let surface = Surface::new(app.context.as_ref().unwrap(), Arc::clone(&window))?;
+
+        let theme = window.theme().unwrap_or(Theme::Dark);
+        info!("Theme: {theme:?}");
+        let named_idx = 0;
+        window.set_cursor(CURSORS[named_idx]);
+
+        // Allow IME out of the box.
+        let ime = true;
+        window.set_ime_allowed(ime);
+
+        let size = window.inner_size();
+        let mut state = Self {
+            #[cfg(macos_platform)]
+            option_as_alt: window.option_as_alt(),
+            custom_idx: app.custom_cursors.len() - 1,
+            cursor_grab: CursorGrabMode::None,
+            named_idx,
+            #[cfg(not(any(android_platform, ios_platform)))]
+            surface,
+            window,
+            theme,
+            ime,
+            cursor_position: Default::default(),
+            cursor_hidden: Default::default(),
+            modifiers: Default::default(),
+            occluded: Default::default(),
+            rotated: Default::default(),
+            panned: Default::default(),
+            zoom: Default::default(),
+        };
+
+        state.resize(size);
+        Ok(state)
+    }
+
+    pub fn toggle_ime(&mut self) {
+        self.ime = !self.ime;
+        self.window.set_ime_allowed(self.ime);
+        if let Some(position) = self.ime.then_some(self.cursor_position).flatten() {
+            self.window.set_ime_cursor_area(position, PhysicalSize::new(20, 20));
+        }
+    }
+
+    pub fn minimize(&mut self) {
+        self.window.set_minimized(true);
+    }
+
+    pub fn cursor_moved(&mut self, position: PhysicalPosition<f64>) {
+        self.cursor_position = Some(position);
+        if self.ime {
+            self.window.set_ime_cursor_area(position, PhysicalSize::new(20, 20));
+        }
+    }
+
+    pub fn cursor_left(&mut self) {
+        self.cursor_position = None;
+    }
+
+    /// Toggle maximized.
+    fn toggle_maximize(&self) {
+        let maximized = self.window.is_maximized();
+        self.window.set_maximized(!maximized);
+    }
+
+    /// Toggle window decorations.
+    fn toggle_decorations(&self) {
+        let decorated = self.window.is_decorated();
+        self.window.set_decorations(!decorated);
+    }
+
+    /// Toggle window resizable state.
+    fn toggle_resizable(&self) {
+        let resizable = self.window.is_resizable();
+        self.window.set_resizable(!resizable);
+    }
+
+    /// Toggle cursor visibility
+    fn toggle_cursor_visibility(&mut self) {
+        self.cursor_hidden = !self.cursor_hidden;
+        self.window.set_cursor_visible(!self.cursor_hidden);
+    }
+
+    /// Toggle resize increments on a window.
+    fn toggle_resize_increments(&mut self) {
+        let new_increments = match self.window.resize_increments() {
+            Some(_) => None,
+            None => Some(LogicalSize::new(25.0, 25.0)),
+        };
+        info!("Had increments: {}", new_increments.is_none());
+        self.window.set_resize_increments(new_increments);
+    }
+
+    /// Toggle fullscreen.
+    fn toggle_fullscreen(&self) {
+        let fullscreen = if self.window.fullscreen().is_some() {
+            None
+        } else {
+            Some(Fullscreen::Borderless(None))
+        };
+
+        self.window.set_fullscreen(fullscreen);
+    }
+
+    /// Cycle through the grab modes ignoring errors.
+    fn cycle_cursor_grab(&mut self) {
+        self.cursor_grab = match self.cursor_grab {
+            CursorGrabMode::None => CursorGrabMode::Confined,
+            CursorGrabMode::Confined => CursorGrabMode::Locked,
+            CursorGrabMode::Locked => CursorGrabMode::None,
+        };
+        info!("Changing cursor grab mode to {:?}", self.cursor_grab);
+        if let Err(err) = self.window.set_cursor_grab(self.cursor_grab) {
+            error!("Error setting cursor grab: {err}");
+        }
+    }
+
+    #[cfg(macos_platform)]
+    fn cycle_option_as_alt(&mut self) {
+        self.option_as_alt = match self.option_as_alt {
+            OptionAsAlt::None => OptionAsAlt::OnlyLeft,
+            OptionAsAlt::OnlyLeft => OptionAsAlt::OnlyRight,
+            OptionAsAlt::OnlyRight => OptionAsAlt::Both,
+            OptionAsAlt::Both => OptionAsAlt::None,
+        };
+        info!("Setting option as alt {:?}", self.option_as_alt);
+        self.window.set_option_as_alt(self.option_as_alt);
+    }
+
+    /// Swap the window dimensions with `request_inner_size`.
+    fn swap_dimensions(&mut self) {
+        let old_inner_size = self.window.inner_size();
+        let mut inner_size = old_inner_size;
+
+        mem::swap(&mut inner_size.width, &mut inner_size.height);
+        info!("Requesting resize from {old_inner_size:?} to {inner_size:?}");
+
+        if let Some(new_inner_size) = self.window.request_inner_size(inner_size) {
+            if old_inner_size == new_inner_size {
+                info!("Inner size change got ignored");
+            } else {
+                self.resize(new_inner_size);
+            }
+        } else {
+            info!("Request inner size is asynchronous");
+        }
+    }
+
+    /// Pick the next cursor.
+    fn next_cursor(&mut self) {
+        self.named_idx = (self.named_idx + 1) % CURSORS.len();
+        info!("Setting cursor to \"{:?}\"", CURSORS[self.named_idx]);
+        self.window.set_cursor(Cursor::Icon(CURSORS[self.named_idx]));
+    }
+
+    /// Pick the next custom cursor.
+    fn next_custom_cursor(&mut self, custom_cursors: &[CustomCursor]) {
+        self.custom_idx = (self.custom_idx + 1) % custom_cursors.len();
+        let cursor = Cursor::Custom(custom_cursors[self.custom_idx].clone());
+        self.window.set_cursor(cursor);
+    }
+
+    /// Custom cursor from an URL.
+    #[cfg(web_platform)]
+    fn url_custom_cursor(&mut self, event_loop: &ActiveEventLoop) {
+        let cursor = event_loop.create_custom_cursor(url_custom_cursor());
+
+        self.window.set_cursor(cursor);
+    }
+
+    /// Custom cursor from a URL.
+    #[cfg(web_platform)]
+    fn animation_custom_cursor(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        custom_cursors: &[CustomCursor],
+    ) {
+        use std::time::Duration;
+        use winit::platform::web::CustomCursorExtWebSys;
+
+        let cursors = vec![
+            custom_cursors[0].clone(),
+            custom_cursors[1].clone(),
+            event_loop.create_custom_cursor(url_custom_cursor()),
+        ];
+        let cursor = CustomCursor::from_animation(Duration::from_secs(3), cursors).unwrap();
+        let cursor = event_loop.create_custom_cursor(cursor);
+
+        self.window.set_cursor(cursor);
+    }
+
+    /// Resize the window to the new size.
+    fn resize(&mut self, size: PhysicalSize<u32>) {
+        info!("Resized to {size:?}");
+        #[cfg(not(any(android_platform, ios_platform)))]
+        {
+            let (width, height) = match (NonZeroU32::new(size.width), NonZeroU32::new(size.height))
+            {
+                (Some(width), Some(height)) => (width, height),
+                _ => return,
+            };
+            self.surface.resize(width, height).expect("failed to resize inner buffer");
+        }
+        self.window.request_redraw();
+    }
+
+    /// Change the theme that things are drawn in.
+    fn set_draw_theme(&mut self, theme: Theme) {
+        self.theme = theme;
+        self.window.request_redraw();
+    }
+
+    /// Show window menu.
+    fn show_menu(&self) {
+        if let Some(position) = self.cursor_position {
+            self.window.show_window_menu(position);
+        }
+    }
+
+    /// Drag the window.
+    fn drag_window(&self) {
+        if let Err(err) = self.window.drag_window() {
+            info!("Error starting window drag: {err}");
+        } else {
+            info!("Dragging window Window={:?}", self.window.id());
+        }
+    }
+
+    /// Drag-resize the window.
+    fn drag_resize_window(&self) {
+        let position = match self.cursor_position {
+            Some(position) => position,
+            None => {
+                info!("Drag-resize requires cursor to be inside the window");
+                return;
+            },
+        };
+
+        let win_size = self.window.inner_size();
+        let border_size = BORDER_SIZE * self.window.scale_factor();
+
+        let x_direction = if position.x < border_size {
+            ResizeDirection::West
+        } else if position.x > (win_size.width as f64 - border_size) {
+            ResizeDirection::East
+        } else {
+            // Use arbitrary direction instead of None for simplicity.
+            ResizeDirection::SouthEast
+        };
+
+        let y_direction = if position.y < border_size {
+            ResizeDirection::North
+        } else if position.y > (win_size.height as f64 - border_size) {
+            ResizeDirection::South
+        } else {
+            // Use arbitrary direction instead of None for simplicity.
+            ResizeDirection::SouthEast
+        };
+
+        let direction = match (x_direction, y_direction) {
+            (ResizeDirection::West, ResizeDirection::North) => ResizeDirection::NorthWest,
+            (ResizeDirection::West, ResizeDirection::South) => ResizeDirection::SouthWest,
+            (ResizeDirection::West, _) => ResizeDirection::West,
+            (ResizeDirection::East, ResizeDirection::North) => ResizeDirection::NorthEast,
+            (ResizeDirection::East, ResizeDirection::South) => ResizeDirection::SouthEast,
+            (ResizeDirection::East, _) => ResizeDirection::East,
+            (_, ResizeDirection::South) => ResizeDirection::South,
+            (_, ResizeDirection::North) => ResizeDirection::North,
+            _ => return,
+        };
+
+        if let Err(err) = self.window.drag_resize_window(direction) {
+            info!("Error starting window drag-resize: {err}");
+        } else {
+            info!("Drag-resizing window Window={:?}", self.window.id());
+        }
+    }
+
+    /// Change window occlusion state.
+    fn set_occluded(&mut self, occluded: bool) {
+        self.occluded = occluded;
+        if !occluded {
+            self.window.request_redraw();
+        }
+    }
+
+    /// Draw the window contents.
+    #[cfg(not(any(android_platform, ios_platform)))]
+    fn draw(&mut self) -> Result<(), Box<dyn Error>> {
+        if self.occluded {
+            info!("Skipping drawing occluded window={:?}", self.window.id());
+            return Ok(());
+        }
+
+        const WHITE: u32 = 0xffffffff;
+        const DARK_GRAY: u32 = 0xff181818;
+
+        let color = match self.theme {
+            Theme::Light => WHITE,
+            Theme::Dark => DARK_GRAY,
+        };
+
+        let mut buffer = self.surface.buffer_mut()?;
+        buffer.fill(color);
+        self.window.pre_present_notify();
+        buffer.present()?;
+        Ok(())
+    }
+
+    #[cfg(any(android_platform, ios_platform))]
+    fn draw(&mut self) -> Result<(), Box<dyn Error>> {
+        info!("Drawing but without rendering...");
+        Ok(())
+    }
+}
+
+struct Binding<T: Eq> {
+    trigger: T,
+    mods: ModifiersState,
+    action: Action,
+}
+
+impl<T: Eq> Binding<T> {
+    const fn new(trigger: T, mods: ModifiersState, action: Action) -> Self {
+        Self { trigger, mods, action }
+    }
+
+    fn is_triggered_by(&self, trigger: &T, mods: &ModifiersState) -> bool {
+        &self.trigger == trigger && &self.mods == mods
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Action {
+    CloseWindow,
+    ToggleCursorVisibility,
+    CreateNewWindow,
+    ToggleResizeIncrements,
+    ToggleImeInput,
+    ToggleDecorations,
+    ToggleResizable,
+    ToggleFullscreen,
+    ToggleMaximize,
+    Minimize,
+    NextCursor,
+    NextCustomCursor,
+    #[cfg(web_platform)]
+    UrlCustomCursor,
+    #[cfg(web_platform)]
+    AnimationCustomCursor,
+    CycleCursorGrab,
+    PrintHelp,
+    DragWindow,
+    DragResizeWindow,
+    ShowWindowMenu,
+    #[cfg(macos_platform)]
+    CycleOptionAsAlt,
+    SetTheme(Option<Theme>),
+    #[cfg(macos_platform)]
+    CreateNewTab,
+    RequestResize,
+}
+
+impl Action {
+    fn help(&self) -> &'static str {
+        match self {
+            Action::CloseWindow => "Close window",
+            Action::ToggleCursorVisibility => "Hide cursor",
+            Action::CreateNewWindow => "Create new window",
+            Action::ToggleImeInput => "Toggle IME input",
+            Action::ToggleDecorations => "Toggle decorations",
+            Action::ToggleResizable => "Toggle window resizable state",
+            Action::ToggleFullscreen => "Toggle fullscreen",
+            Action::ToggleMaximize => "Maximize",
+            Action::Minimize => "Minimize",
+            Action::ToggleResizeIncrements => "Use resize increments when resizing window",
+            Action::NextCursor => "Advance the cursor to the next value",
+            Action::NextCustomCursor => "Advance custom cursor to the next value",
+            #[cfg(web_platform)]
+            Action::UrlCustomCursor => "Custom cursor from an URL",
+            #[cfg(web_platform)]
+            Action::AnimationCustomCursor => "Custom cursor from an animation",
+            Action::CycleCursorGrab => "Cycle through cursor grab mode",
+            Action::PrintHelp => "Print help",
+            Action::DragWindow => "Start window drag",
+            Action::DragResizeWindow => "Start window drag-resize",
+            Action::ShowWindowMenu => "Show window menu",
+            #[cfg(macos_platform)]
+            Action::CycleOptionAsAlt => "Cycle option as alt mode",
+            Action::SetTheme(None) => "Change to the system theme",
+            Action::SetTheme(Some(Theme::Light)) => "Change to a light theme",
+            Action::SetTheme(Some(Theme::Dark)) => "Change to a dark theme",
+            #[cfg(macos_platform)]
+            Action::CreateNewTab => "Create new tab",
+            Action::RequestResize => "Request a resize",
+        }
+    }
+}
+
+impl fmt::Display for Action {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        Debug::fmt(&self, f)
+    }
+}
+
+fn decode_cursor(bytes: &[u8]) -> CustomCursorSource {
+    let img = image::load_from_memory(bytes).unwrap().to_rgba8();
+    let samples = img.into_flat_samples();
+    let (_, w, h) = samples.extents();
+    let (w, h) = (w as u16, h as u16);
+    CustomCursor::from_rgba(samples.samples, w, h, w / 2, h / 2).unwrap()
+}
+
+#[cfg(web_platform)]
+fn url_custom_cursor() -> CustomCursorSource {
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    use winit::platform::web::CustomCursorExtWebSys;
+
+    static URL_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+    CustomCursor::from_url(
+        format!("https://picsum.photos/128?random={}", URL_COUNTER.fetch_add(1, Ordering::Relaxed)),
+        64,
+        64,
+    )
+}
+
+fn load_icon(bytes: &[u8]) -> Icon {
+    let (icon_rgba, icon_width, icon_height) = {
+        let image = image::load_from_memory(bytes).unwrap().into_rgba8();
+        let (width, height) = image.dimensions();
+        let rgba = image.into_raw();
+        (rgba, width, height)
+    };
+    Icon::from_rgba(icon_rgba, icon_width, icon_height).expect("Failed to open icon")
+}
+
+fn modifiers_to_string(mods: ModifiersState) -> String {
+    let mut mods_line = String::new();
+    // Always add + since it's printed as a part of the bindings.
+    for (modifier, desc) in [
+        (ModifiersState::SUPER, "Super+"),
+        (ModifiersState::ALT, "Alt+"),
+        (ModifiersState::CONTROL, "Ctrl+"),
+        (ModifiersState::SHIFT, "Shift+"),
+    ] {
+        if !mods.contains(modifier) {
+            continue;
+        }
+
+        mods_line.push_str(desc);
+    }
+    mods_line
+}
+
+fn mouse_button_to_string(button: MouseButton) -> &'static str {
+    match button {
+        MouseButton::Left => "LMB",
+        MouseButton::Right => "RMB",
+        MouseButton::Middle => "MMB",
+        MouseButton::Back => "Back",
+        MouseButton::Forward => "Forward",
+        MouseButton::Other(_) => "",
+    }
+}
+
+/// Cursor list to cycle through.
+const CURSORS: &[CursorIcon] = &[
+    CursorIcon::Default,
+    CursorIcon::Crosshair,
+    CursorIcon::Pointer,
+    CursorIcon::Move,
+    CursorIcon::Text,
+    CursorIcon::Wait,
+    CursorIcon::Help,
+    CursorIcon::Progress,
+    CursorIcon::NotAllowed,
+    CursorIcon::ContextMenu,
+    CursorIcon::Cell,
+    CursorIcon::VerticalText,
+    CursorIcon::Alias,
+    CursorIcon::Copy,
+    CursorIcon::NoDrop,
+    CursorIcon::Grab,
+    CursorIcon::Grabbing,
+    CursorIcon::AllScroll,
+    CursorIcon::ZoomIn,
+    CursorIcon::ZoomOut,
+    CursorIcon::EResize,
+    CursorIcon::NResize,
+    CursorIcon::NeResize,
+    CursorIcon::NwResize,
+    CursorIcon::SResize,
+    CursorIcon::SeResize,
+    CursorIcon::SwResize,
+    CursorIcon::WResize,
+    CursorIcon::EwResize,
+    CursorIcon::NsResize,
+    CursorIcon::NeswResize,
+    CursorIcon::NwseResize,
+    CursorIcon::ColResize,
+    CursorIcon::RowResize,
+];
+
+const KEY_BINDINGS: &[Binding<&'static str>] = &[
+    Binding::new("Q", ModifiersState::CONTROL, Action::CloseWindow),
+    Binding::new("H", ModifiersState::CONTROL, Action::PrintHelp),
+    Binding::new("F", ModifiersState::CONTROL, Action::ToggleFullscreen),
+    Binding::new("D", ModifiersState::CONTROL, Action::ToggleDecorations),
+    Binding::new("I", ModifiersState::CONTROL, Action::ToggleImeInput),
+    Binding::new("L", ModifiersState::CONTROL, Action::CycleCursorGrab),
+    Binding::new("P", ModifiersState::CONTROL, Action::ToggleResizeIncrements),
+    Binding::new("R", ModifiersState::CONTROL, Action::ToggleResizable),
+    Binding::new("R", ModifiersState::ALT, Action::RequestResize),
+    // M.
+    Binding::new("M", ModifiersState::CONTROL, Action::ToggleMaximize),
+    Binding::new("M", ModifiersState::ALT, Action::Minimize),
+    // N.
+    Binding::new("N", ModifiersState::CONTROL, Action::CreateNewWindow),
+    // C.
+    Binding::new("C", ModifiersState::CONTROL, Action::NextCursor),
+    Binding::new("C", ModifiersState::ALT, Action::NextCustomCursor),
+    #[cfg(web_platform)]
+    Binding::new(
+        "C",
+        ModifiersState::CONTROL.union(ModifiersState::SHIFT),
+        Action::UrlCustomCursor,
+    ),
+    #[cfg(web_platform)]
+    Binding::new(
+        "C",
+        ModifiersState::ALT.union(ModifiersState::SHIFT),
+        Action::AnimationCustomCursor,
+    ),
+    Binding::new("Z", ModifiersState::CONTROL, Action::ToggleCursorVisibility),
+    // K.
+    Binding::new("K", ModifiersState::empty(), Action::SetTheme(None)),
+    Binding::new("K", ModifiersState::SUPER, Action::SetTheme(Some(Theme::Light))),
+    Binding::new("K", ModifiersState::CONTROL, Action::SetTheme(Some(Theme::Dark))),
+    #[cfg(macos_platform)]
+    Binding::new("T", ModifiersState::SUPER, Action::CreateNewTab),
+    #[cfg(macos_platform)]
+    Binding::new("O", ModifiersState::CONTROL, Action::CycleOptionAsAlt),
+];
+
+const MOUSE_BINDINGS: &[Binding<MouseButton>] = &[
+    Binding::new(MouseButton::Left, ModifiersState::ALT, Action::DragResizeWindow),
+    Binding::new(MouseButton::Left, ModifiersState::CONTROL, Action::DragWindow),
+    Binding::new(MouseButton::Right, ModifiersState::CONTROL, Action::ShowWindowMenu),
+];
diff --git a/vendor/winit/examples/x11_embed.rs b/vendor/winit/examples/x11_embed.rs
new file mode 100644
index 00000000..9db55e5c
--- /dev/null
+++ b/vendor/winit/examples/x11_embed.rs
@@ -0,0 +1,69 @@
+//! A demonstration of embedding a winit window in an existing X11 application.
+use std::error::Error;
+
+#[cfg(x11_platform)]
+fn main() -> Result<(), Box<dyn Error>> {
+    use winit::application::ApplicationHandler;
+    use winit::event::WindowEvent;
+    use winit::event_loop::{ActiveEventLoop, EventLoop};
+    use winit::platform::x11::WindowAttributesExtX11;
+    use winit::window::{Window, WindowId};
+
+    #[path = "util/fill.rs"]
+    mod fill;
+
+    pub struct XEmbedDemo {
+        parent_window_id: u32,
+        window: Option<Window>,
+    }
+
+    impl ApplicationHandler for XEmbedDemo {
+        fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+            let window_attributes = Window::default_attributes()
+                .with_title("An embedded window!")
+                .with_inner_size(winit::dpi::LogicalSize::new(128.0, 128.0))
+                .with_embed_parent_window(self.parent_window_id);
+
+            self.window = Some(event_loop.create_window(window_attributes).unwrap());
+        }
+
+        fn window_event(
+            &mut self,
+            event_loop: &ActiveEventLoop,
+            _window_id: WindowId,
+            event: WindowEvent,
+        ) {
+            let window = self.window.as_ref().unwrap();
+            match event {
+                WindowEvent::CloseRequested => event_loop.exit(),
+                WindowEvent::RedrawRequested => {
+                    window.pre_present_notify();
+                    fill::fill_window(window);
+                },
+                _ => (),
+            }
+        }
+
+        fn about_to_wait(&mut self, _event_loop: &ActiveEventLoop) {
+            self.window.as_ref().unwrap().request_redraw();
+        }
+    }
+
+    // First argument should be a 32-bit X11 window ID.
+    let parent_window_id = std::env::args()
+        .nth(1)
+        .ok_or("Expected a 32-bit X11 window ID as the first argument.")?
+        .parse::<u32>()?;
+
+    tracing_subscriber::fmt::init();
+    let event_loop = EventLoop::new()?;
+
+    let mut app = XEmbedDemo { parent_window_id, window: None };
+    event_loop.run_app(&mut app).map_err(Into::into)
+}
+
+#[cfg(not(x11_platform))]
+fn main() -> Result<(), Box<dyn Error>> {
+    println!("This example is only supported on X11 platforms.");
+    Ok(())
+}
diff --git a/vendor/winit/src/application.rs b/vendor/winit/src/application.rs
new file mode 100644
index 00000000..977a7c79
--- /dev/null
+++ b/vendor/winit/src/application.rs
@@ -0,0 +1,339 @@
+//! End user application handling.
+
+use crate::event::{DeviceEvent, DeviceId, StartCause, WindowEvent};
+use crate::event_loop::ActiveEventLoop;
+use crate::window::WindowId;
+
+/// The handler of the application events.
+pub trait ApplicationHandler<T: 'static = ()> {
+    /// Emitted when new events arrive from the OS to be processed.
+    ///
+    /// This is a useful place to put code that should be done before you start processing
+    /// events, such as updating frame timing information for benchmarking or checking the
+    /// [`StartCause`] to see if a timer set by
+    /// [`ControlFlow::WaitUntil`][crate::event_loop::ControlFlow::WaitUntil] has elapsed.
+    fn new_events(&mut self, event_loop: &ActiveEventLoop, cause: StartCause) {
+        let _ = (event_loop, cause);
+    }
+
+    /// Emitted when the application has been resumed.
+    ///
+    /// For consistency, all platforms emit a `Resumed` event even if they don't themselves have a
+    /// formal suspend/resume lifecycle. For systems without a formal suspend/resume lifecycle
+    /// the `Resumed` event is always emitted after the
+    /// [`NewEvents(StartCause::Init)`][StartCause::Init] event.
+    ///
+    /// # Portability
+    ///
+    /// It's recommended that applications should only initialize their graphics context and create
+    /// a window after they have received their first `Resumed` event. Some systems
+    /// (specifically Android) won't allow applications to create a render surface until they are
+    /// resumed.
+    ///
+    /// Considering that the implementation of [`Suspended`] and `Resumed` events may be internally
+    /// driven by multiple platform-specific events, and that there may be subtle differences across
+    /// platforms with how these internal events are delivered, it's recommended that applications
+    /// be able to gracefully handle redundant (i.e. back-to-back) [`Suspended`] or `Resumed`
+    /// events.
+    ///
+    /// Also see [`Suspended`] notes.
+    ///
+    /// ## Android
+    ///
+    /// On Android, the `Resumed` event is sent when a new [`SurfaceView`] has been created. This is
+    /// expected to closely correlate with the [`onResume`] lifecycle event but there may
+    /// technically be a discrepancy.
+    ///
+    /// [`onResume`]: https://developer.android.com/reference/android/app/Activity#onResume()
+    ///
+    /// Applications that need to run on Android must wait until they have been `Resumed`
+    /// before they will be able to create a render surface (such as an `EGLSurface`,
+    /// [`VkSurfaceKHR`] or [`wgpu::Surface`]) which depend on having a
+    /// [`SurfaceView`]. Applications must also assume that if they are [`Suspended`], then their
+    /// render surfaces are invalid and should be dropped.
+    ///
+    /// Also see [`Suspended`] notes.
+    ///
+    /// [`SurfaceView`]: https://developer.android.com/reference/android/view/SurfaceView
+    /// [Activity lifecycle]: https://developer.android.com/guide/components/activities/activity-lifecycle
+    /// [`VkSurfaceKHR`]: https://www.khronos.org/registry/vulkan/specs/1.3-extensions/man/html/VkSurfaceKHR.html
+    /// [`wgpu::Surface`]: https://docs.rs/wgpu/latest/wgpu/struct.Surface.html
+    ///
+    /// ## iOS
+    ///
+    /// On iOS, the `Resumed` event is emitted in response to an [`applicationDidBecomeActive`]
+    /// callback which means the application is "active" (according to the
+    /// [iOS application lifecycle]).
+    ///
+    /// [`applicationDidBecomeActive`]: https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1622956-applicationdidbecomeactive
+    /// [iOS application lifecycle]: https://developer.apple.com/documentation/uikit/app_and_environment/managing_your_app_s_life_cycle
+    ///
+    /// ## Web
+    ///
+    /// On Web, the `Resumed` event is emitted in response to a [`pageshow`] event
+    /// with the property [`persisted`] being true, which means that the page is being
+    /// restored from the [`bfcache`] (back/forward cache) - an in-memory cache that
+    /// stores a complete snapshot of a page (including the JavaScript heap) as the
+    /// user is navigating away.
+    ///
+    /// [`pageshow`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/pageshow_event
+    /// [`persisted`]: https://developer.mozilla.org/en-US/docs/Web/API/PageTransitionEvent/persisted
+    /// [`bfcache`]: https://web.dev/bfcache/
+    /// [`Suspended`]: Self::suspended
+    fn resumed(&mut self, event_loop: &ActiveEventLoop);
+
+    /// Emitted when an event is sent from [`EventLoopProxy::send_event`].
+    ///
+    /// [`EventLoopProxy::send_event`]: crate::event_loop::EventLoopProxy::send_event
+    fn user_event(&mut self, event_loop: &ActiveEventLoop, event: T) {
+        let _ = (event_loop, event);
+    }
+
+    /// Emitted when the OS sends an event to a winit window.
+    fn window_event(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        window_id: WindowId,
+        event: WindowEvent,
+    );
+
+    /// Emitted when the OS sends an event to a device.
+    fn device_event(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        device_id: DeviceId,
+        event: DeviceEvent,
+    ) {
+        let _ = (event_loop, device_id, event);
+    }
+
+    /// Emitted when the event loop is about to block and wait for new events.
+    ///
+    /// Most applications shouldn't need to hook into this event since there is no real relationship
+    /// between how often the event loop needs to wake up and the dispatching of any specific
+    /// events.
+    ///
+    /// High frequency event sources, such as input devices could potentially lead to lots of wake
+    /// ups and also lots of corresponding `AboutToWait` events.
+    ///
+    /// This is not an ideal event to drive application rendering from and instead applications
+    /// should render in response to [`WindowEvent::RedrawRequested`] events.
+    fn about_to_wait(&mut self, event_loop: &ActiveEventLoop) {
+        let _ = event_loop;
+    }
+
+    /// Emitted when the application has been suspended.
+    ///
+    /// # Portability
+    ///
+    /// Not all platforms support the notion of suspending applications, and there may be no
+    /// technical way to guarantee being able to emit a `Suspended` event if the OS has
+    /// no formal application lifecycle (currently only Android, iOS, and Web do). For this reason,
+    /// Winit does not currently try to emit pseudo `Suspended` events before the application
+    /// quits on platforms without an application lifecycle.
+    ///
+    /// Considering that the implementation of `Suspended` and [`Resumed`] events may be internally
+    /// driven by multiple platform-specific events, and that there may be subtle differences across
+    /// platforms with how these internal events are delivered, it's recommended that applications
+    /// be able to gracefully handle redundant (i.e. back-to-back) `Suspended` or [`Resumed`]
+    /// events.
+    ///
+    /// Also see [`Resumed`] notes.
+    ///
+    /// ## Android
+    ///
+    /// On Android, the `Suspended` event is only sent when the application's associated
+    /// [`SurfaceView`] is destroyed. This is expected to closely correlate with the [`onPause`]
+    /// lifecycle event but there may technically be a discrepancy.
+    ///
+    /// [`onPause`]: https://developer.android.com/reference/android/app/Activity#onPause()
+    ///
+    /// Applications that need to run on Android should assume their [`SurfaceView`] has been
+    /// destroyed, which indirectly invalidates any existing render surfaces that may have been
+    /// created outside of Winit (such as an `EGLSurface`, [`VkSurfaceKHR`] or [`wgpu::Surface`]).
+    ///
+    /// After being `Suspended` on Android applications must drop all render surfaces before
+    /// the event callback completes, which may be re-created when the application is next
+    /// [`Resumed`].
+    ///
+    /// [`SurfaceView`]: https://developer.android.com/reference/android/view/SurfaceView
+    /// [Activity lifecycle]: https://developer.android.com/guide/components/activities/activity-lifecycle
+    /// [`VkSurfaceKHR`]: https://www.khronos.org/registry/vulkan/specs/1.3-extensions/man/html/VkSurfaceKHR.html
+    /// [`wgpu::Surface`]: https://docs.rs/wgpu/latest/wgpu/struct.Surface.html
+    ///
+    /// ## iOS
+    ///
+    /// On iOS, the `Suspended` event is currently emitted in response to an
+    /// [`applicationWillResignActive`] callback which means that the application is
+    /// about to transition from the active to inactive state (according to the
+    /// [iOS application lifecycle]).
+    ///
+    /// [`applicationWillResignActive`]: https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1622950-applicationwillresignactive
+    /// [iOS application lifecycle]: https://developer.apple.com/documentation/uikit/app_and_environment/managing_your_app_s_life_cycle
+    ///
+    /// ## Web
+    ///
+    /// On Web, the `Suspended` event is emitted in response to a [`pagehide`] event
+    /// with the property [`persisted`] being true, which means that the page is being
+    /// put in the [`bfcache`] (back/forward cache) - an in-memory cache that stores a
+    /// complete snapshot of a page (including the JavaScript heap) as the user is
+    /// navigating away.
+    ///
+    /// [`pagehide`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/pagehide_event
+    /// [`persisted`]: https://developer.mozilla.org/en-US/docs/Web/API/PageTransitionEvent/persisted
+    /// [`bfcache`]: https://web.dev/bfcache/
+    /// [`Resumed`]: Self::resumed
+    fn suspended(&mut self, event_loop: &ActiveEventLoop) {
+        let _ = event_loop;
+    }
+
+    /// Emitted when the event loop is being shut down.
+    ///
+    /// This is irreversible - if this method is called, it is guaranteed that the event loop
+    /// will exit right after.
+    fn exiting(&mut self, event_loop: &ActiveEventLoop) {
+        let _ = event_loop;
+    }
+
+    /// Emitted when the application has received a memory warning.
+    ///
+    /// ## Platform-specific
+    ///
+    /// ### Android
+    ///
+    /// On Android, the `MemoryWarning` event is sent when [`onLowMemory`] was called. The
+    /// application must [release memory] or risk being killed.
+    ///
+    /// [`onLowMemory`]: https://developer.android.com/reference/android/app/Application.html#onLowMemory()
+    /// [release memory]: https://developer.android.com/topic/performance/memory#release
+    ///
+    /// ### iOS
+    ///
+    /// On iOS, the `MemoryWarning` event is emitted in response to an
+    /// [`applicationDidReceiveMemoryWarning`] callback. The application must free as much
+    /// memory as possible or risk being terminated, see [how to respond to memory warnings].
+    ///
+    /// [`applicationDidReceiveMemoryWarning`]: https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1623063-applicationdidreceivememorywarni
+    /// [how to respond to memory warnings]: https://developer.apple.com/documentation/uikit/app_and_environment/managing_your_app_s_life_cycle/responding_to_memory_warnings
+    ///
+    /// ### Others
+    ///
+    /// - **macOS / Orbital / Wayland / Web / Windows:** Unsupported.
+    fn memory_warning(&mut self, event_loop: &ActiveEventLoop) {
+        let _ = event_loop;
+    }
+}
+
+impl<A: ?Sized + ApplicationHandler<T>, T: 'static> ApplicationHandler<T> for &mut A {
+    #[inline]
+    fn new_events(&mut self, event_loop: &ActiveEventLoop, cause: StartCause) {
+        (**self).new_events(event_loop, cause);
+    }
+
+    #[inline]
+    fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).resumed(event_loop);
+    }
+
+    #[inline]
+    fn user_event(&mut self, event_loop: &ActiveEventLoop, event: T) {
+        (**self).user_event(event_loop, event);
+    }
+
+    #[inline]
+    fn window_event(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        window_id: WindowId,
+        event: WindowEvent,
+    ) {
+        (**self).window_event(event_loop, window_id, event);
+    }
+
+    #[inline]
+    fn device_event(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        device_id: DeviceId,
+        event: DeviceEvent,
+    ) {
+        (**self).device_event(event_loop, device_id, event);
+    }
+
+    #[inline]
+    fn about_to_wait(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).about_to_wait(event_loop);
+    }
+
+    #[inline]
+    fn suspended(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).suspended(event_loop);
+    }
+
+    #[inline]
+    fn exiting(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).exiting(event_loop);
+    }
+
+    #[inline]
+    fn memory_warning(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).memory_warning(event_loop);
+    }
+}
+
+impl<A: ?Sized + ApplicationHandler<T>, T: 'static> ApplicationHandler<T> for Box<A> {
+    #[inline]
+    fn new_events(&mut self, event_loop: &ActiveEventLoop, cause: StartCause) {
+        (**self).new_events(event_loop, cause);
+    }
+
+    #[inline]
+    fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).resumed(event_loop);
+    }
+
+    #[inline]
+    fn user_event(&mut self, event_loop: &ActiveEventLoop, event: T) {
+        (**self).user_event(event_loop, event);
+    }
+
+    #[inline]
+    fn window_event(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        window_id: WindowId,
+        event: WindowEvent,
+    ) {
+        (**self).window_event(event_loop, window_id, event);
+    }
+
+    #[inline]
+    fn device_event(
+        &mut self,
+        event_loop: &ActiveEventLoop,
+        device_id: DeviceId,
+        event: DeviceEvent,
+    ) {
+        (**self).device_event(event_loop, device_id, event);
+    }
+
+    #[inline]
+    fn about_to_wait(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).about_to_wait(event_loop);
+    }
+
+    #[inline]
+    fn suspended(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).suspended(event_loop);
+    }
+
+    #[inline]
+    fn exiting(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).exiting(event_loop);
+    }
+
+    #[inline]
+    fn memory_warning(&mut self, event_loop: &ActiveEventLoop) {
+        (**self).memory_warning(event_loop);
+    }
+}
diff --git a/vendor/winit/src/changelog/mod.rs b/vendor/winit/src/changelog/mod.rs
new file mode 100644
index 00000000..a05ea9cc
--- /dev/null
+++ b/vendor/winit/src/changelog/mod.rs
@@ -0,0 +1,77 @@
+//! # Changelog and migrations
+//!
+//! All notable changes to this project will be documented in this module,
+//! along with migration instructions for larger changes.
+// Put the current entry at the top of this page, for discoverability.
+// See `.cargo/config.toml` for details about `unreleased_changelogs`.
+#![cfg_attr(unreleased_changelogs, doc = include_str!("unreleased.md"))]
+#![cfg_attr(not(unreleased_changelogs), doc = include_str!("v0.30.md"))]
+
+#[doc = include_str!("v0.30.md")]
+pub mod v0_30 {}
+
+#[doc = include_str!("v0.29.md")]
+pub mod v0_29 {}
+
+#[doc = include_str!("v0.28.md")]
+pub mod v0_28 {}
+
+#[doc = include_str!("v0.27.md")]
+pub mod v0_27 {}
+
+#[doc = include_str!("v0.26.md")]
+pub mod v0_26 {}
+
+#[doc = include_str!("v0.25.md")]
+pub mod v0_25 {}
+
+#[doc = include_str!("v0.24.md")]
+pub mod v0_24 {}
+
+#[doc = include_str!("v0.23.md")]
+pub mod v0_23 {}
+
+#[doc = include_str!("v0.22.md")]
+pub mod v0_22 {}
+
+#[doc = include_str!("v0.21.md")]
+pub mod v0_21 {}
+
+#[doc = include_str!("v0.20.md")]
+pub mod v0_20 {}
+
+#[doc = include_str!("v0.19.md")]
+pub mod v0_19 {}
+
+#[doc = include_str!("v0.18.md")]
+pub mod v0_18 {}
+
+#[doc = include_str!("v0.17.md")]
+pub mod v0_17 {}
+
+#[doc = include_str!("v0.16.md")]
+pub mod v0_16 {}
+
+#[doc = include_str!("v0.15.md")]
+pub mod v0_15 {}
+
+#[doc = include_str!("v0.14.md")]
+pub mod v0_14 {}
+
+#[doc = include_str!("v0.13.md")]
+pub mod v0_13 {}
+
+#[doc = include_str!("v0.12.md")]
+pub mod v0_12 {}
+
+#[doc = include_str!("v0.11.md")]
+pub mod v0_11 {}
+
+#[doc = include_str!("v0.10.md")]
+pub mod v0_10 {}
+
+#[doc = include_str!("v0.9.md")]
+pub mod v0_9 {}
+
+#[doc = include_str!("v0.8.md")]
+pub mod v0_8 {}
diff --git a/vendor/winit/src/changelog/unreleased.md b/vendor/winit/src/changelog/unreleased.md
new file mode 100644
index 00000000..f3a0f6d2
--- /dev/null
+++ b/vendor/winit/src/changelog/unreleased.md
@@ -0,0 +1,41 @@
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+
+The sections should follow the order `Added`, `Changed`, `Deprecated`,
+`Removed`, and `Fixed`.
+
+Platform specific changed should be added to the end of the section and grouped
+by platform name. Common API additions should have `, implemented` at the end
+for platforms where the API was initially implemented. See the following example
+on how to add them:
+
+```md
+### Added
+
+- Add `Window::turbo()`, implemented on X11, Wayland, and Web.
+- On X11, add `Window::some_rare_api`.
+- On X11, add `Window::even_more_rare_api`.
+- On Wayland, add `Window::common_api`.
+- On Windows, add `Window::some_rare_api`.
+```
+
+When the change requires non-trivial amount of work for users to comply
+with it, the migration guide should be added below the entry, like:
+
+```md
+- Deprecate `Window` creation outside of `EventLoop::run`
+
+  This was done to simply migration in the future. Consider the
+  following code:
+
+  // Code snippet.
+
+  To migrate it we should do X, Y, and then Z, for example:
+
+  // Code snippet.
+
+```
+
+The migration guide could reference other migration examples in the current
+changelog entry.
+
+## Unreleased
diff --git a/vendor/winit/src/changelog/v0.10.md b/vendor/winit/src/changelog/v0.10.md
new file mode 100644
index 00000000..9e47c0b1
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.10.md
@@ -0,0 +1,13 @@
+## 0.10.1
+
+_Yanked_
+
+## 0.10.0
+
+- Add support for `Touch` for emscripten backend.
+- Added support for `DroppedFile`, `HoveredFile`, and `HoveredFileCancelled` to X11 backend.
+- **Breaking:** `unix::WindowExt` no longer returns pointers for things that aren't actually pointers; `get_xlib_window` now returns `Option<std::os::raw::c_ulong>` and `get_xlib_screen_id` returns `Option<std::os::raw::c_int>`. Additionally, methods that previously returned `libc::c_void` have been changed to return `std::os::raw::c_void`, which are not interchangeable types, so users wanting the former will need to explicitly cast.
+- Added `set_decorations` method to `Window` to allow decorations to be toggled after the window is built. Presently only implemented on X11.
+- Raised the minimum supported version of Rust to 1.20 on MacOS due to usage of associated constants in new versions of cocoa and core-graphics.
+- Added `modifiers` field to `MouseInput`, `MouseWheel`, and `CursorMoved` events to track the modifiers state (`ModifiersState`).
+- Fixed the emscripten backend to return the size of the canvas instead of the size of the window.
diff --git a/vendor/winit/src/changelog/v0.11.md b/vendor/winit/src/changelog/v0.11.md
new file mode 100644
index 00000000..31fb1d3b
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.11.md
@@ -0,0 +1,27 @@
+## 0.11.3
+
+- Added `set_min_dimensions` and `set_max_dimensions` methods to `Window`, and implemented on Windows, X11, Wayland, and OSX.
+- On X11, dropping a `Window` actually closes it now, and clicking the window's × button (or otherwise having the WM signal to close it) will result in the window closing.
+- Added `WindowBuilderExt` methods for macos: `with_titlebar_transparent`,
+  `with_title_hidden`, `with_titlebar_buttons_hidden`,
+  `with_fullsize_content_view`.
+- Mapped X11 numpad keycodes (arrows, Home, End, PageUp, PageDown, Insert and Delete) to corresponding virtual keycodes
+
+## 0.11.2
+
+- Impl `Hash`, `PartialEq`, and `Eq` for `events::ModifiersState`.
+- Implement `MonitorId::get_hidpi_factor` for MacOS.
+- Added method `os::macos::MonitorIdExt::get_nsscreen() -> *mut c_void` that gets a `NSScreen` object matching the monitor ID.
+- Send `Awakened` event on Android when event loop is woken up.
+
+## 0.11.1
+
+- Fixed windows not receiving mouse events when click-dragging the mouse outside the client area of a window, on Windows platforms.
+- Added method `os::android::EventsLoopExt:set_suspend_callback(Option<Box<Fn(bool) -> ()>>)` that allows glutin to register a callback when a suspend event happens
+
+## 0.11.0
+
+- Implement `MonitorId::get_dimensions` for Android.
+- Added method `os::macos::WindowBuilderExt::with_movable_by_window_background(bool)` that allows to move a window without a titlebar - `with_decorations(false)`
+- Implement `Window::set_fullscreen`, `Window::set_maximized` and `Window::set_decorations` for Wayland.
+- Added `Caret` as VirtualKeyCode and support OSX ^-Key with german input.
diff --git a/vendor/winit/src/changelog/v0.12.md b/vendor/winit/src/changelog/v0.12.md
new file mode 100644
index 00000000..3f9c83d8
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.12.md
@@ -0,0 +1,8 @@
+## 0.12.0
+
+- Added subclass to macos windows so they can be made resizable even with no decorations.
+- Dead keys now work properly on X11, no longer resulting in a panic.
+- On X11, input method creation first tries to use the value from the user's `XMODIFIERS` environment variable, so application developers should no longer need to manually call `XSetLocaleModifiers`. If that fails, fallbacks are tried, which should prevent input method initialization from ever outright failing.
+- Fixed thread safety issues with input methods on X11.
+- Add support for `Touch` for win32 backend.
+- Fixed `Window::get_inner_size` and friends to return the size in pixels instead of points when using HIDPI displays on OSX.
diff --git a/vendor/winit/src/changelog/v0.13.md b/vendor/winit/src/changelog/v0.13.md
new file mode 100644
index 00000000..fd45665f
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.13.md
@@ -0,0 +1,20 @@
+## 0.13.1
+
+- Ensure necessary `x11-dl` version is used.
+
+## 0.13.0
+
+- Implement `WindowBuilder::with_maximized`, `Window::set_fullscreen`, `Window::set_maximized` and `Window::set_decorations` for MacOS.
+- Implement `WindowBuilder::with_maximized`, `Window::set_fullscreen`, `Window::set_maximized` and `Window::set_decorations` for Windows.
+- On Windows, `WindowBuilder::with_fullscreen` no longer changing monitor display resolution.
+- Overhauled X11 window geometry calculations. `get_position` and `set_position` are more universally accurate across different window managers, and `get_outer_size` actually works now.
+- Fixed SIGSEGV/SIGILL crashes on macOS caused by stabilization of the `!` (never) type.
+- Implement `WindowEvent::HiDPIFactorChanged` for macOS
+- On X11, input methods now work completely out of the box, no longer requiring application developers to manually call `setlocale`. Additionally, when input methods are started, stopped, or restarted on the server end, it's correctly handled.
+- Implemented `Refresh` event on Windows.
+- Properly calculate the minimum and maximum window size on Windows, including window decorations.
+- Map more `MouseCursor` variants to cursor icons on Windows.
+- Corrected `get_position` on macOS to return outer frame position, not content area position.
+- Corrected `set_position` on macOS to set outer frame position, not content area position.
+- Added `get_inner_position` method to `Window`, which gets the position of the window's client area. This is implemented on all applicable platforms (all desktop platforms other than Wayland, where this isn't possible).
+- **Breaking:** the `Closed` event has been replaced by `CloseRequested` and `Destroyed`. To migrate, you typically just need to replace all usages of `Closed` with `CloseRequested`; see example programs for more info. The exception is iOS, where `Closed` must be replaced by `Destroyed`.
diff --git a/vendor/winit/src/changelog/v0.14.md b/vendor/winit/src/changelog/v0.14.md
new file mode 100644
index 00000000..822ae209
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.14.md
@@ -0,0 +1,21 @@
+## 0.14.0
+
+- Created the `Copy`, `Paste` and `Cut` `VirtualKeyCode`s and added support for them on X11 and Wayland
+- Fix `.with_decorations(false)` in macOS
+- On Mac, `NSWindow` and supporting objects might be alive long after they were `closed` which resulted in apps consuming more heap then needed. Mainly it was affecting multi window applications. Not expecting any user visible change of behaviour after the fix.
+- Fix regression of Window platform extensions for macOS where `NSFullSizeContentViewWindowMask` was not being correctly applied to `.fullsize_content_view`.
+- Corrected `get_position` on Windows to be relative to the screen rather than to the taskbar.
+- Corrected `Moved` event on Windows to use position values equivalent to those returned by `get_position`. It previously supplied client area positions instead of window positions, and would additionally interpret negative values as being very large (around `u16::MAX`).
+- Implemented `Moved` event on macOS.
+- On X11, the `Moved` event correctly use window positions rather than client area positions. Additionally, a stray `Moved` that unconditionally accompanied `Resized` with the client area position relative to the parent has been eliminated; `Moved` is still received alongside `Resized`, but now only once and always correctly.
+- On Windows, implemented all variants of `DeviceEvent` other than `Text`. Mouse `DeviceEvent`s are now received even if the window isn't in the foreground.
+- `DeviceId` on Windows is no longer a unit struct, and now contains a `u32`. For `WindowEvent`s, this will always be 0, but on `DeviceEvent`s it will be the handle to that device. `DeviceIdExt::get_persistent_identifier` can be used to acquire a unique identifier for that device that persists across replugs/reboots/etc.
+- Corrected `run_forever` on X11 to stop discarding `Awakened` events.
+- Various safety and correctness improvements to the X11 backend internals.
+- Fixed memory leak on X11 every time the mouse entered the window.
+- On X11, drag and drop now works reliably in release mode.
+- Added `WindowBuilderExt::with_resize_increments` and `WindowBuilderExt::with_base_size` to X11, allowing for more optional hints to be set.
+- Rework of the wayland backend, migrating it to use [Smithay's Client Toolkit](https://github.com/Smithay/client-toolkit).
+- Added `WindowBuilder::with_window_icon` and `Window::set_window_icon`, finally making it possible to set the window icon on Windows and X11. The `icon_loading` feature can be enabled to allow for icons to be easily loaded; see example program `window_icon.rs` for usage.
+- Windows additionally has `WindowBuilderExt::with_taskbar_icon` and `WindowExt::set_taskbar_icon`.
+- On Windows, fix panic when trying to call `set_fullscreen(None)` on a window that has not been fullscreened prior.
diff --git a/vendor/winit/src/changelog/v0.15.md b/vendor/winit/src/changelog/v0.15.md
new file mode 100644
index 00000000..f5fc4853
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.15.md
@@ -0,0 +1,42 @@
+## 0.15.1
+
+- On X11, the `Moved` event is no longer sent when the window is resized without changing position.
+- `MouseCursor` and `CursorState` now implement `Default`.
+- `WindowBuilder::with_resizable` implemented for Windows, X11, Wayland, and macOS.
+- `Window::set_resizable` implemented for Windows, X11, Wayland, and macOS.
+- On X11, if the monitor's width or height in millimeters is reported as 0, the DPI is now 1.0 instead of +inf.
+- On X11, the environment variable `WINIT_HIDPI_FACTOR` has been added for overriding DPI factor.
+- On X11, enabling transparency no longer causes the window contents to flicker when resizing.
+- On X11, `with_override_redirect` now actually enables override redirect.
+- macOS now generates `VirtualKeyCode::LAlt` and `VirtualKeyCode::RAlt` instead of `None` for both.
+- On macOS, `VirtualKeyCode::RWin` and `VirtualKeyCode::LWin` are no longer switched.
+- On macOS, windows without decorations can once again be resized.
+- Fixed race conditions when creating an `EventsLoop` on X11, most commonly manifesting as `"[xcb] Unknown sequence number while processing queue"`.
+- On macOS, `CursorMoved` and `MouseInput` events are only generated if they occurs within the window's client area.
+- On macOS, resizing the window no longer generates a spurious `MouseInput` event.
+
+## 0.15.0
+
+- `Icon::to_cardinals` is no longer public, since it was never supposed to be.
+- Wayland: improve diagnostics if initialization fails
+- Fix some system event key doesn't work when focused, do not block keyevent forward to system on macOS
+- On X11, the scroll wheel position is now correctly reset on i3 and other WMs that have the same quirk.
+- On X11, `Window::get_current_monitor` now reliably returns the correct monitor.
+- On X11, `Window::hidpi_factor` returns values from XRandR rather than the inaccurate values previously queried from the core protocol.
+- On X11, the primary monitor is detected correctly even when using versions of XRandR less than 1.5.
+- `MonitorId` now implements `Debug`.
+- Fixed bug on macOS where using `with_decorations(false)` would cause `set_decorations(true)` to produce a transparent titlebar with no title.
+- Implemented `MonitorId::get_position` on macOS.
+- On macOS, `Window::get_current_monitor` now returns accurate values.
+- Added `WindowBuilderExt::with_resize_increments` to macOS.
+- **Breaking:** On X11, `WindowBuilderExt::with_resize_increments` and `WindowBuilderExt::with_base_size` now take `u32` values rather than `i32`.
+- macOS keyboard handling has been overhauled, allowing for the use of dead keys, IME, etc. Right modifier keys are also no longer reported as being left.
+- Added the `Window::set_ime_spot(x: i32, y: i32)` method, which is implemented on X11 and macOS.
+- **Breaking**: `os::unix::WindowExt::send_xim_spot(x: i16, y: i16)` no longer exists. Switch to the new `Window::set_ime_spot(x: i32, y: i32)`, which has equivalent functionality.
+- Fixed detection of `Pause` and `Scroll` keys on Windows.
+- On Windows, alt-tabbing while the cursor is grabbed no longer makes it impossible to re-grab the cursor.
+- On Windows, using `CursorState::Hide` when the cursor is grabbed now ungrabs the cursor first.
+- Implemented `MouseCursor::NoneCursor` on Windows.
+- Added `WindowBuilder::with_always_on_top` and `Window::set_always_on_top`. Implemented on Windows, macOS, and X11.
+- On X11, `WindowBuilderExt` now has `with_class`, `with_override_redirect`, and `with_x11_window_type` to allow for more control over window creation. `WindowExt` additionally has `set_urgent`.
+- More hints are set by default on X11, including `_NET_WM_PID` and `WM_CLIENT_MACHINE`. Note that prior to this, the `WM_CLASS` hint was automatically set to whatever value was passed to `with_title`. It's now set to the executable name to better conform to expectations and the specification; if this is undesirable, you must explicitly use `WindowBuilderExt::with_class`.
diff --git a/vendor/winit/src/changelog/v0.16.md b/vendor/winit/src/changelog/v0.16.md
new file mode 100644
index 00000000..126ad9f7
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.16.md
@@ -0,0 +1,32 @@
+## 0.16.2
+
+- On Windows, non-resizable windows now have the maximization button disabled. This is consistent with behavior on macOS and popular X11 WMs.
+- Corrected incorrect `unreachable!` usage when guessing the DPI factor with no detected monitors.
+
+## 0.16.1
+
+- Added logging through `log`. Logging will become more extensive over time.
+- On X11 and Windows, the window's DPI factor is guessed before creating the window. This _greatly_ cuts back on unsightly auto-resizing that would occur immediately after window creation.
+- Fixed X11 backend compilation for environments where `c_char` is unsigned.
+
+## 0.16.0
+
+- Windows additionally has `WindowBuilderExt::with_no_redirection_bitmap`.
+- **Breaking:** Removed `VirtualKeyCode::LMenu` and `VirtualKeyCode::RMenu`; Windows now generates `VirtualKeyCode::LAlt` and `VirtualKeyCode::RAlt` instead.
+- On X11, exiting fullscreen no longer leaves the window in the monitor's top left corner.
+- **Breaking:** `Window::hidpi_factor` has been renamed to `Window::get_hidpi_factor` for better consistency. `WindowEvent::HiDPIFactorChanged` has been renamed to `WindowEvent::HiDpiFactorChanged`. DPI factors are always represented as `f64` instead of `f32` now.
+- The Windows backend is now DPI aware. `WindowEvent::HiDpiFactorChanged` is implemented, and `MonitorId::get_hidpi_factor` and `Window::hidpi_factor` return accurate values.
+- Implemented `WindowEvent::HiDpiFactorChanged` on X11.
+- On macOS, `Window::set_cursor_position` is now relative to the client area.
+- On macOS, setting the maximum and minimum dimensions now applies to the client area dimensions rather than to the window dimensions.
+- On iOS, `MonitorId::get_dimensions` has been implemented and both `MonitorId::get_hidpi_factor` and `Window::get_hidpi_factor` return accurate values.
+- On Emscripten, `MonitorId::get_hidpi_factor` now returns the same value as `Window::get_hidpi_factor` (it previously would always return 1.0).
+- **Breaking:** The entire API for sizes, positions, etc. has changed. In the majority of cases, winit produces and consumes positions and sizes as `LogicalPosition` and `LogicalSize`, respectively. The notable exception is `MonitorId` methods, which deal in `PhysicalPosition` and `PhysicalSize`. See the documentation for specifics and explanations of the types. Additionally, winit automatically conserves logical size when the DPI factor changes.
+- **Breaking:** All deprecated methods have been removed. For `Window::platform_display` and `Window::platform_window`, switch to the appropriate platform-specific `WindowExt` methods. For `Window::get_inner_size_points` and `Window::get_inner_size_pixels`, use the `LogicalSize` returned by `Window::get_inner_size` and convert as needed.
+- HiDPI support for Wayland.
+- `EventsLoop::get_available_monitors` and `EventsLoop::get_primary_monitor` now have identical counterparts on `Window`, so this information can be acquired without an `EventsLoop` borrow.
+- `AvailableMonitorsIter` now implements `Debug`.
+- Fixed quirk on macOS where certain keys would generate characters at twice the normal rate when held down.
+- On X11, all event loops now share the same `XConnection`.
+- **Breaking:** `Window::set_cursor_state` and `CursorState` enum removed in favor of the more composable `Window::grab_cursor` and `Window::hide_cursor`. As a result, grabbing the cursor no longer automatically hides it; you must call both methods to retain the old behavior on Windows and macOS. `Cursor::NoneCursor` has been removed, as it's no longer useful.
+- **Breaking:** `Window::set_cursor_position` now returns `Result<(), String>`, thus allowing for `Box<Error>` conversion via `?`.
diff --git a/vendor/winit/src/changelog/v0.17.md b/vendor/winit/src/changelog/v0.17.md
new file mode 100644
index 00000000..0a1abc8b
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.17.md
@@ -0,0 +1,23 @@
+## 0.17.2
+
+- On macOS, fix `<C-Tab>` so applications receive the event.
+- On macOS, fix `<Cmd-{key}>` so applications receive the event.
+- On Wayland, key press events will now be repeated.
+
+## 0.17.1
+
+- On X11, prevent a compilation failure in release mode for versions of Rust greater than or equal to 1.30.
+- Fixed deadlock that broke fullscreen mode on Windows.
+
+## 0.17.0
+
+- Cocoa and core-graphics updates.
+- Fixed thread-safety issues in several `Window` functions on Windows.
+- On MacOS, the key state for modifiers key events is now properly set.
+- On iOS, the view is now set correctly. This makes it possible to render things (instead of being stuck on a black screen), and touch events work again.
+- Added NetBSD support.
+- **Breaking:** On iOS, `UIView` is now the default root view. `WindowBuilderExt::with_root_view_class` can be used to set the root view objective-c class to `GLKView` (OpenGLES) or `MTKView` (Metal/MoltenVK).
+- On iOS, the `UIApplication` is not started until `Window::new` is called.
+- Fixed thread unsafety with cursor hiding on macOS.
+- On iOS, fixed the size of the `JmpBuf` type used for `setjmp`/`longjmp` calls. Previously this was a buffer overflow on most architectures.
+- On Windows, use cached window DPI instead of repeatedly querying the system. This fixes sporadic crashes on Windows 7.
diff --git a/vendor/winit/src/changelog/v0.18.md b/vendor/winit/src/changelog/v0.18.md
new file mode 100644
index 00000000..e98df5bc
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.18.md
@@ -0,0 +1,52 @@
+## 0.18.1
+
+- On macOS, fix `Yen` (JIS) so applications receive the event.
+- On X11 with a tiling WM, fixed high CPU usage when moving windows across monitors.
+- On X11, fixed panic caused by dropping the window before running the event loop.
+- on macOS, added `WindowExt::set_simple_fullscreen` which does not require a separate space
+- Introduce `WindowBuilderExt::with_app_id` to allow setting the application ID on Wayland.
+- On Windows, catch panics in event loop child thread and forward them to the parent thread. This prevents an invocation of undefined behavior due to unwinding into foreign code.
+- On Windows, fix issue where resizing or moving window combined with grabbing the cursor would freeze program.
+- On Windows, fix issue where resizing or moving window would eat `Awakened` events.
+- On Windows, exiting fullscreen after entering fullscreen with disabled decorations no longer shrinks window.
+- On X11, fixed a segfault when using virtual monitors with XRandR.
+- Derive `Ord` and `PartialOrd` for `VirtualKeyCode` enum.
+- On Windows, fix issue where hovering or dropping a non file item would create a panic.
+- On Wayland, fix resizing and DPI calculation when a `wl_output` is removed without sending a `leave` event to the `wl_surface`, such as disconnecting a monitor from a laptop.
+- On Wayland, DPI calculation is handled by smithay-client-toolkit.
+- On X11, `WindowBuilder::with_min_dimensions` and `WindowBuilder::with_max_dimensions` now correctly account for DPI.
+- Added support for generating dummy `DeviceId`s and `WindowId`s to better support unit testing.
+- On macOS, fixed unsoundness in drag-and-drop that could result in drops being rejected.
+- On macOS, implemented `WindowEvent::Refresh`.
+- On macOS, all `MouseCursor` variants are now implemented and the cursor will no longer reset after unfocusing.
+- Removed minimum supported Rust version guarantee.
+
+## 0.18.0
+
+- **Breaking:** `image` crate upgraded to 0.20. This is exposed as part of the `icon_loading` API.
+- On Wayland, pointer events will now provide the current modifiers state.
+- On Wayland, titles will now be displayed in the window header decoration.
+- On Wayland, key repetition is now ended when keyboard loses focus.
+- On Wayland, windows will now use more stylish and modern client side decorations.
+- On Wayland, windows will use server-side decorations when available.
+- **Breaking:** Added support for F16-F24 keys (variants were added to the `VirtualKeyCode` enum).
+- Fixed graphical glitches when resizing on Wayland.
+- On Windows, fix freezes when performing certain actions after a window resize has been triggered. Reintroduces some visual artifacts when resizing.
+- Updated window manager hints under X11 to v1.5 of [Extended Window Manager Hints](https://specifications.freedesktop.org/wm-spec/wm-spec-1.5.html#idm140200472629520).
+- Added `WindowBuilderExt::with_gtk_theme_variant` to X11-specific `WindowBuilder` functions.
+- Fixed UTF8 handling bug in X11 `set_title` function.
+- On Windows, `Window::set_cursor` now applies immediately instead of requiring specific events to occur first.
+- On Windows, the `HoveredFile` and `HoveredFileCancelled` events are now implemented.
+- On Windows, fix `Window::set_maximized`.
+- On Windows 10, fix transparency (#260).
+- On macOS, fix modifiers during key repeat.
+- Implemented the `Debug` trait for `Window`, `EventsLoop`, `EventsLoopProxy` and `WindowBuilder`.
+- On X11, now a `Resized` event will always be generated after a DPI change to ensure the window's logical size is consistent with the new DPI.
+- Added further clarifications to the DPI docs.
+- On Linux, if neither X11 nor Wayland manage to initialize, the corresponding panic now consists of a single line only.
+- Add optional `serde` feature with implementations of `Serialize`/`Deserialize` for DPI types and various event types.
+- Add `PartialEq`, `Eq`, and `Hash` implementations on public types that could have them but were missing them.
+- On X11, drag-and-drop receiving an unsupported drop type can no longer cause the WM to freeze.
+- Fix issue whereby the OpenGL context would not appear at startup on macOS Mojave (#1069).
+- **Breaking:** Removed `From<NSApplicationActivationPolicy>` impl from `ActivationPolicy` on macOS.
+- On macOS, the application can request the user's attention with `WindowExt::request_user_attention`.
diff --git a/vendor/winit/src/changelog/v0.19.md b/vendor/winit/src/changelog/v0.19.md
new file mode 100644
index 00000000..65aefef8
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.19.md
@@ -0,0 +1,27 @@
+## 0.19.1
+
+- On Wayland, added a `get_wayland_display` function to `EventsLoopExt`.
+- On Windows, fix `CursorMoved(0, 0)` getting dispatched on window focus.
+- On macOS, fix command key event left and right reverse.
+- On FreeBSD, NetBSD, and OpenBSD, fix build of X11 backend.
+- On Linux, the numpad's add, subtract and divide keys are now mapped to the `Add`, `Subtract` and `Divide` virtual key codes
+- On macOS, the numpad's subtract key has been added to the `Subtract` mapping
+- On Wayland, the numpad's home, end, page up and page down keys are now mapped to the `Home`, `End`, `PageUp` and `PageDown` virtual key codes
+- On Windows, fix icon not showing up in corner of window.
+- On X11, change DPI scaling factor behavior. First, winit tries to read it from "Xft.dpi" XResource, and uses DPI calculation from xrandr dimensions as fallback behavior.
+
+## 0.19.0
+
+- On X11, we will use the faster `XRRGetScreenResourcesCurrent` function instead of `XRRGetScreenResources` when available.
+- On macOS, fix keycodes being incorrect when using a non-US keyboard layout.
+- On Wayland, fix `with_title()` not setting the windows title
+- On Wayland, add `set_wayland_theme()` to control client decoration color theme
+- Added serde serialization to `os::unix::XWindowType`.
+- **Breaking:** Remove the `icon_loading` feature and the associated `image` dependency.
+- On X11, make event loop thread safe by replacing XNextEvent with select(2) and XCheckIfEvent
+- On Windows, fix malformed function pointer typecast that could invoke undefined behavior.
+- Refactored Windows state/flag-setting code.
+- On Windows, hiding the cursor no longer hides the cursor for all Winit windows - just the one `hide_cursor` was called on.
+- On Windows, cursor grabs used to get perpetually canceled when the grabbing window lost focus. Now, cursor grabs automatically get re-initialized when the window regains focus and the mouse moves over the client area.
+- On Windows, only vertical mouse wheel events were handled. Now, horizontal mouse wheel events are also handled.
+- On Windows, ignore the AltGr key when populating the `ModifiersState` type.
diff --git a/vendor/winit/src/changelog/v0.20.md b/vendor/winit/src/changelog/v0.20.md
new file mode 100644
index 00000000..eb4ba6a1
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.20.md
@@ -0,0 +1,200 @@
+## 0.20.0
+
+- On X11, fix `ModifiersChanged` emitting incorrect modifier change events
+- **Breaking**: Overhaul how Winit handles DPI:
+  - Window functions and events now return `PhysicalSize` instead of `LogicalSize`.
+  - Functions that take `Size` or `Position` types can now take either `Logical` or `Physical` types.
+  - `hidpi_factor` has been renamed to `scale_factor`.
+  - `HiDpiFactorChanged` has been renamed to `ScaleFactorChanged`, and lets you control how the OS
+    resizes the window in response to the change.
+  - On X11, deprecate `WINIT_HIDPI_FACTOR` environment variable in favor of `WINIT_X11_SCALE_FACTOR`.
+  - `Size` and `Position` types are now generic over their exact pixel type.
+
+## 0.20.0-alpha6
+
+- On macOS, fix `set_cursor_visible` hides cursor outside of window.
+- On macOS, fix `CursorEntered` and `CursorLeft` events fired at old window size.
+- On macOS, fix error when `set_fullscreen` is called during fullscreen transition.
+- On all platforms except mobile and WASM, implement `Window::set_minimized`.
+- On X11, fix `CursorEntered` event being generated for non-winit windows.
+- On macOS, fix crash when starting maximized without decorations.
+- On macOS, fix application not terminating on `run_return`.
+- On Wayland, fix cursor icon updates on window borders when using CSD.
+- On Wayland, under mutter(GNOME Wayland), fix CSD being behind the status bar, when starting window in maximized mode.
+- On Windows, theme the title bar according to whether the system theme is "Light" or "Dark".
+- Added `WindowEvent::ThemeChanged` variant to handle changes to the system theme. Currently only implemented on Windows.
+- **Breaking**: Changes to the `RedrawRequested` event (#1041):
+  - `RedrawRequested` has been moved from `WindowEvent` to `Event`.
+  - `EventsCleared` has been renamed to `MainEventsCleared`.
+  - `RedrawRequested` is now issued only after `MainEventsCleared`.
+  - `RedrawEventsCleared` is issued after each set of `RedrawRequested` events.
+- Implement synthetic window focus key events on Windows.
+- **Breaking**: Change `ModifiersState` to a `bitflags` struct.
+- On Windows, implement `VirtualKeyCode` translation for `LWin` and `RWin`.
+- On Windows, fix closing the last opened window causing `DeviceEvent`s to stop getting emitted.
+- On Windows, fix `Window::set_visible` not setting internal flags correctly. This resulted in some weird behavior.
+- Add `DeviceEvent::ModifiersChanged`.
+  - Deprecate `modifiers` fields in other events in favor of `ModifiersChanged`.
+- On X11, `WINIT_HIDPI_FACTOR` now dominates `Xft.dpi` when picking DPI factor for output.
+- On X11, add special value `randr` for `WINIT_HIDPI_FACTOR` to make winit use self computed DPI factor instead of the one from `Xft.dpi`.
+
+## 0.20.0-alpha5
+
+- On macOS, fix application termination on `ControlFlow::Exit`
+- On Windows, fix missing `ReceivedCharacter` events when Alt is held.
+- On macOS, stop emitting private corporate characters in `ReceivedCharacter` events.
+- On X11, fix misreporting DPI factor at startup.
+- On X11, fix events not being reported when using `run_return`.
+- On X11, fix key modifiers being incorrectly reported.
+- On X11, fix window creation hanging when another window is fullscreen.
+- On Windows, fix focusing unfocused windows when switching from fullscreen to windowed.
+- On X11, fix reporting incorrect DPI factor when waking from suspend.
+- Change `EventLoopClosed` to contain the original event.
+- **Breaking**: Add `is_synthetic` field to `WindowEvent` variant `KeyboardInput`,
+  indicating that the event is generated by winit.
+- On X11, generate synthetic key events for keys held when a window gains or loses focus.
+- On X11, issue a `CursorMoved` event when a `Touch` event occurs,
+  as X11 implicitly moves the cursor for such events.
+
+## 0.20.0-alpha4
+
+- Add web support via the 'stdweb' or 'web-sys' features
+- On Windows, implemented function to get HINSTANCE
+- On macOS, implement `run_return`.
+- On iOS, fix inverted parameter in `set_prefers_home_indicator_hidden`.
+- On X11, performance is improved when rapidly calling `Window::set_cursor_icon`.
+- On iOS, fix improper `msg_send` usage that was UB and/or would break if `!` is stabilized.
+- On Windows, unset `maximized` when manually changing the window's position or size.
+- On Windows, add touch pressure information for touch events.
+- On macOS, differentiate between `CursorIcon::Grab` and `CursorIcon::Grabbing`.
+- On Wayland, fix event processing sometimes stalling when using OpenGL with vsync.
+- Officially remove the Emscripten backend.
+- On Windows, fix handling of surrogate pairs when dispatching `ReceivedCharacter`.
+- On macOS 10.15, fix freeze upon exiting exclusive fullscreen mode.
+- On iOS, fix panic upon closing the app.
+- On X11, allow setting multiple `XWindowType`s.
+- On iOS, fix null window on initial `HiDpiFactorChanged` event.
+- On Windows, fix fullscreen window shrinking upon getting restored to a normal window.
+- On macOS, fix events not being emitted during modal loops, such as when windows are being resized
+  by the user.
+- On Windows, fix hovering the mouse over the active window creating an endless stream of CursorMoved events.
+- Always dispatch a `RedrawRequested` event after creating a new window.
+- On X11, return dummy monitor data to avoid panicking when no monitors exist.
+- On X11, prevent stealing input focus when creating a new window.
+  Only steal input focus when entering fullscreen mode.
+- On Wayland, fixed DeviceEvents for relative mouse movement is not always produced
+- On Wayland, add support for set_cursor_visible and set_cursor_grab.
+- On Wayland, fixed DeviceEvents for relative mouse movement is not always produced.
+- Removed `derivative` crate dependency.
+- On Wayland, add support for set_cursor_icon.
+- Use `impl Iterator<Item = MonitorHandle>` instead of `AvailableMonitorsIter` consistently.
+- On macOS, fix fullscreen state being updated after entering fullscreen instead of before,
+  resulting in `Window::fullscreen` returning the old state in `Resized` events instead of
+  reflecting the new fullscreen state
+- On X11, fix use-after-free during window creation
+- On Windows, disable monitor change keyboard shortcut while in exclusive fullscreen.
+- On Windows, ensure that changing a borderless fullscreen window's monitor via keyboard shortcuts keeps the window fullscreen on the new monitor.
+- Prevent `EventLoop::new` and `EventLoop::with_user_event` from getting called outside the main thread.
+  - This is because some platforms cannot run the event loop outside the main thread. Preventing this
+    reduces the potential for cross-platform compatibility gotchyas.
+- On Windows and Linux X11/Wayland, add platform-specific functions for creating an `EventLoop` outside the main thread.
+- On Wayland, drop resize events identical to the current window size.
+- On Windows, fix window rectangle not getting set correctly on high-DPI systems.
+
+## 0.20.0-alpha3
+
+- On macOS, drop the run closure on exit.
+- On Windows, location of `WindowEvent::Touch` are window client coordinates instead of screen coordinates.
+- On X11, fix delayed events after window redraw.
+- On macOS, add `WindowBuilderExt::with_disallow_hidpi` to have the option to turn off best resolution openGL surface.
+- On Windows, screen saver won't start if the window is in fullscreen mode.
+- Change all occurrences of the `new_user_event` method to `with_user_event`.
+- On macOS, the dock and the menu bar are now hidden in fullscreen mode.
+- `Window::set_fullscreen` now takes `Option<Fullscreen>` where `Fullscreen`
+  consists of `Fullscreen::Exclusive(VideoMode)` and
+  `Fullscreen::Borderless(MonitorHandle)` variants.
+  - Adds support for exclusive fullscreen mode.
+- On iOS, add support for hiding the home indicator.
+- On iOS, add support for deferring system gestures.
+- On iOS, fix a crash that occurred while acquiring a monitor's name.
+- On iOS, fix armv7-apple-ios compile target.
+- Removed the `T: Clone` requirement from the `Clone` impl of `EventLoopProxy<T>`.
+- On iOS, disable overscan compensation for external displays (removes black
+  bars surrounding the image).
+- On Linux, the functions `is_wayland`, `is_x11`, `xlib_xconnection` and `wayland_display` have been moved to a new `EventLoopWindowTargetExtUnix` trait.
+- On iOS, add `set_prefers_status_bar_hidden` extension function instead of
+  hijacking `set_decorations` for this purpose.
+- On macOS and iOS, corrected the auto trait impls of `EventLoopProxy`.
+- On iOS, add touch pressure information for touch events.
+- Implement `raw_window_handle::HasRawWindowHandle` for `Window` type on all supported platforms.
+- On macOS, fix the signature of `-[NSView drawRect:]`.
+- On iOS, fix the behavior of `ControlFlow::Poll`. It wasn't polling if that was the only mode ever used by the application.
+- On iOS, fix DPI sent out by views on creation was `0.0` - now it gives a reasonable number.
+- On iOS, RedrawRequested now works for gl/metal backed views.
+- On iOS, RedrawRequested is generally ordered after EventsCleared.
+
+## 0.20.0-alpha2
+
+- On X11, non-resizable windows now have maximize explicitly disabled.
+- On Windows, support paths longer than MAX_PATH (260 characters) in `WindowEvent::DroppedFile`
+  and `WindowEvent::HoveredFile`.
+- On Mac, implement `DeviceEvent::Button`.
+- Change `Event::Suspended(true / false)` to `Event::Suspended` and `Event::Resumed`.
+- On X11, fix sanity check which checks that a monitor's reported width and height (in millimeters) are non-zero when calculating the DPI factor.
+- Revert the use of invisible surfaces in Wayland, which introduced graphical glitches with OpenGL (#835)
+- On X11, implement `_NET_WM_PING` to allow desktop environment to kill unresponsive programs.
+- On Windows, when a window is initially invisible, it won't take focus from the existing visible windows.
+- On Windows, fix multiple calls to `request_redraw` during `EventsCleared` sending multiple `RedrawRequested events.`
+- On Windows, fix edge case where `RedrawRequested` could be dispatched before input events in event loop iteration.
+- On Windows, fix timing issue that could cause events to be improperly dispatched after `RedrawRequested` but before `EventsCleared`.
+- On macOS, drop unused Metal dependency.
+- On Windows, fix the trail effect happening on transparent decorated windows. Borderless (or un-decorated) windows were not affected.
+- On Windows, fix `with_maximized` not properly setting window size to entire window.
+- On macOS, change `WindowExtMacOS::request_user_attention()` to take an `enum` instead of a `bool`.
+
+## 0.20.0-alpha1
+
+- Changes below are considered **breaking**.
+- Change all occurrences of `EventsLoop` to `EventLoop`.
+- Previously flat API is now exposed through `event`, `event_loop`, `monitor`, and `window` modules.
+- `os` module changes:
+  - Renamed to `platform`.
+  - All traits now have platform-specific suffixes.
+  - Exposes new `desktop` module on Windows, Mac, and Linux.
+- Changes to event loop types:
+  - `EventLoopProxy::wakeup` has been removed in favor of `send_event`.
+  - **Major:** New `run` method drives winit event loop.
+    - Returns `!` to ensure API behaves identically across all supported platforms.
+      - This allows `emscripten` implementation to work without lying about the API.
+    - `ControlFlow`'s variants have been replaced with `Wait`, `WaitUntil(Instant)`, `Poll`, and `Exit`.
+      - Is read after `EventsCleared` is processed.
+      - `Wait` waits until new events are available.
+      - `WaitUntil` waits until either new events are available or the provided time has been reached.
+      - `Poll` instantly resumes the event loop.
+      - `Exit` aborts the event loop.
+    - Takes a closure that implements `'static + FnMut(Event<T>, &EventLoop<T>, &mut ControlFlow)`.
+      - `&EventLoop<T>` is provided to allow new `Window`s to be created.
+  - **Major:** `platform::desktop` module exposes `EventLoopExtDesktop` trait with `run_return` method.
+    - Behaves identically to `run`, but returns control flow to the calling context and can take non-`'static` closures.
+  - `EventLoop`'s `poll_events` and `run_forever` methods have been removed in favor of `run` and `run_return`.
+- Changes to events:
+  - Remove `Event::Awakened` in favor of `Event::UserEvent(T)`.
+    - Can be sent with `EventLoopProxy::send_event`.
+  - Rename `WindowEvent::Refresh` to `WindowEvent::RedrawRequested`.
+    - `RedrawRequested` can be sent by the user with the `Window::request_redraw` method.
+  - `EventLoop`, `EventLoopProxy`, and `Event` are now generic over `T`, for use in `UserEvent`.
+  - **Major:** Add `NewEvents(StartCause)`, `EventsCleared`, and `LoopDestroyed` variants to `Event`.
+    - `NewEvents` is emitted when new events are ready to be processed by event loop.
+      - `StartCause` describes why new events are available, with `ResumeTimeReached`, `Poll`, `WaitCancelled`, and `Init` (sent once at start of loop).
+    - `EventsCleared` is emitted when all available events have been processed.
+      - Can be used to perform logic that depends on all events being processed (e.g. an iteration of a game loop).
+    - `LoopDestroyed` is emitted when the `run` or `run_return` method is about to exit.
+- Rename `MonitorId` to `MonitorHandle`.
+- Removed `serde` implementations from `ControlFlow`.
+- Rename several functions to improve both internal consistency and compliance with Rust API guidelines.
+- Remove `WindowBuilder::multitouch` field, since it was only implemented on a few platforms. Multitouch is always enabled now.
+- **Breaking:** On macOS, change `ns` identifiers to use snake_case for consistency with iOS's `ui` identifiers.
+- Add `MonitorHandle::video_modes` method for retrieving supported video modes for the given monitor.
+- On Wayland, the window now exists even if nothing has been drawn.
+- On Windows, fix initial dimensions of a fullscreen window.
+- On Windows, Fix transparent borderless windows rendering wrong.
diff --git a/vendor/winit/src/changelog/v0.21.md b/vendor/winit/src/changelog/v0.21.md
new file mode 100644
index 00000000..48f3d354
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.21.md
@@ -0,0 +1,16 @@
+## 0.21.0
+
+- On Windows, fixed "error: linking with `link.exe` failed: exit code: 1120" error on older versions of windows.
+- On macOS, fix set_minimized(true) works only with decorations.
+- On macOS, add `hide_application` to `EventLoopWindowTarget` via a new `EventLoopWindowTargetExtMacOS` trait. `hide_application` will hide the entire application by calling `-[NSApplication hide: nil]`.
+- On macOS, fix not sending ReceivedCharacter event for specific keys combinations.
+- On macOS, fix `CursorMoved` event reporting the cursor position using logical coordinates.
+- On macOS, fix issue where unbundled applications would sometimes open without being focused.
+- On macOS, fix `run_return` does not return unless it receives a message.
+- On Windows, fix bug where `RedrawRequested` would only get emitted every other iteration of the event loop.
+- On X11, fix deadlock on window state when handling certain window events.
+- `WindowBuilder` now implements `Default`.
+- **Breaking:** `WindowEvent::CursorMoved` changed to `f64` units, preserving high-precision data supplied by most backends
+- On Wayland, fix coordinates in mouse events when scale factor isn't 1
+- On Web, add the ability to provide a custom canvas
+- **Breaking:** On Wayland, the `WaylandTheme` struct has been replaced with a `Theme` trait, allowing for extra configuration
diff --git a/vendor/winit/src/changelog/v0.22.md b/vendor/winit/src/changelog/v0.22.md
new file mode 100644
index 00000000..07bc1ef2
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.22.md
@@ -0,0 +1,37 @@
+## 0.22.2
+
+- Added Clone implementation for 'static events.
+- On Windows, fix window intermittently hanging when `ControlFlow` was set to `Poll`.
+- On Windows, fix `WindowBuilder::with_maximized` being ignored.
+- On Android, minimal platform support.
+- On iOS, touch positions are now properly converted to physical pixels.
+- On macOS, updated core-* dependencies and cocoa
+
+## 0.22.1
+
+- On X11, fix `ResumeTimeReached` being fired too early.
+- On Web, replaced zero timeout for `ControlFlow::Poll` with `requestAnimationFrame`
+- On Web, fix a possible panic during event handling
+- On macOS, fix `EventLoopProxy` leaking memory for every instance.
+
+## 0.22.0
+
+- On Windows, fix minor timing issue in wait_until_time_or_msg
+- On Windows, rework handling of request_redraw() to address panics.
+- On macOS, fix `set_simple_screen` to remember frame excluding title bar.
+- On Wayland, fix coordinates in touch events when scale factor isn't 1.
+- On Wayland, fix color from `close_button_icon_color` not applying.
+- Ignore locale if unsupported by X11 backend
+- On Wayland, Add HiDPI cursor support
+- On Web, add the ability to query "Light" or "Dark" system theme send `ThemeChanged` on change.
+- Fix `Event::to_static` returning `None` for user events.
+- On Wayland, Hide CSD for fullscreen windows.
+- On Windows, ignore spurious mouse move messages.
+- **Breaking:** Move `ModifiersChanged` variant from `DeviceEvent` to `WindowEvent`.
+- On Windows, add `IconExtWindows` trait which exposes creating an `Icon` from an external file or embedded resource
+- Add `BadIcon::OsError` variant for when OS icon functionality fails
+- On Windows, fix crash at startup on systems that do not properly support Windows' Dark Mode
+- Revert On macOS, fix not sending ReceivedCharacter event for specific keys combinations.
+- on macOS, fix incorrect ReceivedCharacter events for some key combinations.
+- **Breaking:** Use `i32` instead of `u32` for position type in `WindowEvent::Moved`.
+- On macOS, a mouse motion event is now generated before every mouse click.
diff --git a/vendor/winit/src/changelog/v0.23.md b/vendor/winit/src/changelog/v0.23.md
new file mode 100644
index 00000000..33ea2abd
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.23.md
@@ -0,0 +1,65 @@
+## 0.23.0
+
+- On iOS, fixed support for the "Debug View Hierarchy" feature in Xcode.
+- On all platforms, `available_monitors` and `primary_monitor` are now on `EventLoopWindowTarget` rather than `EventLoop` to list monitors event in the event loop.
+- On Unix, X11 and Wayland are now optional features (enabled by default)
+- On X11, fix deadlock when calling `set_fullscreen_inner`.
+- On Web, prevent the webpage from scrolling when the user is focused on a winit canvas
+- On Web, calling `window.set_cursor_icon` no longer breaks HiDPI scaling
+- On Windows, drag and drop is now optional (enabled by default) and can be disabled with `WindowBuilderExtWindows::with_drag_and_drop(false)`.
+- On Wayland, fix deadlock when calling to `set_inner_size` from a callback.
+- On macOS, add `hide__other_applications` to `EventLoopWindowTarget` via existing `EventLoopWindowTargetExtMacOS` trait. `hide_other_applications` will hide other applications by calling `-[NSApplication hideOtherApplications: nil]`.
+- On android added support for `run_return`.
+- On MacOS, Fixed fullscreen and dialog support for `run_return`.
+- On Windows, fix bug where we'd try to emit `MainEventsCleared` events during nested win32 event loops.
+- On Web, use mouse events if pointer events aren't supported. This affects Safari.
+- On Windows, `set_ime_position` is now a no-op instead of a runtime crash.
+- On Android, `set_fullscreen` is now a no-op instead of a runtime crash.
+- On iOS and Android, `set_inner_size` is now a no-op instead of a runtime crash.
+- On Android, fix `ControlFlow::Poll` not polling the Android event queue.
+- On macOS, add `NSWindow.hasShadow` support.
+- On Web, fix vertical mouse wheel scrolling being inverted.
+- On Web, implement mouse capturing for click-dragging out of the canvas.
+- On Web, fix `ControlFlow::Exit` not properly handled.
+- On Web (web-sys only), send `WindowEvent::ScaleFactorChanged` event when `window.devicePixelRatio` is changed.
+- **Breaking:** On Web, `set_cursor_position` and `set_cursor_grab` will now always return an error.
+- **Breaking:** `PixelDelta` scroll events now return a `PhysicalPosition`.
+- On NetBSD, fixed crash due to incorrect detection of the main thread.
+- **Breaking:** On X11, `-` key is mapped to the `Minus` virtual key code, instead of `Subtract`.
+- On macOS, fix inverted horizontal scroll.
+- **Breaking:** `current_monitor` now returns `Option<MonitorHandle>`.
+- **Breaking:** `primary_monitor` now returns `Option<MonitorHandle>`.
+- On macOS, updated core-* dependencies and cocoa.
+- Bump `parking_lot` to 0.11
+- On Android, bump `ndk`, `ndk-sys` and `ndk-glue` to 0.2. Checkout the new ndk-glue main proc attribute.
+- On iOS, fixed starting the app in landscape where the view still had portrait dimensions.
+- Deprecate the stdweb backend, to be removed in a future release
+- **Breaking:** Prefixed virtual key codes `Add`, `Multiply`, `Divide`, `Decimal`, and `Subtract` with `Numpad`.
+- Added `Asterisk` and `Plus` virtual key codes.
+- On Web (web-sys only), the `Event::LoopDestroyed` event is correctly emitted when leaving the page.
+- On Web, the `WindowEvent::Destroyed` event now gets emitted when a `Window` is dropped.
+- On Web (web-sys only), the event listeners are now removed when a `Window` is dropped or when the event loop is destroyed.
+- On Web, the event handler closure passed to `EventLoop::run` now gets dropped after the event loop is destroyed.
+- **Breaking:** On Web, the canvas element associated to a `Window` is no longer removed from the DOM when the `Window` is dropped.
+- On Web, `WindowEvent::Resized` is now emitted when `Window::set_inner_size` is called.
+- **Breaking:** `Fullscreen` enum now uses `Borderless(Option<MonitorHandle>)` instead of `Borderless(MonitorHandle)` to allow picking the current monitor.
+- On MacOS, fix `WindowEvent::Moved` ignoring the scale factor.
+- On Wayland, add missing virtual keycodes.
+- On Wayland, implement proper `set_cursor_grab`.
+- On Wayland, the cursor will use similar icons if the requested one isn't available.
+- On Wayland, right clicking on client side decorations will request application menu.
+- On Wayland, fix tracking of window size after state changes.
+- On Wayland, fix client side decorations not being hidden properly in fullscreen.
+- On Wayland, fix incorrect size event when entering fullscreen with client side decorations.
+- On Wayland, fix `resizable` attribute not being applied properly on startup.
+- On Wayland, fix disabled repeat rate not being handled.
+- On Wayland, fix decoration buttons not working after tty switch.
+- On Wayland, fix scaling not being applied on output re-enable.
+- On Wayland, fix crash when `XCURSOR_SIZE` is `0`.
+- On Wayland, fix pointer getting created in some cases without pointer capability.
+- On Wayland, on kwin, fix space between window and decorations on startup.
+- **Breaking:** On Wayland, `Theme` trait was reworked.
+- On Wayland, disable maximize button for non-resizable window.
+- On Wayland, added support for `set_ime_position`.
+- On Wayland, fix crash on startup since GNOME 3.37.90.
+- On X11, fix incorrect modifiers state on startup.
diff --git a/vendor/winit/src/changelog/v0.24.md b/vendor/winit/src/changelog/v0.24.md
new file mode 100644
index 00000000..fa0a27b2
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.24.md
@@ -0,0 +1,28 @@
+## 0.24.0
+
+- On Windows, fix applications not exiting gracefully due to thread_event_target_callback accessing corrupted memory.
+- On Windows, implement `Window::set_ime_position`.
+- **Breaking:** On Windows, Renamed `WindowBuilderExtWindows`'s `is_dark_mode` to `theme`.
+- **Breaking:** On Windows, renamed `WindowBuilderExtWindows::is_dark_mode` to `theme`.
+- On Windows, add `WindowBuilderExtWindows::with_theme` to set a preferred theme.
+- On Windows, fix bug causing message boxes to appear delayed.
+- On Android, calling `WindowEvent::Focused` now works properly instead of always returning false.
+- On Windows, fix Alt-Tab behaviour by removing borderless fullscreen "always on top" flag.
+- On Windows, fix bug preventing windows with transparency enabled from having fully-opaque regions.
+- **Breaking:** On Windows, include prefix byte in scancodes.
+- On Wayland, fix window not being resizeable when using `WindowBuilder::with_min_inner_size`.
+- On Unix, fix cross-compiling to wasm32 without enabling X11 or Wayland.
+- On Windows, fix use-after-free crash during window destruction.
+- On Web, fix `WindowEvent::ReceivedCharacter` never being sent on key input.
+- On macOS, fix compilation when targeting aarch64.
+- On X11, fix `Window::request_redraw` not waking the event loop.
+- On Wayland, the keypad arrow keys are now recognized.
+- **Breaking** Rename `desktop::EventLoopExtDesktop` to `run_return::EventLoopExtRunReturn`.
+- Added `request_user_attention` method to `Window`.
+- **Breaking:** On macOS, removed `WindowExt::request_user_attention`, use `Window::request_user_attention`.
+- **Breaking:** On X11, removed `WindowExt::set_urgent`, use `Window::request_user_attention`.
+- On Wayland, default font size in CSD increased from 11 to 17.
+- On Windows, fix bug causing message boxes to appear delayed.
+- On Android, support multi-touch.
+- On Wayland, extra mouse buttons are not dropped anymore.
+- **Breaking**: `MouseButton::Other` now uses `u16`.
diff --git a/vendor/winit/src/changelog/v0.25.md b/vendor/winit/src/changelog/v0.25.md
new file mode 100644
index 00000000..00451c08
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.25.md
@@ -0,0 +1,31 @@
+## 0.25.0
+
+- **Breaking:** On macOS, replace `WindowBuilderExtMacOS::with_activation_policy` with `EventLoopExtMacOS::set_activation_policy`
+- On macOS, wait with activating the application until the application has initialized.
+- On macOS, fix creating new windows when the application has a main menu.
+- On Windows, fix fractional deltas for mouse wheel device events.
+- On macOS, fix segmentation fault after dropping the main window.
+- On Android, `InputEvent::KeyEvent` is partially implemented providing the key scancode.
+- Added `is_maximized` method to `Window`.
+- On Windows, fix bug where clicking the decoration bar would make the cursor blink.
+- On Windows, fix bug causing newly created windows to erroneously display the "wait" (spinning) cursor.
+- On macOS, wake up the event loop immediately when a redraw is requested.
+- On Windows, change the default window size (1024x768) to match the default on other desktop platforms (800x600).
+- On Windows, fix bug causing mouse capture to not be released.
+- On Windows, fix fullscreen not preserving minimized/maximized state.
+- On Android, unimplemented events are marked as unhandled on the native event loop.
+- On Windows, added `WindowBuilderExtWindows::with_menu` to set a custom menu at window creation time.
+- On Android, bump `ndk` and `ndk-glue` to 0.3: use predefined constants for event `ident`.
+- On macOS, fix objects captured by the event loop closure not being dropped on panic.
+- On Windows, fixed `WindowEvent::ThemeChanged` not properly firing and fixed `Window::theme` returning the wrong theme.
+- On Web, added support for `DeviceEvent::MouseMotion` to listen for relative mouse movements.
+- Added `WindowBuilder::with_position` to allow setting the position of a `Window` on creation. Supported on Windows, macOS and X11.
+- Added `Window::drag_window`. Implemented on Windows, macOS, X11 and Wayland.
+- On X11, bump `mio` to 0.7.
+- On Windows, added `WindowBuilderExtWindows::with_owner_window` to allow creating popup windows.
+- On Windows, added `WindowExtWindows::set_enable` to allow creating modal popup windows.
+- On macOS, emit `RedrawRequested` events immediately while the window is being resized.
+- Implement `Default`, `Hash`, and `Eq` for `LogicalPosition`, `PhysicalPosition`, `LogicalSize`, and `PhysicalSize`.
+- On macOS, initialize the Menu Bar with minimal defaults. (Can be prevented using `enable_default_menu_creation`)
+- On macOS, change the default behavior for first click when the window was unfocused. Now the window becomes focused and then emits a `MouseInput` event on a "first mouse click".
+- Implement mint (math interoperability standard types) conversions (under feature flag `mint`).
diff --git a/vendor/winit/src/changelog/v0.26.md b/vendor/winit/src/changelog/v0.26.md
new file mode 100644
index 00000000..d33d4a3b
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.26.md
@@ -0,0 +1,36 @@
+## 0.26.1
+
+- Fix linking to the `ColorSync` framework on macOS 10.7, and in newer Rust versions.
+- On Web, implement cursor grabbing through the pointer lock API.
+- On X11, add mappings for numpad comma, numpad enter, numlock and pause.
+- On macOS, fix Pinyin IME input by reverting a change that intended to improve IME.
+- On Windows, fix a crash with transparent windows on Windows 11.
+
+## 0.26.0
+
+- Update `raw-window-handle` to `v0.4`. This is _not_ a breaking change, we still implement `HasRawWindowHandle` from `v0.3`, see [rust-windowing/raw-window-handle#74](https://github.com/rust-windowing/raw-window-handle/pull/74). Note that you might have to run `cargo update -p raw-window-handle` after upgrading.
+- On X11, bump `mio` to 0.8.
+- On Android, fixed `WindowExtAndroid::config` initially returning an empty `Configuration`.
+- On Android, fixed `Window::scale_factor` and `MonitorHandle::scale_factor` initially always returning 1.0.
+- On X11, select an appropriate visual for transparency if is requested
+- On Wayland and X11, fix diagonal window resize cursor orientation.
+- On macOS, drop the event callback before exiting.
+- On Android, implement `Window::request_redraw`
+- **Breaking:** On Web, remove the `stdweb` backend.
+- Added `Window::focus_window`to bring the window to the front and set input focus.
+- On Wayland and X11, implement `is_maximized` method on `Window`.
+- On Windows, prevent ghost window from showing up in the taskbar after either several hours of use or restarting `explorer.exe`.
+- On macOS, fix issue where `ReceivedCharacter` was not being emitted during some key repeat events.
+- On Wayland, load cursor icons `hand2` and `hand1` for `CursorIcon::Hand`.
+- **Breaking:** On Wayland, Theme trait and its support types are dropped.
+- On Wayland, bump `smithay-client-toolkit` to 0.15.1.
+- On Wayland, implement `request_user_attention` with `xdg_activation_v1`.
+- On X11, emit missing `WindowEvent::ScaleFactorChanged` when the only monitor gets reconnected.
+- On X11, if RANDR based scale factor is higher than 20 reset it to 1
+- On Wayland, add an enabled-by-default feature called `wayland-dlopen` so users can opt out of using `dlopen` to load system libraries.
+- **Breaking:** On Android, bump `ndk` and `ndk-glue` to 0.5.
+- On Windows, increase wait timer resolution for more accurate timing when using `WaitUntil`.
+- On macOS, fix native file dialogs hanging the event loop.
+- On Wayland, implement a workaround for wrong configure size when using `xdg_decoration` in `kwin_wayland`
+- On macOS, fix an issue that prevented the menu bar from showing in borderless fullscreen mode.
+- On X11, EINTR while polling for events no longer causes a panic. Instead it will be treated as a spurious wakeup.
diff --git a/vendor/winit/src/changelog/v0.27.md b/vendor/winit/src/changelog/v0.27.md
new file mode 100644
index 00000000..5f067f59
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.27.md
@@ -0,0 +1,107 @@
+## 0.27.5
+
+- On Wayland, fix byte offset in `Ime::Preedit` pointing to invalid bytes.
+
+## 0.27.4
+
+- On Windows, emit `ReceivedCharacter` events on system keybindings.
+- On Windows, fixed focus event emission on minimize.
+- On X11, fixed IME crashing during reload.
+
+## 0.27.3
+
+- On Windows, added `WindowExtWindows::set_undecorated_shadow` and `WindowBuilderExtWindows::with_undecorated_shadow` to draw the drop shadow behind a borderless window.
+- On Windows, fixed default window features (ie snap, animations, shake, etc.) when decorations are disabled.
+- On Windows, fixed ALT+Space shortcut to open window menu.
+- On Wayland, fixed `Ime::Preedit` not being sent on IME reset.
+- Fixed unbound version specified for `raw-window-handle` leading to compilation failures.
+- Empty `Ime::Preedit` event will be sent before `Ime::Commit` to help clearing preedit.
+- On X11, fixed IME context picking by querying for supported styles beforehand.
+
+## 0.27.2
+
+- On macOS, fixed touch phase reporting when scrolling.
+- On X11, fix min, max and resize increment hints not persisting for resizable windows (e.g. on DPI change).
+- On Windows, respect min/max inner sizes when creating the window.
+- For backwards compatibility, `Window` now (additionally) implements the old version (`0.4`) of the `HasRawWindowHandle` trait
+- On Windows, added support for `EventLoopWindowTarget::set_device_event_filter`.
+- On Wayland, fix user requested `WindowEvent::RedrawRequested` being delayed by a frame.
+
+## 0.27.1
+
+- The minimum supported Rust version was lowered to `1.57.0` and now explicitly tested.
+- On X11, fix crash on start due to inability to create an IME context without any preedit.
+
+## 0.27.0
+
+- On Windows, fix hiding a maximized window.
+- On Android, `ndk-glue`'s `NativeWindow` lock is now held between `Event::Resumed` and `Event::Suspended`.
+- On Web, added `EventLoopExtWebSys` with a `spawn` method to start the event loop without throwing an exception.
+- Added `WindowEvent::Occluded(bool)`, currently implemented on macOS and X11.
+- On X11, fix events for caps lock key not being sent
+- Build docs on `docs.rs` for iOS and Android as well.
+- **Breaking:** Removed the `WindowAttributes` struct, since all its functionality is accessible from `WindowBuilder`.
+- Added `WindowBuilder::transparent` getter to check if the user set `transparent` attribute.
+- On macOS, Fix emitting `Event::LoopDestroyed` on CMD+Q.
+- On macOS, fixed an issue where having multiple windows would prevent run_return from ever returning.
+- On Wayland, fix bug where the cursor wouldn't hide in GNOME.
+- On macOS, Windows, and Wayland, add `set_cursor_hittest` to let the window ignore mouse events.
+- On Windows, added `WindowExtWindows::set_skip_taskbar` and `WindowBuilderExtWindows::with_skip_taskbar`.
+- On Windows, added `EventLoopBuilderExtWindows::with_msg_hook`.
+- On Windows, remove internally unique DC per window.
+- On macOS, remove the need to call `set_ime_position` after moving the window.
+- Added `Window::is_visible`.
+- Added `Window::is_resizable`.
+- Added `Window::is_decorated`.
+- On X11, fix for repeated event loop iteration when `ControlFlow` was `Wait`
+- On X11, fix scale factor calculation when the only monitor is reconnected
+- On Wayland, report unaccelerated mouse deltas in `DeviceEvent::MouseMotion`.
+- On Web, a focused event is manually generated when a click occurs to emulate behaviour of other backends.
+- **Breaking:** Bump `ndk` version to 0.6, ndk-sys to `v0.3`, `ndk-glue` to `0.6`.
+- Remove no longer needed `WINIT_LINK_COLORSYNC` environment variable.
+- **Breaking:** Rename the `Exit` variant of `ControlFlow` to `ExitWithCode`, which holds a value to control the exit code after running. Add an `Exit` constant which aliases to `ExitWithCode(0)` instead to avoid major breakage. This shouldn't affect most existing programs.
+- Add `EventLoopBuilder`, which allows you to create and tweak the settings of an event loop before creating it.
+- Deprecated `EventLoop::with_user_event`; use `EventLoopBuilder::with_user_event` instead.
+- **Breaking:** Replaced `EventLoopExtMacOS` with `EventLoopBuilderExtMacOS` (which also has renamed methods).
+- **Breaking:** Replaced `EventLoopExtWindows` with `EventLoopBuilderExtWindows` (which also has renamed methods).
+- **Breaking:** Replaced `EventLoopExtUnix` with `EventLoopBuilderExtUnix` (which also has renamed methods).
+- **Breaking:** The platform specific extensions for Windows `winit::platform::windows` have changed. All `HANDLE`-like types e.g. `HWND` and `HMENU` were converted from winapi types or `*mut c_void` to `isize`. This was done to be consistent with the type definitions in windows-sys and to not expose internal dependencies.
+- The internal bindings to the [Windows API](https://docs.microsoft.com/en-us/windows/) were changed from the unofficial [winapi](https://github.com/retep998/winapi-rs) bindings to the official Microsoft [windows-sys](https://github.com/microsoft/windows-rs) bindings.
+- On Wayland, fix polling during consecutive `EventLoop::run_return` invocations.
+- On Windows, fix race issue creating fullscreen windows with `WindowBuilder::with_fullscreen`
+- On Android, `virtual_keycode` for `KeyboardInput` events is now filled in where a suitable match is found.
+- Added helper methods on `ControlFlow` to set its value.
+- On Wayland, fix `TouchPhase::Ended` always reporting the location of the first touch down, unless the compositor
+  sent a cancel or frame event.
+- On iOS, send `RedrawEventsCleared` even if there are no redraw events, consistent with other platforms.
+- **Breaking:** Replaced `Window::with_app_id` and `Window::with_class` with `Window::with_name` on `WindowBuilderExtUnix`.
+- On Wayland, fallback CSD was replaced with proper one:
+  - `WindowBuilderExtUnix::with_wayland_csd_theme` to set color theme in builder.
+  - `WindowExtUnix::wayland_set_csd_theme` to set color theme when creating a window.
+  - `WINIT_WAYLAND_CSD_THEME` env variable was added, it can be used to set "dark"/"light" theme in apps that don't expose theme setting.
+  - `wayland-csd-adwaita` feature that enables proper CSD with title rendering using FreeType system library.
+  - `wayland-csd-adwaita-notitle` feature that enables CSD but without title rendering.
+- On Wayland and X11, fix window not resizing with `Window::set_inner_size` after calling `Window:set_resizable(false)`.
+- On Windows, fix wrong fullscreen monitors being recognized when handling WM_WINDOWPOSCHANGING messages
+- **Breaking:** Added new `WindowEvent::Ime` supported on desktop platforms.
+- Added `Window::set_ime_allowed` supported on desktop platforms.
+- **Breaking:** IME input on desktop platforms won't be received unless it's explicitly allowed via `Window::set_ime_allowed` and new `WindowEvent::Ime` events are handled.
+- On macOS, `WindowEvent::Resized` is now emitted in `frameDidChange` instead of `windowDidResize`.
+- **Breaking:** On X11, device events are now ignored for unfocused windows by default, use `EventLoopWindowTarget::set_device_event_filter` to set the filter level.
+- Implemented `Default` on `EventLoop<()>`.
+- Implemented `Eq` for `Fullscreen`, `Theme`, and `UserAttentionType`.
+- **Breaking:** `Window::set_cursor_grab` now accepts `CursorGrabMode` to control grabbing behavior.
+- On Wayland, add support for `Window::set_cursor_position`.
+- Fix on macOS `WindowBuilder::with_disallow_hidpi`, setting true or false by the user no matter the SO default value.
+- `EventLoopBuilder::build` will now panic when the `EventLoop` is being created more than once.
+- Added `From<u64>` for `WindowId` and `From<WindowId>` for `u64`.
+- Added `MonitorHandle::refresh_rate_millihertz` to get monitor's refresh rate.
+- **Breaking**, Replaced `VideoMode::refresh_rate` with `VideoMode::refresh_rate_millihertz` providing better precision.
+- On Web, add `with_prevent_default` and `with_focusable` to `WindowBuilderExtWebSys` to control whether events should be propagated.
+- On Windows, fix focus events being sent to inactive windows.
+- **Breaking**, update `raw-window-handle` to `v0.5` and implement `HasRawDisplayHandle` for `Window` and `EventLoopWindowTarget`.
+- On X11, add function `register_xlib_error_hook` into `winit::platform::unix` to subscribe for errors coming from Xlib.
+- On Android, upgrade `ndk` and `ndk-glue` dependencies to the recently released `0.7.0`.
+- All platforms can now be relied on to emit a `Resumed` event. Applications are recommended to lazily initialize graphics state and windows on first resume for portability.
+- **Breaking:**: Reverse horizontal scrolling sign in `MouseScrollDelta` to match the direction of vertical scrolling. A positive X value now means moving the content to the right. The meaning of vertical scrolling stays the same: a positive Y value means moving the content down.
+- On MacOS, fix deadlock when calling `set_maximized` from event loop.
diff --git a/vendor/winit/src/changelog/v0.28.md b/vendor/winit/src/changelog/v0.28.md
new file mode 100644
index 00000000..a8b3262f
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.28.md
@@ -0,0 +1,100 @@
+## 0.28.7
+
+- Fix window size sometimes being invalid when resizing on macOS 14 Sonoma.
+
+## 0.28.6
+
+- On macOS, fixed memory leak when getting monitor handle.
+- On macOS, fix `Backspace` being emitted when clearing preedit with it.
+
+## 0.28.5
+
+- On macOS, fix `key_up` being ignored when `Ime` is disabled.
+
+## 0.28.4
+
+- On macOS, fix empty marked text blocking regular input.
+- On macOS, fix potential panic when getting refresh rate.
+- On macOS, fix crash when calling `Window::set_ime_position` from another thread.
+
+## 0.28.3
+
+- Fix macOS memory leaks.
+
+## 0.28.2
+
+- Implement `HasRawDisplayHandle` for `EventLoop`.
+- On macOS, set resize increments only for live resizes.
+- On Wayland, fix rare crash on DPI change
+- Web: Added support for `Window::theme`.
+- On Wayland, fix rounding issues when doing resize.
+- On macOS, fix wrong focused state on startup.
+- On Windows, fix crash on setting taskbar when using Visual Studio debugger.
+- On macOS, resize simple fullscreen windows on windowDidChangeScreen events.
+
+## 0.28.1
+
+- On Wayland, fix crash when dropping a window in multi-window setup.
+
+## 0.28.0
+
+- On macOS, fixed `Ime::Commit` persisting for all input after interacting with `Ime`.
+- On macOS, added `WindowExtMacOS::option_as_alt` and `WindowExtMacOS::set_option_as_alt`.
+- On Windows, fix window size for maximized, undecorated windows.
+- On Windows and macOS, add `WindowBuilder::with_active`.
+- Add `Window::is_minimized`.
+- On X11, fix errors handled during `register_xlib_error_hook` invocation bleeding into winit.
+- Add `Window::has_focus`.
+- On Windows, fix `Window::set_minimized(false)` not working for windows minimized by `Win + D` hotkey.
+- **Breaking:** On Web, touch input no longer fires `WindowEvent::Cursor*`, `WindowEvent::MouseInput`, or `DeviceEvent::MouseMotion` like other platforms, but instead it fires `WindowEvent::Touch`.
+- **Breaking:** Removed platform specific `WindowBuilder::with_parent` API in favor of `WindowBuilder::with_parent_window`.
+- On Windows, retain `WS_MAXIMIZE` window style when un-minimizing a maximized window.
+- On Windows, fix left mouse button release event not being sent after `Window::drag_window`.
+- On macOS, run most actions on the main thread, which is strictly more correct, but might make multithreaded applications block slightly more.
+- On macOS, fix panic when getting current monitor without any monitor attached.
+- On Windows and MacOS, add API to enable/disable window buttons (close, minimize, ...etc).
+- On Windows, macOS, X11 and Wayland, add `Window::set_theme`.
+- **Breaking:** Remove `WindowExtWayland::wayland_set_csd_theme` and `WindowBuilderExtX11::with_gtk_theme_variant`.
+- On Windows, revert window background to an empty brush to avoid white flashes when changing scaling.
+- **Breaking:** Removed `Window::set_always_on_top` and related APIs in favor of `Window::set_window_level`.
+- On Windows, MacOS and X11, add always on bottom APIs.
+- On Windows, fix the value in `MouseButton::Other`.
+- On macOS, add `WindowExtMacOS::is_document_edited` and `WindowExtMacOS::set_document_edited` APIs.
+- **Breaking:** Removed `WindowBuilderExtIOS::with_root_view_class`; instead, you should use `[[view layer] addSublayer: ...]` to add an instance of the desired layer class (e.g. `CAEAGLLayer` or `CAMetalLayer`). See `vulkano-win` or `wgpu` for examples of this.
+- On MacOS and Windows, add `Window::set_content_protected`.
+- On MacOS, add `EventLoopBuilderExtMacOS::with_activate_ignoring_other_apps`.
+- On Windows, fix icons specified on `WindowBuilder` not taking effect for windows created after the first one.
+- On Windows and macOS, add `Window::title` to query the current window title.
+- On Windows, fix focusing menubar when pressing `Alt`.
+- On MacOS, made `accepts_first_mouse` configurable.
+- Migrated `WindowBuilderExtUnix::with_resize_increments` to `WindowBuilder`.
+- Added `Window::resize_increments`/`Window::set_resize_increments` to update resize increments at runtime for X11/macOS.
+- macOS/iOS: Use `objc2` instead of `objc` internally.
+- **Breaking:** Bump MSRV from `1.57` to `1.60`.
+- **Breaking:** Split the `platform::unix` module into `platform::x11` and `platform::wayland`. The extension types are similarly renamed.
+- **Breaking:**: Removed deprecated method `platform::unix::WindowExtUnix::is_ready`.
+- Removed `parking_lot` dependency.
+- **Breaking:** On macOS, add support for two-finger touchpad magnification and rotation gestures with new events `WindowEvent::TouchpadMagnify` and `WindowEvent::TouchpadRotate`. Also add support for touchpad smart-magnification gesture with a new event `WindowEvent::SmartMagnify`.
+- **Breaking:** On web, the `WindowBuilderExtWebSys::with_prevent_default` setting (enabled by default), now additionally prevents scrolling of the webpage in mobile browsers, previously it only disabled scrolling on desktop.
+- On Wayland, `wayland-csd-adwaita` now uses `ab_glyph` instead of `crossfont` to render the title for decorations.
+- On Wayland, a new `wayland-csd-adwaita-crossfont` feature was added to use `crossfont` instead of `ab_glyph` for decorations.
+- On Wayland, if not otherwise specified use upstream automatic CSD theme selection.
+- On X11, added `WindowExtX11::with_parent` to create child windows.
+- Added support for `WindowBuilder::with_theme` and `Window::theme` to support per-window dark/light/system theme configuration on macos, windows and wayland.
+- On macOS, added support for `WindowEvent::ThemeChanged`.
+- **Breaking:** Removed `WindowBuilderExtWindows::with_theme` and `WindowBuilderExtWayland::with_wayland_csd_theme` in favour of `WindowBuilder::with_theme`.
+- **Breaking:** Removed `WindowExtWindows::theme` in favour of `Window::theme`.
+- Enabled `doc_auto_cfg` when generating docs on docs.rs for feature labels.
+- **Breaking:** On Android, switched to using [`android-activity`](https://github.com/rib/android-activity) crate as a glue layer instead of [`ndk-glue`](https://github.com/rust-windowing/android-ndk-rs/tree/master/ndk-glue). See [README.md#Android](https://github.com/rust-windowing/winit#Android) for more details. ([#2444](https://github.com/rust-windowing/winit/pull/2444))
+- **Breaking:** Removed support for `raw-window-handle` version `0.4`
+- On Wayland, `RedrawRequested` not emitted during resize.
+- Add a `set_wait_timeout` function to `ControlFlow` to allow waiting for a `Duration`.
+- **Breaking:** Remove the unstable `xlib_xconnection()` function from the private interface.
+- Added Orbital support for Redox OS
+- On X11, added `drag_resize_window` method.
+- Added `Window::set_transparent` to provide a hint about transparency of the window on Wayland and macOS.
+- On macOS, fix the mouse buttons other than left/right/middle being reported as middle.
+- On Wayland, support fractional scaling via the wp-fractional-scale protocol.
+- On web, fix removal of mouse event listeners from the global object upon window destruction.
+- Add WindowAttributes getter to WindowBuilder to allow introspection of default values.
+- Added `Window::set_ime_purpose` for setting the IME purpose, currently implemented on Wayland only.
diff --git a/vendor/winit/src/changelog/v0.29.md b/vendor/winit/src/changelog/v0.29.md
new file mode 100644
index 00000000..fc17f170
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.29.md
@@ -0,0 +1,289 @@
+## 0.29.15
+
+- On X11, fix crash due to xsettings query on systems with incomplete xsettings.
+
+## 0.29.14
+
+- On X11/Wayland, fix `text` and `text_with_all_modifiers` not being `None` during compose.
+- On Wayland, don't reapply cursor grab when unchanged.
+- On X11, fix a bug where some mouse events would be unexpectedly filtered out.
+
+## 0.29.13
+
+- On Web, fix possible crash with `ControlFlow::Wait` and `ControlFlow::WaitUntil`.
+
+## 0.29.12
+
+- On X11, fix use after free during xinput2 handling.
+- On X11, filter close to zero values in mouse device events
+
+## 0.29.11
+
+- Fix compatibility with 32-bit platforms without 64-bit atomics.
+- On macOS, fix incorrect IME cursor rect origin.
+- On Windows, fixed a race condition when sending an event through the loop proxy.
+- On X11, fix swapped instance and general class names.
+- On X11, don't require XIM to run.
+- On X11, fix xkb state not being updated correctly sometimes leading to wrong input.
+- On X11, reload dpi on `_XSETTINGS_SETTINGS` update.
+- On X11, fix deadlock when adjusting DPI and resizing at the same time.
+- On Wayland, disable `Occluded` event handling.
+- On Wayland, fix DeviceEvent::Motion not being sent
+- On Wayland, fix `Focused(false)` being send when other seats still have window focused.
+- On Wayland, fix `Window::set_{min,max}_inner_size` not always applied.
+- On Wayland, fix title in CSD not updated from `AboutToWait`.
+- On Windows, fix inconsistent resizing behavior with multi-monitor setups when repositioning outside the event loop.
+- On Wayland, fix `WAYLAND_SOCKET` not used when detecting platform.
+- On Orbital, fix `logical_key` and `text` not reported in `KeyEvent`.
+- On Orbital, implement `KeyEventExtModifierSupplement`.
+- On Orbital, map keys to `NamedKey` when possible.
+- On Orbital, implement `set_cursor_grab`.
+- On Orbital, implement `set_cursor_visible`.
+- On Orbital, implement `drag_window`.
+- On Orbital, implement `drag_resize_window`.
+- On Orbital, implement `set_transparent`.
+- On Orbital, implement `set_visible`.
+- On Orbital, implement `is_visible`.
+- On Orbital, implement `set_resizable`.
+- On Orbital, implement `is_resizable`.
+- On Orbital, implement `set_maximized`.
+- On Orbital, implement `is_maximized`.
+- On Orbital, implement `set_decorations`.
+- On Orbital, implement `is_decorated`.
+- On Orbital, implement `set_window_level`.
+- On Orbital, emit `DeviceEvent::MouseMotion`.
+
+## 0.29.10
+
+- On Web, account for canvas being focused already before event loop starts.
+- On Web, increase cursor position accuracy.
+
+## 0.29.9
+
+- On X11, fix `NotSupported` error not propagated when creating event loop.
+- On Wayland, fix resize not issued when scale changes
+- On X11 and Wayland, fix arrow up on keypad reported as `ArrowLeft`.
+- On macOS, report correct logical key when Ctrl or Cmd is pressed.
+
+## 0.29.8
+
+- On X11, fix IME input lagging behind.
+- On X11, fix `ModifiersChanged` not sent from xdotool-like input
+- On X11, fix keymap not updated from xmodmap.
+- On X11, reduce the amount of time spent fetching screen resources.
+- On Wayland, fix `Window::request_inner_size` being overwritten by resize.
+- On Wayland, fix `Window::inner_size` not using the correct rounding.
+
+## 0.29.7
+
+- On X11, fix `Xft.dpi` reload during runtime.
+- On X11, fix window minimize.
+
+## 0.29.6
+
+- On Web, fix context menu not being disabled by `with_prevent_default(true)`.
+- On Wayland, fix `WindowEvent::Destroyed` not being delivered after destroying window.
+- Fix `EventLoopExtRunOnDemand::run_on_demand` not working for consequent invocation
+
+## 0.29.5
+
+- On macOS, remove spurious error logging when handling `Fn`.
+- On X11, fix an issue where floating point data from the server is
+  misinterpreted during a drag and drop operation.
+- On X11, fix a bug where focusing the window would panic.
+- On macOS, fix `refresh_rate_millihertz`.
+- On Wayland, disable Client Side Decorations when `wl_subcompositor` is not supported.
+- On X11, fix `Xft.dpi` detection from Xresources.
+- On Windows, fix consecutive calls to `window.set_fullscreen(Some(Fullscreen::Borderless(None)))` resulting in losing previous window state when eventually exiting fullscreen using `window.set_fullscreen(None)`.
+- On Wayland, fix resize being sent on focus change.
+- On Windows, fix `set_ime_cursor_area`.
+
+## 0.29.4
+
+- Fix crash when running iOS app on macOS.
+- On X11, check common alternative cursor names when loading cursor.
+- On X11, reload the DPI after a property change event.
+- On Windows, fix so `drag_window` and `drag_resize_window` can be called from another thread.
+- On Windows, fix `set_control_flow` in `AboutToWait` not being taken in account.
+- On macOS, send a `Resized` event after each `ScaleFactorChanged` event.
+- On Wayland, fix `wl_surface` being destroyed before associated objects.
+- On macOS, fix assertion when pressing `Fn` key.
+- On Windows, add `WindowBuilderExtWindows::with_clip_children` to control `WS_CLIPCHILDREN` style.
+
+## 0.29.3
+
+- On Wayland, apply correct scale to `PhysicalSize` passed in `WindowBuilder::with_inner_size` when possible.
+- On Wayland, fix `RedrawRequested` being always sent without decorations and `sctk-adwaita` feature.
+- On Wayland, ignore resize requests when the window is fully tiled.
+- On Wayland, use `configure_bounds` to constrain `with_inner_size` when compositor wants users to pick size.
+- On Windows, fix deadlock when accessing the state during `Cursor{Enter,Leave}`.
+- On Windows, add support for `Window::set_transparent`.
+- On macOS, fix deadlock when entering a nested event loop from an event handler.
+- On macOS, add support for `Window::set_blur`.
+
+## 0.29.2
+
+- **Breaking:** Bump MSRV from `1.60` to `1.65`.
+- **Breaking:** Add `Event::MemoryWarning`; implemented on iOS/Android.
+- **Breaking:** Bump `ndk` version to `0.8.0`, ndk-sys to `0.5.0`, `android-activity` to `0.5.0`.
+- **Breaking:** Change default `ControlFlow` from `Poll` to `Wait`.
+- **Breaking:** Move `Event::RedrawRequested` to `WindowEvent::RedrawRequested`.
+- **Breaking:** Moved `ControlFlow::Exit` to `EventLoopWindowTarget::exit()` and `EventLoopWindowTarget::exiting()` and removed `ControlFlow::ExitWithCode(_)` entirely.
+- **Breaking:** Moved `ControlFlow` to `EventLoopWindowTarget::set_control_flow()` and `EventLoopWindowTarget::control_flow()`.
+- **Breaking:** `EventLoop::new` and `EventLoopBuilder::build` now return `Result<Self, EventLoopError>`
+- **Breaking:** `WINIT_UNIX_BACKEND` was removed in favor of standard `WAYLAND_DISPLAY` and `DISPLAY` variables.
+- **Breaking:** on Wayland, dispatching user created Wayland queue won't wake up the loop unless winit has event to send back.
+- **Breaking:** remove `DeviceEvent::Text`.
+- **Breaking:** Remove lifetime parameter from `Event` and `WindowEvent`.
+- **Breaking:** Rename `Window::set_inner_size` to `Window::request_inner_size` and indicate if the size was applied immediately.
+- **Breaking:** `ActivationTokenDone` event which could be requested with the new `startup_notify` module, see its docs for more.
+- **Breaking:** `ScaleFactorChanged` now contains a writer instead of a reference to update inner size.
+- **Breaking** `run() -> !` has been replaced by `run() -> Result<(), EventLoopError>` for returning errors without calling `std::process::exit()` ([#2767](https://github.com/rust-windowing/winit/pull/2767))
+- **Breaking** Removed `EventLoopExtRunReturn` / `run_return` in favor of `EventLoopExtPumpEvents` / `pump_events` and `EventLoopExtRunOnDemand` / `run_on_demand` ([#2767](https://github.com/rust-windowing/winit/pull/2767))
+- `RedrawRequested` is no longer guaranteed to be emitted after `MainEventsCleared`, it is now platform-specific when the event is emitted after being requested via `redraw_request()`.
+  - On Windows, `RedrawRequested` is now driven by `WM_PAINT` messages which are requested via `redraw_request()`
+- **Breaking** `LoopDestroyed` renamed to `LoopExiting` ([#2900](https://github.com/rust-windowing/winit/issues/2900))
+- **Breaking** `RedrawEventsCleared` removed ([#2900](https://github.com/rust-windowing/winit/issues/2900))
+- **Breaking** `MainEventsCleared` removed ([#2900](https://github.com/rust-windowing/winit/issues/2900))
+- **Breaking:** Remove all deprecated `modifiers` fields.
+- **Breaking:** Rename `DeviceEventFilter` to `DeviceEvents` reversing the behavior of variants.
+- **Breaking** Add `AboutToWait` event which is emitted when the event loop is about to block and wait for new events ([#2900](https://github.com/rust-windowing/winit/issues/2900))
+- **Breaking:** Rename `EventLoopWindowTarget::set_device_event_filter` to `listen_device_events`.
+- **Breaking:** Rename `Window::set_ime_position` to `Window::set_ime_cursor_area` adding a way to set exclusive zone.
+- **Breaking:** `with_x11_visual` now takes the visual ID instead of the bare pointer.
+- **Breaking** `MouseButton` now supports `Back` and `Forward` variants, emitted from mouse events on Wayland, X11, Windows, macOS and Web.
+- **Breaking:** On Web, `instant` is now replaced by `web_time`.
+- **Breaking:** On Web, dropped support for Safari versions below 13.1.
+- **Breaking:** On Web, the canvas output bitmap size is no longer adjusted.
+- **Breaking:** On Web, the canvas size is not controlled by Winit anymore and external changes to the canvas size will be reported through `WindowEvent::Resized`.
+- **Breaking:** Updated `bitflags` crate version to `2`, which changes the API on exposed types.
+- **Breaking:** `CursorIcon::Arrow` was removed.
+- **Breaking:** `CursorIcon::Hand` is now named `CursorIcon::Pointer`.
+- **Breaking:** `CursorIcon` is now used from the `cursor-icon` crate.
+- **Breaking:** `WindowExtWebSys::canvas()` now returns an `Option`.
+- **Breaking:** Overhaul keyboard input handling.
+  - Replace `KeyboardInput` with `KeyEvent` and `RawKeyEvent`.
+    - Change `WindowEvent::KeyboardInput` to contain a `KeyEvent`.
+    - Change `Event::Key` to contain a `RawKeyEvent`.
+  - Remove `Event::ReceivedCharacter`. In its place, you should use
+    `KeyEvent.text` in combination with `WindowEvent::Ime`.
+  - Replace `VirtualKeyCode` with the `Key` enum.
+  - Replace `ScanCode` with the `KeyCode` enum.
+  - Rename `ModifiersState::LOGO` to `SUPER` and `ModifiersState::CTRL` to `CONTROL`.
+  - Add `PhysicalKey` wrapping `KeyCode` and `NativeKeyCode`.
+  - Add `KeyCode` to refer to keys (roughly) by their physical location.
+  - Add `NativeKeyCode` to represent raw `KeyCode`s which Winit doesn't
+    understand.
+  - Add `Key` to represent the keys after they've been interpreted by the
+    active (software) keyboard layout.
+  - Add `NamedKey` to represent the categorized keys.
+  - Add `NativeKey` to represent raw `Key`s which Winit doesn't understand.
+  - Add `KeyLocation` to tell apart `Key`s which usually "mean" the same thing,
+    but can appear simultaneously in different spots on the same keyboard
+    layout.
+  - Add `Window::reset_dead_keys` to enable application-controlled cancellation
+    of dead key sequences.
+  - Add `KeyEventExtModifierSupplement` to expose additional (and less
+    portable) interpretations of a given key-press.
+  - Add `PhysicalKeyExtScancode`, which lets you convert between scancodes and
+    `PhysicalKey`.
+  - `ModifiersChanged` now uses dedicated `Modifiers` struct.
+- Removed platform-specific extensions that should be retrieved through `raw-window-handle` trait implementations instead:
+  - `platform::windows::HINSTANCE`.
+  - `WindowExtWindows::hinstance`.
+  - `WindowExtWindows::hwnd`.
+  - `WindowExtIOS::ui_window`.
+  - `WindowExtIOS::ui_view_controller`.
+  - `WindowExtIOS::ui_view`.
+  - `WindowExtMacOS::ns_window`.
+  - `WindowExtMacOS::ns_view`.
+  - `EventLoopWindowTargetExtWayland::wayland_display`.
+  - `WindowExtWayland::wayland_surface`.
+  - `WindowExtWayland::wayland_display`.
+  - `WindowExtX11::xlib_window`.
+  - `WindowExtX11::xlib_display`.
+  - `WindowExtX11::xlib_screen_id`.
+  - `WindowExtX11::xcb_connection`.
+- Reexport `raw-window-handle` in `window` module.
+- Add `ElementState::is_pressed`.
+- Add `Window::pre_present_notify` to notify winit before presenting to the windowing system.
+- Add `Window::set_blur` to request a blur behind the window; implemented on Wayland for now.
+- Add `Window::show_window_menu` to request a titlebar/system menu; implemented on Wayland/Windows for now.
+- Implement `AsFd`/`AsRawFd` for `EventLoop<T>` on X11 and Wayland.
+- Implement `PartialOrd` and `Ord` for `MouseButton`.
+- Implement `PartialOrd` and `Ord` on types in the `dpi` module.
+- Make `WindowBuilder` `Send + Sync`.
+- Make iOS `MonitorHandle` and `VideoMode` usable from other threads.
+- Make iOS windows usable from other threads.
+- On Android, add force data to touch events.
+- On Android, added `EventLoopBuilderExtAndroid::handle_volume_keys` to indicate that the application will handle the volume keys manually.
+- On Android, fix `DeviceId` to contain device id's.
+- On Orbital, fix `ModifiersChanged` not being sent.
+- On Wayland, `Window::outer_size` now accounts for **client side** decorations.
+- On Wayland, add `Window::drag_resize_window` method.
+- On Wayland, remove `WINIT_WAYLAND_CSD_THEME` variable.
+- On Wayland, fix `TouchPhase::Canceled` being sent for moved events.
+- On Wayland, fix forward compatibility issues.
+- On Wayland, fix initial window size not restored for maximized/fullscreened on startup window.
+- On Wayland, fix maximized startup not taking full size on GNOME.
+- On Wayland, fix maximized window creation and window geometry handling.
+- On Wayland, fix window not checking that it actually got initial configure event.
+- On Wayland, make double clicking and moving the CSD frame more reliable.
+- On Wayland, support `Occluded` event with xdg-shell v6
+- On Wayland, use frame callbacks to throttle `RedrawRequested` events so redraws will align with compositor.
+- On Web, `ControlFlow::WaitUntil` now uses the Prioritized Task Scheduling API. `setTimeout()`, with a trick to circumvent throttling to 4ms, is used as a fallback.
+- On Web, `EventLoopProxy` now implements `Send`.
+- On Web, `Window` now implements `Send` and `Sync`.
+- On Web, account for CSS `padding`, `border`, and `margin` when getting or setting the canvas position.
+- On Web, add Fullscreen API compatibility for Safari.
+- On Web, add `DeviceEvent::Motion`, `DeviceEvent::MouseWheel`, `DeviceEvent::Button` and `DeviceEvent::Key` support.
+- On Web, add `EventLoopWindowTargetExtWebSys` and `PollStrategy`, which allows to set different strategies for `ControlFlow::Poll`. By default the Prioritized Task Scheduling API is used, but an option to use `Window.requestIdleCallback` is available as well. Both use `setTimeout()`, with a trick to circumvent throttling to 4ms, as a fallback.
+- On Web, add `WindowBuilderExtWebSys::with_append()` to append the canvas element to the web page on creation.
+- On Web, allow event loops to be recreated with `spawn`.
+- On Web, enable event propagation.
+- On Web, fix `ControlFlow::WaitUntil` to never wake up **before** the given time.
+- On Web, fix `DeviceEvent::MouseMotion` only being emitted for each canvas instead of the whole window.
+- On Web, fix `Window:::set_fullscreen` doing nothing when called outside the event loop but during transient activation.
+- On Web, fix pen treated as mouse input.
+- On Web, fix pointer button events not being processed when a buttons is already pressed.
+- On Web, fix scale factor resize suggestion always overwriting the canvas size.
+- On Web, fix some `WindowBuilder` methods doing nothing.
+- On Web, fix some `Window` methods using incorrect HTML attributes instead of CSS properties.
+- On Web, fix the bfcache by not using the `beforeunload` event and map bfcache loading/unloading to `Suspended`/`Resumed` events.
+- On Web, fix touch input not gaining or losing focus.
+- On Web, fix touch location to be as accurate as mouse position.
+- On Web, handle coalesced pointer events, which increases the resolution of pointer inputs.
+- On Web, implement `Window::focus_window()`.
+- On Web, implement `Window::set_(min|max)_inner_size()`.
+- On Web, implement `WindowEvent::Occluded`.
+- On Web, never return a `MonitorHandle`.
+- On Web, prevent clicks on the canvas to select text.
+- On Web, remove any fullscreen requests from the queue when an external fullscreen activation was detected.
+- On Web, remove unnecessary `Window::is_dark_mode()`, which was replaced with `Window::theme()`.
+- On Web, respect `EventLoopWindowTarget::listen_device_events()` settings.
+- On Web, scale factor and dark mode detection are now more robust.
+- On Web, send mouse position on button release as well.
+- On Web, take all transient activations on the canvas and window into account to queue a fullscreen request.
+- On Web, use `Window.requestAnimationFrame()` to throttle `RedrawRequested` events.
+- On Web, use the correct canvas size when calculating the new size during scale factor change, instead of using the output bitmap size.
+- On Web: fix `Window::request_redraw` not waking the event loop when called from outside the loop.
+- On Web: fix position of touch events to be relative to the canvas.
+- On Windows, add `drag_resize_window` method support.
+- On Windows, add horizontal MouseWheel `DeviceEvent`.
+- On Windows, added `WindowBuilderExtWindows::with_class_name` to customize the internal class name.
+- On Windows, fix IME APIs not working when from non event loop thread.
+- On Windows, fix `CursorEnter/Left` not being sent when grabbing the mouse.
+- On Windows, fix `RedrawRequested` not being delivered when calling `Window::request_redraw` from `RedrawRequested`.
+- On Windows, port to `windows-sys` version 0.48.0.
+- On X11, add a `with_embedded_parent_window` function to the window builder to allow embedding a window into another window.
+- On X11, fix event loop not waking up on `ControlFlow::Poll` and `ControlFlow::WaitUntil`.
+- On X11, fix false positive flagging of key repeats when pressing different keys with no release between presses.
+- On X11, set `visual_id` in returned `raw-window-handle`.
+- On iOS, add ability to change the status bar style.
+- On iOS, add force data to touch events when using the Apple Pencil.
+- On iOS, always wake the event loop when transitioning from `ControlFlow::Poll` to `ControlFlow::Poll`.
+- On iOS, send events `WindowEvent::Occluded(false)`, `WindowEvent::Occluded(true)` when application enters/leaves foreground.
+- On macOS, add tabbing APIs on `WindowExtMacOS` and `EventLoopWindowTargetExtMacOS`.
+- On macOS, fix assertion when pressing `Globe` key.
+- On macOS, fix crash in `window.set_minimized(false)`.
+- On macOS, fix crash when dropping `Window`.
diff --git a/vendor/winit/src/changelog/v0.30.md b/vendor/winit/src/changelog/v0.30.md
new file mode 100644
index 00000000..6b0b47dd
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.30.md
@@ -0,0 +1,413 @@
+## 0.30.13
+
+### Added
+
+- On Wayland, add `Window::set_resize_increments`.
+
+### Fixed
+
+- On macOS, fixed crash when dragging non-file content onto window.
+- On X11, fix `set_hittest` not working on some window managers.
+- On X11, fix debug mode overflow panic in `set_timestamp`.
+- On macOS, fix crash in `set_marked_text` when native Pinyin IME sends out-of-bounds `selected_range`.
+- On Windows, fix `WM_IME_SETCONTEXT` IME UI flag masking on `lParam`.
+- On Android, populate `KeyEvent::text` and `KeyEvent::text_with_all_modifiers` via `Key::to_text()`.
+
+## 0.30.12
+
+### Fixed
+
+- On macOS, fix crash on macOS 26 by using objc2's `relax-sign-encoding` feature.
+
+## 0.30.11
+
+### Fixed
+
+- On Windows, fixed crash in should_apps_use_dark_mode() for Windows versions < 17763.
+- On Wayland, fixed `pump_events` driven loop deadlocking when loop was not drained before exit.
+
+## 0.30.10
+
+### Added
+
+- On Windows, add `IconExtWindows::from_resource_name`.
+- On Windows, add `CursorGrabMode::Locked`.
+- On Wayland, add `WindowExtWayland::xdg_toplevel`.
+
+### Changed
+
+- On macOS, no longer need control of the main `NSApplication` class (which means you can now override it yourself).
+- On iOS, remove custom application delegates. You are now allowed to override the
+  application delegate yourself.
+- On iOS, no longer act as-if the application successfully open all URLs. Override
+  `application:didFinishLaunchingWithOptions:` and provide the desired behaviour yourself.
+
+### Fixed
+
+- On Windows, fixed ~500 ms pause when clicking the title bar during continuous redraw.
+- On macOS, `WindowExtMacOS::set_simple_fullscreen` now honors `WindowExtMacOS::set_borderless_game`
+- On X11 and Wayland, fixed pump_events with `Some(Duration::Zero)` blocking with `Wait` polling mode
+- On Wayland, fixed a crash when consequently calling `set_cursor_grab` without pointer focus.
+- On Wayland, ensure that external event loop is woken-up when using pump_events and integrating via `FD`.
+- On Wayland, apply fractional scaling to custom cursors.
+- On macOS, fixed `run_app_on_demand` returning without closing open windows.
+- On macOS, fixed `VideoMode::refresh_rate_millihertz` for fractional refresh rates.
+- On macOS, store monitor handle to avoid panics after going in/out of sleep.
+- On macOS, allow certain invalid monitor handles and return `None` instead of panicking.
+- On Windows, fixed `Ime::Preedit` cursor offset calculation.
+
+## 0.30.9
+
+### Changed
+
+- On Wayland, no longer send an explicit clearing `Ime::Preedit` just prior to a new `Ime::Preedit`.
+
+### Fixed
+
+- On X11, fix crash with uim.
+- On X11, fix modifiers for keys that were sent by the same X11 request.
+- On iOS, fix high CPU usage even when using `ControlFlow::Wait`.
+
+## 0.30.8
+
+### Added
+
+- `ActivationToken::from_raw` and `ActivationToken::into_raw`.
+- On X11, add a workaround for disabling IME on GNOME.
+
+### Fixed
+
+- On Windows, fixed the event loop not waking on accessibility requests.
+- On X11, fixed cursor grab mode state tracking on error.
+
+## 0.30.7
+
+### Fixed
+
+- On X11, fixed KeyboardInput delivered twice when IME enabled.
+
+## 0.30.6
+
+### Added
+
+- On macOS, add `WindowExtMacOS::set_borderless_game` and `WindowAttributesExtMacOS::with_borderless_game`
+  to fully disable the menu bar and dock in Borderless Fullscreen as commonly done in games.
+- On X11, the `window` example now understands the `X11_VISUAL_ID` and `X11_SCREEN_ID` env
+  variables to test the respective modifiers of window creation.
+- On Android, the soft keyboard can now be shown using `Window::set_ime_allowed`.
+- Add basic iOS IME support. The soft keyboard can now be shown using `Window::set_ime_allowed`.
+
+### Fixed
+
+- On macOS, fix `WindowEvent::Moved` sometimes being triggered unnecessarily on resize.
+- On macOS, package manifest definitions of `LSUIElement` will no longer be overridden with the
+  default activation policy, unless explicitly provided during initialization.
+- On macOS, fix crash when calling `drag_window()` without a left click present.
+- On X11, key events forward to IME anyway, even when it's disabled.
+- On Windows, make `ControlFlow::WaitUntil` work more precisely using `CREATE_WAITABLE_TIMER_HIGH_RESOLUTION`.
+- On X11, creating windows on screen that is not the first one (e.g. `DISPLAY=:0.1`) works again.
+- On X11, creating windows while passing `with_x11_screen(non_default_screen)` works again.
+- On X11, fix XInput handling that prevented a new window from getting the focus in some cases.
+- On macOS, fix crash when pressing Caps Lock in certain configurations.
+- On iOS, fixed `MonitorHandle`'s `PartialEq` and `Hash` implementations.
+- On macOS, fixed undocumented cursors (e.g. zoom, resize, help) always appearing to be invalid and falling back to the default cursor.
+
+## 0.30.5
+
+### Added
+
+- Add `ActiveEventLoop::system_theme()`, returning the current system theme.
+- On Web, implement `Error` for `platform::web::CustomCursorError`.
+- On Android, add `{Active,}EventLoopExtAndroid::android_app()` to access the app used to create the loop.
+
+### Fixed
+
+- On MacOS, fix building with `feature = "rwh_04"`.
+- On Web, pen events are now routed through to `WindowEvent::Cursor*`.
+- On macOS, fix panic when releasing not available monitor.
+- On MacOS, return the system theme in `Window::theme()` if no theme override is set.
+
+## 0.30.4
+
+### Changed
+
+- `DeviceId::dummy()` and `WindowId::dummy()` are no longer marked `unsafe`.
+
+### Fixed
+
+- On Wayland, avoid crashing when compositor is misbehaving.
+- On Web, fix `WindowEvent::Resized` not using `requestAnimationFrame` when sending
+  `WindowEvent::RedrawRequested` and also potentially causing `WindowEvent::RedrawRequested`
+  to not be de-duplicated.
+- Account for different browser engine implementations of pointer movement coordinate space.
+
+## 0.30.3
+
+### Added
+
+- On Web, add `EventLoopExtWebSys::(set_)poll_strategy()` to allow setting
+  control flow strategies before starting the event loop.
+- On Web, add `WaitUntilStrategy`, which allows to set different strategies for
+  `ControlFlow::WaitUntil`. By default the Prioritized Task Scheduling API is
+  used, with a fallback to `setTimeout()` with a trick to circumvent throttling
+  to 4ms. But an option to use a Web worker to schedule the timer is available
+  as well, which commonly prevents any throttling when the window is not focused.
+
+### Changed
+
+- On macOS, set the window theme on the `NSWindow` instead of application-wide.
+
+### Fixed
+
+- On X11, build on arm platforms.
+- On macOS, fixed `WindowBuilder::with_theme` not having any effect on the window.
+
+## 0.30.2
+
+### Fixed
+
+- On Web, fix `EventLoopProxy::send_event()` triggering event loop immediately
+  when not called from inside the event loop. Now queues a microtask instead.
+- On Web, stop overwriting default cursor with `CursorIcon::Default`.
+- On Web, prevent crash when using `InnerSizeWriter::request_inner_size()`.
+- On macOS, fix not working opacity for entire window.
+
+## 0.30.1
+
+### Added
+
+- Reexport `raw-window-handle` versions 0.4 and 0.5 as `raw_window_handle_04` and `raw_window_handle_05`.
+- Implement `ApplicationHandler` for `&mut` references and heap allocations to something that implements `ApplicationHandler`.
+
+### Fixed
+
+- On macOS, fix panic on exit when dropping windows outside the event loop.
+- On macOS, fix window dragging glitches when dragging across a monitor boundary with different scale factor.
+- On macOS, fix the range in `Ime::Preedit`.
+- On macOS, use the system's internal mechanisms for queuing events.
+- On macOS, handle events directly instead of queuing when possible.
+
+## 0.30.0
+
+### Added
+
+- Add `OwnedDisplayHandle` type for allowing safe display handle usage outside of
+  trivial cases.
+- Add `ApplicationHandler<T>` trait which mimics `Event<T>`.
+- Add `WindowBuilder::with_cursor` and `Window::set_cursor` which takes a
+  `CursorIcon` or `CustomCursor`.
+- Add `Sync` implementation for `EventLoopProxy<T: Send>`.
+- Add `Window::default_attributes` to get default `WindowAttributes`.
+- Add `EventLoop::builder` to get `EventLoopBuilder` without export.
+- Add `CustomCursor::from_rgba` to allow creating cursor images from RGBA data.
+- Add `CustomCursorExtWebSys::from_url` to allow loading cursor images from URLs.
+- Add `CustomCursorExtWebSys::from_animation` to allow creating animated
+  cursors from other `CustomCursor`s.
+- Add `{Active,}EventLoop::create_custom_cursor` to load custom cursor image sources.
+- Add `ActiveEventLoop::create_window` and `EventLoop::create_window`.
+- Add `CustomCursor` which could be set via `Window::set_cursor`, implemented on
+  Windows, macOS, X11, Wayland, and Web.
+- On Web, add to toggle calling `Event.preventDefault()` on `Window`.
+- On iOS, add `PinchGesture`, `DoubleTapGesture`, `PanGesture` and `RotationGesture`.
+- on iOS, use `UIGestureRecognizerDelegate` for fine grained control of gesture recognizers.
+- On macOS, add services menu.
+- On Windows, add `with_title_text_color`, and `with_corner_preference` on
+  `WindowAttributesExtWindows`.
+- On Windows, implement resize increments.
+- On Windows, add `AnyThread` API to access window handle off the main thread.
+
+### Changed
+
+- Bump MSRV from `1.65` to `1.70`.
+- On Wayland, bump `sctk-adwaita` to `0.9.0`, which changed system library
+  crates. This change is a **cascading breaking change**, you must do breaking
+  change as well, even if you don't expose winit.
+- Rename `TouchpadMagnify` to `PinchGesture`.
+- Rename `SmartMagnify` to `DoubleTapGesture`.
+- Rename `TouchpadRotate` to `RotationGesture`.
+- Rename `EventLoopWindowTarget` to `ActiveEventLoop`.
+- Rename `platform::x11::XWindowType` to `platform::x11::WindowType`.
+- Rename `VideoMode` to `VideoModeHandle` to represent that it doesn't hold
+  static data.
+- Make `Debug` formatting of `WindowId` more concise.
+- Move `dpi` types to its own crate, and re-export it from the root crate.
+- Replace `log` with `tracing`, use `log` feature on `tracing` to restore old
+  behavior.
+- `EventLoop::with_user_event` now returns `EventLoopBuilder`.
+- On Web, return `HandleError::Unavailable` when a window handle is not available.
+- On Web, return `RawWindowHandle::WebCanvas` instead of `RawWindowHandle::Web`.
+- On Web, remove queuing fullscreen request in absence of transient activation.
+- On iOS, return `HandleError::Unavailable` when a window handle is not available.
+- On macOS, return `HandleError::Unavailable` when a window handle is not available.
+- On Windows, remove `WS_CAPTION`, `WS_BORDER`, and `WS_EX_WINDOWEDGE` styles
+  for child windows without decorations.
+- On Android, bump `ndk` to `0.9.0` and `android-activity` to `0.6.0`,
+  and remove unused direct dependency on `ndk-sys`.
+
+### Deprecated
+
+- Deprecate `EventLoop::run`, use `EventLoop::run_app`.
+- Deprecate `EventLoopExtRunOnDemand::run_on_demand`, use `EventLoop::run_app_on_demand`.
+- Deprecate `EventLoopExtPumpEvents::pump_events`, use `EventLoopExtPumpEvents::pump_app_events`.
+
+  The new `app` APIs accept a newly added `ApplicationHandler<T>` instead of
+  `Fn`. The semantics are mostly the same, given that the capture list of the
+  closure is your new `State`. Consider the following code:
+
+  ```rust,no_run
+  use winit::event::Event;
+  use winit::event_loop::EventLoop;
+  use winit::window::Window;
+
+  struct MyUserEvent;
+
+  let event_loop = EventLoop::<MyUserEvent>::with_user_event().build().unwrap();
+  let window = event_loop.create_window(Window::default_attributes()).unwrap();
+  let mut counter = 0;
+
+  let _ = event_loop.run(move |event, event_loop| {
+      match event {
+          Event::AboutToWait => {
+              window.request_redraw();
+              counter += 1;
+          }
+          Event::WindowEvent { window_id, event } => {
+              // Handle window event.
+          }
+          Event::UserEvent(event) => {
+              // Handle user event.
+          }
+          Event::DeviceEvent { device_id, event } => {
+              // Handle device event.
+          }
+          _ => (),
+      }
+  });
+  ```
+
+  To migrate this code, you should move all the captured values into some
+  newtype `State` and implement `ApplicationHandler` for this type. Finally,
+  we move particular `match event` arms into methods on `ApplicationHandler`,
+  for example:
+
+  ```rust,no_run
+  use winit::application::ApplicationHandler;
+  use winit::event::{Event, WindowEvent, DeviceEvent, DeviceId};
+  use winit::event_loop::{EventLoop, ActiveEventLoop};
+  use winit::window::{Window, WindowId};
+
+  struct MyUserEvent;
+
+  struct State {
+      window: Window,
+      counter: i32,
+  }
+
+  impl ApplicationHandler<MyUserEvent> for State {
+      fn user_event(&mut self, event_loop: &ActiveEventLoop, user_event: MyUserEvent) {
+          // Handle user event.
+      }
+
+      fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+          // Your application got resumed.
+      }
+
+      fn window_event(&mut self, event_loop: &ActiveEventLoop, window_id: WindowId, event: WindowEvent) {
+          // Handle window event.
+      }
+
+      fn device_event(&mut self, event_loop: &ActiveEventLoop, device_id: DeviceId, event: DeviceEvent) {
+          // Handle device event.
+      }
+
+      fn about_to_wait(&mut self, event_loop: &ActiveEventLoop) {
+          self.window.request_redraw();
+          self.counter += 1;
+      }
+  }
+
+  let event_loop = EventLoop::<MyUserEvent>::with_user_event().build().unwrap();
+  #[allow(deprecated)]
+  let window = event_loop.create_window(Window::default_attributes()).unwrap();
+  let mut state = State { window, counter: 0 };
+
+  let _ = event_loop.run_app(&mut state);
+  ```
+
+  Please submit your feedback after migrating in [this issue](https://github.com/rust-windowing/winit/issues/3626).
+
+- Deprecate `Window::set_cursor_icon`, use `Window::set_cursor`.
+
+### Removed
+
+- Remove `Window::new`, use `ActiveEventLoop::create_window` instead.
+
+  You now have to create your windows inside the actively running event loop
+  (usually the `new_events(cause: StartCause::Init)` or `resumed()` events),
+  and can no longer do it before the application has properly launched.
+  This change is done to fix many long-standing issues on iOS and macOS, and
+  will improve things on Wayland once fully implemented.
+
+  To ease migration, we provide the deprecated `EventLoop::create_window` that
+  will allow you to bypass this restriction in this release.
+
+  Using the migration example from above, you can change your code as follows:
+
+  ```rust,no_run
+  use winit::application::ApplicationHandler;
+  use winit::event::{Event, WindowEvent, DeviceEvent, DeviceId};
+  use winit::event_loop::{EventLoop, ActiveEventLoop};
+  use winit::window::{Window, WindowId};
+
+  #[derive(Default)]
+  struct State {
+      // Use an `Option` to allow the window to not be available until the
+      // application is properly running.
+      window: Option<Window>,
+      counter: i32,
+  }
+
+  impl ApplicationHandler for State {
+      // This is a common indicator that you can create a window.
+      fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+          self.window = Some(event_loop.create_window(Window::default_attributes()).unwrap());
+      }
+      fn window_event(&mut self, event_loop: &ActiveEventLoop, window_id: WindowId, event: WindowEvent) {
+          // `unwrap` is fine, the window will always be available when
+          // receiving a window event.
+          let window = self.window.as_ref().unwrap();
+          // Handle window event.
+      }
+      fn device_event(&mut self, event_loop: &ActiveEventLoop, device_id: DeviceId, event: DeviceEvent) {
+          // Handle window event.
+      }
+      fn about_to_wait(&mut self, event_loop: &ActiveEventLoop) {
+          if let Some(window) = self.window.as_ref() {
+              window.request_redraw();
+              self.counter += 1;
+          }
+      }
+  }
+
+  let event_loop = EventLoop::new().unwrap();
+  let mut state = State::default();
+  let _ = event_loop.run_app(&mut state);
+  ```
+
+- Remove `Deref` implementation for `EventLoop` that gave `EventLoopWindowTarget`.
+- Remove `WindowBuilder` in favor of `WindowAttributes`.
+- Remove Generic parameter `T` from `ActiveEventLoop`.
+- Remove `EventLoopBuilder::with_user_event`, use `EventLoop::with_user_event`.
+- Remove Redundant `EventLoopError::AlreadyRunning`.
+- Remove `WindowAttributes::fullscreen` and expose as field directly.
+- On X11, remove `platform::x11::XNotSupported` export.
+
+### Fixed
+
+- On Web, fix setting cursor icon overriding cursor visibility.
+- On Windows, fix cursor not confined to center of window when grabbed and hidden.
+- On macOS, fix sequence of mouse events being out of order when dragging on the trackpad.
+- On Wayland, fix decoration glitch on close with some compositors.
+- On Android, fix a regression introduced in #2748 to allow volume key events to be received again.
+- On Windows, don't return a valid window handle outside of the GUI thread.
+- On macOS, don't set the background color when initializing a window with transparency.
diff --git a/vendor/winit/src/changelog/v0.8.md b/vendor/winit/src/changelog/v0.8.md
new file mode 100644
index 00000000..1963429c
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.8.md
@@ -0,0 +1,33 @@
+## 0.8.3
+
+- Fixed issue of calls to `set_inner_size` blocking on Windows.
+- Mapped `ISO_Left_Tab` to `VirtualKeyCode::Tab` to make the key work with modifiers
+- Fixed the X11 backed on 32bit targets
+
+## 0.8.2
+
+- Uniformize keyboard scancode values across Wayland and X11 (#297).
+- Internal rework of the wayland event loop
+- Added method `os::linux::WindowExt::is_ready`
+
+## 0.8.1
+
+- Added various methods to `os::linux::EventsLoopExt`, plus some hidden items necessary to make
+  glutin work.
+
+## 0.8.0
+
+- Added `Window::set_maximized`, `WindowAttributes::maximized` and `WindowBuilder::with_maximized`.
+- Added `Window::set_fullscreen`.
+- Changed `with_fullscreen` to take a `Option<MonitorId>` instead of a `MonitorId`.
+- Removed `MonitorId::get_native_identifier()` in favor of platform-specific traits in the `os`
+  module.
+- Changed `get_available_monitors()` and `get_primary_monitor()` to be methods of `EventsLoop`
+  instead of stand-alone methods.
+- Changed `EventsLoop` to be tied to a specific X11 or Wayland connection.
+- Added a `os::linux::EventsLoopExt` trait that makes it possible to configure the connection.
+- Fixed the emscripten code, which now compiles.
+- Changed the X11 fullscreen code to use `xrandr` instead of `xxf86vm`.
+- Fixed the Wayland backend to produce `Refresh` event after window creation.
+- Changed the `Suspended` event to be outside of `WindowEvent`.
+- Fixed the X11 backend sometimes reporting the wrong virtual key (#273).
diff --git a/vendor/winit/src/changelog/v0.9.md b/vendor/winit/src/changelog/v0.9.md
new file mode 100644
index 00000000..2a9e8cc3
--- /dev/null
+++ b/vendor/winit/src/changelog/v0.9.md
@@ -0,0 +1,22 @@
+## 0.9.0
+
+- Added event `WindowEvent::HiDPIFactorChanged`.
+- Added method `MonitorId::get_hidpi_factor`.
+- Deprecated `get_inner_size_pixels` and `get_inner_size_points` methods of `Window` in favor of
+  `get_inner_size`.
+- **Breaking:** `EventsLoop` is `!Send` and `!Sync` because of platform-dependant constraints,
+  but `Window`, `WindowId`, `DeviceId` and `MonitorId` guaranteed to be `Send`.
+- `MonitorId::get_position` now returns `(i32, i32)` instead of `(u32, u32)`.
+- Rewrite of the wayland backend to use wayland-client-0.11
+- Support for dead keys on wayland for keyboard utf8 input
+- Monitor enumeration on Windows is now implemented using `EnumDisplayMonitors` instead of
+  `EnumDisplayDevices`. This changes the value returned by `MonitorId::get_name()`.
+- On Windows added `MonitorIdExt::hmonitor` method
+- Impl `Clone` for `EventsLoopProxy`
+- `EventsLoop::get_primary_monitor()` on X11 will fallback to any available monitor if no primary is found
+- Support for touch event on wayland
+- `WindowEvent`s `MouseMoved`, `MouseEntered`, and `MouseLeft` have been renamed to
+  `CursorMoved`, `CursorEntered`, and `CursorLeft`.
+- New `DeviceEvent`s added, `MouseMotion` and `MouseWheel`.
+- Send `CursorMoved` event after `CursorEntered` and `Focused` events.
+- Add support for `ModifiersState`, `MouseMove`, `MouseInput`, `MouseMotion` for emscripten backend.
diff --git a/vendor/winit/src/cursor.rs b/vendor/winit/src/cursor.rs
new file mode 100644
index 00000000..7bcac54d
--- /dev/null
+++ b/vendor/winit/src/cursor.rs
@@ -0,0 +1,263 @@
+use core::fmt;
+use std::error::Error;
+use std::hash::{Hash, Hasher};
+use std::sync::Arc;
+
+use cursor_icon::CursorIcon;
+
+use crate::platform_impl::{PlatformCustomCursor, PlatformCustomCursorSource};
+
+/// The maximum width and height for a cursor when using [`CustomCursor::from_rgba`].
+pub const MAX_CURSOR_SIZE: u16 = 2048;
+
+const PIXEL_SIZE: usize = 4;
+
+/// See [`Window::set_cursor()`][crate::window::Window::set_cursor] for more details.
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+pub enum Cursor {
+    Icon(CursorIcon),
+    Custom(CustomCursor),
+}
+
+impl Default for Cursor {
+    fn default() -> Self {
+        Self::Icon(CursorIcon::default())
+    }
+}
+
+impl From<CursorIcon> for Cursor {
+    fn from(icon: CursorIcon) -> Self {
+        Self::Icon(icon)
+    }
+}
+
+impl From<CustomCursor> for Cursor {
+    fn from(custom: CustomCursor) -> Self {
+        Self::Custom(custom)
+    }
+}
+
+/// Use a custom image as a cursor (mouse pointer).
+///
+/// Is guaranteed to be cheap to clone.
+///
+/// ## Platform-specific
+///
+/// **Web**: Some browsers have limits on cursor sizes usually at 128x128.
+///
+/// # Example
+///
+/// ```no_run
+/// # use winit::event_loop::ActiveEventLoop;
+/// # use winit::window::Window;
+/// # fn scope(event_loop: &ActiveEventLoop, window: &Window) {
+/// use winit::window::CustomCursor;
+///
+/// let w = 10;
+/// let h = 10;
+/// let rgba = vec![255; (w * h * 4) as usize];
+///
+/// #[cfg(not(target_family = "wasm"))]
+/// let source = CustomCursor::from_rgba(rgba, w, h, w / 2, h / 2).unwrap();
+///
+/// #[cfg(target_family = "wasm")]
+/// let source = {
+///     use winit::platform::web::CustomCursorExtWebSys;
+///     CustomCursor::from_url(String::from("http://localhost:3000/cursor.png"), 0, 0)
+/// };
+///
+/// let custom_cursor = event_loop.create_custom_cursor(source);
+///
+/// window.set_cursor(custom_cursor.clone());
+/// # }
+/// ```
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+pub struct CustomCursor {
+    /// Platforms should make sure this is cheap to clone.
+    pub(crate) inner: PlatformCustomCursor,
+}
+
+impl CustomCursor {
+    /// Creates a new cursor from an rgba buffer.
+    ///
+    /// The alpha channel is assumed to be **not** premultiplied.
+    pub fn from_rgba(
+        rgba: impl Into<Vec<u8>>,
+        width: u16,
+        height: u16,
+        hotspot_x: u16,
+        hotspot_y: u16,
+    ) -> Result<CustomCursorSource, BadImage> {
+        let _span =
+            tracing::debug_span!("winit::Cursor::from_rgba", width, height, hotspot_x, hotspot_y)
+                .entered();
+
+        Ok(CustomCursorSource {
+            inner: PlatformCustomCursorSource::from_rgba(
+                rgba.into(),
+                width,
+                height,
+                hotspot_x,
+                hotspot_y,
+            )?,
+        })
+    }
+}
+
+/// Source for [`CustomCursor`].
+///
+/// See [`CustomCursor`] for more details.
+#[derive(Debug)]
+pub struct CustomCursorSource {
+    pub(crate) inner: PlatformCustomCursorSource,
+}
+
+/// An error produced when using [`CustomCursor::from_rgba`] with invalid arguments.
+#[derive(Debug, Clone)]
+pub enum BadImage {
+    /// Produced when the image dimensions are larger than [`MAX_CURSOR_SIZE`]. This doesn't
+    /// guarantee that the cursor will work, but should avoid many platform and device specific
+    /// limits.
+    TooLarge { width: u16, height: u16 },
+    /// Produced when the length of the `rgba` argument isn't divisible by 4, thus `rgba` can't be
+    /// safely interpreted as 32bpp RGBA pixels.
+    ByteCountNotDivisibleBy4 { byte_count: usize },
+    /// Produced when the number of pixels (`rgba.len() / 4`) isn't equal to `width * height`.
+    /// At least one of your arguments is incorrect.
+    DimensionsVsPixelCount { width: u16, height: u16, width_x_height: u64, pixel_count: u64 },
+    /// Produced when the hotspot is outside the image bounds
+    HotspotOutOfBounds { width: u16, height: u16, hotspot_x: u16, hotspot_y: u16 },
+}
+
+impl fmt::Display for BadImage {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            BadImage::TooLarge { width, height } => write!(
+                f,
+                "The specified dimensions ({width:?}x{height:?}) are too large. The maximum is \
+                 {MAX_CURSOR_SIZE:?}x{MAX_CURSOR_SIZE:?}.",
+            ),
+            BadImage::ByteCountNotDivisibleBy4 { byte_count } => write!(
+                f,
+                "The length of the `rgba` argument ({byte_count:?}) isn't divisible by 4, making \
+                 it impossible to interpret as 32bpp RGBA pixels.",
+            ),
+            BadImage::DimensionsVsPixelCount { width, height, width_x_height, pixel_count } => {
+                write!(
+                    f,
+                    "The specified dimensions ({width:?}x{height:?}) don't match the number of \
+                     pixels supplied by the `rgba` argument ({pixel_count:?}). For those \
+                     dimensions, the expected pixel count is {width_x_height:?}.",
+                )
+            },
+            BadImage::HotspotOutOfBounds { width, height, hotspot_x, hotspot_y } => write!(
+                f,
+                "The specified hotspot ({hotspot_x:?}, {hotspot_y:?}) is outside the image bounds \
+                 ({width:?}x{height:?}).",
+            ),
+        }
+    }
+}
+
+impl Error for BadImage {}
+
+/// Platforms export this directly as `PlatformCustomCursorSource` if they need to only work with
+/// images.
+#[allow(dead_code)]
+#[derive(Debug)]
+pub(crate) struct OnlyCursorImageSource(pub(crate) CursorImage);
+
+#[allow(dead_code)]
+impl OnlyCursorImageSource {
+    pub(crate) fn from_rgba(
+        rgba: Vec<u8>,
+        width: u16,
+        height: u16,
+        hotspot_x: u16,
+        hotspot_y: u16,
+    ) -> Result<Self, BadImage> {
+        CursorImage::from_rgba(rgba, width, height, hotspot_x, hotspot_y).map(Self)
+    }
+}
+
+/// Platforms export this directly as `PlatformCustomCursor` if they don't implement caching.
+#[allow(dead_code)]
+#[derive(Debug, Clone)]
+pub(crate) struct OnlyCursorImage(pub(crate) Arc<CursorImage>);
+
+impl Hash for OnlyCursorImage {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        Arc::as_ptr(&self.0).hash(state);
+    }
+}
+
+impl PartialEq for OnlyCursorImage {
+    fn eq(&self, other: &Self) -> bool {
+        Arc::ptr_eq(&self.0, &other.0)
+    }
+}
+
+impl Eq for OnlyCursorImage {}
+
+#[derive(Debug)]
+#[allow(dead_code)]
+pub(crate) struct CursorImage {
+    pub(crate) rgba: Vec<u8>,
+    pub(crate) width: u16,
+    pub(crate) height: u16,
+    pub(crate) hotspot_x: u16,
+    pub(crate) hotspot_y: u16,
+}
+
+impl CursorImage {
+    pub(crate) fn from_rgba(
+        rgba: Vec<u8>,
+        width: u16,
+        height: u16,
+        hotspot_x: u16,
+        hotspot_y: u16,
+    ) -> Result<Self, BadImage> {
+        if width > MAX_CURSOR_SIZE || height > MAX_CURSOR_SIZE {
+            return Err(BadImage::TooLarge { width, height });
+        }
+
+        if rgba.len() % PIXEL_SIZE != 0 {
+            return Err(BadImage::ByteCountNotDivisibleBy4 { byte_count: rgba.len() });
+        }
+
+        let pixel_count = (rgba.len() / PIXEL_SIZE) as u64;
+        let width_x_height = width as u64 * height as u64;
+        if pixel_count != width_x_height {
+            return Err(BadImage::DimensionsVsPixelCount {
+                width,
+                height,
+                width_x_height,
+                pixel_count,
+            });
+        }
+
+        if hotspot_x >= width || hotspot_y >= height {
+            return Err(BadImage::HotspotOutOfBounds { width, height, hotspot_x, hotspot_y });
+        }
+
+        Ok(CursorImage { rgba, width, height, hotspot_x, hotspot_y })
+    }
+}
+
+// Platforms that don't support cursors will export this as `PlatformCustomCursor`.
+#[derive(Debug, Clone, Hash, PartialEq, Eq)]
+pub(crate) struct NoCustomCursor;
+
+#[allow(dead_code)]
+impl NoCustomCursor {
+    pub(crate) fn from_rgba(
+        rgba: Vec<u8>,
+        width: u16,
+        height: u16,
+        hotspot_x: u16,
+        hotspot_y: u16,
+    ) -> Result<Self, BadImage> {
+        CursorImage::from_rgba(rgba, width, height, hotspot_x, hotspot_y)?;
+        Ok(Self)
+    }
+}
diff --git a/vendor/winit/src/error.rs b/vendor/winit/src/error.rs
new file mode 100644
index 00000000..d15bb9e7
--- /dev/null
+++ b/vendor/winit/src/error.rs
@@ -0,0 +1,131 @@
+use std::{error, fmt};
+
+use crate::platform_impl;
+
+// TODO: Rename
+/// An error that may be generated when requesting Winit state
+#[derive(Debug)]
+pub enum ExternalError {
+    /// The operation is not supported by the backend.
+    NotSupported(NotSupportedError),
+    /// The operation was ignored.
+    Ignored,
+    /// The OS cannot perform the operation.
+    Os(OsError),
+}
+
+/// The error type for when the requested operation is not supported by the backend.
+#[derive(Clone)]
+pub struct NotSupportedError {
+    _marker: (),
+}
+
+/// The error type for when the OS cannot perform the requested operation.
+#[derive(Debug)]
+pub struct OsError {
+    line: u32,
+    file: &'static str,
+    error: platform_impl::OsError,
+}
+
+/// A general error that may occur while running the Winit event loop
+#[derive(Debug)]
+pub enum EventLoopError {
+    /// The operation is not supported by the backend.
+    NotSupported(NotSupportedError),
+    /// The OS cannot perform the operation.
+    Os(OsError),
+    /// The event loop can't be re-created.
+    RecreationAttempt,
+    /// Application has exit with an error status.
+    ExitFailure(i32),
+}
+
+impl From<OsError> for EventLoopError {
+    fn from(value: OsError) -> Self {
+        Self::Os(value)
+    }
+}
+
+impl NotSupportedError {
+    #[inline]
+    #[allow(dead_code)]
+    pub(crate) fn new() -> NotSupportedError {
+        NotSupportedError { _marker: () }
+    }
+}
+
+impl OsError {
+    #[allow(dead_code)]
+    pub(crate) fn new(line: u32, file: &'static str, error: platform_impl::OsError) -> OsError {
+        OsError { line, file, error }
+    }
+}
+
+#[allow(unused_macros)]
+macro_rules! os_error {
+    ($error:expr) => {{
+        crate::error::OsError::new(line!(), file!(), $error)
+    }};
+}
+
+impl fmt::Display for OsError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        f.pad(&format!("os error at {}:{}: {}", self.file, self.line, self.error))
+    }
+}
+
+impl fmt::Display for ExternalError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        match self {
+            ExternalError::NotSupported(e) => e.fmt(f),
+            ExternalError::Ignored => write!(f, "Operation was ignored"),
+            ExternalError::Os(e) => e.fmt(f),
+        }
+    }
+}
+
+impl fmt::Debug for NotSupportedError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        f.debug_struct("NotSupportedError").finish()
+    }
+}
+
+impl fmt::Display for NotSupportedError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        f.pad("the requested operation is not supported by Winit")
+    }
+}
+
+impl fmt::Display for EventLoopError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        match self {
+            EventLoopError::RecreationAttempt => write!(f, "EventLoop can't be recreated"),
+            EventLoopError::NotSupported(e) => e.fmt(f),
+            EventLoopError::Os(e) => e.fmt(f),
+            EventLoopError::ExitFailure(status) => write!(f, "Exit Failure: {status}"),
+        }
+    }
+}
+
+impl error::Error for OsError {}
+impl error::Error for ExternalError {}
+impl error::Error for NotSupportedError {}
+impl error::Error for EventLoopError {}
+
+#[cfg(test)]
+#[allow(clippy::redundant_clone)]
+mod tests {
+    use super::*;
+
+    // Eat attributes for testing
+    #[test]
+    fn ensure_fmt_does_not_panic() {
+        let _ = format!("{:?}, {}", NotSupportedError::new(), NotSupportedError::new().clone());
+        let _ = format!(
+            "{:?}, {}",
+            ExternalError::NotSupported(NotSupportedError::new()),
+            ExternalError::NotSupported(NotSupportedError::new())
+        );
+    }
+}
diff --git a/vendor/winit/src/event.rs b/vendor/winit/src/event.rs
new file mode 100644
index 00000000..4e01420a
--- /dev/null
+++ b/vendor/winit/src/event.rs
@@ -0,0 +1,1183 @@
+//! The [`Event`] enum and assorted supporting types.
+//!
+//! These are sent to the closure given to [`EventLoop::run_app(...)`], where they get
+//! processed and used to modify the program state. For more details, see the root-level
+//! documentation.
+//!
+//! Some of these events represent different "parts" of a traditional event-handling loop. You could
+//! approximate the basic ordering loop of [`EventLoop::run_app(...)`] like this:
+//!
+//! ```rust,ignore
+//! let mut start_cause = StartCause::Init;
+//!
+//! while !elwt.exiting() {
+//!     app.new_events(event_loop, start_cause);
+//!
+//!     for event in (window events, user events, device events) {
+//!         // This will pick the right method on the application based on the event.
+//!         app.handle_event(event_loop, event);
+//!     }
+//!
+//!     for window_id in (redraw windows) {
+//!         app.window_event(event_loop, window_id, RedrawRequested);
+//!     }
+//!
+//!     app.about_to_wait(event_loop);
+//!     start_cause = wait_if_necessary();
+//! }
+//!
+//! app.exiting(event_loop);
+//! ```
+//!
+//! This leaves out timing details like [`ControlFlow::WaitUntil`] but hopefully
+//! describes what happens in what order.
+//!
+//! [`EventLoop::run_app(...)`]: crate::event_loop::EventLoop::run_app
+//! [`ControlFlow::WaitUntil`]: crate::event_loop::ControlFlow::WaitUntil
+use std::path::PathBuf;
+use std::sync::{Mutex, Weak};
+#[cfg(not(web_platform))]
+use std::time::Instant;
+
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+use smol_str::SmolStr;
+#[cfg(web_platform)]
+use web_time::Instant;
+
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::error::ExternalError;
+use crate::event_loop::AsyncRequestSerial;
+use crate::keyboard::{self, ModifiersKeyState, ModifiersKeys, ModifiersState};
+use crate::platform_impl;
+#[cfg(doc)]
+use crate::window::Window;
+use crate::window::{ActivationToken, Theme, WindowId};
+
+/// Describes a generic event.
+///
+/// See the module-level docs for more information on the event loop manages each event.
+#[derive(Debug, Clone, PartialEq)]
+pub enum Event<T: 'static> {
+    /// See [`ApplicationHandler::new_events`] for details.
+    ///
+    /// [`ApplicationHandler::new_events`]: crate::application::ApplicationHandler::new_events
+    NewEvents(StartCause),
+
+    /// See [`ApplicationHandler::window_event`] for details.
+    ///
+    /// [`ApplicationHandler::window_event`]: crate::application::ApplicationHandler::window_event
+    WindowEvent { window_id: WindowId, event: WindowEvent },
+
+    /// See [`ApplicationHandler::device_event`] for details.
+    ///
+    /// [`ApplicationHandler::device_event`]: crate::application::ApplicationHandler::device_event
+    DeviceEvent { device_id: DeviceId, event: DeviceEvent },
+
+    /// See [`ApplicationHandler::user_event`] for details.
+    ///
+    /// [`ApplicationHandler::user_event`]: crate::application::ApplicationHandler::user_event
+    UserEvent(T),
+
+    /// See [`ApplicationHandler::suspended`] for details.
+    ///
+    /// [`ApplicationHandler::suspended`]: crate::application::ApplicationHandler::suspended
+    Suspended,
+
+    /// See [`ApplicationHandler::resumed`] for details.
+    ///
+    /// [`ApplicationHandler::resumed`]: crate::application::ApplicationHandler::resumed
+    Resumed,
+
+    /// See [`ApplicationHandler::about_to_wait`] for details.
+    ///
+    /// [`ApplicationHandler::about_to_wait`]: crate::application::ApplicationHandler::about_to_wait
+    AboutToWait,
+
+    /// See [`ApplicationHandler::exiting`] for details.
+    ///
+    /// [`ApplicationHandler::exiting`]: crate::application::ApplicationHandler::exiting
+    LoopExiting,
+
+    /// See [`ApplicationHandler::memory_warning`] for details.
+    ///
+    /// [`ApplicationHandler::memory_warning`]: crate::application::ApplicationHandler::memory_warning
+    MemoryWarning,
+}
+
+impl<T> Event<T> {
+    #[allow(clippy::result_large_err)]
+    pub fn map_nonuser_event<U>(self) -> Result<Event<U>, Event<T>> {
+        use self::Event::*;
+        match self {
+            UserEvent(_) => Err(self),
+            WindowEvent { window_id, event } => Ok(WindowEvent { window_id, event }),
+            DeviceEvent { device_id, event } => Ok(DeviceEvent { device_id, event }),
+            NewEvents(cause) => Ok(NewEvents(cause)),
+            AboutToWait => Ok(AboutToWait),
+            LoopExiting => Ok(LoopExiting),
+            Suspended => Ok(Suspended),
+            Resumed => Ok(Resumed),
+            MemoryWarning => Ok(MemoryWarning),
+        }
+    }
+}
+
+/// Describes the reason the event loop is resuming.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StartCause {
+    /// Sent if the time specified by [`ControlFlow::WaitUntil`] has been reached. Contains the
+    /// moment the timeout was requested and the requested resume time. The actual resume time is
+    /// guaranteed to be equal to or after the requested resume time.
+    ///
+    /// [`ControlFlow::WaitUntil`]: crate::event_loop::ControlFlow::WaitUntil
+    ResumeTimeReached { start: Instant, requested_resume: Instant },
+
+    /// Sent if the OS has new events to send to the window, after a wait was requested. Contains
+    /// the moment the wait was requested and the resume time, if requested.
+    WaitCancelled { start: Instant, requested_resume: Option<Instant> },
+
+    /// Sent if the event loop is being resumed after the loop's control flow was set to
+    /// [`ControlFlow::Poll`].
+    ///
+    /// [`ControlFlow::Poll`]: crate::event_loop::ControlFlow::Poll
+    Poll,
+
+    /// Sent once, immediately after `run` is called. Indicates that the loop was just initialized.
+    Init,
+}
+
+/// Describes an event from a [`Window`].
+#[derive(Debug, Clone, PartialEq)]
+pub enum WindowEvent {
+    /// The activation token was delivered back and now could be used.
+    #[cfg_attr(not(any(x11_platform, wayland_platform)), allow(rustdoc::broken_intra_doc_links))]
+    /// Delivered in response to [`request_activation_token`].
+    ///
+    /// [`request_activation_token`]: crate::platform::startup_notify::WindowExtStartupNotify::request_activation_token
+    ActivationTokenDone { serial: AsyncRequestSerial, token: ActivationToken },
+
+    /// The size of the window has changed. Contains the client area's new dimensions.
+    Resized(PhysicalSize<u32>),
+
+    /// The position of the window has changed. Contains the window's new position.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Wayland:** Unsupported.
+    Moved(PhysicalPosition<i32>),
+
+    /// The window has been requested to close.
+    CloseRequested,
+
+    /// The window has been destroyed.
+    Destroyed,
+
+    /// A file has been dropped into the window.
+    ///
+    /// When the user drops multiple files at once, this event will be emitted for each file
+    /// separately.
+    DroppedFile(PathBuf),
+
+    /// A file is being hovered over the window.
+    ///
+    /// When the user hovers multiple files at once, this event will be emitted for each file
+    /// separately.
+    HoveredFile(PathBuf),
+
+    /// A file was hovered, but has exited the window.
+    ///
+    /// There will be a single `HoveredFileCancelled` event triggered even if multiple files were
+    /// hovered.
+    HoveredFileCancelled,
+
+    /// The window gained or lost focus.
+    ///
+    /// The parameter is true if the window has gained focus, and false if it has lost focus.
+    Focused(bool),
+
+    /// An event from the keyboard has been received.
+    ///
+    /// ## Platform-specific
+    /// - **Windows:** The shift key overrides NumLock. In other words, while shift is held down,
+    ///   numpad keys act as if NumLock wasn't active. When this is used, the OS sends fake key
+    ///   events which are not marked as `is_synthetic`.
+    KeyboardInput {
+        device_id: DeviceId,
+        event: KeyEvent,
+
+        /// If `true`, the event was generated synthetically by winit
+        /// in one of the following circumstances:
+        ///
+        /// * Synthetic key press events are generated for all keys pressed when a window gains
+        ///   focus. Likewise, synthetic key release events are generated for all keys pressed when
+        ///   a window goes out of focus. ***Currently, this is only functional on X11 and
+        ///   Windows***
+        ///
+        /// Otherwise, this value is always `false`.
+        is_synthetic: bool,
+    },
+
+    /// The keyboard modifiers have changed.
+    ModifiersChanged(Modifiers),
+
+    /// An event from an input method.
+    ///
+    /// **Note:** You have to explicitly enable this event using [`Window::set_ime_allowed`].
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Orbital:** Unsupported.
+    Ime(Ime),
+
+    /// The cursor has moved on the window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Web:** Doesn't take into account CSS [`border`], [`padding`], or [`transform`].
+    ///
+    /// [`border`]: https://developer.mozilla.org/en-US/docs/Web/CSS/border
+    /// [`padding`]: https://developer.mozilla.org/en-US/docs/Web/CSS/padding
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    CursorMoved {
+        device_id: DeviceId,
+
+        /// (x,y) coords in pixels relative to the top-left corner of the window. Because the range
+        /// of this data is limited by the display area and it may have been transformed by
+        /// the OS to implement effects such as cursor acceleration, it should not be used
+        /// to implement non-cursor-like interactions such as 3D camera control.
+        position: PhysicalPosition<f64>,
+    },
+
+    /// The cursor has entered the window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Web:** Doesn't take into account CSS [`border`], [`padding`], or [`transform`].
+    ///
+    /// [`border`]: https://developer.mozilla.org/en-US/docs/Web/CSS/border
+    /// [`padding`]: https://developer.mozilla.org/en-US/docs/Web/CSS/padding
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    CursorEntered { device_id: DeviceId },
+
+    /// The cursor has left the window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Web:** Doesn't take into account CSS [`border`], [`padding`], or [`transform`].
+    ///
+    /// [`border`]: https://developer.mozilla.org/en-US/docs/Web/CSS/border
+    /// [`padding`]: https://developer.mozilla.org/en-US/docs/Web/CSS/padding
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    CursorLeft { device_id: DeviceId },
+
+    /// A mouse wheel movement or touchpad scroll occurred.
+    MouseWheel { device_id: DeviceId, delta: MouseScrollDelta, phase: TouchPhase },
+
+    /// An mouse button press has been received.
+    MouseInput { device_id: DeviceId, state: ElementState, button: MouseButton },
+
+    /// Two-finger pinch gesture, often used for magnification.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - Only available on **macOS** and **iOS**.
+    /// - On iOS, not recognized by default. It must be enabled when needed.
+    PinchGesture {
+        device_id: DeviceId,
+        /// Positive values indicate magnification (zooming in) and  negative
+        /// values indicate shrinking (zooming out).
+        ///
+        /// This value may be NaN.
+        delta: f64,
+        phase: TouchPhase,
+    },
+
+    /// N-finger pan gesture
+    ///
+    /// ## Platform-specific
+    ///
+    /// - Only available on **iOS**.
+    /// - On iOS, not recognized by default. It must be enabled when needed.
+    PanGesture {
+        device_id: DeviceId,
+        /// Change in pixels of pan gesture from last update.
+        delta: PhysicalPosition<f32>,
+        phase: TouchPhase,
+    },
+
+    /// Double tap gesture.
+    ///
+    /// On a Mac, smart magnification is triggered by a double tap with two fingers
+    /// on the trackpad and is commonly used to zoom on a certain object
+    /// (e.g. a paragraph of a PDF) or (sort of like a toggle) to reset any zoom.
+    /// The gesture is also supported in Safari, Pages, etc.
+    ///
+    /// The event is general enough that its generating gesture is allowed to vary
+    /// across platforms. It could also be generated by another device.
+    ///
+    /// Unfortunately, neither [Windows](https://support.microsoft.com/en-us/windows/touch-gestures-for-windows-a9d28305-4818-a5df-4e2b-e5590f850741)
+    /// nor [Wayland](https://wayland.freedesktop.org/libinput/doc/latest/gestures.html)
+    /// support this gesture or any other gesture with the same effect.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - Only available on **macOS 10.8** and later, and **iOS**.
+    /// - On iOS, not recognized by default. It must be enabled when needed.
+    DoubleTapGesture { device_id: DeviceId },
+
+    /// Two-finger rotation gesture.
+    ///
+    /// Positive delta values indicate rotation counterclockwise and
+    /// negative delta values indicate rotation clockwise.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - Only available on **macOS** and **iOS**.
+    /// - On iOS, not recognized by default. It must be enabled when needed.
+    RotationGesture {
+        device_id: DeviceId,
+        /// change in rotation in degrees
+        delta: f32,
+        phase: TouchPhase,
+    },
+
+    /// Touchpad pressure event.
+    ///
+    /// At the moment, only supported on Apple forcetouch-capable macbooks.
+    /// The parameters are: pressure level (value between 0 and 1 representing how hard the
+    /// touchpad is being pressed) and stage (integer representing the click level).
+    TouchpadPressure { device_id: DeviceId, pressure: f32, stage: i64 },
+
+    /// Motion on some analog axis. May report data redundant to other, more specific events.
+    AxisMotion { device_id: DeviceId, axis: AxisId, value: f64 },
+
+    /// Touch event has been received
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Web:** Doesn't take into account CSS [`border`], [`padding`], or [`transform`].
+    /// - **macOS:** Unsupported.
+    ///
+    /// [`border`]: https://developer.mozilla.org/en-US/docs/Web/CSS/border
+    /// [`padding`]: https://developer.mozilla.org/en-US/docs/Web/CSS/padding
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    Touch(Touch),
+
+    /// The window's scale factor has changed.
+    ///
+    /// The following user actions can cause DPI changes:
+    ///
+    /// * Changing the display's resolution.
+    /// * Changing the display's scale factor (e.g. in Control Panel on Windows).
+    /// * Moving the window to a display with a different scale factor.
+    ///
+    /// To update the window size, use the provided [`InnerSizeWriter`] handle. By default, the
+    /// window is resized to the value suggested by the OS, but it can be changed to any value.
+    ///
+    /// For more information about DPI in general, see the [`dpi`] crate.
+    ScaleFactorChanged {
+        scale_factor: f64,
+        /// Handle to update inner size during scale changes.
+        ///
+        /// See [`InnerSizeWriter`] docs for more details.
+        inner_size_writer: InnerSizeWriter,
+    },
+
+    /// The system window theme has changed.
+    ///
+    /// Applications might wish to react to this to change the theme of the content of the window
+    /// when the system changes the window theme.
+    ///
+    /// This only reports a change if the window theme was not overridden by [`Window::set_theme`].
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / X11 / Wayland / Orbital:** Unsupported.
+    ThemeChanged(Theme),
+
+    /// The window has been occluded (completely hidden from view).
+    ///
+    /// This is different to window visibility as it depends on whether the window is closed,
+    /// minimised, set invisible, or fully occluded by another window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// ### iOS
+    ///
+    /// On iOS, the `Occluded(false)` event is emitted in response to an
+    /// [`applicationWillEnterForeground`] callback which means the application should start
+    /// preparing its data. The `Occluded(true)` event is emitted in response to an
+    /// [`applicationDidEnterBackground`] callback which means the application should free
+    /// resources (according to the [iOS application lifecycle]).
+    ///
+    /// [`applicationWillEnterForeground`]: https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1623076-applicationwillenterforeground
+    /// [`applicationDidEnterBackground`]: https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1622997-applicationdidenterbackground
+    /// [iOS application lifecycle]: https://developer.apple.com/documentation/uikit/app_and_environment/managing_your_app_s_life_cycle
+    ///
+    /// ### Others
+    ///
+    /// - **Web:** Doesn't take into account CSS [`border`], [`padding`], or [`transform`].
+    /// - **Android / Wayland / Windows / Orbital:** Unsupported.
+    ///
+    /// [`border`]: https://developer.mozilla.org/en-US/docs/Web/CSS/border
+    /// [`padding`]: https://developer.mozilla.org/en-US/docs/Web/CSS/padding
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    Occluded(bool),
+
+    /// Emitted when a window should be redrawn.
+    ///
+    /// This gets triggered in two scenarios:
+    /// - The OS has performed an operation that's invalidated the window's contents (such as
+    ///   resizing the window).
+    /// - The application has explicitly requested a redraw via [`Window::request_redraw`].
+    ///
+    /// Winit will aggregate duplicate redraw requests into a single event, to
+    /// help avoid duplicating rendering work.
+    RedrawRequested,
+}
+
+/// Identifier of an input device.
+///
+/// Whenever you receive an event arising from a particular input device, this event contains a
+/// `DeviceId` which identifies its origin. Note that devices may be virtual (representing an
+/// on-screen cursor and keyboard focus) or physical. Virtual devices typically aggregate inputs
+/// from multiple physical devices.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct DeviceId(pub(crate) platform_impl::DeviceId);
+
+impl DeviceId {
+    /// Returns a dummy id, useful for unit testing.
+    ///
+    /// # Notes
+    ///
+    /// The only guarantee made about the return value of this function is that
+    /// it will always be equal to itself and to future values returned by this function.
+    /// No other guarantees are made. This may be equal to a real `DeviceId`.
+    pub const fn dummy() -> Self {
+        DeviceId(platform_impl::DeviceId::dummy())
+    }
+}
+
+/// Represents raw hardware events that are not associated with any particular window.
+///
+/// Useful for interactions that diverge significantly from a conventional 2D GUI, such as 3D camera
+/// or first-person game controls. Many physical actions, such as mouse movement, can produce both
+/// device and window events. Because window events typically arise from virtual devices
+/// (corresponding to GUI cursors and keyboard focus) the device IDs may not match.
+///
+/// Note that these events are delivered regardless of input focus.
+#[derive(Clone, Debug, PartialEq)]
+pub enum DeviceEvent {
+    Added,
+    Removed,
+
+    /// Change in physical position of a pointing device.
+    ///
+    /// This represents raw, unfiltered physical motion. Not to be confused with
+    /// [`WindowEvent::CursorMoved`].
+    MouseMotion {
+        /// (x, y) change in position in unspecified units.
+        ///
+        /// Different devices may use different units.
+        delta: (f64, f64),
+    },
+
+    /// Physical scroll event
+    MouseWheel {
+        delta: MouseScrollDelta,
+    },
+
+    /// Motion on some analog axis. This event will be reported for all arbitrary input devices
+    /// that winit supports on this platform, including mouse devices.  If the device is a mouse
+    /// device then this will be reported alongside the MouseMotion event.
+    Motion {
+        axis: AxisId,
+        value: f64,
+    },
+
+    Button {
+        button: ButtonId,
+        state: ElementState,
+    },
+
+    Key(RawKeyEvent),
+}
+
+/// Describes a keyboard input as a raw device event.
+///
+/// Note that holding down a key may produce repeated `RawKeyEvent`s. The
+/// operating system doesn't provide information whether such an event is a
+/// repeat or the initial keypress. An application may emulate this by, for
+/// example keeping a Map/Set of pressed keys and determining whether a keypress
+/// corresponds to an already pressed key.
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub struct RawKeyEvent {
+    pub physical_key: keyboard::PhysicalKey,
+    pub state: ElementState,
+}
+
+/// Describes a keyboard input targeting a window.
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub struct KeyEvent {
+    /// Represents the position of a key independent of the currently active layout.
+    ///
+    /// It also uniquely identifies the physical key (i.e. it's mostly synonymous with a scancode).
+    /// The most prevalent use case for this is games. For example the default keys for the player
+    /// to move around might be the W, A, S, and D keys on a US layout. The position of these keys
+    /// is more important than their label, so they should map to Z, Q, S, and D on an "AZERTY"
+    /// layout. (This value is `KeyCode::KeyW` for the Z key on an AZERTY layout.)
+    ///
+    /// ## Caveats
+    ///
+    /// - Certain niche hardware will shuffle around physical key positions, e.g. a keyboard that
+    ///   implements DVORAK in hardware (or firmware)
+    /// - Your application will likely have to handle keyboards which are missing keys that your
+    ///   own keyboard has.
+    /// - Certain `KeyCode`s will move between a couple of different positions depending on what
+    ///   layout the keyboard was manufactured to support.
+    ///
+    ///  **Because of these caveats, it is important that you provide users with a way to configure
+    ///  most (if not all) keybinds in your application.**
+    ///
+    /// ## `Fn` and `FnLock`
+    ///
+    /// `Fn` and `FnLock` key events are *exceedingly unlikely* to be emitted by Winit. These keys
+    /// are usually handled at the hardware or OS level, and aren't surfaced to applications. If
+    /// you somehow see this in the wild, we'd like to know :)
+    pub physical_key: keyboard::PhysicalKey,
+
+    // Allowing `broken_intra_doc_links` for `logical_key`, because
+    // `key_without_modifiers` is not available on all platforms
+    #[cfg_attr(
+        not(any(windows_platform, macos_platform, x11_platform, wayland_platform)),
+        allow(rustdoc::broken_intra_doc_links)
+    )]
+    /// This value is affected by all modifiers except <kbd>Ctrl</kbd>.
+    ///
+    /// This has two use cases:
+    /// - Allows querying whether the current input is a Dead key.
+    /// - Allows handling key-bindings on platforms which don't support [`key_without_modifiers`].
+    ///
+    /// If you use this field (or [`key_without_modifiers`] for that matter) for keyboard
+    /// shortcuts, **it is important that you provide users with a way to configure your
+    /// application's shortcuts so you don't render your application unusable for users with an
+    /// incompatible keyboard layout.**
+    ///
+    /// ## Platform-specific
+    /// - **Web:** Dead keys might be reported as the real key instead of `Dead` depending on the
+    ///   browser/OS.
+    ///
+    /// [`key_without_modifiers`]: crate::platform::modifier_supplement::KeyEventExtModifierSupplement::key_without_modifiers
+    pub logical_key: keyboard::Key,
+
+    /// Contains the text produced by this keypress.
+    ///
+    /// In most cases this is identical to the content
+    /// of the `Character` variant of `logical_key`.
+    /// However, on Windows when a dead key was pressed earlier
+    /// but cannot be combined with the character from this
+    /// keypress, the produced text will consist of two characters:
+    /// the dead-key-character followed by the character resulting
+    /// from this keypress.
+    ///
+    /// An additional difference from `logical_key` is that
+    /// this field stores the text representation of any key
+    /// that has such a representation. For example when
+    /// `logical_key` is `Key::Named(NamedKey::Enter)`, this field is `Some("\r")`.
+    ///
+    /// This is `None` if the current keypress cannot
+    /// be interpreted as text.
+    ///
+    /// See also: `text_with_all_modifiers()`
+    pub text: Option<SmolStr>,
+
+    /// Contains the location of this key on the keyboard.
+    ///
+    /// Certain keys on the keyboard may appear in more than once place. For example, the "Shift"
+    /// key appears on the left side of the QWERTY keyboard as well as the right side. However,
+    /// both keys have the same symbolic value. Another example of this phenomenon is the "1"
+    /// key, which appears both above the "Q" key and as the "Keypad 1" key.
+    ///
+    /// This field allows the user to differentiate between keys like this that have the same
+    /// symbolic value but different locations on the keyboard.
+    ///
+    /// See the [`KeyLocation`] type for more details.
+    ///
+    /// [`KeyLocation`]: crate::keyboard::KeyLocation
+    pub location: keyboard::KeyLocation,
+
+    /// Whether the key is being pressed or released.
+    ///
+    /// See the [`ElementState`] type for more details.
+    pub state: ElementState,
+
+    /// Whether or not this key is a key repeat event.
+    ///
+    /// On some systems, holding down a key for some period of time causes that key to be repeated
+    /// as though it were being pressed and released repeatedly. This field is `true` if and only
+    /// if this event is the result of one of those repeats.
+    ///
+    /// # Example
+    ///
+    /// In games, you often want to ignore repeated key events - this can be
+    /// done by ignoring events where this property is set.
+    ///
+    /// ```
+    /// use winit::event::{ElementState, KeyEvent, WindowEvent};
+    /// use winit::keyboard::{KeyCode, PhysicalKey};
+    /// # let window_event = WindowEvent::RedrawRequested; // To make the example compile
+    /// match window_event {
+    ///     WindowEvent::KeyboardInput {
+    ///         event:
+    ///             KeyEvent {
+    ///                 physical_key: PhysicalKey::Code(KeyCode::KeyW),
+    ///                 state: ElementState::Pressed,
+    ///                 repeat: false,
+    ///                 ..
+    ///             },
+    ///         ..
+    ///     } => {
+    ///         // The physical key `W` was pressed, and it was not a repeat
+    ///     },
+    ///     _ => {}, // Handle other events
+    /// }
+    /// ```
+    pub repeat: bool,
+
+    /// Platform-specific key event information.
+    ///
+    /// On Windows, Linux and macOS, this type contains the key without modifiers and the text with
+    /// all modifiers applied.
+    ///
+    /// On Android, iOS, Redox and Web, this type is a no-op.
+    pub(crate) platform_specific: platform_impl::KeyEventExtra,
+}
+
+/// Describes keyboard modifiers event.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct Modifiers {
+    pub(crate) state: ModifiersState,
+
+    // NOTE: Currently pressed modifiers keys.
+    //
+    // The field providing a metadata, it shouldn't be used as a source of truth.
+    pub(crate) pressed_mods: ModifiersKeys,
+}
+
+impl Modifiers {
+    /// The state of the modifiers.
+    pub fn state(&self) -> ModifiersState {
+        self.state
+    }
+
+    /// The state of the left shift key.
+    pub fn lshift_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::LSHIFT)
+    }
+
+    /// The state of the right shift key.
+    pub fn rshift_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::RSHIFT)
+    }
+
+    /// The state of the left alt key.
+    pub fn lalt_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::LALT)
+    }
+
+    /// The state of the right alt key.
+    pub fn ralt_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::RALT)
+    }
+
+    /// The state of the left control key.
+    pub fn lcontrol_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::LCONTROL)
+    }
+
+    /// The state of the right control key.
+    pub fn rcontrol_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::RCONTROL)
+    }
+
+    /// The state of the left super key.
+    pub fn lsuper_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::LSUPER)
+    }
+
+    /// The state of the right super key.
+    pub fn rsuper_state(&self) -> ModifiersKeyState {
+        self.mod_state(ModifiersKeys::RSUPER)
+    }
+
+    fn mod_state(&self, modifier: ModifiersKeys) -> ModifiersKeyState {
+        if self.pressed_mods.contains(modifier) {
+            ModifiersKeyState::Pressed
+        } else {
+            ModifiersKeyState::Unknown
+        }
+    }
+}
+
+impl From<ModifiersState> for Modifiers {
+    fn from(value: ModifiersState) -> Self {
+        Self { state: value, pressed_mods: Default::default() }
+    }
+}
+
+/// Describes [input method](https://en.wikipedia.org/wiki/Input_method) events.
+///
+/// This is also called a "composition event".
+///
+/// Most keypresses using a latin-like keyboard layout simply generate a
+/// [`WindowEvent::KeyboardInput`]. However, one couldn't possibly have a key for every single
+/// unicode character that the user might want to type
+/// - so the solution operating systems employ is to allow the user to type these using _a sequence
+///   of keypresses_ instead.
+///
+/// A prominent example of this is accents - many keyboard layouts allow you to first click the
+/// "accent key", and then the character you want to apply the accent to. In this case, some
+/// platforms will generate the following event sequence:
+///
+/// ```ignore
+/// // Press "`" key
+/// Ime::Preedit("`", Some((0, 0)))
+/// // Press "E" key
+/// Ime::Preedit("", None) // Synthetic event generated by winit to clear preedit.
+/// Ime::Commit("é")
+/// ```
+///
+/// Additionally, certain input devices are configured to display a candidate box that allow the
+/// user to select the desired character interactively. (To properly position this box, you must use
+/// [`Window::set_ime_cursor_area`].)
+///
+/// An example of a keyboard layout which uses candidate boxes is pinyin. On a latin keyboard the
+/// following event sequence could be obtained:
+///
+/// ```ignore
+/// // Press "A" key
+/// Ime::Preedit("a", Some((1, 1)))
+/// // Press "B" key
+/// Ime::Preedit("a b", Some((3, 3)))
+/// // Press left arrow key
+/// Ime::Preedit("a b", Some((1, 1)))
+/// // Press space key
+/// Ime::Preedit("啊b", Some((3, 3)))
+/// // Press space key
+/// Ime::Preedit("", None) // Synthetic event generated by winit to clear preedit.
+/// Ime::Commit("啊不")
+/// ```
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum Ime {
+    /// Notifies when the IME was enabled.
+    ///
+    /// After getting this event you could receive [`Preedit`][Self::Preedit] and
+    /// [`Commit`][Self::Commit] events. You should also start performing IME related requests
+    /// like [`Window::set_ime_cursor_area`].
+    Enabled,
+
+    /// Notifies when a new composing text should be set at the cursor position.
+    ///
+    /// The value represents a pair of the preedit string and the cursor begin position and end
+    /// position. When it's `None`, the cursor should be hidden. When `String` is an empty string
+    /// this indicates that preedit was cleared.
+    ///
+    /// The cursor position is byte-wise indexed.
+    Preedit(String, Option<(usize, usize)>),
+
+    /// Notifies when text should be inserted into the editor widget.
+    ///
+    /// Right before this event winit will send empty [`Self::Preedit`] event.
+    Commit(String),
+
+    /// Notifies when the IME was disabled.
+    ///
+    /// After receiving this event you won't get any more [`Preedit`][Self::Preedit] or
+    /// [`Commit`][Self::Commit] events until the next [`Enabled`][Self::Enabled] event. You should
+    /// also stop issuing IME related requests like [`Window::set_ime_cursor_area`] and clear
+    /// pending preedit text.
+    Disabled,
+}
+
+/// Describes touch-screen input state.
+#[derive(Debug, Hash, PartialEq, Eq, Clone, Copy)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum TouchPhase {
+    Started,
+    Moved,
+    Ended,
+    Cancelled,
+}
+
+/// Represents a touch event
+///
+/// Every time the user touches the screen, a new [`TouchPhase::Started`] event with an unique
+/// identifier for the finger is generated. When the finger is lifted, an [`TouchPhase::Ended`]
+/// event is generated with the same finger id.
+///
+/// After a `Started` event has been emitted, there may be zero or more `Move`
+/// events when the finger is moved or the touch pressure changes.
+///
+/// The finger id may be reused by the system after an `Ended` event. The user
+/// should assume that a new `Started` event received with the same id has nothing
+/// to do with the old finger and is a new finger.
+///
+/// A [`TouchPhase::Cancelled`] event is emitted when the system has canceled tracking this
+/// touch, such as when the window loses focus, or on iOS if the user moves the
+/// device against their face.
+///
+/// ## Platform-specific
+///
+/// - **Web:** Doesn't take into account CSS [`border`], [`padding`], or [`transform`].
+/// - **macOS:** Unsupported.
+///
+/// [`border`]: https://developer.mozilla.org/en-US/docs/Web/CSS/border
+/// [`padding`]: https://developer.mozilla.org/en-US/docs/Web/CSS/padding
+/// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Touch {
+    pub device_id: DeviceId,
+    pub phase: TouchPhase,
+    pub location: PhysicalPosition<f64>,
+    /// Describes how hard the screen was pressed. May be `None` if the platform
+    /// does not support pressure sensitivity.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - Only available on **iOS** 9.0+, **Windows** 8+, **Web**, and **Android**.
+    /// - **Android**: This will never be [None]. If the device doesn't support pressure
+    ///   sensitivity, force will either be 0.0 or 1.0. Also see the
+    ///   [android documentation](https://developer.android.com/reference/android/view/MotionEvent#AXIS_PRESSURE).
+    pub force: Option<Force>,
+    /// Unique identifier of a finger.
+    pub id: u64,
+}
+
+/// Describes the force of a touch event
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Force {
+    /// On iOS, the force is calibrated so that the same number corresponds to
+    /// roughly the same amount of pressure on the screen regardless of the
+    /// device.
+    Calibrated {
+        /// The force of the touch, where a value of 1.0 represents the force of
+        /// an average touch (predetermined by the system, not user-specific).
+        ///
+        /// The force reported by Apple Pencil is measured along the axis of the
+        /// pencil. If you want a force perpendicular to the device, you need to
+        /// calculate this value using the `altitude_angle` value.
+        force: f64,
+        /// The maximum possible force for a touch.
+        ///
+        /// The value of this field is sufficiently high to provide a wide
+        /// dynamic range for values of the `force` field.
+        max_possible_force: f64,
+        /// The altitude (in radians) of the stylus.
+        ///
+        /// A value of 0 radians indicates that the stylus is parallel to the
+        /// surface. The value of this property is Pi/2 when the stylus is
+        /// perpendicular to the surface.
+        altitude_angle: Option<f64>,
+    },
+    /// If the platform reports the force as normalized, we have no way of
+    /// knowing how much pressure 1.0 corresponds to – we know it's the maximum
+    /// amount of force, but as to how much force, you might either have to
+    /// press really really hard, or not hard at all, depending on the device.
+    Normalized(f64),
+}
+
+impl Force {
+    /// Returns the force normalized to the range between 0.0 and 1.0 inclusive.
+    ///
+    /// Instead of normalizing the force, you should prefer to handle
+    /// [`Force::Calibrated`] so that the amount of force the user has to apply is
+    /// consistent across devices.
+    pub fn normalized(&self) -> f64 {
+        match self {
+            Force::Calibrated { force, max_possible_force, altitude_angle } => {
+                let force = match altitude_angle {
+                    Some(altitude_angle) => force / altitude_angle.sin(),
+                    None => *force,
+                };
+                force / max_possible_force
+            },
+            Force::Normalized(force) => *force,
+        }
+    }
+}
+
+/// Identifier for a specific analog axis on some device.
+pub type AxisId = u32;
+
+/// Identifier for a specific button on some device.
+pub type ButtonId = u32;
+
+/// Describes the input state of a key.
+#[derive(Debug, Hash, PartialEq, Eq, Clone, Copy)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum ElementState {
+    Pressed,
+    Released,
+}
+
+impl ElementState {
+    /// True if `self == Pressed`.
+    pub fn is_pressed(self) -> bool {
+        self == ElementState::Pressed
+    }
+}
+
+/// Describes a button of a mouse controller.
+///
+/// ## Platform-specific
+///
+/// **macOS:** `Back` and `Forward` might not work with all hardware.
+/// **Orbital:** `Back` and `Forward` are unsupported due to orbital not supporting them.
+#[derive(Debug, Hash, PartialEq, Eq, PartialOrd, Ord, Clone, Copy)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum MouseButton {
+    Left,
+    Right,
+    Middle,
+    Back,
+    Forward,
+    Other(u16),
+}
+
+/// Describes a difference in the mouse scroll wheel state.
+#[derive(Debug, Clone, Copy, PartialEq)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum MouseScrollDelta {
+    /// Amount in lines or rows to scroll in the horizontal
+    /// and vertical directions.
+    ///
+    /// Positive values indicate that the content that is being scrolled should move
+    /// right and down (revealing more content left and up).
+    LineDelta(f32, f32),
+
+    /// Amount in pixels to scroll in the horizontal and
+    /// vertical direction.
+    ///
+    /// Scroll events are expressed as a `PixelDelta` if
+    /// supported by the device (eg. a touchpad) and
+    /// platform.
+    ///
+    /// Positive values indicate that the content being scrolled should
+    /// move right/down.
+    ///
+    /// For a 'natural scrolling' touch pad (that acts like a touch screen)
+    /// this means moving your fingers right and down should give positive values,
+    /// and move the content right and down (to reveal more things left and up).
+    PixelDelta(PhysicalPosition<f64>),
+}
+
+/// Handle to synchronously change the size of the window from the
+/// [`WindowEvent`].
+#[derive(Debug, Clone)]
+pub struct InnerSizeWriter {
+    pub(crate) new_inner_size: Weak<Mutex<PhysicalSize<u32>>>,
+}
+
+impl InnerSizeWriter {
+    #[cfg(not(orbital_platform))]
+    pub(crate) fn new(new_inner_size: Weak<Mutex<PhysicalSize<u32>>>) -> Self {
+        Self { new_inner_size }
+    }
+
+    /// Try to request inner size which will be set synchronously on the window.
+    pub fn request_inner_size(
+        &mut self,
+        new_inner_size: PhysicalSize<u32>,
+    ) -> Result<(), ExternalError> {
+        if let Some(inner) = self.new_inner_size.upgrade() {
+            *inner.lock().unwrap() = new_inner_size;
+            Ok(())
+        } else {
+            Err(ExternalError::Ignored)
+        }
+    }
+}
+
+impl PartialEq for InnerSizeWriter {
+    fn eq(&self, other: &Self) -> bool {
+        self.new_inner_size.as_ptr() == other.new_inner_size.as_ptr()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::dpi::PhysicalPosition;
+    use crate::event;
+    use std::collections::{BTreeSet, HashSet};
+
+    macro_rules! foreach_event {
+        ($closure:expr) => {{
+            #[allow(unused_mut)]
+            let mut x = $closure;
+            let did = event::DeviceId::dummy();
+
+            #[allow(deprecated)]
+            {
+                use crate::event::Event::*;
+                use crate::event::Ime::Enabled;
+                use crate::event::WindowEvent::*;
+                use crate::window::WindowId;
+
+                // Mainline events.
+                let wid = WindowId::dummy();
+                x(UserEvent(()));
+                x(NewEvents(event::StartCause::Init));
+                x(AboutToWait);
+                x(LoopExiting);
+                x(Suspended);
+                x(Resumed);
+
+                // Window events.
+                let with_window_event = |wev| x(WindowEvent { window_id: wid, event: wev });
+
+                with_window_event(CloseRequested);
+                with_window_event(Destroyed);
+                with_window_event(Focused(true));
+                with_window_event(Moved((0, 0).into()));
+                with_window_event(Resized((0, 0).into()));
+                with_window_event(DroppedFile("x.txt".into()));
+                with_window_event(HoveredFile("x.txt".into()));
+                with_window_event(HoveredFileCancelled);
+                with_window_event(Ime(Enabled));
+                with_window_event(CursorMoved { device_id: did, position: (0, 0).into() });
+                with_window_event(ModifiersChanged(event::Modifiers::default()));
+                with_window_event(CursorEntered { device_id: did });
+                with_window_event(CursorLeft { device_id: did });
+                with_window_event(MouseWheel {
+                    device_id: did,
+                    delta: event::MouseScrollDelta::LineDelta(0.0, 0.0),
+                    phase: event::TouchPhase::Started,
+                });
+                with_window_event(MouseInput {
+                    device_id: did,
+                    state: event::ElementState::Pressed,
+                    button: event::MouseButton::Other(0),
+                });
+                with_window_event(PinchGesture {
+                    device_id: did,
+                    delta: 0.0,
+                    phase: event::TouchPhase::Started,
+                });
+                with_window_event(DoubleTapGesture { device_id: did });
+                with_window_event(RotationGesture {
+                    device_id: did,
+                    delta: 0.0,
+                    phase: event::TouchPhase::Started,
+                });
+                with_window_event(PanGesture {
+                    device_id: did,
+                    delta: PhysicalPosition::<f32>::new(0.0, 0.0),
+                    phase: event::TouchPhase::Started,
+                });
+                with_window_event(TouchpadPressure { device_id: did, pressure: 0.0, stage: 0 });
+                with_window_event(AxisMotion { device_id: did, axis: 0, value: 0.0 });
+                with_window_event(Touch(event::Touch {
+                    device_id: did,
+                    phase: event::TouchPhase::Started,
+                    location: (0.0, 0.0).into(),
+                    id: 0,
+                    force: Some(event::Force::Normalized(0.0)),
+                }));
+                with_window_event(ThemeChanged(crate::window::Theme::Light));
+                with_window_event(Occluded(true));
+            }
+
+            #[allow(deprecated)]
+            {
+                use event::DeviceEvent::*;
+
+                let with_device_event =
+                    |dev_ev| x(event::Event::DeviceEvent { device_id: did, event: dev_ev });
+
+                with_device_event(Added);
+                with_device_event(Removed);
+                with_device_event(MouseMotion { delta: (0.0, 0.0).into() });
+                with_device_event(MouseWheel {
+                    delta: event::MouseScrollDelta::LineDelta(0.0, 0.0),
+                });
+                with_device_event(Motion { axis: 0, value: 0.0 });
+                with_device_event(Button { button: 0, state: event::ElementState::Pressed });
+            }
+        }};
+    }
+
+    #[allow(clippy::redundant_clone)]
+    #[test]
+    fn test_event_clone() {
+        foreach_event!(|event: event::Event<()>| {
+            let event2 = event.clone();
+            assert_eq!(event, event2);
+        })
+    }
+
+    #[test]
+    fn test_map_nonuser_event() {
+        foreach_event!(|event: event::Event<()>| {
+            let is_user = matches!(event, event::Event::UserEvent(()));
+            let event2 = event.map_nonuser_event::<()>();
+            if is_user {
+                assert_eq!(event2, Err(event::Event::UserEvent(())));
+            } else {
+                assert!(event2.is_ok());
+            }
+        })
+    }
+
+    #[test]
+    fn test_force_normalize() {
+        let force = event::Force::Normalized(0.0);
+        assert_eq!(force.normalized(), 0.0);
+
+        let force2 =
+            event::Force::Calibrated { force: 5.0, max_possible_force: 2.5, altitude_angle: None };
+        assert_eq!(force2.normalized(), 2.0);
+
+        let force3 = event::Force::Calibrated {
+            force: 5.0,
+            max_possible_force: 2.5,
+            altitude_angle: Some(std::f64::consts::PI / 2.0),
+        };
+        assert_eq!(force3.normalized(), 2.0);
+    }
+
+    #[allow(clippy::clone_on_copy)]
+    #[test]
+    fn ensure_attrs_do_not_panic() {
+        foreach_event!(|event: event::Event<()>| {
+            let _ = format!("{event:?}");
+        });
+        let _ = event::StartCause::Init.clone();
+
+        let did = crate::event::DeviceId::dummy().clone();
+        HashSet::new().insert(did);
+        let mut set = [did, did, did];
+        set.sort_unstable();
+        let mut set2 = BTreeSet::new();
+        set2.insert(did);
+        set2.insert(did);
+
+        HashSet::new().insert(event::TouchPhase::Started.clone());
+        HashSet::new().insert(event::MouseButton::Left.clone());
+        HashSet::new().insert(event::Ime::Enabled);
+
+        let _ = event::Touch {
+            device_id: did,
+            phase: event::TouchPhase::Started,
+            location: (0.0, 0.0).into(),
+            id: 0,
+            force: Some(event::Force::Normalized(0.0)),
+        }
+        .clone();
+        let _ =
+            event::Force::Calibrated { force: 0.0, max_possible_force: 0.0, altitude_angle: None }
+                .clone();
+    }
+}
diff --git a/vendor/winit/src/event_loop.rs b/vendor/winit/src/event_loop.rs
new file mode 100644
index 00000000..233374be
--- /dev/null
+++ b/vendor/winit/src/event_loop.rs
@@ -0,0 +1,651 @@
+//! The [`EventLoop`] struct and assorted supporting types, including
+//! [`ControlFlow`].
+//!
+//! If you want to send custom events to the event loop, use
+//! [`EventLoop::create_proxy`] to acquire an [`EventLoopProxy`] and call its
+//! [`send_event`][EventLoopProxy::send_event] method.
+//!
+//! See the root-level documentation for information on how to create and use an event loop to
+//! handle events.
+use std::marker::PhantomData;
+#[cfg(any(x11_platform, wayland_platform))]
+use std::os::unix::io::{AsFd, AsRawFd, BorrowedFd, RawFd};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::{error, fmt};
+
+#[cfg(not(web_platform))]
+use std::time::{Duration, Instant};
+#[cfg(web_platform)]
+use web_time::{Duration, Instant};
+
+use crate::application::ApplicationHandler;
+use crate::error::{EventLoopError, OsError};
+use crate::event::Event;
+use crate::monitor::MonitorHandle;
+use crate::platform_impl;
+use crate::window::{CustomCursor, CustomCursorSource, Theme, Window, WindowAttributes};
+
+/// Provides a way to retrieve events from the system and from the windows that were registered to
+/// the events loop.
+///
+/// An `EventLoop` can be seen more or less as a "context". Calling [`EventLoop::new`]
+/// initializes everything that will be required to create windows. For example on Linux creating
+/// an event loop opens a connection to the X or Wayland server.
+///
+/// To wake up an `EventLoop` from a another thread, see the [`EventLoopProxy`] docs.
+///
+/// Note that this cannot be shared across threads (due to platform-dependant logic
+/// forbidding it), as such it is neither [`Send`] nor [`Sync`]. If you need cross-thread access,
+/// the [`Window`] created from this _can_ be sent to an other thread, and the
+/// [`EventLoopProxy`] allows you to wake up an `EventLoop` from another thread.
+///
+/// [`Window`]: crate::window::Window
+pub struct EventLoop<T: 'static> {
+    pub(crate) event_loop: platform_impl::EventLoop<T>,
+    pub(crate) _marker: PhantomData<*mut ()>, // Not Send nor Sync
+}
+
+/// Target that associates windows with an [`EventLoop`].
+///
+/// This type exists to allow you to create new windows while Winit executes
+/// your callback.
+pub struct ActiveEventLoop {
+    pub(crate) p: platform_impl::ActiveEventLoop,
+    pub(crate) _marker: PhantomData<*mut ()>, // Not Send nor Sync
+}
+
+/// Object that allows building the event loop.
+///
+/// This is used to make specifying options that affect the whole application
+/// easier. But note that constructing multiple event loops is not supported.
+///
+/// This can be created using [`EventLoop::new`] or [`EventLoop::with_user_event`].
+#[derive(Default)]
+pub struct EventLoopBuilder<T: 'static> {
+    pub(crate) platform_specific: platform_impl::PlatformSpecificEventLoopAttributes,
+    _p: PhantomData<T>,
+}
+
+static EVENT_LOOP_CREATED: AtomicBool = AtomicBool::new(false);
+
+impl EventLoopBuilder<()> {
+    /// Start building a new event loop.
+    #[inline]
+    #[deprecated = "use `EventLoop::builder` instead"]
+    pub fn new() -> Self {
+        EventLoop::builder()
+    }
+}
+
+impl<T> EventLoopBuilder<T> {
+    /// Builds a new event loop.
+    ///
+    /// ***For cross-platform compatibility, the [`EventLoop`] must be created on the main thread,
+    /// and only once per application.***
+    ///
+    /// Calling this function will result in display backend initialisation.
+    ///
+    /// ## Panics
+    ///
+    /// Attempting to create the event loop off the main thread will panic. This
+    /// restriction isn't strictly necessary on all platforms, but is imposed to
+    /// eliminate any nasty surprises when porting to platforms that require it.
+    /// `EventLoopBuilderExt::any_thread` functions are exposed in the relevant
+    /// [`platform`] module if the target platform supports creating an event
+    /// loop on any thread.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland/X11:** to prevent running under `Wayland` or `X11` unset `WAYLAND_DISPLAY` or
+    ///   `DISPLAY` respectively when building the event loop.
+    /// - **Android:** must be configured with an `AndroidApp` from `android_main()` by calling
+    ///   [`.with_android_app(app)`] before calling `.build()`, otherwise it'll panic.
+    ///
+    /// [`platform`]: crate::platform
+    #[cfg_attr(
+        android_platform,
+        doc = "[`.with_android_app(app)`]: \
+               crate::platform::android::EventLoopBuilderExtAndroid::with_android_app"
+    )]
+    #[cfg_attr(
+        not(android_platform),
+        doc = "[`.with_android_app(app)`]: #only-available-on-android"
+    )]
+    #[inline]
+    pub fn build(&mut self) -> Result<EventLoop<T>, EventLoopError> {
+        let _span = tracing::debug_span!("winit::EventLoopBuilder::build").entered();
+
+        if EVENT_LOOP_CREATED.swap(true, Ordering::Relaxed) {
+            return Err(EventLoopError::RecreationAttempt);
+        }
+
+        // Certain platforms accept a mutable reference in their API.
+        #[allow(clippy::unnecessary_mut_passed)]
+        Ok(EventLoop {
+            event_loop: platform_impl::EventLoop::new(&mut self.platform_specific)?,
+            _marker: PhantomData,
+        })
+    }
+
+    #[cfg(web_platform)]
+    pub(crate) fn allow_event_loop_recreation() {
+        EVENT_LOOP_CREATED.store(false, Ordering::Relaxed);
+    }
+}
+
+impl<T> fmt::Debug for EventLoop<T> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.pad("EventLoop { .. }")
+    }
+}
+
+impl fmt::Debug for ActiveEventLoop {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.pad("ActiveEventLoop { .. }")
+    }
+}
+
+/// Set through [`ActiveEventLoop::set_control_flow()`].
+///
+/// Indicates the desired behavior of the event loop after [`Event::AboutToWait`] is emitted.
+///
+/// Defaults to [`Wait`].
+///
+/// [`Wait`]: Self::Wait
+#[derive(Copy, Clone, Debug, Default, PartialEq, Eq)]
+pub enum ControlFlow {
+    /// When the current loop iteration finishes, immediately begin a new iteration regardless of
+    /// whether or not new events are available to process.
+    Poll,
+
+    /// When the current loop iteration finishes, suspend the thread until another event arrives.
+    #[default]
+    Wait,
+
+    /// When the current loop iteration finishes, suspend the thread until either another event
+    /// arrives or the given time is reached.
+    ///
+    /// Useful for implementing efficient timers. Applications which want to render at the
+    /// display's native refresh rate should instead use [`Poll`] and the VSync functionality
+    /// of a graphics API to reduce odds of missed frames.
+    ///
+    /// [`Poll`]: Self::Poll
+    WaitUntil(Instant),
+}
+
+impl ControlFlow {
+    /// Creates a [`ControlFlow`] that waits until a timeout has expired.
+    ///
+    /// In most cases, this is set to [`WaitUntil`]. However, if the timeout overflows, it is
+    /// instead set to [`Wait`].
+    ///
+    /// [`WaitUntil`]: Self::WaitUntil
+    /// [`Wait`]: Self::Wait
+    pub fn wait_duration(timeout: Duration) -> Self {
+        match Instant::now().checked_add(timeout) {
+            Some(instant) => Self::WaitUntil(instant),
+            None => Self::Wait,
+        }
+    }
+}
+
+impl EventLoop<()> {
+    /// Create the event loop.
+    ///
+    /// This is an alias of `EventLoop::builder().build()`.
+    #[inline]
+    pub fn new() -> Result<EventLoop<()>, EventLoopError> {
+        Self::builder().build()
+    }
+
+    /// Start building a new event loop.
+    ///
+    /// This returns an [`EventLoopBuilder`], to allow configuring the event loop before creation.
+    ///
+    /// To get the actual event loop, call [`build`][EventLoopBuilder::build] on that.
+    #[inline]
+    pub fn builder() -> EventLoopBuilder<()> {
+        Self::with_user_event()
+    }
+}
+
+impl<T> EventLoop<T> {
+    /// Start building a new event loop, with the given type as the user event
+    /// type.
+    pub fn with_user_event() -> EventLoopBuilder<T> {
+        EventLoopBuilder { platform_specific: Default::default(), _p: PhantomData }
+    }
+
+    /// See [`run_app`].
+    ///
+    /// [`run_app`]: Self::run_app
+    #[inline]
+    #[deprecated = "use `EventLoop::run_app` instead"]
+    #[cfg(not(all(web_platform, target_feature = "exception-handling")))]
+    pub fn run<F>(self, event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<T>, &ActiveEventLoop),
+    {
+        let _span = tracing::debug_span!("winit::EventLoop::run").entered();
+
+        self.event_loop.run(event_handler)
+    }
+
+    /// Run the application with the event loop on the calling thread.
+    ///
+    /// See the [`set_control_flow()`] docs on how to change the event loop's behavior.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS:** Will never return to the caller and so values not passed to this function will
+    ///   *not* be dropped before the process exits.
+    /// - **Web:** Will _act_ as if it never returns to the caller by throwing a Javascript
+    ///   exception (that Rust doesn't see) that will also mean that the rest of the function is
+    ///   never executed and any values not passed to this function will *not* be dropped.
+    ///
+    ///   Web applications are recommended to use
+    #[cfg_attr(
+        web_platform,
+        doc = "[`EventLoopExtWebSys::spawn_app()`][crate::platform::web::EventLoopExtWebSys::spawn_app()]"
+    )]
+    #[cfg_attr(not(web_platform), doc = "`EventLoopExtWebSys::spawn()`")]
+    ///   [^1] instead of [`run_app()`] to avoid the need
+    ///   for the Javascript exception trick, and to make it clearer that the event loop runs
+    ///   asynchronously (via the browser's own, internal, event loop) and doesn't block the
+    ///   current thread of execution like it does on other platforms.
+    ///
+    ///   This function won't be available with `target_feature = "exception-handling"`.
+    ///
+    /// [`set_control_flow()`]: ActiveEventLoop::set_control_flow()
+    /// [`run_app()`]: Self::run_app()
+    /// [^1]: `EventLoopExtWebSys::spawn_app()` is only available on Web.
+    #[inline]
+    #[cfg(not(all(web_platform, target_feature = "exception-handling")))]
+    pub fn run_app<A: ApplicationHandler<T>>(self, app: &mut A) -> Result<(), EventLoopError> {
+        self.event_loop.run(|event, event_loop| dispatch_event_for_app(app, event_loop, event))
+    }
+
+    /// Creates an [`EventLoopProxy`] that can be used to dispatch user events
+    /// to the main event loop, possibly from another thread.
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy { event_loop_proxy: self.event_loop.create_proxy() }
+    }
+
+    /// Gets a persistent reference to the underlying platform display.
+    ///
+    /// See the [`OwnedDisplayHandle`] type for more information.
+    pub fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle { platform: self.event_loop.window_target().p.owned_display_handle() }
+    }
+
+    /// Change if or when [`DeviceEvent`]s are captured.
+    ///
+    /// See [`ActiveEventLoop::listen_device_events`] for details.
+    ///
+    /// [`DeviceEvent`]: crate::event::DeviceEvent
+    pub fn listen_device_events(&self, allowed: DeviceEvents) {
+        let _span = tracing::debug_span!(
+            "winit::EventLoop::listen_device_events",
+            allowed = ?allowed
+        )
+        .entered();
+
+        self.event_loop.window_target().p.listen_device_events(allowed);
+    }
+
+    /// Sets the [`ControlFlow`].
+    pub fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.event_loop.window_target().p.set_control_flow(control_flow)
+    }
+
+    /// Create a window.
+    ///
+    /// Creating window without event loop running often leads to improper window creation;
+    /// use [`ActiveEventLoop::create_window`] instead.
+    #[deprecated = "use `ActiveEventLoop::create_window` instead"]
+    #[inline]
+    pub fn create_window(&self, window_attributes: WindowAttributes) -> Result<Window, OsError> {
+        let _span = tracing::debug_span!(
+            "winit::EventLoop::create_window",
+            window_attributes = ?window_attributes
+        )
+        .entered();
+
+        let window =
+            platform_impl::Window::new(&self.event_loop.window_target().p, window_attributes)?;
+        Ok(Window { window })
+    }
+
+    /// Create custom cursor.
+    pub fn create_custom_cursor(&self, custom_cursor: CustomCursorSource) -> CustomCursor {
+        self.event_loop.window_target().p.create_custom_cursor(custom_cursor)
+    }
+}
+
+#[cfg(feature = "rwh_06")]
+impl<T> rwh_06::HasDisplayHandle for EventLoop<T> {
+    fn display_handle(&self) -> Result<rwh_06::DisplayHandle<'_>, rwh_06::HandleError> {
+        rwh_06::HasDisplayHandle::display_handle(self.event_loop.window_target())
+    }
+}
+
+#[cfg(feature = "rwh_05")]
+unsafe impl<T> rwh_05::HasRawDisplayHandle for EventLoop<T> {
+    /// Returns a [`rwh_05::RawDisplayHandle`] for the event loop.
+    fn raw_display_handle(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::HasRawDisplayHandle::raw_display_handle(self.event_loop.window_target())
+    }
+}
+
+#[cfg(any(x11_platform, wayland_platform))]
+impl<T> AsFd for EventLoop<T> {
+    /// Get the underlying [EventLoop]'s `fd` which you can register
+    /// into other event loop, like [`calloop`] or [`mio`]. When doing so, the
+    /// loop must be polled with the [`pump_app_events`] API.
+    ///
+    /// [`calloop`]: https://crates.io/crates/calloop
+    /// [`mio`]: https://crates.io/crates/mio
+    /// [`pump_app_events`]: crate::platform::pump_events::EventLoopExtPumpEvents::pump_app_events
+    fn as_fd(&self) -> BorrowedFd<'_> {
+        self.event_loop.as_fd()
+    }
+}
+
+#[cfg(any(x11_platform, wayland_platform))]
+impl<T> AsRawFd for EventLoop<T> {
+    /// Get the underlying [EventLoop]'s raw `fd` which you can register
+    /// into other event loop, like [`calloop`] or [`mio`]. When doing so, the
+    /// loop must be polled with the [`pump_app_events`] API.
+    ///
+    /// [`calloop`]: https://crates.io/crates/calloop
+    /// [`mio`]: https://crates.io/crates/mio
+    /// [`pump_app_events`]: crate::platform::pump_events::EventLoopExtPumpEvents::pump_app_events
+    fn as_raw_fd(&self) -> RawFd {
+        self.event_loop.as_raw_fd()
+    }
+}
+
+impl ActiveEventLoop {
+    /// Create the window.
+    ///
+    /// Possible causes of error include denied permission, incompatible system, and lack of memory.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Web:** The window is created but not inserted into the web page automatically. Please
+    ///   see the web platform module for more information.
+    #[inline]
+    pub fn create_window(&self, window_attributes: WindowAttributes) -> Result<Window, OsError> {
+        let _span = tracing::debug_span!(
+            "winit::ActiveEventLoop::create_window",
+            window_attributes = ?window_attributes
+        )
+        .entered();
+
+        let window = platform_impl::Window::new(&self.p, window_attributes)?;
+        Ok(Window { window })
+    }
+
+    /// Create custom cursor.
+    pub fn create_custom_cursor(&self, custom_cursor: CustomCursorSource) -> CustomCursor {
+        let _span = tracing::debug_span!("winit::ActiveEventLoop::create_custom_cursor",).entered();
+
+        self.p.create_custom_cursor(custom_cursor)
+    }
+
+    /// Returns the list of all the monitors available on the system.
+    #[inline]
+    pub fn available_monitors(&self) -> impl Iterator<Item = MonitorHandle> {
+        let _span = tracing::debug_span!("winit::ActiveEventLoop::available_monitors",).entered();
+
+        #[allow(clippy::useless_conversion)] // false positive on some platforms
+        self.p.available_monitors().into_iter().map(|inner| MonitorHandle { inner })
+    }
+
+    /// Returns the primary monitor of the system.
+    ///
+    /// Returns `None` if it can't identify any monitor as a primary one.
+    ///
+    /// ## Platform-specific
+    ///
+    /// **Wayland / Web:** Always returns `None`.
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        let _span = tracing::debug_span!("winit::ActiveEventLoop::primary_monitor",).entered();
+
+        self.p.primary_monitor().map(|inner| MonitorHandle { inner })
+    }
+
+    /// Change if or when [`DeviceEvent`]s are captured.
+    ///
+    /// Since the [`DeviceEvent`] capture can lead to high CPU usage for unfocused windows, winit
+    /// will ignore them by default for unfocused windows on Linux/BSD. This method allows changing
+    /// this at runtime to explicitly capture them again.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland / macOS / iOS / Android / Orbital:** Unsupported.
+    ///
+    /// [`DeviceEvent`]: crate::event::DeviceEvent
+    pub fn listen_device_events(&self, allowed: DeviceEvents) {
+        let _span = tracing::debug_span!(
+            "winit::ActiveEventLoop::listen_device_events",
+            allowed = ?allowed
+        )
+        .entered();
+
+        self.p.listen_device_events(allowed);
+    }
+
+    /// Returns the current system theme.
+    ///
+    /// Returns `None` if it cannot be determined on the current platform.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Wayland / x11 / Orbital:** Unsupported.
+    pub fn system_theme(&self) -> Option<Theme> {
+        self.p.system_theme()
+    }
+
+    /// Sets the [`ControlFlow`].
+    pub fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.p.set_control_flow(control_flow)
+    }
+
+    /// Gets the current [`ControlFlow`].
+    pub fn control_flow(&self) -> ControlFlow {
+        self.p.control_flow()
+    }
+
+    /// This exits the event loop.
+    ///
+    /// See [`LoopExiting`][Event::LoopExiting].
+    pub fn exit(&self) {
+        let _span = tracing::debug_span!("winit::ActiveEventLoop::exit",).entered();
+
+        self.p.exit()
+    }
+
+    /// Returns if the [`EventLoop`] is about to stop.
+    ///
+    /// See [`exit()`][Self::exit].
+    pub fn exiting(&self) -> bool {
+        self.p.exiting()
+    }
+
+    /// Gets a persistent reference to the underlying platform display.
+    ///
+    /// See the [`OwnedDisplayHandle`] type for more information.
+    pub fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle { platform: self.p.owned_display_handle() }
+    }
+}
+
+#[cfg(feature = "rwh_06")]
+impl rwh_06::HasDisplayHandle for ActiveEventLoop {
+    fn display_handle(&self) -> Result<rwh_06::DisplayHandle<'_>, rwh_06::HandleError> {
+        let raw = self.p.raw_display_handle_rwh_06()?;
+        // SAFETY: The display will never be deallocated while the event loop is alive.
+        Ok(unsafe { rwh_06::DisplayHandle::borrow_raw(raw) })
+    }
+}
+
+#[cfg(feature = "rwh_05")]
+unsafe impl rwh_05::HasRawDisplayHandle for ActiveEventLoop {
+    /// Returns a [`rwh_05::RawDisplayHandle`] for the event loop.
+    fn raw_display_handle(&self) -> rwh_05::RawDisplayHandle {
+        self.p.raw_display_handle_rwh_05()
+    }
+}
+
+/// A proxy for the underlying display handle.
+///
+/// The purpose of this type is to provide a cheaply cloneable handle to the underlying
+/// display handle. This is often used by graphics APIs to connect to the underlying APIs.
+/// It is difficult to keep a handle to the [`EventLoop`] type or the [`ActiveEventLoop`]
+/// type. In contrast, this type involves no lifetimes and can be persisted for as long as
+/// needed.
+///
+/// For all platforms, this is one of the following:
+///
+/// - A zero-sized type that is likely optimized out.
+/// - A reference-counted pointer to the underlying type.
+#[derive(Clone)]
+pub struct OwnedDisplayHandle {
+    #[cfg_attr(not(any(feature = "rwh_05", feature = "rwh_06")), allow(dead_code))]
+    platform: platform_impl::OwnedDisplayHandle,
+}
+
+impl fmt::Debug for OwnedDisplayHandle {
+    #[inline]
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("OwnedDisplayHandle").finish_non_exhaustive()
+    }
+}
+
+#[cfg(feature = "rwh_06")]
+impl rwh_06::HasDisplayHandle for OwnedDisplayHandle {
+    #[inline]
+    fn display_handle(&self) -> Result<rwh_06::DisplayHandle<'_>, rwh_06::HandleError> {
+        let raw = self.platform.raw_display_handle_rwh_06()?;
+
+        // SAFETY: The underlying display handle should be safe.
+        let handle = unsafe { rwh_06::DisplayHandle::borrow_raw(raw) };
+
+        Ok(handle)
+    }
+}
+
+#[cfg(feature = "rwh_05")]
+unsafe impl rwh_05::HasRawDisplayHandle for OwnedDisplayHandle {
+    #[inline]
+    fn raw_display_handle(&self) -> rwh_05::RawDisplayHandle {
+        self.platform.raw_display_handle_rwh_05()
+    }
+}
+
+/// Used to send custom events to [`EventLoop`].
+pub struct EventLoopProxy<T: 'static> {
+    event_loop_proxy: platform_impl::EventLoopProxy<T>,
+}
+
+impl<T: 'static> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        Self { event_loop_proxy: self.event_loop_proxy.clone() }
+    }
+}
+
+impl<T: 'static> EventLoopProxy<T> {
+    /// Send an event to the [`EventLoop`] from which this proxy was created. This emits a
+    /// `UserEvent(event)` event in the event loop, where `event` is the value passed to this
+    /// function.
+    ///
+    /// Returns an `Err` if the associated [`EventLoop`] no longer exists.
+    ///
+    /// [`UserEvent(event)`]: Event::UserEvent
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        let _span = tracing::debug_span!("winit::EventLoopProxy::send_event",).entered();
+
+        self.event_loop_proxy.send_event(event)
+    }
+}
+
+impl<T: 'static> fmt::Debug for EventLoopProxy<T> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.pad("EventLoopProxy { .. }")
+    }
+}
+
+/// The error that is returned when an [`EventLoopProxy`] attempts to wake up an [`EventLoop`] that
+/// no longer exists.
+///
+/// Contains the original event given to [`EventLoopProxy::send_event`].
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash)]
+pub struct EventLoopClosed<T>(pub T);
+
+impl<T> fmt::Display for EventLoopClosed<T> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Tried to wake up a closed `EventLoop`")
+    }
+}
+
+impl<T: fmt::Debug> error::Error for EventLoopClosed<T> {}
+
+/// Control when device events are captured.
+#[derive(Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Debug, Default)]
+pub enum DeviceEvents {
+    /// Report device events regardless of window focus.
+    Always,
+    /// Only capture device events while the window is focused.
+    #[default]
+    WhenFocused,
+    /// Never capture device events.
+    Never,
+}
+
+/// A unique identifier of the winit's async request.
+///
+/// This could be used to identify the async request once it's done
+/// and a specific action must be taken.
+///
+/// One of the handling scenarios could be to maintain a working list
+/// containing [`AsyncRequestSerial`] and some closure associated with it.
+/// Then once event is arriving the working list is being traversed and a job
+/// executed and removed from the list.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AsyncRequestSerial {
+    serial: usize,
+}
+
+impl AsyncRequestSerial {
+    // TODO(kchibisov): Remove `cfg` when the clipboard will be added.
+    #[allow(dead_code)]
+    pub(crate) fn get() -> Self {
+        static CURRENT_SERIAL: AtomicUsize = AtomicUsize::new(0);
+        // NOTE: We rely on wrap around here, while the user may just request
+        // in the loop usize::MAX times that's issue is considered on them.
+        let serial = CURRENT_SERIAL.fetch_add(1, Ordering::Relaxed);
+        Self { serial }
+    }
+}
+
+/// Shim for various run APIs.
+#[inline(always)]
+pub(crate) fn dispatch_event_for_app<T: 'static, A: ApplicationHandler<T>>(
+    app: &mut A,
+    event_loop: &ActiveEventLoop,
+    event: Event<T>,
+) {
+    match event {
+        Event::NewEvents(cause) => app.new_events(event_loop, cause),
+        Event::WindowEvent { window_id, event } => app.window_event(event_loop, window_id, event),
+        Event::DeviceEvent { device_id, event } => app.device_event(event_loop, device_id, event),
+        Event::UserEvent(event) => app.user_event(event_loop, event),
+        Event::Suspended => app.suspended(event_loop),
+        Event::Resumed => app.resumed(event_loop),
+        Event::AboutToWait => app.about_to_wait(event_loop),
+        Event::LoopExiting => app.exiting(event_loop),
+        Event::MemoryWarning => app.memory_warning(event_loop),
+    }
+}
diff --git a/vendor/winit/src/icon.rs b/vendor/winit/src/icon.rs
new file mode 100644
index 00000000..b013d2f0
--- /dev/null
+++ b/vendor/winit/src/icon.rs
@@ -0,0 +1,117 @@
+use crate::platform_impl::PlatformIcon;
+use std::error::Error;
+use std::{fmt, io, mem};
+
+#[repr(C)]
+#[derive(Debug)]
+pub(crate) struct Pixel {
+    pub(crate) r: u8,
+    pub(crate) g: u8,
+    pub(crate) b: u8,
+    pub(crate) a: u8,
+}
+
+pub(crate) const PIXEL_SIZE: usize = mem::size_of::<Pixel>();
+
+#[derive(Debug)]
+/// An error produced when using [`Icon::from_rgba`] with invalid arguments.
+pub enum BadIcon {
+    /// Produced when the length of the `rgba` argument isn't divisible by 4, thus `rgba` can't be
+    /// safely interpreted as 32bpp RGBA pixels.
+    ByteCountNotDivisibleBy4 { byte_count: usize },
+    /// Produced when the number of pixels (`rgba.len() / 4`) isn't equal to `width * height`.
+    /// At least one of your arguments is incorrect.
+    DimensionsVsPixelCount { width: u32, height: u32, width_x_height: usize, pixel_count: usize },
+    /// Produced when underlying OS functionality failed to create the icon
+    OsError(io::Error),
+}
+
+impl fmt::Display for BadIcon {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            BadIcon::ByteCountNotDivisibleBy4 { byte_count } => write!(
+                f,
+                "The length of the `rgba` argument ({byte_count:?}) isn't divisible by 4, making \
+                 it impossible to interpret as 32bpp RGBA pixels.",
+            ),
+            BadIcon::DimensionsVsPixelCount { width, height, width_x_height, pixel_count } => {
+                write!(
+                    f,
+                    "The specified dimensions ({width:?}x{height:?}) don't match the number of \
+                     pixels supplied by the `rgba` argument ({pixel_count:?}). For those \
+                     dimensions, the expected pixel count is {width_x_height:?}.",
+                )
+            },
+            BadIcon::OsError(e) => write!(f, "OS error when instantiating the icon: {e:?}"),
+        }
+    }
+}
+
+impl Error for BadIcon {}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct RgbaIcon {
+    pub(crate) rgba: Vec<u8>,
+    pub(crate) width: u32,
+    pub(crate) height: u32,
+}
+
+/// For platforms which don't have window icons (e.g. web)
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct NoIcon;
+
+#[allow(dead_code)] // These are not used on every platform
+mod constructors {
+    use super::*;
+
+    impl RgbaIcon {
+        pub fn from_rgba(rgba: Vec<u8>, width: u32, height: u32) -> Result<Self, BadIcon> {
+            if rgba.len() % PIXEL_SIZE != 0 {
+                return Err(BadIcon::ByteCountNotDivisibleBy4 { byte_count: rgba.len() });
+            }
+            let pixel_count = rgba.len() / PIXEL_SIZE;
+            if pixel_count != (width * height) as usize {
+                Err(BadIcon::DimensionsVsPixelCount {
+                    width,
+                    height,
+                    width_x_height: (width * height) as usize,
+                    pixel_count,
+                })
+            } else {
+                Ok(RgbaIcon { rgba, width, height })
+            }
+        }
+    }
+
+    impl NoIcon {
+        pub fn from_rgba(rgba: Vec<u8>, width: u32, height: u32) -> Result<Self, BadIcon> {
+            // Create the rgba icon anyway to validate the input
+            let _ = RgbaIcon::from_rgba(rgba, width, height)?;
+            Ok(NoIcon)
+        }
+    }
+}
+
+/// An icon used for the window titlebar, taskbar, etc.
+#[derive(Clone)]
+pub struct Icon {
+    pub(crate) inner: PlatformIcon,
+}
+
+impl fmt::Debug for Icon {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        fmt::Debug::fmt(&self.inner, formatter)
+    }
+}
+
+impl Icon {
+    /// Creates an icon from 32bpp RGBA data.
+    ///
+    /// The length of `rgba` must be divisible by 4, and `width * height` must equal
+    /// `rgba.len() / 4`. Otherwise, this will return a `BadIcon` error.
+    pub fn from_rgba(rgba: Vec<u8>, width: u32, height: u32) -> Result<Self, BadIcon> {
+        let _span = tracing::debug_span!("winit::Icon::from_rgba", width, height).entered();
+
+        Ok(Icon { inner: PlatformIcon::from_rgba(rgba, width, height)? })
+    }
+}
diff --git a/vendor/winit/src/keyboard.rs b/vendor/winit/src/keyboard.rs
new file mode 100644
index 00000000..7b406f08
--- /dev/null
+++ b/vendor/winit/src/keyboard.rs
@@ -0,0 +1,1804 @@
+//! Types related to the keyboard.
+
+// This file contains a substantial portion of the UI Events Specification by the W3C. In
+// particular, the variant names within `Key` and `KeyCode` and their documentation are modified
+// versions of contents of the aforementioned specification.
+//
+// The original documents are:
+//
+// ### For `Key`
+// UI Events KeyboardEvent key Values
+// https://www.w3.org/TR/2017/CR-uievents-key-20170601/
+// Copyright © 2017 W3C® (MIT, ERCIM, Keio, Beihang).
+//
+// ### For `KeyCode`
+// UI Events KeyboardEvent code Values
+// https://www.w3.org/TR/2017/CR-uievents-code-20170601/
+// Copyright © 2017 W3C® (MIT, ERCIM, Keio, Beihang).
+//
+// These documents were used under the terms of the following license. This W3C license as well as
+// the W3C short notice apply to the `Key` and `KeyCode` enums and their variants and the
+// documentation attached to their variants.
+
+// --------- BEGINNING OF W3C LICENSE --------------------------------------------------------------
+//
+// License
+//
+// By obtaining and/or copying this work, you (the licensee) agree that you have read, understood,
+// and will comply with the following terms and conditions.
+//
+// Permission to copy, modify, and distribute this work, with or without modification, for any
+// purpose and without fee or royalty is hereby granted, provided that you include the following on
+// ALL copies of the work or portions thereof, including modifications:
+//
+// - The full text of this NOTICE in a location viewable to users of the redistributed or derivative
+//   work.
+// - Any pre-existing intellectual property disclaimers, notices, or terms and conditions. If none
+//   exist, the W3C Software and Document Short Notice should be included.
+// - Notice of any changes or modifications, through a copyright statement on the new code or
+//   document such as "This software or document includes material copied from or derived from
+//   [title and URI of the W3C document]. Copyright © [YEAR] W3C® (MIT, ERCIM, Keio, Beihang)."
+//
+// Disclaimers
+//
+// THIS WORK IS PROVIDED "AS IS," AND COPYRIGHT HOLDERS MAKE NO REPRESENTATIONS OR WARRANTIES,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY OR FITNESS FOR
+// ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE OR DOCUMENT WILL NOT INFRINGE ANY THIRD
+// PARTY PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS.
+//
+// COPYRIGHT HOLDERS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES
+// ARISING OUT OF ANY USE OF THE SOFTWARE OR DOCUMENT.
+//
+// The name and trademarks of copyright holders may NOT be used in advertising or publicity
+// pertaining to the work without specific, written prior permission. Title to copyright in this
+// work will at all times remain with copyright holders.
+//
+// --------- END OF W3C LICENSE --------------------------------------------------------------------
+
+// --------- BEGINNING OF W3C SHORT NOTICE ---------------------------------------------------------
+//
+// winit: https://github.com/rust-windowing/winit
+//
+// Copyright © 2021 World Wide Web Consortium, (Massachusetts Institute of Technology, European
+// Research Consortium for Informatics and Mathematics, Keio University, Beihang). All Rights
+// Reserved. This work is distributed under the W3C® Software License [1] in the hope that it will
+// be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+// FITNESS FOR A PARTICULAR PURPOSE.
+//
+// [1] http://www.w3.org/Consortium/Legal/copyright-software
+//
+// --------- END OF W3C SHORT NOTICE ---------------------------------------------------------------
+
+use bitflags::bitflags;
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+pub use smol_str::SmolStr;
+
+/// Contains the platform-native physical key identifier
+///
+/// The exact values vary from platform to platform (which is part of why this is a per-platform
+/// enum), but the values are primarily tied to the key's physical location on the keyboard.
+///
+/// This enum is primarily used to store raw keycodes when Winit doesn't map a given native
+/// physical key identifier to a meaningful [`KeyCode`] variant. In the presence of identifiers we
+/// haven't mapped for you yet, this lets you use use [`KeyCode`] to:
+///
+/// - Correctly match key press and release events.
+/// - On non-web platforms, support assigning keybinds to virtually any key through a UI.
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum NativeKeyCode {
+    Unidentified,
+    /// An Android "scancode".
+    Android(u32),
+    /// A macOS "scancode".
+    MacOS(u16),
+    /// A Windows "scancode".
+    Windows(u16),
+    /// An XKB "keycode".
+    Xkb(u32),
+}
+
+impl std::fmt::Debug for NativeKeyCode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        use NativeKeyCode::{Android, MacOS, Unidentified, Windows, Xkb};
+        let mut debug_tuple;
+        match self {
+            Unidentified => {
+                debug_tuple = f.debug_tuple("Unidentified");
+            },
+            Android(code) => {
+                debug_tuple = f.debug_tuple("Android");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+            MacOS(code) => {
+                debug_tuple = f.debug_tuple("MacOS");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+            Windows(code) => {
+                debug_tuple = f.debug_tuple("Windows");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+            Xkb(code) => {
+                debug_tuple = f.debug_tuple("Xkb");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+        }
+        debug_tuple.finish()
+    }
+}
+
+/// Contains the platform-native logical key identifier
+///
+/// Exactly what that means differs from platform to platform, but the values are to some degree
+/// tied to the currently active keyboard layout. The same key on the same keyboard may also report
+/// different values on different platforms, which is one of the reasons this is a per-platform
+/// enum.
+///
+/// This enum is primarily used to store raw keysym when Winit doesn't map a given native logical
+/// key identifier to a meaningful [`Key`] variant. This lets you use [`Key`], and let the user
+/// define keybinds which work in the presence of identifiers we haven't mapped for you yet.
+#[derive(Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum NativeKey {
+    Unidentified,
+    /// An Android "keycode", which is similar to a "virtual-key code" on Windows.
+    Android(u32),
+    /// A macOS "scancode". There does not appear to be any direct analogue to either keysyms or
+    /// "virtual-key" codes in macOS, so we report the scancode instead.
+    MacOS(u16),
+    /// A Windows "virtual-key code".
+    Windows(u16),
+    /// An XKB "keysym".
+    Xkb(u32),
+    /// A "key value string".
+    Web(SmolStr),
+}
+
+impl std::fmt::Debug for NativeKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        use NativeKey::{Android, MacOS, Unidentified, Web, Windows, Xkb};
+        let mut debug_tuple;
+        match self {
+            Unidentified => {
+                debug_tuple = f.debug_tuple("Unidentified");
+            },
+            Android(code) => {
+                debug_tuple = f.debug_tuple("Android");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+            MacOS(code) => {
+                debug_tuple = f.debug_tuple("MacOS");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+            Windows(code) => {
+                debug_tuple = f.debug_tuple("Windows");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+            Xkb(code) => {
+                debug_tuple = f.debug_tuple("Xkb");
+                debug_tuple.field(&format_args!("0x{code:04X}"));
+            },
+            Web(code) => {
+                debug_tuple = f.debug_tuple("Web");
+                debug_tuple.field(code);
+            },
+        }
+        debug_tuple.finish()
+    }
+}
+
+impl From<NativeKeyCode> for NativeKey {
+    #[inline]
+    fn from(code: NativeKeyCode) -> Self {
+        match code {
+            NativeKeyCode::Unidentified => NativeKey::Unidentified,
+            NativeKeyCode::Android(x) => NativeKey::Android(x),
+            NativeKeyCode::MacOS(x) => NativeKey::MacOS(x),
+            NativeKeyCode::Windows(x) => NativeKey::Windows(x),
+            NativeKeyCode::Xkb(x) => NativeKey::Xkb(x),
+        }
+    }
+}
+
+impl PartialEq<NativeKey> for NativeKeyCode {
+    #[allow(clippy::cmp_owned)] // uses less code than direct match; target is stack allocated
+    #[inline]
+    fn eq(&self, rhs: &NativeKey) -> bool {
+        NativeKey::from(*self) == *rhs
+    }
+}
+
+impl PartialEq<NativeKeyCode> for NativeKey {
+    #[inline]
+    fn eq(&self, rhs: &NativeKeyCode) -> bool {
+        rhs == self
+    }
+}
+
+/// Represents the location of a physical key.
+///
+/// This type is a superset of [`KeyCode`], including an [`Unidentified`][Self::Unidentified]
+/// variant.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum PhysicalKey {
+    /// A known key code
+    Code(KeyCode),
+    /// This variant is used when the key cannot be translated to a [`KeyCode`]
+    ///
+    /// The native keycode is provided (if available) so you're able to more reliably match
+    /// key-press and key-release events by hashing the [`PhysicalKey`]. It is also possible to use
+    /// this for keybinds for non-standard keys, but such keybinds are tied to a given platform.
+    Unidentified(NativeKeyCode),
+}
+
+impl From<KeyCode> for PhysicalKey {
+    #[inline]
+    fn from(code: KeyCode) -> Self {
+        PhysicalKey::Code(code)
+    }
+}
+
+impl From<NativeKeyCode> for PhysicalKey {
+    #[inline]
+    fn from(code: NativeKeyCode) -> Self {
+        PhysicalKey::Unidentified(code)
+    }
+}
+
+impl PartialEq<KeyCode> for PhysicalKey {
+    #[inline]
+    fn eq(&self, rhs: &KeyCode) -> bool {
+        match self {
+            PhysicalKey::Code(ref code) => code == rhs,
+            _ => false,
+        }
+    }
+}
+
+impl PartialEq<PhysicalKey> for KeyCode {
+    #[inline]
+    fn eq(&self, rhs: &PhysicalKey) -> bool {
+        rhs == self
+    }
+}
+
+impl PartialEq<NativeKeyCode> for PhysicalKey {
+    #[inline]
+    fn eq(&self, rhs: &NativeKeyCode) -> bool {
+        match self {
+            PhysicalKey::Unidentified(ref code) => code == rhs,
+            _ => false,
+        }
+    }
+}
+
+impl PartialEq<PhysicalKey> for NativeKeyCode {
+    #[inline]
+    fn eq(&self, rhs: &PhysicalKey) -> bool {
+        rhs == self
+    }
+}
+
+/// Code representing the location of a physical key
+///
+/// This mostly conforms to the UI Events Specification's [`KeyboardEvent.code`] with a few
+/// exceptions:
+/// - The keys that the specification calls "MetaLeft" and "MetaRight" are named "SuperLeft" and
+///   "SuperRight" here.
+/// - The key that the specification calls "Super" is reported as `Unidentified` here.
+///
+/// [`KeyboardEvent.code`]: https://w3c.github.io/uievents-code/#code-value-tables
+#[non_exhaustive]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum KeyCode {
+    /// <kbd>`</kbd> on a US keyboard. This is also called a backtick or grave.
+    /// This is the <kbd>半角</kbd>/<kbd>全角</kbd>/<kbd>漢字</kbd>
+    /// (hankaku/zenkaku/kanji) key on Japanese keyboards
+    Backquote,
+    /// Used for both the US <kbd>\\</kbd> (on the 101-key layout) and also for the key
+    /// located between the <kbd>"</kbd> and <kbd>Enter</kbd> keys on row C of the 102-,
+    /// 104- and 106-key layouts.
+    /// Labeled <kbd>#</kbd> on a UK (102) keyboard.
+    Backslash,
+    /// <kbd>[</kbd> on a US keyboard.
+    BracketLeft,
+    /// <kbd>]</kbd> on a US keyboard.
+    BracketRight,
+    /// <kbd>,</kbd> on a US keyboard.
+    Comma,
+    /// <kbd>0</kbd> on a US keyboard.
+    Digit0,
+    /// <kbd>1</kbd> on a US keyboard.
+    Digit1,
+    /// <kbd>2</kbd> on a US keyboard.
+    Digit2,
+    /// <kbd>3</kbd> on a US keyboard.
+    Digit3,
+    /// <kbd>4</kbd> on a US keyboard.
+    Digit4,
+    /// <kbd>5</kbd> on a US keyboard.
+    Digit5,
+    /// <kbd>6</kbd> on a US keyboard.
+    Digit6,
+    /// <kbd>7</kbd> on a US keyboard.
+    Digit7,
+    /// <kbd>8</kbd> on a US keyboard.
+    Digit8,
+    /// <kbd>9</kbd> on a US keyboard.
+    Digit9,
+    /// <kbd>=</kbd> on a US keyboard.
+    Equal,
+    /// Located between the left <kbd>Shift</kbd> and <kbd>Z</kbd> keys.
+    /// Labeled <kbd>\\</kbd> on a UK keyboard.
+    IntlBackslash,
+    /// Located between the <kbd>/</kbd> and right <kbd>Shift</kbd> keys.
+    /// Labeled <kbd>\\</kbd> (ro) on a Japanese keyboard.
+    IntlRo,
+    /// Located between the <kbd>=</kbd> and <kbd>Backspace</kbd> keys.
+    /// Labeled <kbd>¥</kbd> (yen) on a Japanese keyboard. <kbd>\\</kbd> on a
+    /// Russian keyboard.
+    IntlYen,
+    /// <kbd>a</kbd> on a US keyboard.
+    /// Labeled <kbd>q</kbd> on an AZERTY (e.g., French) keyboard.
+    KeyA,
+    /// <kbd>b</kbd> on a US keyboard.
+    KeyB,
+    /// <kbd>c</kbd> on a US keyboard.
+    KeyC,
+    /// <kbd>d</kbd> on a US keyboard.
+    KeyD,
+    /// <kbd>e</kbd> on a US keyboard.
+    KeyE,
+    /// <kbd>f</kbd> on a US keyboard.
+    KeyF,
+    /// <kbd>g</kbd> on a US keyboard.
+    KeyG,
+    /// <kbd>h</kbd> on a US keyboard.
+    KeyH,
+    /// <kbd>i</kbd> on a US keyboard.
+    KeyI,
+    /// <kbd>j</kbd> on a US keyboard.
+    KeyJ,
+    /// <kbd>k</kbd> on a US keyboard.
+    KeyK,
+    /// <kbd>l</kbd> on a US keyboard.
+    KeyL,
+    /// <kbd>m</kbd> on a US keyboard.
+    KeyM,
+    /// <kbd>n</kbd> on a US keyboard.
+    KeyN,
+    /// <kbd>o</kbd> on a US keyboard.
+    KeyO,
+    /// <kbd>p</kbd> on a US keyboard.
+    KeyP,
+    /// <kbd>q</kbd> on a US keyboard.
+    /// Labeled <kbd>a</kbd> on an AZERTY (e.g., French) keyboard.
+    KeyQ,
+    /// <kbd>r</kbd> on a US keyboard.
+    KeyR,
+    /// <kbd>s</kbd> on a US keyboard.
+    KeyS,
+    /// <kbd>t</kbd> on a US keyboard.
+    KeyT,
+    /// <kbd>u</kbd> on a US keyboard.
+    KeyU,
+    /// <kbd>v</kbd> on a US keyboard.
+    KeyV,
+    /// <kbd>w</kbd> on a US keyboard.
+    /// Labeled <kbd>z</kbd> on an AZERTY (e.g., French) keyboard.
+    KeyW,
+    /// <kbd>x</kbd> on a US keyboard.
+    KeyX,
+    /// <kbd>y</kbd> on a US keyboard.
+    /// Labeled <kbd>z</kbd> on a QWERTZ (e.g., German) keyboard.
+    KeyY,
+    /// <kbd>z</kbd> on a US keyboard.
+    /// Labeled <kbd>w</kbd> on an AZERTY (e.g., French) keyboard, and <kbd>y</kbd> on a
+    /// QWERTZ (e.g., German) keyboard.
+    KeyZ,
+    /// <kbd>-</kbd> on a US keyboard.
+    Minus,
+    /// <kbd>.</kbd> on a US keyboard.
+    Period,
+    /// <kbd>'</kbd> on a US keyboard.
+    Quote,
+    /// <kbd>;</kbd> on a US keyboard.
+    Semicolon,
+    /// <kbd>/</kbd> on a US keyboard.
+    Slash,
+    /// <kbd>Alt</kbd>, <kbd>Option</kbd>, or <kbd>⌥</kbd>.
+    AltLeft,
+    /// <kbd>Alt</kbd>, <kbd>Option</kbd>, or <kbd>⌥</kbd>.
+    /// This is labeled <kbd>AltGr</kbd> on many keyboard layouts.
+    AltRight,
+    /// <kbd>Backspace</kbd> or <kbd>⌫</kbd>.
+    /// Labeled <kbd>Delete</kbd> on Apple keyboards.
+    Backspace,
+    /// <kbd>CapsLock</kbd> or <kbd>⇪</kbd>
+    CapsLock,
+    /// The application context menu key, which is typically found between the right
+    /// <kbd>Super</kbd> key and the right <kbd>Control</kbd> key.
+    ContextMenu,
+    /// <kbd>Control</kbd> or <kbd>⌃</kbd>
+    ControlLeft,
+    /// <kbd>Control</kbd> or <kbd>⌃</kbd>
+    ControlRight,
+    /// <kbd>Enter</kbd> or <kbd>↵</kbd>. Labeled <kbd>Return</kbd> on Apple keyboards.
+    Enter,
+    /// The Windows, <kbd>⌘</kbd>, <kbd>Command</kbd>, or other OS symbol key.
+    SuperLeft,
+    /// The Windows, <kbd>⌘</kbd>, <kbd>Command</kbd>, or other OS symbol key.
+    SuperRight,
+    /// <kbd>Shift</kbd> or <kbd>⇧</kbd>
+    ShiftLeft,
+    /// <kbd>Shift</kbd> or <kbd>⇧</kbd>
+    ShiftRight,
+    /// <kbd> </kbd> (space)
+    Space,
+    /// <kbd>Tab</kbd> or <kbd>⇥</kbd>
+    Tab,
+    /// Japanese: <kbd>変</kbd> (henkan)
+    Convert,
+    /// Japanese: <kbd>カタカナ</kbd>/<kbd>ひらがな</kbd>/<kbd>ローマ字</kbd>
+    /// (katakana/hiragana/romaji)
+    KanaMode,
+    /// Korean: HangulMode <kbd>한/영</kbd> (han/yeong)
+    ///
+    /// Japanese (Mac keyboard): <kbd>か</kbd> (kana)
+    Lang1,
+    /// Korean: Hanja <kbd>한</kbd> (hanja)
+    ///
+    /// Japanese (Mac keyboard): <kbd>英</kbd> (eisu)
+    Lang2,
+    /// Japanese (word-processing keyboard): Katakana
+    Lang3,
+    /// Japanese (word-processing keyboard): Hiragana
+    Lang4,
+    /// Japanese (word-processing keyboard): Zenkaku/Hankaku
+    Lang5,
+    /// Japanese: <kbd>無変換</kbd> (muhenkan)
+    NonConvert,
+    /// <kbd>⌦</kbd>. The forward delete key.
+    /// Note that on Apple keyboards, the key labelled <kbd>Delete</kbd> on the main part of
+    /// the keyboard is encoded as [`Backspace`].
+    ///
+    /// [`Backspace`]: Self::Backspace
+    Delete,
+    /// <kbd>Page Down</kbd>, <kbd>End</kbd>, or <kbd>↘</kbd>
+    End,
+    /// <kbd>Help</kbd>. Not present on standard PC keyboards.
+    Help,
+    /// <kbd>Home</kbd> or <kbd>↖</kbd>
+    Home,
+    /// <kbd>Insert</kbd> or <kbd>Ins</kbd>. Not present on Apple keyboards.
+    Insert,
+    /// <kbd>Page Down</kbd>, <kbd>PgDn</kbd>, or <kbd>⇟</kbd>
+    PageDown,
+    /// <kbd>Page Up</kbd>, <kbd>PgUp</kbd>, or <kbd>⇞</kbd>
+    PageUp,
+    /// <kbd>↓</kbd>
+    ArrowDown,
+    /// <kbd>←</kbd>
+    ArrowLeft,
+    /// <kbd>→</kbd>
+    ArrowRight,
+    /// <kbd>↑</kbd>
+    ArrowUp,
+    /// On the Mac, this is used for the numpad <kbd>Clear</kbd> key.
+    NumLock,
+    /// <kbd>0 Ins</kbd> on a keyboard. <kbd>0</kbd> on a phone or remote control
+    Numpad0,
+    /// <kbd>1 End</kbd> on a keyboard. <kbd>1</kbd> or <kbd>1 QZ</kbd> on a phone or remote
+    /// control
+    Numpad1,
+    /// <kbd>2 ↓</kbd> on a keyboard. <kbd>2 ABC</kbd> on a phone or remote control
+    Numpad2,
+    /// <kbd>3 PgDn</kbd> on a keyboard. <kbd>3 DEF</kbd> on a phone or remote control
+    Numpad3,
+    /// <kbd>4 ←</kbd> on a keyboard. <kbd>4 GHI</kbd> on a phone or remote control
+    Numpad4,
+    /// <kbd>5</kbd> on a keyboard. <kbd>5 JKL</kbd> on a phone or remote control
+    Numpad5,
+    /// <kbd>6 →</kbd> on a keyboard. <kbd>6 MNO</kbd> on a phone or remote control
+    Numpad6,
+    /// <kbd>7 Home</kbd> on a keyboard. <kbd>7 PQRS</kbd> or <kbd>7 PRS</kbd> on a phone
+    /// or remote control
+    Numpad7,
+    /// <kbd>8 ↑</kbd> on a keyboard. <kbd>8 TUV</kbd> on a phone or remote control
+    Numpad8,
+    /// <kbd>9 PgUp</kbd> on a keyboard. <kbd>9 WXYZ</kbd> or <kbd>9 WXY</kbd> on a phone
+    /// or remote control
+    Numpad9,
+    /// <kbd>+</kbd>
+    NumpadAdd,
+    /// Found on the Microsoft Natural Keyboard.
+    NumpadBackspace,
+    /// <kbd>C</kbd> or <kbd>A</kbd> (All Clear). Also for use with numpads that have a
+    /// <kbd>Clear</kbd> key that is separate from the <kbd>NumLock</kbd> key. On the Mac, the
+    /// numpad <kbd>Clear</kbd> key is encoded as [`NumLock`].
+    ///
+    /// [`NumLock`]: Self::NumLock
+    NumpadClear,
+    /// <kbd>C</kbd> (Clear Entry)
+    NumpadClearEntry,
+    /// <kbd>,</kbd> (thousands separator). For locales where the thousands separator
+    /// is a "." (e.g., Brazil), this key may generate a <kbd>.</kbd>.
+    NumpadComma,
+    /// <kbd>. Del</kbd>. For locales where the decimal separator is "," (e.g.,
+    /// Brazil), this key may generate a <kbd>,</kbd>.
+    NumpadDecimal,
+    /// <kbd>/</kbd>
+    NumpadDivide,
+    NumpadEnter,
+    /// <kbd>=</kbd>
+    NumpadEqual,
+    /// <kbd>#</kbd> on a phone or remote control device. This key is typically found
+    /// below the <kbd>9</kbd> key and to the right of the <kbd>0</kbd> key.
+    NumpadHash,
+    /// <kbd>M</kbd> Add current entry to the value stored in memory.
+    NumpadMemoryAdd,
+    /// <kbd>M</kbd> Clear the value stored in memory.
+    NumpadMemoryClear,
+    /// <kbd>M</kbd> Replace the current entry with the value stored in memory.
+    NumpadMemoryRecall,
+    /// <kbd>M</kbd> Replace the value stored in memory with the current entry.
+    NumpadMemoryStore,
+    /// <kbd>M</kbd> Subtract current entry from the value stored in memory.
+    NumpadMemorySubtract,
+    /// <kbd>*</kbd> on a keyboard. For use with numpads that provide mathematical
+    /// operations (<kbd>+</kbd>, <kbd>-</kbd> <kbd>*</kbd> and <kbd>/</kbd>).
+    ///
+    /// Use `NumpadStar` for the <kbd>*</kbd> key on phones and remote controls.
+    NumpadMultiply,
+    /// <kbd>(</kbd> Found on the Microsoft Natural Keyboard.
+    NumpadParenLeft,
+    /// <kbd>)</kbd> Found on the Microsoft Natural Keyboard.
+    NumpadParenRight,
+    /// <kbd>*</kbd> on a phone or remote control device.
+    ///
+    /// This key is typically found below the <kbd>7</kbd> key and to the left of
+    /// the <kbd>0</kbd> key.
+    ///
+    /// Use <kbd>"NumpadMultiply"</kbd> for the <kbd>*</kbd> key on
+    /// numeric keypads.
+    NumpadStar,
+    /// <kbd>-</kbd>
+    NumpadSubtract,
+    /// <kbd>Esc</kbd> or <kbd>⎋</kbd>
+    Escape,
+    /// <kbd>Fn</kbd> This is typically a hardware key that does not generate a separate code.
+    Fn,
+    /// <kbd>FLock</kbd> or <kbd>FnLock</kbd>. Function Lock key. Found on the Microsoft
+    /// Natural Keyboard.
+    FnLock,
+    /// <kbd>PrtScr SysRq</kbd> or <kbd>Print Screen</kbd>
+    PrintScreen,
+    /// <kbd>Scroll Lock</kbd>
+    ScrollLock,
+    /// <kbd>Pause Break</kbd>
+    Pause,
+    /// Some laptops place this key to the left of the <kbd>↑</kbd> key.
+    ///
+    /// This also the "back" button (triangle) on Android.
+    BrowserBack,
+    BrowserFavorites,
+    /// Some laptops place this key to the right of the <kbd>↑</kbd> key.
+    BrowserForward,
+    /// The "home" button on Android.
+    BrowserHome,
+    BrowserRefresh,
+    BrowserSearch,
+    BrowserStop,
+    /// <kbd>Eject</kbd> or <kbd>⏏</kbd>. This key is placed in the function section on some Apple
+    /// keyboards.
+    Eject,
+    /// Sometimes labelled <kbd>My Computer</kbd> on the keyboard
+    LaunchApp1,
+    /// Sometimes labelled <kbd>Calculator</kbd> on the keyboard
+    LaunchApp2,
+    LaunchMail,
+    MediaPlayPause,
+    MediaSelect,
+    MediaStop,
+    MediaTrackNext,
+    MediaTrackPrevious,
+    /// This key is placed in the function section on some Apple keyboards, replacing the
+    /// <kbd>Eject</kbd> key.
+    Power,
+    Sleep,
+    AudioVolumeDown,
+    AudioVolumeMute,
+    AudioVolumeUp,
+    WakeUp,
+    // Legacy modifier key. Also called "Super" in certain places.
+    Meta,
+    // Legacy modifier key.
+    Hyper,
+    Turbo,
+    Abort,
+    Resume,
+    Suspend,
+    /// Found on Sun’s USB keyboard.
+    Again,
+    /// Found on Sun’s USB keyboard.
+    Copy,
+    /// Found on Sun’s USB keyboard.
+    Cut,
+    /// Found on Sun’s USB keyboard.
+    Find,
+    /// Found on Sun’s USB keyboard.
+    Open,
+    /// Found on Sun’s USB keyboard.
+    Paste,
+    /// Found on Sun’s USB keyboard.
+    Props,
+    /// Found on Sun’s USB keyboard.
+    Select,
+    /// Found on Sun’s USB keyboard.
+    Undo,
+    /// Use for dedicated <kbd>ひらがな</kbd> key found on some Japanese word processing keyboards.
+    Hiragana,
+    /// Use for dedicated <kbd>カタカナ</kbd> key found on some Japanese word processing keyboards.
+    Katakana,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F1,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F2,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F3,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F4,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F5,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F6,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F7,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F8,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F9,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F10,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F11,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F12,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F13,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F14,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F15,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F16,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F17,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F18,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F19,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F20,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F21,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F22,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F23,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F24,
+    /// General-purpose function key.
+    F25,
+    /// General-purpose function key.
+    F26,
+    /// General-purpose function key.
+    F27,
+    /// General-purpose function key.
+    F28,
+    /// General-purpose function key.
+    F29,
+    /// General-purpose function key.
+    F30,
+    /// General-purpose function key.
+    F31,
+    /// General-purpose function key.
+    F32,
+    /// General-purpose function key.
+    F33,
+    /// General-purpose function key.
+    F34,
+    /// General-purpose function key.
+    F35,
+}
+
+/// A [`Key::Named`] value
+///
+/// This mostly conforms to the UI Events Specification's [`KeyboardEvent.key`] with a few
+/// exceptions:
+/// - The `Super` variant here, is named `Meta` in the aforementioned specification. (There's
+///   another key which the specification calls `Super`. That does not exist here.)
+/// - The `Space` variant here, can be identified by the character it generates in the
+///   specification.
+///
+/// [`KeyboardEvent.key`]: https://w3c.github.io/uievents-key/
+#[non_exhaustive]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum NamedKey {
+    /// The `Alt` (Alternative) key.
+    ///
+    /// This key enables the alternate modifier function for interpreting concurrent or subsequent
+    /// keyboard input. This key value is also used for the Apple <kbd>Option</kbd> key.
+    Alt,
+    /// The Alternate Graphics (<kbd>AltGr</kbd> or <kbd>AltGraph</kbd>) key.
+    ///
+    /// This key is used enable the ISO Level 3 shift modifier (the standard `Shift` key is the
+    /// level 2 modifier).
+    AltGraph,
+    /// The `Caps Lock` (Capital) key.
+    ///
+    /// Toggle capital character lock function for interpreting subsequent keyboard input event.
+    CapsLock,
+    /// The `Control` or `Ctrl` key.
+    ///
+    /// Used to enable control modifier function for interpreting concurrent or subsequent keyboard
+    /// input.
+    Control,
+    /// The Function switch `Fn` key. Activating this key simultaneously with another key changes
+    /// that key’s value to an alternate character or function. This key is often handled directly
+    /// in the keyboard hardware and does not usually generate key events.
+    Fn,
+    /// The Function-Lock (`FnLock` or `F-Lock`) key. Activating this key switches the mode of the
+    /// keyboard to changes some keys' values to an alternate character or function. This key is
+    /// often handled directly in the keyboard hardware and does not usually generate key events.
+    FnLock,
+    /// The `NumLock` or Number Lock key. Used to toggle numpad mode function for interpreting
+    /// subsequent keyboard input.
+    NumLock,
+    /// Toggle between scrolling and cursor movement modes.
+    ScrollLock,
+    /// Used to enable shift modifier function for interpreting concurrent or subsequent keyboard
+    /// input.
+    Shift,
+    /// The Symbol modifier key (used on some virtual keyboards).
+    Symbol,
+    SymbolLock,
+    // Legacy modifier key. Also called "Super" in certain places.
+    Meta,
+    // Legacy modifier key.
+    Hyper,
+    /// Used to enable "super" modifier function for interpreting concurrent or subsequent keyboard
+    /// input. This key value is used for the "Windows Logo" key and the Apple `Command` or `⌘`
+    /// key.
+    ///
+    /// Note: In some contexts (e.g. the Web) this is referred to as the "Meta" key.
+    Super,
+    /// The `Enter` or `↵` key. Used to activate current selection or accept current input. This
+    /// key value is also used for the `Return` (Macintosh numpad) key. This key value is also
+    /// used for the Android `KEYCODE_DPAD_CENTER`.
+    Enter,
+    /// The Horizontal Tabulation `Tab` key.
+    Tab,
+    /// Used in text to insert a space between words. Usually located below the character keys.
+    Space,
+    /// Navigate or traverse downward. (`KEYCODE_DPAD_DOWN`)
+    ArrowDown,
+    /// Navigate or traverse leftward. (`KEYCODE_DPAD_LEFT`)
+    ArrowLeft,
+    /// Navigate or traverse rightward. (`KEYCODE_DPAD_RIGHT`)
+    ArrowRight,
+    /// Navigate or traverse upward. (`KEYCODE_DPAD_UP`)
+    ArrowUp,
+    /// The End key, used with keyboard entry to go to the end of content (`KEYCODE_MOVE_END`).
+    End,
+    /// The Home key, used with keyboard entry, to go to start of content (`KEYCODE_MOVE_HOME`).
+    /// For the mobile phone `Home` key (which goes to the phone’s main screen), use [`GoHome`].
+    ///
+    /// [`GoHome`]: Self::GoHome
+    Home,
+    /// Scroll down or display next page of content.
+    PageDown,
+    /// Scroll up or display previous page of content.
+    PageUp,
+    /// Used to remove the character to the left of the cursor. This key value is also used for
+    /// the key labeled `Delete` on MacOS keyboards.
+    Backspace,
+    /// Remove the currently selected input.
+    Clear,
+    /// Copy the current selection. (`APPCOMMAND_COPY`)
+    Copy,
+    /// The Cursor Select key.
+    CrSel,
+    /// Cut the current selection. (`APPCOMMAND_CUT`)
+    Cut,
+    /// Used to delete the character to the right of the cursor. This key value is also used for
+    /// the key labeled `Delete` on MacOS keyboards when `Fn` is active.
+    Delete,
+    /// The Erase to End of Field key. This key deletes all characters from the current cursor
+    /// position to the end of the current field.
+    EraseEof,
+    /// The Extend Selection (Exsel) key.
+    ExSel,
+    /// Toggle between text modes for insertion or overtyping.
+    /// (`KEYCODE_INSERT`)
+    Insert,
+    /// The Paste key. (`APPCOMMAND_PASTE`)
+    Paste,
+    /// Redo the last action. (`APPCOMMAND_REDO`)
+    Redo,
+    /// Undo the last action. (`APPCOMMAND_UNDO`)
+    Undo,
+    /// The Accept (Commit, OK) key. Accept current option or input method sequence conversion.
+    Accept,
+    /// Redo or repeat an action.
+    Again,
+    /// The Attention (Attn) key.
+    Attn,
+    Cancel,
+    /// Show the application’s context menu.
+    /// This key is commonly found between the right `Super` key and the right `Control` key.
+    ContextMenu,
+    /// The `Esc` key. This key was originally used to initiate an escape sequence, but is
+    /// now more generally used to exit or "escape" the current context, such as closing a dialog
+    /// or exiting full screen mode.
+    Escape,
+    Execute,
+    /// Open the Find dialog. (`APPCOMMAND_FIND`)
+    Find,
+    /// Open a help dialog or toggle display of help information. (`APPCOMMAND_HELP`,
+    /// `KEYCODE_HELP`)
+    Help,
+    /// Pause the current state or application (as appropriate).
+    ///
+    /// Note: Do not use this value for the `Pause` button on media controllers. Use `"MediaPause"`
+    /// instead.
+    Pause,
+    /// Play or resume the current state or application (as appropriate).
+    ///
+    /// Note: Do not use this value for the `Play` button on media controllers. Use `"MediaPlay"`
+    /// instead.
+    Play,
+    /// The properties (Props) key.
+    Props,
+    Select,
+    /// The ZoomIn key. (`KEYCODE_ZOOM_IN`)
+    ZoomIn,
+    /// The ZoomOut key. (`KEYCODE_ZOOM_OUT`)
+    ZoomOut,
+    /// The Brightness Down key. Typically controls the display brightness.
+    /// (`KEYCODE_BRIGHTNESS_DOWN`)
+    BrightnessDown,
+    /// The Brightness Up key. Typically controls the display brightness. (`KEYCODE_BRIGHTNESS_UP`)
+    BrightnessUp,
+    /// Toggle removable media to eject (open) and insert (close) state. (`KEYCODE_MEDIA_EJECT`)
+    Eject,
+    LogOff,
+    /// Toggle power state. (`KEYCODE_POWER`)
+    /// Note: Note: Some devices might not expose this key to the operating environment.
+    Power,
+    /// The `PowerOff` key. Sometime called `PowerDown`.
+    PowerOff,
+    /// Initiate print-screen function.
+    PrintScreen,
+    /// The Hibernate key. This key saves the current state of the computer to disk so that it can
+    /// be restored. The computer will then shutdown.
+    Hibernate,
+    /// The Standby key. This key turns off the display and places the computer into a low-power
+    /// mode without completely shutting down. It is sometimes labelled `Suspend` or `Sleep` key.
+    /// (`KEYCODE_SLEEP`)
+    Standby,
+    /// The WakeUp key. (`KEYCODE_WAKEUP`)
+    WakeUp,
+    /// Initiate the multi-candidate mode.
+    AllCandidates,
+    Alphanumeric,
+    /// Initiate the Code Input mode to allow characters to be entered by
+    /// their code points.
+    CodeInput,
+    /// The Compose key, also known as "Multi_key" on the X Window System. This key acts in a
+    /// manner similar to a dead key, triggering a mode where subsequent key presses are combined
+    /// to produce a different character.
+    Compose,
+    /// Convert the current input method sequence.
+    Convert,
+    /// The Final Mode `Final` key used on some Asian keyboards, to enable the final mode for IMEs.
+    FinalMode,
+    /// Switch to the first character group. (ISO/IEC 9995)
+    GroupFirst,
+    /// Switch to the last character group. (ISO/IEC 9995)
+    GroupLast,
+    /// Switch to the next character group. (ISO/IEC 9995)
+    GroupNext,
+    /// Switch to the previous character group. (ISO/IEC 9995)
+    GroupPrevious,
+    /// Toggle between or cycle through input modes of IMEs.
+    ModeChange,
+    NextCandidate,
+    /// Accept current input method sequence without
+    /// conversion in IMEs.
+    NonConvert,
+    PreviousCandidate,
+    Process,
+    SingleCandidate,
+    /// Toggle between Hangul and English modes.
+    HangulMode,
+    HanjaMode,
+    JunjaMode,
+    /// The Eisu key. This key may close the IME, but its purpose is defined by the current IME.
+    /// (`KEYCODE_EISU`)
+    Eisu,
+    /// The (Half-Width) Characters key.
+    Hankaku,
+    /// The Hiragana (Japanese Kana characters) key.
+    Hiragana,
+    /// The Hiragana/Katakana toggle key. (`KEYCODE_KATAKANA_HIRAGANA`)
+    HiraganaKatakana,
+    /// The Kana Mode (Kana Lock) key. This key is used to enter hiragana mode (typically from
+    /// romaji mode).
+    KanaMode,
+    /// The Kanji (Japanese name for ideographic characters of Chinese origin) Mode key. This key
+    /// is typically used to switch to a hiragana keyboard for the purpose of converting input
+    /// into kanji. (`KEYCODE_KANA`)
+    KanjiMode,
+    /// The Katakana (Japanese Kana characters) key.
+    Katakana,
+    /// The Roman characters function key.
+    Romaji,
+    /// The Zenkaku (Full-Width) Characters key.
+    Zenkaku,
+    /// The Zenkaku/Hankaku (full-width/half-width) toggle key. (`KEYCODE_ZENKAKU_HANKAKU`)
+    ZenkakuHankaku,
+    /// General purpose virtual function key, as index 1.
+    Soft1,
+    /// General purpose virtual function key, as index 2.
+    Soft2,
+    /// General purpose virtual function key, as index 3.
+    Soft3,
+    /// General purpose virtual function key, as index 4.
+    Soft4,
+    /// Select next (numerically or logically) lower channel. (`APPCOMMAND_MEDIA_CHANNEL_DOWN`,
+    /// `KEYCODE_CHANNEL_DOWN`)
+    ChannelDown,
+    /// Select next (numerically or logically) higher channel. (`APPCOMMAND_MEDIA_CHANNEL_UP`,
+    /// `KEYCODE_CHANNEL_UP`)
+    ChannelUp,
+    /// Close the current document or message (Note: This doesn’t close the application).
+    /// (`APPCOMMAND_CLOSE`)
+    Close,
+    /// Open an editor to forward the current message. (`APPCOMMAND_FORWARD_MAIL`)
+    MailForward,
+    /// Open an editor to reply to the current message. (`APPCOMMAND_REPLY_TO_MAIL`)
+    MailReply,
+    /// Send the current message. (`APPCOMMAND_SEND_MAIL`)
+    MailSend,
+    /// Close the current media, for example to close a CD or DVD tray. (`KEYCODE_MEDIA_CLOSE`)
+    MediaClose,
+    /// Initiate or continue forward playback at faster than normal speed, or increase speed if
+    /// already fast forwarding. (`APPCOMMAND_MEDIA_FAST_FORWARD`, `KEYCODE_MEDIA_FAST_FORWARD`)
+    MediaFastForward,
+    /// Pause the currently playing media. (`APPCOMMAND_MEDIA_PAUSE`, `KEYCODE_MEDIA_PAUSE`)
+    ///
+    /// Note: Media controller devices should use this value rather than `"Pause"` for their pause
+    /// keys.
+    MediaPause,
+    /// Initiate or continue media playback at normal speed, if not currently playing at normal
+    /// speed. (`APPCOMMAND_MEDIA_PLAY`, `KEYCODE_MEDIA_PLAY`)
+    MediaPlay,
+    /// Toggle media between play and pause states. (`APPCOMMAND_MEDIA_PLAY_PAUSE`,
+    /// `KEYCODE_MEDIA_PLAY_PAUSE`)
+    MediaPlayPause,
+    /// Initiate or resume recording of currently selected media. (`APPCOMMAND_MEDIA_RECORD`,
+    /// `KEYCODE_MEDIA_RECORD`)
+    MediaRecord,
+    /// Initiate or continue reverse playback at faster than normal speed, or increase speed if
+    /// already rewinding. (`APPCOMMAND_MEDIA_REWIND`, `KEYCODE_MEDIA_REWIND`)
+    MediaRewind,
+    /// Stop media playing, pausing, forwarding, rewinding, or recording, if not already stopped.
+    /// (`APPCOMMAND_MEDIA_STOP`, `KEYCODE_MEDIA_STOP`)
+    MediaStop,
+    /// Seek to next media or program track. (`APPCOMMAND_MEDIA_NEXTTRACK`, `KEYCODE_MEDIA_NEXT`)
+    MediaTrackNext,
+    /// Seek to previous media or program track. (`APPCOMMAND_MEDIA_PREVIOUSTRACK`,
+    /// `KEYCODE_MEDIA_PREVIOUS`)
+    MediaTrackPrevious,
+    /// Open a new document or message. (`APPCOMMAND_NEW`)
+    New,
+    /// Open an existing document or message. (`APPCOMMAND_OPEN`)
+    Open,
+    /// Print the current document or message. (`APPCOMMAND_PRINT`)
+    Print,
+    /// Save the current document or message. (`APPCOMMAND_SAVE`)
+    Save,
+    /// Spellcheck the current document or selection. (`APPCOMMAND_SPELL_CHECK`)
+    SpellCheck,
+    /// The `11` key found on media numpads that
+    /// have buttons from `1` ... `12`.
+    Key11,
+    /// The `12` key found on media numpads that
+    /// have buttons from `1` ... `12`.
+    Key12,
+    /// Adjust audio balance leftward. (`VK_AUDIO_BALANCE_LEFT`)
+    AudioBalanceLeft,
+    /// Adjust audio balance rightward. (`VK_AUDIO_BALANCE_RIGHT`)
+    AudioBalanceRight,
+    /// Decrease audio bass boost or cycle down through bass boost states. (`APPCOMMAND_BASS_DOWN`,
+    /// `VK_BASS_BOOST_DOWN`)
+    AudioBassBoostDown,
+    /// Toggle bass boost on/off. (`APPCOMMAND_BASS_BOOST`)
+    AudioBassBoostToggle,
+    /// Increase audio bass boost or cycle up through bass boost states. (`APPCOMMAND_BASS_UP`,
+    /// `VK_BASS_BOOST_UP`)
+    AudioBassBoostUp,
+    /// Adjust audio fader towards front. (`VK_FADER_FRONT`)
+    AudioFaderFront,
+    /// Adjust audio fader towards rear. (`VK_FADER_REAR`)
+    AudioFaderRear,
+    /// Advance surround audio mode to next available mode. (`VK_SURROUND_MODE_NEXT`)
+    AudioSurroundModeNext,
+    /// Decrease treble. (`APPCOMMAND_TREBLE_DOWN`)
+    AudioTrebleDown,
+    /// Increase treble. (`APPCOMMAND_TREBLE_UP`)
+    AudioTrebleUp,
+    /// Decrease audio volume. (`APPCOMMAND_VOLUME_DOWN`, `KEYCODE_VOLUME_DOWN`)
+    AudioVolumeDown,
+    /// Increase audio volume. (`APPCOMMAND_VOLUME_UP`, `KEYCODE_VOLUME_UP`)
+    AudioVolumeUp,
+    /// Toggle between muted state and prior volume level. (`APPCOMMAND_VOLUME_MUTE`,
+    /// `KEYCODE_VOLUME_MUTE`)
+    AudioVolumeMute,
+    /// Toggle the microphone on/off. (`APPCOMMAND_MIC_ON_OFF_TOGGLE`)
+    MicrophoneToggle,
+    /// Decrease microphone volume. (`APPCOMMAND_MICROPHONE_VOLUME_DOWN`)
+    MicrophoneVolumeDown,
+    /// Increase microphone volume. (`APPCOMMAND_MICROPHONE_VOLUME_UP`)
+    MicrophoneVolumeUp,
+    /// Mute the microphone. (`APPCOMMAND_MICROPHONE_VOLUME_MUTE`, `KEYCODE_MUTE`)
+    MicrophoneVolumeMute,
+    /// Show correction list when a word is incorrectly identified. (`APPCOMMAND_CORRECTION_LIST`)
+    SpeechCorrectionList,
+    /// Toggle between dictation mode and command/control mode.
+    /// (`APPCOMMAND_DICTATE_OR_COMMAND_CONTROL_TOGGLE`)
+    SpeechInputToggle,
+    /// The first generic "LaunchApplication" key. This is commonly associated with launching "My
+    /// Computer", and may have a computer symbol on the key. (`APPCOMMAND_LAUNCH_APP1`)
+    LaunchApplication1,
+    /// The second generic "LaunchApplication" key. This is commonly associated with launching
+    /// "Calculator", and may have a calculator symbol on the key. (`APPCOMMAND_LAUNCH_APP2`,
+    /// `KEYCODE_CALCULATOR`)
+    LaunchApplication2,
+    /// The "Calendar" key. (`KEYCODE_CALENDAR`)
+    LaunchCalendar,
+    /// The "Contacts" key. (`KEYCODE_CONTACTS`)
+    LaunchContacts,
+    /// The "Mail" key. (`APPCOMMAND_LAUNCH_MAIL`)
+    LaunchMail,
+    /// The "Media Player" key. (`APPCOMMAND_LAUNCH_MEDIA_SELECT`)
+    LaunchMediaPlayer,
+    LaunchMusicPlayer,
+    LaunchPhone,
+    LaunchScreenSaver,
+    LaunchSpreadsheet,
+    LaunchWebBrowser,
+    LaunchWebCam,
+    LaunchWordProcessor,
+    /// Navigate to previous content or page in current history. (`APPCOMMAND_BROWSER_BACKWARD`)
+    BrowserBack,
+    /// Open the list of browser favorites. (`APPCOMMAND_BROWSER_FAVORITES`)
+    BrowserFavorites,
+    /// Navigate to next content or page in current history. (`APPCOMMAND_BROWSER_FORWARD`)
+    BrowserForward,
+    /// Go to the user’s preferred home page. (`APPCOMMAND_BROWSER_HOME`)
+    BrowserHome,
+    /// Refresh the current page or content. (`APPCOMMAND_BROWSER_REFRESH`)
+    BrowserRefresh,
+    /// Call up the user’s preferred search page. (`APPCOMMAND_BROWSER_SEARCH`)
+    BrowserSearch,
+    /// Stop loading the current page or content. (`APPCOMMAND_BROWSER_STOP`)
+    BrowserStop,
+    /// The Application switch key, which provides a list of recent apps to switch between.
+    /// (`KEYCODE_APP_SWITCH`)
+    AppSwitch,
+    /// The Call key. (`KEYCODE_CALL`)
+    Call,
+    /// The Camera key. (`KEYCODE_CAMERA`)
+    Camera,
+    /// The Camera focus key. (`KEYCODE_FOCUS`)
+    CameraFocus,
+    /// The End Call key. (`KEYCODE_ENDCALL`)
+    EndCall,
+    /// The Back key. (`KEYCODE_BACK`)
+    GoBack,
+    /// The Home key, which goes to the phone’s main screen. (`KEYCODE_HOME`)
+    GoHome,
+    /// The Headset Hook key. (`KEYCODE_HEADSETHOOK`)
+    HeadsetHook,
+    LastNumberRedial,
+    /// The Notification key. (`KEYCODE_NOTIFICATION`)
+    Notification,
+    /// Toggle between manner mode state: silent, vibrate, ring, ... (`KEYCODE_MANNER_MODE`)
+    MannerMode,
+    VoiceDial,
+    /// Switch to viewing TV. (`KEYCODE_TV`)
+    TV,
+    /// TV 3D Mode. (`KEYCODE_3D_MODE`)
+    TV3DMode,
+    /// Toggle between antenna and cable input. (`KEYCODE_TV_ANTENNA_CABLE`)
+    TVAntennaCable,
+    /// Audio description. (`KEYCODE_TV_AUDIO_DESCRIPTION`)
+    TVAudioDescription,
+    /// Audio description mixing volume down. (`KEYCODE_TV_AUDIO_DESCRIPTION_MIX_DOWN`)
+    TVAudioDescriptionMixDown,
+    /// Audio description mixing volume up. (`KEYCODE_TV_AUDIO_DESCRIPTION_MIX_UP`)
+    TVAudioDescriptionMixUp,
+    /// Contents menu. (`KEYCODE_TV_CONTENTS_MENU`)
+    TVContentsMenu,
+    /// Contents menu. (`KEYCODE_TV_DATA_SERVICE`)
+    TVDataService,
+    /// Switch the input mode on an external TV. (`KEYCODE_TV_INPUT`)
+    TVInput,
+    /// Switch to component input #1. (`KEYCODE_TV_INPUT_COMPONENT_1`)
+    TVInputComponent1,
+    /// Switch to component input #2. (`KEYCODE_TV_INPUT_COMPONENT_2`)
+    TVInputComponent2,
+    /// Switch to composite input #1. (`KEYCODE_TV_INPUT_COMPOSITE_1`)
+    TVInputComposite1,
+    /// Switch to composite input #2. (`KEYCODE_TV_INPUT_COMPOSITE_2`)
+    TVInputComposite2,
+    /// Switch to HDMI input #1. (`KEYCODE_TV_INPUT_HDMI_1`)
+    TVInputHDMI1,
+    /// Switch to HDMI input #2. (`KEYCODE_TV_INPUT_HDMI_2`)
+    TVInputHDMI2,
+    /// Switch to HDMI input #3. (`KEYCODE_TV_INPUT_HDMI_3`)
+    TVInputHDMI3,
+    /// Switch to HDMI input #4. (`KEYCODE_TV_INPUT_HDMI_4`)
+    TVInputHDMI4,
+    /// Switch to VGA input #1. (`KEYCODE_TV_INPUT_VGA_1`)
+    TVInputVGA1,
+    /// Media context menu. (`KEYCODE_TV_MEDIA_CONTEXT_MENU`)
+    TVMediaContext,
+    /// Toggle network. (`KEYCODE_TV_NETWORK`)
+    TVNetwork,
+    /// Number entry. (`KEYCODE_TV_NUMBER_ENTRY`)
+    TVNumberEntry,
+    /// Toggle the power on an external TV. (`KEYCODE_TV_POWER`)
+    TVPower,
+    /// Radio. (`KEYCODE_TV_RADIO_SERVICE`)
+    TVRadioService,
+    /// Satellite. (`KEYCODE_TV_SATELLITE`)
+    TVSatellite,
+    /// Broadcast Satellite. (`KEYCODE_TV_SATELLITE_BS`)
+    TVSatelliteBS,
+    /// Communication Satellite. (`KEYCODE_TV_SATELLITE_CS`)
+    TVSatelliteCS,
+    /// Toggle between available satellites. (`KEYCODE_TV_SATELLITE_SERVICE`)
+    TVSatelliteToggle,
+    /// Analog Terrestrial. (`KEYCODE_TV_TERRESTRIAL_ANALOG`)
+    TVTerrestrialAnalog,
+    /// Digital Terrestrial. (`KEYCODE_TV_TERRESTRIAL_DIGITAL`)
+    TVTerrestrialDigital,
+    /// Timer programming. (`KEYCODE_TV_TIMER_PROGRAMMING`)
+    TVTimer,
+    /// Switch the input mode on an external AVR (audio/video receiver). (`KEYCODE_AVR_INPUT`)
+    AVRInput,
+    /// Toggle the power on an external AVR (audio/video receiver). (`KEYCODE_AVR_POWER`)
+    AVRPower,
+    /// General purpose color-coded media function key, as index 0 (red). (`VK_COLORED_KEY_0`,
+    /// `KEYCODE_PROG_RED`)
+    ColorF0Red,
+    /// General purpose color-coded media function key, as index 1 (green). (`VK_COLORED_KEY_1`,
+    /// `KEYCODE_PROG_GREEN`)
+    ColorF1Green,
+    /// General purpose color-coded media function key, as index 2 (yellow). (`VK_COLORED_KEY_2`,
+    /// `KEYCODE_PROG_YELLOW`)
+    ColorF2Yellow,
+    /// General purpose color-coded media function key, as index 3 (blue). (`VK_COLORED_KEY_3`,
+    /// `KEYCODE_PROG_BLUE`)
+    ColorF3Blue,
+    /// General purpose color-coded media function key, as index 4 (grey). (`VK_COLORED_KEY_4`)
+    ColorF4Grey,
+    /// General purpose color-coded media function key, as index 5 (brown). (`VK_COLORED_KEY_5`)
+    ColorF5Brown,
+    /// Toggle the display of Closed Captions. (`VK_CC`, `KEYCODE_CAPTIONS`)
+    ClosedCaptionToggle,
+    /// Adjust brightness of device, by toggling between or cycling through states. (`VK_DIMMER`)
+    Dimmer,
+    /// Swap video sources. (`VK_DISPLAY_SWAP`)
+    DisplaySwap,
+    /// Select Digital Video Recorder. (`KEYCODE_DVR`)
+    DVR,
+    /// Exit the current application. (`VK_EXIT`)
+    Exit,
+    /// Clear program or content stored as favorite 0. (`VK_CLEAR_FAVORITE_0`)
+    FavoriteClear0,
+    /// Clear program or content stored as favorite 1. (`VK_CLEAR_FAVORITE_1`)
+    FavoriteClear1,
+    /// Clear program or content stored as favorite 2. (`VK_CLEAR_FAVORITE_2`)
+    FavoriteClear2,
+    /// Clear program or content stored as favorite 3. (`VK_CLEAR_FAVORITE_3`)
+    FavoriteClear3,
+    /// Select (recall) program or content stored as favorite 0. (`VK_RECALL_FAVORITE_0`)
+    FavoriteRecall0,
+    /// Select (recall) program or content stored as favorite 1. (`VK_RECALL_FAVORITE_1`)
+    FavoriteRecall1,
+    /// Select (recall) program or content stored as favorite 2. (`VK_RECALL_FAVORITE_2`)
+    FavoriteRecall2,
+    /// Select (recall) program or content stored as favorite 3. (`VK_RECALL_FAVORITE_3`)
+    FavoriteRecall3,
+    /// Store current program or content as favorite 0. (`VK_STORE_FAVORITE_0`)
+    FavoriteStore0,
+    /// Store current program or content as favorite 1. (`VK_STORE_FAVORITE_1`)
+    FavoriteStore1,
+    /// Store current program or content as favorite 2. (`VK_STORE_FAVORITE_2`)
+    FavoriteStore2,
+    /// Store current program or content as favorite 3. (`VK_STORE_FAVORITE_3`)
+    FavoriteStore3,
+    /// Toggle display of program or content guide. (`VK_GUIDE`, `KEYCODE_GUIDE`)
+    Guide,
+    /// If guide is active and displayed, then display next day’s content. (`VK_NEXT_DAY`)
+    GuideNextDay,
+    /// If guide is active and displayed, then display previous day’s content. (`VK_PREV_DAY`)
+    GuidePreviousDay,
+    /// Toggle display of information about currently selected context or media. (`VK_INFO`,
+    /// `KEYCODE_INFO`)
+    Info,
+    /// Toggle instant replay. (`VK_INSTANT_REPLAY`)
+    InstantReplay,
+    /// Launch linked content, if available and appropriate. (`VK_LINK`)
+    Link,
+    /// List the current program. (`VK_LIST`)
+    ListProgram,
+    /// Toggle display listing of currently available live content or programs. (`VK_LIVE`)
+    LiveContent,
+    /// Lock or unlock current content or program. (`VK_LOCK`)
+    Lock,
+    /// Show a list of media applications: audio/video players and image viewers. (`VK_APPS`)
+    ///
+    /// Note: Do not confuse this key value with the Windows' `VK_APPS` / `VK_CONTEXT_MENU` key,
+    /// which is encoded as `"ContextMenu"`.
+    MediaApps,
+    /// Audio track key. (`KEYCODE_MEDIA_AUDIO_TRACK`)
+    MediaAudioTrack,
+    /// Select previously selected channel or media. (`VK_LAST`, `KEYCODE_LAST_CHANNEL`)
+    MediaLast,
+    /// Skip backward to next content or program. (`KEYCODE_MEDIA_SKIP_BACKWARD`)
+    MediaSkipBackward,
+    /// Skip forward to next content or program. (`VK_SKIP`, `KEYCODE_MEDIA_SKIP_FORWARD`)
+    MediaSkipForward,
+    /// Step backward to next content or program. (`KEYCODE_MEDIA_STEP_BACKWARD`)
+    MediaStepBackward,
+    /// Step forward to next content or program. (`KEYCODE_MEDIA_STEP_FORWARD`)
+    MediaStepForward,
+    /// Media top menu. (`KEYCODE_MEDIA_TOP_MENU`)
+    MediaTopMenu,
+    /// Navigate in. (`KEYCODE_NAVIGATE_IN`)
+    NavigateIn,
+    /// Navigate to next key. (`KEYCODE_NAVIGATE_NEXT`)
+    NavigateNext,
+    /// Navigate out. (`KEYCODE_NAVIGATE_OUT`)
+    NavigateOut,
+    /// Navigate to previous key. (`KEYCODE_NAVIGATE_PREVIOUS`)
+    NavigatePrevious,
+    /// Cycle to next favorite channel (in favorites list). (`VK_NEXT_FAVORITE_CHANNEL`)
+    NextFavoriteChannel,
+    /// Cycle to next user profile (if there are multiple user profiles). (`VK_USER`)
+    NextUserProfile,
+    /// Access on-demand content or programs. (`VK_ON_DEMAND`)
+    OnDemand,
+    /// Pairing key to pair devices. (`KEYCODE_PAIRING`)
+    Pairing,
+    /// Move picture-in-picture window down. (`VK_PINP_DOWN`)
+    PinPDown,
+    /// Move picture-in-picture window. (`VK_PINP_MOVE`)
+    PinPMove,
+    /// Toggle display of picture-in-picture window. (`VK_PINP_TOGGLE`)
+    PinPToggle,
+    /// Move picture-in-picture window up. (`VK_PINP_UP`)
+    PinPUp,
+    /// Decrease media playback speed. (`VK_PLAY_SPEED_DOWN`)
+    PlaySpeedDown,
+    /// Reset playback to normal speed. (`VK_PLAY_SPEED_RESET`)
+    PlaySpeedReset,
+    /// Increase media playback speed. (`VK_PLAY_SPEED_UP`)
+    PlaySpeedUp,
+    /// Toggle random media or content shuffle mode. (`VK_RANDOM_TOGGLE`)
+    RandomToggle,
+    /// Not a physical key, but this key code is sent when the remote control battery is low.
+    /// (`VK_RC_LOW_BATTERY`)
+    RcLowBattery,
+    /// Toggle or cycle between media recording speeds. (`VK_RECORD_SPEED_NEXT`)
+    RecordSpeedNext,
+    /// Toggle RF (radio frequency) input bypass mode (pass RF input directly to the RF output).
+    /// (`VK_RF_BYPASS`)
+    RfBypass,
+    /// Toggle scan channels mode. (`VK_SCAN_CHANNELS_TOGGLE`)
+    ScanChannelsToggle,
+    /// Advance display screen mode to next available mode. (`VK_SCREEN_MODE_NEXT`)
+    ScreenModeNext,
+    /// Toggle display of device settings screen. (`VK_SETTINGS`, `KEYCODE_SETTINGS`)
+    Settings,
+    /// Toggle split screen mode. (`VK_SPLIT_SCREEN_TOGGLE`)
+    SplitScreenToggle,
+    /// Switch the input mode on an external STB (set top box). (`KEYCODE_STB_INPUT`)
+    STBInput,
+    /// Toggle the power on an external STB (set top box). (`KEYCODE_STB_POWER`)
+    STBPower,
+    /// Toggle display of subtitles, if available. (`VK_SUBTITLE`)
+    Subtitle,
+    /// Toggle display of teletext, if available (`VK_TELETEXT`, `KEYCODE_TV_TELETEXT`).
+    Teletext,
+    /// Advance video mode to next available mode. (`VK_VIDEO_MODE_NEXT`)
+    VideoModeNext,
+    /// Cause device to identify itself in some manner, e.g., audibly or visibly. (`VK_WINK`)
+    Wink,
+    /// Toggle between full-screen and scaled content, or alter magnification level. (`VK_ZOOM`,
+    /// `KEYCODE_TV_ZOOM_MODE`)
+    ZoomToggle,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F1,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F2,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F3,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F4,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F5,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F6,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F7,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F8,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F9,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F10,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F11,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F12,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F13,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F14,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F15,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F16,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F17,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F18,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F19,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F20,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F21,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F22,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F23,
+    /// General-purpose function key.
+    /// Usually found at the top of the keyboard.
+    F24,
+    /// General-purpose function key.
+    F25,
+    /// General-purpose function key.
+    F26,
+    /// General-purpose function key.
+    F27,
+    /// General-purpose function key.
+    F28,
+    /// General-purpose function key.
+    F29,
+    /// General-purpose function key.
+    F30,
+    /// General-purpose function key.
+    F31,
+    /// General-purpose function key.
+    F32,
+    /// General-purpose function key.
+    F33,
+    /// General-purpose function key.
+    F34,
+    /// General-purpose function key.
+    F35,
+}
+
+/// Key represents the meaning of a keypress.
+///
+/// This is a superset of the UI Events Specification's [`KeyboardEvent.key`] with
+/// additions:
+/// - All simple variants are wrapped under the `Named` variant
+/// - The `Unidentified` variant here, can still identify a key through it's `NativeKeyCode`.
+/// - The `Dead` variant here, can specify the character which is inserted when pressing the
+///   dead-key twice.
+///
+/// [`KeyboardEvent.key`]: https://w3c.github.io/uievents-key/
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum Key<Str = SmolStr> {
+    /// A simple (unparameterised) action
+    Named(NamedKey),
+
+    /// A key string that corresponds to the character typed by the user, taking into account the
+    /// user’s current locale setting, and any system-level keyboard mapping overrides that are in
+    /// effect.
+    Character(Str),
+
+    /// This variant is used when the key cannot be translated to any other variant.
+    ///
+    /// The native key is provided (if available) in order to allow the user to specify keybindings
+    /// for keys which are not defined by this API, mainly through some sort of UI.
+    Unidentified(NativeKey),
+
+    /// Contains the text representation of the dead-key when available.
+    ///
+    /// ## Platform-specific
+    /// - **Web:** Always contains `None`
+    Dead(Option<char>),
+}
+
+impl From<NamedKey> for Key {
+    #[inline]
+    fn from(action: NamedKey) -> Self {
+        Key::Named(action)
+    }
+}
+
+impl From<NativeKey> for Key {
+    #[inline]
+    fn from(code: NativeKey) -> Self {
+        Key::Unidentified(code)
+    }
+}
+
+impl<Str> PartialEq<NamedKey> for Key<Str> {
+    #[inline]
+    fn eq(&self, rhs: &NamedKey) -> bool {
+        match self {
+            Key::Named(ref a) => a == rhs,
+            _ => false,
+        }
+    }
+}
+
+impl<Str: PartialEq<str>> PartialEq<str> for Key<Str> {
+    #[inline]
+    fn eq(&self, rhs: &str) -> bool {
+        match self {
+            Key::Character(ref s) => s == rhs,
+            _ => false,
+        }
+    }
+}
+
+impl<Str: PartialEq<str>> PartialEq<&str> for Key<Str> {
+    #[inline]
+    fn eq(&self, rhs: &&str) -> bool {
+        self == *rhs
+    }
+}
+
+impl<Str> PartialEq<NativeKey> for Key<Str> {
+    #[inline]
+    fn eq(&self, rhs: &NativeKey) -> bool {
+        match self {
+            Key::Unidentified(ref code) => code == rhs,
+            _ => false,
+        }
+    }
+}
+
+impl<Str> PartialEq<Key<Str>> for NativeKey {
+    #[inline]
+    fn eq(&self, rhs: &Key<Str>) -> bool {
+        rhs == self
+    }
+}
+
+impl Key<SmolStr> {
+    /// Convert `Key::Character(SmolStr)` to `Key::Character(&str)` so you can more easily match on
+    /// `Key`. All other variants remain unchanged.
+    pub fn as_ref(&self) -> Key<&str> {
+        match self {
+            Key::Named(a) => Key::Named(*a),
+            Key::Character(ch) => Key::Character(ch.as_str()),
+            Key::Dead(d) => Key::Dead(*d),
+            Key::Unidentified(u) => Key::Unidentified(u.clone()),
+        }
+    }
+}
+
+impl NamedKey {
+    /// Convert an action to its approximate textual equivalent.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use winit::keyboard::NamedKey;
+    ///
+    /// assert_eq!(NamedKey::Enter.to_text(), Some("\r"));
+    /// assert_eq!(NamedKey::F20.to_text(), None);
+    /// ```
+    pub fn to_text(&self) -> Option<&str> {
+        match self {
+            NamedKey::Enter => Some("\r"),
+            NamedKey::Backspace => Some("\x08"),
+            NamedKey::Tab => Some("\t"),
+            NamedKey::Space => Some(" "),
+            NamedKey::Escape => Some("\x1b"),
+            _ => None,
+        }
+    }
+}
+
+impl Key {
+    /// Convert a key to its approximate textual equivalent.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use winit::keyboard::{Key, NamedKey};
+    ///
+    /// assert_eq!(Key::Character("a".into()).to_text(), Some("a"));
+    /// assert_eq!(Key::Named(NamedKey::Enter).to_text(), Some("\r"));
+    /// assert_eq!(Key::Named(NamedKey::F20).to_text(), None);
+    /// ```
+    pub fn to_text(&self) -> Option<&str> {
+        match self {
+            Key::Named(action) => action.to_text(),
+            Key::Character(ch) => Some(ch.as_str()),
+            _ => None,
+        }
+    }
+}
+
+/// The location of the key on the keyboard.
+///
+/// Certain physical keys on the keyboard can have the same value, but are in different locations.
+/// For instance, the Shift key can be on the left or right side of the keyboard, or the number
+/// keys can be above the letters or on the numpad. This enum allows the user to differentiate
+/// them.
+///
+/// See the documentation for the [`location`] field on the [`KeyEvent`] struct for more
+/// information.
+///
+/// [`location`]: ../event/struct.KeyEvent.html#structfield.location
+/// [`KeyEvent`]: crate::event::KeyEvent
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum KeyLocation {
+    /// The key is in its "normal" location on the keyboard.
+    ///
+    /// For instance, the "1" key above the "Q" key on a QWERTY keyboard will use this location.
+    /// This invariant is also returned when the location of the key cannot be identified.
+    ///
+    /// ![Standard 1 key](https://raw.githubusercontent.com/rust-windowing/winit/master/docs/res/keyboard_standard_1_key.svg)
+    ///
+    /// <sub>
+    ///   For image attribution, see the
+    ///   <a href="https://github.com/rust-windowing/winit/blob/master/docs/res/ATTRIBUTION.md">
+    ///     ATTRIBUTION.md
+    ///   </a>
+    ///   file.
+    /// </sub>
+    Standard,
+
+    /// The key is on the left side of the keyboard.
+    ///
+    /// For instance, the left Shift key below the Caps Lock key on a QWERTY keyboard will use this
+    /// location.
+    ///
+    /// ![Left Shift key](https://raw.githubusercontent.com/rust-windowing/winit/master/docs/res/keyboard_left_shift_key.svg)
+    ///
+    /// <sub>
+    ///   For image attribution, see the
+    ///   <a href="https://github.com/rust-windowing/winit/blob/master/docs/res/ATTRIBUTION.md">
+    ///     ATTRIBUTION.md
+    ///   </a>
+    ///   file.
+    /// </sub>
+    Left,
+
+    /// The key is on the right side of the keyboard.
+    ///
+    /// For instance, the right Shift key below the Enter key on a QWERTY keyboard will use this
+    /// location.
+    ///
+    /// ![Right Shift key](https://raw.githubusercontent.com/rust-windowing/winit/master/docs/res/keyboard_right_shift_key.svg)
+    ///
+    /// <sub>
+    ///   For image attribution, see the
+    ///   <a href="https://github.com/rust-windowing/winit/blob/master/docs/res/ATTRIBUTION.md">
+    ///     ATTRIBUTION.md
+    ///   </a>
+    ///   file.
+    /// </sub>
+    Right,
+
+    /// The key is on the numpad.
+    ///
+    /// For instance, the "1" key on the numpad will use this location.
+    ///
+    /// ![Numpad 1 key](https://raw.githubusercontent.com/rust-windowing/winit/master/docs/res/keyboard_numpad_1_key.svg)
+    ///
+    /// <sub>
+    ///   For image attribution, see the
+    ///   <a href="https://github.com/rust-windowing/winit/blob/master/docs/res/ATTRIBUTION.md">
+    ///     ATTRIBUTION.md
+    ///   </a>
+    ///   file.
+    /// </sub>
+    Numpad,
+}
+
+bitflags! {
+    /// Represents the current state of the keyboard modifiers
+    ///
+    /// Each flag represents a modifier and is set if this modifier is active.
+    #[derive(Default, Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+    pub struct ModifiersState: u32 {
+        /// The "shift" key.
+        const SHIFT = 0b100;
+        /// The "control" key.
+        const CONTROL = 0b100 << 3;
+        /// The "alt" key.
+        const ALT = 0b100 << 6;
+        /// This is the "windows" key on PC and "command" key on Mac.
+        const SUPER = 0b100 << 9;
+    }
+}
+
+impl ModifiersState {
+    /// Returns `true` if the shift key is pressed.
+    pub fn shift_key(&self) -> bool {
+        self.intersects(Self::SHIFT)
+    }
+
+    /// Returns `true` if the control key is pressed.
+    pub fn control_key(&self) -> bool {
+        self.intersects(Self::CONTROL)
+    }
+
+    /// Returns `true` if the alt key is pressed.
+    pub fn alt_key(&self) -> bool {
+        self.intersects(Self::ALT)
+    }
+
+    /// Returns `true` if the super key is pressed.
+    pub fn super_key(&self) -> bool {
+        self.intersects(Self::SUPER)
+    }
+}
+
+/// The state of the particular modifiers key.
+#[derive(Default, Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ModifiersKeyState {
+    /// The particular key is pressed.
+    Pressed,
+    /// The state of the key is unknown.
+    #[default]
+    Unknown,
+}
+
+// NOTE: the exact modifier key is not used to represent modifiers state in the
+// first place due to a fact that modifiers state could be changed without any
+// key being pressed and on some platforms like Wayland/X11 which key resulted
+// in modifiers change is hidden, also, not that it really matters.
+//
+// The reason this API is even exposed is mostly to provide a way for users
+// to treat modifiers differently based on their position, which is required
+// on macOS due to their AltGr/Option situation.
+bitflags! {
+    #[derive(Default, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    pub(crate) struct ModifiersKeys: u8 {
+        const LSHIFT   = 0b0000_0001;
+        const RSHIFT   = 0b0000_0010;
+        const LCONTROL = 0b0000_0100;
+        const RCONTROL = 0b0000_1000;
+        const LALT     = 0b0001_0000;
+        const RALT     = 0b0010_0000;
+        const LSUPER   = 0b0100_0000;
+        const RSUPER   = 0b1000_0000;
+    }
+}
+
+#[cfg(feature = "serde")]
+mod modifiers_serde {
+    use super::ModifiersState;
+    use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+    #[derive(Default, Serialize, Deserialize)]
+    #[serde(default)]
+    #[serde(rename = "ModifiersState")]
+    pub struct ModifiersStateSerialize {
+        pub shift_key: bool,
+        pub control_key: bool,
+        pub alt_key: bool,
+        pub super_key: bool,
+    }
+
+    impl Serialize for ModifiersState {
+        fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+        where
+            S: Serializer,
+        {
+            let s = ModifiersStateSerialize {
+                shift_key: self.shift_key(),
+                control_key: self.control_key(),
+                alt_key: self.alt_key(),
+                super_key: self.super_key(),
+            };
+            s.serialize(serializer)
+        }
+    }
+
+    impl<'de> Deserialize<'de> for ModifiersState {
+        fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+        where
+            D: Deserializer<'de>,
+        {
+            let ModifiersStateSerialize { shift_key, control_key, alt_key, super_key } =
+                ModifiersStateSerialize::deserialize(deserializer)?;
+            let mut m = ModifiersState::empty();
+            m.set(ModifiersState::SHIFT, shift_key);
+            m.set(ModifiersState::CONTROL, control_key);
+            m.set(ModifiersState::ALT, alt_key);
+            m.set(ModifiersState::SUPER, super_key);
+            Ok(m)
+        }
+    }
+}
diff --git a/vendor/winit/src/lib.rs b/vendor/winit/src/lib.rs
new file mode 100644
index 00000000..41a55b23
--- /dev/null
+++ b/vendor/winit/src/lib.rs
@@ -0,0 +1,217 @@
+//! Winit is a cross-platform window creation and event loop management library.
+//!
+//! # Building windows
+//!
+//! Before you can create a [`Window`], you first need to build an [`EventLoop`]. This is done with
+//! the [`EventLoop::new()`] function.
+//!
+//! ```no_run
+//! use winit::event_loop::EventLoop;
+//!
+//! # // Intentionally use `fn main` for clarity
+//! fn main() {
+//!     let event_loop = EventLoop::new().unwrap();
+//!     // ...
+//! }
+//! ```
+//!
+//! Then you create a [`Window`] with [`create_window`].
+//!
+//! # Event handling
+//!
+//! Once a [`Window`] has been created, it will generate different *events*. A [`Window`] object can
+//! generate [`WindowEvent`]s when certain input events occur, such as a cursor moving over the
+//! window or a key getting pressed while the window is focused. Devices can generate
+//! [`DeviceEvent`]s, which contain unfiltered event data that isn't specific to a certain window.
+//! Some user activity, like mouse movement, can generate both a [`WindowEvent`] *and* a
+//! [`DeviceEvent`]. You can also create and handle your own custom [`Event::UserEvent`]s, if
+//! desired.
+//!
+//! You can retrieve events by calling [`EventLoop::run_app()`]. This function will
+//! dispatch events for every [`Window`] that was created with that particular [`EventLoop`], and
+//! will run until [`exit()`] is used, at which point [`Event::LoopExiting`].
+//!
+//! Winit no longer uses a `EventLoop::poll_events() -> impl Iterator<Event>`-based event loop
+//! model, since that can't be implemented properly on some platforms (e.g web, iOS) and works
+//! poorly on most other platforms. However, this model can be re-implemented to an extent with
+#![cfg_attr(
+    any(windows_platform, macos_platform, android_platform, x11_platform, wayland_platform),
+    doc = "[`EventLoopExtPumpEvents::pump_app_events()`][platform::pump_events::EventLoopExtPumpEvents::pump_app_events()]"
+)]
+#![cfg_attr(
+    not(any(windows_platform, macos_platform, android_platform, x11_platform, wayland_platform)),
+    doc = "`EventLoopExtPumpEvents::pump_app_events()`"
+)]
+//! [^1]. See that method's documentation for more reasons about why
+//! it's discouraged beyond compatibility reasons.
+//!
+//!
+//! ```no_run
+//! use winit::application::ApplicationHandler;
+//! use winit::event::WindowEvent;
+//! use winit::event_loop::{ActiveEventLoop, ControlFlow, EventLoop};
+//! use winit::window::{Window, WindowId};
+//!
+//! #[derive(Default)]
+//! struct App {
+//!     window: Option<Window>,
+//! }
+//!
+//! impl ApplicationHandler for App {
+//!     fn resumed(&mut self, event_loop: &ActiveEventLoop) {
+//!         self.window = Some(event_loop.create_window(Window::default_attributes()).unwrap());
+//!     }
+//!
+//!     fn window_event(&mut self, event_loop: &ActiveEventLoop, id: WindowId, event: WindowEvent) {
+//!         match event {
+//!             WindowEvent::CloseRequested => {
+//!                 println!("The close button was pressed; stopping");
+//!                 event_loop.exit();
+//!             },
+//!             WindowEvent::RedrawRequested => {
+//!                 // Redraw the application.
+//!                 //
+//!                 // It's preferable for applications that do not render continuously to render in
+//!                 // this event rather than in AboutToWait, since rendering in here allows
+//!                 // the program to gracefully handle redraws requested by the OS.
+//!
+//!                 // Draw.
+//!
+//!                 // Queue a RedrawRequested event.
+//!                 //
+//!                 // You only need to call this if you've determined that you need to redraw in
+//!                 // applications which do not always need to. Applications that redraw continuously
+//!                 // can render here instead.
+//!                 self.window.as_ref().unwrap().request_redraw();
+//!             }
+//!             _ => (),
+//!         }
+//!     }
+//! }
+//!
+//! # // Intentionally use `fn main` for clarity
+//! fn main() {
+//!     let event_loop = EventLoop::new().unwrap();
+//!
+//!     // ControlFlow::Poll continuously runs the event loop, even if the OS hasn't
+//!     // dispatched any events. This is ideal for games and similar applications.
+//!     event_loop.set_control_flow(ControlFlow::Poll);
+//!
+//!     // ControlFlow::Wait pauses the event loop if no events are available to process.
+//!     // This is ideal for non-game applications that only update in response to user
+//!     // input, and uses significantly less power/CPU time than ControlFlow::Poll.
+//!     event_loop.set_control_flow(ControlFlow::Wait);
+//!
+//!     let mut app = App::default();
+//!     event_loop.run_app(&mut app);
+//! }
+//! ```
+//!
+//! [`WindowEvent`] has a [`WindowId`] member. In multi-window environments, it should be
+//! compared to the value returned by [`Window::id()`] to determine which [`Window`]
+//! dispatched the event.
+//!
+//! # Drawing on the window
+//!
+//! Winit doesn't directly provide any methods for drawing on a [`Window`]. However, it allows you
+//! to retrieve the raw handle of the window and display (see the [`platform`] module and/or the
+//! [`raw_window_handle`] and [`raw_display_handle`] methods), which in turn allows
+//! you to create an OpenGL/Vulkan/DirectX/Metal/etc. context that can be used to render graphics.
+//!
+//! Note that many platforms will display garbage data in the window's client area if the
+//! application doesn't render anything to the window by the time the desktop compositor is ready to
+//! display the window to the user. If you notice this happening, you should create the window with
+//! [`visible` set to `false`][crate::window::WindowAttributes::with_visible] and explicitly make
+//! the window visible only once you're ready to render into it.
+//!
+//! # UI scaling
+//!
+//! UI scaling is important, go read the docs for the [`dpi`] crate for an
+//! introduction.
+//!
+//! All of Winit's functions return physical types, but can take either logical or physical
+//! coordinates as input, allowing you to use the most convenient coordinate system for your
+//! particular application.
+//!
+//! Winit will dispatch a [`ScaleFactorChanged`] event whenever a window's scale factor has changed.
+//! This can happen if the user drags their window from a standard-resolution monitor to a high-DPI
+//! monitor or if the user changes their DPI settings. This allows you to rescale your application's
+//! UI elements and adjust how the platform changes the window's size to reflect the new scale
+//! factor. If a window hasn't received a [`ScaleFactorChanged`] event, its scale factor
+//! can be found by calling [`window.scale_factor()`].
+//!
+//! [`ScaleFactorChanged`]: event::WindowEvent::ScaleFactorChanged
+//! [`window.scale_factor()`]: window::Window::scale_factor
+//!
+//! # Cargo Features
+//!
+//! Winit provides the following Cargo features:
+//!
+//! * `x11` (enabled by default): On Unix platforms, enables the X11 backend.
+//! * `wayland` (enabled by default): On Unix platforms, enables the Wayland backend.
+//! * `rwh_04`: Implement `raw-window-handle v0.4` traits.
+//! * `rwh_05`: Implement `raw-window-handle v0.5` traits.
+//! * `rwh_06`: Implement `raw-window-handle v0.6` traits.
+//! * `serde`: Enables serialization/deserialization of certain types with [Serde](https://crates.io/crates/serde).
+//! * `mint`: Enables mint (math interoperability standard types) conversions.
+//!
+//! See the [`platform`] module for documentation on platform-specific cargo
+//! features.
+//!
+//! [`EventLoop`]: event_loop::EventLoop
+//! [`EventLoop::new()`]: event_loop::EventLoop::new
+//! [`EventLoop::run_app()`]: event_loop::EventLoop::run_app
+//! [`exit()`]: event_loop::ActiveEventLoop::exit
+//! [`Window`]: window::Window
+//! [`WindowId`]: window::WindowId
+//! [`WindowAttributes`]: window::WindowAttributes
+//! [`create_window`]: event_loop::ActiveEventLoop::create_window
+//! [`Window::id()`]: window::Window::id
+//! [`WindowEvent`]: event::WindowEvent
+//! [`DeviceEvent`]: event::DeviceEvent
+//! [`Event::UserEvent`]: event::Event::UserEvent
+//! [`Event::LoopExiting`]: event::Event::LoopExiting
+//! [`raw_window_handle`]: ./window/struct.Window.html#method.raw_window_handle
+//! [`raw_display_handle`]: ./window/struct.Window.html#method.raw_display_handle
+//! [^1]: `EventLoopExtPumpEvents::pump_app_events()` is only available on Windows, macOS, Android, X11 and Wayland.
+
+#![deny(rust_2018_idioms)]
+#![deny(rustdoc::broken_intra_doc_links)]
+#![deny(clippy::all)]
+#![deny(unsafe_op_in_unsafe_fn)]
+#![cfg_attr(clippy, deny(warnings))]
+// Doc feature labels can be tested locally by running RUSTDOCFLAGS="--cfg=docsrs" cargo +nightly
+// doc
+#![cfg_attr(docsrs, feature(doc_cfg), doc(auto_cfg(hide(doc, docsrs))))]
+#![allow(clippy::missing_safety_doc)]
+#![warn(clippy::uninlined_format_args)]
+// TODO: wasm-binding needs to be updated for that to be resolved, for now just silence it.
+#![cfg_attr(web_platform, allow(unknown_lints, renamed_and_removed_lints, wasm_c_abi))]
+
+#[cfg(feature = "rwh_04")]
+pub use rwh_04 as raw_window_handle_04;
+#[cfg(feature = "rwh_05")]
+pub use rwh_05 as raw_window_handle_05;
+#[cfg(feature = "rwh_06")]
+pub use rwh_06 as raw_window_handle;
+
+// Re-export DPI types so that users don't have to put it in Cargo.toml.
+#[doc(inline)]
+pub use dpi;
+
+pub mod application;
+#[cfg(any(doc, doctest, test))]
+pub mod changelog;
+#[macro_use]
+pub mod error;
+mod cursor;
+pub mod event;
+pub mod event_loop;
+mod icon;
+pub mod keyboard;
+pub mod monitor;
+mod platform_impl;
+mod utils;
+pub mod window;
+
+pub mod platform;
diff --git a/vendor/winit/src/monitor.rs b/vendor/winit/src/monitor.rs
new file mode 100644
index 00000000..ed987e25
--- /dev/null
+++ b/vendor/winit/src/monitor.rs
@@ -0,0 +1,167 @@
+//! Types useful for interacting with a user's monitors.
+//!
+//! If you want to get basic information about a monitor, you can use the
+//! [`MonitorHandle`] type. This is retrieved from one of the following
+//! methods, which return an iterator of [`MonitorHandle`]:
+//! - [`ActiveEventLoop::available_monitors`][crate::event_loop::ActiveEventLoop::available_monitors].
+//! - [`Window::available_monitors`][crate::window::Window::available_monitors].
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::platform_impl;
+
+/// Deprecated! Use `VideoModeHandle` instead.
+#[deprecated = "Renamed to `VideoModeHandle`"]
+pub type VideoMode = VideoModeHandle;
+
+/// Describes a fullscreen video mode of a monitor.
+///
+/// Can be acquired with [`MonitorHandle::video_modes`].
+#[derive(Clone, PartialEq, Eq, Hash)]
+pub struct VideoModeHandle {
+    pub(crate) video_mode: platform_impl::VideoModeHandle,
+}
+
+impl std::fmt::Debug for VideoModeHandle {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.video_mode.fmt(f)
+    }
+}
+
+impl PartialOrd for VideoModeHandle {
+    fn partial_cmp(&self, other: &VideoModeHandle) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for VideoModeHandle {
+    fn cmp(&self, other: &VideoModeHandle) -> std::cmp::Ordering {
+        self.monitor().cmp(&other.monitor()).then(
+            self.size()
+                .cmp(&other.size())
+                .then(
+                    self.refresh_rate_millihertz()
+                        .cmp(&other.refresh_rate_millihertz())
+                        .then(self.bit_depth().cmp(&other.bit_depth())),
+                )
+                .reverse(),
+        )
+    }
+}
+
+impl VideoModeHandle {
+    /// Returns the resolution of this video mode.
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.video_mode.size()
+    }
+
+    /// Returns the bit depth of this video mode, as in how many bits you have
+    /// available per color. This is generally 24 bits or 32 bits on modern
+    /// systems, depending on whether the alpha channel is counted or not.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland / Orbital:** Always returns 32.
+    /// - **iOS:** Always returns 32.
+    #[inline]
+    pub fn bit_depth(&self) -> u16 {
+        self.video_mode.bit_depth()
+    }
+
+    /// Returns the refresh rate of this video mode in mHz.
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.video_mode.refresh_rate_millihertz()
+    }
+
+    /// Returns the monitor that this video mode is valid for. Each monitor has
+    /// a separate set of valid video modes.
+    #[inline]
+    pub fn monitor(&self) -> MonitorHandle {
+        MonitorHandle { inner: self.video_mode.monitor() }
+    }
+}
+
+impl std::fmt::Display for VideoModeHandle {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}x{} @ {} mHz ({} bpp)",
+            self.size().width,
+            self.size().height,
+            self.refresh_rate_millihertz(),
+            self.bit_depth()
+        )
+    }
+}
+
+/// Handle to a monitor.
+///
+/// Allows you to retrieve information about a given monitor and can be used in [`Window`] creation.
+///
+/// [`Window`]: crate::window::Window
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub struct MonitorHandle {
+    pub(crate) inner: platform_impl::MonitorHandle,
+}
+
+impl MonitorHandle {
+    /// Returns a human-readable name of the monitor.
+    ///
+    /// Returns `None` if the monitor doesn't exist anymore.
+    #[inline]
+    pub fn name(&self) -> Option<String> {
+        self.inner.name()
+    }
+
+    /// Returns the monitor's resolution.
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.inner.size()
+    }
+
+    /// Returns the top-left corner position of the monitor relative to the larger full
+    /// screen area.
+    #[inline]
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        self.inner.position()
+    }
+
+    /// The monitor refresh rate used by the system.
+    ///
+    /// Return `Some` if succeed, or `None` if failed, which usually happens when the monitor
+    /// the window is on is removed.
+    ///
+    /// When using exclusive fullscreen, the refresh rate of the [`VideoModeHandle`] that was
+    /// used to enter fullscreen should be used instead.
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        self.inner.refresh_rate_millihertz()
+    }
+
+    /// Returns the scale factor of the underlying monitor. To map logical pixels to physical
+    /// pixels and vice versa, use [`Window::scale_factor`].
+    ///
+    /// See the [`dpi`] module for more information.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **X11:** Can be overridden using the `WINIT_X11_SCALE_FACTOR` environment variable.
+    /// - **Wayland:** May differ from [`Window::scale_factor`].
+    /// - **Android:** Always returns 1.0.
+    ///
+    /// [`Window::scale_factor`]: crate::window::Window::scale_factor
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        self.inner.scale_factor()
+    }
+
+    /// Returns all fullscreen video modes supported by this monitor.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Web:** Always returns an empty iterator
+    #[inline]
+    pub fn video_modes(&self) -> impl Iterator<Item = VideoModeHandle> {
+        self.inner.video_modes().map(|video_mode| VideoModeHandle { video_mode })
+    }
+}
diff --git a/vendor/winit/src/platform/android.rs b/vendor/winit/src/platform/android.rs
new file mode 100644
index 00000000..b76159c0
--- /dev/null
+++ b/vendor/winit/src/platform/android.rs
@@ -0,0 +1,188 @@
+//! # Android
+//!
+//! The Android backend builds on (and exposes types from) the [`ndk`](https://docs.rs/ndk/) crate.
+//!
+//! Native Android applications need some form of "glue" crate that is responsible
+//! for defining the main entry point for your Rust application as well as tracking
+//! various life-cycle events and synchronizing with the main JVM thread.
+//!
+//! Winit uses the [android-activity](https://docs.rs/android-activity/) as a
+//! glue crate (prior to `0.28` it used
+//! [ndk-glue](https://github.com/rust-windowing/android-ndk-rs/tree/master/ndk-glue)).
+//!
+//! The version of the glue crate that your application depends on _must_ match the
+//! version that Winit depends on because the glue crate is responsible for your
+//! application's main entry point. If Cargo resolves multiple versions, they will
+//! clash.
+//!
+//! `winit` glue compatibility table:
+//!
+//! | winit |       ndk-glue               |
+//! | :---: | :--------------------------: |
+//! | 0.30  | `android-activity = "0.6"`   |
+//! | 0.29  | `android-activity = "0.5"`   |
+//! | 0.28  | `android-activity = "0.4"`   |
+//! | 0.27  | `ndk-glue = "0.7"`           |
+//! | 0.26  | `ndk-glue = "0.5"`           |
+//! | 0.25  | `ndk-glue = "0.3"`           |
+//! | 0.24  | `ndk-glue = "0.2"`           |
+//!
+//! The recommended way to avoid a conflict with the glue version is to avoid explicitly
+//! depending on the `android-activity` crate, and instead consume the API that
+//! is re-exported by Winit under `winit::platform::android::activity::*`
+//!
+//! Running on an Android device needs a dynamic system library. Add this to Cargo.toml:
+//!
+//! ```toml
+//! [lib]
+//! name = "main"
+//! crate-type = ["cdylib"]
+//! ```
+//!
+//! All Android applications are based on an `Activity` subclass, and the
+//! `android-activity` crate is designed to support different choices for this base
+//! class. Your application _must_ specify the base class it needs via a feature flag:
+//!
+//! | Base Class       | Feature Flag      |  Notes  |
+//! | :--------------: | :---------------: | :-----: |
+//! | `NativeActivity` | `android-native-activity` | Built-in to Android - it is possible to use without compiling any Java or Kotlin code. Java or Kotlin code may be needed to subclass `NativeActivity` to access some platform features. It does not derive from the [`AndroidAppCompat`] base class.|
+//! | [`GameActivity`] | `android-game-activity`   | Derives from [`AndroidAppCompat`], a defacto standard `Activity` base class that helps support a wider range of Android versions. Requires a build system that can compile Java or Kotlin and fetch Android dependencies from a [Maven repository][agdk_jetpack] (or link with an embedded [release][agdk_releases] of [`GameActivity`]) |
+//!
+//! [`GameActivity`]: https://developer.android.com/games/agdk/game-activity
+//! [`GameTextInput`]: https://developer.android.com/games/agdk/add-support-for-text-input
+//! [`AndroidAppCompat`]: https://developer.android.com/reference/androidx/appcompat/app/AppCompatActivity
+//! [agdk_jetpack]: https://developer.android.com/jetpack/androidx/releases/games
+//! [agdk_releases]: https://developer.android.com/games/agdk/download#agdk-libraries
+//! [Gradle]: https://developer.android.com/studio/build
+//!
+//! For more details, refer to these `android-activity` [example applications](https://github.com/rust-mobile/android-activity/tree/main/examples).
+//!
+//! ## Converting from `ndk-glue` to `android-activity`
+//!
+//! If your application is currently based on `NativeActivity` via the `ndk-glue` crate and building
+//! with `cargo apk`, then the minimal changes would be:
+//! 1. Remove `ndk-glue` from your `Cargo.toml`
+//! 2. Enable the `"android-native-activity"` feature for Winit: `winit = { version = "0.30.13",
+//!    features = [ "android-native-activity" ] }`
+//! 3. Add an `android_main` entrypoint (as above), instead of using the '`[ndk_glue::main]` proc
+//!    macro from `ndk-macros` (optionally add a dependency on `android_logger` and initialize
+//!    logging as above).
+//! 4. Pass a clone of the `AndroidApp` that your application receives to Winit when building your
+//!    event loop (as shown above).
+
+use crate::event_loop::{ActiveEventLoop, EventLoop, EventLoopBuilder};
+use crate::window::{Window, WindowAttributes};
+
+use self::activity::{AndroidApp, ConfigurationRef, Rect};
+
+/// Additional methods on [`EventLoop`] that are specific to Android.
+pub trait EventLoopExtAndroid {
+    /// Get the [`AndroidApp`] which was used to create this event loop.
+    fn android_app(&self) -> &AndroidApp;
+}
+
+impl<T> EventLoopExtAndroid for EventLoop<T> {
+    fn android_app(&self) -> &AndroidApp {
+        &self.event_loop.android_app
+    }
+}
+
+/// Additional methods on [`ActiveEventLoop`] that are specific to Android.
+pub trait ActiveEventLoopExtAndroid {
+    /// Get the [`AndroidApp`] which was used to create this event loop.
+    fn android_app(&self) -> &AndroidApp;
+}
+
+/// Additional methods on [`Window`] that are specific to Android.
+pub trait WindowExtAndroid {
+    fn content_rect(&self) -> Rect;
+
+    fn config(&self) -> ConfigurationRef;
+}
+
+impl WindowExtAndroid for Window {
+    fn content_rect(&self) -> Rect {
+        self.window.content_rect()
+    }
+
+    fn config(&self) -> ConfigurationRef {
+        self.window.config()
+    }
+}
+
+impl ActiveEventLoopExtAndroid for ActiveEventLoop {
+    fn android_app(&self) -> &AndroidApp {
+        &self.p.app
+    }
+}
+
+/// Additional methods on [`WindowAttributes`] that are specific to Android.
+pub trait WindowAttributesExtAndroid {}
+
+impl WindowAttributesExtAndroid for WindowAttributes {}
+
+pub trait EventLoopBuilderExtAndroid {
+    /// Associates the [`AndroidApp`] that was passed to `android_main()` with the event loop
+    ///
+    /// This must be called on Android since the [`AndroidApp`] is not global state.
+    fn with_android_app(&mut self, app: AndroidApp) -> &mut Self;
+
+    /// Calling this will mark the volume keys to be manually handled by the application
+    ///
+    /// Default is to let the operating system handle the volume keys
+    fn handle_volume_keys(&mut self) -> &mut Self;
+}
+
+impl<T> EventLoopBuilderExtAndroid for EventLoopBuilder<T> {
+    fn with_android_app(&mut self, app: AndroidApp) -> &mut Self {
+        self.platform_specific.android_app = Some(app);
+        self
+    }
+
+    fn handle_volume_keys(&mut self) -> &mut Self {
+        self.platform_specific.ignore_volume_keys = false;
+        self
+    }
+}
+
+/// Re-export of the `android_activity` API
+///
+/// Winit re-exports the `android_activity` API for convenience so that most
+/// applications can rely on the Winit crate to resolve the required version of
+/// `android_activity` and avoid any chance of a conflict between Winit and the
+/// application crate.
+///
+/// Unlike most libraries there can only be a single implementation
+/// of the `android_activity` glue crate linked with an application because
+/// it is responsible for the application's `android_main()` entry point.
+///
+/// Since Winit depends on a specific version of `android_activity` the simplest
+/// way to avoid creating a conflict is for applications to avoid explicitly
+/// depending on the `android_activity` crate, and instead consume the API that
+/// is re-exported by Winit.
+///
+/// For compatibility applications should then import the [`AndroidApp`] type for
+/// their `android_main(app: AndroidApp)` function like:
+/// ```rust
+/// #[cfg(target_os = "android")]
+/// use winit::platform::android::activity::AndroidApp;
+/// ```
+pub mod activity {
+    // We enable the `"native-activity"` feature just so that we can build the
+    // docs, but it'll be very confusing for users to see the docs with that
+    // feature enabled, so we avoid inlining it so that they're forced to view
+    // it on the crate's own docs.rs page.
+    #[doc(no_inline)]
+    #[cfg(android_platform)]
+    pub use android_activity::*;
+
+    #[cfg(not(android_platform))]
+    #[doc(hidden)]
+    pub struct Rect;
+    #[cfg(not(android_platform))]
+    #[doc(hidden)]
+    pub struct ConfigurationRef;
+    #[cfg(not(android_platform))]
+    #[doc(hidden)]
+    pub struct AndroidApp;
+}
diff --git a/vendor/winit/src/platform/ios.rs b/vendor/winit/src/platform/ios.rs
new file mode 100644
index 00000000..6e628768
--- /dev/null
+++ b/vendor/winit/src/platform/ios.rs
@@ -0,0 +1,435 @@
+//! # iOS / UIKit
+//!
+//! Winit has an OS requirement of iOS 8 or higher, and is regularly tested on
+//! iOS 9.3.
+//!
+//! ## Window initialization
+//!
+//! iOS's main `UIApplicationMain` does some init work that's required by all
+//! UI-related code (see issue [#1705]). It is best to create your windows
+//! inside [`ApplicationHandler::resumed`].
+//!
+//! [#1705]: https://github.com/rust-windowing/winit/issues/1705
+//! [`ApplicationHandler::resumed`]: crate::application::ApplicationHandler::resumed
+//!
+//! ## Building app
+//!
+//! To build ios app you will need rustc built for this targets:
+//!
+//!  - armv7-apple-ios
+//!  - armv7s-apple-ios
+//!  - i386-apple-ios
+//!  - aarch64-apple-ios
+//!  - x86_64-apple-ios
+//!
+//! Then
+//!
+//! ```
+//! cargo build --target=...
+//! ```
+//! The simplest way to integrate your app into xcode environment is to build it
+//! as a static library. Wrap your main function and export it.
+//!
+//! ```rust, ignore
+//! #[no_mangle]
+//! pub extern fn start_winit_app() {
+//!     start_inner()
+//! }
+//!
+//! fn start_inner() {
+//!    ...
+//! }
+//! ```
+//!
+//! Compile project and then drag resulting .a into Xcode project. Add winit.h to xcode.
+//!
+//! ```ignore
+//! void start_winit_app();
+//! ```
+//!
+//! Use start_winit_app inside your xcode's main function.
+//!
+//!
+//! ## App lifecycle and events
+//!
+//! iOS environment is very different from other platforms and you must be very
+//! careful with it's events. Familiarize yourself with
+//! [app lifecycle](https://developer.apple.com/library/ios/documentation/UIKit/Reference/UIApplicationDelegate_Protocol/).
+//!
+//! This is how those event are represented in winit:
+//!
+//!  - applicationDidBecomeActive is Resumed
+//!  - applicationWillResignActive is Suspended
+//!  - applicationWillTerminate is LoopExiting
+//!
+//! Keep in mind that after LoopExiting event is received every attempt to draw with
+//! opengl will result in segfault.
+//!
+//! Also note that app may not receive the LoopExiting event if suspended; it might be SIGKILL'ed.
+//!
+//! ## Custom `UIApplicationDelegate`
+//!
+//! Winit usually handles everything related to the lifecycle events of the application. Sometimes,
+//! though, you might want to access some of the more niche stuff that [the application
+//! delegate][app-delegate] provides. This functionality is not exposed directly in Winit, since it
+//! would increase the API surface by quite a lot. Instead, Winit guarantees that it will not
+//! register an application delegate, so you can set up a custom one in a nib file instead.
+//!
+//! [app-delegate]: https://developer.apple.com/documentation/uikit/uiapplicationdelegate?language=objc
+
+use std::os::raw::c_void;
+
+use crate::event_loop::EventLoop;
+use crate::monitor::{MonitorHandle, VideoModeHandle};
+use crate::window::{Window, WindowAttributes};
+
+/// Additional methods on [`EventLoop`] that are specific to iOS.
+pub trait EventLoopExtIOS {
+    /// Returns the [`Idiom`] (phone/tablet/tv/etc) for the current device.
+    fn idiom(&self) -> Idiom;
+}
+
+impl<T: 'static> EventLoopExtIOS for EventLoop<T> {
+    fn idiom(&self) -> Idiom {
+        self.event_loop.idiom()
+    }
+}
+
+/// Additional methods on [`Window`] that are specific to iOS.
+pub trait WindowExtIOS {
+    /// Sets the [`contentScaleFactor`] of the underlying [`UIWindow`] to `scale_factor`.
+    ///
+    /// The default value is device dependent, and it's recommended GLES or Metal applications set
+    /// this to [`MonitorHandle::scale_factor()`].
+    ///
+    /// [`UIWindow`]: https://developer.apple.com/documentation/uikit/uiwindow?language=objc
+    /// [`contentScaleFactor`]: https://developer.apple.com/documentation/uikit/uiview/1622657-contentscalefactor?language=objc
+    fn set_scale_factor(&self, scale_factor: f64);
+
+    /// Sets the valid orientations for the [`Window`].
+    ///
+    /// The default value is [`ValidOrientations::LandscapeAndPortrait`].
+    ///
+    /// This changes the value returned by
+    /// [`-[UIViewController supportedInterfaceOrientations]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621435-supportedinterfaceorientations?language=objc),
+    /// and then calls
+    /// [`-[UIViewController attemptRotationToDeviceOrientation]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621400-attemptrotationtodeviceorientati?language=objc).
+    fn set_valid_orientations(&self, valid_orientations: ValidOrientations);
+
+    /// Sets whether the [`Window`] prefers the home indicator hidden.
+    ///
+    /// The default is to prefer showing the home indicator.
+    ///
+    /// This changes the value returned by
+    /// [`-[UIViewController prefersHomeIndicatorAutoHidden]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/2887510-prefershomeindicatorautohidden?language=objc),
+    /// and then calls
+    /// [`-[UIViewController setNeedsUpdateOfHomeIndicatorAutoHidden]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/2887509-setneedsupdateofhomeindicatoraut?language=objc).
+    ///
+    /// This only has an effect on iOS 11.0+.
+    fn set_prefers_home_indicator_hidden(&self, hidden: bool);
+
+    /// Sets the screen edges for which the system gestures will take a lower priority than the
+    /// application's touch handling.
+    ///
+    /// This changes the value returned by
+    /// [`-[UIViewController preferredScreenEdgesDeferringSystemGestures]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/2887512-preferredscreenedgesdeferringsys?language=objc),
+    /// and then calls
+    /// [`-[UIViewController setNeedsUpdateOfScreenEdgesDeferringSystemGestures]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/2887507-setneedsupdateofscreenedgesdefer?language=objc).
+    ///
+    /// This only has an effect on iOS 11.0+.
+    fn set_preferred_screen_edges_deferring_system_gestures(&self, edges: ScreenEdge);
+
+    /// Sets whether the [`Window`] prefers the status bar hidden.
+    ///
+    /// The default is to prefer showing the status bar.
+    ///
+    /// This sets the value of the
+    /// [`prefersStatusBarHidden`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621440-prefersstatusbarhidden?language=objc)
+    /// property.
+    ///
+    /// [`setNeedsStatusBarAppearanceUpdate()`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621354-setneedsstatusbarappearanceupdat?language=objc)
+    /// is also called for you.
+    fn set_prefers_status_bar_hidden(&self, hidden: bool);
+
+    /// Sets the preferred status bar style for the [`Window`].
+    ///
+    /// The default is system-defined.
+    ///
+    /// This sets the value of the
+    /// [`preferredStatusBarStyle`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621416-preferredstatusbarstyle?language=objc)
+    /// property.
+    ///
+    /// [`setNeedsStatusBarAppearanceUpdate()`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621354-setneedsstatusbarappearanceupdat?language=objc)
+    /// is also called for you.
+    fn set_preferred_status_bar_style(&self, status_bar_style: StatusBarStyle);
+
+    /// Sets whether the [`Window`] should recognize pinch gestures.
+    ///
+    /// The default is to not recognize gestures.
+    fn recognize_pinch_gesture(&self, should_recognize: bool);
+
+    /// Sets whether the [`Window`] should recognize pan gestures.
+    ///
+    /// The default is to not recognize gestures.
+    /// Installs [`UIPanGestureRecognizer`](https://developer.apple.com/documentation/uikit/uipangesturerecognizer) onto view
+    ///
+    /// Set the minimum number of touches required: [`minimumNumberOfTouches`](https://developer.apple.com/documentation/uikit/uipangesturerecognizer/1621208-minimumnumberoftouches)
+    ///
+    /// Set the maximum number of touches recognized: [`maximumNumberOfTouches`](https://developer.apple.com/documentation/uikit/uipangesturerecognizer/1621208-maximumnumberoftouches)
+    fn recognize_pan_gesture(
+        &self,
+        should_recognize: bool,
+        minimum_number_of_touches: u8,
+        maximum_number_of_touches: u8,
+    );
+
+    /// Sets whether the [`Window`] should recognize double tap gestures.
+    ///
+    /// The default is to not recognize gestures.
+    fn recognize_doubletap_gesture(&self, should_recognize: bool);
+
+    /// Sets whether the [`Window`] should recognize rotation gestures.
+    ///
+    /// The default is to not recognize gestures.
+    fn recognize_rotation_gesture(&self, should_recognize: bool);
+}
+
+impl WindowExtIOS for Window {
+    #[inline]
+    fn set_scale_factor(&self, scale_factor: f64) {
+        self.window.maybe_queue_on_main(move |w| w.set_scale_factor(scale_factor))
+    }
+
+    #[inline]
+    fn set_valid_orientations(&self, valid_orientations: ValidOrientations) {
+        self.window.maybe_queue_on_main(move |w| w.set_valid_orientations(valid_orientations))
+    }
+
+    #[inline]
+    fn set_prefers_home_indicator_hidden(&self, hidden: bool) {
+        self.window.maybe_queue_on_main(move |w| w.set_prefers_home_indicator_hidden(hidden))
+    }
+
+    #[inline]
+    fn set_preferred_screen_edges_deferring_system_gestures(&self, edges: ScreenEdge) {
+        self.window.maybe_queue_on_main(move |w| {
+            w.set_preferred_screen_edges_deferring_system_gestures(edges)
+        })
+    }
+
+    #[inline]
+    fn set_prefers_status_bar_hidden(&self, hidden: bool) {
+        self.window.maybe_queue_on_main(move |w| w.set_prefers_status_bar_hidden(hidden))
+    }
+
+    #[inline]
+    fn set_preferred_status_bar_style(&self, status_bar_style: StatusBarStyle) {
+        self.window.maybe_queue_on_main(move |w| w.set_preferred_status_bar_style(status_bar_style))
+    }
+
+    #[inline]
+    fn recognize_pinch_gesture(&self, should_recognize: bool) {
+        self.window.maybe_queue_on_main(move |w| w.recognize_pinch_gesture(should_recognize));
+    }
+
+    #[inline]
+    fn recognize_pan_gesture(
+        &self,
+        should_recognize: bool,
+        minimum_number_of_touches: u8,
+        maximum_number_of_touches: u8,
+    ) {
+        self.window.maybe_queue_on_main(move |w| {
+            w.recognize_pan_gesture(
+                should_recognize,
+                minimum_number_of_touches,
+                maximum_number_of_touches,
+            )
+        });
+    }
+
+    #[inline]
+    fn recognize_doubletap_gesture(&self, should_recognize: bool) {
+        self.window.maybe_queue_on_main(move |w| w.recognize_doubletap_gesture(should_recognize));
+    }
+
+    #[inline]
+    fn recognize_rotation_gesture(&self, should_recognize: bool) {
+        self.window.maybe_queue_on_main(move |w| w.recognize_rotation_gesture(should_recognize));
+    }
+}
+
+/// Additional methods on [`WindowAttributes`] that are specific to iOS.
+pub trait WindowAttributesExtIOS {
+    /// Sets the [`contentScaleFactor`] of the underlying [`UIWindow`] to `scale_factor`.
+    ///
+    /// The default value is device dependent, and it's recommended GLES or Metal applications set
+    /// this to [`MonitorHandle::scale_factor()`].
+    ///
+    /// [`UIWindow`]: https://developer.apple.com/documentation/uikit/uiwindow?language=objc
+    /// [`contentScaleFactor`]: https://developer.apple.com/documentation/uikit/uiview/1622657-contentscalefactor?language=objc
+    fn with_scale_factor(self, scale_factor: f64) -> Self;
+
+    /// Sets the valid orientations for the [`Window`].
+    ///
+    /// The default value is [`ValidOrientations::LandscapeAndPortrait`].
+    ///
+    /// This sets the initial value returned by
+    /// [`-[UIViewController supportedInterfaceOrientations]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621435-supportedinterfaceorientations?language=objc).
+    fn with_valid_orientations(self, valid_orientations: ValidOrientations) -> Self;
+
+    /// Sets whether the [`Window`] prefers the home indicator hidden.
+    ///
+    /// The default is to prefer showing the home indicator.
+    ///
+    /// This sets the initial value returned by
+    /// [`-[UIViewController prefersHomeIndicatorAutoHidden]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/2887510-prefershomeindicatorautohidden?language=objc).
+    ///
+    /// This only has an effect on iOS 11.0+.
+    fn with_prefers_home_indicator_hidden(self, hidden: bool) -> Self;
+
+    /// Sets the screen edges for which the system gestures will take a lower priority than the
+    /// application's touch handling.
+    ///
+    /// This sets the initial value returned by
+    /// [`-[UIViewController preferredScreenEdgesDeferringSystemGestures]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/2887512-preferredscreenedgesdeferringsys?language=objc).
+    ///
+    /// This only has an effect on iOS 11.0+.
+    fn with_preferred_screen_edges_deferring_system_gestures(self, edges: ScreenEdge) -> Self;
+
+    /// Sets whether the [`Window`] prefers the status bar hidden.
+    ///
+    /// The default is to prefer showing the status bar.
+    ///
+    /// This sets the initial value returned by
+    /// [`-[UIViewController prefersStatusBarHidden]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621440-prefersstatusbarhidden?language=objc).
+    fn with_prefers_status_bar_hidden(self, hidden: bool) -> Self;
+
+    /// Sets the style of the [`Window`]'s status bar.
+    ///
+    /// The default is system-defined.
+    ///
+    /// This sets the initial value returned by
+    /// [`-[UIViewController preferredStatusBarStyle]`](https://developer.apple.com/documentation/uikit/uiviewcontroller/1621416-preferredstatusbarstyle?language=objc),
+    fn with_preferred_status_bar_style(self, status_bar_style: StatusBarStyle) -> Self;
+}
+
+impl WindowAttributesExtIOS for WindowAttributes {
+    #[inline]
+    fn with_scale_factor(mut self, scale_factor: f64) -> Self {
+        self.platform_specific.scale_factor = Some(scale_factor);
+        self
+    }
+
+    #[inline]
+    fn with_valid_orientations(mut self, valid_orientations: ValidOrientations) -> Self {
+        self.platform_specific.valid_orientations = valid_orientations;
+        self
+    }
+
+    #[inline]
+    fn with_prefers_home_indicator_hidden(mut self, hidden: bool) -> Self {
+        self.platform_specific.prefers_home_indicator_hidden = hidden;
+        self
+    }
+
+    #[inline]
+    fn with_preferred_screen_edges_deferring_system_gestures(mut self, edges: ScreenEdge) -> Self {
+        self.platform_specific.preferred_screen_edges_deferring_system_gestures = edges;
+        self
+    }
+
+    #[inline]
+    fn with_prefers_status_bar_hidden(mut self, hidden: bool) -> Self {
+        self.platform_specific.prefers_status_bar_hidden = hidden;
+        self
+    }
+
+    #[inline]
+    fn with_preferred_status_bar_style(mut self, status_bar_style: StatusBarStyle) -> Self {
+        self.platform_specific.preferred_status_bar_style = status_bar_style;
+        self
+    }
+}
+
+/// Additional methods on [`MonitorHandle`] that are specific to iOS.
+pub trait MonitorHandleExtIOS {
+    /// Returns a pointer to the [`UIScreen`] that is used by this monitor.
+    ///
+    /// [`UIScreen`]: https://developer.apple.com/documentation/uikit/uiscreen?language=objc
+    fn ui_screen(&self) -> *mut c_void;
+
+    /// Returns the preferred [`VideoModeHandle`] for this monitor.
+    ///
+    /// This translates to a call to [`-[UIScreen preferredMode]`](https://developer.apple.com/documentation/uikit/uiscreen/1617823-preferredmode?language=objc).
+    fn preferred_video_mode(&self) -> VideoModeHandle;
+}
+
+impl MonitorHandleExtIOS for MonitorHandle {
+    #[inline]
+    fn ui_screen(&self) -> *mut c_void {
+        // SAFETY: The marker is only used to get the pointer of the screen
+        let mtm = unsafe { objc2_foundation::MainThreadMarker::new_unchecked() };
+        objc2::rc::Retained::as_ptr(self.inner.ui_screen(mtm)) as *mut c_void
+    }
+
+    #[inline]
+    fn preferred_video_mode(&self) -> VideoModeHandle {
+        VideoModeHandle { video_mode: self.inner.preferred_video_mode() }
+    }
+}
+
+/// Valid orientations for a particular [`Window`].
+#[derive(Default, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum ValidOrientations {
+    /// Excludes `PortraitUpsideDown` on iphone
+    #[default]
+    LandscapeAndPortrait,
+
+    Landscape,
+
+    /// Excludes `PortraitUpsideDown` on iphone
+    Portrait,
+}
+
+/// The device [idiom].
+///
+/// [idiom]: https://developer.apple.com/documentation/uikit/uidevice/1620037-userinterfaceidiom?language=objc
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Idiom {
+    Unspecified,
+
+    /// iPhone and iPod touch.
+    Phone,
+
+    /// iPad.
+    Pad,
+
+    /// tvOS and Apple TV.
+    TV,
+    CarPlay,
+}
+
+bitflags::bitflags! {
+    /// The [edges] of a screen.
+    ///
+    /// [edges]: https://developer.apple.com/documentation/uikit/uirectedge?language=objc
+    #[derive(Default, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    pub struct ScreenEdge: u8 {
+        const NONE   = 0;
+        const TOP    = 1 << 0;
+        const LEFT   = 1 << 1;
+        const BOTTOM = 1 << 2;
+        const RIGHT  = 1 << 3;
+        const ALL = ScreenEdge::TOP.bits() | ScreenEdge::LEFT.bits()
+            | ScreenEdge::BOTTOM.bits() | ScreenEdge::RIGHT.bits();
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum StatusBarStyle {
+    #[default]
+    Default,
+    LightContent,
+    DarkContent,
+}
diff --git a/vendor/winit/src/platform/macos.rs b/vendor/winit/src/platform/macos.rs
new file mode 100644
index 00000000..30623b01
--- /dev/null
+++ b/vendor/winit/src/platform/macos.rs
@@ -0,0 +1,531 @@
+//! # macOS / AppKit
+//!
+//! Winit has an OS requirement of macOS 10.11 or higher (same as Rust
+//! itself), and is regularly tested on macOS 10.14.
+//!
+//! ## Window initialization
+//!
+//! A lot of functionality expects the application to be ready before you
+//! start doing anything; this includes creating windows, fetching monitors,
+//! drawing, and so on, see issues [#2238], [#2051] and [#2087].
+//!
+//! If you encounter problems, you should try doing your initialization inside
+//! [`ApplicationHandler::resumed`].
+//!
+//! [#2238]: https://github.com/rust-windowing/winit/issues/2238
+//! [#2051]: https://github.com/rust-windowing/winit/issues/2051
+//! [#2087]: https://github.com/rust-windowing/winit/issues/2087
+//! [`ApplicationHandler::resumed`]: crate::application::ApplicationHandler::resumed
+//!
+//! ## Custom `NSApplicationDelegate`
+//!
+//! Winit usually handles everything related to the lifecycle events of the application. Sometimes,
+//! though, you might want to do more niche stuff, such as [handle when the user re-activates the
+//! application][reopen]. Such functionality is not exposed directly in Winit, since it would
+//! increase the API surface by quite a lot.
+//!
+//! [reopen]: https://developer.apple.com/documentation/appkit/nsapplicationdelegate/1428638-applicationshouldhandlereopen?language=objc
+//!
+//! Instead, Winit guarantees that it will not register an application delegate, so the solution is
+//! to register your own application delegate, as outlined in the following example (see
+//! `objc2-app-kit` for more detailed information).
+#![cfg_attr(target_os = "macos", doc = "```")]
+#![cfg_attr(not(target_os = "macos"), doc = "```ignore")]
+//! use objc2::rc::Retained;
+//! use objc2::runtime::ProtocolObject;
+//! use objc2::{declare_class, msg_send_id, mutability, ClassType, DeclaredClass};
+//! use objc2_app_kit::{NSApplication, NSApplicationDelegate};
+//! use objc2_foundation::{NSArray, NSURL, MainThreadMarker, NSObject, NSObjectProtocol};
+//! use winit::event_loop::EventLoop;
+//!
+//! declare_class!(
+//!     struct AppDelegate;
+//!
+//!     unsafe impl ClassType for AppDelegate {
+//!         type Super = NSObject;
+//!         type Mutability = mutability::MainThreadOnly;
+//!         const NAME: &'static str = "MyAppDelegate";
+//!     }
+//!
+//!     impl DeclaredClass for AppDelegate {}
+//!
+//!     unsafe impl NSObjectProtocol for AppDelegate {}
+//!
+//!     unsafe impl NSApplicationDelegate for AppDelegate {
+//!         #[method(application:openURLs:)]
+//!         fn application_openURLs(&self, application: &NSApplication, urls: &NSArray<NSURL>) {
+//!             // Note: To specifically get `application:openURLs:` to work, you _might_
+//!             // have to bundle your application. This is not done in this example.
+//!             println!("open urls: {application:?}, {urls:?}");
+//!         }
+//!     }
+//! );
+//!
+//! impl AppDelegate {
+//!     fn new(mtm: MainThreadMarker) -> Retained<Self> {
+//!         unsafe { msg_send_id![super(mtm.alloc().set_ivars(())), init] }
+//!     }
+//! }
+//!
+//! fn main() -> Result<(), Box<dyn std::error::Error>> {
+//!     let event_loop = EventLoop::new()?;
+//!
+//!     let mtm = MainThreadMarker::new().unwrap();
+//!     let delegate = AppDelegate::new(mtm);
+//!     // Important: Call `sharedApplication` after `EventLoop::new`,
+//!     // doing it before is not yet supported.
+//!     let app = NSApplication::sharedApplication(mtm);
+//!     app.setDelegate(Some(ProtocolObject::from_ref(&*delegate)));
+//!
+//!     // event_loop.run_app(&mut my_app);
+//!     Ok(())
+//! }
+//! ```
+
+use std::os::raw::c_void;
+
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+
+use crate::event_loop::{ActiveEventLoop, EventLoopBuilder};
+use crate::monitor::MonitorHandle;
+use crate::window::{Window, WindowAttributes};
+
+/// Additional methods on [`Window`] that are specific to MacOS.
+pub trait WindowExtMacOS {
+    /// Returns whether or not the window is in simple fullscreen mode.
+    fn simple_fullscreen(&self) -> bool;
+
+    /// Toggles a fullscreen mode that doesn't require a new macOS space.
+    /// Returns a boolean indicating whether the transition was successful (this
+    /// won't work if the window was already in the native fullscreen).
+    ///
+    /// This is how fullscreen used to work on macOS in versions before Lion.
+    /// And allows the user to have a fullscreen window without using another
+    /// space or taking control over the entire monitor.
+    fn set_simple_fullscreen(&self, fullscreen: bool) -> bool;
+
+    /// Returns whether or not the window has shadow.
+    fn has_shadow(&self) -> bool;
+
+    /// Sets whether or not the window has shadow.
+    fn set_has_shadow(&self, has_shadow: bool);
+
+    /// Group windows together by using the same tabbing identifier.
+    ///
+    /// <https://developer.apple.com/documentation/appkit/nswindow/1644704-tabbingidentifier>
+    fn set_tabbing_identifier(&self, identifier: &str);
+
+    /// Returns the window's tabbing identifier.
+    fn tabbing_identifier(&self) -> String;
+
+    /// Select next tab.
+    fn select_next_tab(&self);
+
+    /// Select previous tab.
+    fn select_previous_tab(&self);
+
+    /// Select the tab with the given index.
+    ///
+    /// Will no-op when the index is out of bounds.
+    fn select_tab_at_index(&self, index: usize);
+
+    /// Get the number of tabs in the window tab group.
+    fn num_tabs(&self) -> usize;
+
+    /// Get the window's edit state.
+    ///
+    /// # Examples
+    ///
+    /// ```ignore
+    /// WindowEvent::CloseRequested => {
+    ///     if window.is_document_edited() {
+    ///         // Show the user a save pop-up or similar
+    ///     } else {
+    ///         // Close the window
+    ///         drop(window);
+    ///     }
+    /// }
+    /// ```
+    fn is_document_edited(&self) -> bool;
+
+    /// Put the window in a state which indicates a file save is required.
+    fn set_document_edited(&self, edited: bool);
+
+    /// Set option as alt behavior as described in [`OptionAsAlt`].
+    ///
+    /// This will ignore diacritical marks and accent characters from
+    /// being processed as received characters. Instead, the input
+    /// device's raw character will be placed in event queues with the
+    /// Alt modifier set.
+    fn set_option_as_alt(&self, option_as_alt: OptionAsAlt);
+
+    /// Getter for the [`WindowExtMacOS::set_option_as_alt`].
+    fn option_as_alt(&self) -> OptionAsAlt;
+
+    /// Disable the Menu Bar and Dock in Simple or Borderless Fullscreen mode. Useful for games.
+    /// The effect is applied when [`WindowExtMacOS::set_simple_fullscreen`] or
+    /// [`Window::set_fullscreen`] is called.
+    fn set_borderless_game(&self, borderless_game: bool);
+
+    /// Getter for the [`WindowExtMacOS::set_borderless_game`].
+    fn is_borderless_game(&self) -> bool;
+}
+
+impl WindowExtMacOS for Window {
+    #[inline]
+    fn simple_fullscreen(&self) -> bool {
+        self.window.maybe_wait_on_main(|w| w.simple_fullscreen())
+    }
+
+    #[inline]
+    fn set_simple_fullscreen(&self, fullscreen: bool) -> bool {
+        self.window.maybe_wait_on_main(move |w| w.set_simple_fullscreen(fullscreen))
+    }
+
+    #[inline]
+    fn has_shadow(&self) -> bool {
+        self.window.maybe_wait_on_main(|w| w.has_shadow())
+    }
+
+    #[inline]
+    fn set_has_shadow(&self, has_shadow: bool) {
+        self.window.maybe_queue_on_main(move |w| w.set_has_shadow(has_shadow))
+    }
+
+    #[inline]
+    fn set_tabbing_identifier(&self, identifier: &str) {
+        self.window.maybe_wait_on_main(|w| w.set_tabbing_identifier(identifier))
+    }
+
+    #[inline]
+    fn tabbing_identifier(&self) -> String {
+        self.window.maybe_wait_on_main(|w| w.tabbing_identifier())
+    }
+
+    #[inline]
+    fn select_next_tab(&self) {
+        self.window.maybe_queue_on_main(|w| w.select_next_tab())
+    }
+
+    #[inline]
+    fn select_previous_tab(&self) {
+        self.window.maybe_queue_on_main(|w| w.select_previous_tab())
+    }
+
+    #[inline]
+    fn select_tab_at_index(&self, index: usize) {
+        self.window.maybe_queue_on_main(move |w| w.select_tab_at_index(index))
+    }
+
+    #[inline]
+    fn num_tabs(&self) -> usize {
+        self.window.maybe_wait_on_main(|w| w.num_tabs())
+    }
+
+    #[inline]
+    fn is_document_edited(&self) -> bool {
+        self.window.maybe_wait_on_main(|w| w.is_document_edited())
+    }
+
+    #[inline]
+    fn set_document_edited(&self, edited: bool) {
+        self.window.maybe_queue_on_main(move |w| w.set_document_edited(edited))
+    }
+
+    #[inline]
+    fn set_option_as_alt(&self, option_as_alt: OptionAsAlt) {
+        self.window.maybe_queue_on_main(move |w| w.set_option_as_alt(option_as_alt))
+    }
+
+    #[inline]
+    fn option_as_alt(&self) -> OptionAsAlt {
+        self.window.maybe_wait_on_main(|w| w.option_as_alt())
+    }
+
+    #[inline]
+    fn set_borderless_game(&self, borderless_game: bool) {
+        self.window.maybe_wait_on_main(|w| w.set_borderless_game(borderless_game))
+    }
+
+    #[inline]
+    fn is_borderless_game(&self) -> bool {
+        self.window.maybe_wait_on_main(|w| w.is_borderless_game())
+    }
+}
+
+/// Corresponds to `NSApplicationActivationPolicy`.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum ActivationPolicy {
+    /// Corresponds to `NSApplicationActivationPolicyRegular`.
+    #[default]
+    Regular,
+
+    /// Corresponds to `NSApplicationActivationPolicyAccessory`.
+    Accessory,
+
+    /// Corresponds to `NSApplicationActivationPolicyProhibited`.
+    Prohibited,
+}
+
+/// Additional methods on [`WindowAttributes`] that are specific to MacOS.
+///
+/// **Note:** Properties dealing with the titlebar will be overwritten by the
+/// [`WindowAttributes::with_decorations`] method:
+/// - `with_titlebar_transparent`
+/// - `with_title_hidden`
+/// - `with_titlebar_hidden`
+/// - `with_titlebar_buttons_hidden`
+/// - `with_fullsize_content_view`
+pub trait WindowAttributesExtMacOS {
+    /// Enables click-and-drag behavior for the entire window, not just the titlebar.
+    fn with_movable_by_window_background(self, movable_by_window_background: bool) -> Self;
+    /// Makes the titlebar transparent and allows the content to appear behind it.
+    fn with_titlebar_transparent(self, titlebar_transparent: bool) -> Self;
+    /// Hides the window title.
+    fn with_title_hidden(self, title_hidden: bool) -> Self;
+    /// Hides the window titlebar.
+    fn with_titlebar_hidden(self, titlebar_hidden: bool) -> Self;
+    /// Hides the window titlebar buttons.
+    fn with_titlebar_buttons_hidden(self, titlebar_buttons_hidden: bool) -> Self;
+    /// Makes the window content appear behind the titlebar.
+    fn with_fullsize_content_view(self, fullsize_content_view: bool) -> Self;
+    fn with_disallow_hidpi(self, disallow_hidpi: bool) -> Self;
+    fn with_has_shadow(self, has_shadow: bool) -> Self;
+    /// Window accepts click-through mouse events.
+    fn with_accepts_first_mouse(self, accepts_first_mouse: bool) -> Self;
+    /// Defines the window tabbing identifier.
+    ///
+    /// <https://developer.apple.com/documentation/appkit/nswindow/1644704-tabbingidentifier>
+    fn with_tabbing_identifier(self, identifier: &str) -> Self;
+    /// Set how the <kbd>Option</kbd> keys are interpreted.
+    ///
+    /// See [`WindowExtMacOS::set_option_as_alt`] for details on what this means if set.
+    fn with_option_as_alt(self, option_as_alt: OptionAsAlt) -> Self;
+    /// See [`WindowExtMacOS::set_borderless_game`] for details on what this means if set.
+    fn with_borderless_game(self, borderless_game: bool) -> Self;
+}
+
+impl WindowAttributesExtMacOS for WindowAttributes {
+    #[inline]
+    fn with_movable_by_window_background(mut self, movable_by_window_background: bool) -> Self {
+        self.platform_specific.movable_by_window_background = movable_by_window_background;
+        self
+    }
+
+    #[inline]
+    fn with_titlebar_transparent(mut self, titlebar_transparent: bool) -> Self {
+        self.platform_specific.titlebar_transparent = titlebar_transparent;
+        self
+    }
+
+    #[inline]
+    fn with_titlebar_hidden(mut self, titlebar_hidden: bool) -> Self {
+        self.platform_specific.titlebar_hidden = titlebar_hidden;
+        self
+    }
+
+    #[inline]
+    fn with_titlebar_buttons_hidden(mut self, titlebar_buttons_hidden: bool) -> Self {
+        self.platform_specific.titlebar_buttons_hidden = titlebar_buttons_hidden;
+        self
+    }
+
+    #[inline]
+    fn with_title_hidden(mut self, title_hidden: bool) -> Self {
+        self.platform_specific.title_hidden = title_hidden;
+        self
+    }
+
+    #[inline]
+    fn with_fullsize_content_view(mut self, fullsize_content_view: bool) -> Self {
+        self.platform_specific.fullsize_content_view = fullsize_content_view;
+        self
+    }
+
+    #[inline]
+    fn with_disallow_hidpi(mut self, disallow_hidpi: bool) -> Self {
+        self.platform_specific.disallow_hidpi = disallow_hidpi;
+        self
+    }
+
+    #[inline]
+    fn with_has_shadow(mut self, has_shadow: bool) -> Self {
+        self.platform_specific.has_shadow = has_shadow;
+        self
+    }
+
+    #[inline]
+    fn with_accepts_first_mouse(mut self, accepts_first_mouse: bool) -> Self {
+        self.platform_specific.accepts_first_mouse = accepts_first_mouse;
+        self
+    }
+
+    #[inline]
+    fn with_tabbing_identifier(mut self, tabbing_identifier: &str) -> Self {
+        self.platform_specific.tabbing_identifier.replace(tabbing_identifier.to_string());
+        self
+    }
+
+    #[inline]
+    fn with_option_as_alt(mut self, option_as_alt: OptionAsAlt) -> Self {
+        self.platform_specific.option_as_alt = option_as_alt;
+        self
+    }
+
+    #[inline]
+    fn with_borderless_game(mut self, borderless_game: bool) -> Self {
+        self.platform_specific.borderless_game = borderless_game;
+        self
+    }
+}
+
+pub trait EventLoopBuilderExtMacOS {
+    /// Sets the activation policy for the application. If used, this will override
+    /// any relevant settings provided in the package manifest.
+    /// For instance, `with_activation_policy(ActivationPolicy::Regular)` will prevent
+    /// the application from running as an "agent", even if LSUIElement is set to true.
+    ///
+    /// If unused, the Winit will honor the package manifest.
+    ///
+    /// # Example
+    ///
+    /// Set the activation policy to "accessory".
+    ///
+    /// ```
+    /// use winit::event_loop::EventLoopBuilder;
+    /// #[cfg(target_os = "macos")]
+    /// use winit::platform::macos::{ActivationPolicy, EventLoopBuilderExtMacOS};
+    ///
+    /// let mut builder = EventLoopBuilder::new();
+    /// #[cfg(target_os = "macos")]
+    /// builder.with_activation_policy(ActivationPolicy::Accessory);
+    /// # if false { // We can't test this part
+    /// let event_loop = builder.build();
+    /// # }
+    /// ```
+    fn with_activation_policy(&mut self, activation_policy: ActivationPolicy) -> &mut Self;
+
+    /// Used to control whether a default menubar menu is created.
+    ///
+    /// Menu creation is enabled by default.
+    ///
+    /// # Example
+    ///
+    /// Disable creating a default menubar.
+    ///
+    /// ```
+    /// use winit::event_loop::EventLoopBuilder;
+    /// #[cfg(target_os = "macos")]
+    /// use winit::platform::macos::EventLoopBuilderExtMacOS;
+    ///
+    /// let mut builder = EventLoopBuilder::new();
+    /// #[cfg(target_os = "macos")]
+    /// builder.with_default_menu(false);
+    /// # if false { // We can't test this part
+    /// let event_loop = builder.build();
+    /// # }
+    /// ```
+    fn with_default_menu(&mut self, enable: bool) -> &mut Self;
+
+    /// Used to prevent the application from automatically activating when launched if
+    /// another application is already active.
+    ///
+    /// The default behavior is to ignore other applications and activate when launched.
+    fn with_activate_ignoring_other_apps(&mut self, ignore: bool) -> &mut Self;
+}
+
+impl<T> EventLoopBuilderExtMacOS for EventLoopBuilder<T> {
+    #[inline]
+    fn with_activation_policy(&mut self, activation_policy: ActivationPolicy) -> &mut Self {
+        self.platform_specific.activation_policy = Some(activation_policy);
+        self
+    }
+
+    #[inline]
+    fn with_default_menu(&mut self, enable: bool) -> &mut Self {
+        self.platform_specific.default_menu = enable;
+        self
+    }
+
+    #[inline]
+    fn with_activate_ignoring_other_apps(&mut self, ignore: bool) -> &mut Self {
+        self.platform_specific.activate_ignoring_other_apps = ignore;
+        self
+    }
+}
+
+/// Additional methods on [`MonitorHandle`] that are specific to MacOS.
+pub trait MonitorHandleExtMacOS {
+    /// Returns the identifier of the monitor for Cocoa.
+    fn native_id(&self) -> u32;
+    /// Returns a pointer to the NSScreen representing this monitor.
+    fn ns_screen(&self) -> Option<*mut c_void>;
+}
+
+impl MonitorHandleExtMacOS for MonitorHandle {
+    #[inline]
+    fn native_id(&self) -> u32 {
+        self.inner.native_identifier()
+    }
+
+    fn ns_screen(&self) -> Option<*mut c_void> {
+        // SAFETY: We only use the marker to get a pointer
+        let mtm = unsafe { objc2_foundation::MainThreadMarker::new_unchecked() };
+        self.inner.ns_screen(mtm).map(|s| objc2::rc::Retained::as_ptr(&s) as _)
+    }
+}
+
+/// Additional methods on [`ActiveEventLoop`] that are specific to macOS.
+pub trait ActiveEventLoopExtMacOS {
+    /// Hide the entire application. In most applications this is typically triggered with
+    /// Command-H.
+    fn hide_application(&self);
+    /// Hide the other applications. In most applications this is typically triggered with
+    /// Command+Option-H.
+    fn hide_other_applications(&self);
+    /// Set whether the system can automatically organize windows into tabs.
+    ///
+    /// <https://developer.apple.com/documentation/appkit/nswindow/1646657-allowsautomaticwindowtabbing>
+    fn set_allows_automatic_window_tabbing(&self, enabled: bool);
+    /// Returns whether the system can automatically organize windows into tabs.
+    fn allows_automatic_window_tabbing(&self) -> bool;
+}
+
+impl ActiveEventLoopExtMacOS for ActiveEventLoop {
+    fn hide_application(&self) {
+        self.p.hide_application()
+    }
+
+    fn hide_other_applications(&self) {
+        self.p.hide_other_applications()
+    }
+
+    fn set_allows_automatic_window_tabbing(&self, enabled: bool) {
+        self.p.set_allows_automatic_window_tabbing(enabled);
+    }
+
+    fn allows_automatic_window_tabbing(&self) -> bool {
+        self.p.allows_automatic_window_tabbing()
+    }
+}
+
+/// Option as alt behavior.
+///
+/// The default is `None`.
+#[derive(Default, Debug, Clone, Copy, PartialEq, Eq)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum OptionAsAlt {
+    /// The left `Option` key is treated as `Alt`.
+    OnlyLeft,
+
+    /// The right `Option` key is treated as `Alt`.
+    OnlyRight,
+
+    /// Both `Option` keys are treated as `Alt`.
+    Both,
+
+    /// No special handling is applied for `Option` key.
+    #[default]
+    None,
+}
diff --git a/vendor/winit/src/platform/mod.rs b/vendor/winit/src/platform/mod.rs
new file mode 100644
index 00000000..4f59303e
--- /dev/null
+++ b/vendor/winit/src/platform/mod.rs
@@ -0,0 +1,55 @@
+//! Contains traits with platform-specific methods in them.
+//!
+//! Only the modules corresponding to the platform you're compiling to will be available.
+
+#[cfg(any(android_platform, docsrs))]
+pub mod android;
+#[cfg(any(ios_platform, docsrs))]
+pub mod ios;
+#[cfg(any(macos_platform, docsrs))]
+pub mod macos;
+#[cfg(any(orbital_platform, docsrs))]
+pub mod orbital;
+#[cfg(any(x11_platform, wayland_platform, docsrs))]
+pub mod startup_notify;
+#[cfg(any(wayland_platform, docsrs))]
+pub mod wayland;
+#[cfg(any(web_platform, docsrs))]
+pub mod web;
+#[cfg(any(windows_platform, docsrs))]
+pub mod windows;
+#[cfg(any(x11_platform, docsrs))]
+pub mod x11;
+
+#[cfg(any(
+    windows_platform,
+    macos_platform,
+    android_platform,
+    x11_platform,
+    wayland_platform,
+    docsrs,
+))]
+pub mod run_on_demand;
+
+#[cfg(any(
+    windows_platform,
+    macos_platform,
+    android_platform,
+    x11_platform,
+    wayland_platform,
+    docsrs,
+))]
+pub mod pump_events;
+
+#[cfg(any(
+    windows_platform,
+    macos_platform,
+    x11_platform,
+    wayland_platform,
+    orbital_platform,
+    docsrs
+))]
+pub mod modifier_supplement;
+
+#[cfg(any(windows_platform, macos_platform, x11_platform, wayland_platform, docsrs))]
+pub mod scancode;
diff --git a/vendor/winit/src/platform/modifier_supplement.rs b/vendor/winit/src/platform/modifier_supplement.rs
new file mode 100644
index 00000000..b1db7345
--- /dev/null
+++ b/vendor/winit/src/platform/modifier_supplement.rs
@@ -0,0 +1,35 @@
+use crate::event::KeyEvent;
+use crate::keyboard::Key;
+
+/// Additional methods for the `KeyEvent` which cannot be implemented on all
+/// platforms.
+pub trait KeyEventExtModifierSupplement {
+    /// Identical to `KeyEvent::text` but this is affected by <kbd>Ctrl</kbd>.
+    ///
+    /// For example, pressing <kbd>Ctrl</kbd>+<kbd>a</kbd> produces `Some("\x01")`.
+    fn text_with_all_modifiers(&self) -> Option<&str>;
+
+    /// This value ignores all modifiers including,
+    /// but not limited to <kbd>Shift</kbd>, <kbd>Caps Lock</kbd>,
+    /// and <kbd>Ctrl</kbd>. In most cases this means that the
+    /// unicode character in the resulting string is lowercase.
+    ///
+    /// This is useful for key-bindings / shortcut key combinations.
+    ///
+    /// In case `logical_key` reports `Dead`, this will still report the
+    /// key as `Character` according to the current keyboard layout. This value
+    /// cannot be `Dead`.
+    fn key_without_modifiers(&self) -> Key;
+}
+
+impl KeyEventExtModifierSupplement for KeyEvent {
+    #[inline]
+    fn text_with_all_modifiers(&self) -> Option<&str> {
+        self.platform_specific.text_with_all_modifiers.as_ref().map(|s| s.as_str())
+    }
+
+    #[inline]
+    fn key_without_modifiers(&self) -> Key {
+        self.platform_specific.key_without_modifiers.clone()
+    }
+}
diff --git a/vendor/winit/src/platform/orbital.rs b/vendor/winit/src/platform/orbital.rs
new file mode 100644
index 00000000..d8093503
--- /dev/null
+++ b/vendor/winit/src/platform/orbital.rs
@@ -0,0 +1,6 @@
+//! # Orbital / Redox OS
+//!
+//! Redox OS has some functionality not yet present that will be implemented
+//! when its orbital display server provides it.
+
+// There are no Orbital specific traits yet.
diff --git a/vendor/winit/src/platform/pump_events.rs b/vendor/winit/src/platform/pump_events.rs
new file mode 100644
index 00000000..44766353
--- /dev/null
+++ b/vendor/winit/src/platform/pump_events.rs
@@ -0,0 +1,143 @@
+use std::time::Duration;
+
+use crate::application::ApplicationHandler;
+use crate::event::Event;
+use crate::event_loop::{self, ActiveEventLoop, EventLoop};
+
+/// Additional methods on [`EventLoop`] for pumping events within an external event loop
+pub trait EventLoopExtPumpEvents {
+    /// A type provided by the user that can be passed through [`Event::UserEvent`].
+    type UserEvent: 'static;
+
+    /// Pump the `EventLoop` to check for and dispatch pending events.
+    ///
+    /// This API is designed to enable applications to integrate Winit into an
+    /// external event loop, for platforms that can support this.
+    ///
+    /// The given `timeout` limits how long it may block waiting for new events.
+    ///
+    /// Passing a `timeout` of `Some(Duration::ZERO)` would ensure your external
+    /// event loop is never blocked but you would likely need to consider how
+    /// to throttle your own external loop.
+    ///
+    /// Passing a `timeout` of `None` means that it may wait indefinitely for new
+    /// events before returning control back to the external loop.
+    ///
+    /// **Note:** This is not a portable API, and its usage involves a number of
+    /// caveats and trade offs that should be considered before using this API!
+    ///
+    /// You almost certainly shouldn't use this API, unless you absolutely know it's
+    /// the only practical option you have.
+    ///
+    /// ## Synchronous events
+    ///
+    /// Some events _must_ only be handled synchronously via the closure that
+    /// is passed to Winit so that the handler will also be synchronized with
+    /// the window system and operating system.
+    ///
+    /// This is because some events are driven by a window system callback
+    /// where the window systems expects the application to have handled the
+    /// event before returning.
+    ///
+    /// **These events can not be buffered and handled outside of the closure
+    /// passed to Winit.**
+    ///
+    /// As a general rule it is not recommended to ever buffer events to handle
+    /// them outside of the closure passed to Winit since it's difficult to
+    /// provide guarantees about which events are safe to buffer across all
+    /// operating systems.
+    ///
+    /// Notable events that will certainly create portability problems if
+    /// buffered and handled outside of Winit include:
+    /// - `RedrawRequested` events, used to schedule rendering.
+    ///
+    ///   macOS for example uses a `drawRect` callback to drive rendering
+    ///   within applications and expects rendering to be finished before
+    ///   the `drawRect` callback returns.
+    ///
+    ///   For portability it's strongly recommended that applications should
+    ///   keep their rendering inside the closure provided to Winit.
+    /// - Any lifecycle events, such as `Suspended` / `Resumed`.
+    ///
+    ///   The handling of these events needs to be synchronized with the
+    ///   operating system and it would never be appropriate to buffer a
+    ///   notification that your application has been suspended or resumed and
+    ///   then handled that later since there would always be a chance that
+    ///   other lifecycle events occur while the event is buffered.
+    ///
+    /// ## Supported Platforms
+    ///
+    /// - Windows
+    /// - Linux
+    /// - MacOS
+    /// - Android
+    ///
+    /// ## Unsupported Platforms
+    ///
+    /// - **Web:**  This API is fundamentally incompatible with the event-based way in which Web
+    ///   browsers work because it's not possible to have a long-running external loop that would
+    ///   block the browser and there is nothing that can be polled to ask for new new events.
+    ///   Events are delivered via callbacks based on an event loop that is internal to the browser
+    ///   itself.
+    /// - **iOS:** It's not possible to stop and start an `NSApplication` repeatedly on iOS so
+    ///   there's no way to support the same approach to polling as on MacOS.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Windows**: The implementation will use `PeekMessage` when checking for window messages
+    ///   to avoid blocking your external event loop.
+    ///
+    /// - **MacOS**: The implementation works in terms of stopping the global application whenever
+    ///   the application `RunLoop` indicates that it is preparing to block and wait for new events.
+    ///
+    ///   This is very different to the polling APIs that are available on other
+    ///   platforms (the lower level polling primitives on MacOS are private
+    ///   implementation details for `NSApplication` which aren't accessible to
+    ///   application developers)
+    ///
+    ///   It's likely this will be less efficient than polling on other OSs and
+    ///   it also means the `NSApplication` is stopped while outside of the Winit
+    ///   event loop - and that's observable (for example to crates like `rfd`)
+    ///   because the `NSApplication` is global state.
+    ///
+    ///   If you render outside of Winit you are likely to see window resizing artifacts
+    ///   since MacOS expects applications to render synchronously during any `drawRect`
+    ///   callback.
+    fn pump_app_events<A: ApplicationHandler<Self::UserEvent>>(
+        &mut self,
+        timeout: Option<Duration>,
+        app: &mut A,
+    ) -> PumpStatus {
+        #[allow(deprecated)]
+        self.pump_events(timeout, |event, event_loop| {
+            event_loop::dispatch_event_for_app(app, event_loop, event)
+        })
+    }
+
+    /// See [`pump_app_events`].
+    ///
+    /// [`pump_app_events`]: Self::pump_app_events
+    #[deprecated = "use EventLoopExtPumpEvents::pump_app_events"]
+    fn pump_events<F>(&mut self, timeout: Option<Duration>, event_handler: F) -> PumpStatus
+    where
+        F: FnMut(Event<Self::UserEvent>, &ActiveEventLoop);
+}
+
+impl<T> EventLoopExtPumpEvents for EventLoop<T> {
+    type UserEvent = T;
+
+    fn pump_events<F>(&mut self, timeout: Option<Duration>, event_handler: F) -> PumpStatus
+    where
+        F: FnMut(Event<Self::UserEvent>, &ActiveEventLoop),
+    {
+        self.event_loop.pump_events(timeout, event_handler)
+    }
+}
+
+/// The return status for `pump_events`
+pub enum PumpStatus {
+    /// Continue running external loop.
+    Continue,
+    /// Exit external loop.
+    Exit(i32),
+}
diff --git a/vendor/winit/src/platform/run_on_demand.rs b/vendor/winit/src/platform/run_on_demand.rs
new file mode 100644
index 00000000..0bb96e92
--- /dev/null
+++ b/vendor/winit/src/platform/run_on_demand.rs
@@ -0,0 +1,111 @@
+use crate::application::ApplicationHandler;
+use crate::error::EventLoopError;
+use crate::event::Event;
+use crate::event_loop::{self, ActiveEventLoop, EventLoop};
+
+#[cfg(doc)]
+use crate::{platform::pump_events::EventLoopExtPumpEvents, window::Window};
+
+/// Additional methods on [`EventLoop`] to return control flow to the caller.
+pub trait EventLoopExtRunOnDemand {
+    /// A type provided by the user that can be passed through [`Event::UserEvent`].
+    type UserEvent: 'static;
+
+    /// See [`run_app_on_demand`].
+    ///
+    /// [`run_app_on_demand`]: Self::run_app_on_demand
+    #[deprecated = "use EventLoopExtRunOnDemand::run_app_on_demand"]
+    fn run_on_demand<F>(&mut self, event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<Self::UserEvent>, &ActiveEventLoop);
+
+    /// Run the application with the event loop on the calling thread.
+    ///
+    /// Unlike [`EventLoop::run_app`], this function accepts non-`'static` (i.e. non-`move`)
+    /// closures and it is possible to return control back to the caller without
+    /// consuming the `EventLoop` (by using [`exit()`]) and
+    /// so the event loop can be re-run after it has exit.
+    ///
+    /// It's expected that each run of the loop will be for orthogonal instantiations of your
+    /// Winit application, but internally each instantiation may re-use some common window
+    /// system resources, such as a display server connection.
+    ///
+    /// This API is not designed to run an event loop in bursts that you can exit from and return
+    /// to while maintaining the full state of your application. (If you need something like this
+    /// you can look at the [`EventLoopExtPumpEvents::pump_app_events()`] API)
+    ///
+    /// Each time `run_app_on_demand` is called the startup sequence of `init`, followed by
+    /// `resume` is being preserved.
+    ///
+    /// See the [`set_control_flow()`] docs on how to change the event loop's behavior.
+    ///
+    /// # Caveats
+    /// - This extension isn't available on all platforms, since it's not always possible to return
+    ///   to the caller (specifically this is impossible on iOS and Web - though with the Web
+    ///   backend it is possible to use `EventLoopExtWebSys::spawn()`
+    #[cfg_attr(not(web_platform), doc = "[^1]")]
+    ///   more than once instead).
+    /// - No [`Window`] state can be carried between separate runs of the event loop.
+    ///
+    /// You are strongly encouraged to use [`EventLoop::run_app()`] for portability, unless you
+    /// specifically need the ability to re-run a single event loop more than once
+    ///
+    /// # Supported Platforms
+    /// - Windows
+    /// - Linux
+    /// - macOS
+    /// - Android
+    ///
+    /// # Unsupported Platforms
+    /// - **Web:**  This API is fundamentally incompatible with the event-based way in which Web
+    ///   browsers work because it's not possible to have a long-running external loop that would
+    ///   block the browser and there is nothing that can be polled to ask for new events. Events
+    ///   are delivered via callbacks based on an event loop that is internal to the browser itself.
+    /// - **iOS:** It's not possible to stop and start an `UIApplication` repeatedly on iOS.
+    #[cfg_attr(not(web_platform), doc = "[^1]: `spawn()` is only available on `wasm` platforms.")]
+    ///
+    #[rustfmt::skip]
+    /// [`exit()`]: ActiveEventLoop::exit()
+    /// [`set_control_flow()`]: ActiveEventLoop::set_control_flow()
+    fn run_app_on_demand<A: ApplicationHandler<Self::UserEvent>>(
+        &mut self,
+        app: &mut A,
+    ) -> Result<(), EventLoopError> {
+        #[allow(deprecated)]
+        self.run_on_demand(|event, event_loop| {
+            event_loop::dispatch_event_for_app(app, event_loop, event)
+        })
+    }
+}
+
+impl<T> EventLoopExtRunOnDemand for EventLoop<T> {
+    type UserEvent = T;
+
+    fn run_on_demand<F>(&mut self, event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<Self::UserEvent>, &ActiveEventLoop),
+    {
+        self.event_loop.window_target().clear_exit();
+        self.event_loop.run_on_demand(event_handler)
+    }
+}
+
+impl ActiveEventLoop {
+    /// Clear exit status.
+    pub(crate) fn clear_exit(&self) {
+        self.p.clear_exit()
+    }
+}
+
+/// ```compile_fail
+/// use winit::event_loop::EventLoop;
+/// use winit::platform::run_on_demand::EventLoopExtRunOnDemand;
+///
+/// let mut event_loop = EventLoop::new().unwrap();
+/// event_loop.run_on_demand(|_, _| {
+///     // Attempt to run the event loop re-entrantly; this must fail.
+///     event_loop.run_on_demand(|_, _| {});
+/// });
+/// ```
+#[allow(dead_code)]
+fn test_run_on_demand_cannot_access_event_loop() {}
diff --git a/vendor/winit/src/platform/scancode.rs b/vendor/winit/src/platform/scancode.rs
new file mode 100644
index 00000000..0d783135
--- /dev/null
+++ b/vendor/winit/src/platform/scancode.rs
@@ -0,0 +1,50 @@
+use crate::keyboard::{KeyCode, PhysicalKey};
+
+// TODO: Describe what this value contains for each platform
+
+/// Additional methods for the [`PhysicalKey`] type that allow the user to access the
+/// platform-specific scancode.
+///
+/// [`PhysicalKey`]: crate::keyboard::PhysicalKey
+pub trait PhysicalKeyExtScancode {
+    /// The raw value of the platform-specific physical key identifier.
+    ///
+    /// Returns `Some(key_id)` if the conversion was successful; returns `None` otherwise.
+    ///
+    /// ## Platform-specific
+    /// - **Windows:** A 16bit extended scancode
+    /// - **Wayland/X11**: A 32-bit linux scancode, which is X11/Wayland keycode subtracted by 8.
+    fn to_scancode(self) -> Option<u32>;
+
+    /// Constructs a `PhysicalKey` from a platform-specific physical key identifier.
+    ///
+    /// Note that this conversion may be lossy, i.e. converting the returned `PhysicalKey` back
+    /// using `to_scancode` might not yield the original value.
+    ///
+    /// ## Platform-specific
+    /// - **Wayland/X11**: A 32-bit linux scancode. When building from X11/Wayland keycode subtract
+    ///   `8` to get the value you wanted.
+    fn from_scancode(scancode: u32) -> PhysicalKey;
+}
+
+impl PhysicalKeyExtScancode for PhysicalKey {
+    fn to_scancode(self) -> Option<u32> {
+        crate::platform_impl::physicalkey_to_scancode(self)
+    }
+
+    fn from_scancode(scancode: u32) -> PhysicalKey {
+        crate::platform_impl::scancode_to_physicalkey(scancode)
+    }
+}
+
+impl PhysicalKeyExtScancode for KeyCode {
+    #[inline]
+    fn to_scancode(self) -> Option<u32> {
+        <PhysicalKey as PhysicalKeyExtScancode>::to_scancode(PhysicalKey::Code(self))
+    }
+
+    #[inline]
+    fn from_scancode(scancode: u32) -> PhysicalKey {
+        <PhysicalKey as PhysicalKeyExtScancode>::from_scancode(scancode)
+    }
+}
diff --git a/vendor/winit/src/platform/startup_notify.rs b/vendor/winit/src/platform/startup_notify.rs
new file mode 100644
index 00000000..6fab284e
--- /dev/null
+++ b/vendor/winit/src/platform/startup_notify.rs
@@ -0,0 +1,99 @@
+//! Window startup notification to handle window raising.
+//!
+//! The [`ActivationToken`] is essential to ensure that your newly
+//! created window will obtain the focus, otherwise the user could
+//! be requered to click on the window.
+//!
+//! Such token is usually delivered via the environment variable and
+//! could be read from it with the [`EventLoopExtStartupNotify::read_token_from_env`].
+//!
+//! Such token must also be reset after reading it from your environment with
+//! [`reset_activation_token_env`] otherwise child processes could inherit it.
+//!
+//! When starting a new child process with a newly obtained [`ActivationToken`] from
+//! [`WindowExtStartupNotify::request_activation_token`] the [`set_activation_token_env`]
+//! must be used to propagate it to the child
+//!
+//! To ensure the delivery of such token by other processes to you, the user should
+//! set `StartupNotify=true` inside the `.desktop` file of their application.
+//!
+//! The specification could be found [`here`].
+//!
+//! [`here`]: https://specifications.freedesktop.org/startup-notification-spec/startup-notification-latest.txt
+
+use std::env;
+
+use crate::error::NotSupportedError;
+use crate::event_loop::{ActiveEventLoop, AsyncRequestSerial};
+use crate::window::{ActivationToken, Window, WindowAttributes};
+
+/// The variable which is used mostly on X11.
+const X11_VAR: &str = "DESKTOP_STARTUP_ID";
+
+/// The variable which is used mostly on Wayland.
+const WAYLAND_VAR: &str = "XDG_ACTIVATION_TOKEN";
+
+pub trait EventLoopExtStartupNotify {
+    /// Read the token from the environment.
+    ///
+    /// It's recommended **to unset** this environment variable for child processes.
+    fn read_token_from_env(&self) -> Option<ActivationToken>;
+}
+
+pub trait WindowExtStartupNotify {
+    /// Request a new activation token.
+    ///
+    /// The token will be delivered inside
+    fn request_activation_token(&self) -> Result<AsyncRequestSerial, NotSupportedError>;
+}
+
+pub trait WindowAttributesExtStartupNotify {
+    /// Use this [`ActivationToken`] during window creation.
+    ///
+    /// Not using such a token upon a window could make your window not gaining
+    /// focus until the user clicks on the window.
+    fn with_activation_token(self, token: ActivationToken) -> Self;
+}
+
+impl EventLoopExtStartupNotify for ActiveEventLoop {
+    fn read_token_from_env(&self) -> Option<ActivationToken> {
+        match self.p {
+            #[cfg(wayland_platform)]
+            crate::platform_impl::ActiveEventLoop::Wayland(_) => env::var(WAYLAND_VAR),
+            #[cfg(x11_platform)]
+            crate::platform_impl::ActiveEventLoop::X(_) => env::var(X11_VAR),
+        }
+        .ok()
+        .map(ActivationToken::from_raw)
+    }
+}
+
+impl WindowExtStartupNotify for Window {
+    fn request_activation_token(&self) -> Result<AsyncRequestSerial, NotSupportedError> {
+        self.window.request_activation_token()
+    }
+}
+
+impl WindowAttributesExtStartupNotify for WindowAttributes {
+    fn with_activation_token(mut self, token: ActivationToken) -> Self {
+        self.platform_specific.activation_token = Some(token);
+        self
+    }
+}
+
+/// Remove the activation environment variables from the current process.
+///
+/// This is wise to do before running child processes,
+/// which may not to support the activation token.
+pub fn reset_activation_token_env() {
+    env::remove_var(X11_VAR);
+    env::remove_var(WAYLAND_VAR);
+}
+
+/// Set environment variables responsible for activation token.
+///
+/// This could be used before running daemon processes.
+pub fn set_activation_token_env(token: ActivationToken) {
+    env::set_var(X11_VAR, &token.token);
+    env::set_var(WAYLAND_VAR, token.token);
+}
diff --git a/vendor/winit/src/platform/wayland.rs b/vendor/winit/src/platform/wayland.rs
new file mode 100644
index 00000000..9c1a8e43
--- /dev/null
+++ b/vendor/winit/src/platform/wayland.rs
@@ -0,0 +1,131 @@
+//! # Wayland
+//!
+//! **Note:** Windows don't appear on Wayland until you draw/present to them.
+//!
+//! By default, Winit loads system libraries using `dlopen`. This can be
+//! disabled by disabling the `"wayland-dlopen"` cargo feature.
+//!
+//! ## Client-side decorations
+//!
+//! Winit provides client-side decorations by default, but the behaviour can
+//! be controlled with the following feature flags:
+//!
+//! * `wayland-csd-adwaita` (default).
+//! * `wayland-csd-adwaita-crossfont`.
+//! * `wayland-csd-adwaita-notitle`.
+
+use std::ffi::c_void;
+use std::ptr::NonNull;
+
+use crate::event_loop::{ActiveEventLoop, EventLoop, EventLoopBuilder};
+use crate::monitor::MonitorHandle;
+use crate::window::{Window, WindowAttributes};
+
+pub use crate::window::Theme;
+
+/// Additional methods on [`ActiveEventLoop`] that are specific to Wayland.
+pub trait ActiveEventLoopExtWayland {
+    /// True if the [`ActiveEventLoop`] uses Wayland.
+    fn is_wayland(&self) -> bool;
+}
+
+impl ActiveEventLoopExtWayland for ActiveEventLoop {
+    #[inline]
+    fn is_wayland(&self) -> bool {
+        self.p.is_wayland()
+    }
+}
+
+/// Additional methods on [`EventLoop`] that are specific to Wayland.
+pub trait EventLoopExtWayland {
+    /// True if the [`EventLoop`] uses Wayland.
+    fn is_wayland(&self) -> bool;
+}
+
+impl<T: 'static> EventLoopExtWayland for EventLoop<T> {
+    #[inline]
+    fn is_wayland(&self) -> bool {
+        self.event_loop.is_wayland()
+    }
+}
+
+/// Additional methods on [`EventLoopBuilder`] that are specific to Wayland.
+pub trait EventLoopBuilderExtWayland {
+    /// Force using Wayland.
+    fn with_wayland(&mut self) -> &mut Self;
+
+    /// Whether to allow the event loop to be created off of the main thread.
+    ///
+    /// By default, the window is only allowed to be created on the main
+    /// thread, to make platform compatibility easier.
+    fn with_any_thread(&mut self, any_thread: bool) -> &mut Self;
+}
+
+impl<T> EventLoopBuilderExtWayland for EventLoopBuilder<T> {
+    #[inline]
+    fn with_wayland(&mut self) -> &mut Self {
+        self.platform_specific.forced_backend = Some(crate::platform_impl::Backend::Wayland);
+        self
+    }
+
+    #[inline]
+    fn with_any_thread(&mut self, any_thread: bool) -> &mut Self {
+        self.platform_specific.any_thread = any_thread;
+        self
+    }
+}
+
+/// Additional methods on [`Window`] that are specific to Wayland.
+///
+/// [`Window`]: crate::window::Window
+pub trait WindowExtWayland {
+    /// Returns `xdg_toplevel` of the window or [`None`] if the window is X11 window.
+    fn xdg_toplevel(&self) -> Option<NonNull<c_void>>;
+}
+
+impl WindowExtWayland for Window {
+    #[inline]
+    fn xdg_toplevel(&self) -> Option<NonNull<c_void>> {
+        #[allow(clippy::single_match)]
+        match &self.window {
+            #[cfg(x11_platform)]
+            crate::platform_impl::Window::X(_) => None,
+            #[cfg(wayland_platform)]
+            crate::platform_impl::Window::Wayland(window) => window.xdg_toplevel(),
+        }
+    }
+}
+
+/// Additional methods on [`WindowAttributes`] that are specific to Wayland.
+pub trait WindowAttributesExtWayland {
+    /// Build window with the given name.
+    ///
+    /// The `general` name sets an application ID, which should match the `.desktop`
+    /// file distributed with your program. The `instance` is a `no-op`.
+    ///
+    /// For details about application ID conventions, see the
+    /// [Desktop Entry Spec](https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html#desktop-file-id)
+    fn with_name(self, general: impl Into<String>, instance: impl Into<String>) -> Self;
+}
+
+impl WindowAttributesExtWayland for WindowAttributes {
+    #[inline]
+    fn with_name(mut self, general: impl Into<String>, instance: impl Into<String>) -> Self {
+        self.platform_specific.name =
+            Some(crate::platform_impl::ApplicationName::new(general.into(), instance.into()));
+        self
+    }
+}
+
+/// Additional methods on `MonitorHandle` that are specific to Wayland.
+pub trait MonitorHandleExtWayland {
+    /// Returns the inner identifier of the monitor.
+    fn native_id(&self) -> u32;
+}
+
+impl MonitorHandleExtWayland for MonitorHandle {
+    #[inline]
+    fn native_id(&self) -> u32 {
+        self.inner.native_identifier()
+    }
+}
diff --git a/vendor/winit/src/platform/web.rs b/vendor/winit/src/platform/web.rs
new file mode 100644
index 00000000..f257ca41
--- /dev/null
+++ b/vendor/winit/src/platform/web.rs
@@ -0,0 +1,465 @@
+//! # Web
+//!
+//! The officially supported browsers are Chrome, Firefox and Safari 13.1+,
+//! though forks of these should work fine.
+//!
+//! Winit supports compiling to the `wasm32-unknown-unknown` target with
+//! `web-sys`.
+//!
+//! On the web platform, a Winit window is backed by a `<canvas>` element. You
+//! can either [provide Winit with a `<canvas>` element][with_canvas], or
+//! [let Winit create a `<canvas>` element which you can then retrieve][get]
+//! and insert it into the DOM yourself.
+//!
+//! Currently, there is no example code using Winit on Web, see [#3473]. For
+//! information on using Rust on WebAssembly, check out the [Rust and
+//! WebAssembly book].
+//!
+//! [with_canvas]: WindowAttributesExtWebSys::with_canvas
+//! [get]: WindowExtWebSys::canvas
+//! [#3473]: https://github.com/rust-windowing/winit/issues/3473
+//! [Rust and WebAssembly book]: https://rustwasm.github.io/book/
+//!
+//! ## CSS properties
+//!
+//! It is recommended **not** to apply certain CSS properties to the canvas:
+//! - [`transform`](https://developer.mozilla.org/en-US/docs/Web/CSS/transform)
+//! - [`border`](https://developer.mozilla.org/en-US/docs/Web/CSS/border)
+//! - [`padding`](https://developer.mozilla.org/en-US/docs/Web/CSS/padding)
+//!
+//! The following APIs can't take them into account and will therefore provide inaccurate results:
+//! - [`WindowEvent::Resized`] and [`Window::(set_)inner_size()`]
+//! - [`WindowEvent::Occluded`]
+//! - [`WindowEvent::CursorMoved`], [`WindowEvent::CursorEntered`], [`WindowEvent::CursorLeft`], and
+//!   [`WindowEvent::Touch`].
+//! - [`Window::set_outer_position()`]
+//!
+//! [`WindowEvent::Resized`]: crate::event::WindowEvent::Resized
+//! [`Window::(set_)inner_size()`]: crate::window::Window::inner_size
+//! [`WindowEvent::Occluded`]: crate::event::WindowEvent::Occluded
+//! [`WindowEvent::CursorMoved`]: crate::event::WindowEvent::CursorMoved
+//! [`WindowEvent::CursorEntered`]: crate::event::WindowEvent::CursorEntered
+//! [`WindowEvent::CursorLeft`]: crate::event::WindowEvent::CursorLeft
+//! [`WindowEvent::Touch`]: crate::event::WindowEvent::Touch
+//! [`Window::set_outer_position()`]: crate::window::Window::set_outer_position
+
+use std::error::Error;
+use std::fmt::{self, Display, Formatter};
+use std::future::Future;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+use std::time::Duration;
+
+#[cfg(web_platform)]
+use web_sys::HtmlCanvasElement;
+
+use crate::application::ApplicationHandler;
+use crate::cursor::CustomCursorSource;
+use crate::event::Event;
+use crate::event_loop::{self, ActiveEventLoop, EventLoop};
+#[cfg(web_platform)]
+use crate::platform_impl::CustomCursorFuture as PlatformCustomCursorFuture;
+use crate::platform_impl::PlatformCustomCursorSource;
+use crate::window::{CustomCursor, Window, WindowAttributes};
+
+#[cfg(not(web_platform))]
+#[doc(hidden)]
+pub struct HtmlCanvasElement;
+
+pub trait WindowExtWebSys {
+    /// Only returns the canvas if called from inside the window context (the
+    /// main thread).
+    fn canvas(&self) -> Option<HtmlCanvasElement>;
+
+    /// Returns [`true`] if calling `event.preventDefault()` is enabled.
+    ///
+    /// See [`Window::set_prevent_default()`] for more details.
+    fn prevent_default(&self) -> bool;
+
+    /// Sets whether `event.preventDefault()` should be called on events on the
+    /// canvas that have side effects.
+    ///
+    /// For example, by default using the mouse wheel would cause the page to scroll, enabling this
+    /// would prevent that.
+    ///
+    /// Some events are impossible to prevent. E.g. Firefox allows to access the native browser
+    /// context menu with Shift+Rightclick.
+    fn set_prevent_default(&self, prevent_default: bool);
+}
+
+impl WindowExtWebSys for Window {
+    #[inline]
+    fn canvas(&self) -> Option<HtmlCanvasElement> {
+        self.window.canvas()
+    }
+
+    fn prevent_default(&self) -> bool {
+        self.window.prevent_default()
+    }
+
+    fn set_prevent_default(&self, prevent_default: bool) {
+        self.window.set_prevent_default(prevent_default)
+    }
+}
+
+pub trait WindowAttributesExtWebSys {
+    /// Pass an [`HtmlCanvasElement`] to be used for this [`Window`]. If [`None`],
+    /// [`WindowAttributes::default()`] will create one.
+    ///
+    /// In any case, the canvas won't be automatically inserted into the web page.
+    ///
+    /// [`None`] by default.
+    #[cfg_attr(not(web_platform), doc = "", doc = "[`HtmlCanvasElement`]: #only-available-on-wasm")]
+    fn with_canvas(self, canvas: Option<HtmlCanvasElement>) -> Self;
+
+    /// Sets whether `event.preventDefault()` should be called on events on the
+    /// canvas that have side effects.
+    ///
+    /// See [`Window::set_prevent_default()`] for more details.
+    ///
+    /// Enabled by default.
+    fn with_prevent_default(self, prevent_default: bool) -> Self;
+
+    /// Whether the canvas should be focusable using the tab key. This is necessary to capture
+    /// canvas keyboard events.
+    ///
+    /// Enabled by default.
+    fn with_focusable(self, focusable: bool) -> Self;
+
+    /// On window creation, append the canvas element to the web page if it isn't already.
+    ///
+    /// Disabled by default.
+    fn with_append(self, append: bool) -> Self;
+}
+
+impl WindowAttributesExtWebSys for WindowAttributes {
+    fn with_canvas(mut self, canvas: Option<HtmlCanvasElement>) -> Self {
+        self.platform_specific.set_canvas(canvas);
+        self
+    }
+
+    fn with_prevent_default(mut self, prevent_default: bool) -> Self {
+        self.platform_specific.prevent_default = prevent_default;
+        self
+    }
+
+    fn with_focusable(mut self, focusable: bool) -> Self {
+        self.platform_specific.focusable = focusable;
+        self
+    }
+
+    fn with_append(mut self, append: bool) -> Self {
+        self.platform_specific.append = append;
+        self
+    }
+}
+
+/// Additional methods on `EventLoop` that are specific to the web.
+pub trait EventLoopExtWebSys {
+    /// A type provided by the user that can be passed through `Event::UserEvent`.
+    type UserEvent: 'static;
+
+    /// Initializes the winit event loop.
+    ///
+    /// Unlike
+    #[cfg_attr(all(web_platform, target_feature = "exception-handling"), doc = "`run_app()`")]
+    #[cfg_attr(
+        not(all(web_platform, target_feature = "exception-handling")),
+        doc = "[`run_app()`]"
+    )]
+    /// [^1], this returns immediately, and doesn't throw an exception in order to
+    /// satisfy its [`!`] return type.
+    ///
+    /// Once the event loop has been destroyed, it's possible to reinitialize another event loop
+    /// by calling this function again. This can be useful if you want to recreate the event loop
+    /// while the WebAssembly module is still loaded. For example, this can be used to recreate the
+    /// event loop when switching between tabs on a single page application.
+    #[rustfmt::skip]
+    ///
+    #[cfg_attr(
+        not(all(web_platform, target_feature = "exception-handling")),
+        doc = "[`run_app()`]: EventLoop::run_app()"
+    )]
+    /// [^1]: `run_app()` is _not_ available on WASM when the target supports `exception-handling`.
+    fn spawn_app<A: ApplicationHandler<Self::UserEvent> + 'static>(self, app: A);
+
+    /// See [`spawn_app`].
+    ///
+    /// [`spawn_app`]: Self::spawn_app
+    #[deprecated = "use EventLoopExtWebSys::spawn_app"]
+    fn spawn<F>(self, event_handler: F)
+    where
+        F: 'static + FnMut(Event<Self::UserEvent>, &ActiveEventLoop);
+
+    /// Sets the strategy for [`ControlFlow::Poll`].
+    ///
+    /// See [`PollStrategy`].
+    ///
+    /// [`ControlFlow::Poll`]: crate::event_loop::ControlFlow::Poll
+    fn set_poll_strategy(&self, strategy: PollStrategy);
+
+    /// Gets the strategy for [`ControlFlow::Poll`].
+    ///
+    /// See [`PollStrategy`].
+    ///
+    /// [`ControlFlow::Poll`]: crate::event_loop::ControlFlow::Poll
+    fn poll_strategy(&self) -> PollStrategy;
+
+    /// Sets the strategy for [`ControlFlow::WaitUntil`].
+    ///
+    /// See [`WaitUntilStrategy`].
+    ///
+    /// [`ControlFlow::WaitUntil`]: crate::event_loop::ControlFlow::WaitUntil
+    fn set_wait_until_strategy(&self, strategy: WaitUntilStrategy);
+
+    /// Gets the strategy for [`ControlFlow::WaitUntil`].
+    ///
+    /// See [`WaitUntilStrategy`].
+    ///
+    /// [`ControlFlow::WaitUntil`]: crate::event_loop::ControlFlow::WaitUntil
+    fn wait_until_strategy(&self) -> WaitUntilStrategy;
+}
+
+impl<T> EventLoopExtWebSys for EventLoop<T> {
+    type UserEvent = T;
+
+    fn spawn_app<A: ApplicationHandler<Self::UserEvent> + 'static>(self, mut app: A) {
+        self.event_loop.spawn(move |event, event_loop| {
+            event_loop::dispatch_event_for_app(&mut app, event_loop, event)
+        });
+    }
+
+    fn spawn<F>(self, event_handler: F)
+    where
+        F: 'static + FnMut(Event<Self::UserEvent>, &ActiveEventLoop),
+    {
+        self.event_loop.spawn(event_handler)
+    }
+
+    fn set_poll_strategy(&self, strategy: PollStrategy) {
+        self.event_loop.set_poll_strategy(strategy);
+    }
+
+    fn poll_strategy(&self) -> PollStrategy {
+        self.event_loop.poll_strategy()
+    }
+
+    fn set_wait_until_strategy(&self, strategy: WaitUntilStrategy) {
+        self.event_loop.set_wait_until_strategy(strategy);
+    }
+
+    fn wait_until_strategy(&self) -> WaitUntilStrategy {
+        self.event_loop.wait_until_strategy()
+    }
+}
+
+pub trait ActiveEventLoopExtWebSys {
+    /// Sets the strategy for [`ControlFlow::Poll`].
+    ///
+    /// See [`PollStrategy`].
+    ///
+    /// [`ControlFlow::Poll`]: crate::event_loop::ControlFlow::Poll
+    fn set_poll_strategy(&self, strategy: PollStrategy);
+
+    /// Gets the strategy for [`ControlFlow::Poll`].
+    ///
+    /// See [`PollStrategy`].
+    ///
+    /// [`ControlFlow::Poll`]: crate::event_loop::ControlFlow::Poll
+    fn poll_strategy(&self) -> PollStrategy;
+
+    /// Sets the strategy for [`ControlFlow::WaitUntil`].
+    ///
+    /// See [`WaitUntilStrategy`].
+    ///
+    /// [`ControlFlow::WaitUntil`]: crate::event_loop::ControlFlow::WaitUntil
+    fn set_wait_until_strategy(&self, strategy: WaitUntilStrategy);
+
+    /// Gets the strategy for [`ControlFlow::WaitUntil`].
+    ///
+    /// See [`WaitUntilStrategy`].
+    ///
+    /// [`ControlFlow::WaitUntil`]: crate::event_loop::ControlFlow::WaitUntil
+    fn wait_until_strategy(&self) -> WaitUntilStrategy;
+
+    /// Async version of [`ActiveEventLoop::create_custom_cursor()`] which waits until the
+    /// cursor has completely finished loading.
+    fn create_custom_cursor_async(&self, source: CustomCursorSource) -> CustomCursorFuture;
+}
+
+impl ActiveEventLoopExtWebSys for ActiveEventLoop {
+    #[inline]
+    fn create_custom_cursor_async(&self, source: CustomCursorSource) -> CustomCursorFuture {
+        self.p.create_custom_cursor_async(source)
+    }
+
+    #[inline]
+    fn set_poll_strategy(&self, strategy: PollStrategy) {
+        self.p.set_poll_strategy(strategy);
+    }
+
+    #[inline]
+    fn poll_strategy(&self) -> PollStrategy {
+        self.p.poll_strategy()
+    }
+
+    #[inline]
+    fn set_wait_until_strategy(&self, strategy: WaitUntilStrategy) {
+        self.p.set_wait_until_strategy(strategy);
+    }
+
+    #[inline]
+    fn wait_until_strategy(&self) -> WaitUntilStrategy {
+        self.p.wait_until_strategy()
+    }
+}
+
+/// Strategy used for [`ControlFlow::Poll`][crate::event_loop::ControlFlow::Poll].
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum PollStrategy {
+    /// Uses [`Window.requestIdleCallback()`] to queue the next event loop. If not available
+    /// this will fallback to [`setTimeout()`].
+    ///
+    /// This strategy will wait for the browser to enter an idle period before running and might
+    /// be affected by browser throttling.
+    ///
+    /// [`Window.requestIdleCallback()`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/requestIdleCallback
+    /// [`setTimeout()`]: https://developer.mozilla.org/en-US/docs/Web/API/setTimeout
+    IdleCallback,
+    /// Uses the [Prioritized Task Scheduling API] to queue the next event loop. If not available
+    /// this will fallback to [`setTimeout()`].
+    ///
+    /// This strategy will run as fast as possible without disturbing users from interacting with
+    /// the page and is not affected by browser throttling.
+    ///
+    /// This is the default strategy.
+    ///
+    /// [Prioritized Task Scheduling API]: https://developer.mozilla.org/en-US/docs/Web/API/Prioritized_Task_Scheduling_API
+    /// [`setTimeout()`]: https://developer.mozilla.org/en-US/docs/Web/API/setTimeout
+    #[default]
+    Scheduler,
+}
+
+/// Strategy used for [`ControlFlow::WaitUntil`][crate::event_loop::ControlFlow::WaitUntil].
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum WaitUntilStrategy {
+    /// Uses the [Prioritized Task Scheduling API] to queue the next event loop. If not available
+    /// this will fallback to [`setTimeout()`].
+    ///
+    /// This strategy is commonly not affected by browser throttling unless the window is not
+    /// focused.
+    ///
+    /// This is the default strategy.
+    ///
+    /// [Prioritized Task Scheduling API]: https://developer.mozilla.org/en-US/docs/Web/API/Prioritized_Task_Scheduling_API
+    /// [`setTimeout()`]: https://developer.mozilla.org/en-US/docs/Web/API/setTimeout
+    #[default]
+    Scheduler,
+    /// Equal to [`Scheduler`][Self::Scheduler] but wakes up the event loop from a [worker].
+    ///
+    /// This strategy is commonly not affected by browser throttling regardless of window focus.
+    ///
+    /// [worker]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API
+    Worker,
+}
+
+pub trait CustomCursorExtWebSys {
+    /// Returns if this cursor is an animation.
+    fn is_animation(&self) -> bool;
+
+    /// Creates a new cursor from a URL pointing to an image.
+    /// It uses the [url css function](https://developer.mozilla.org/en-US/docs/Web/CSS/url),
+    /// but browser support for image formats is inconsistent. Using [PNG] is recommended.
+    ///
+    /// [PNG]: https://en.wikipedia.org/wiki/PNG
+    fn from_url(url: String, hotspot_x: u16, hotspot_y: u16) -> CustomCursorSource;
+
+    /// Crates a new animated cursor from multiple [`CustomCursor`]s.
+    /// Supplied `cursors` can't be empty or other animations.
+    fn from_animation(
+        duration: Duration,
+        cursors: Vec<CustomCursor>,
+    ) -> Result<CustomCursorSource, BadAnimation>;
+}
+
+impl CustomCursorExtWebSys for CustomCursor {
+    fn is_animation(&self) -> bool {
+        self.inner.animation
+    }
+
+    fn from_url(url: String, hotspot_x: u16, hotspot_y: u16) -> CustomCursorSource {
+        CustomCursorSource { inner: PlatformCustomCursorSource::Url { url, hotspot_x, hotspot_y } }
+    }
+
+    fn from_animation(
+        duration: Duration,
+        cursors: Vec<CustomCursor>,
+    ) -> Result<CustomCursorSource, BadAnimation> {
+        if cursors.is_empty() {
+            return Err(BadAnimation::Empty);
+        }
+
+        if cursors.iter().any(CustomCursor::is_animation) {
+            return Err(BadAnimation::Animation);
+        }
+
+        Ok(CustomCursorSource {
+            inner: PlatformCustomCursorSource::Animation { duration, cursors },
+        })
+    }
+}
+
+/// An error produced when using [`CustomCursor::from_animation`] with invalid arguments.
+#[derive(Debug, Clone)]
+pub enum BadAnimation {
+    /// Produced when no cursors were supplied.
+    Empty,
+    /// Produced when a supplied cursor is an animation.
+    Animation,
+}
+
+impl fmt::Display for BadAnimation {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Empty => write!(f, "No cursors supplied"),
+            Self::Animation => write!(f, "A supplied cursor is an animation"),
+        }
+    }
+}
+
+impl Error for BadAnimation {}
+
+#[cfg(not(web_platform))]
+struct PlatformCustomCursorFuture;
+
+#[derive(Debug)]
+pub struct CustomCursorFuture(pub(crate) PlatformCustomCursorFuture);
+
+impl Future for CustomCursorFuture {
+    type Output = Result<CustomCursor, CustomCursorError>;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        Pin::new(&mut self.0).poll(cx).map_ok(|cursor| CustomCursor { inner: cursor })
+    }
+}
+
+#[derive(Clone, Debug)]
+pub enum CustomCursorError {
+    Blob,
+    Decode(String),
+    Animation,
+}
+
+impl Display for CustomCursorError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Blob => write!(f, "failed to create `Blob`"),
+            Self::Decode(error) => write!(f, "failed to decode image: {error}"),
+            Self::Animation => {
+                write!(f, "found `CustomCursor` that is an animation when building an animation")
+            },
+        }
+    }
+}
+
+impl Error for CustomCursorError {}
diff --git a/vendor/winit/src/platform/windows.rs b/vendor/winit/src/platform/windows.rs
new file mode 100644
index 00000000..e4593be1
--- /dev/null
+++ b/vendor/winit/src/platform/windows.rs
@@ -0,0 +1,767 @@
+//! # Windows
+//!
+//! The supported OS version is Windows 7 or higher, though Windows 10 is
+//! tested regularly.
+use std::borrow::Borrow;
+use std::ffi::c_void;
+use std::path::Path;
+
+use crate::dpi::PhysicalSize;
+use crate::event::DeviceId;
+use crate::event_loop::EventLoopBuilder;
+use crate::monitor::MonitorHandle;
+use crate::window::{BadIcon, Icon, Window, WindowAttributes};
+
+/// Window Handle type used by Win32 API
+pub type HWND = isize;
+/// Menu Handle type used by Win32 API
+pub type HMENU = isize;
+/// Monitor Handle type used by Win32 API
+pub type HMONITOR = isize;
+
+/// Describes a system-drawn backdrop material of a window.
+///
+/// For a detailed explanation, see [`DWM_SYSTEMBACKDROP_TYPE docs`].
+///
+/// [`DWM_SYSTEMBACKDROP_TYPE docs`]: https://learn.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwm_systembackdrop_type
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum BackdropType {
+    /// Corresponds to `DWMSBT_AUTO`.
+    ///
+    /// Usually draws a default backdrop effect on the title bar.
+    #[default]
+    Auto = 0,
+
+    /// Corresponds to `DWMSBT_NONE`.
+    None = 1,
+
+    /// Corresponds to `DWMSBT_MAINWINDOW`.
+    ///
+    /// Draws the Mica backdrop material.
+    MainWindow = 2,
+
+    /// Corresponds to `DWMSBT_TRANSIENTWINDOW`.
+    ///
+    /// Draws the Background Acrylic backdrop material.
+    TransientWindow = 3,
+
+    /// Corresponds to `DWMSBT_TABBEDWINDOW`.
+    ///
+    /// Draws the Alt Mica backdrop material.
+    TabbedWindow = 4,
+}
+
+/// Describes a color used by Windows
+#[repr(transparent)]
+#[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)]
+pub struct Color(u32);
+
+impl Color {
+    // Special constant only valid for the window border and therefore modeled using Option<Color>
+    // for user facing code
+    const NONE: Color = Color(0xfffffffe);
+    /// Use the system's default color
+    pub const SYSTEM_DEFAULT: Color = Color(0xffffffff);
+
+    /// Create a new color from the given RGB values
+    pub const fn from_rgb(r: u8, g: u8, b: u8) -> Self {
+        Self((r as u32) | ((g as u32) << 8) | ((b as u32) << 16))
+    }
+}
+
+impl Default for Color {
+    fn default() -> Self {
+        Self::SYSTEM_DEFAULT
+    }
+}
+
+/// Describes how the corners of a window should look like.
+///
+/// For a detailed explanation, see [`DWM_WINDOW_CORNER_PREFERENCE docs`].
+///
+/// [`DWM_WINDOW_CORNER_PREFERENCE docs`]: https://learn.microsoft.com/en-us/windows/win32/api/dwmapi/ne-dwmapi-dwm_window_corner_preference
+#[repr(i32)]
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum CornerPreference {
+    /// Corresponds to `DWMWCP_DEFAULT`.
+    ///
+    /// Let the system decide when to round window corners.
+    #[default]
+    Default = 0,
+
+    /// Corresponds to `DWMWCP_DONOTROUND`.
+    ///
+    /// Never round window corners.
+    DoNotRound = 1,
+
+    /// Corresponds to `DWMWCP_ROUND`.
+    ///
+    /// Round the corners, if appropriate.
+    Round = 2,
+
+    /// Corresponds to `DWMWCP_ROUNDSMALL`.
+    ///
+    /// Round the corners if appropriate, with a small radius.
+    RoundSmall = 3,
+}
+
+/// A wrapper around a [`Window`] that ignores thread-specific window handle limitations.
+///
+/// See [`WindowBorrowExtWindows::any_thread`] for more information.
+#[derive(Debug)]
+pub struct AnyThread<W>(W);
+
+impl<W: Borrow<Window>> AnyThread<W> {
+    /// Get a reference to the inner window.
+    #[inline]
+    pub fn get_ref(&self) -> &Window {
+        self.0.borrow()
+    }
+
+    /// Get a reference to the inner object.
+    #[inline]
+    pub fn inner(&self) -> &W {
+        &self.0
+    }
+
+    /// Unwrap and get the inner window.
+    #[inline]
+    pub fn into_inner(self) -> W {
+        self.0
+    }
+}
+
+impl<W: Borrow<Window>> AsRef<Window> for AnyThread<W> {
+    fn as_ref(&self) -> &Window {
+        self.get_ref()
+    }
+}
+
+impl<W: Borrow<Window>> Borrow<Window> for AnyThread<W> {
+    fn borrow(&self) -> &Window {
+        self.get_ref()
+    }
+}
+
+impl<W: Borrow<Window>> std::ops::Deref for AnyThread<W> {
+    type Target = Window;
+
+    fn deref(&self) -> &Self::Target {
+        self.get_ref()
+    }
+}
+
+#[cfg(feature = "rwh_06")]
+impl<W: Borrow<Window>> rwh_06::HasWindowHandle for AnyThread<W> {
+    fn window_handle(&self) -> Result<rwh_06::WindowHandle<'_>, rwh_06::HandleError> {
+        // SAFETY: The top level user has asserted this is only used safely.
+        unsafe { self.get_ref().window_handle_any_thread() }
+    }
+}
+
+/// Additional methods on `EventLoop` that are specific to Windows.
+pub trait EventLoopBuilderExtWindows {
+    /// Whether to allow the event loop to be created off of the main thread.
+    ///
+    /// By default, the window is only allowed to be created on the main
+    /// thread, to make platform compatibility easier.
+    ///
+    /// # `Window` caveats
+    ///
+    /// Note that any `Window` created on the new thread will be destroyed when the thread
+    /// terminates. Attempting to use a `Window` after its parent thread terminates has
+    /// unspecified, although explicitly not undefined, behavior.
+    fn with_any_thread(&mut self, any_thread: bool) -> &mut Self;
+
+    /// Whether to enable process-wide DPI awareness.
+    ///
+    /// By default, `winit` will attempt to enable process-wide DPI awareness. If
+    /// that's undesirable, you can disable it with this function.
+    ///
+    /// # Example
+    ///
+    /// Disable process-wide DPI awareness.
+    ///
+    /// ```
+    /// use winit::event_loop::EventLoopBuilder;
+    /// #[cfg(target_os = "windows")]
+    /// use winit::platform::windows::EventLoopBuilderExtWindows;
+    ///
+    /// let mut builder = EventLoopBuilder::new();
+    /// #[cfg(target_os = "windows")]
+    /// builder.with_dpi_aware(false);
+    /// # if false { // We can't test this part
+    /// let event_loop = builder.build();
+    /// # }
+    /// ```
+    fn with_dpi_aware(&mut self, dpi_aware: bool) -> &mut Self;
+
+    /// A callback to be executed before dispatching a win32 message to the window procedure.
+    /// Return true to disable winit's internal message dispatching.
+    ///
+    /// # Example
+    ///
+    /// ```
+    /// # use windows_sys::Win32::UI::WindowsAndMessaging::{ACCEL, CreateAcceleratorTableW, TranslateAcceleratorW, DispatchMessageW, TranslateMessage, MSG};
+    /// use winit::event_loop::EventLoopBuilder;
+    /// #[cfg(target_os = "windows")]
+    /// use winit::platform::windows::EventLoopBuilderExtWindows;
+    ///
+    /// let mut builder = EventLoopBuilder::new();
+    /// #[cfg(target_os = "windows")]
+    /// builder.with_msg_hook(|msg|{
+    ///     let msg = msg as *const MSG;
+    /// #   let accels: Vec<ACCEL> = Vec::new();
+    ///     let translated = unsafe {
+    ///         TranslateAcceleratorW(
+    ///             (*msg).hwnd,
+    ///             CreateAcceleratorTableW(accels.as_ptr() as _, 1),
+    ///             msg,
+    ///         ) == 1
+    ///     };
+    ///     translated
+    /// });
+    /// ```
+    fn with_msg_hook<F>(&mut self, callback: F) -> &mut Self
+    where
+        F: FnMut(*const c_void) -> bool + 'static;
+}
+
+impl<T> EventLoopBuilderExtWindows for EventLoopBuilder<T> {
+    #[inline]
+    fn with_any_thread(&mut self, any_thread: bool) -> &mut Self {
+        self.platform_specific.any_thread = any_thread;
+        self
+    }
+
+    #[inline]
+    fn with_dpi_aware(&mut self, dpi_aware: bool) -> &mut Self {
+        self.platform_specific.dpi_aware = dpi_aware;
+        self
+    }
+
+    #[inline]
+    fn with_msg_hook<F>(&mut self, callback: F) -> &mut Self
+    where
+        F: FnMut(*const c_void) -> bool + 'static,
+    {
+        self.platform_specific.msg_hook = Some(Box::new(callback));
+        self
+    }
+}
+
+/// Additional methods on `Window` that are specific to Windows.
+pub trait WindowExtWindows {
+    /// Enables or disables mouse and keyboard input to the specified window.
+    ///
+    /// A window must be enabled before it can be activated.
+    /// If an application has create a modal dialog box by disabling its owner window
+    /// (as described in [`WindowAttributesExtWindows::with_owner_window`]), the application must
+    /// enable the owner window before destroying the dialog box.
+    /// Otherwise, another window will receive the keyboard focus and be activated.
+    ///
+    /// If a child window is disabled, it is ignored when the system tries to determine which
+    /// window should receive mouse messages.
+    ///
+    /// For more information, see <https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enablewindow#remarks>
+    /// and <https://docs.microsoft.com/en-us/windows/win32/winmsg/window-features#disabled-windows>
+    fn set_enable(&self, enabled: bool);
+
+    /// This sets `ICON_BIG`. A good ceiling here is 256x256.
+    fn set_taskbar_icon(&self, taskbar_icon: Option<Icon>);
+
+    /// Whether to show or hide the window icon in the taskbar.
+    fn set_skip_taskbar(&self, skip: bool);
+
+    /// Shows or hides the background drop shadow for undecorated windows.
+    ///
+    /// Enabling the shadow causes a thin 1px line to appear on the top of the window.
+    fn set_undecorated_shadow(&self, shadow: bool);
+
+    /// Sets system-drawn backdrop type.
+    ///
+    /// Requires Windows 11 build 22523+.
+    fn set_system_backdrop(&self, backdrop_type: BackdropType);
+
+    /// Sets the color of the window border.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn set_border_color(&self, color: Option<Color>);
+
+    /// Sets the background color of the title bar.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn set_title_background_color(&self, color: Option<Color>);
+
+    /// Sets the color of the window title.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn set_title_text_color(&self, color: Color);
+
+    /// Sets the preferred style of the window corners.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn set_corner_preference(&self, preference: CornerPreference);
+
+    /// Get the raw window handle for this [`Window`] without checking for thread affinity.
+    ///
+    /// Window handles in Win32 have a property called "thread affinity" that ties them to their
+    /// origin thread. Some operations can only happen on the window's origin thread, while others
+    /// can be called from any thread. For example, [`SetWindowSubclass`] is not thread safe while
+    /// [`GetDC`] is thread safe.
+    ///
+    /// In Rust terms, the window handle is `Send` sometimes but `!Send` other times.
+    ///
+    /// Therefore, in order to avoid confusing threading errors, [`Window`] only returns the
+    /// window handle when the [`window_handle`] function is called from the thread that created
+    /// the window. In other cases, it returns an [`Unavailable`] error.
+    ///
+    /// However in some cases you may already know that you are using the window handle for
+    /// operations that are guaranteed to be thread-safe. In which case this function aims
+    /// to provide an escape hatch so these functions are still accessible from other threads.
+    ///
+    /// # Safety
+    ///
+    /// It is the responsibility of the user to only pass the window handle into thread-safe
+    /// Win32 APIs.
+    ///
+    /// [`SetWindowSubclass`]: https://learn.microsoft.com/en-us/windows/win32/api/commctrl/nf-commctrl-setwindowsubclass
+    /// [`GetDC`]: https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getdc
+    /// [`Window`]: crate::window::Window
+    /// [`window_handle`]: https://docs.rs/raw-window-handle/latest/raw_window_handle/trait.HasWindowHandle.html#tymethod.window_handle
+    /// [`Unavailable`]: https://docs.rs/raw-window-handle/latest/raw_window_handle/enum.HandleError.html#variant.Unavailable
+    ///
+    /// ## Example
+    ///
+    /// ```no_run
+    /// # use winit::window::Window;
+    /// # fn scope(window: Window) {
+    /// use std::thread;
+    /// use winit::platform::windows::WindowExtWindows;
+    /// use winit::raw_window_handle::HasWindowHandle;
+    ///
+    /// // We can get the window handle on the current thread.
+    /// let handle = window.window_handle().unwrap();
+    ///
+    /// // However, on another thread, we can't!
+    /// thread::spawn(move || {
+    ///     assert!(window.window_handle().is_err());
+    ///
+    ///     // We can use this function as an escape hatch.
+    ///     let handle = unsafe { window.window_handle_any_thread().unwrap() };
+    /// });
+    /// # }
+    /// ```
+    #[cfg(feature = "rwh_06")]
+    unsafe fn window_handle_any_thread(
+        &self,
+    ) -> Result<rwh_06::WindowHandle<'_>, rwh_06::HandleError>;
+}
+
+impl WindowExtWindows for Window {
+    #[inline]
+    fn set_enable(&self, enabled: bool) {
+        self.window.set_enable(enabled)
+    }
+
+    #[inline]
+    fn set_taskbar_icon(&self, taskbar_icon: Option<Icon>) {
+        self.window.set_taskbar_icon(taskbar_icon)
+    }
+
+    #[inline]
+    fn set_skip_taskbar(&self, skip: bool) {
+        self.window.set_skip_taskbar(skip)
+    }
+
+    #[inline]
+    fn set_undecorated_shadow(&self, shadow: bool) {
+        self.window.set_undecorated_shadow(shadow)
+    }
+
+    #[inline]
+    fn set_system_backdrop(&self, backdrop_type: BackdropType) {
+        self.window.set_system_backdrop(backdrop_type)
+    }
+
+    #[inline]
+    fn set_border_color(&self, color: Option<Color>) {
+        self.window.set_border_color(color.unwrap_or(Color::NONE))
+    }
+
+    #[inline]
+    fn set_title_background_color(&self, color: Option<Color>) {
+        // The windows docs don't mention NONE as a valid options but it works in practice and is
+        // useful to circumvent the Windows option "Show accent color on title bars and
+        // window borders"
+        self.window.set_title_background_color(color.unwrap_or(Color::NONE))
+    }
+
+    #[inline]
+    fn set_title_text_color(&self, color: Color) {
+        self.window.set_title_text_color(color)
+    }
+
+    #[inline]
+    fn set_corner_preference(&self, preference: CornerPreference) {
+        self.window.set_corner_preference(preference)
+    }
+
+    #[cfg(feature = "rwh_06")]
+    unsafe fn window_handle_any_thread(
+        &self,
+    ) -> Result<rwh_06::WindowHandle<'_>, rwh_06::HandleError> {
+        unsafe {
+            let handle = self.window.rwh_06_no_thread_check()?;
+
+            // SAFETY: The handle is valid in this context.
+            Ok(rwh_06::WindowHandle::borrow_raw(handle))
+        }
+    }
+}
+
+/// Additional methods for anything that dereference to [`Window`].
+///
+/// [`Window`]: crate::window::Window
+pub trait WindowBorrowExtWindows: Borrow<Window> + Sized {
+    /// Create an object that allows accessing the inner window handle in a thread-unsafe way.
+    ///
+    /// It is possible to call [`window_handle_any_thread`] to get around Windows's thread
+    /// affinity limitations. However, it may be desired to pass the [`Window`] into something
+    /// that requires the [`HasWindowHandle`] trait, while ignoring thread affinity limitations.
+    ///
+    /// This function wraps anything that implements `Borrow<Window>` into a structure that
+    /// uses the inner window handle as a mean of implementing [`HasWindowHandle`]. It wraps
+    /// `Window`, `&Window`, `Arc<Window>`, and other reference types.
+    ///
+    /// # Safety
+    ///
+    /// It is the responsibility of the user to only pass the window handle into thread-safe
+    /// Win32 APIs.
+    ///
+    /// [`window_handle_any_thread`]: WindowExtWindows::window_handle_any_thread
+    /// [`Window`]: crate::window::Window
+    /// [`HasWindowHandle`]: rwh_06::HasWindowHandle
+    unsafe fn any_thread(self) -> AnyThread<Self> {
+        AnyThread(self)
+    }
+}
+
+impl<W: Borrow<Window> + Sized> WindowBorrowExtWindows for W {}
+
+/// Additional methods on `WindowAttributes` that are specific to Windows.
+#[allow(rustdoc::broken_intra_doc_links)]
+pub trait WindowAttributesExtWindows {
+    /// Set an owner to the window to be created. Can be used to create a dialog box, for example.
+    /// This only works when [`WindowAttributes::with_parent_window`] isn't called or set to `None`.
+    /// Can be used in combination with
+    /// [`WindowExtWindows::set_enable(false)`][WindowExtWindows::set_enable] on the owner
+    /// window to create a modal dialog box.
+    ///
+    /// From MSDN:
+    /// - An owned window is always above its owner in the z-order.
+    /// - The system automatically destroys an owned window when its owner is destroyed.
+    /// - An owned window is hidden when its owner is minimized.
+    ///
+    /// For more information, see <https://docs.microsoft.com/en-us/windows/win32/winmsg/window-features#owned-windows>
+    fn with_owner_window(self, parent: HWND) -> Self;
+
+    /// Sets a menu on the window to be created.
+    ///
+    /// Parent and menu are mutually exclusive; a child window cannot have a menu!
+    ///
+    /// The menu must have been manually created beforehand with [`CreateMenu`] or similar.
+    ///
+    /// Note: Dark mode cannot be supported for win32 menus, it's simply not possible to change how
+    /// the menus look. If you use this, it is recommended that you combine it with
+    /// `with_theme(Some(Theme::Light))` to avoid a jarring effect.
+    #[cfg_attr(
+        windows_platform,
+        doc = "[`CreateMenu`]: windows_sys::Win32::UI::WindowsAndMessaging::CreateMenu"
+    )]
+    #[cfg_attr(not(windows_platform), doc = "[`CreateMenu`]: #only-available-on-windows")]
+    fn with_menu(self, menu: HMENU) -> Self;
+
+    /// This sets `ICON_BIG`. A good ceiling here is 256x256.
+    fn with_taskbar_icon(self, taskbar_icon: Option<Icon>) -> Self;
+
+    /// This sets `WS_EX_NOREDIRECTIONBITMAP`.
+    fn with_no_redirection_bitmap(self, flag: bool) -> Self;
+
+    /// Enables or disables drag and drop support (enabled by default). Will interfere with other
+    /// crates that use multi-threaded COM API (`CoInitializeEx` with `COINIT_MULTITHREADED`
+    /// instead of `COINIT_APARTMENTTHREADED`) on the same thread. Note that winit may still
+    /// attempt to initialize COM API regardless of this option. Currently only fullscreen mode
+    /// does that, but there may be more in the future. If you need COM API with
+    /// `COINIT_MULTITHREADED` you must initialize it before calling any winit functions. See <https://docs.microsoft.com/en-us/windows/win32/api/objbase/nf-objbase-coinitialize#remarks> for more information.
+    fn with_drag_and_drop(self, flag: bool) -> Self;
+
+    /// Whether show or hide the window icon in the taskbar.
+    fn with_skip_taskbar(self, skip: bool) -> Self;
+
+    /// Customize the window class name.
+    fn with_class_name<S: Into<String>>(self, class_name: S) -> Self;
+
+    /// Shows or hides the background drop shadow for undecorated windows.
+    ///
+    /// The shadow is hidden by default.
+    /// Enabling the shadow causes a thin 1px line to appear on the top of the window.
+    fn with_undecorated_shadow(self, shadow: bool) -> Self;
+
+    /// Sets system-drawn backdrop type.
+    ///
+    /// Requires Windows 11 build 22523+.
+    fn with_system_backdrop(self, backdrop_type: BackdropType) -> Self;
+
+    /// This sets or removes `WS_CLIPCHILDREN` style.
+    fn with_clip_children(self, flag: bool) -> Self;
+
+    /// Sets the color of the window border.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn with_border_color(self, color: Option<Color>) -> Self;
+
+    /// Sets the background color of the title bar.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn with_title_background_color(self, color: Option<Color>) -> Self;
+
+    /// Sets the color of the window title.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn with_title_text_color(self, color: Color) -> Self;
+
+    /// Sets the preferred style of the window corners.
+    ///
+    /// Supported starting with Windows 11 Build 22000.
+    fn with_corner_preference(self, corners: CornerPreference) -> Self;
+}
+
+impl WindowAttributesExtWindows for WindowAttributes {
+    #[inline]
+    fn with_owner_window(mut self, parent: HWND) -> Self {
+        self.platform_specific.owner = Some(parent);
+        self
+    }
+
+    #[inline]
+    fn with_menu(mut self, menu: HMENU) -> Self {
+        self.platform_specific.menu = Some(menu);
+        self
+    }
+
+    #[inline]
+    fn with_taskbar_icon(mut self, taskbar_icon: Option<Icon>) -> Self {
+        self.platform_specific.taskbar_icon = taskbar_icon;
+        self
+    }
+
+    #[inline]
+    fn with_no_redirection_bitmap(mut self, flag: bool) -> Self {
+        self.platform_specific.no_redirection_bitmap = flag;
+        self
+    }
+
+    #[inline]
+    fn with_drag_and_drop(mut self, flag: bool) -> Self {
+        self.platform_specific.drag_and_drop = flag;
+        self
+    }
+
+    #[inline]
+    fn with_skip_taskbar(mut self, skip: bool) -> Self {
+        self.platform_specific.skip_taskbar = skip;
+        self
+    }
+
+    #[inline]
+    fn with_class_name<S: Into<String>>(mut self, class_name: S) -> Self {
+        self.platform_specific.class_name = class_name.into();
+        self
+    }
+
+    #[inline]
+    fn with_undecorated_shadow(mut self, shadow: bool) -> Self {
+        self.platform_specific.decoration_shadow = shadow;
+        self
+    }
+
+    #[inline]
+    fn with_system_backdrop(mut self, backdrop_type: BackdropType) -> Self {
+        self.platform_specific.backdrop_type = backdrop_type;
+        self
+    }
+
+    #[inline]
+    fn with_clip_children(mut self, flag: bool) -> Self {
+        self.platform_specific.clip_children = flag;
+        self
+    }
+
+    #[inline]
+    fn with_border_color(mut self, color: Option<Color>) -> Self {
+        self.platform_specific.border_color = Some(color.unwrap_or(Color::NONE));
+        self
+    }
+
+    #[inline]
+    fn with_title_background_color(mut self, color: Option<Color>) -> Self {
+        self.platform_specific.title_background_color = Some(color.unwrap_or(Color::NONE));
+        self
+    }
+
+    #[inline]
+    fn with_title_text_color(mut self, color: Color) -> Self {
+        self.platform_specific.title_text_color = Some(color);
+        self
+    }
+
+    #[inline]
+    fn with_corner_preference(mut self, corners: CornerPreference) -> Self {
+        self.platform_specific.corner_preference = Some(corners);
+        self
+    }
+}
+
+/// Additional methods on `MonitorHandle` that are specific to Windows.
+pub trait MonitorHandleExtWindows {
+    /// Returns the name of the monitor adapter specific to the Win32 API.
+    fn native_id(&self) -> String;
+
+    /// Returns the handle of the monitor - `HMONITOR`.
+    fn hmonitor(&self) -> HMONITOR;
+}
+
+impl MonitorHandleExtWindows for MonitorHandle {
+    #[inline]
+    fn native_id(&self) -> String {
+        self.inner.native_identifier()
+    }
+
+    #[inline]
+    fn hmonitor(&self) -> HMONITOR {
+        self.inner.hmonitor()
+    }
+}
+
+/// Additional methods on `DeviceId` that are specific to Windows.
+pub trait DeviceIdExtWindows {
+    /// Returns an identifier that persistently refers to this specific device.
+    ///
+    /// Will return `None` if the device is no longer available.
+    fn persistent_identifier(&self) -> Option<String>;
+}
+
+impl DeviceIdExtWindows for DeviceId {
+    #[inline]
+    fn persistent_identifier(&self) -> Option<String> {
+        self.0.persistent_identifier()
+    }
+}
+
+/// Additional methods on `Icon` that are specific to Windows.
+///
+/// Windows icons can be created from files, or from the [`embedded resources`](https://learn.microsoft.com/en-us/windows/win32/menurc/about-resource-files).
+///
+/// The `ICON` resource definition statement use the following syntax:
+/// ```rc
+/// nameID ICON filename
+/// ```
+/// `nameID` is a unique name or a 16-bit unsigned integer value identifying the resource,
+/// `filename` is the name of the file that contains the resource.
+///
+/// More information about the `ICON` resource can be found at [`Microsoft Learn`](https://learn.microsoft.com/en-us/windows/win32/menurc/icon-resource) portal.
+pub trait IconExtWindows: Sized {
+    /// Create an icon from a file path.
+    ///
+    /// Specify `size` to load a specific icon size from the file, or `None` to load the default
+    /// icon size from the file.
+    ///
+    /// In cases where the specified size does not exist in the file, Windows may perform scaling
+    /// to get an icon of the desired size.
+    fn from_path<P: AsRef<Path>>(path: P, size: Option<PhysicalSize<u32>>)
+        -> Result<Self, BadIcon>;
+
+    /// Create an icon from a resource embedded in this executable or library by its ordinal id.
+    ///
+    /// The valid `ordinal` values range from 1 to [`u16::MAX`] (inclusive). The value `0` is an
+    /// invalid ordinal id, but it can be used with [`from_resource_name`] as `"0"`.
+    ///
+    /// [`from_resource_name`]: IconExtWindows::from_resource_name
+    ///
+    /// Specify `size` to load a specific icon size from the file, or `None` to load the default
+    /// icon size from the file.
+    ///
+    /// In cases where the specified size does not exist in the file, Windows may perform scaling
+    /// to get an icon of the desired size.
+    fn from_resource(ordinal: u16, size: Option<PhysicalSize<u32>>) -> Result<Self, BadIcon>;
+
+    /// Create an icon from a resource embedded in this executable or library by its name.
+    ///
+    /// Specify `size` to load a specific icon size from the file, or `None` to load the default
+    /// icon size from the file.
+    ///
+    /// In cases where the specified size does not exist in the file, Windows may perform scaling
+    /// to get an icon of the desired size.
+    ///
+    /// # Notes
+    ///
+    /// Consider the following resource definition statements:
+    /// ```rc
+    /// app     ICON "app.ico"
+    /// 1       ICON "a.ico"
+    /// 0027    ICON "custom.ico"
+    /// 0       ICON "alt.ico"
+    /// ```
+    ///
+    /// Due to some internal implementation details of the resource embedding/loading process on
+    /// Windows platform, strings that can be interpreted as 16-bit unsigned integers (`"1"`,
+    /// `"002"`, etc.) cannot be used as valid resource names, and instead should be passed into
+    /// [`from_resource`]:
+    ///
+    /// [`from_resource`]: IconExtWindows::from_resource
+    ///
+    /// ```rust,no_run
+    /// use winit::platform::windows::IconExtWindows;
+    /// use winit::window::Icon;
+    ///
+    /// assert!(Icon::from_resource_name("app", None).is_ok());
+    /// assert!(Icon::from_resource(1, None).is_ok());
+    /// assert!(Icon::from_resource(27, None).is_ok());
+    /// assert!(Icon::from_resource_name("27", None).is_err());
+    /// assert!(Icon::from_resource_name("0027", None).is_err());
+    /// ```
+    ///
+    /// While `0` cannot be used as an ordinal id (see [`from_resource`]), it can be used as a
+    /// name:
+    ///
+    /// [`from_resource`]: IconExtWindows::from_resource
+    ///
+    /// ```rust,no_run
+    /// # use winit::platform::windows::IconExtWindows;
+    /// # use winit::window::Icon;
+    /// assert!(Icon::from_resource_name("0", None).is_ok());
+    /// assert!(Icon::from_resource(0, None).is_err());
+    /// ```
+    fn from_resource_name(name: &str, size: Option<PhysicalSize<u32>>) -> Result<Self, BadIcon>;
+}
+
+impl IconExtWindows for Icon {
+    fn from_path<P: AsRef<Path>>(
+        path: P,
+        size: Option<PhysicalSize<u32>>,
+    ) -> Result<Self, BadIcon> {
+        let win_icon = crate::platform_impl::WinIcon::from_path(path, size)?;
+        Ok(Icon { inner: win_icon })
+    }
+
+    fn from_resource(ordinal: u16, size: Option<PhysicalSize<u32>>) -> Result<Self, BadIcon> {
+        let win_icon = crate::platform_impl::WinIcon::from_resource(ordinal, size)?;
+        Ok(Icon { inner: win_icon })
+    }
+
+    fn from_resource_name(name: &str, size: Option<PhysicalSize<u32>>) -> Result<Self, BadIcon> {
+        let win_icon = crate::platform_impl::WinIcon::from_resource_name(name, size)?;
+        Ok(Icon { inner: win_icon })
+    }
+}
diff --git a/vendor/winit/src/platform/x11.rs b/vendor/winit/src/platform/x11.rs
new file mode 100644
index 00000000..4ab900c9
--- /dev/null
+++ b/vendor/winit/src/platform/x11.rs
@@ -0,0 +1,254 @@
+//! # X11
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+
+use crate::event_loop::{ActiveEventLoop, EventLoop, EventLoopBuilder};
+use crate::monitor::MonitorHandle;
+use crate::window::{Window, WindowAttributes};
+
+use crate::dpi::Size;
+
+/// X window type. Maps directly to
+/// [`_NET_WM_WINDOW_TYPE`](https://specifications.freedesktop.org/wm-spec/wm-spec-1.5.html).
+#[derive(Debug, Default, Copy, Clone, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum WindowType {
+    /// A desktop feature. This can include a single window containing desktop icons with the same
+    /// dimensions as the screen, allowing the desktop environment to have full control of the
+    /// desktop, without the need for proxying root window clicks.
+    Desktop,
+    /// A dock or panel feature. Typically a Window Manager would keep such windows on top of all
+    /// other windows.
+    Dock,
+    /// Toolbar windows. "Torn off" from the main application.
+    Toolbar,
+    /// Pinnable menu windows. "Torn off" from the main application.
+    Menu,
+    /// A small persistent utility window, such as a palette or toolbox.
+    Utility,
+    /// The window is a splash screen displayed as an application is starting up.
+    Splash,
+    /// This is a dialog window.
+    Dialog,
+    /// A dropdown menu that usually appears when the user clicks on an item in a menu bar.
+    /// This property is typically used on override-redirect windows.
+    DropdownMenu,
+    /// A popup menu that usually appears when the user right clicks on an object.
+    /// This property is typically used on override-redirect windows.
+    PopupMenu,
+    /// A tooltip window. Usually used to show additional information when hovering over an object
+    /// with the cursor. This property is typically used on override-redirect windows.
+    Tooltip,
+    /// The window is a notification.
+    /// This property is typically used on override-redirect windows.
+    Notification,
+    /// This should be used on the windows that are popped up by combo boxes.
+    /// This property is typically used on override-redirect windows.
+    Combo,
+    /// This indicates the window is being dragged.
+    /// This property is typically used on override-redirect windows.
+    Dnd,
+    /// This is a normal, top-level window.
+    #[default]
+    Normal,
+}
+
+/// The first argument in the provided hook will be the pointer to `XDisplay`
+/// and the second one the pointer to [`XErrorEvent`]. The returned `bool` is an
+/// indicator whether the error was handled by the callback.
+///
+/// [`XErrorEvent`]: https://linux.die.net/man/3/xerrorevent
+pub type XlibErrorHook =
+    Box<dyn Fn(*mut std::ffi::c_void, *mut std::ffi::c_void) -> bool + Send + Sync>;
+
+/// A unique identifier for an X11 visual.
+pub type XVisualID = u32;
+
+/// A unique identifier for an X11 window.
+pub type XWindow = u32;
+
+/// Hook to winit's xlib error handling callback.
+///
+/// This method is provided as a safe way to handle the errors coming from X11
+/// when using xlib in external crates, like glutin for GLX access. Trying to
+/// handle errors by speculating with `XSetErrorHandler` is [`unsafe`].
+///
+/// **Be aware that your hook is always invoked and returning `true` from it will
+/// prevent `winit` from getting the error itself. It's wise to always return
+/// `false` if you're not initiated the `Sync`.**
+///
+/// [`unsafe`]: https://www.remlab.net/op/xlib.shtml
+#[inline]
+pub fn register_xlib_error_hook(hook: XlibErrorHook) {
+    // Append new hook.
+    crate::platform_impl::XLIB_ERROR_HOOKS.lock().unwrap().push(hook);
+}
+
+/// Additional methods on [`ActiveEventLoop`] that are specific to X11.
+pub trait ActiveEventLoopExtX11 {
+    /// True if the [`ActiveEventLoop`] uses X11.
+    fn is_x11(&self) -> bool;
+}
+
+impl ActiveEventLoopExtX11 for ActiveEventLoop {
+    #[inline]
+    fn is_x11(&self) -> bool {
+        !self.p.is_wayland()
+    }
+}
+
+/// Additional methods on [`EventLoop`] that are specific to X11.
+pub trait EventLoopExtX11 {
+    /// True if the [`EventLoop`] uses X11.
+    fn is_x11(&self) -> bool;
+}
+
+impl<T: 'static> EventLoopExtX11 for EventLoop<T> {
+    #[inline]
+    fn is_x11(&self) -> bool {
+        !self.event_loop.is_wayland()
+    }
+}
+
+/// Additional methods on [`EventLoopBuilder`] that are specific to X11.
+pub trait EventLoopBuilderExtX11 {
+    /// Force using X11.
+    fn with_x11(&mut self) -> &mut Self;
+
+    /// Whether to allow the event loop to be created off of the main thread.
+    ///
+    /// By default, the window is only allowed to be created on the main
+    /// thread, to make platform compatibility easier.
+    fn with_any_thread(&mut self, any_thread: bool) -> &mut Self;
+}
+
+impl<T> EventLoopBuilderExtX11 for EventLoopBuilder<T> {
+    #[inline]
+    fn with_x11(&mut self) -> &mut Self {
+        self.platform_specific.forced_backend = Some(crate::platform_impl::Backend::X);
+        self
+    }
+
+    #[inline]
+    fn with_any_thread(&mut self, any_thread: bool) -> &mut Self {
+        self.platform_specific.any_thread = any_thread;
+        self
+    }
+}
+
+/// Additional methods on [`Window`] that are specific to X11.
+pub trait WindowExtX11 {}
+
+impl WindowExtX11 for Window {}
+
+/// Additional methods on [`WindowAttributes`] that are specific to X11.
+pub trait WindowAttributesExtX11 {
+    /// Create this window with a specific X11 visual.
+    fn with_x11_visual(self, visual_id: XVisualID) -> Self;
+
+    fn with_x11_screen(self, screen_id: i32) -> Self;
+
+    /// Build window with the given `general` and `instance` names.
+    ///
+    /// The `general` sets general class of `WM_CLASS(STRING)`, while `instance` set the
+    /// instance part of it. The resulted property looks like `WM_CLASS(STRING) = "instance",
+    /// "general"`.
+    ///
+    /// For details about application ID conventions, see the
+    /// [Desktop Entry Spec](https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html#desktop-file-id)
+    fn with_name(self, general: impl Into<String>, instance: impl Into<String>) -> Self;
+
+    /// Build window with override-redirect flag; defaults to false.
+    fn with_override_redirect(self, override_redirect: bool) -> Self;
+
+    /// Build window with `_NET_WM_WINDOW_TYPE` hints; defaults to `Normal`.
+    fn with_x11_window_type(self, x11_window_type: Vec<WindowType>) -> Self;
+
+    /// Build window with base size hint.
+    ///
+    /// ```
+    /// # use winit::dpi::{LogicalSize, PhysicalSize};
+    /// # use winit::window::Window;
+    /// # use winit::platform::x11::WindowAttributesExtX11;
+    /// // Specify the size in logical dimensions like this:
+    /// Window::default_attributes().with_base_size(LogicalSize::new(400.0, 200.0));
+    ///
+    /// // Or specify the size in physical dimensions like this:
+    /// Window::default_attributes().with_base_size(PhysicalSize::new(400, 200));
+    /// ```
+    fn with_base_size<S: Into<Size>>(self, base_size: S) -> Self;
+
+    /// Embed this window into another parent window.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use winit::window::Window;
+    /// use winit::event_loop::ActiveEventLoop;
+    /// use winit::platform::x11::{XWindow, WindowAttributesExtX11};
+    /// # fn create_window(event_loop: &ActiveEventLoop) -> Result<(), Box<dyn std::error::Error>> {
+    /// let parent_window_id = std::env::args().nth(1).unwrap().parse::<XWindow>()?;
+    /// let window_attributes = Window::default_attributes().with_embed_parent_window(parent_window_id);
+    /// let window = event_loop.create_window(window_attributes)?;
+    /// # Ok(()) }
+    /// ```
+    fn with_embed_parent_window(self, parent_window_id: XWindow) -> Self;
+}
+
+impl WindowAttributesExtX11 for WindowAttributes {
+    #[inline]
+    fn with_x11_visual(mut self, visual_id: XVisualID) -> Self {
+        self.platform_specific.x11.visual_id = Some(visual_id);
+        self
+    }
+
+    #[inline]
+    fn with_x11_screen(mut self, screen_id: i32) -> Self {
+        self.platform_specific.x11.screen_id = Some(screen_id);
+        self
+    }
+
+    #[inline]
+    fn with_name(mut self, general: impl Into<String>, instance: impl Into<String>) -> Self {
+        self.platform_specific.name =
+            Some(crate::platform_impl::ApplicationName::new(general.into(), instance.into()));
+        self
+    }
+
+    #[inline]
+    fn with_override_redirect(mut self, override_redirect: bool) -> Self {
+        self.platform_specific.x11.override_redirect = override_redirect;
+        self
+    }
+
+    #[inline]
+    fn with_x11_window_type(mut self, x11_window_types: Vec<WindowType>) -> Self {
+        self.platform_specific.x11.x11_window_types = x11_window_types;
+        self
+    }
+
+    #[inline]
+    fn with_base_size<S: Into<Size>>(mut self, base_size: S) -> Self {
+        self.platform_specific.x11.base_size = Some(base_size.into());
+        self
+    }
+
+    #[inline]
+    fn with_embed_parent_window(mut self, parent_window_id: XWindow) -> Self {
+        self.platform_specific.x11.embed_window = Some(parent_window_id);
+        self
+    }
+}
+
+/// Additional methods on `MonitorHandle` that are specific to X11.
+pub trait MonitorHandleExtX11 {
+    /// Returns the inner identifier of the monitor.
+    fn native_id(&self) -> u32;
+}
+
+impl MonitorHandleExtX11 for MonitorHandle {
+    #[inline]
+    fn native_id(&self) -> u32 {
+        self.inner.native_identifier()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/android/keycodes.rs b/vendor/winit/src/platform_impl/android/keycodes.rs
new file mode 100644
index 00000000..207d549f
--- /dev/null
+++ b/vendor/winit/src/platform_impl/android/keycodes.rs
@@ -0,0 +1,608 @@
+use android_activity::input::{KeyAction, KeyEvent, KeyMapChar, Keycode};
+use android_activity::AndroidApp;
+
+use crate::keyboard::{Key, KeyCode, KeyLocation, NamedKey, NativeKey, NativeKeyCode, PhysicalKey};
+
+pub fn to_physical_key(keycode: Keycode) -> PhysicalKey {
+    PhysicalKey::Code(match keycode {
+        Keycode::A => KeyCode::KeyA,
+        Keycode::B => KeyCode::KeyB,
+        Keycode::C => KeyCode::KeyC,
+        Keycode::D => KeyCode::KeyD,
+        Keycode::E => KeyCode::KeyE,
+        Keycode::F => KeyCode::KeyF,
+        Keycode::G => KeyCode::KeyG,
+        Keycode::H => KeyCode::KeyH,
+        Keycode::I => KeyCode::KeyI,
+        Keycode::J => KeyCode::KeyJ,
+        Keycode::K => KeyCode::KeyK,
+        Keycode::L => KeyCode::KeyL,
+        Keycode::M => KeyCode::KeyM,
+        Keycode::N => KeyCode::KeyN,
+        Keycode::O => KeyCode::KeyO,
+        Keycode::P => KeyCode::KeyP,
+        Keycode::Q => KeyCode::KeyQ,
+        Keycode::R => KeyCode::KeyR,
+        Keycode::S => KeyCode::KeyS,
+        Keycode::T => KeyCode::KeyT,
+        Keycode::U => KeyCode::KeyU,
+        Keycode::V => KeyCode::KeyV,
+        Keycode::W => KeyCode::KeyW,
+        Keycode::X => KeyCode::KeyX,
+        Keycode::Y => KeyCode::KeyY,
+        Keycode::Z => KeyCode::KeyZ,
+
+        Keycode::Keycode0 => KeyCode::Digit0,
+        Keycode::Keycode1 => KeyCode::Digit1,
+        Keycode::Keycode2 => KeyCode::Digit2,
+        Keycode::Keycode3 => KeyCode::Digit3,
+        Keycode::Keycode4 => KeyCode::Digit4,
+        Keycode::Keycode5 => KeyCode::Digit5,
+        Keycode::Keycode6 => KeyCode::Digit6,
+        Keycode::Keycode7 => KeyCode::Digit7,
+        Keycode::Keycode8 => KeyCode::Digit8,
+        Keycode::Keycode9 => KeyCode::Digit9,
+
+        Keycode::Numpad0 => KeyCode::Numpad0,
+        Keycode::Numpad1 => KeyCode::Numpad1,
+        Keycode::Numpad2 => KeyCode::Numpad2,
+        Keycode::Numpad3 => KeyCode::Numpad3,
+        Keycode::Numpad4 => KeyCode::Numpad4,
+        Keycode::Numpad5 => KeyCode::Numpad5,
+        Keycode::Numpad6 => KeyCode::Numpad6,
+        Keycode::Numpad7 => KeyCode::Numpad7,
+        Keycode::Numpad8 => KeyCode::Numpad8,
+        Keycode::Numpad9 => KeyCode::Numpad9,
+
+        Keycode::NumpadAdd => KeyCode::NumpadAdd,
+        Keycode::NumpadSubtract => KeyCode::NumpadSubtract,
+        Keycode::NumpadMultiply => KeyCode::NumpadMultiply,
+        Keycode::NumpadDivide => KeyCode::NumpadDivide,
+        Keycode::NumpadEnter => KeyCode::NumpadEnter,
+        Keycode::NumpadEquals => KeyCode::NumpadEqual,
+        Keycode::NumpadComma => KeyCode::NumpadComma,
+        Keycode::NumpadDot => KeyCode::NumpadDecimal,
+        Keycode::NumLock => KeyCode::NumLock,
+
+        Keycode::DpadLeft => KeyCode::ArrowLeft,
+        Keycode::DpadRight => KeyCode::ArrowRight,
+        Keycode::DpadUp => KeyCode::ArrowUp,
+        Keycode::DpadDown => KeyCode::ArrowDown,
+
+        Keycode::F1 => KeyCode::F1,
+        Keycode::F2 => KeyCode::F2,
+        Keycode::F3 => KeyCode::F3,
+        Keycode::F4 => KeyCode::F4,
+        Keycode::F5 => KeyCode::F5,
+        Keycode::F6 => KeyCode::F6,
+        Keycode::F7 => KeyCode::F7,
+        Keycode::F8 => KeyCode::F8,
+        Keycode::F9 => KeyCode::F9,
+        Keycode::F10 => KeyCode::F10,
+        Keycode::F11 => KeyCode::F11,
+        Keycode::F12 => KeyCode::F12,
+
+        Keycode::Space => KeyCode::Space,
+        Keycode::Escape => KeyCode::Escape,
+        Keycode::Enter => KeyCode::Enter, // not on the Numpad
+        Keycode::Tab => KeyCode::Tab,
+
+        Keycode::PageUp => KeyCode::PageUp,
+        Keycode::PageDown => KeyCode::PageDown,
+        Keycode::MoveHome => KeyCode::Home,
+        Keycode::MoveEnd => KeyCode::End,
+        Keycode::Insert => KeyCode::Insert,
+
+        Keycode::Del => KeyCode::Backspace, // Backspace (above Enter)
+        Keycode::ForwardDel => KeyCode::Delete, // Delete (below Insert)
+
+        Keycode::Copy => KeyCode::Copy,
+        Keycode::Paste => KeyCode::Paste,
+        Keycode::Cut => KeyCode::Cut,
+
+        Keycode::VolumeUp => KeyCode::AudioVolumeUp,
+        Keycode::VolumeDown => KeyCode::AudioVolumeDown,
+        Keycode::VolumeMute => KeyCode::AudioVolumeMute,
+        // Keycode::Mute => None, // Microphone mute
+        Keycode::MediaPlayPause => KeyCode::MediaPlayPause,
+        Keycode::MediaStop => KeyCode::MediaStop,
+        Keycode::MediaNext => KeyCode::MediaTrackNext,
+        Keycode::MediaPrevious => KeyCode::MediaTrackPrevious,
+
+        Keycode::Plus => KeyCode::Equal,
+        Keycode::Minus => KeyCode::Minus,
+        // Winit doesn't differentiate both '+' and '=', considering they are usually
+        // on the same physical key
+        Keycode::Equals => KeyCode::Equal,
+        Keycode::Semicolon => KeyCode::Semicolon,
+        Keycode::Slash => KeyCode::Slash,
+        Keycode::Backslash => KeyCode::Backslash,
+        Keycode::Comma => KeyCode::Comma,
+        Keycode::Period => KeyCode::Period,
+        Keycode::Apostrophe => KeyCode::Quote,
+        Keycode::Grave => KeyCode::Backquote,
+
+        // Winit doesn't expose a SysRq code, so map to PrintScreen since it's
+        // usually the same physical key
+        Keycode::Sysrq => KeyCode::PrintScreen,
+        // These are usually the same (Pause/Break)
+        Keycode::Break => KeyCode::Pause,
+        // These are exactly the same
+        Keycode::ScrollLock => KeyCode::ScrollLock,
+
+        Keycode::Yen => KeyCode::IntlYen,
+        Keycode::Kana => KeyCode::Lang1,
+        Keycode::KatakanaHiragana => KeyCode::KanaMode,
+
+        Keycode::CtrlLeft => KeyCode::ControlLeft,
+        Keycode::CtrlRight => KeyCode::ControlRight,
+
+        Keycode::ShiftLeft => KeyCode::ShiftLeft,
+        Keycode::ShiftRight => KeyCode::ShiftRight,
+
+        Keycode::AltLeft => KeyCode::AltLeft,
+        Keycode::AltRight => KeyCode::AltRight,
+
+        Keycode::MetaLeft => KeyCode::SuperLeft,
+        Keycode::MetaRight => KeyCode::SuperRight,
+
+        Keycode::LeftBracket => KeyCode::BracketLeft,
+        Keycode::RightBracket => KeyCode::BracketRight,
+
+        Keycode::Power => KeyCode::Power,
+        Keycode::Sleep => KeyCode::Sleep, // what about SoftSleep?
+        Keycode::Wakeup => KeyCode::WakeUp,
+
+        keycode => return PhysicalKey::Unidentified(NativeKeyCode::Android(keycode.into())),
+    })
+}
+
+/// Tries to map the `key_event` to a `KeyMapChar` containing a unicode character or dead key accent
+///
+/// This takes a `KeyEvent` and looks up its corresponding `KeyCharacterMap` and
+/// uses that to try and map the `key_code` + `meta_state` to a unicode
+/// character or a dead key that can be combined with the next key press.
+pub fn character_map_and_combine_key(
+    app: &AndroidApp,
+    key_event: &KeyEvent<'_>,
+    combining_accent: &mut Option<char>,
+) -> Option<KeyMapChar> {
+    let device_id = key_event.device_id();
+
+    let key_map = match app.device_key_character_map(device_id) {
+        Ok(key_map) => key_map,
+        Err(err) => {
+            tracing::warn!("Failed to look up `KeyCharacterMap` for device {device_id}: {err:?}");
+            return None;
+        },
+    };
+
+    match key_map.get(key_event.key_code(), key_event.meta_state()) {
+        Ok(KeyMapChar::Unicode(unicode)) => {
+            // Only do dead key combining on key down
+            if key_event.action() == KeyAction::Down {
+                let combined_unicode = if let Some(accent) = combining_accent {
+                    match key_map.get_dead_char(*accent, unicode) {
+                        Ok(Some(key)) => Some(key),
+                        Ok(None) => None,
+                        Err(err) => {
+                            tracing::warn!(
+                                "KeyEvent: Failed to combine 'dead key' accent '{accent}' with \
+                                 '{unicode}': {err:?}"
+                            );
+                            None
+                        },
+                    }
+                } else {
+                    Some(unicode)
+                };
+                *combining_accent = None;
+                combined_unicode.map(KeyMapChar::Unicode)
+            } else {
+                Some(KeyMapChar::Unicode(unicode))
+            }
+        },
+        Ok(KeyMapChar::CombiningAccent(accent)) => {
+            if key_event.action() == KeyAction::Down {
+                *combining_accent = Some(accent);
+            }
+            Some(KeyMapChar::CombiningAccent(accent))
+        },
+        Ok(KeyMapChar::None) => {
+            // Leave any combining_accent state in tact (seems to match how other
+            // Android apps work)
+            None
+        },
+        Err(err) => {
+            tracing::warn!("KeyEvent: Failed to get key map character: {err:?}");
+            *combining_accent = None;
+            None
+        },
+    }
+}
+
+pub fn to_logical(key_char: Option<KeyMapChar>, keycode: Keycode) -> Key {
+    use android_activity::input::Keycode::*;
+
+    let native = NativeKey::Android(keycode.into());
+
+    match key_char {
+        Some(KeyMapChar::Unicode(c)) => Key::Character(smol_str::SmolStr::from_iter([c])),
+        Some(KeyMapChar::CombiningAccent(c)) => Key::Dead(Some(c)),
+        None | Some(KeyMapChar::None) => match keycode {
+            // Using `BrowserHome` instead of `GoHome` according to
+            // https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/key/Key_Values
+            Home => Key::Named(NamedKey::BrowserHome),
+            Back => Key::Named(NamedKey::BrowserBack),
+            Call => Key::Named(NamedKey::Call),
+            Endcall => Key::Named(NamedKey::EndCall),
+
+            //-------------------------------------------------------------------------------
+            // These should be redundant because they should have already been matched
+            // as `KeyMapChar::Unicode`, but also matched here as a fallback
+            Keycode0 => Key::Character("0".into()),
+            Keycode1 => Key::Character("1".into()),
+            Keycode2 => Key::Character("2".into()),
+            Keycode3 => Key::Character("3".into()),
+            Keycode4 => Key::Character("4".into()),
+            Keycode5 => Key::Character("5".into()),
+            Keycode6 => Key::Character("6".into()),
+            Keycode7 => Key::Character("7".into()),
+            Keycode8 => Key::Character("8".into()),
+            Keycode9 => Key::Character("9".into()),
+            Star => Key::Character("*".into()),
+            Pound => Key::Character("#".into()),
+            A => Key::Character("a".into()),
+            B => Key::Character("b".into()),
+            C => Key::Character("c".into()),
+            D => Key::Character("d".into()),
+            E => Key::Character("e".into()),
+            F => Key::Character("f".into()),
+            G => Key::Character("g".into()),
+            H => Key::Character("h".into()),
+            I => Key::Character("i".into()),
+            J => Key::Character("j".into()),
+            K => Key::Character("k".into()),
+            L => Key::Character("l".into()),
+            M => Key::Character("m".into()),
+            N => Key::Character("n".into()),
+            O => Key::Character("o".into()),
+            P => Key::Character("p".into()),
+            Q => Key::Character("q".into()),
+            R => Key::Character("r".into()),
+            S => Key::Character("s".into()),
+            T => Key::Character("t".into()),
+            U => Key::Character("u".into()),
+            V => Key::Character("v".into()),
+            W => Key::Character("w".into()),
+            X => Key::Character("x".into()),
+            Y => Key::Character("y".into()),
+            Z => Key::Character("z".into()),
+            Comma => Key::Character(",".into()),
+            Period => Key::Character(".".into()),
+            Grave => Key::Character("`".into()),
+            Minus => Key::Character("-".into()),
+            Equals => Key::Character("=".into()),
+            LeftBracket => Key::Character("[".into()),
+            RightBracket => Key::Character("]".into()),
+            Backslash => Key::Character("\\".into()),
+            Semicolon => Key::Character(";".into()),
+            Apostrophe => Key::Character("'".into()),
+            Slash => Key::Character("/".into()),
+            At => Key::Character("@".into()),
+            Plus => Key::Character("+".into()),
+            //-------------------------------------------------------------------------------
+            DpadUp => Key::Named(NamedKey::ArrowUp),
+            DpadDown => Key::Named(NamedKey::ArrowDown),
+            DpadLeft => Key::Named(NamedKey::ArrowLeft),
+            DpadRight => Key::Named(NamedKey::ArrowRight),
+            DpadCenter => Key::Named(NamedKey::Enter),
+
+            VolumeUp => Key::Named(NamedKey::AudioVolumeUp),
+            VolumeDown => Key::Named(NamedKey::AudioVolumeDown),
+            Power => Key::Named(NamedKey::Power),
+            Camera => Key::Named(NamedKey::Camera),
+            Clear => Key::Named(NamedKey::Clear),
+
+            AltLeft => Key::Named(NamedKey::Alt),
+            AltRight => Key::Named(NamedKey::Alt),
+            ShiftLeft => Key::Named(NamedKey::Shift),
+            ShiftRight => Key::Named(NamedKey::Shift),
+            Tab => Key::Named(NamedKey::Tab),
+            Space => Key::Named(NamedKey::Space),
+            Sym => Key::Named(NamedKey::Symbol),
+            Explorer => Key::Named(NamedKey::LaunchWebBrowser),
+            Envelope => Key::Named(NamedKey::LaunchMail),
+            Enter => Key::Named(NamedKey::Enter),
+            Del => Key::Named(NamedKey::Backspace),
+
+            // According to https://developer.android.com/reference/android/view/KeyEvent#KEYCODE_NUM
+            Num => Key::Named(NamedKey::Alt),
+
+            Headsethook => Key::Named(NamedKey::HeadsetHook),
+            Focus => Key::Named(NamedKey::CameraFocus),
+
+            Notification => Key::Named(NamedKey::Notification),
+            Search => Key::Named(NamedKey::BrowserSearch),
+            MediaPlayPause => Key::Named(NamedKey::MediaPlayPause),
+            MediaStop => Key::Named(NamedKey::MediaStop),
+            MediaNext => Key::Named(NamedKey::MediaTrackNext),
+            MediaPrevious => Key::Named(NamedKey::MediaTrackPrevious),
+            MediaRewind => Key::Named(NamedKey::MediaRewind),
+            MediaFastForward => Key::Named(NamedKey::MediaFastForward),
+            Mute => Key::Named(NamedKey::MicrophoneVolumeMute),
+            PageUp => Key::Named(NamedKey::PageUp),
+            PageDown => Key::Named(NamedKey::PageDown),
+
+            Escape => Key::Named(NamedKey::Escape),
+            ForwardDel => Key::Named(NamedKey::Delete),
+            CtrlLeft => Key::Named(NamedKey::Control),
+            CtrlRight => Key::Named(NamedKey::Control),
+            CapsLock => Key::Named(NamedKey::CapsLock),
+            ScrollLock => Key::Named(NamedKey::ScrollLock),
+            MetaLeft => Key::Named(NamedKey::Super),
+            MetaRight => Key::Named(NamedKey::Super),
+            Function => Key::Named(NamedKey::Fn),
+            Sysrq => Key::Named(NamedKey::PrintScreen),
+            Break => Key::Named(NamedKey::Pause),
+            MoveHome => Key::Named(NamedKey::Home),
+            MoveEnd => Key::Named(NamedKey::End),
+            Insert => Key::Named(NamedKey::Insert),
+            Forward => Key::Named(NamedKey::BrowserForward),
+            MediaPlay => Key::Named(NamedKey::MediaPlay),
+            MediaPause => Key::Named(NamedKey::MediaPause),
+            MediaClose => Key::Named(NamedKey::MediaClose),
+            MediaEject => Key::Named(NamedKey::Eject),
+            MediaRecord => Key::Named(NamedKey::MediaRecord),
+            F1 => Key::Named(NamedKey::F1),
+            F2 => Key::Named(NamedKey::F2),
+            F3 => Key::Named(NamedKey::F3),
+            F4 => Key::Named(NamedKey::F4),
+            F5 => Key::Named(NamedKey::F5),
+            F6 => Key::Named(NamedKey::F6),
+            F7 => Key::Named(NamedKey::F7),
+            F8 => Key::Named(NamedKey::F8),
+            F9 => Key::Named(NamedKey::F9),
+            F10 => Key::Named(NamedKey::F10),
+            F11 => Key::Named(NamedKey::F11),
+            F12 => Key::Named(NamedKey::F12),
+            NumLock => Key::Named(NamedKey::NumLock),
+            Numpad0 => Key::Character("0".into()),
+            Numpad1 => Key::Character("1".into()),
+            Numpad2 => Key::Character("2".into()),
+            Numpad3 => Key::Character("3".into()),
+            Numpad4 => Key::Character("4".into()),
+            Numpad5 => Key::Character("5".into()),
+            Numpad6 => Key::Character("6".into()),
+            Numpad7 => Key::Character("7".into()),
+            Numpad8 => Key::Character("8".into()),
+            Numpad9 => Key::Character("9".into()),
+            NumpadDivide => Key::Character("/".into()),
+            NumpadMultiply => Key::Character("*".into()),
+            NumpadSubtract => Key::Character("-".into()),
+            NumpadAdd => Key::Character("+".into()),
+            NumpadDot => Key::Character(".".into()),
+            NumpadComma => Key::Character(",".into()),
+            NumpadEnter => Key::Named(NamedKey::Enter),
+            NumpadEquals => Key::Character("=".into()),
+            NumpadLeftParen => Key::Character("(".into()),
+            NumpadRightParen => Key::Character(")".into()),
+
+            VolumeMute => Key::Named(NamedKey::AudioVolumeMute),
+            Info => Key::Named(NamedKey::Info),
+            ChannelUp => Key::Named(NamedKey::ChannelUp),
+            ChannelDown => Key::Named(NamedKey::ChannelDown),
+            ZoomIn => Key::Named(NamedKey::ZoomIn),
+            ZoomOut => Key::Named(NamedKey::ZoomOut),
+            Tv => Key::Named(NamedKey::TV),
+            Guide => Key::Named(NamedKey::Guide),
+            Dvr => Key::Named(NamedKey::DVR),
+            Bookmark => Key::Named(NamedKey::BrowserFavorites),
+            Captions => Key::Named(NamedKey::ClosedCaptionToggle),
+            Settings => Key::Named(NamedKey::Settings),
+            TvPower => Key::Named(NamedKey::TVPower),
+            TvInput => Key::Named(NamedKey::TVInput),
+            StbPower => Key::Named(NamedKey::STBPower),
+            StbInput => Key::Named(NamedKey::STBInput),
+            AvrPower => Key::Named(NamedKey::AVRPower),
+            AvrInput => Key::Named(NamedKey::AVRInput),
+            ProgRed => Key::Named(NamedKey::ColorF0Red),
+            ProgGreen => Key::Named(NamedKey::ColorF1Green),
+            ProgYellow => Key::Named(NamedKey::ColorF2Yellow),
+            ProgBlue => Key::Named(NamedKey::ColorF3Blue),
+            AppSwitch => Key::Named(NamedKey::AppSwitch),
+            LanguageSwitch => Key::Named(NamedKey::GroupNext),
+            MannerMode => Key::Named(NamedKey::MannerMode),
+            Keycode3dMode => Key::Named(NamedKey::TV3DMode),
+            Contacts => Key::Named(NamedKey::LaunchContacts),
+            Calendar => Key::Named(NamedKey::LaunchCalendar),
+            Music => Key::Named(NamedKey::LaunchMusicPlayer),
+            Calculator => Key::Named(NamedKey::LaunchApplication2),
+            ZenkakuHankaku => Key::Named(NamedKey::ZenkakuHankaku),
+            Eisu => Key::Named(NamedKey::Eisu),
+            Muhenkan => Key::Named(NamedKey::NonConvert),
+            Henkan => Key::Named(NamedKey::Convert),
+            KatakanaHiragana => Key::Named(NamedKey::HiraganaKatakana),
+            Kana => Key::Named(NamedKey::KanjiMode),
+            BrightnessDown => Key::Named(NamedKey::BrightnessDown),
+            BrightnessUp => Key::Named(NamedKey::BrightnessUp),
+            MediaAudioTrack => Key::Named(NamedKey::MediaAudioTrack),
+            Sleep => Key::Named(NamedKey::Standby),
+            Wakeup => Key::Named(NamedKey::WakeUp),
+            Pairing => Key::Named(NamedKey::Pairing),
+            MediaTopMenu => Key::Named(NamedKey::MediaTopMenu),
+            LastChannel => Key::Named(NamedKey::MediaLast),
+            TvDataService => Key::Named(NamedKey::TVDataService),
+            VoiceAssist => Key::Named(NamedKey::VoiceDial),
+            TvRadioService => Key::Named(NamedKey::TVRadioService),
+            TvTeletext => Key::Named(NamedKey::Teletext),
+            TvNumberEntry => Key::Named(NamedKey::TVNumberEntry),
+            TvTerrestrialAnalog => Key::Named(NamedKey::TVTerrestrialAnalog),
+            TvTerrestrialDigital => Key::Named(NamedKey::TVTerrestrialDigital),
+            TvSatellite => Key::Named(NamedKey::TVSatellite),
+            TvSatelliteBs => Key::Named(NamedKey::TVSatelliteBS),
+            TvSatelliteCs => Key::Named(NamedKey::TVSatelliteCS),
+            TvSatelliteService => Key::Named(NamedKey::TVSatelliteToggle),
+            TvNetwork => Key::Named(NamedKey::TVNetwork),
+            TvAntennaCable => Key::Named(NamedKey::TVAntennaCable),
+            TvInputHdmi1 => Key::Named(NamedKey::TVInputHDMI1),
+            TvInputHdmi2 => Key::Named(NamedKey::TVInputHDMI2),
+            TvInputHdmi3 => Key::Named(NamedKey::TVInputHDMI3),
+            TvInputHdmi4 => Key::Named(NamedKey::TVInputHDMI4),
+            TvInputComposite1 => Key::Named(NamedKey::TVInputComposite1),
+            TvInputComposite2 => Key::Named(NamedKey::TVInputComposite2),
+            TvInputComponent1 => Key::Named(NamedKey::TVInputComponent1),
+            TvInputComponent2 => Key::Named(NamedKey::TVInputComponent2),
+            TvInputVga1 => Key::Named(NamedKey::TVInputVGA1),
+            TvAudioDescription => Key::Named(NamedKey::TVAudioDescription),
+            TvAudioDescriptionMixUp => Key::Named(NamedKey::TVAudioDescriptionMixUp),
+            TvAudioDescriptionMixDown => Key::Named(NamedKey::TVAudioDescriptionMixDown),
+            TvZoomMode => Key::Named(NamedKey::ZoomToggle),
+            TvContentsMenu => Key::Named(NamedKey::TVContentsMenu),
+            TvMediaContextMenu => Key::Named(NamedKey::TVMediaContext),
+            TvTimerProgramming => Key::Named(NamedKey::TVTimer),
+            Help => Key::Named(NamedKey::Help),
+            NavigatePrevious => Key::Named(NamedKey::NavigatePrevious),
+            NavigateNext => Key::Named(NamedKey::NavigateNext),
+            NavigateIn => Key::Named(NamedKey::NavigateIn),
+            NavigateOut => Key::Named(NamedKey::NavigateOut),
+            MediaSkipForward => Key::Named(NamedKey::MediaSkipForward),
+            MediaSkipBackward => Key::Named(NamedKey::MediaSkipBackward),
+            MediaStepForward => Key::Named(NamedKey::MediaStepForward),
+            MediaStepBackward => Key::Named(NamedKey::MediaStepBackward),
+            Cut => Key::Named(NamedKey::Cut),
+            Copy => Key::Named(NamedKey::Copy),
+            Paste => Key::Named(NamedKey::Paste),
+            Refresh => Key::Named(NamedKey::BrowserRefresh),
+
+            // -----------------------------------------------------------------
+            // Keycodes that don't have a logical Key mapping
+            // -----------------------------------------------------------------
+            Unknown => Key::Unidentified(native),
+
+            // Can be added on demand
+            SoftLeft => Key::Unidentified(native),
+            SoftRight => Key::Unidentified(native),
+
+            Menu => Key::Unidentified(native),
+
+            Pictsymbols => Key::Unidentified(native),
+            SwitchCharset => Key::Unidentified(native),
+
+            // -----------------------------------------------------------------
+            // Gamepad events should be exposed through a separate API, not
+            // keyboard events
+            ButtonA => Key::Unidentified(native),
+            ButtonB => Key::Unidentified(native),
+            ButtonC => Key::Unidentified(native),
+            ButtonX => Key::Unidentified(native),
+            ButtonY => Key::Unidentified(native),
+            ButtonZ => Key::Unidentified(native),
+            ButtonL1 => Key::Unidentified(native),
+            ButtonR1 => Key::Unidentified(native),
+            ButtonL2 => Key::Unidentified(native),
+            ButtonR2 => Key::Unidentified(native),
+            ButtonThumbl => Key::Unidentified(native),
+            ButtonThumbr => Key::Unidentified(native),
+            ButtonStart => Key::Unidentified(native),
+            ButtonSelect => Key::Unidentified(native),
+            ButtonMode => Key::Unidentified(native),
+            // -----------------------------------------------------------------
+            Window => Key::Unidentified(native),
+
+            Button1 => Key::Unidentified(native),
+            Button2 => Key::Unidentified(native),
+            Button3 => Key::Unidentified(native),
+            Button4 => Key::Unidentified(native),
+            Button5 => Key::Unidentified(native),
+            Button6 => Key::Unidentified(native),
+            Button7 => Key::Unidentified(native),
+            Button8 => Key::Unidentified(native),
+            Button9 => Key::Unidentified(native),
+            Button10 => Key::Unidentified(native),
+            Button11 => Key::Unidentified(native),
+            Button12 => Key::Unidentified(native),
+            Button13 => Key::Unidentified(native),
+            Button14 => Key::Unidentified(native),
+            Button15 => Key::Unidentified(native),
+            Button16 => Key::Unidentified(native),
+
+            Yen => Key::Unidentified(native),
+            Ro => Key::Unidentified(native),
+
+            Assist => Key::Unidentified(native),
+
+            Keycode11 => Key::Unidentified(native),
+            Keycode12 => Key::Unidentified(native),
+
+            StemPrimary => Key::Unidentified(native),
+            Stem1 => Key::Unidentified(native),
+            Stem2 => Key::Unidentified(native),
+            Stem3 => Key::Unidentified(native),
+
+            DpadUpLeft => Key::Unidentified(native),
+            DpadDownLeft => Key::Unidentified(native),
+            DpadUpRight => Key::Unidentified(native),
+            DpadDownRight => Key::Unidentified(native),
+
+            SoftSleep => Key::Unidentified(native),
+
+            SystemNavigationUp => Key::Unidentified(native),
+            SystemNavigationDown => Key::Unidentified(native),
+            SystemNavigationLeft => Key::Unidentified(native),
+            SystemNavigationRight => Key::Unidentified(native),
+
+            AllApps => Key::Unidentified(native),
+            ThumbsUp => Key::Unidentified(native),
+            ThumbsDown => Key::Unidentified(native),
+            ProfileSwitch => Key::Unidentified(native),
+
+            // It's always possible that new versions of Android could introduce
+            // key codes we can't know about at compile time.
+            _ => Key::Unidentified(native),
+        },
+    }
+}
+
+pub fn to_location(keycode: Keycode) -> KeyLocation {
+    use android_activity::input::Keycode::*;
+
+    match keycode {
+        AltLeft => KeyLocation::Left,
+        AltRight => KeyLocation::Right,
+        ShiftLeft => KeyLocation::Left,
+        ShiftRight => KeyLocation::Right,
+
+        // According to https://developer.android.com/reference/android/view/KeyEvent#KEYCODE_NUM
+        Num => KeyLocation::Left,
+
+        CtrlLeft => KeyLocation::Left,
+        CtrlRight => KeyLocation::Right,
+        MetaLeft => KeyLocation::Left,
+        MetaRight => KeyLocation::Right,
+
+        NumLock => KeyLocation::Numpad,
+        Numpad0 => KeyLocation::Numpad,
+        Numpad1 => KeyLocation::Numpad,
+        Numpad2 => KeyLocation::Numpad,
+        Numpad3 => KeyLocation::Numpad,
+        Numpad4 => KeyLocation::Numpad,
+        Numpad5 => KeyLocation::Numpad,
+        Numpad6 => KeyLocation::Numpad,
+        Numpad7 => KeyLocation::Numpad,
+        Numpad8 => KeyLocation::Numpad,
+        Numpad9 => KeyLocation::Numpad,
+        NumpadDivide => KeyLocation::Numpad,
+        NumpadMultiply => KeyLocation::Numpad,
+        NumpadSubtract => KeyLocation::Numpad,
+        NumpadAdd => KeyLocation::Numpad,
+        NumpadDot => KeyLocation::Numpad,
+        NumpadComma => KeyLocation::Numpad,
+        NumpadEnter => KeyLocation::Numpad,
+        NumpadEquals => KeyLocation::Numpad,
+        NumpadLeftParen => KeyLocation::Numpad,
+        NumpadRightParen => KeyLocation::Numpad,
+
+        _ => KeyLocation::Standard,
+    }
+}
diff --git a/vendor/winit/src/platform_impl/android/mod.rs b/vendor/winit/src/platform_impl/android/mod.rs
new file mode 100644
index 00000000..c6a7416f
--- /dev/null
+++ b/vendor/winit/src/platform_impl/android/mod.rs
@@ -0,0 +1,1141 @@
+use std::cell::Cell;
+use std::collections::VecDeque;
+use std::hash::Hash;
+use std::marker::PhantomData;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{mpsc, Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use android_activity::input::{InputEvent, KeyAction, Keycode, MotionAction};
+use android_activity::{
+    AndroidApp, AndroidAppWaker, ConfigurationRef, InputStatus, MainEvent, Rect,
+};
+use tracing::{debug, trace, warn};
+
+use crate::cursor::Cursor;
+use crate::dpi::{PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error;
+use crate::error::EventLoopError;
+use crate::event::{self, Force, InnerSizeWriter, StartCause};
+use crate::event_loop::{self, ActiveEventLoop as RootAEL, ControlFlow, DeviceEvents};
+use crate::platform::pump_events::PumpStatus;
+use crate::platform_impl::Fullscreen;
+use crate::window::{
+    self, CursorGrabMode, CustomCursor, CustomCursorSource, ImePurpose, ResizeDirection, Theme,
+    WindowButtons, WindowLevel,
+};
+
+mod keycodes;
+
+pub(crate) use crate::cursor::{
+    NoCustomCursor as PlatformCustomCursor, NoCustomCursor as PlatformCustomCursorSource,
+};
+pub(crate) use crate::icon::NoIcon as PlatformIcon;
+
+static HAS_FOCUS: AtomicBool = AtomicBool::new(true);
+
+/// Returns the minimum `Option<Duration>`, taking into account that `None`
+/// equates to an infinite timeout, not a zero timeout (so can't just use
+/// `Option::min`)
+fn min_timeout(a: Option<Duration>, b: Option<Duration>) -> Option<Duration> {
+    a.map_or(b, |a_timeout| b.map_or(Some(a_timeout), |b_timeout| Some(a_timeout.min(b_timeout))))
+}
+
+struct PeekableReceiver<T> {
+    recv: mpsc::Receiver<T>,
+    first: Option<T>,
+}
+
+impl<T> PeekableReceiver<T> {
+    pub fn from_recv(recv: mpsc::Receiver<T>) -> Self {
+        Self { recv, first: None }
+    }
+
+    pub fn has_incoming(&mut self) -> bool {
+        if self.first.is_some() {
+            return true;
+        }
+        match self.recv.try_recv() {
+            Ok(v) => {
+                self.first = Some(v);
+                true
+            },
+            Err(mpsc::TryRecvError::Empty) => false,
+            Err(mpsc::TryRecvError::Disconnected) => {
+                warn!("Channel was disconnected when checking incoming");
+                false
+            },
+        }
+    }
+
+    pub fn try_recv(&mut self) -> Result<T, mpsc::TryRecvError> {
+        if let Some(first) = self.first.take() {
+            return Ok(first);
+        }
+        self.recv.try_recv()
+    }
+}
+
+#[derive(Clone)]
+struct SharedFlagSetter {
+    flag: Arc<AtomicBool>,
+}
+impl SharedFlagSetter {
+    pub fn set(&self) -> bool {
+        self.flag.compare_exchange(false, true, Ordering::AcqRel, Ordering::Relaxed).is_ok()
+    }
+}
+
+struct SharedFlag {
+    flag: Arc<AtomicBool>,
+}
+
+// Used for queuing redraws from arbitrary threads. We don't care how many
+// times a redraw is requested (so don't actually need to queue any data,
+// we just need to know at the start of a main loop iteration if a redraw
+// was queued and be able to read and clear the state atomically)
+impl SharedFlag {
+    pub fn new() -> Self {
+        Self { flag: Arc::new(AtomicBool::new(false)) }
+    }
+
+    pub fn setter(&self) -> SharedFlagSetter {
+        SharedFlagSetter { flag: self.flag.clone() }
+    }
+
+    pub fn get_and_reset(&self) -> bool {
+        self.flag.swap(false, std::sync::atomic::Ordering::AcqRel)
+    }
+}
+
+#[derive(Clone)]
+pub struct RedrawRequester {
+    flag: SharedFlagSetter,
+    waker: AndroidAppWaker,
+}
+
+impl RedrawRequester {
+    fn new(flag: &SharedFlag, waker: AndroidAppWaker) -> Self {
+        RedrawRequester { flag: flag.setter(), waker }
+    }
+
+    pub fn request_redraw(&self) {
+        if self.flag.set() {
+            // Only explicitly try to wake up the main loop when the flag
+            // value changes
+            self.waker.wake();
+        }
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub struct KeyEventExtra {}
+
+pub struct EventLoop<T: 'static> {
+    pub(crate) android_app: AndroidApp,
+    window_target: event_loop::ActiveEventLoop,
+    redraw_flag: SharedFlag,
+    user_events_sender: mpsc::Sender<T>,
+    user_events_receiver: PeekableReceiver<T>, // must wake looper whenever something gets sent
+    loop_running: bool,                        // Dispatched `NewEvents<Init>`
+    running: bool,
+    pending_redraw: bool,
+    cause: StartCause,
+    ignore_volume_keys: bool,
+    combining_accent: Option<char>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct PlatformSpecificEventLoopAttributes {
+    pub(crate) android_app: Option<AndroidApp>,
+    pub(crate) ignore_volume_keys: bool,
+}
+
+impl Default for PlatformSpecificEventLoopAttributes {
+    fn default() -> Self {
+        Self { android_app: Default::default(), ignore_volume_keys: true }
+    }
+}
+
+impl<T: 'static> EventLoop<T> {
+    pub(crate) fn new(
+        attributes: &PlatformSpecificEventLoopAttributes,
+    ) -> Result<Self, EventLoopError> {
+        let (user_events_sender, user_events_receiver) = mpsc::channel();
+
+        let android_app = attributes.android_app.as_ref().expect(
+            "An `AndroidApp` as passed to android_main() is required to create an `EventLoop` on \
+             Android",
+        );
+        let redraw_flag = SharedFlag::new();
+
+        Ok(Self {
+            android_app: android_app.clone(),
+            window_target: event_loop::ActiveEventLoop {
+                p: ActiveEventLoop {
+                    app: android_app.clone(),
+                    control_flow: Cell::new(ControlFlow::default()),
+                    exit: Cell::new(false),
+                    redraw_requester: RedrawRequester::new(
+                        &redraw_flag,
+                        android_app.create_waker(),
+                    ),
+                },
+                _marker: PhantomData,
+            },
+            redraw_flag,
+            user_events_sender,
+            user_events_receiver: PeekableReceiver::from_recv(user_events_receiver),
+            loop_running: false,
+            running: false,
+            pending_redraw: false,
+            cause: StartCause::Init,
+            ignore_volume_keys: attributes.ignore_volume_keys,
+            combining_accent: None,
+        })
+    }
+
+    fn single_iteration<F>(&mut self, main_event: Option<MainEvent<'_>>, callback: &mut F)
+    where
+        F: FnMut(event::Event<T>, &RootAEL),
+    {
+        trace!("Mainloop iteration");
+
+        let cause = self.cause;
+        let mut pending_redraw = self.pending_redraw;
+        let mut resized = false;
+
+        callback(event::Event::NewEvents(cause), self.window_target());
+
+        if let Some(event) = main_event {
+            trace!("Handling main event {:?}", event);
+
+            match event {
+                MainEvent::InitWindow { .. } => {
+                    callback(event::Event::Resumed, self.window_target());
+                },
+                MainEvent::TerminateWindow { .. } => {
+                    callback(event::Event::Suspended, self.window_target());
+                },
+                MainEvent::WindowResized { .. } => resized = true,
+                MainEvent::RedrawNeeded { .. } => pending_redraw = true,
+                MainEvent::ContentRectChanged { .. } => {
+                    warn!("TODO: find a way to notify application of content rect change");
+                },
+                MainEvent::GainedFocus => {
+                    HAS_FOCUS.store(true, Ordering::Relaxed);
+                    callback(
+                        event::Event::WindowEvent {
+                            window_id: window::WindowId(WindowId),
+                            event: event::WindowEvent::Focused(true),
+                        },
+                        self.window_target(),
+                    );
+                },
+                MainEvent::LostFocus => {
+                    HAS_FOCUS.store(false, Ordering::Relaxed);
+                    callback(
+                        event::Event::WindowEvent {
+                            window_id: window::WindowId(WindowId),
+                            event: event::WindowEvent::Focused(false),
+                        },
+                        self.window_target(),
+                    );
+                },
+                MainEvent::ConfigChanged { .. } => {
+                    let monitor = MonitorHandle::new(self.android_app.clone());
+                    let old_scale_factor = monitor.scale_factor();
+                    let scale_factor = monitor.scale_factor();
+                    if (scale_factor - old_scale_factor).abs() < f64::EPSILON {
+                        let new_inner_size = Arc::new(Mutex::new(
+                            MonitorHandle::new(self.android_app.clone()).size(),
+                        ));
+                        let event = event::Event::WindowEvent {
+                            window_id: window::WindowId(WindowId),
+                            event: event::WindowEvent::ScaleFactorChanged {
+                                inner_size_writer: InnerSizeWriter::new(Arc::downgrade(
+                                    &new_inner_size,
+                                )),
+                                scale_factor,
+                            },
+                        };
+                        callback(event, self.window_target());
+                    }
+                },
+                MainEvent::LowMemory => {
+                    callback(event::Event::MemoryWarning, self.window_target());
+                },
+                MainEvent::Start => {
+                    // XXX: how to forward this state to applications?
+                    warn!("TODO: forward onStart notification to application");
+                },
+                MainEvent::Resume { .. } => {
+                    debug!("App Resumed - is running");
+                    self.running = true;
+                },
+                MainEvent::SaveState { .. } => {
+                    // XXX: how to forward this state to applications?
+                    // XXX: also how do we expose state restoration to apps?
+                    warn!("TODO: forward saveState notification to application");
+                },
+                MainEvent::Pause => {
+                    debug!("App Paused - stopped running");
+                    self.running = false;
+                },
+                MainEvent::Stop => {
+                    // XXX: how to forward this state to applications?
+                    warn!("TODO: forward onStop notification to application");
+                },
+                MainEvent::Destroy => {
+                    // XXX: maybe exit mainloop to drop things before being
+                    // killed by the OS?
+                    warn!("TODO: forward onDestroy notification to application");
+                },
+                MainEvent::InsetsChanged { .. } => {
+                    // XXX: how to forward this state to applications?
+                    warn!("TODO: handle Android InsetsChanged notification");
+                },
+                unknown => {
+                    trace!("Unknown MainEvent {unknown:?} (ignored)");
+                },
+            }
+        } else {
+            trace!("No main event to handle");
+        }
+
+        // temporarily decouple `android_app` from `self` so we aren't holding
+        // a borrow of `self` while iterating
+        let android_app = self.android_app.clone();
+
+        // Process input events
+        match android_app.input_events_iter() {
+            Ok(mut input_iter) => loop {
+                let read_event =
+                    input_iter.next(|event| self.handle_input_event(&android_app, event, callback));
+
+                if !read_event {
+                    break;
+                }
+            },
+            Err(err) => {
+                tracing::warn!("Failed to get input events iterator: {err:?}");
+            },
+        }
+
+        // Empty the user event buffer
+        {
+            while let Ok(event) = self.user_events_receiver.try_recv() {
+                callback(crate::event::Event::UserEvent(event), self.window_target());
+            }
+        }
+
+        if self.running {
+            if resized {
+                let size = if let Some(native_window) = self.android_app.native_window().as_ref() {
+                    let width = native_window.width() as _;
+                    let height = native_window.height() as _;
+                    PhysicalSize::new(width, height)
+                } else {
+                    PhysicalSize::new(0, 0)
+                };
+                let event = event::Event::WindowEvent {
+                    window_id: window::WindowId(WindowId),
+                    event: event::WindowEvent::Resized(size),
+                };
+                callback(event, self.window_target());
+            }
+
+            pending_redraw |= self.redraw_flag.get_and_reset();
+            if pending_redraw {
+                pending_redraw = false;
+                let event = event::Event::WindowEvent {
+                    window_id: window::WindowId(WindowId),
+                    event: event::WindowEvent::RedrawRequested,
+                };
+                callback(event, self.window_target());
+            }
+        }
+
+        // This is always the last event we dispatch before poll again
+        callback(event::Event::AboutToWait, self.window_target());
+
+        self.pending_redraw = pending_redraw;
+    }
+
+    fn handle_input_event<F>(
+        &mut self,
+        android_app: &AndroidApp,
+        event: &InputEvent<'_>,
+        callback: &mut F,
+    ) -> InputStatus
+    where
+        F: FnMut(event::Event<T>, &RootAEL),
+    {
+        let mut input_status = InputStatus::Handled;
+        match event {
+            InputEvent::MotionEvent(motion_event) => {
+                let window_id = window::WindowId(WindowId);
+                let device_id = event::DeviceId(DeviceId(motion_event.device_id()));
+
+                let phase = match motion_event.action() {
+                    MotionAction::Down | MotionAction::PointerDown => {
+                        Some(event::TouchPhase::Started)
+                    },
+                    MotionAction::Up | MotionAction::PointerUp => Some(event::TouchPhase::Ended),
+                    MotionAction::Move => Some(event::TouchPhase::Moved),
+                    MotionAction::Cancel => Some(event::TouchPhase::Cancelled),
+                    _ => {
+                        None // TODO mouse events
+                    },
+                };
+                if let Some(phase) = phase {
+                    let pointers: Box<dyn Iterator<Item = android_activity::input::Pointer<'_>>> =
+                        match phase {
+                            event::TouchPhase::Started | event::TouchPhase::Ended => {
+                                Box::new(std::iter::once(
+                                    motion_event.pointer_at_index(motion_event.pointer_index()),
+                                ))
+                            },
+                            event::TouchPhase::Moved | event::TouchPhase::Cancelled => {
+                                Box::new(motion_event.pointers())
+                            },
+                        };
+
+                    for pointer in pointers {
+                        let location =
+                            PhysicalPosition { x: pointer.x() as _, y: pointer.y() as _ };
+                        trace!(
+                            "Input event {device_id:?}, {phase:?}, loc={location:?}, \
+                             pointer={pointer:?}"
+                        );
+                        let event = event::Event::WindowEvent {
+                            window_id,
+                            event: event::WindowEvent::Touch(event::Touch {
+                                device_id,
+                                phase,
+                                location,
+                                id: pointer.pointer_id() as u64,
+                                force: Some(Force::Normalized(pointer.pressure() as f64)),
+                            }),
+                        };
+                        callback(event, self.window_target());
+                    }
+                }
+            },
+            InputEvent::KeyEvent(key) => {
+                match key.key_code() {
+                    // Flag keys related to volume as unhandled. While winit does not have a way for
+                    // applications to configure what keys to flag as handled,
+                    // this appears to be a good default until winit
+                    // can be configured.
+                    Keycode::VolumeUp | Keycode::VolumeDown | Keycode::VolumeMute
+                        if self.ignore_volume_keys =>
+                    {
+                        input_status = InputStatus::Unhandled
+                    },
+                    keycode => {
+                        let state = match key.action() {
+                            KeyAction::Down => event::ElementState::Pressed,
+                            KeyAction::Up => event::ElementState::Released,
+                            _ => event::ElementState::Released,
+                        };
+
+                        let key_char = keycodes::character_map_and_combine_key(
+                            android_app,
+                            key,
+                            &mut self.combining_accent,
+                        );
+
+                        let logical_key = keycodes::to_logical(key_char, keycode);
+                        let text = if state == event::ElementState::Pressed {
+                            logical_key.to_text().map(smol_str::SmolStr::new)
+                        } else {
+                            None
+                        };
+
+                        let event = event::Event::WindowEvent {
+                            window_id: window::WindowId(WindowId),
+                            event: event::WindowEvent::KeyboardInput {
+                                device_id: event::DeviceId(DeviceId(key.device_id())),
+                                event: event::KeyEvent {
+                                    state,
+                                    physical_key: keycodes::to_physical_key(keycode),
+                                    logical_key,
+                                    location: keycodes::to_location(keycode),
+                                    repeat: key.repeat_count() > 0,
+                                    text,
+                                    platform_specific: KeyEventExtra {},
+                                },
+                                is_synthetic: false,
+                            },
+                        };
+                        callback(event, self.window_target());
+                    },
+                }
+            },
+            _ => {
+                warn!("Unknown android_activity input event {event:?}")
+            },
+        }
+
+        input_status
+    }
+
+    pub fn run<F>(mut self, event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(event::Event<T>, &event_loop::ActiveEventLoop),
+    {
+        self.run_on_demand(event_handler)
+    }
+
+    pub fn run_on_demand<F>(&mut self, mut event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(event::Event<T>, &event_loop::ActiveEventLoop),
+    {
+        loop {
+            match self.pump_events(None, &mut event_handler) {
+                PumpStatus::Exit(0) => {
+                    break Ok(());
+                },
+                PumpStatus::Exit(code) => {
+                    break Err(EventLoopError::ExitFailure(code));
+                },
+                _ => {
+                    continue;
+                },
+            }
+        }
+    }
+
+    pub fn pump_events<F>(&mut self, timeout: Option<Duration>, mut callback: F) -> PumpStatus
+    where
+        F: FnMut(event::Event<T>, &RootAEL),
+    {
+        if !self.loop_running {
+            self.loop_running = true;
+
+            // Reset the internal state for the loop as we start running to
+            // ensure consistent behaviour in case the loop runs and exits more
+            // than once
+            self.pending_redraw = false;
+            self.cause = StartCause::Init;
+
+            // run the initial loop iteration
+            self.single_iteration(None, &mut callback);
+        }
+
+        // Consider the possibility that the `StartCause::Init` iteration could
+        // request to Exit
+        if !self.exiting() {
+            self.poll_events_with_timeout(timeout, &mut callback);
+        }
+        if self.exiting() {
+            self.loop_running = false;
+
+            callback(event::Event::LoopExiting, self.window_target());
+
+            PumpStatus::Exit(0)
+        } else {
+            PumpStatus::Continue
+        }
+    }
+
+    fn poll_events_with_timeout<F>(&mut self, mut timeout: Option<Duration>, mut callback: F)
+    where
+        F: FnMut(event::Event<T>, &RootAEL),
+    {
+        let start = Instant::now();
+
+        self.pending_redraw |= self.redraw_flag.get_and_reset();
+
+        timeout =
+            if self.running && (self.pending_redraw || self.user_events_receiver.has_incoming()) {
+                // If we already have work to do then we don't want to block on the next poll
+                Some(Duration::ZERO)
+            } else {
+                let control_flow_timeout = match self.control_flow() {
+                    ControlFlow::Wait => None,
+                    ControlFlow::Poll => Some(Duration::ZERO),
+                    ControlFlow::WaitUntil(wait_deadline) => {
+                        Some(wait_deadline.saturating_duration_since(start))
+                    },
+                };
+
+                min_timeout(control_flow_timeout, timeout)
+            };
+
+        let app = self.android_app.clone(); // Don't borrow self as part of poll expression
+        app.poll_events(timeout, |poll_event| {
+            let mut main_event = None;
+
+            match poll_event {
+                android_activity::PollEvent::Wake => {
+                    // In the X11 backend it's noted that too many false-positive wake ups
+                    // would cause the event loop to run continuously. They handle this by
+                    // re-checking for pending events (assuming they cover all
+                    // valid reasons for a wake up).
+                    //
+                    // For now, user_events and redraw_requests are the only reasons to expect
+                    // a wake up here so we can ignore the wake up if there are no events/requests.
+                    // We also ignore wake ups while suspended.
+                    self.pending_redraw |= self.redraw_flag.get_and_reset();
+                    if !self.running
+                        || (!self.pending_redraw && !self.user_events_receiver.has_incoming())
+                    {
+                        return;
+                    }
+                },
+                android_activity::PollEvent::Timeout => {},
+                android_activity::PollEvent::Main(event) => {
+                    main_event = Some(event);
+                },
+                unknown_event => {
+                    warn!("Unknown poll event {unknown_event:?} (ignored)");
+                },
+            }
+
+            self.cause = match self.control_flow() {
+                ControlFlow::Poll => StartCause::Poll,
+                ControlFlow::Wait => StartCause::WaitCancelled { start, requested_resume: None },
+                ControlFlow::WaitUntil(deadline) => {
+                    if Instant::now() < deadline {
+                        StartCause::WaitCancelled { start, requested_resume: Some(deadline) }
+                    } else {
+                        StartCause::ResumeTimeReached { start, requested_resume: deadline }
+                    }
+                },
+            };
+
+            self.single_iteration(main_event, &mut callback);
+        });
+    }
+
+    pub fn window_target(&self) -> &event_loop::ActiveEventLoop {
+        &self.window_target
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy {
+            user_events_sender: self.user_events_sender.clone(),
+            waker: self.android_app.create_waker(),
+        }
+    }
+
+    fn control_flow(&self) -> ControlFlow {
+        self.window_target.p.control_flow()
+    }
+
+    fn exiting(&self) -> bool {
+        self.window_target.p.exiting()
+    }
+}
+
+pub struct EventLoopProxy<T: 'static> {
+    user_events_sender: mpsc::Sender<T>,
+    waker: AndroidAppWaker,
+}
+
+impl<T: 'static> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        EventLoopProxy {
+            user_events_sender: self.user_events_sender.clone(),
+            waker: self.waker.clone(),
+        }
+    }
+}
+
+impl<T> EventLoopProxy<T> {
+    pub fn send_event(&self, event: T) -> Result<(), event_loop::EventLoopClosed<T>> {
+        self.user_events_sender.send(event).map_err(|err| event_loop::EventLoopClosed(err.0))?;
+        self.waker.wake();
+        Ok(())
+    }
+}
+
+pub struct ActiveEventLoop {
+    pub(crate) app: AndroidApp,
+    control_flow: Cell<ControlFlow>,
+    exit: Cell<bool>,
+    redraw_requester: RedrawRequester,
+}
+
+impl ActiveEventLoop {
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        Some(MonitorHandle::new(self.app.clone()))
+    }
+
+    pub fn create_custom_cursor(&self, source: CustomCursorSource) -> CustomCursor {
+        let _ = source.inner;
+        CustomCursor { inner: PlatformCustomCursor }
+    }
+
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        let mut v = VecDeque::with_capacity(1);
+        v.push_back(MonitorHandle::new(self.app.clone()));
+        v
+    }
+
+    #[inline]
+    pub fn listen_device_events(&self, _allowed: DeviceEvents) {}
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Android(rwh_05::AndroidDisplayHandle::empty())
+    }
+
+    #[inline]
+    pub fn system_theme(&self) -> Option<Theme> {
+        None
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Android(rwh_06::AndroidDisplayHandle::new()))
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.control_flow.set(control_flow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.control_flow.get()
+    }
+
+    pub(crate) fn exit(&self) {
+        self.exit.set(true)
+    }
+
+    pub(crate) fn clear_exit(&self) {
+        self.exit.set(false)
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.exit.get()
+    }
+
+    pub(crate) fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct OwnedDisplayHandle;
+
+impl OwnedDisplayHandle {
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::AndroidDisplayHandle::empty().into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::AndroidDisplayHandle::new().into())
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub(crate) struct WindowId;
+
+impl WindowId {
+    pub const fn dummy() -> Self {
+        WindowId
+    }
+}
+
+impl From<WindowId> for u64 {
+    fn from(_: WindowId) -> Self {
+        0
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(_: u64) -> Self {
+        Self
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct DeviceId(i32);
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        DeviceId(0)
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct PlatformSpecificWindowAttributes;
+
+pub(crate) struct Window {
+    app: AndroidApp,
+    redraw_requester: RedrawRequester,
+}
+
+impl Window {
+    pub(crate) fn new(
+        el: &ActiveEventLoop,
+        _window_attrs: window::WindowAttributes,
+    ) -> Result<Self, error::OsError> {
+        // FIXME this ignores requested window attributes
+
+        Ok(Self { app: el.app.clone(), redraw_requester: el.redraw_requester.clone() })
+    }
+
+    pub(crate) fn maybe_queue_on_main(&self, f: impl FnOnce(&Self) + Send + 'static) {
+        f(self)
+    }
+
+    pub(crate) fn maybe_wait_on_main<R: Send>(&self, f: impl FnOnce(&Self) -> R + Send) -> R {
+        f(self)
+    }
+
+    pub fn id(&self) -> WindowId {
+        WindowId
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        Some(MonitorHandle::new(self.app.clone()))
+    }
+
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        let mut v = VecDeque::with_capacity(1);
+        v.push_back(MonitorHandle::new(self.app.clone()));
+        v
+    }
+
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        Some(MonitorHandle::new(self.app.clone()))
+    }
+
+    pub fn scale_factor(&self) -> f64 {
+        MonitorHandle::new(self.app.clone()).scale_factor()
+    }
+
+    pub fn request_redraw(&self) {
+        self.redraw_requester.request_redraw()
+    }
+
+    pub fn pre_present_notify(&self) {}
+
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, error::NotSupportedError> {
+        Err(error::NotSupportedError::new())
+    }
+
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, error::NotSupportedError> {
+        Err(error::NotSupportedError::new())
+    }
+
+    pub fn set_outer_position(&self, _position: Position) {
+        // no effect
+    }
+
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        self.outer_size()
+    }
+
+    pub fn request_inner_size(&self, _size: Size) -> Option<PhysicalSize<u32>> {
+        Some(self.inner_size())
+    }
+
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        MonitorHandle::new(self.app.clone()).size()
+    }
+
+    pub fn set_min_inner_size(&self, _: Option<Size>) {}
+
+    pub fn set_max_inner_size(&self, _: Option<Size>) {}
+
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        None
+    }
+
+    pub fn set_resize_increments(&self, _increments: Option<Size>) {}
+
+    pub fn set_title(&self, _title: &str) {}
+
+    pub fn set_transparent(&self, _transparent: bool) {}
+
+    pub fn set_blur(&self, _blur: bool) {}
+
+    pub fn set_visible(&self, _visibility: bool) {}
+
+    pub fn is_visible(&self) -> Option<bool> {
+        None
+    }
+
+    pub fn set_resizable(&self, _resizeable: bool) {}
+
+    pub fn is_resizable(&self) -> bool {
+        false
+    }
+
+    pub fn set_enabled_buttons(&self, _buttons: WindowButtons) {}
+
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        WindowButtons::all()
+    }
+
+    pub fn set_minimized(&self, _minimized: bool) {}
+
+    pub fn is_minimized(&self) -> Option<bool> {
+        None
+    }
+
+    pub fn set_maximized(&self, _maximized: bool) {}
+
+    pub fn is_maximized(&self) -> bool {
+        false
+    }
+
+    pub fn set_fullscreen(&self, _monitor: Option<Fullscreen>) {
+        warn!("Cannot set fullscreen on Android");
+    }
+
+    pub fn fullscreen(&self) -> Option<Fullscreen> {
+        None
+    }
+
+    pub fn set_decorations(&self, _decorations: bool) {}
+
+    pub fn is_decorated(&self) -> bool {
+        true
+    }
+
+    pub fn set_window_level(&self, _level: WindowLevel) {}
+
+    pub fn set_window_icon(&self, _window_icon: Option<crate::icon::Icon>) {}
+
+    pub fn set_ime_cursor_area(&self, _position: Position, _size: Size) {}
+
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        if allowed {
+            self.app.show_soft_input(true);
+        } else {
+            self.app.hide_soft_input(true);
+        }
+    }
+
+    pub fn set_ime_purpose(&self, _purpose: ImePurpose) {}
+
+    pub fn focus_window(&self) {}
+
+    pub fn request_user_attention(&self, _request_type: Option<window::UserAttentionType>) {}
+
+    pub fn set_cursor(&self, _: Cursor) {}
+
+    pub fn set_cursor_position(&self, _: Position) -> Result<(), error::ExternalError> {
+        Err(error::ExternalError::NotSupported(error::NotSupportedError::new()))
+    }
+
+    pub fn set_cursor_grab(&self, _: CursorGrabMode) -> Result<(), error::ExternalError> {
+        Err(error::ExternalError::NotSupported(error::NotSupportedError::new()))
+    }
+
+    pub fn set_cursor_visible(&self, _: bool) {}
+
+    pub fn drag_window(&self) -> Result<(), error::ExternalError> {
+        Err(error::ExternalError::NotSupported(error::NotSupportedError::new()))
+    }
+
+    pub fn drag_resize_window(
+        &self,
+        _direction: ResizeDirection,
+    ) -> Result<(), error::ExternalError> {
+        Err(error::ExternalError::NotSupported(error::NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, _position: Position) {}
+
+    pub fn set_cursor_hittest(&self, _hittest: bool) -> Result<(), error::ExternalError> {
+        Err(error::ExternalError::NotSupported(error::NotSupportedError::new()))
+    }
+
+    #[cfg(feature = "rwh_04")]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        use rwh_04::HasRawWindowHandle;
+
+        if let Some(native_window) = self.app.native_window().as_ref() {
+            native_window.raw_window_handle()
+        } else {
+            panic!(
+                "Cannot get the native window, it's null and will always be null before \
+                 Event::Resumed and after Event::Suspended. Make sure you only call this function \
+                 between those events."
+            );
+        }
+    }
+
+    #[cfg(feature = "rwh_05")]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        use rwh_05::HasRawWindowHandle;
+
+        if let Some(native_window) = self.app.native_window().as_ref() {
+            native_window.raw_window_handle()
+        } else {
+            panic!(
+                "Cannot get the native window, it's null and will always be null before \
+                 Event::Resumed and after Event::Suspended. Make sure you only call this function \
+                 between those events."
+            );
+        }
+    }
+
+    #[cfg(feature = "rwh_05")]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Android(rwh_05::AndroidDisplayHandle::empty())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    // Allow the usage of HasRawWindowHandle inside this function
+    #[allow(deprecated)]
+    pub fn raw_window_handle_rwh_06(&self) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        use rwh_06::HasRawWindowHandle;
+
+        if let Some(native_window) = self.app.native_window().as_ref() {
+            native_window.raw_window_handle()
+        } else {
+            tracing::error!(
+                "Cannot get the native window, it's null and will always be null before \
+                 Event::Resumed and after Event::Suspended. Make sure you only call this function \
+                 between those events."
+            );
+            Err(rwh_06::HandleError::Unavailable)
+        }
+    }
+
+    #[cfg(feature = "rwh_06")]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Android(rwh_06::AndroidDisplayHandle::new()))
+    }
+
+    pub fn config(&self) -> ConfigurationRef {
+        self.app.config()
+    }
+
+    pub fn content_rect(&self) -> Rect {
+        self.app.content_rect()
+    }
+
+    pub fn set_theme(&self, _theme: Option<Theme>) {}
+
+    pub fn theme(&self) -> Option<Theme> {
+        None
+    }
+
+    pub fn set_content_protected(&self, _protected: bool) {}
+
+    pub fn has_focus(&self) -> bool {
+        HAS_FOCUS.load(Ordering::Relaxed)
+    }
+
+    pub fn title(&self) -> String {
+        String::new()
+    }
+
+    pub fn reset_dead_keys(&self) {}
+}
+
+#[derive(Default, Clone, Debug)]
+pub struct OsError;
+
+use std::fmt::{self, Display, Formatter};
+impl Display for OsError {
+    fn fmt(&self, fmt: &mut Formatter<'_>) -> Result<(), fmt::Error> {
+        write!(fmt, "Android OS Error")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct MonitorHandle {
+    app: AndroidApp,
+}
+impl PartialOrd for MonitorHandle {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+impl Ord for MonitorHandle {
+    fn cmp(&self, _other: &Self) -> std::cmp::Ordering {
+        std::cmp::Ordering::Equal
+    }
+}
+
+impl MonitorHandle {
+    pub(crate) fn new(app: AndroidApp) -> Self {
+        Self { app }
+    }
+
+    pub fn name(&self) -> Option<String> {
+        Some("Android Device".to_owned())
+    }
+
+    pub fn size(&self) -> PhysicalSize<u32> {
+        if let Some(native_window) = self.app.native_window() {
+            PhysicalSize::new(native_window.width() as _, native_window.height() as _)
+        } else {
+            PhysicalSize::new(0, 0)
+        }
+    }
+
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        (0, 0).into()
+    }
+
+    pub fn scale_factor(&self) -> f64 {
+        self.app.config().density().map(|dpi| dpi as f64 / 160.0).unwrap_or(1.0)
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        // FIXME no way to get real refresh rate for now.
+        None
+    }
+
+    pub fn video_modes(&self) -> impl Iterator<Item = VideoModeHandle> {
+        let size = self.size().into();
+        // FIXME this is not the real refresh rate
+        // (it is guaranteed to support 32 bit color though)
+        std::iter::once(VideoModeHandle {
+            size,
+            bit_depth: 32,
+            refresh_rate_millihertz: 60000,
+            monitor: self.clone(),
+        })
+    }
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+pub struct VideoModeHandle {
+    size: (u32, u32),
+    bit_depth: u16,
+    refresh_rate_millihertz: u32,
+    monitor: MonitorHandle,
+}
+
+impl VideoModeHandle {
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.size.into()
+    }
+
+    pub fn bit_depth(&self) -> u16 {
+        self.bit_depth
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.refresh_rate_millihertz
+    }
+
+    pub fn monitor(&self) -> MonitorHandle {
+        self.monitor.clone()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/ios/app_state.rs b/vendor/winit/src/platform_impl/ios/app_state.rs
new file mode 100644
index 00000000..e34bf43c
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/app_state.rs
@@ -0,0 +1,925 @@
+#![deny(unused_results)]
+
+use std::cell::{RefCell, RefMut};
+use std::collections::HashSet;
+use std::os::raw::c_void;
+use std::sync::{Arc, Mutex, OnceLock};
+use std::time::Instant;
+use std::{fmt, mem, ptr};
+
+use core_foundation::base::CFRelease;
+use core_foundation::date::CFAbsoluteTimeGetCurrent;
+use core_foundation::runloop::{
+    kCFRunLoopCommonModes, CFRunLoopAddTimer, CFRunLoopGetMain, CFRunLoopRef, CFRunLoopTimerCreate,
+    CFRunLoopTimerInvalidate, CFRunLoopTimerRef, CFRunLoopTimerSetNextFireDate,
+};
+use objc2::rc::Retained;
+use objc2::runtime::AnyObject;
+use objc2::{msg_send, sel};
+use objc2_foundation::{
+    CGRect, CGSize, MainThreadMarker, NSInteger, NSObjectProtocol, NSOperatingSystemVersion,
+    NSProcessInfo,
+};
+use objc2_ui_kit::{UIApplication, UICoordinateSpace, UIView, UIWindow};
+
+use super::window::WinitUIWindow;
+use crate::dpi::PhysicalSize;
+use crate::event::{Event, InnerSizeWriter, StartCause, WindowEvent};
+use crate::event_loop::{ActiveEventLoop as RootActiveEventLoop, ControlFlow};
+use crate::window::WindowId as RootWindowId;
+
+macro_rules! bug {
+    ($($msg:tt)*) => {
+        panic!("winit iOS bug, file an issue: {}", format!($($msg)*))
+    };
+}
+
+macro_rules! bug_assert {
+    ($test:expr, $($msg:tt)*) => {
+        assert!($test, "winit iOS bug, file an issue: {}", format!($($msg)*))
+    };
+}
+
+#[derive(Debug)]
+pub(crate) struct HandlePendingUserEvents;
+
+pub(crate) struct EventLoopHandler {
+    #[allow(clippy::type_complexity)]
+    pub(crate) handler: Box<dyn FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop)>,
+    pub(crate) event_loop: RootActiveEventLoop,
+}
+
+impl fmt::Debug for EventLoopHandler {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EventLoopHandler")
+            .field("handler", &"...")
+            .field("event_loop", &self.event_loop)
+            .finish()
+    }
+}
+
+impl EventLoopHandler {
+    fn handle_event(&mut self, event: Event<HandlePendingUserEvents>) {
+        (self.handler)(event, &self.event_loop)
+    }
+}
+
+#[derive(Debug)]
+pub(crate) enum EventWrapper {
+    StaticEvent(Event<HandlePendingUserEvents>),
+    ScaleFactorChanged(ScaleFactorChanged),
+}
+
+#[derive(Debug)]
+pub struct ScaleFactorChanged {
+    pub(super) window: Retained<WinitUIWindow>,
+    pub(super) suggested_size: PhysicalSize<u32>,
+    pub(super) scale_factor: f64,
+}
+
+enum UserCallbackTransitionResult<'a> {
+    Success {
+        handler: EventLoopHandler,
+        active_control_flow: ControlFlow,
+        processing_redraws: bool,
+    },
+    ReentrancyPrevented {
+        queued_events: &'a mut Vec<EventWrapper>,
+    },
+}
+
+impl Event<HandlePendingUserEvents> {
+    fn is_redraw(&self) -> bool {
+        matches!(self, Event::WindowEvent { event: WindowEvent::RedrawRequested, .. })
+    }
+}
+
+// this is the state machine for the app lifecycle
+#[derive(Debug)]
+#[must_use = "dropping `AppStateImpl` without inspecting it is probably a bug"]
+enum AppStateImpl {
+    NotLaunched {
+        queued_windows: Vec<Retained<WinitUIWindow>>,
+        queued_events: Vec<EventWrapper>,
+        queued_gpu_redraws: HashSet<Retained<WinitUIWindow>>,
+    },
+    Launching {
+        queued_windows: Vec<Retained<WinitUIWindow>>,
+        queued_events: Vec<EventWrapper>,
+        queued_handler: EventLoopHandler,
+        queued_gpu_redraws: HashSet<Retained<WinitUIWindow>>,
+    },
+    ProcessingEvents {
+        handler: EventLoopHandler,
+        queued_gpu_redraws: HashSet<Retained<WinitUIWindow>>,
+        active_control_flow: ControlFlow,
+    },
+    // special state to deal with reentrancy and prevent mutable aliasing.
+    InUserCallback {
+        queued_events: Vec<EventWrapper>,
+        queued_gpu_redraws: HashSet<Retained<WinitUIWindow>>,
+    },
+    ProcessingRedraws {
+        handler: EventLoopHandler,
+        active_control_flow: ControlFlow,
+    },
+    Waiting {
+        waiting_handler: EventLoopHandler,
+        start: Instant,
+    },
+    PollFinished {
+        waiting_handler: EventLoopHandler,
+    },
+    Terminated,
+}
+
+pub(crate) struct AppState {
+    // This should never be `None`, except for briefly during a state transition.
+    app_state: Option<AppStateImpl>,
+    control_flow: ControlFlow,
+    waker: EventLoopWaker,
+}
+
+impl AppState {
+    pub(crate) fn get_mut(_mtm: MainThreadMarker) -> RefMut<'static, AppState> {
+        // basically everything in UIKit requires the main thread, so it's pointless to use the
+        // std::sync APIs.
+        // must be mut because plain `static` requires `Sync`
+        static mut APP_STATE: RefCell<Option<AppState>> = RefCell::new(None);
+
+        #[allow(unknown_lints)] // New lint below
+        #[allow(static_mut_refs)] // TODO: Use `MainThreadBound` instead.
+        let mut guard = unsafe { APP_STATE.borrow_mut() };
+        if guard.is_none() {
+            #[inline(never)]
+            #[cold]
+            fn init_guard(guard: &mut RefMut<'static, Option<AppState>>) {
+                let waker = EventLoopWaker::new(unsafe { CFRunLoopGetMain() });
+                **guard = Some(AppState {
+                    app_state: Some(AppStateImpl::NotLaunched {
+                        queued_windows: Vec::new(),
+                        queued_events: Vec::new(),
+                        queued_gpu_redraws: HashSet::new(),
+                    }),
+                    control_flow: ControlFlow::default(),
+                    waker,
+                });
+            }
+            init_guard(&mut guard);
+        }
+        RefMut::map(guard, |state| state.as_mut().unwrap())
+    }
+
+    fn state(&self) -> &AppStateImpl {
+        match &self.app_state {
+            Some(ref state) => state,
+            None => bug!("`AppState` previously failed a state transition"),
+        }
+    }
+
+    fn state_mut(&mut self) -> &mut AppStateImpl {
+        match &mut self.app_state {
+            Some(ref mut state) => state,
+            None => bug!("`AppState` previously failed a state transition"),
+        }
+    }
+
+    fn take_state(&mut self) -> AppStateImpl {
+        match self.app_state.take() {
+            Some(state) => state,
+            None => bug!("`AppState` previously failed a state transition"),
+        }
+    }
+
+    fn set_state(&mut self, new_state: AppStateImpl) {
+        bug_assert!(
+            self.app_state.is_none(),
+            "attempted to set an `AppState` without calling `take_state` first {:?}",
+            self.app_state
+        );
+        self.app_state = Some(new_state)
+    }
+
+    fn replace_state(&mut self, new_state: AppStateImpl) -> AppStateImpl {
+        match &mut self.app_state {
+            Some(ref mut state) => mem::replace(state, new_state),
+            None => bug!("`AppState` previously failed a state transition"),
+        }
+    }
+
+    fn has_launched(&self) -> bool {
+        !matches!(self.state(), AppStateImpl::NotLaunched { .. } | AppStateImpl::Launching { .. })
+    }
+
+    fn has_terminated(&self) -> bool {
+        matches!(self.state(), AppStateImpl::Terminated)
+    }
+
+    fn will_launch_transition(&mut self, queued_handler: EventLoopHandler) {
+        let (queued_windows, queued_events, queued_gpu_redraws) = match self.take_state() {
+            AppStateImpl::NotLaunched { queued_windows, queued_events, queued_gpu_redraws } => {
+                (queued_windows, queued_events, queued_gpu_redraws)
+            },
+            s => bug!("unexpected state {:?}", s),
+        };
+        self.set_state(AppStateImpl::Launching {
+            queued_windows,
+            queued_events,
+            queued_handler,
+            queued_gpu_redraws,
+        });
+    }
+
+    fn did_finish_launching_transition(
+        &mut self,
+    ) -> (Vec<Retained<WinitUIWindow>>, Vec<EventWrapper>) {
+        let (windows, events, handler, queued_gpu_redraws) = match self.take_state() {
+            AppStateImpl::Launching {
+                queued_windows,
+                queued_events,
+                queued_handler,
+                queued_gpu_redraws,
+            } => (queued_windows, queued_events, queued_handler, queued_gpu_redraws),
+            s => bug!("unexpected state {:?}", s),
+        };
+        self.set_state(AppStateImpl::ProcessingEvents {
+            handler,
+            active_control_flow: self.control_flow,
+            queued_gpu_redraws,
+        });
+        (windows, events)
+    }
+
+    fn wakeup_transition(&mut self) -> Option<EventWrapper> {
+        // before `AppState::did_finish_launching` is called, pretend there is no running
+        // event loop.
+        if !self.has_launched() || self.has_terminated() {
+            return None;
+        }
+
+        let (handler, event) = match (self.control_flow, self.take_state()) {
+            (ControlFlow::Poll, AppStateImpl::PollFinished { waiting_handler }) => {
+                (waiting_handler, EventWrapper::StaticEvent(Event::NewEvents(StartCause::Poll)))
+            },
+            (ControlFlow::Wait, AppStateImpl::Waiting { waiting_handler, start }) => (
+                waiting_handler,
+                EventWrapper::StaticEvent(Event::NewEvents(StartCause::WaitCancelled {
+                    start,
+                    requested_resume: None,
+                })),
+            ),
+            (
+                ControlFlow::WaitUntil(requested_resume),
+                AppStateImpl::Waiting { waiting_handler, start },
+            ) => {
+                let event = if Instant::now() >= requested_resume {
+                    EventWrapper::StaticEvent(Event::NewEvents(StartCause::ResumeTimeReached {
+                        start,
+                        requested_resume,
+                    }))
+                } else {
+                    EventWrapper::StaticEvent(Event::NewEvents(StartCause::WaitCancelled {
+                        start,
+                        requested_resume: Some(requested_resume),
+                    }))
+                };
+                (waiting_handler, event)
+            },
+            s => bug!("`EventHandler` unexpectedly woke up {:?}", s),
+        };
+
+        self.set_state(AppStateImpl::ProcessingEvents {
+            handler,
+            queued_gpu_redraws: Default::default(),
+            active_control_flow: self.control_flow,
+        });
+        Some(event)
+    }
+
+    fn try_user_callback_transition(&mut self) -> UserCallbackTransitionResult<'_> {
+        // If we're not able to process an event due to recursion or `Init` not having been sent out
+        // yet, then queue the events up.
+        match self.state_mut() {
+            &mut AppStateImpl::Launching { ref mut queued_events, .. }
+            | &mut AppStateImpl::NotLaunched { ref mut queued_events, .. }
+            | &mut AppStateImpl::InUserCallback { ref mut queued_events, .. } => {
+                // A lifetime cast: early returns are not currently handled well with NLL, but
+                // polonius handles them well. This transmute is a safe workaround.
+                return unsafe {
+                    mem::transmute::<
+                        UserCallbackTransitionResult<'_>,
+                        UserCallbackTransitionResult<'_>,
+                    >(UserCallbackTransitionResult::ReentrancyPrevented {
+                        queued_events,
+                    })
+                };
+            },
+
+            &mut AppStateImpl::ProcessingEvents { .. }
+            | &mut AppStateImpl::ProcessingRedraws { .. } => {},
+
+            s @ &mut AppStateImpl::PollFinished { .. }
+            | s @ &mut AppStateImpl::Waiting { .. }
+            | s @ &mut AppStateImpl::Terminated => {
+                bug!("unexpected attempted to process an event {:?}", s)
+            },
+        }
+
+        let (handler, queued_gpu_redraws, active_control_flow, processing_redraws) = match self
+            .take_state()
+        {
+            AppStateImpl::Launching { .. }
+            | AppStateImpl::NotLaunched { .. }
+            | AppStateImpl::InUserCallback { .. } => unreachable!(),
+            AppStateImpl::ProcessingEvents { handler, queued_gpu_redraws, active_control_flow } => {
+                (handler, queued_gpu_redraws, active_control_flow, false)
+            },
+            AppStateImpl::ProcessingRedraws { handler, active_control_flow } => {
+                (handler, Default::default(), active_control_flow, true)
+            },
+            AppStateImpl::PollFinished { .. }
+            | AppStateImpl::Waiting { .. }
+            | AppStateImpl::Terminated => unreachable!(),
+        };
+        self.set_state(AppStateImpl::InUserCallback {
+            queued_events: Vec::new(),
+            queued_gpu_redraws,
+        });
+        UserCallbackTransitionResult::Success { handler, active_control_flow, processing_redraws }
+    }
+
+    fn main_events_cleared_transition(&mut self) -> HashSet<Retained<WinitUIWindow>> {
+        let (handler, queued_gpu_redraws, active_control_flow) = match self.take_state() {
+            AppStateImpl::ProcessingEvents { handler, queued_gpu_redraws, active_control_flow } => {
+                (handler, queued_gpu_redraws, active_control_flow)
+            },
+            s => bug!("unexpected state {:?}", s),
+        };
+        self.set_state(AppStateImpl::ProcessingRedraws { handler, active_control_flow });
+        queued_gpu_redraws
+    }
+
+    fn events_cleared_transition(&mut self) {
+        if !self.has_launched() || self.has_terminated() {
+            return;
+        }
+        let (waiting_handler, old) = match self.take_state() {
+            AppStateImpl::ProcessingRedraws { handler, active_control_flow } => {
+                (handler, active_control_flow)
+            },
+            s => bug!("unexpected state {:?}", s),
+        };
+
+        let new = self.control_flow;
+        match (old, new) {
+            (ControlFlow::Wait, ControlFlow::Wait) => {
+                let start = Instant::now();
+                self.set_state(AppStateImpl::Waiting { waiting_handler, start });
+                self.waker.stop()
+            },
+            (ControlFlow::WaitUntil(old_instant), ControlFlow::WaitUntil(new_instant))
+                if old_instant == new_instant =>
+            {
+                let start = Instant::now();
+                self.set_state(AppStateImpl::Waiting { waiting_handler, start });
+            },
+            (_, ControlFlow::Wait) => {
+                let start = Instant::now();
+                self.set_state(AppStateImpl::Waiting { waiting_handler, start });
+                self.waker.stop()
+            },
+            (_, ControlFlow::WaitUntil(new_instant)) => {
+                let start = Instant::now();
+                self.set_state(AppStateImpl::Waiting { waiting_handler, start });
+                self.waker.start_at(new_instant)
+            },
+            // Unlike on macOS, handle Poll to Poll transition here to call the waker
+            (_, ControlFlow::Poll) => {
+                self.set_state(AppStateImpl::PollFinished { waiting_handler });
+                self.waker.start()
+            },
+        }
+    }
+
+    fn terminated_transition(&mut self) -> EventLoopHandler {
+        match self.replace_state(AppStateImpl::Terminated) {
+            AppStateImpl::ProcessingEvents { handler, .. } => handler,
+            s => bug!("`LoopExiting` happened while not processing events {:?}", s),
+        }
+    }
+
+    pub(crate) fn set_control_flow(&mut self, control_flow: ControlFlow) {
+        self.control_flow = control_flow;
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.control_flow
+    }
+}
+
+pub(crate) fn set_key_window(mtm: MainThreadMarker, window: &Retained<WinitUIWindow>) {
+    let mut this = AppState::get_mut(mtm);
+    match this.state_mut() {
+        &mut AppStateImpl::NotLaunched { ref mut queued_windows, .. } => {
+            return queued_windows.push(window.clone())
+        },
+        &mut AppStateImpl::ProcessingEvents { .. }
+        | &mut AppStateImpl::InUserCallback { .. }
+        | &mut AppStateImpl::ProcessingRedraws { .. } => {},
+        s @ &mut AppStateImpl::Launching { .. }
+        | s @ &mut AppStateImpl::Waiting { .. }
+        | s @ &mut AppStateImpl::PollFinished { .. } => bug!("unexpected state {:?}", s),
+        &mut AppStateImpl::Terminated => {
+            panic!("Attempt to create a `Window` after the app has terminated")
+        },
+    }
+    drop(this);
+    window.makeKeyAndVisible();
+}
+
+pub(crate) fn queue_gl_or_metal_redraw(mtm: MainThreadMarker, window: Retained<WinitUIWindow>) {
+    let mut this = AppState::get_mut(mtm);
+    match this.state_mut() {
+        &mut AppStateImpl::NotLaunched { ref mut queued_gpu_redraws, .. }
+        | &mut AppStateImpl::Launching { ref mut queued_gpu_redraws, .. }
+        | &mut AppStateImpl::ProcessingEvents { ref mut queued_gpu_redraws, .. }
+        | &mut AppStateImpl::InUserCallback { ref mut queued_gpu_redraws, .. } => {
+            let _ = queued_gpu_redraws.insert(window);
+        },
+        s @ &mut AppStateImpl::ProcessingRedraws { .. }
+        | s @ &mut AppStateImpl::Waiting { .. }
+        | s @ &mut AppStateImpl::PollFinished { .. } => bug!("unexpected state {:?}", s),
+        &mut AppStateImpl::Terminated => {
+            panic!("Attempt to create a `Window` after the app has terminated")
+        },
+    }
+}
+
+pub(crate) fn will_launch(mtm: MainThreadMarker, queued_handler: EventLoopHandler) {
+    AppState::get_mut(mtm).will_launch_transition(queued_handler)
+}
+
+pub fn did_finish_launching(mtm: MainThreadMarker) {
+    let mut this = AppState::get_mut(mtm);
+    let windows = match this.state_mut() {
+        AppStateImpl::Launching { queued_windows, .. } => mem::take(queued_windows),
+        s => bug!("unexpected state {:?}", s),
+    };
+
+    this.waker.start();
+
+    // have to drop RefMut because the window setup code below can trigger new events
+    drop(this);
+
+    for window in windows {
+        // Do a little screen dance here to account for windows being created before
+        // `UIApplicationMain` is called. This fixes visual issues such as being
+        // offcenter and sized incorrectly. Additionally, to fix orientation issues, we
+        // gotta reset the `rootViewController`.
+        //
+        // relevant iOS log:
+        // ```
+        // [ApplicationLifecycle] Windows were created before application initialization
+        // completed. This may result in incorrect visual appearance.
+        // ```
+        let screen = window.screen();
+        let _: () = unsafe { msg_send![&window, setScreen: ptr::null::<AnyObject>()] };
+        window.setScreen(&screen);
+
+        let controller = window.rootViewController();
+        window.setRootViewController(None);
+        window.setRootViewController(controller.as_deref());
+
+        window.makeKeyAndVisible();
+    }
+
+    let (windows, events) = AppState::get_mut(mtm).did_finish_launching_transition();
+
+    let events = std::iter::once(EventWrapper::StaticEvent(Event::NewEvents(StartCause::Init)))
+        .chain(events);
+    handle_nonuser_events(mtm, events);
+
+    // the above window dance hack, could possibly trigger new windows to be created.
+    // we can just set those windows up normally, as they were created after didFinishLaunching
+    for window in windows {
+        window.makeKeyAndVisible();
+    }
+}
+
+// AppState::did_finish_launching handles the special transition `Init`
+pub fn handle_wakeup_transition(mtm: MainThreadMarker) {
+    let mut this = AppState::get_mut(mtm);
+    let wakeup_event = match this.wakeup_transition() {
+        None => return,
+        Some(wakeup_event) => wakeup_event,
+    };
+    drop(this);
+
+    handle_nonuser_event(mtm, wakeup_event)
+}
+
+pub(crate) fn handle_nonuser_event(mtm: MainThreadMarker, event: EventWrapper) {
+    handle_nonuser_events(mtm, std::iter::once(event))
+}
+
+pub(crate) fn handle_nonuser_events<I: IntoIterator<Item = EventWrapper>>(
+    mtm: MainThreadMarker,
+    events: I,
+) {
+    let mut this = AppState::get_mut(mtm);
+    if this.has_terminated() {
+        return;
+    }
+
+    let (mut handler, active_control_flow, processing_redraws) =
+        match this.try_user_callback_transition() {
+            UserCallbackTransitionResult::ReentrancyPrevented { queued_events } => {
+                queued_events.extend(events);
+                return;
+            },
+            UserCallbackTransitionResult::Success {
+                handler,
+                active_control_flow,
+                processing_redraws,
+            } => (handler, active_control_flow, processing_redraws),
+        };
+    drop(this);
+
+    for wrapper in events {
+        match wrapper {
+            EventWrapper::StaticEvent(event) => {
+                if !processing_redraws && event.is_redraw() {
+                    tracing::info!("processing `RedrawRequested` during the main event loop");
+                } else if processing_redraws && !event.is_redraw() {
+                    tracing::warn!(
+                        "processing non `RedrawRequested` event after the main event loop: {:#?}",
+                        event
+                    );
+                }
+                handler.handle_event(event)
+            },
+            EventWrapper::ScaleFactorChanged(event) => handle_hidpi_proxy(&mut handler, event),
+        }
+    }
+
+    loop {
+        let mut this = AppState::get_mut(mtm);
+        let queued_events = match this.state_mut() {
+            &mut AppStateImpl::InUserCallback { ref mut queued_events, queued_gpu_redraws: _ } => {
+                mem::take(queued_events)
+            },
+            s => bug!("unexpected state {:?}", s),
+        };
+        if queued_events.is_empty() {
+            let queued_gpu_redraws = match this.take_state() {
+                AppStateImpl::InUserCallback { queued_events: _, queued_gpu_redraws } => {
+                    queued_gpu_redraws
+                },
+                _ => unreachable!(),
+            };
+            this.app_state = Some(if processing_redraws {
+                bug_assert!(
+                    queued_gpu_redraws.is_empty(),
+                    "redraw queued while processing redraws"
+                );
+                AppStateImpl::ProcessingRedraws { handler, active_control_flow }
+            } else {
+                AppStateImpl::ProcessingEvents { handler, queued_gpu_redraws, active_control_flow }
+            });
+            break;
+        }
+        drop(this);
+
+        for wrapper in queued_events {
+            match wrapper {
+                EventWrapper::StaticEvent(event) => {
+                    if !processing_redraws && event.is_redraw() {
+                        tracing::info!("processing `RedrawRequested` during the main event loop");
+                    } else if processing_redraws && !event.is_redraw() {
+                        tracing::warn!(
+                            "processing non-`RedrawRequested` event after the main event loop: \
+                             {:#?}",
+                            event
+                        );
+                    }
+                    handler.handle_event(event)
+                },
+                EventWrapper::ScaleFactorChanged(event) => handle_hidpi_proxy(&mut handler, event),
+            }
+        }
+    }
+}
+
+fn handle_user_events(mtm: MainThreadMarker) {
+    let mut this = AppState::get_mut(mtm);
+    let (mut handler, active_control_flow, processing_redraws) =
+        match this.try_user_callback_transition() {
+            UserCallbackTransitionResult::ReentrancyPrevented { .. } => {
+                bug!("unexpected attempted to process an event")
+            },
+            UserCallbackTransitionResult::Success {
+                handler,
+                active_control_flow,
+                processing_redraws,
+            } => (handler, active_control_flow, processing_redraws),
+        };
+    if processing_redraws {
+        bug!("user events attempted to be sent out while `ProcessingRedraws`");
+    }
+    drop(this);
+
+    handler.handle_event(Event::UserEvent(HandlePendingUserEvents));
+
+    loop {
+        let mut this = AppState::get_mut(mtm);
+        let queued_events = match this.state_mut() {
+            &mut AppStateImpl::InUserCallback { ref mut queued_events, queued_gpu_redraws: _ } => {
+                mem::take(queued_events)
+            },
+            s => bug!("unexpected state {:?}", s),
+        };
+        if queued_events.is_empty() {
+            let queued_gpu_redraws = match this.take_state() {
+                AppStateImpl::InUserCallback { queued_events: _, queued_gpu_redraws } => {
+                    queued_gpu_redraws
+                },
+                _ => unreachable!(),
+            };
+            this.app_state = Some(AppStateImpl::ProcessingEvents {
+                handler,
+                queued_gpu_redraws,
+                active_control_flow,
+            });
+            break;
+        }
+        drop(this);
+
+        for wrapper in queued_events {
+            match wrapper {
+                EventWrapper::StaticEvent(event) => handler.handle_event(event),
+                EventWrapper::ScaleFactorChanged(event) => handle_hidpi_proxy(&mut handler, event),
+            }
+        }
+
+        handler.handle_event(Event::UserEvent(HandlePendingUserEvents));
+    }
+}
+
+pub(crate) fn send_occluded_event_for_all_windows(application: &UIApplication, occluded: bool) {
+    let mtm = MainThreadMarker::from(application);
+
+    let mut events = Vec::new();
+    #[allow(deprecated)]
+    for window in application.windows().iter() {
+        if window.is_kind_of::<WinitUIWindow>() {
+            // SAFETY: We just checked that the window is a `winit` window
+            let window = unsafe {
+                let ptr: *const UIWindow = window;
+                let ptr: *const WinitUIWindow = ptr.cast();
+                &*ptr
+            };
+            events.push(EventWrapper::StaticEvent(Event::WindowEvent {
+                window_id: RootWindowId(window.id()),
+                event: WindowEvent::Occluded(occluded),
+            }));
+        }
+    }
+    handle_nonuser_events(mtm, events);
+}
+
+pub fn handle_main_events_cleared(mtm: MainThreadMarker) {
+    let mut this = AppState::get_mut(mtm);
+    if !this.has_launched() || this.has_terminated() {
+        return;
+    }
+    match this.state_mut() {
+        AppStateImpl::ProcessingEvents { .. } => {},
+        _ => bug!("`ProcessingRedraws` happened unexpectedly"),
+    };
+    drop(this);
+
+    handle_user_events(mtm);
+
+    let mut this = AppState::get_mut(mtm);
+    let redraw_events: Vec<EventWrapper> = this
+        .main_events_cleared_transition()
+        .into_iter()
+        .map(|window| {
+            EventWrapper::StaticEvent(Event::WindowEvent {
+                window_id: RootWindowId(window.id()),
+                event: WindowEvent::RedrawRequested,
+            })
+        })
+        .collect();
+    drop(this);
+
+    handle_nonuser_events(mtm, redraw_events);
+    handle_nonuser_event(mtm, EventWrapper::StaticEvent(Event::AboutToWait));
+}
+
+pub fn handle_events_cleared(mtm: MainThreadMarker) {
+    AppState::get_mut(mtm).events_cleared_transition();
+}
+
+pub(crate) fn terminated(application: &UIApplication) {
+    let mtm = MainThreadMarker::from(application);
+
+    let mut events = Vec::new();
+    #[allow(deprecated)]
+    for window in application.windows().iter() {
+        if window.is_kind_of::<WinitUIWindow>() {
+            // SAFETY: We just checked that the window is a `winit` window
+            let window = unsafe {
+                let ptr: *const UIWindow = window;
+                let ptr: *const WinitUIWindow = ptr.cast();
+                &*ptr
+            };
+            events.push(EventWrapper::StaticEvent(Event::WindowEvent {
+                window_id: RootWindowId(window.id()),
+                event: WindowEvent::Destroyed,
+            }));
+        }
+    }
+    handle_nonuser_events(mtm, events);
+
+    let mut this = AppState::get_mut(mtm);
+    let mut handler = this.terminated_transition();
+    drop(this);
+
+    handler.handle_event(Event::LoopExiting)
+}
+
+fn handle_hidpi_proxy(handler: &mut EventLoopHandler, event: ScaleFactorChanged) {
+    let ScaleFactorChanged { suggested_size, scale_factor, window } = event;
+    let new_inner_size = Arc::new(Mutex::new(suggested_size));
+    let event = Event::WindowEvent {
+        window_id: RootWindowId(window.id()),
+        event: WindowEvent::ScaleFactorChanged {
+            scale_factor,
+            inner_size_writer: InnerSizeWriter::new(Arc::downgrade(&new_inner_size)),
+        },
+    };
+    handler.handle_event(event);
+    let (view, screen_frame) = get_view_and_screen_frame(&window);
+    let physical_size = *new_inner_size.lock().unwrap();
+    drop(new_inner_size);
+    let logical_size = physical_size.to_logical(scale_factor);
+    let size = CGSize::new(logical_size.width, logical_size.height);
+    let new_frame: CGRect = CGRect::new(screen_frame.origin, size);
+    view.setFrame(new_frame);
+}
+
+fn get_view_and_screen_frame(window: &WinitUIWindow) -> (Retained<UIView>, CGRect) {
+    let view_controller = window.rootViewController().unwrap();
+    let view = view_controller.view().unwrap();
+    let bounds = window.bounds();
+    let screen = window.screen();
+    let screen_space = screen.coordinateSpace();
+    let screen_frame = window.convertRect_toCoordinateSpace(bounds, &screen_space);
+    (view, screen_frame)
+}
+
+struct EventLoopWaker {
+    timer: CFRunLoopTimerRef,
+}
+
+impl Drop for EventLoopWaker {
+    fn drop(&mut self) {
+        unsafe {
+            CFRunLoopTimerInvalidate(self.timer);
+            CFRelease(self.timer as _);
+        }
+    }
+}
+
+impl EventLoopWaker {
+    fn new(rl: CFRunLoopRef) -> EventLoopWaker {
+        extern "C" fn wakeup_main_loop(_timer: CFRunLoopTimerRef, _info: *mut c_void) {}
+        unsafe {
+            // Create a timer with a 0.1µs interval (1ns does not work) to mimic polling.
+            // It is initially setup with a first fire time really far into the
+            // future, but that gets changed to fire immediately in did_finish_launching
+            let timer = CFRunLoopTimerCreate(
+                ptr::null_mut(),
+                f64::MAX,
+                0.000_000_1,
+                0,
+                0,
+                wakeup_main_loop,
+                ptr::null_mut(),
+            );
+            CFRunLoopAddTimer(rl, timer, kCFRunLoopCommonModes);
+
+            EventLoopWaker { timer }
+        }
+    }
+
+    fn stop(&mut self) {
+        unsafe { CFRunLoopTimerSetNextFireDate(self.timer, f64::MAX) }
+    }
+
+    fn start(&mut self) {
+        unsafe { CFRunLoopTimerSetNextFireDate(self.timer, f64::MIN) }
+    }
+
+    fn start_at(&mut self, instant: Instant) {
+        let now = Instant::now();
+        if now >= instant {
+            self.start();
+        } else {
+            unsafe {
+                let current = CFAbsoluteTimeGetCurrent();
+                let duration = instant - now;
+                let fsecs =
+                    duration.subsec_nanos() as f64 / 1_000_000_000.0 + duration.as_secs() as f64;
+                CFRunLoopTimerSetNextFireDate(self.timer, current + fsecs)
+            }
+        }
+    }
+}
+
+macro_rules! os_capabilities {
+    (
+        $(
+            $(#[$attr:meta])*
+            $error_name:ident: $objc_call:literal,
+            $name:ident: $major:literal-$minor:literal
+        ),*
+        $(,)*
+    ) => {
+        #[derive(Clone, Debug)]
+        pub struct OSCapabilities {
+            $(
+                pub $name: bool,
+            )*
+
+            os_version: NSOperatingSystemVersion,
+        }
+
+        impl OSCapabilities {
+            fn from_os_version(os_version: NSOperatingSystemVersion) -> Self {
+                $(let $name = meets_requirements(os_version, $major, $minor);)*
+                Self { $($name,)* os_version, }
+            }
+        }
+
+        impl OSCapabilities {$(
+            $(#[$attr])*
+            pub fn $error_name(&self, extra_msg: &str) {
+                tracing::warn!(
+                    concat!("`", $objc_call, "` requires iOS {}.{}+. This device is running iOS {}.{}.{}. {}"),
+                    $major, $minor, self.os_version.majorVersion, self.os_version.minorVersion, self.os_version.patchVersion,
+                    extra_msg
+                )
+            }
+        )*}
+    };
+}
+
+os_capabilities! {
+    /// <https://developer.apple.com/documentation/uikit/uiview/2891103-safeareainsets?language=objc>
+    #[allow(unused)] // error message unused
+    safe_area_err_msg: "-[UIView safeAreaInsets]",
+    safe_area: 11-0,
+    /// <https://developer.apple.com/documentation/uikit/uiviewcontroller/2887509-setneedsupdateofhomeindicatoraut?language=objc>
+    home_indicator_hidden_err_msg: "-[UIViewController setNeedsUpdateOfHomeIndicatorAutoHidden]",
+    home_indicator_hidden: 11-0,
+    /// <https://developer.apple.com/documentation/uikit/uiviewcontroller/2887507-setneedsupdateofscreenedgesdefer?language=objc>
+    defer_system_gestures_err_msg: "-[UIViewController setNeedsUpdateOfScreenEdgesDeferringSystem]",
+    defer_system_gestures: 11-0,
+    /// <https://developer.apple.com/documentation/uikit/uiscreen/2806814-maximumframespersecond?language=objc>
+    maximum_frames_per_second_err_msg: "-[UIScreen maximumFramesPerSecond]",
+    maximum_frames_per_second: 10-3,
+    /// <https://developer.apple.com/documentation/uikit/uitouch/1618110-force?language=objc>
+    #[allow(unused)] // error message unused
+    force_touch_err_msg: "-[UITouch force]",
+    force_touch: 9-0,
+}
+
+fn meets_requirements(
+    version: NSOperatingSystemVersion,
+    required_major: NSInteger,
+    required_minor: NSInteger,
+) -> bool {
+    (version.majorVersion, version.minorVersion) >= (required_major, required_minor)
+}
+
+fn get_version() -> NSOperatingSystemVersion {
+    let process_info = NSProcessInfo::processInfo();
+    let atleast_ios_8 = process_info.respondsToSelector(sel!(operatingSystemVersion));
+    // Winit requires atleast iOS 8 because no one has put the time into supporting earlier os
+    // versions. Older iOS versions are increasingly difficult to test. For example, Xcode 11 does
+    // not support debugging on devices with an iOS version of less than 8. Another example, in
+    // order to use an iOS simulator older than iOS 8, you must download an older version of Xcode
+    // (<9), and at least Xcode 7 has been tested to not even run on macOS 10.15 - Xcode 8 might?
+    //
+    // The minimum required iOS version is likely to grow in the future.
+    assert!(atleast_ios_8, "`winit` requires iOS version 8 or greater");
+    process_info.operatingSystemVersion()
+}
+
+pub fn os_capabilities() -> OSCapabilities {
+    // Cache the version lookup for efficiency
+    static OS_CAPABILITIES: OnceLock<OSCapabilities> = OnceLock::new();
+    OS_CAPABILITIES.get_or_init(|| OSCapabilities::from_os_version(get_version())).clone()
+}
diff --git a/vendor/winit/src/platform_impl/ios/event_loop.rs b/vendor/winit/src/platform_impl/ios/event_loop.rs
new file mode 100644
index 00000000..a093b7b5
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/event_loop.rs
@@ -0,0 +1,494 @@
+use std::collections::VecDeque;
+use std::ffi::{c_char, c_int, c_void};
+use std::marker::PhantomData;
+use std::ptr::{self, NonNull};
+use std::sync::mpsc::{self, Receiver, Sender};
+
+use core_foundation::base::{CFIndex, CFRelease};
+use core_foundation::runloop::{
+    kCFRunLoopAfterWaiting, kCFRunLoopBeforeWaiting, kCFRunLoopCommonModes, kCFRunLoopDefaultMode,
+    kCFRunLoopExit, CFRunLoopActivity, CFRunLoopAddObserver, CFRunLoopAddSource, CFRunLoopGetMain,
+    CFRunLoopObserverCreate, CFRunLoopObserverRef, CFRunLoopSourceContext, CFRunLoopSourceCreate,
+    CFRunLoopSourceInvalidate, CFRunLoopSourceRef, CFRunLoopSourceSignal, CFRunLoopWakeUp,
+};
+use objc2::rc::Retained;
+use objc2::{msg_send_id, ClassType};
+use objc2_foundation::{MainThreadMarker, NSNotificationCenter, NSObject};
+use objc2_ui_kit::{
+    UIApplication, UIApplicationDidBecomeActiveNotification,
+    UIApplicationDidEnterBackgroundNotification, UIApplicationDidFinishLaunchingNotification,
+    UIApplicationDidReceiveMemoryWarningNotification, UIApplicationMain,
+    UIApplicationWillEnterForegroundNotification, UIApplicationWillResignActiveNotification,
+    UIApplicationWillTerminateNotification, UIDevice, UIScreen, UIUserInterfaceIdiom,
+};
+
+use crate::error::EventLoopError;
+use crate::event::Event;
+use crate::event_loop::{
+    ActiveEventLoop as RootActiveEventLoop, ControlFlow, DeviceEvents, EventLoopClosed,
+};
+use crate::platform::ios::Idiom;
+use crate::platform_impl::ios::app_state::{EventLoopHandler, HandlePendingUserEvents};
+use crate::window::{CustomCursor, CustomCursorSource, Theme};
+
+use super::app_state::{send_occluded_event_for_all_windows, AppState, EventWrapper};
+use super::notification_center::create_observer;
+use super::{app_state, monitor, MonitorHandle};
+
+#[derive(Debug)]
+pub struct ActiveEventLoop {
+    pub(super) mtm: MainThreadMarker,
+}
+
+impl ActiveEventLoop {
+    pub fn create_custom_cursor(&self, source: CustomCursorSource) -> CustomCursor {
+        let _ = source.inner;
+        CustomCursor { inner: super::PlatformCustomCursor }
+    }
+
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        monitor::uiscreens(self.mtm)
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        #[allow(deprecated)]
+        Some(MonitorHandle::new(UIScreen::mainScreen(self.mtm)))
+    }
+
+    #[inline]
+    pub fn listen_device_events(&self, _allowed: DeviceEvents) {}
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::UiKit(rwh_05::UiKitDisplayHandle::empty())
+    }
+
+    #[inline]
+    pub fn system_theme(&self) -> Option<Theme> {
+        None
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::UiKit(rwh_06::UiKitDisplayHandle::new()))
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        AppState::get_mut(self.mtm).set_control_flow(control_flow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        AppState::get_mut(self.mtm).control_flow()
+    }
+
+    pub(crate) fn exit(&self) {
+        // https://developer.apple.com/library/archive/qa/qa1561/_index.html
+        // it is not possible to quit an iOS app gracefully and programmatically
+        tracing::warn!("`ControlFlow::Exit` ignored on iOS");
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        false
+    }
+
+    pub(crate) fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct OwnedDisplayHandle;
+
+impl OwnedDisplayHandle {
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::UiKitDisplayHandle::empty().into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::UiKitDisplayHandle::new().into())
+    }
+}
+
+fn map_user_event<T: 'static>(
+    mut handler: impl FnMut(Event<T>, &RootActiveEventLoop),
+    receiver: mpsc::Receiver<T>,
+) -> impl FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop) {
+    move |event, window_target| match event.map_nonuser_event() {
+        Ok(event) => (handler)(event, window_target),
+        Err(_) => {
+            for event in receiver.try_iter() {
+                (handler)(Event::UserEvent(event), window_target);
+            }
+        },
+    }
+}
+
+pub struct EventLoop<T: 'static> {
+    mtm: MainThreadMarker,
+    sender: Sender<T>,
+    receiver: Receiver<T>,
+    window_target: RootActiveEventLoop,
+
+    // Since iOS 9.0, we no longer need to remove the observers before they are deallocated; the
+    // system instead cleans it up next time it would have posted a notification to it.
+    //
+    // Though we do still need to keep the observers around to prevent them from being deallocated.
+    _did_finish_launching_observer: Retained<NSObject>,
+    _did_become_active_observer: Retained<NSObject>,
+    _will_resign_active_observer: Retained<NSObject>,
+    _will_enter_foreground_observer: Retained<NSObject>,
+    _did_enter_background_observer: Retained<NSObject>,
+    _will_terminate_observer: Retained<NSObject>,
+    _did_receive_memory_warning_observer: Retained<NSObject>,
+}
+
+#[derive(Default, Debug, Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) struct PlatformSpecificEventLoopAttributes {}
+
+impl<T: 'static> EventLoop<T> {
+    pub(crate) fn new(
+        _: &PlatformSpecificEventLoopAttributes,
+    ) -> Result<EventLoop<T>, EventLoopError> {
+        let mtm = MainThreadMarker::new()
+            .expect("On iOS, `EventLoop` must be created on the main thread");
+
+        static mut SINGLETON_INIT: bool = false;
+        unsafe {
+            assert!(
+                !SINGLETON_INIT,
+                "Only one `EventLoop` is supported on iOS. `EventLoopProxy` might be helpful"
+            );
+            SINGLETON_INIT = true;
+        }
+
+        let (sender, receiver) = mpsc::channel();
+
+        // this line sets up the main run loop before `UIApplicationMain`
+        setup_control_flow_observers();
+
+        let center = unsafe { NSNotificationCenter::defaultCenter() };
+
+        let _did_finish_launching_observer = create_observer(
+            &center,
+            // `application:didFinishLaunchingWithOptions:`
+            unsafe { UIApplicationDidFinishLaunchingNotification },
+            move |_| {
+                app_state::did_finish_launching(mtm);
+            },
+        );
+        let _did_become_active_observer = create_observer(
+            &center,
+            // `applicationDidBecomeActive:`
+            unsafe { UIApplicationDidBecomeActiveNotification },
+            move |_| {
+                app_state::handle_nonuser_event(mtm, EventWrapper::StaticEvent(Event::Resumed));
+            },
+        );
+        let _will_resign_active_observer = create_observer(
+            &center,
+            // `applicationWillResignActive:`
+            unsafe { UIApplicationWillResignActiveNotification },
+            move |_| {
+                app_state::handle_nonuser_event(mtm, EventWrapper::StaticEvent(Event::Suspended));
+            },
+        );
+        let _will_enter_foreground_observer = create_observer(
+            &center,
+            // `applicationWillEnterForeground:`
+            unsafe { UIApplicationWillEnterForegroundNotification },
+            move |notification| {
+                let app = unsafe { notification.object() }.expect(
+                    "UIApplicationWillEnterForegroundNotification to have application object",
+                );
+                // SAFETY: The `object` in `UIApplicationWillEnterForegroundNotification` is
+                // documented to be `UIApplication`.
+                let app: Retained<UIApplication> = unsafe { Retained::cast(app) };
+                send_occluded_event_for_all_windows(&app, false);
+            },
+        );
+        let _did_enter_background_observer = create_observer(
+            &center,
+            // `applicationDidEnterBackground:`
+            unsafe { UIApplicationDidEnterBackgroundNotification },
+            move |notification| {
+                let app = unsafe { notification.object() }.expect(
+                    "UIApplicationDidEnterBackgroundNotification to have application object",
+                );
+                // SAFETY: The `object` in `UIApplicationDidEnterBackgroundNotification` is
+                // documented to be `UIApplication`.
+                let app: Retained<UIApplication> = unsafe { Retained::cast(app) };
+                send_occluded_event_for_all_windows(&app, true);
+            },
+        );
+        let _will_terminate_observer = create_observer(
+            &center,
+            // `applicationWillTerminate:`
+            unsafe { UIApplicationWillTerminateNotification },
+            move |notification| {
+                let app = unsafe { notification.object() }
+                    .expect("UIApplicationWillTerminateNotification to have application object");
+                // SAFETY: The `object` in `UIApplicationWillTerminateNotification` is
+                // (somewhat) documented to be `UIApplication`.
+                let app: Retained<UIApplication> = unsafe { Retained::cast(app) };
+                app_state::terminated(&app);
+            },
+        );
+        let _did_receive_memory_warning_observer = create_observer(
+            &center,
+            // `applicationDidReceiveMemoryWarning:`
+            unsafe { UIApplicationDidReceiveMemoryWarningNotification },
+            move |_| {
+                app_state::handle_nonuser_event(
+                    mtm,
+                    EventWrapper::StaticEvent(Event::MemoryWarning),
+                );
+            },
+        );
+
+        Ok(EventLoop {
+            mtm,
+            sender,
+            receiver,
+            window_target: RootActiveEventLoop { p: ActiveEventLoop { mtm }, _marker: PhantomData },
+            _did_finish_launching_observer,
+            _did_become_active_observer,
+            _will_resign_active_observer,
+            _will_enter_foreground_observer,
+            _did_enter_background_observer,
+            _will_terminate_observer,
+            _did_receive_memory_warning_observer,
+        })
+    }
+
+    pub fn run<F>(self, handler: F) -> !
+    where
+        F: FnMut(Event<T>, &RootActiveEventLoop),
+    {
+        let application: Option<Retained<UIApplication>> =
+            unsafe { msg_send_id![UIApplication::class(), sharedApplication] };
+        assert!(
+            application.is_none(),
+            "\
+                `EventLoop` cannot be `run` after a call to `UIApplicationMain` on iOS\nNote: \
+             `EventLoop::run_app` calls `UIApplicationMain` on iOS",
+        );
+
+        let handler = map_user_event(handler, self.receiver);
+
+        let handler = unsafe {
+            std::mem::transmute::<
+                Box<dyn FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop)>,
+                Box<dyn FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop)>,
+            >(Box::new(handler))
+        };
+
+        let handler = EventLoopHandler { handler, event_loop: self.window_target };
+
+        app_state::will_launch(self.mtm, handler);
+
+        extern "C" {
+            // These functions are in crt_externs.h.
+            fn _NSGetArgc() -> *mut c_int;
+            fn _NSGetArgv() -> *mut *mut *mut c_char;
+        }
+
+        unsafe {
+            UIApplicationMain(
+                *_NSGetArgc(),
+                NonNull::new(*_NSGetArgv()).unwrap(),
+                // We intentionally override neither the application nor the delegate, to allow the
+                // user to do so themselves!
+                None,
+                None,
+            )
+        };
+        unreachable!()
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy::new(self.sender.clone())
+    }
+
+    pub fn window_target(&self) -> &RootActiveEventLoop {
+        &self.window_target
+    }
+}
+
+// EventLoopExtIOS
+impl<T: 'static> EventLoop<T> {
+    pub fn idiom(&self) -> Idiom {
+        match UIDevice::currentDevice(self.mtm).userInterfaceIdiom() {
+            UIUserInterfaceIdiom::Unspecified => Idiom::Unspecified,
+            UIUserInterfaceIdiom::Phone => Idiom::Phone,
+            UIUserInterfaceIdiom::Pad => Idiom::Pad,
+            UIUserInterfaceIdiom::TV => Idiom::TV,
+            UIUserInterfaceIdiom::CarPlay => Idiom::CarPlay,
+            _ => Idiom::Unspecified,
+        }
+    }
+}
+
+pub struct EventLoopProxy<T> {
+    sender: Sender<T>,
+    source: CFRunLoopSourceRef,
+}
+
+unsafe impl<T: Send> Send for EventLoopProxy<T> {}
+unsafe impl<T: Send> Sync for EventLoopProxy<T> {}
+
+impl<T> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> EventLoopProxy<T> {
+        EventLoopProxy::new(self.sender.clone())
+    }
+}
+
+impl<T> Drop for EventLoopProxy<T> {
+    fn drop(&mut self) {
+        unsafe {
+            CFRunLoopSourceInvalidate(self.source);
+            CFRelease(self.source as _);
+        }
+    }
+}
+
+impl<T> EventLoopProxy<T> {
+    fn new(sender: Sender<T>) -> EventLoopProxy<T> {
+        unsafe {
+            // just wake up the eventloop
+            extern "C" fn event_loop_proxy_handler(_: *const c_void) {}
+
+            // adding a Source to the main CFRunLoop lets us wake it up and
+            // process user events through the normal OS EventLoop mechanisms.
+            let rl = CFRunLoopGetMain();
+            let mut context = CFRunLoopSourceContext {
+                version: 0,
+                info: ptr::null_mut(),
+                retain: None,
+                release: None,
+                copyDescription: None,
+                equal: None,
+                hash: None,
+                schedule: None,
+                cancel: None,
+                perform: event_loop_proxy_handler,
+            };
+            let source = CFRunLoopSourceCreate(ptr::null_mut(), CFIndex::MAX - 1, &mut context);
+            CFRunLoopAddSource(rl, source, kCFRunLoopCommonModes);
+            CFRunLoopWakeUp(rl);
+
+            EventLoopProxy { sender, source }
+        }
+    }
+
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        self.sender.send(event).map_err(|::std::sync::mpsc::SendError(x)| EventLoopClosed(x))?;
+        unsafe {
+            // let the main thread know there's a new event
+            CFRunLoopSourceSignal(self.source);
+            let rl = CFRunLoopGetMain();
+            CFRunLoopWakeUp(rl);
+        }
+        Ok(())
+    }
+}
+
+fn setup_control_flow_observers() {
+    unsafe {
+        // begin is queued with the highest priority to ensure it is processed before other
+        // observers
+        extern "C" fn control_flow_begin_handler(
+            _: CFRunLoopObserverRef,
+            activity: CFRunLoopActivity,
+            _: *mut c_void,
+        ) {
+            let mtm = MainThreadMarker::new().unwrap();
+            #[allow(non_upper_case_globals)]
+            match activity {
+                kCFRunLoopAfterWaiting => app_state::handle_wakeup_transition(mtm),
+                _ => unreachable!(),
+            }
+        }
+
+        // Core Animation registers its `CFRunLoopObserver` that performs drawing operations in
+        // `CA::Transaction::ensure_implicit` with a priority of `0x1e8480`. We set the main_end
+        // priority to be 0, in order to send AboutToWait before RedrawRequested. This value was
+        // chosen conservatively to guard against apple using different priorities for their redraw
+        // observers in different OS's or on different devices. If it so happens that it's too
+        // conservative, the main symptom would be non-redraw events coming in after `AboutToWait`.
+        //
+        // The value of `0x1e8480` was determined by inspecting stack traces and the associated
+        // registers for every `CFRunLoopAddObserver` call on an iPad Air 2 running iOS 11.4.
+        //
+        // Also tested to be `0x1e8480` on iPhone 8, iOS 13 beta 4.
+        extern "C" fn control_flow_main_end_handler(
+            _: CFRunLoopObserverRef,
+            activity: CFRunLoopActivity,
+            _: *mut c_void,
+        ) {
+            let mtm = MainThreadMarker::new().unwrap();
+            #[allow(non_upper_case_globals)]
+            match activity {
+                kCFRunLoopBeforeWaiting => app_state::handle_main_events_cleared(mtm),
+                kCFRunLoopExit => {}, // may happen when running on macOS
+                _ => unreachable!(),
+            }
+        }
+
+        // end is queued with the lowest priority to ensure it is processed after other observers
+        extern "C" fn control_flow_end_handler(
+            _: CFRunLoopObserverRef,
+            activity: CFRunLoopActivity,
+            _: *mut c_void,
+        ) {
+            let mtm = MainThreadMarker::new().unwrap();
+            #[allow(non_upper_case_globals)]
+            match activity {
+                kCFRunLoopBeforeWaiting => app_state::handle_events_cleared(mtm),
+                kCFRunLoopExit => {}, // may happen when running on macOS
+                _ => unreachable!(),
+            }
+        }
+
+        let main_loop = CFRunLoopGetMain();
+
+        let begin_observer = CFRunLoopObserverCreate(
+            ptr::null_mut(),
+            kCFRunLoopAfterWaiting,
+            1, // repeat = true
+            CFIndex::MIN,
+            control_flow_begin_handler,
+            ptr::null_mut(),
+        );
+        CFRunLoopAddObserver(main_loop, begin_observer, kCFRunLoopDefaultMode);
+
+        let main_end_observer = CFRunLoopObserverCreate(
+            ptr::null_mut(),
+            kCFRunLoopExit | kCFRunLoopBeforeWaiting,
+            1, // repeat = true
+            0, // see comment on `control_flow_main_end_handler`
+            control_flow_main_end_handler,
+            ptr::null_mut(),
+        );
+        CFRunLoopAddObserver(main_loop, main_end_observer, kCFRunLoopDefaultMode);
+
+        let end_observer = CFRunLoopObserverCreate(
+            ptr::null_mut(),
+            kCFRunLoopExit | kCFRunLoopBeforeWaiting,
+            1, // repeat = true
+            CFIndex::MAX,
+            control_flow_end_handler,
+            ptr::null_mut(),
+        );
+        CFRunLoopAddObserver(main_loop, end_observer, kCFRunLoopDefaultMode);
+    }
+}
diff --git a/vendor/winit/src/platform_impl/ios/mod.rs b/vendor/winit/src/platform_impl/ios/mod.rs
new file mode 100644
index 00000000..69e79c92
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/mod.rs
@@ -0,0 +1,52 @@
+#![allow(clippy::let_unit_value)]
+
+mod app_state;
+mod event_loop;
+mod monitor;
+mod notification_center;
+mod view;
+mod view_controller;
+mod window;
+
+use std::fmt;
+
+use crate::event::DeviceId as RootDeviceId;
+
+pub(crate) use self::event_loop::{
+    ActiveEventLoop, EventLoop, EventLoopProxy, OwnedDisplayHandle,
+    PlatformSpecificEventLoopAttributes,
+};
+pub(crate) use self::monitor::{MonitorHandle, VideoModeHandle};
+pub(crate) use self::window::{PlatformSpecificWindowAttributes, Window, WindowId};
+pub(crate) use crate::cursor::{
+    NoCustomCursor as PlatformCustomCursor, NoCustomCursor as PlatformCustomCursorSource,
+};
+pub(crate) use crate::icon::NoIcon as PlatformIcon;
+pub(crate) use crate::platform_impl::Fullscreen;
+
+/// There is no way to detect which device that performed a certain event in
+/// UIKit (i.e. you can't differentiate between different external keyboards,
+/// or whether it was the main touchscreen, assistive technologies, or some
+/// other pointer device that caused a touch event).
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct DeviceId;
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        DeviceId
+    }
+}
+
+pub(crate) const DEVICE_ID: RootDeviceId = RootDeviceId(DeviceId);
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct KeyEventExtra {}
+
+#[derive(Debug)]
+pub enum OsError {}
+
+impl fmt::Display for OsError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "os error")
+    }
+}
diff --git a/vendor/winit/src/platform_impl/ios/monitor.rs b/vendor/winit/src/platform_impl/ios/monitor.rs
new file mode 100644
index 00000000..9f017a24
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/monitor.rs
@@ -0,0 +1,277 @@
+#![allow(clippy::unnecessary_cast)]
+
+use std::collections::{BTreeSet, VecDeque};
+use std::{fmt, hash, ptr};
+
+use objc2::mutability::IsRetainable;
+use objc2::rc::Retained;
+use objc2::Message;
+use objc2_foundation::{run_on_main, MainThreadBound, MainThreadMarker, NSInteger};
+use objc2_ui_kit::{UIScreen, UIScreenMode};
+
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::monitor::VideoModeHandle as RootVideoModeHandle;
+use crate::platform_impl::platform::app_state;
+
+// Workaround for `MainThreadBound` implementing almost no traits
+#[derive(Debug)]
+struct MainThreadBoundDelegateImpls<T>(MainThreadBound<Retained<T>>);
+
+impl<T: IsRetainable + Message> Clone for MainThreadBoundDelegateImpls<T> {
+    fn clone(&self) -> Self {
+        Self(run_on_main(|mtm| MainThreadBound::new(Retained::clone(self.0.get(mtm)), mtm)))
+    }
+}
+
+impl<T: IsRetainable + Message> hash::Hash for MainThreadBoundDelegateImpls<T> {
+    fn hash<H: hash::Hasher>(&self, state: &mut H) {
+        // SAFETY: Marker only used to get the pointer
+        let mtm = unsafe { MainThreadMarker::new_unchecked() };
+        Retained::as_ptr(self.0.get(mtm)).hash(state);
+    }
+}
+
+impl<T: IsRetainable + Message> PartialEq for MainThreadBoundDelegateImpls<T> {
+    fn eq(&self, other: &Self) -> bool {
+        // SAFETY: Marker only used to get the pointer
+        let mtm = unsafe { MainThreadMarker::new_unchecked() };
+        Retained::as_ptr(self.0.get(mtm)) == Retained::as_ptr(other.0.get(mtm))
+    }
+}
+
+impl<T: IsRetainable + Message> Eq for MainThreadBoundDelegateImpls<T> {}
+
+#[derive(Debug, PartialEq, Eq, Hash, Clone)]
+pub struct VideoModeHandle {
+    pub(crate) size: (u32, u32),
+    pub(crate) bit_depth: u16,
+    pub(crate) refresh_rate_millihertz: u32,
+    screen_mode: MainThreadBoundDelegateImpls<UIScreenMode>,
+    pub(crate) monitor: MonitorHandle,
+}
+
+impl VideoModeHandle {
+    fn new(
+        uiscreen: Retained<UIScreen>,
+        screen_mode: Retained<UIScreenMode>,
+        mtm: MainThreadMarker,
+    ) -> VideoModeHandle {
+        let refresh_rate_millihertz = refresh_rate_millihertz(&uiscreen);
+        let size = screen_mode.size();
+        VideoModeHandle {
+            size: (size.width as u32, size.height as u32),
+            bit_depth: 32,
+            refresh_rate_millihertz,
+            screen_mode: MainThreadBoundDelegateImpls(MainThreadBound::new(screen_mode, mtm)),
+            monitor: MonitorHandle::new(uiscreen),
+        }
+    }
+
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.size.into()
+    }
+
+    pub fn bit_depth(&self) -> u16 {
+        self.bit_depth
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.refresh_rate_millihertz
+    }
+
+    pub fn monitor(&self) -> MonitorHandle {
+        self.monitor.clone()
+    }
+
+    pub(super) fn screen_mode(&self, mtm: MainThreadMarker) -> &Retained<UIScreenMode> {
+        self.screen_mode.0.get(mtm)
+    }
+}
+
+pub struct MonitorHandle {
+    ui_screen: MainThreadBound<Retained<UIScreen>>,
+}
+
+impl Clone for MonitorHandle {
+    fn clone(&self) -> Self {
+        run_on_main(|mtm| Self {
+            ui_screen: MainThreadBound::new(self.ui_screen.get(mtm).clone(), mtm),
+        })
+    }
+}
+
+impl hash::Hash for MonitorHandle {
+    fn hash<H: hash::Hasher>(&self, state: &mut H) {
+        // SAFETY: Only getting the pointer.
+        let mtm = unsafe { MainThreadMarker::new_unchecked() };
+        Retained::as_ptr(self.ui_screen.get(mtm)).hash(state);
+    }
+}
+
+impl PartialEq for MonitorHandle {
+    fn eq(&self, other: &Self) -> bool {
+        // SAFETY: Only getting the pointer.
+        let mtm = unsafe { MainThreadMarker::new_unchecked() };
+        ptr::eq(
+            Retained::as_ptr(self.ui_screen.get(mtm)),
+            Retained::as_ptr(other.ui_screen.get(mtm)),
+        )
+    }
+}
+
+impl Eq for MonitorHandle {}
+
+impl PartialOrd for MonitorHandle {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for MonitorHandle {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        // SAFETY: Only getting the pointer.
+        // TODO: Make a better ordering
+        let mtm = unsafe { MainThreadMarker::new_unchecked() };
+        Retained::as_ptr(self.ui_screen.get(mtm)).cmp(&Retained::as_ptr(other.ui_screen.get(mtm)))
+    }
+}
+
+impl fmt::Debug for MonitorHandle {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("MonitorHandle")
+            .field("name", &self.name())
+            .field("size", &self.size())
+            .field("position", &self.position())
+            .field("scale_factor", &self.scale_factor())
+            .field("refresh_rate_millihertz", &self.refresh_rate_millihertz())
+            .finish_non_exhaustive()
+    }
+}
+
+impl MonitorHandle {
+    pub(crate) fn new(ui_screen: Retained<UIScreen>) -> Self {
+        // Holding `Retained<UIScreen>` implies we're on the main thread.
+        let mtm = MainThreadMarker::new().unwrap();
+        Self { ui_screen: MainThreadBound::new(ui_screen, mtm) }
+    }
+
+    pub fn name(&self) -> Option<String> {
+        run_on_main(|mtm| {
+            #[allow(deprecated)]
+            let main = UIScreen::mainScreen(mtm);
+            if *self.ui_screen(mtm) == main {
+                Some("Primary".to_string())
+            } else if Some(self.ui_screen(mtm)) == main.mirroredScreen().as_ref() {
+                Some("Mirrored".to_string())
+            } else {
+                #[allow(deprecated)]
+                UIScreen::screens(mtm)
+                    .iter()
+                    .position(|rhs| rhs == &**self.ui_screen(mtm))
+                    .map(|idx| idx.to_string())
+            }
+        })
+    }
+
+    pub fn size(&self) -> PhysicalSize<u32> {
+        let bounds = self.ui_screen.get_on_main(|ui_screen| ui_screen.nativeBounds());
+        PhysicalSize::new(bounds.size.width as u32, bounds.size.height as u32)
+    }
+
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        let bounds = self.ui_screen.get_on_main(|ui_screen| ui_screen.nativeBounds());
+        (bounds.origin.x as f64, bounds.origin.y as f64).into()
+    }
+
+    pub fn scale_factor(&self) -> f64 {
+        self.ui_screen.get_on_main(|ui_screen| ui_screen.nativeScale()) as f64
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        Some(self.ui_screen.get_on_main(|ui_screen| refresh_rate_millihertz(ui_screen)))
+    }
+
+    pub fn video_modes(&self) -> impl Iterator<Item = VideoModeHandle> {
+        run_on_main(|mtm| {
+            let ui_screen = self.ui_screen(mtm);
+            // Use Ord impl of RootVideoModeHandle
+
+            let modes: BTreeSet<_> = ui_screen
+                .availableModes()
+                .into_iter()
+                .map(|mode| RootVideoModeHandle {
+                    video_mode: VideoModeHandle::new(ui_screen.clone(), mode, mtm),
+                })
+                .collect();
+
+            modes.into_iter().map(|mode| mode.video_mode)
+        })
+    }
+
+    pub(crate) fn ui_screen(&self, mtm: MainThreadMarker) -> &Retained<UIScreen> {
+        self.ui_screen.get(mtm)
+    }
+
+    pub fn preferred_video_mode(&self) -> VideoModeHandle {
+        run_on_main(|mtm| {
+            VideoModeHandle::new(
+                self.ui_screen(mtm).clone(),
+                self.ui_screen(mtm).preferredMode().unwrap(),
+                mtm,
+            )
+        })
+    }
+}
+
+fn refresh_rate_millihertz(uiscreen: &UIScreen) -> u32 {
+    let refresh_rate_millihertz: NSInteger = {
+        let os_capabilities = app_state::os_capabilities();
+        if os_capabilities.maximum_frames_per_second {
+            uiscreen.maximumFramesPerSecond()
+        } else {
+            // https://developer.apple.com/library/archive/technotes/tn2460/_index.html
+            // https://en.wikipedia.org/wiki/IPad_Pro#Model_comparison
+            //
+            // All iOS devices support 60 fps, and on devices where `maximumFramesPerSecond` is not
+            // supported, they are all guaranteed to have 60hz refresh rates. This does not
+            // correctly handle external displays. ProMotion displays support 120fps, but they were
+            // introduced at the same time as the `maximumFramesPerSecond` API.
+            //
+            // FIXME: earlier OSs could calculate the refresh rate using
+            // `-[CADisplayLink duration]`.
+            os_capabilities.maximum_frames_per_second_err_msg("defaulting to 60 fps");
+            60
+        }
+    };
+
+    refresh_rate_millihertz as u32 * 1000
+}
+
+pub fn uiscreens(mtm: MainThreadMarker) -> VecDeque<MonitorHandle> {
+    #[allow(deprecated)]
+    UIScreen::screens(mtm).into_iter().map(MonitorHandle::new).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use objc2_foundation::NSSet;
+
+    use super::*;
+
+    // Test that UIScreen pointer comparisons are correct.
+    #[test]
+    #[allow(deprecated)]
+    fn screen_comparisons() {
+        // Test code, doesn't matter that it's not thread safe
+        let mtm = unsafe { MainThreadMarker::new_unchecked() };
+
+        assert!(ptr::eq(&*UIScreen::mainScreen(mtm), &*UIScreen::mainScreen(mtm)));
+
+        let main = UIScreen::mainScreen(mtm);
+        assert!(UIScreen::screens(mtm).iter().any(|screen| ptr::eq(screen, &*main)));
+
+        assert!(unsafe {
+            NSSet::setWithArray(&UIScreen::screens(mtm)).containsObject(&UIScreen::mainScreen(mtm))
+        });
+    }
+}
diff --git a/vendor/winit/src/platform_impl/ios/notification_center.rs b/vendor/winit/src/platform_impl/ios/notification_center.rs
new file mode 100644
index 00000000..652bf1d0
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/notification_center.rs
@@ -0,0 +1,27 @@
+use std::ptr::NonNull;
+
+use block2::RcBlock;
+use objc2::rc::Retained;
+use objc2_foundation::{NSNotification, NSNotificationCenter, NSNotificationName, NSObject};
+
+/// Observe the given notification.
+///
+/// This is used in Winit as an alternative to declaring an application delegate, as we want to
+/// give the user full control over those.
+pub fn create_observer(
+    center: &NSNotificationCenter,
+    name: &NSNotificationName,
+    handler: impl Fn(&NSNotification) + 'static,
+) -> Retained<NSObject> {
+    let block = RcBlock::new(move |notification: NonNull<NSNotification>| {
+        handler(unsafe { notification.as_ref() });
+    });
+    unsafe {
+        center.addObserverForName_object_queue_usingBlock(
+            Some(name),
+            None, // No sender filter
+            None, // No queue, run on posting thread (i.e. main thread)
+            &block,
+        )
+    }
+}
diff --git a/vendor/winit/src/platform_impl/ios/view.rs b/vendor/winit/src/platform_impl/ios/view.rs
new file mode 100644
index 00000000..418968c7
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/view.rs
@@ -0,0 +1,607 @@
+#![allow(clippy::unnecessary_cast)]
+use std::cell::{Cell, RefCell};
+
+use objc2::rc::Retained;
+use objc2::runtime::{NSObjectProtocol, ProtocolObject};
+use objc2::{declare_class, msg_send, msg_send_id, mutability, sel, ClassType, DeclaredClass};
+use objc2_foundation::{CGFloat, CGPoint, CGRect, MainThreadMarker, NSObject, NSSet, NSString};
+use objc2_ui_kit::{
+    UICoordinateSpace, UIEvent, UIForceTouchCapability, UIGestureRecognizer,
+    UIGestureRecognizerDelegate, UIGestureRecognizerState, UIKeyInput, UIPanGestureRecognizer,
+    UIPinchGestureRecognizer, UIResponder, UIRotationGestureRecognizer, UITapGestureRecognizer,
+    UITextInputTraits, UITouch, UITouchPhase, UITouchType, UITraitEnvironment, UIView,
+};
+
+use super::app_state::{self, EventWrapper};
+use super::window::WinitUIWindow;
+use crate::dpi::PhysicalPosition;
+use crate::event::{ElementState, Event, Force, KeyEvent, Touch, TouchPhase, WindowEvent};
+use crate::keyboard::{Key, KeyCode, KeyLocation, NamedKey, NativeKeyCode, PhysicalKey};
+use crate::platform_impl::platform::DEVICE_ID;
+use crate::platform_impl::KeyEventExtra;
+use crate::window::{WindowAttributes, WindowId as RootWindowId};
+
+pub struct WinitViewState {
+    pinch_gesture_recognizer: RefCell<Option<Retained<UIPinchGestureRecognizer>>>,
+    doubletap_gesture_recognizer: RefCell<Option<Retained<UITapGestureRecognizer>>>,
+    rotation_gesture_recognizer: RefCell<Option<Retained<UIRotationGestureRecognizer>>>,
+    pan_gesture_recognizer: RefCell<Option<Retained<UIPanGestureRecognizer>>>,
+
+    // for iOS delta references the start of the Gesture
+    rotation_last_delta: Cell<CGFloat>,
+    pinch_last_delta: Cell<CGFloat>,
+    pan_last_delta: Cell<CGPoint>,
+}
+
+declare_class!(
+    pub(crate) struct WinitView;
+
+    unsafe impl ClassType for WinitView {
+        #[inherits(UIResponder, NSObject)]
+        type Super = UIView;
+        type Mutability = mutability::MainThreadOnly;
+        const NAME: &'static str = "WinitUIView";
+    }
+
+    impl DeclaredClass for WinitView {
+        type Ivars = WinitViewState;
+    }
+
+    unsafe impl WinitView {
+        #[method(drawRect:)]
+        fn draw_rect(&self, rect: CGRect) {
+            let mtm = MainThreadMarker::new().unwrap();
+            let window = self.window().unwrap();
+            app_state::handle_nonuser_event(
+                mtm,
+                EventWrapper::StaticEvent(Event::WindowEvent {
+                    window_id: RootWindowId(window.id()),
+                    event: WindowEvent::RedrawRequested,
+                }),
+            );
+            let _: () = unsafe { msg_send![super(self), drawRect: rect] };
+        }
+
+        #[method(layoutSubviews)]
+        fn layout_subviews(&self) {
+            let mtm = MainThreadMarker::new().unwrap();
+            let _: () = unsafe { msg_send![super(self), layoutSubviews] };
+
+            let window = self.window().unwrap();
+            let window_bounds = window.bounds();
+            let screen = window.screen();
+            let screen_space = screen.coordinateSpace();
+            let screen_frame = self.convertRect_toCoordinateSpace(window_bounds, &screen_space);
+            let scale_factor = screen.scale();
+            let size = crate::dpi::LogicalSize {
+                width: screen_frame.size.width as f64,
+                height: screen_frame.size.height as f64,
+            }
+            .to_physical(scale_factor as f64);
+
+            // If the app is started in landscape, the view frame and window bounds can be mismatched.
+            // The view frame will be in portrait and the window bounds in landscape. So apply the
+            // window bounds to the view frame to make it consistent.
+            let view_frame = self.frame();
+            if view_frame != window_bounds {
+                self.setFrame(window_bounds);
+            }
+
+            app_state::handle_nonuser_event(
+                mtm,
+                EventWrapper::StaticEvent(Event::WindowEvent {
+                    window_id: RootWindowId(window.id()),
+                    event: WindowEvent::Resized(size),
+                }),
+            );
+        }
+
+        #[method(setContentScaleFactor:)]
+        fn set_content_scale_factor(&self, untrusted_scale_factor: CGFloat) {
+            let mtm = MainThreadMarker::new().unwrap();
+            let _: () =
+                unsafe { msg_send![super(self), setContentScaleFactor: untrusted_scale_factor] };
+
+            // `window` is null when `setContentScaleFactor` is invoked prior to `[UIWindow
+            // makeKeyAndVisible]` at window creation time (either manually or internally by
+            // UIKit when the `UIView` is first created), in which case we send no events here
+            let window = match self.window() {
+                Some(window) => window,
+                None => return,
+            };
+            // `setContentScaleFactor` may be called with a value of 0, which means "reset the
+            // content scale factor to a device-specific default value", so we can't use the
+            // parameter here. We can query the actual factor using the getter
+            let scale_factor = self.contentScaleFactor();
+            assert!(
+                !scale_factor.is_nan()
+                    && scale_factor.is_finite()
+                    && scale_factor.is_sign_positive()
+                    && scale_factor > 0.0,
+                "invalid scale_factor set on UIView",
+            );
+            let scale_factor = scale_factor as f64;
+            let bounds = self.bounds();
+            let screen = window.screen();
+            let screen_space = screen.coordinateSpace();
+            let screen_frame = self.convertRect_toCoordinateSpace(bounds, &screen_space);
+            let size = crate::dpi::LogicalSize {
+                width: screen_frame.size.width as f64,
+                height: screen_frame.size.height as f64,
+            };
+            let window_id = RootWindowId(window.id());
+            app_state::handle_nonuser_events(
+                mtm,
+                std::iter::once(EventWrapper::ScaleFactorChanged(
+                    app_state::ScaleFactorChanged {
+                        window,
+                        scale_factor,
+                        suggested_size: size.to_physical(scale_factor),
+                    },
+                ))
+                .chain(std::iter::once(EventWrapper::StaticEvent(
+                    Event::WindowEvent {
+                        window_id,
+                        event: WindowEvent::Resized(size.to_physical(scale_factor)),
+                    },
+                ))),
+            );
+        }
+
+        #[method(touchesBegan:withEvent:)]
+        fn touches_began(&self, touches: &NSSet<UITouch>, _event: Option<&UIEvent>) {
+            self.handle_touches(touches)
+        }
+
+        #[method(touchesMoved:withEvent:)]
+        fn touches_moved(&self, touches: &NSSet<UITouch>, _event: Option<&UIEvent>) {
+            self.handle_touches(touches)
+        }
+
+        #[method(touchesEnded:withEvent:)]
+        fn touches_ended(&self, touches: &NSSet<UITouch>, _event: Option<&UIEvent>) {
+            self.handle_touches(touches)
+        }
+
+        #[method(touchesCancelled:withEvent:)]
+        fn touches_cancelled(&self, touches: &NSSet<UITouch>, _event: Option<&UIEvent>) {
+            self.handle_touches(touches)
+        }
+
+        #[method(pinchGesture:)]
+        fn pinch_gesture(&self, recognizer: &UIPinchGestureRecognizer) {
+            let window = self.window().unwrap();
+
+            let (phase, delta) = match recognizer.state() {
+                UIGestureRecognizerState::Began => {
+                    self.ivars().pinch_last_delta.set(recognizer.scale());
+                    (TouchPhase::Started, 0.0)
+                }
+                UIGestureRecognizerState::Changed => {
+                    let last_scale: f64 = self.ivars().pinch_last_delta.replace(recognizer.scale());
+                    (TouchPhase::Moved, recognizer.scale() - last_scale)
+                }
+                UIGestureRecognizerState::Ended => {
+                    let last_scale: f64 = self.ivars().pinch_last_delta.replace(0.0);
+                    (TouchPhase::Moved, recognizer.scale() - last_scale)
+                }
+                UIGestureRecognizerState::Cancelled | UIGestureRecognizerState::Failed => {
+                    self.ivars().rotation_last_delta.set(0.0);
+                    // Pass -delta so that action is reversed
+                    (TouchPhase::Cancelled, -recognizer.scale())
+                }
+                state => panic!("unexpected recognizer state: {state:?}"),
+            };
+
+            let gesture_event = EventWrapper::StaticEvent(Event::WindowEvent {
+                window_id: RootWindowId(window.id()),
+                event: WindowEvent::PinchGesture {
+                    device_id: DEVICE_ID,
+                    delta: delta as f64,
+                    phase,
+                },
+            });
+
+            let mtm = MainThreadMarker::new().unwrap();
+            app_state::handle_nonuser_event(mtm, gesture_event);
+        }
+
+        #[method(doubleTapGesture:)]
+        fn double_tap_gesture(&self, recognizer: &UITapGestureRecognizer) {
+            let window = self.window().unwrap();
+
+            if recognizer.state() == UIGestureRecognizerState::Ended {
+                let gesture_event = EventWrapper::StaticEvent(Event::WindowEvent {
+                    window_id: RootWindowId(window.id()),
+                    event: WindowEvent::DoubleTapGesture {
+                        device_id: DEVICE_ID,
+                    },
+                });
+
+                let mtm = MainThreadMarker::new().unwrap();
+                app_state::handle_nonuser_event(mtm, gesture_event);
+            }
+        }
+
+        #[method(rotationGesture:)]
+        fn rotation_gesture(&self, recognizer: &UIRotationGestureRecognizer) {
+            let window = self.window().unwrap();
+
+            let (phase, delta) = match recognizer.state() {
+                UIGestureRecognizerState::Began => {
+                    self.ivars().rotation_last_delta.set(0.0);
+
+                    (TouchPhase::Started, 0.0)
+                }
+                UIGestureRecognizerState::Changed => {
+                    let last_rotation = self.ivars().rotation_last_delta.replace(recognizer.rotation());
+
+                    (TouchPhase::Moved, recognizer.rotation() - last_rotation)
+                }
+                UIGestureRecognizerState::Ended => {
+                    let last_rotation = self.ivars().rotation_last_delta.replace(0.0);
+
+                    (TouchPhase::Ended, recognizer.rotation() - last_rotation)
+                }
+                UIGestureRecognizerState::Cancelled | UIGestureRecognizerState::Failed => {
+                    self.ivars().rotation_last_delta.set(0.0);
+
+                    // Pass -delta so that action is reversed
+                    (TouchPhase::Cancelled, -recognizer.rotation())
+                }
+                state => panic!("unexpected recognizer state: {state:?}"),
+            };
+
+            // Make delta negative to match macos, convert to degrees
+            let gesture_event = EventWrapper::StaticEvent(Event::WindowEvent {
+                window_id: RootWindowId(window.id()),
+                event: WindowEvent::RotationGesture {
+                    device_id: DEVICE_ID,
+                    delta: -delta.to_degrees() as _,
+                    phase,
+                },
+            });
+
+            let mtm = MainThreadMarker::new().unwrap();
+            app_state::handle_nonuser_event(mtm, gesture_event);
+        }
+
+        #[method(panGesture:)]
+        fn pan_gesture(&self, recognizer: &UIPanGestureRecognizer) {
+            let window = self.window().unwrap();
+
+            let translation = recognizer.translationInView(Some(self));
+
+            let (phase, dx, dy) = match recognizer.state() {
+                UIGestureRecognizerState::Began => {
+                    self.ivars().pan_last_delta.set(translation);
+
+                    (TouchPhase::Started, 0.0, 0.0)
+                }
+                UIGestureRecognizerState::Changed => {
+                    let last_pan: CGPoint = self.ivars().pan_last_delta.replace(translation);
+
+                    let dx = translation.x - last_pan.x;
+                    let dy = translation.y - last_pan.y;
+
+                    (TouchPhase::Moved, dx, dy)
+                }
+                UIGestureRecognizerState::Ended => {
+                    let last_pan: CGPoint = self.ivars().pan_last_delta.replace(CGPoint{x:0.0, y:0.0});
+
+                    let dx = translation.x - last_pan.x;
+                    let dy = translation.y - last_pan.y;
+
+                    (TouchPhase::Ended, dx, dy)
+                }
+                UIGestureRecognizerState::Cancelled | UIGestureRecognizerState::Failed => {
+                    let last_pan: CGPoint = self.ivars().pan_last_delta.replace(CGPoint{x:0.0, y:0.0});
+
+                    // Pass -delta so that action is reversed
+                    (TouchPhase::Cancelled, -last_pan.x, -last_pan.y)
+                }
+                state => panic!("unexpected recognizer state: {state:?}"),
+            };
+
+
+            let gesture_event = EventWrapper::StaticEvent(Event::WindowEvent {
+                window_id: RootWindowId(window.id()),
+                event: WindowEvent::PanGesture {
+                    device_id: DEVICE_ID,
+                    delta: PhysicalPosition::new(dx as _, dy as _),
+                    phase,
+                },
+            });
+
+            let mtm = MainThreadMarker::new().unwrap();
+            app_state::handle_nonuser_event(mtm, gesture_event);
+        }
+
+        #[method(canBecomeFirstResponder)]
+        fn can_become_first_responder(&self) -> bool {
+            true
+        }
+    }
+
+    unsafe impl NSObjectProtocol for WinitView {}
+
+    unsafe impl UIGestureRecognizerDelegate for WinitView {
+        #[method(gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:)]
+        fn should_recognize_simultaneously(&self, _gesture_recognizer: &UIGestureRecognizer, _other_gesture_recognizer: &UIGestureRecognizer) -> bool {
+            true
+        }
+    }
+
+    unsafe impl UITextInputTraits for WinitView {
+    }
+
+    unsafe impl UIKeyInput for WinitView {
+        #[method(hasText)]
+        fn has_text(&self) -> bool {
+            true
+        }
+
+        #[method(insertText:)]
+        fn insert_text(&self, text: &NSString) {
+            self.handle_insert_text(text)
+        }
+
+        #[method(deleteBackward)]
+        fn delete_backward(&self) {
+            self.handle_delete_backward()
+        }
+    }
+);
+
+impl WinitView {
+    pub(crate) fn new(
+        mtm: MainThreadMarker,
+        window_attributes: &WindowAttributes,
+        frame: CGRect,
+    ) -> Retained<Self> {
+        let this = mtm.alloc().set_ivars(WinitViewState {
+            pinch_gesture_recognizer: RefCell::new(None),
+            doubletap_gesture_recognizer: RefCell::new(None),
+            rotation_gesture_recognizer: RefCell::new(None),
+            pan_gesture_recognizer: RefCell::new(None),
+
+            rotation_last_delta: Cell::new(0.0),
+            pinch_last_delta: Cell::new(0.0),
+            pan_last_delta: Cell::new(CGPoint { x: 0.0, y: 0.0 }),
+        });
+        let this: Retained<Self> = unsafe { msg_send_id![super(this), initWithFrame: frame] };
+
+        this.setMultipleTouchEnabled(true);
+
+        if let Some(scale_factor) = window_attributes.platform_specific.scale_factor {
+            this.setContentScaleFactor(scale_factor as _);
+        }
+
+        this
+    }
+
+    fn window(&self) -> Option<Retained<WinitUIWindow>> {
+        // SAFETY: `WinitView`s are always installed in a `WinitUIWindow`
+        (**self).window().map(|window| unsafe { Retained::cast(window) })
+    }
+
+    pub(crate) fn recognize_pinch_gesture(&self, should_recognize: bool) {
+        let mtm = MainThreadMarker::from(self);
+        if should_recognize {
+            if self.ivars().pinch_gesture_recognizer.borrow().is_none() {
+                let pinch = unsafe {
+                    UIPinchGestureRecognizer::initWithTarget_action(
+                        mtm.alloc(),
+                        Some(self),
+                        Some(sel!(pinchGesture:)),
+                    )
+                };
+                pinch.setDelegate(Some(ProtocolObject::from_ref(self)));
+                self.addGestureRecognizer(&pinch);
+                self.ivars().pinch_gesture_recognizer.replace(Some(pinch));
+            }
+        } else if let Some(recognizer) = self.ivars().pinch_gesture_recognizer.take() {
+            self.removeGestureRecognizer(&recognizer);
+        }
+    }
+
+    pub(crate) fn recognize_pan_gesture(
+        &self,
+        should_recognize: bool,
+        minimum_number_of_touches: u8,
+        maximum_number_of_touches: u8,
+    ) {
+        let mtm = MainThreadMarker::from(self);
+        if should_recognize {
+            if self.ivars().pan_gesture_recognizer.borrow().is_none() {
+                let pan = unsafe {
+                    UIPanGestureRecognizer::initWithTarget_action(
+                        mtm.alloc(),
+                        Some(self),
+                        Some(sel!(panGesture:)),
+                    )
+                };
+                pan.setDelegate(Some(ProtocolObject::from_ref(self)));
+                pan.setMinimumNumberOfTouches(minimum_number_of_touches as _);
+                pan.setMaximumNumberOfTouches(maximum_number_of_touches as _);
+                self.addGestureRecognizer(&pan);
+                self.ivars().pan_gesture_recognizer.replace(Some(pan));
+            }
+        } else if let Some(recognizer) = self.ivars().pan_gesture_recognizer.take() {
+            self.removeGestureRecognizer(&recognizer);
+        }
+    }
+
+    pub(crate) fn recognize_doubletap_gesture(&self, should_recognize: bool) {
+        let mtm = MainThreadMarker::from(self);
+        if should_recognize {
+            if self.ivars().doubletap_gesture_recognizer.borrow().is_none() {
+                let tap = unsafe {
+                    UITapGestureRecognizer::initWithTarget_action(
+                        mtm.alloc(),
+                        Some(self),
+                        Some(sel!(doubleTapGesture:)),
+                    )
+                };
+                tap.setDelegate(Some(ProtocolObject::from_ref(self)));
+                tap.setNumberOfTapsRequired(2);
+                tap.setNumberOfTouchesRequired(1);
+                self.addGestureRecognizer(&tap);
+                self.ivars().doubletap_gesture_recognizer.replace(Some(tap));
+            }
+        } else if let Some(recognizer) = self.ivars().doubletap_gesture_recognizer.take() {
+            self.removeGestureRecognizer(&recognizer);
+        }
+    }
+
+    pub(crate) fn recognize_rotation_gesture(&self, should_recognize: bool) {
+        let mtm = MainThreadMarker::from(self);
+        if should_recognize {
+            if self.ivars().rotation_gesture_recognizer.borrow().is_none() {
+                let rotation = unsafe {
+                    UIRotationGestureRecognizer::initWithTarget_action(
+                        mtm.alloc(),
+                        Some(self),
+                        Some(sel!(rotationGesture:)),
+                    )
+                };
+                rotation.setDelegate(Some(ProtocolObject::from_ref(self)));
+                self.addGestureRecognizer(&rotation);
+                self.ivars().rotation_gesture_recognizer.replace(Some(rotation));
+            }
+        } else if let Some(recognizer) = self.ivars().rotation_gesture_recognizer.take() {
+            self.removeGestureRecognizer(&recognizer);
+        }
+    }
+
+    fn handle_touches(&self, touches: &NSSet<UITouch>) {
+        let window = self.window().unwrap();
+        let mut touch_events = Vec::new();
+        let os_supports_force = app_state::os_capabilities().force_touch;
+        for touch in touches {
+            let logical_location = touch.locationInView(None);
+            let touch_type = touch.r#type();
+            let force = if os_supports_force {
+                let trait_collection = self.traitCollection();
+                let touch_capability = trait_collection.forceTouchCapability();
+                // Both the OS _and_ the device need to be checked for force touch support.
+                if touch_capability == UIForceTouchCapability::Available
+                    || touch_type == UITouchType::Pencil
+                {
+                    let force = touch.force();
+                    let max_possible_force = touch.maximumPossibleForce();
+                    let altitude_angle: Option<f64> = if touch_type == UITouchType::Pencil {
+                        let angle = touch.altitudeAngle();
+                        Some(angle as _)
+                    } else {
+                        None
+                    };
+                    Some(Force::Calibrated {
+                        force: force as _,
+                        max_possible_force: max_possible_force as _,
+                        altitude_angle,
+                    })
+                } else {
+                    None
+                }
+            } else {
+                None
+            };
+            let touch_id = touch as *const UITouch as u64;
+            let phase = touch.phase();
+            let phase = match phase {
+                UITouchPhase::Began => TouchPhase::Started,
+                UITouchPhase::Moved => TouchPhase::Moved,
+                // 2 is UITouchPhase::Stationary and is not expected here
+                UITouchPhase::Ended => TouchPhase::Ended,
+                UITouchPhase::Cancelled => TouchPhase::Cancelled,
+                _ => panic!("unexpected touch phase: {phase:?}"),
+            };
+
+            let physical_location = {
+                let scale_factor = self.contentScaleFactor();
+                PhysicalPosition::from_logical::<(f64, f64), f64>(
+                    (logical_location.x as _, logical_location.y as _),
+                    scale_factor as f64,
+                )
+            };
+            touch_events.push(EventWrapper::StaticEvent(Event::WindowEvent {
+                window_id: RootWindowId(window.id()),
+                event: WindowEvent::Touch(Touch {
+                    device_id: DEVICE_ID,
+                    id: touch_id,
+                    location: physical_location,
+                    force,
+                    phase,
+                }),
+            }));
+        }
+        let mtm = MainThreadMarker::new().unwrap();
+        app_state::handle_nonuser_events(mtm, touch_events);
+    }
+
+    fn handle_insert_text(&self, text: &NSString) {
+        let window = self.window().unwrap();
+        let window_id = RootWindowId(window.id());
+        let mtm = MainThreadMarker::new().unwrap();
+        // send individual events for each character
+        app_state::handle_nonuser_events(
+            mtm,
+            text.to_string().chars().flat_map(|c| {
+                let text = smol_str::SmolStr::from_iter([c]);
+                // Emit both press and release events
+                [ElementState::Pressed, ElementState::Released].map(|state| {
+                    EventWrapper::StaticEvent(Event::WindowEvent {
+                        window_id,
+                        event: WindowEvent::KeyboardInput {
+                            event: KeyEvent {
+                                text: if state == ElementState::Pressed {
+                                    Some(text.clone())
+                                } else {
+                                    None
+                                },
+                                state,
+                                location: KeyLocation::Standard,
+                                repeat: false,
+                                logical_key: Key::Character(text.clone()),
+                                physical_key: PhysicalKey::Unidentified(
+                                    NativeKeyCode::Unidentified,
+                                ),
+                                platform_specific: KeyEventExtra {},
+                            },
+                            is_synthetic: false,
+                            device_id: DEVICE_ID,
+                        },
+                    })
+                })
+            }),
+        );
+    }
+
+    fn handle_delete_backward(&self) {
+        let window = self.window().unwrap();
+        let window_id = RootWindowId(window.id());
+        let mtm = MainThreadMarker::new().unwrap();
+        app_state::handle_nonuser_events(
+            mtm,
+            [ElementState::Pressed, ElementState::Released].map(|state| {
+                EventWrapper::StaticEvent(Event::WindowEvent {
+                    window_id,
+                    event: WindowEvent::KeyboardInput {
+                        device_id: DEVICE_ID,
+                        event: KeyEvent {
+                            state,
+                            logical_key: Key::Named(NamedKey::Backspace),
+                            physical_key: PhysicalKey::Code(KeyCode::Backspace),
+                            platform_specific: KeyEventExtra {},
+                            repeat: false,
+                            location: KeyLocation::Standard,
+                            text: None,
+                        },
+                        is_synthetic: false,
+                    },
+                })
+            }),
+        );
+    }
+}
diff --git a/vendor/winit/src/platform_impl/ios/view_controller.rs b/vendor/winit/src/platform_impl/ios/view_controller.rs
new file mode 100644
index 00000000..dd658682
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/view_controller.rs
@@ -0,0 +1,176 @@
+use std::cell::Cell;
+
+use objc2::rc::Retained;
+use objc2::{declare_class, msg_send_id, mutability, ClassType, DeclaredClass};
+use objc2_foundation::{MainThreadMarker, NSObject};
+use objc2_ui_kit::{
+    UIDevice, UIInterfaceOrientationMask, UIRectEdge, UIResponder, UIStatusBarStyle,
+    UIUserInterfaceIdiom, UIView, UIViewController,
+};
+
+use super::app_state::{self};
+use crate::platform::ios::{ScreenEdge, StatusBarStyle, ValidOrientations};
+use crate::window::WindowAttributes;
+
+pub struct ViewControllerState {
+    prefers_status_bar_hidden: Cell<bool>,
+    preferred_status_bar_style: Cell<UIStatusBarStyle>,
+    prefers_home_indicator_auto_hidden: Cell<bool>,
+    supported_orientations: Cell<UIInterfaceOrientationMask>,
+    preferred_screen_edges_deferring_system_gestures: Cell<UIRectEdge>,
+}
+
+declare_class!(
+    pub(crate) struct WinitViewController;
+
+    unsafe impl ClassType for WinitViewController {
+        #[inherits(UIResponder, NSObject)]
+        type Super = UIViewController;
+        type Mutability = mutability::MainThreadOnly;
+        const NAME: &'static str = "WinitUIViewController";
+    }
+
+    impl DeclaredClass for WinitViewController {
+        type Ivars = ViewControllerState;
+    }
+
+    unsafe impl WinitViewController {
+        #[method(shouldAutorotate)]
+        fn should_autorotate(&self) -> bool {
+            true
+        }
+
+        #[method(prefersStatusBarHidden)]
+        fn prefers_status_bar_hidden(&self) -> bool {
+            self.ivars().prefers_status_bar_hidden.get()
+        }
+
+        #[method(preferredStatusBarStyle)]
+        fn preferred_status_bar_style(&self) -> UIStatusBarStyle {
+            self.ivars().preferred_status_bar_style.get()
+        }
+
+        #[method(prefersHomeIndicatorAutoHidden)]
+        fn prefers_home_indicator_auto_hidden(&self) -> bool {
+            self.ivars().prefers_home_indicator_auto_hidden.get()
+        }
+
+        #[method(supportedInterfaceOrientations)]
+        fn supported_orientations(&self) -> UIInterfaceOrientationMask {
+            self.ivars().supported_orientations.get()
+        }
+
+        #[method(preferredScreenEdgesDeferringSystemGestures)]
+        fn preferred_screen_edges_deferring_system_gestures(&self) -> UIRectEdge {
+            self.ivars()
+                .preferred_screen_edges_deferring_system_gestures
+                .get()
+        }
+    }
+);
+
+impl WinitViewController {
+    pub(crate) fn set_prefers_status_bar_hidden(&self, val: bool) {
+        self.ivars().prefers_status_bar_hidden.set(val);
+        self.setNeedsStatusBarAppearanceUpdate();
+    }
+
+    pub(crate) fn set_preferred_status_bar_style(&self, val: StatusBarStyle) {
+        let val = match val {
+            StatusBarStyle::Default => UIStatusBarStyle::Default,
+            StatusBarStyle::LightContent => UIStatusBarStyle::LightContent,
+            StatusBarStyle::DarkContent => UIStatusBarStyle::DarkContent,
+        };
+        self.ivars().preferred_status_bar_style.set(val);
+        self.setNeedsStatusBarAppearanceUpdate();
+    }
+
+    pub(crate) fn set_prefers_home_indicator_auto_hidden(&self, val: bool) {
+        self.ivars().prefers_home_indicator_auto_hidden.set(val);
+        let os_capabilities = app_state::os_capabilities();
+        if os_capabilities.home_indicator_hidden {
+            self.setNeedsUpdateOfHomeIndicatorAutoHidden();
+        } else {
+            os_capabilities.home_indicator_hidden_err_msg("ignoring")
+        }
+    }
+
+    pub(crate) fn set_preferred_screen_edges_deferring_system_gestures(&self, val: ScreenEdge) {
+        let val = {
+            assert_eq!(val.bits() & !ScreenEdge::ALL.bits(), 0, "invalid `ScreenEdge`");
+            UIRectEdge(val.bits().into())
+        };
+        self.ivars().preferred_screen_edges_deferring_system_gestures.set(val);
+        let os_capabilities = app_state::os_capabilities();
+        if os_capabilities.defer_system_gestures {
+            self.setNeedsUpdateOfScreenEdgesDeferringSystemGestures();
+        } else {
+            os_capabilities.defer_system_gestures_err_msg("ignoring")
+        }
+    }
+
+    pub(crate) fn set_supported_interface_orientations(
+        &self,
+        mtm: MainThreadMarker,
+        valid_orientations: ValidOrientations,
+    ) {
+        let mask = match (valid_orientations, UIDevice::currentDevice(mtm).userInterfaceIdiom()) {
+            (ValidOrientations::LandscapeAndPortrait, UIUserInterfaceIdiom::Phone) => {
+                UIInterfaceOrientationMask::AllButUpsideDown
+            },
+            (ValidOrientations::LandscapeAndPortrait, _) => UIInterfaceOrientationMask::All,
+            (ValidOrientations::Landscape, _) => UIInterfaceOrientationMask::Landscape,
+            (ValidOrientations::Portrait, UIUserInterfaceIdiom::Phone) => {
+                UIInterfaceOrientationMask::Portrait
+            },
+            (ValidOrientations::Portrait, _) => {
+                UIInterfaceOrientationMask::Portrait
+                    | UIInterfaceOrientationMask::PortraitUpsideDown
+            },
+        };
+        self.ivars().supported_orientations.set(mask);
+        #[allow(deprecated)]
+        UIViewController::attemptRotationToDeviceOrientation(mtm);
+    }
+
+    pub(crate) fn new(
+        mtm: MainThreadMarker,
+        window_attributes: &WindowAttributes,
+        view: &UIView,
+    ) -> Retained<Self> {
+        // These are set properly below, we just to set them to something in the meantime.
+        let this = mtm.alloc().set_ivars(ViewControllerState {
+            prefers_status_bar_hidden: Cell::new(false),
+            preferred_status_bar_style: Cell::new(UIStatusBarStyle::Default),
+            prefers_home_indicator_auto_hidden: Cell::new(false),
+            supported_orientations: Cell::new(UIInterfaceOrientationMask::All),
+            preferred_screen_edges_deferring_system_gestures: Cell::new(UIRectEdge::empty()),
+        });
+        let this: Retained<Self> = unsafe { msg_send_id![super(this), init] };
+
+        this.set_prefers_status_bar_hidden(
+            window_attributes.platform_specific.prefers_status_bar_hidden,
+        );
+
+        this.set_preferred_status_bar_style(
+            window_attributes.platform_specific.preferred_status_bar_style,
+        );
+
+        this.set_supported_interface_orientations(
+            mtm,
+            window_attributes.platform_specific.valid_orientations,
+        );
+
+        this.set_prefers_home_indicator_auto_hidden(
+            window_attributes.platform_specific.prefers_home_indicator_hidden,
+        );
+
+        this.set_preferred_screen_edges_deferring_system_gestures(
+            window_attributes.platform_specific.preferred_screen_edges_deferring_system_gestures,
+        );
+
+        this.setView(Some(view));
+
+        this
+    }
+}
diff --git a/vendor/winit/src/platform_impl/ios/window.rs b/vendor/winit/src/platform_impl/ios/window.rs
new file mode 100644
index 00000000..be027595
--- /dev/null
+++ b/vendor/winit/src/platform_impl/ios/window.rs
@@ -0,0 +1,750 @@
+#![allow(clippy::unnecessary_cast)]
+
+use std::collections::VecDeque;
+
+use objc2::rc::Retained;
+use objc2::runtime::{AnyObject, NSObject};
+use objc2::{class, declare_class, msg_send, msg_send_id, mutability, ClassType, DeclaredClass};
+use objc2_foundation::{
+    CGFloat, CGPoint, CGRect, CGSize, MainThreadBound, MainThreadMarker, NSObjectProtocol,
+};
+use objc2_ui_kit::{
+    UIApplication, UICoordinateSpace, UIResponder, UIScreen, UIScreenOverscanCompensation,
+    UIViewController, UIWindow,
+};
+use tracing::{debug, warn};
+
+use super::app_state::EventWrapper;
+use super::view::WinitView;
+use super::view_controller::WinitViewController;
+use crate::cursor::Cursor;
+use crate::dpi::{LogicalPosition, LogicalSize, PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{ExternalError, NotSupportedError, OsError as RootOsError};
+use crate::event::{Event, WindowEvent};
+use crate::icon::Icon;
+use crate::platform::ios::{ScreenEdge, StatusBarStyle, ValidOrientations};
+use crate::platform_impl::platform::{
+    app_state, monitor, ActiveEventLoop, Fullscreen, MonitorHandle,
+};
+use crate::window::{
+    CursorGrabMode, ImePurpose, ResizeDirection, Theme, UserAttentionType, WindowAttributes,
+    WindowButtons, WindowId as RootWindowId, WindowLevel,
+};
+
+declare_class!(
+    #[derive(Debug, PartialEq, Eq, Hash)]
+    pub(crate) struct WinitUIWindow;
+
+    unsafe impl ClassType for WinitUIWindow {
+        #[inherits(UIResponder, NSObject)]
+        type Super = UIWindow;
+        type Mutability = mutability::MainThreadOnly;
+        const NAME: &'static str = "WinitUIWindow";
+    }
+
+    impl DeclaredClass for WinitUIWindow {}
+
+    unsafe impl WinitUIWindow {
+        #[method(becomeKeyWindow)]
+        fn become_key_window(&self) {
+            let mtm = MainThreadMarker::new().unwrap();
+            app_state::handle_nonuser_event(
+                mtm,
+                EventWrapper::StaticEvent(Event::WindowEvent {
+                    window_id: RootWindowId(self.id()),
+                    event: WindowEvent::Focused(true),
+                }),
+            );
+            let _: () = unsafe { msg_send![super(self), becomeKeyWindow] };
+        }
+
+        #[method(resignKeyWindow)]
+        fn resign_key_window(&self) {
+            let mtm = MainThreadMarker::new().unwrap();
+            app_state::handle_nonuser_event(
+                mtm,
+                EventWrapper::StaticEvent(Event::WindowEvent {
+                    window_id: RootWindowId(self.id()),
+                    event: WindowEvent::Focused(false),
+                }),
+            );
+            let _: () = unsafe { msg_send![super(self), resignKeyWindow] };
+        }
+    }
+);
+
+impl WinitUIWindow {
+    pub(crate) fn new(
+        mtm: MainThreadMarker,
+        window_attributes: &WindowAttributes,
+        frame: CGRect,
+        view_controller: &UIViewController,
+    ) -> Retained<Self> {
+        let this: Retained<Self> = unsafe { msg_send_id![mtm.alloc(), initWithFrame: frame] };
+
+        this.setRootViewController(Some(view_controller));
+
+        match window_attributes.fullscreen.clone().map(Into::into) {
+            Some(Fullscreen::Exclusive(ref video_mode)) => {
+                let monitor = video_mode.monitor();
+                let screen = monitor.ui_screen(mtm);
+                screen.setCurrentMode(Some(video_mode.screen_mode(mtm)));
+                this.setScreen(screen);
+            },
+            Some(Fullscreen::Borderless(Some(ref monitor))) => {
+                let screen = monitor.ui_screen(mtm);
+                this.setScreen(screen);
+            },
+            _ => (),
+        }
+
+        this
+    }
+
+    pub(crate) fn id(&self) -> WindowId {
+        (self as *const Self as usize as u64).into()
+    }
+}
+
+pub struct Inner {
+    window: Retained<WinitUIWindow>,
+    view_controller: Retained<WinitViewController>,
+    view: Retained<WinitView>,
+    gl_or_metal_backed: bool,
+}
+
+impl Inner {
+    pub fn set_title(&self, _title: &str) {
+        debug!("`Window::set_title` is ignored on iOS")
+    }
+
+    pub fn set_transparent(&self, _transparent: bool) {
+        debug!("`Window::set_transparent` is ignored on iOS")
+    }
+
+    pub fn set_blur(&self, _blur: bool) {
+        debug!("`Window::set_blur` is ignored on iOS")
+    }
+
+    pub fn set_visible(&self, visible: bool) {
+        self.window.setHidden(!visible)
+    }
+
+    pub fn is_visible(&self) -> Option<bool> {
+        warn!("`Window::is_visible` is ignored on iOS");
+        None
+    }
+
+    pub fn request_redraw(&self) {
+        if self.gl_or_metal_backed {
+            let mtm = MainThreadMarker::new().unwrap();
+            // `setNeedsDisplay` does nothing on UIViews which are directly backed by CAEAGLLayer or
+            // CAMetalLayer. Ordinarily the OS sets up a bunch of UIKit state before
+            // calling drawRect: on a UIView, but when using raw or gl/metal for drawing
+            // this work is completely avoided.
+            //
+            // The docs for `setNeedsDisplay` don't mention `CAMetalLayer`; however, this has been
+            // confirmed via testing.
+            //
+            // https://developer.apple.com/documentation/uikit/uiview/1622437-setneedsdisplay?language=objc
+            app_state::queue_gl_or_metal_redraw(mtm, self.window.clone());
+        } else {
+            self.view.setNeedsDisplay();
+        }
+    }
+
+    pub fn pre_present_notify(&self) {}
+
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let safe_area = self.safe_area_screen_space();
+        let position =
+            LogicalPosition { x: safe_area.origin.x as f64, y: safe_area.origin.y as f64 };
+        let scale_factor = self.scale_factor();
+        Ok(position.to_physical(scale_factor))
+    }
+
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let screen_frame = self.screen_frame();
+        let position =
+            LogicalPosition { x: screen_frame.origin.x as f64, y: screen_frame.origin.y as f64 };
+        let scale_factor = self.scale_factor();
+        Ok(position.to_physical(scale_factor))
+    }
+
+    pub fn set_outer_position(&self, physical_position: Position) {
+        let scale_factor = self.scale_factor();
+        let position = physical_position.to_logical::<f64>(scale_factor);
+        let screen_frame = self.screen_frame();
+        let new_screen_frame = CGRect {
+            origin: CGPoint { x: position.x as _, y: position.y as _ },
+            size: screen_frame.size,
+        };
+        let bounds = self.rect_from_screen_space(new_screen_frame);
+        self.window.setBounds(bounds);
+    }
+
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        let scale_factor = self.scale_factor();
+        let safe_area = self.safe_area_screen_space();
+        let size = LogicalSize {
+            width: safe_area.size.width as f64,
+            height: safe_area.size.height as f64,
+        };
+        size.to_physical(scale_factor)
+    }
+
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        let scale_factor = self.scale_factor();
+        let screen_frame = self.screen_frame();
+        let size = LogicalSize {
+            width: screen_frame.size.width as f64,
+            height: screen_frame.size.height as f64,
+        };
+        size.to_physical(scale_factor)
+    }
+
+    pub fn request_inner_size(&self, _size: Size) -> Option<PhysicalSize<u32>> {
+        Some(self.inner_size())
+    }
+
+    pub fn set_min_inner_size(&self, _dimensions: Option<Size>) {
+        warn!("`Window::set_min_inner_size` is ignored on iOS")
+    }
+
+    pub fn set_max_inner_size(&self, _dimensions: Option<Size>) {
+        warn!("`Window::set_max_inner_size` is ignored on iOS")
+    }
+
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        None
+    }
+
+    #[inline]
+    pub fn set_resize_increments(&self, _increments: Option<Size>) {
+        warn!("`Window::set_resize_increments` is ignored on iOS")
+    }
+
+    pub fn set_resizable(&self, _resizable: bool) {
+        warn!("`Window::set_resizable` is ignored on iOS")
+    }
+
+    pub fn is_resizable(&self) -> bool {
+        warn!("`Window::is_resizable` is ignored on iOS");
+        false
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, _buttons: WindowButtons) {
+        warn!("`Window::set_enabled_buttons` is ignored on iOS");
+    }
+
+    #[inline]
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        warn!("`Window::enabled_buttons` is ignored on iOS");
+        WindowButtons::all()
+    }
+
+    pub fn scale_factor(&self) -> f64 {
+        self.view.contentScaleFactor() as _
+    }
+
+    pub fn set_cursor(&self, _cursor: Cursor) {
+        debug!("`Window::set_cursor` ignored on iOS")
+    }
+
+    pub fn set_cursor_position(&self, _position: Position) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    pub fn set_cursor_grab(&self, _: CursorGrabMode) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    pub fn set_cursor_visible(&self, _visible: bool) {
+        debug!("`Window::set_cursor_visible` is ignored on iOS")
+    }
+
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    pub fn drag_resize_window(&self, _direction: ResizeDirection) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, _position: Position) {}
+
+    pub fn set_cursor_hittest(&self, _hittest: bool) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    pub fn set_minimized(&self, _minimized: bool) {
+        warn!("`Window::set_minimized` is ignored on iOS")
+    }
+
+    pub fn is_minimized(&self) -> Option<bool> {
+        warn!("`Window::is_minimized` is ignored on iOS");
+        None
+    }
+
+    pub fn set_maximized(&self, _maximized: bool) {
+        warn!("`Window::set_maximized` is ignored on iOS")
+    }
+
+    pub fn is_maximized(&self) -> bool {
+        warn!("`Window::is_maximized` is ignored on iOS");
+        false
+    }
+
+    pub(crate) fn set_fullscreen(&self, monitor: Option<Fullscreen>) {
+        let mtm = MainThreadMarker::new().unwrap();
+        let uiscreen = match &monitor {
+            Some(Fullscreen::Exclusive(video_mode)) => {
+                let uiscreen = video_mode.monitor.ui_screen(mtm);
+                uiscreen.setCurrentMode(Some(video_mode.screen_mode(mtm)));
+                uiscreen.clone()
+            },
+            Some(Fullscreen::Borderless(Some(monitor))) => monitor.ui_screen(mtm).clone(),
+            Some(Fullscreen::Borderless(None)) => {
+                self.current_monitor_inner().ui_screen(mtm).clone()
+            },
+            None => {
+                warn!("`Window::set_fullscreen(None)` ignored on iOS");
+                return;
+            },
+        };
+
+        // this is pretty slow on iOS, so avoid doing it if we can
+        let current = self.window.screen();
+        if uiscreen != current {
+            self.window.setScreen(&uiscreen);
+        }
+
+        let bounds = uiscreen.bounds();
+        self.window.setFrame(bounds);
+
+        // For external displays, we must disable overscan compensation or
+        // the displayed image will have giant black bars surrounding it on
+        // each side
+        uiscreen.setOverscanCompensation(UIScreenOverscanCompensation::None);
+    }
+
+    pub(crate) fn fullscreen(&self) -> Option<Fullscreen> {
+        let mtm = MainThreadMarker::new().unwrap();
+        let monitor = self.current_monitor_inner();
+        let uiscreen = monitor.ui_screen(mtm);
+        let screen_space_bounds = self.screen_frame();
+        let screen_bounds = uiscreen.bounds();
+
+        // TODO: track fullscreen instead of relying on brittle float comparisons
+        if screen_space_bounds.origin.x == screen_bounds.origin.x
+            && screen_space_bounds.origin.y == screen_bounds.origin.y
+            && screen_space_bounds.size.width == screen_bounds.size.width
+            && screen_space_bounds.size.height == screen_bounds.size.height
+        {
+            Some(Fullscreen::Borderless(Some(monitor)))
+        } else {
+            None
+        }
+    }
+
+    pub fn set_decorations(&self, _decorations: bool) {}
+
+    pub fn is_decorated(&self) -> bool {
+        true
+    }
+
+    pub fn set_window_level(&self, _level: WindowLevel) {
+        warn!("`Window::set_window_level` is ignored on iOS")
+    }
+
+    pub fn set_window_icon(&self, _icon: Option<Icon>) {
+        warn!("`Window::set_window_icon` is ignored on iOS")
+    }
+
+    pub fn set_ime_cursor_area(&self, _position: Position, _size: Size) {
+        warn!("`Window::set_ime_cursor_area` is ignored on iOS")
+    }
+
+    /// Show / hide the keyboard. To show the keyboard, we call `becomeFirstResponder`,
+    /// requesting focus for the [WinitView]. Since [WinitView] implements
+    /// [objc2_ui_kit::UIKeyInput], the keyboard will be shown.
+    /// <https://developer.apple.com/documentation/uikit/uiresponder/1621113-becomefirstresponder>
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        if allowed {
+            unsafe {
+                self.view.becomeFirstResponder();
+            }
+        } else {
+            unsafe {
+                self.view.resignFirstResponder();
+            }
+        }
+    }
+
+    pub fn set_ime_purpose(&self, _purpose: ImePurpose) {
+        warn!("`Window::set_ime_purpose` is ignored on iOS")
+    }
+
+    pub fn focus_window(&self) {
+        warn!("`Window::set_focus` is ignored on iOS")
+    }
+
+    pub fn request_user_attention(&self, _request_type: Option<UserAttentionType>) {
+        warn!("`Window::request_user_attention` is ignored on iOS")
+    }
+
+    // Allow directly accessing the current monitor internally without unwrapping.
+    fn current_monitor_inner(&self) -> MonitorHandle {
+        MonitorHandle::new(self.window.screen())
+    }
+
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        Some(self.current_monitor_inner())
+    }
+
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        monitor::uiscreens(MainThreadMarker::new().unwrap())
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        #[allow(deprecated)]
+        Some(MonitorHandle::new(UIScreen::mainScreen(MainThreadMarker::new().unwrap())))
+    }
+
+    pub fn id(&self) -> WindowId {
+        self.window.id()
+    }
+
+    #[cfg(feature = "rwh_04")]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        let mut window_handle = rwh_04::UiKitHandle::empty();
+        window_handle.ui_window = Retained::as_ptr(&self.window) as _;
+        window_handle.ui_view = Retained::as_ptr(&self.view) as _;
+        window_handle.ui_view_controller = Retained::as_ptr(&self.view_controller) as _;
+        rwh_04::RawWindowHandle::UiKit(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        let mut window_handle = rwh_05::UiKitWindowHandle::empty();
+        window_handle.ui_window = Retained::as_ptr(&self.window) as _;
+        window_handle.ui_view = Retained::as_ptr(&self.view) as _;
+        window_handle.ui_view_controller = Retained::as_ptr(&self.view_controller) as _;
+        rwh_05::RawWindowHandle::UiKit(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::UiKit(rwh_05::UiKitDisplayHandle::empty())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    pub fn raw_window_handle_rwh_06(&self) -> rwh_06::RawWindowHandle {
+        let mut window_handle = rwh_06::UiKitWindowHandle::new({
+            let ui_view = Retained::as_ptr(&self.view) as _;
+            std::ptr::NonNull::new(ui_view).expect("Retained<T> should never be null")
+        });
+        window_handle.ui_view_controller =
+            std::ptr::NonNull::new(Retained::as_ptr(&self.view_controller) as _);
+        rwh_06::RawWindowHandle::UiKit(window_handle)
+    }
+
+    pub fn theme(&self) -> Option<Theme> {
+        warn!("`Window::theme` is ignored on iOS");
+        None
+    }
+
+    pub fn set_content_protected(&self, _protected: bool) {}
+
+    pub fn has_focus(&self) -> bool {
+        self.window.isKeyWindow()
+    }
+
+    #[inline]
+    pub fn set_theme(&self, _theme: Option<Theme>) {
+        warn!("`Window::set_theme` is ignored on iOS");
+    }
+
+    pub fn title(&self) -> String {
+        warn!("`Window::title` is ignored on iOS");
+        String::new()
+    }
+
+    pub fn reset_dead_keys(&self) {
+        // Noop
+    }
+}
+
+pub struct Window {
+    inner: MainThreadBound<Inner>,
+}
+
+impl Window {
+    pub(crate) fn new(
+        event_loop: &ActiveEventLoop,
+        window_attributes: WindowAttributes,
+    ) -> Result<Window, RootOsError> {
+        let mtm = event_loop.mtm;
+
+        if window_attributes.min_inner_size.is_some() {
+            warn!("`WindowAttributes::min_inner_size` is ignored on iOS");
+        }
+        if window_attributes.max_inner_size.is_some() {
+            warn!("`WindowAttributes::max_inner_size` is ignored on iOS");
+        }
+
+        // TODO: transparency, visible
+
+        #[allow(deprecated)]
+        let main_screen = UIScreen::mainScreen(mtm);
+        let fullscreen = window_attributes.fullscreen.clone().map(Into::into);
+        let screen = match fullscreen {
+            Some(Fullscreen::Exclusive(ref video_mode)) => video_mode.monitor.ui_screen(mtm),
+            Some(Fullscreen::Borderless(Some(ref monitor))) => monitor.ui_screen(mtm),
+            Some(Fullscreen::Borderless(None)) | None => &main_screen,
+        };
+
+        let screen_bounds = screen.bounds();
+
+        let frame = match window_attributes.inner_size {
+            Some(dim) => {
+                let scale_factor = screen.scale();
+                let size = dim.to_logical::<f64>(scale_factor as f64);
+                CGRect {
+                    origin: screen_bounds.origin,
+                    size: CGSize { width: size.width as _, height: size.height as _ },
+                }
+            },
+            None => screen_bounds,
+        };
+
+        let view = WinitView::new(mtm, &window_attributes, frame);
+
+        let gl_or_metal_backed =
+            view.isKindOfClass(class!(CAMetalLayer)) || view.isKindOfClass(class!(CAEAGLLayer));
+
+        let view_controller = WinitViewController::new(mtm, &window_attributes, &view);
+        let window = WinitUIWindow::new(mtm, &window_attributes, frame, &view_controller);
+
+        app_state::set_key_window(mtm, &window);
+
+        // Like the Windows and macOS backends, we send a `ScaleFactorChanged` and `Resized`
+        // event on window creation if the DPI factor != 1.0
+        let scale_factor = view.contentScaleFactor();
+        let scale_factor = scale_factor as f64;
+        if scale_factor != 1.0 {
+            let bounds = view.bounds();
+            let screen = window.screen();
+            let screen_space = screen.coordinateSpace();
+            let screen_frame = view.convertRect_toCoordinateSpace(bounds, &screen_space);
+            let size = LogicalSize {
+                width: screen_frame.size.width as f64,
+                height: screen_frame.size.height as f64,
+            };
+            let window_id = RootWindowId(window.id());
+            app_state::handle_nonuser_events(
+                mtm,
+                std::iter::once(EventWrapper::ScaleFactorChanged(app_state::ScaleFactorChanged {
+                    window: window.clone(),
+                    scale_factor,
+                    suggested_size: size.to_physical(scale_factor),
+                }))
+                .chain(std::iter::once(EventWrapper::StaticEvent(
+                    Event::WindowEvent {
+                        window_id,
+                        event: WindowEvent::Resized(size.to_physical(scale_factor)),
+                    },
+                ))),
+            );
+        }
+
+        let inner = Inner { window, view_controller, view, gl_or_metal_backed };
+        Ok(Window { inner: MainThreadBound::new(inner, mtm) })
+    }
+
+    pub(crate) fn maybe_queue_on_main(&self, f: impl FnOnce(&Inner) + Send + 'static) {
+        // For now, don't actually do queuing, since it may be less predictable
+        self.maybe_wait_on_main(f)
+    }
+
+    pub(crate) fn maybe_wait_on_main<R: Send>(&self, f: impl FnOnce(&Inner) -> R + Send) -> R {
+        self.inner.get_on_main(|inner| f(inner))
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub(crate) fn raw_window_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        if let Some(mtm) = MainThreadMarker::new() {
+            Ok(self.inner.get(mtm).raw_window_handle_rwh_06())
+        } else {
+            Err(rwh_06::HandleError::Unavailable)
+        }
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub(crate) fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::UiKit(rwh_06::UiKitDisplayHandle::new()))
+    }
+}
+
+// WindowExtIOS
+impl Inner {
+    pub fn set_scale_factor(&self, scale_factor: f64) {
+        assert!(
+            dpi::validate_scale_factor(scale_factor),
+            "`WindowExtIOS::set_scale_factor` received an invalid hidpi factor"
+        );
+        let scale_factor = scale_factor as CGFloat;
+        self.view.setContentScaleFactor(scale_factor);
+    }
+
+    pub fn set_valid_orientations(&self, valid_orientations: ValidOrientations) {
+        self.view_controller.set_supported_interface_orientations(
+            MainThreadMarker::new().unwrap(),
+            valid_orientations,
+        );
+    }
+
+    pub fn set_prefers_home_indicator_hidden(&self, hidden: bool) {
+        self.view_controller.set_prefers_home_indicator_auto_hidden(hidden);
+    }
+
+    pub fn set_preferred_screen_edges_deferring_system_gestures(&self, edges: ScreenEdge) {
+        self.view_controller.set_preferred_screen_edges_deferring_system_gestures(edges);
+    }
+
+    pub fn set_prefers_status_bar_hidden(&self, hidden: bool) {
+        self.view_controller.set_prefers_status_bar_hidden(hidden);
+    }
+
+    pub fn set_preferred_status_bar_style(&self, status_bar_style: StatusBarStyle) {
+        self.view_controller.set_preferred_status_bar_style(status_bar_style);
+    }
+
+    pub fn recognize_pinch_gesture(&self, should_recognize: bool) {
+        self.view.recognize_pinch_gesture(should_recognize);
+    }
+
+    pub fn recognize_pan_gesture(
+        &self,
+        should_recognize: bool,
+        minimum_number_of_touches: u8,
+        maximum_number_of_touches: u8,
+    ) {
+        self.view.recognize_pan_gesture(
+            should_recognize,
+            minimum_number_of_touches,
+            maximum_number_of_touches,
+        );
+    }
+
+    pub fn recognize_doubletap_gesture(&self, should_recognize: bool) {
+        self.view.recognize_doubletap_gesture(should_recognize);
+    }
+
+    pub fn recognize_rotation_gesture(&self, should_recognize: bool) {
+        self.view.recognize_rotation_gesture(should_recognize);
+    }
+}
+
+impl Inner {
+    fn screen_frame(&self) -> CGRect {
+        self.rect_to_screen_space(self.window.bounds())
+    }
+
+    fn rect_to_screen_space(&self, rect: CGRect) -> CGRect {
+        let screen_space = self.window.screen().coordinateSpace();
+        self.window.convertRect_toCoordinateSpace(rect, &screen_space)
+    }
+
+    fn rect_from_screen_space(&self, rect: CGRect) -> CGRect {
+        let screen_space = self.window.screen().coordinateSpace();
+        self.window.convertRect_fromCoordinateSpace(rect, &screen_space)
+    }
+
+    fn safe_area_screen_space(&self) -> CGRect {
+        let bounds = self.window.bounds();
+        if app_state::os_capabilities().safe_area {
+            let safe_area = self.window.safeAreaInsets();
+            let safe_bounds = CGRect {
+                origin: CGPoint {
+                    x: bounds.origin.x + safe_area.left,
+                    y: bounds.origin.y + safe_area.top,
+                },
+                size: CGSize {
+                    width: bounds.size.width - safe_area.left - safe_area.right,
+                    height: bounds.size.height - safe_area.top - safe_area.bottom,
+                },
+            };
+            self.rect_to_screen_space(safe_bounds)
+        } else {
+            let screen_frame = self.rect_to_screen_space(bounds);
+            let status_bar_frame = {
+                let app = UIApplication::sharedApplication(MainThreadMarker::new().unwrap());
+                #[allow(deprecated)]
+                app.statusBarFrame()
+            };
+            let (y, height) = if screen_frame.origin.y > status_bar_frame.size.height {
+                (screen_frame.origin.y, screen_frame.size.height)
+            } else {
+                let y = status_bar_frame.size.height;
+                let height = screen_frame.size.height
+                    - (status_bar_frame.size.height - screen_frame.origin.y);
+                (y, height)
+            };
+            CGRect {
+                origin: CGPoint { x: screen_frame.origin.x, y },
+                size: CGSize { width: screen_frame.size.width, height },
+            }
+        }
+    }
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct WindowId {
+    window: *mut WinitUIWindow,
+}
+
+impl WindowId {
+    pub const fn dummy() -> Self {
+        WindowId { window: std::ptr::null_mut() }
+    }
+}
+
+impl From<WindowId> for u64 {
+    fn from(window_id: WindowId) -> Self {
+        window_id.window as u64
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(raw_id: u64) -> Self {
+        Self { window: raw_id as _ }
+    }
+}
+
+unsafe impl Send for WindowId {}
+unsafe impl Sync for WindowId {}
+
+impl From<&AnyObject> for WindowId {
+    fn from(window: &AnyObject) -> WindowId {
+        WindowId { window: window as *const _ as _ }
+    }
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct PlatformSpecificWindowAttributes {
+    pub scale_factor: Option<f64>,
+    pub valid_orientations: ValidOrientations,
+    pub prefers_home_indicator_hidden: bool,
+    pub prefers_status_bar_hidden: bool,
+    pub preferred_status_bar_style: StatusBarStyle,
+    pub preferred_screen_edges_deferring_system_gestures: ScreenEdge,
+}
diff --git a/vendor/winit/src/platform_impl/linux/common/mod.rs b/vendor/winit/src/platform_impl/linux/common/mod.rs
new file mode 100644
index 00000000..ed7f82cd
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/common/mod.rs
@@ -0,0 +1 @@
+pub mod xkb;
diff --git a/vendor/winit/src/platform_impl/linux/common/xkb/compose.rs b/vendor/winit/src/platform_impl/linux/common/xkb/compose.rs
new file mode 100644
index 00000000..9d4f590a
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/common/xkb/compose.rs
@@ -0,0 +1,123 @@
+//! XKB compose handling.
+
+use std::env;
+use std::ffi::CString;
+use std::ops::Deref;
+use std::os::unix::ffi::OsStringExt;
+use std::ptr::NonNull;
+
+use super::{XkbContext, XKBCH};
+use smol_str::SmolStr;
+use xkbcommon_dl::{
+    xkb_compose_compile_flags, xkb_compose_feed_result, xkb_compose_state, xkb_compose_state_flags,
+    xkb_compose_status, xkb_compose_table, xkb_keysym_t,
+};
+
+#[derive(Debug)]
+pub struct XkbComposeTable {
+    table: NonNull<xkb_compose_table>,
+}
+
+impl XkbComposeTable {
+    pub fn new(context: &XkbContext) -> Option<Self> {
+        let locale = env::var_os("LC_ALL")
+            .and_then(|v| if v.is_empty() { None } else { Some(v) })
+            .or_else(|| env::var_os("LC_CTYPE"))
+            .and_then(|v| if v.is_empty() { None } else { Some(v) })
+            .or_else(|| env::var_os("LANG"))
+            .and_then(|v| if v.is_empty() { None } else { Some(v) })
+            .unwrap_or_else(|| "C".into());
+        let locale = CString::new(locale.into_vec()).unwrap();
+
+        let table = unsafe {
+            (XKBCH.xkb_compose_table_new_from_locale)(
+                context.as_ptr(),
+                locale.as_ptr(),
+                xkb_compose_compile_flags::XKB_COMPOSE_COMPILE_NO_FLAGS,
+            )
+        };
+
+        let table = NonNull::new(table)?;
+        Some(Self { table })
+    }
+
+    /// Create new state with the given compose table.
+    pub fn new_state(&self) -> Option<XkbComposeState> {
+        let state = unsafe {
+            (XKBCH.xkb_compose_state_new)(
+                self.table.as_ptr(),
+                xkb_compose_state_flags::XKB_COMPOSE_STATE_NO_FLAGS,
+            )
+        };
+
+        let state = NonNull::new(state)?;
+        Some(XkbComposeState { state })
+    }
+}
+
+impl Deref for XkbComposeTable {
+    type Target = NonNull<xkb_compose_table>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.table
+    }
+}
+
+impl Drop for XkbComposeTable {
+    fn drop(&mut self) {
+        unsafe {
+            (XKBCH.xkb_compose_table_unref)(self.table.as_ptr());
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct XkbComposeState {
+    state: NonNull<xkb_compose_state>,
+}
+
+impl XkbComposeState {
+    pub fn get_string(&mut self, scratch_buffer: &mut Vec<u8>) -> Option<SmolStr> {
+        super::make_string_with(scratch_buffer, |ptr, len| unsafe {
+            (XKBCH.xkb_compose_state_get_utf8)(self.state.as_ptr(), ptr, len)
+        })
+    }
+
+    #[inline]
+    pub fn feed(&mut self, keysym: xkb_keysym_t) -> ComposeStatus {
+        let feed_result = unsafe { (XKBCH.xkb_compose_state_feed)(self.state.as_ptr(), keysym) };
+        match feed_result {
+            xkb_compose_feed_result::XKB_COMPOSE_FEED_IGNORED => ComposeStatus::Ignored,
+            xkb_compose_feed_result::XKB_COMPOSE_FEED_ACCEPTED => {
+                ComposeStatus::Accepted(self.status())
+            },
+        }
+    }
+
+    #[inline]
+    pub fn reset(&mut self) {
+        unsafe {
+            (XKBCH.xkb_compose_state_reset)(self.state.as_ptr());
+        }
+    }
+
+    #[inline]
+    pub fn status(&mut self) -> xkb_compose_status {
+        unsafe { (XKBCH.xkb_compose_state_get_status)(self.state.as_ptr()) }
+    }
+}
+
+impl Drop for XkbComposeState {
+    fn drop(&mut self) {
+        unsafe {
+            (XKBCH.xkb_compose_state_unref)(self.state.as_ptr());
+        };
+    }
+}
+
+#[derive(Copy, Clone, Debug)]
+pub enum ComposeStatus {
+    Accepted(xkb_compose_status),
+    Ignored,
+    None,
+}
diff --git a/vendor/winit/src/platform_impl/linux/common/xkb/keymap.rs b/vendor/winit/src/platform_impl/linux/common/xkb/keymap.rs
new file mode 100644
index 00000000..67aac5c1
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/common/xkb/keymap.rs
@@ -0,0 +1,1044 @@
+//! XKB keymap.
+
+use std::ffi::c_char;
+use std::ops::Deref;
+use std::ptr::{self, NonNull};
+
+#[cfg(x11_platform)]
+use x11_dl::xlib_xcb::xcb_connection_t;
+#[cfg(wayland_platform)]
+use {memmap2::MmapOptions, std::os::unix::io::OwnedFd};
+
+use xkb::XKB_MOD_INVALID;
+use xkbcommon_dl::{
+    self as xkb, xkb_keycode_t, xkb_keymap, xkb_keymap_compile_flags, xkb_keysym_t,
+    xkb_layout_index_t, xkb_mod_index_t,
+};
+
+use crate::keyboard::{Key, KeyCode, KeyLocation, NamedKey, NativeKey, NativeKeyCode, PhysicalKey};
+#[cfg(x11_platform)]
+use crate::platform_impl::common::xkb::XKBXH;
+use crate::platform_impl::common::xkb::{XkbContext, XKBH};
+
+/// Map the raw X11-style keycode to the `KeyCode` enum.
+///
+/// X11-style keycodes are offset by 8 from the keycodes the Linux kernel uses.
+pub fn raw_keycode_to_physicalkey(keycode: u32) -> PhysicalKey {
+    scancode_to_physicalkey(keycode.saturating_sub(8))
+}
+
+/// Map the linux scancode to Keycode.
+///
+/// Both X11 and Wayland use keys with `+ 8` offset to linux scancode.
+pub fn scancode_to_physicalkey(scancode: u32) -> PhysicalKey {
+    // The keycode values are taken from linux/include/uapi/linux/input-event-codes.h, as
+    // libxkbcommon's documentation seems to suggest that the keycode values we're interested in
+    // are defined by the Linux kernel. If Winit programs end up being run on other Unix-likes,
+    // I can only hope they agree on what the keycodes mean.
+    //
+    // Some of the keycodes are likely superfluous for our purposes, and some are ones which are
+    // difficult to test the correctness of, or discover the purpose of. Because of this, they've
+    // either been commented out here, or not included at all.
+    PhysicalKey::Code(match scancode {
+        0 => return PhysicalKey::Unidentified(NativeKeyCode::Xkb(0)),
+        1 => KeyCode::Escape,
+        2 => KeyCode::Digit1,
+        3 => KeyCode::Digit2,
+        4 => KeyCode::Digit3,
+        5 => KeyCode::Digit4,
+        6 => KeyCode::Digit5,
+        7 => KeyCode::Digit6,
+        8 => KeyCode::Digit7,
+        9 => KeyCode::Digit8,
+        10 => KeyCode::Digit9,
+        11 => KeyCode::Digit0,
+        12 => KeyCode::Minus,
+        13 => KeyCode::Equal,
+        14 => KeyCode::Backspace,
+        15 => KeyCode::Tab,
+        16 => KeyCode::KeyQ,
+        17 => KeyCode::KeyW,
+        18 => KeyCode::KeyE,
+        19 => KeyCode::KeyR,
+        20 => KeyCode::KeyT,
+        21 => KeyCode::KeyY,
+        22 => KeyCode::KeyU,
+        23 => KeyCode::KeyI,
+        24 => KeyCode::KeyO,
+        25 => KeyCode::KeyP,
+        26 => KeyCode::BracketLeft,
+        27 => KeyCode::BracketRight,
+        28 => KeyCode::Enter,
+        29 => KeyCode::ControlLeft,
+        30 => KeyCode::KeyA,
+        31 => KeyCode::KeyS,
+        32 => KeyCode::KeyD,
+        33 => KeyCode::KeyF,
+        34 => KeyCode::KeyG,
+        35 => KeyCode::KeyH,
+        36 => KeyCode::KeyJ,
+        37 => KeyCode::KeyK,
+        38 => KeyCode::KeyL,
+        39 => KeyCode::Semicolon,
+        40 => KeyCode::Quote,
+        41 => KeyCode::Backquote,
+        42 => KeyCode::ShiftLeft,
+        43 => KeyCode::Backslash,
+        44 => KeyCode::KeyZ,
+        45 => KeyCode::KeyX,
+        46 => KeyCode::KeyC,
+        47 => KeyCode::KeyV,
+        48 => KeyCode::KeyB,
+        49 => KeyCode::KeyN,
+        50 => KeyCode::KeyM,
+        51 => KeyCode::Comma,
+        52 => KeyCode::Period,
+        53 => KeyCode::Slash,
+        54 => KeyCode::ShiftRight,
+        55 => KeyCode::NumpadMultiply,
+        56 => KeyCode::AltLeft,
+        57 => KeyCode::Space,
+        58 => KeyCode::CapsLock,
+        59 => KeyCode::F1,
+        60 => KeyCode::F2,
+        61 => KeyCode::F3,
+        62 => KeyCode::F4,
+        63 => KeyCode::F5,
+        64 => KeyCode::F6,
+        65 => KeyCode::F7,
+        66 => KeyCode::F8,
+        67 => KeyCode::F9,
+        68 => KeyCode::F10,
+        69 => KeyCode::NumLock,
+        70 => KeyCode::ScrollLock,
+        71 => KeyCode::Numpad7,
+        72 => KeyCode::Numpad8,
+        73 => KeyCode::Numpad9,
+        74 => KeyCode::NumpadSubtract,
+        75 => KeyCode::Numpad4,
+        76 => KeyCode::Numpad5,
+        77 => KeyCode::Numpad6,
+        78 => KeyCode::NumpadAdd,
+        79 => KeyCode::Numpad1,
+        80 => KeyCode::Numpad2,
+        81 => KeyCode::Numpad3,
+        82 => KeyCode::Numpad0,
+        83 => KeyCode::NumpadDecimal,
+        85 => KeyCode::Lang5,
+        86 => KeyCode::IntlBackslash,
+        87 => KeyCode::F11,
+        88 => KeyCode::F12,
+        89 => KeyCode::IntlRo,
+        90 => KeyCode::Lang3,
+        91 => KeyCode::Lang4,
+        92 => KeyCode::Convert,
+        93 => KeyCode::KanaMode,
+        94 => KeyCode::NonConvert,
+        // 95 => KeyCode::KPJPCOMMA,
+        96 => KeyCode::NumpadEnter,
+        97 => KeyCode::ControlRight,
+        98 => KeyCode::NumpadDivide,
+        99 => KeyCode::PrintScreen,
+        100 => KeyCode::AltRight,
+        // 101 => KeyCode::LINEFEED,
+        102 => KeyCode::Home,
+        103 => KeyCode::ArrowUp,
+        104 => KeyCode::PageUp,
+        105 => KeyCode::ArrowLeft,
+        106 => KeyCode::ArrowRight,
+        107 => KeyCode::End,
+        108 => KeyCode::ArrowDown,
+        109 => KeyCode::PageDown,
+        110 => KeyCode::Insert,
+        111 => KeyCode::Delete,
+        // 112 => KeyCode::MACRO,
+        113 => KeyCode::AudioVolumeMute,
+        114 => KeyCode::AudioVolumeDown,
+        115 => KeyCode::AudioVolumeUp,
+        // 116 => KeyCode::POWER,
+        117 => KeyCode::NumpadEqual,
+        // 118 => KeyCode::KPPLUSMINUS,
+        119 => KeyCode::Pause,
+        // 120 => KeyCode::SCALE,
+        121 => KeyCode::NumpadComma,
+        122 => KeyCode::Lang1,
+        123 => KeyCode::Lang2,
+        124 => KeyCode::IntlYen,
+        125 => KeyCode::SuperLeft,
+        126 => KeyCode::SuperRight,
+        127 => KeyCode::ContextMenu,
+        // 128 => KeyCode::STOP,
+        // 129 => KeyCode::AGAIN,
+        // 130 => KeyCode::PROPS,
+        // 131 => KeyCode::UNDO,
+        // 132 => KeyCode::FRONT,
+        // 133 => KeyCode::COPY,
+        // 134 => KeyCode::OPEN,
+        // 135 => KeyCode::PASTE,
+        // 136 => KeyCode::FIND,
+        // 137 => KeyCode::CUT,
+        // 138 => KeyCode::HELP,
+        // 139 => KeyCode::MENU,
+        // 140 => KeyCode::CALC,
+        // 141 => KeyCode::SETUP,
+        // 142 => KeyCode::SLEEP,
+        // 143 => KeyCode::WAKEUP,
+        // 144 => KeyCode::FILE,
+        // 145 => KeyCode::SENDFILE,
+        // 146 => KeyCode::DELETEFILE,
+        // 147 => KeyCode::XFER,
+        // 148 => KeyCode::PROG1,
+        // 149 => KeyCode::PROG2,
+        // 150 => KeyCode::WWW,
+        // 151 => KeyCode::MSDOS,
+        // 152 => KeyCode::COFFEE,
+        // 153 => KeyCode::ROTATE_DISPLAY,
+        // 154 => KeyCode::CYCLEWINDOWS,
+        // 155 => KeyCode::MAIL,
+        // 156 => KeyCode::BOOKMARKS,
+        // 157 => KeyCode::COMPUTER,
+        // 158 => KeyCode::BACK,
+        // 159 => KeyCode::FORWARD,
+        // 160 => KeyCode::CLOSECD,
+        // 161 => KeyCode::EJECTCD,
+        // 162 => KeyCode::EJECTCLOSECD,
+        163 => KeyCode::MediaTrackNext,
+        164 => KeyCode::MediaPlayPause,
+        165 => KeyCode::MediaTrackPrevious,
+        166 => KeyCode::MediaStop,
+        // 167 => KeyCode::RECORD,
+        // 168 => KeyCode::REWIND,
+        // 169 => KeyCode::PHONE,
+        // 170 => KeyCode::ISO,
+        // 171 => KeyCode::CONFIG,
+        // 172 => KeyCode::HOMEPAGE,
+        // 173 => KeyCode::REFRESH,
+        // 174 => KeyCode::EXIT,
+        // 175 => KeyCode::MOVE,
+        // 176 => KeyCode::EDIT,
+        // 177 => KeyCode::SCROLLUP,
+        // 178 => KeyCode::SCROLLDOWN,
+        // 179 => KeyCode::KPLEFTPAREN,
+        // 180 => KeyCode::KPRIGHTPAREN,
+        // 181 => KeyCode::NEW,
+        // 182 => KeyCode::REDO,
+        183 => KeyCode::F13,
+        184 => KeyCode::F14,
+        185 => KeyCode::F15,
+        186 => KeyCode::F16,
+        187 => KeyCode::F17,
+        188 => KeyCode::F18,
+        189 => KeyCode::F19,
+        190 => KeyCode::F20,
+        191 => KeyCode::F21,
+        192 => KeyCode::F22,
+        193 => KeyCode::F23,
+        194 => KeyCode::F24,
+        // 200 => KeyCode::PLAYCD,
+        // 201 => KeyCode::PAUSECD,
+        // 202 => KeyCode::PROG3,
+        // 203 => KeyCode::PROG4,
+        // 204 => KeyCode::DASHBOARD,
+        // 205 => KeyCode::SUSPEND,
+        // 206 => KeyCode::CLOSE,
+        // 207 => KeyCode::PLAY,
+        // 208 => KeyCode::FASTFORWARD,
+        // 209 => KeyCode::BASSBOOST,
+        // 210 => KeyCode::PRINT,
+        // 211 => KeyCode::HP,
+        // 212 => KeyCode::CAMERA,
+        // 213 => KeyCode::SOUND,
+        // 214 => KeyCode::QUESTION,
+        // 215 => KeyCode::EMAIL,
+        // 216 => KeyCode::CHAT,
+        // 217 => KeyCode::SEARCH,
+        // 218 => KeyCode::CONNECT,
+        // 219 => KeyCode::FINANCE,
+        // 220 => KeyCode::SPORT,
+        // 221 => KeyCode::SHOP,
+        // 222 => KeyCode::ALTERASE,
+        // 223 => KeyCode::CANCEL,
+        // 224 => KeyCode::BRIGHTNESSDOW,
+        // 225 => KeyCode::BRIGHTNESSU,
+        // 226 => KeyCode::MEDIA,
+        // 227 => KeyCode::SWITCHVIDEOMODE,
+        // 228 => KeyCode::KBDILLUMTOGGLE,
+        // 229 => KeyCode::KBDILLUMDOWN,
+        // 230 => KeyCode::KBDILLUMUP,
+        // 231 => KeyCode::SEND,
+        // 232 => KeyCode::REPLY,
+        // 233 => KeyCode::FORWARDMAIL,
+        // 234 => KeyCode::SAVE,
+        // 235 => KeyCode::DOCUMENTS,
+        // 236 => KeyCode::BATTERY,
+        // 237 => KeyCode::BLUETOOTH,
+        // 238 => KeyCode::WLAN,
+        // 239 => KeyCode::UWB,
+        240 => return PhysicalKey::Unidentified(NativeKeyCode::Unidentified),
+        // 241 => KeyCode::VIDEO_NEXT,
+        // 242 => KeyCode::VIDEO_PREV,
+        // 243 => KeyCode::BRIGHTNESS_CYCLE,
+        // 244 => KeyCode::BRIGHTNESS_AUTO,
+        // 245 => KeyCode::DISPLAY_OFF,
+        // 246 => KeyCode::WWAN,
+        // 247 => KeyCode::RFKILL,
+        // 248 => KeyCode::KEY_MICMUTE,
+        _ => return PhysicalKey::Unidentified(NativeKeyCode::Xkb(scancode)),
+    })
+}
+
+pub fn physicalkey_to_scancode(key: PhysicalKey) -> Option<u32> {
+    let code = match key {
+        PhysicalKey::Code(code) => code,
+        PhysicalKey::Unidentified(code) => {
+            return match code {
+                NativeKeyCode::Unidentified => Some(240),
+                NativeKeyCode::Xkb(raw) => Some(raw),
+                _ => None,
+            };
+        },
+    };
+
+    match code {
+        KeyCode::Escape => Some(1),
+        KeyCode::Digit1 => Some(2),
+        KeyCode::Digit2 => Some(3),
+        KeyCode::Digit3 => Some(4),
+        KeyCode::Digit4 => Some(5),
+        KeyCode::Digit5 => Some(6),
+        KeyCode::Digit6 => Some(7),
+        KeyCode::Digit7 => Some(8),
+        KeyCode::Digit8 => Some(9),
+        KeyCode::Digit9 => Some(10),
+        KeyCode::Digit0 => Some(11),
+        KeyCode::Minus => Some(12),
+        KeyCode::Equal => Some(13),
+        KeyCode::Backspace => Some(14),
+        KeyCode::Tab => Some(15),
+        KeyCode::KeyQ => Some(16),
+        KeyCode::KeyW => Some(17),
+        KeyCode::KeyE => Some(18),
+        KeyCode::KeyR => Some(19),
+        KeyCode::KeyT => Some(20),
+        KeyCode::KeyY => Some(21),
+        KeyCode::KeyU => Some(22),
+        KeyCode::KeyI => Some(23),
+        KeyCode::KeyO => Some(24),
+        KeyCode::KeyP => Some(25),
+        KeyCode::BracketLeft => Some(26),
+        KeyCode::BracketRight => Some(27),
+        KeyCode::Enter => Some(28),
+        KeyCode::ControlLeft => Some(29),
+        KeyCode::KeyA => Some(30),
+        KeyCode::KeyS => Some(31),
+        KeyCode::KeyD => Some(32),
+        KeyCode::KeyF => Some(33),
+        KeyCode::KeyG => Some(34),
+        KeyCode::KeyH => Some(35),
+        KeyCode::KeyJ => Some(36),
+        KeyCode::KeyK => Some(37),
+        KeyCode::KeyL => Some(38),
+        KeyCode::Semicolon => Some(39),
+        KeyCode::Quote => Some(40),
+        KeyCode::Backquote => Some(41),
+        KeyCode::ShiftLeft => Some(42),
+        KeyCode::Backslash => Some(43),
+        KeyCode::KeyZ => Some(44),
+        KeyCode::KeyX => Some(45),
+        KeyCode::KeyC => Some(46),
+        KeyCode::KeyV => Some(47),
+        KeyCode::KeyB => Some(48),
+        KeyCode::KeyN => Some(49),
+        KeyCode::KeyM => Some(50),
+        KeyCode::Comma => Some(51),
+        KeyCode::Period => Some(52),
+        KeyCode::Slash => Some(53),
+        KeyCode::ShiftRight => Some(54),
+        KeyCode::NumpadMultiply => Some(55),
+        KeyCode::AltLeft => Some(56),
+        KeyCode::Space => Some(57),
+        KeyCode::CapsLock => Some(58),
+        KeyCode::F1 => Some(59),
+        KeyCode::F2 => Some(60),
+        KeyCode::F3 => Some(61),
+        KeyCode::F4 => Some(62),
+        KeyCode::F5 => Some(63),
+        KeyCode::F6 => Some(64),
+        KeyCode::F7 => Some(65),
+        KeyCode::F8 => Some(66),
+        KeyCode::F9 => Some(67),
+        KeyCode::F10 => Some(68),
+        KeyCode::NumLock => Some(69),
+        KeyCode::ScrollLock => Some(70),
+        KeyCode::Numpad7 => Some(71),
+        KeyCode::Numpad8 => Some(72),
+        KeyCode::Numpad9 => Some(73),
+        KeyCode::NumpadSubtract => Some(74),
+        KeyCode::Numpad4 => Some(75),
+        KeyCode::Numpad5 => Some(76),
+        KeyCode::Numpad6 => Some(77),
+        KeyCode::NumpadAdd => Some(78),
+        KeyCode::Numpad1 => Some(79),
+        KeyCode::Numpad2 => Some(80),
+        KeyCode::Numpad3 => Some(81),
+        KeyCode::Numpad0 => Some(82),
+        KeyCode::NumpadDecimal => Some(83),
+        KeyCode::Lang5 => Some(85),
+        KeyCode::IntlBackslash => Some(86),
+        KeyCode::F11 => Some(87),
+        KeyCode::F12 => Some(88),
+        KeyCode::IntlRo => Some(89),
+        KeyCode::Lang3 => Some(90),
+        KeyCode::Lang4 => Some(91),
+        KeyCode::Convert => Some(92),
+        KeyCode::KanaMode => Some(93),
+        KeyCode::NonConvert => Some(94),
+        KeyCode::NumpadEnter => Some(96),
+        KeyCode::ControlRight => Some(97),
+        KeyCode::NumpadDivide => Some(98),
+        KeyCode::PrintScreen => Some(99),
+        KeyCode::AltRight => Some(100),
+        KeyCode::Home => Some(102),
+        KeyCode::ArrowUp => Some(103),
+        KeyCode::PageUp => Some(104),
+        KeyCode::ArrowLeft => Some(105),
+        KeyCode::ArrowRight => Some(106),
+        KeyCode::End => Some(107),
+        KeyCode::ArrowDown => Some(108),
+        KeyCode::PageDown => Some(109),
+        KeyCode::Insert => Some(110),
+        KeyCode::Delete => Some(111),
+        KeyCode::AudioVolumeMute => Some(113),
+        KeyCode::AudioVolumeDown => Some(114),
+        KeyCode::AudioVolumeUp => Some(115),
+        KeyCode::NumpadEqual => Some(117),
+        KeyCode::Pause => Some(119),
+        KeyCode::NumpadComma => Some(121),
+        KeyCode::Lang1 => Some(122),
+        KeyCode::Lang2 => Some(123),
+        KeyCode::IntlYen => Some(124),
+        KeyCode::SuperLeft => Some(125),
+        KeyCode::SuperRight => Some(126),
+        KeyCode::ContextMenu => Some(127),
+        KeyCode::MediaTrackNext => Some(163),
+        KeyCode::MediaPlayPause => Some(164),
+        KeyCode::MediaTrackPrevious => Some(165),
+        KeyCode::MediaStop => Some(166),
+        KeyCode::F13 => Some(183),
+        KeyCode::F14 => Some(184),
+        KeyCode::F15 => Some(185),
+        KeyCode::F16 => Some(186),
+        KeyCode::F17 => Some(187),
+        KeyCode::F18 => Some(188),
+        KeyCode::F19 => Some(189),
+        KeyCode::F20 => Some(190),
+        KeyCode::F21 => Some(191),
+        KeyCode::F22 => Some(192),
+        KeyCode::F23 => Some(193),
+        KeyCode::F24 => Some(194),
+        _ => None,
+    }
+}
+
+pub fn keysym_to_key(keysym: u32) -> Key {
+    use xkbcommon_dl::keysyms;
+    Key::Named(match keysym {
+        // TTY function keys
+        keysyms::BackSpace => NamedKey::Backspace,
+        keysyms::Tab => NamedKey::Tab,
+        // keysyms::Linefeed => NamedKey::Linefeed,
+        keysyms::Clear => NamedKey::Clear,
+        keysyms::Return => NamedKey::Enter,
+        keysyms::Pause => NamedKey::Pause,
+        keysyms::Scroll_Lock => NamedKey::ScrollLock,
+        keysyms::Sys_Req => NamedKey::PrintScreen,
+        keysyms::Escape => NamedKey::Escape,
+        keysyms::Delete => NamedKey::Delete,
+
+        // IME keys
+        keysyms::Multi_key => NamedKey::Compose,
+        keysyms::Codeinput => NamedKey::CodeInput,
+        keysyms::SingleCandidate => NamedKey::SingleCandidate,
+        keysyms::MultipleCandidate => NamedKey::AllCandidates,
+        keysyms::PreviousCandidate => NamedKey::PreviousCandidate,
+
+        // Japanese keys
+        keysyms::Kanji => NamedKey::KanjiMode,
+        keysyms::Muhenkan => NamedKey::NonConvert,
+        keysyms::Henkan_Mode => NamedKey::Convert,
+        keysyms::Romaji => NamedKey::Romaji,
+        keysyms::Hiragana => NamedKey::Hiragana,
+        keysyms::Hiragana_Katakana => NamedKey::HiraganaKatakana,
+        keysyms::Zenkaku => NamedKey::Zenkaku,
+        keysyms::Hankaku => NamedKey::Hankaku,
+        keysyms::Zenkaku_Hankaku => NamedKey::ZenkakuHankaku,
+        // keysyms::Touroku => NamedKey::Touroku,
+        // keysyms::Massyo => NamedKey::Massyo,
+        keysyms::Kana_Lock => NamedKey::KanaMode,
+        keysyms::Kana_Shift => NamedKey::KanaMode,
+        keysyms::Eisu_Shift => NamedKey::Alphanumeric,
+        keysyms::Eisu_toggle => NamedKey::Alphanumeric,
+        // NOTE: The next three items are aliases for values we've already mapped.
+        // keysyms::Kanji_Bangou => NamedKey::CodeInput,
+        // keysyms::Zen_Koho => NamedKey::AllCandidates,
+        // keysyms::Mae_Koho => NamedKey::PreviousCandidate,
+
+        // Cursor control & motion
+        keysyms::Home => NamedKey::Home,
+        keysyms::Left => NamedKey::ArrowLeft,
+        keysyms::Up => NamedKey::ArrowUp,
+        keysyms::Right => NamedKey::ArrowRight,
+        keysyms::Down => NamedKey::ArrowDown,
+        // keysyms::Prior => NamedKey::PageUp,
+        keysyms::Page_Up => NamedKey::PageUp,
+        // keysyms::Next => NamedKey::PageDown,
+        keysyms::Page_Down => NamedKey::PageDown,
+        keysyms::End => NamedKey::End,
+        // keysyms::Begin => NamedKey::Begin,
+
+        // Misc. functions
+        keysyms::Select => NamedKey::Select,
+        keysyms::Print => NamedKey::PrintScreen,
+        keysyms::Execute => NamedKey::Execute,
+        keysyms::Insert => NamedKey::Insert,
+        keysyms::Undo => NamedKey::Undo,
+        keysyms::Redo => NamedKey::Redo,
+        keysyms::Menu => NamedKey::ContextMenu,
+        keysyms::Find => NamedKey::Find,
+        keysyms::Cancel => NamedKey::Cancel,
+        keysyms::Help => NamedKey::Help,
+        keysyms::Break => NamedKey::Pause,
+        keysyms::Mode_switch => NamedKey::ModeChange,
+        // keysyms::script_switch => NamedKey::ModeChange,
+        keysyms::Num_Lock => NamedKey::NumLock,
+
+        // Keypad keys
+        // keysyms::KP_Space => return Key::Character(" "),
+        keysyms::KP_Tab => NamedKey::Tab,
+        keysyms::KP_Enter => NamedKey::Enter,
+        keysyms::KP_F1 => NamedKey::F1,
+        keysyms::KP_F2 => NamedKey::F2,
+        keysyms::KP_F3 => NamedKey::F3,
+        keysyms::KP_F4 => NamedKey::F4,
+        keysyms::KP_Home => NamedKey::Home,
+        keysyms::KP_Left => NamedKey::ArrowLeft,
+        keysyms::KP_Up => NamedKey::ArrowUp,
+        keysyms::KP_Right => NamedKey::ArrowRight,
+        keysyms::KP_Down => NamedKey::ArrowDown,
+        // keysyms::KP_Prior => NamedKey::PageUp,
+        keysyms::KP_Page_Up => NamedKey::PageUp,
+        // keysyms::KP_Next => NamedKey::PageDown,
+        keysyms::KP_Page_Down => NamedKey::PageDown,
+        keysyms::KP_End => NamedKey::End,
+        // This is the key labeled "5" on the numpad when NumLock is off.
+        // keysyms::KP_Begin => NamedKey::Begin,
+        keysyms::KP_Insert => NamedKey::Insert,
+        keysyms::KP_Delete => NamedKey::Delete,
+        // keysyms::KP_Equal => NamedKey::Equal,
+        // keysyms::KP_Multiply => NamedKey::Multiply,
+        // keysyms::KP_Add => NamedKey::Add,
+        // keysyms::KP_Separator => NamedKey::Separator,
+        // keysyms::KP_Subtract => NamedKey::Subtract,
+        // keysyms::KP_Decimal => NamedKey::Decimal,
+        // keysyms::KP_Divide => NamedKey::Divide,
+
+        // keysyms::KP_0 => return Key::Character("0"),
+        // keysyms::KP_1 => return Key::Character("1"),
+        // keysyms::KP_2 => return Key::Character("2"),
+        // keysyms::KP_3 => return Key::Character("3"),
+        // keysyms::KP_4 => return Key::Character("4"),
+        // keysyms::KP_5 => return Key::Character("5"),
+        // keysyms::KP_6 => return Key::Character("6"),
+        // keysyms::KP_7 => return Key::Character("7"),
+        // keysyms::KP_8 => return Key::Character("8"),
+        // keysyms::KP_9 => return Key::Character("9"),
+
+        // Function keys
+        keysyms::F1 => NamedKey::F1,
+        keysyms::F2 => NamedKey::F2,
+        keysyms::F3 => NamedKey::F3,
+        keysyms::F4 => NamedKey::F4,
+        keysyms::F5 => NamedKey::F5,
+        keysyms::F6 => NamedKey::F6,
+        keysyms::F7 => NamedKey::F7,
+        keysyms::F8 => NamedKey::F8,
+        keysyms::F9 => NamedKey::F9,
+        keysyms::F10 => NamedKey::F10,
+        keysyms::F11 => NamedKey::F11,
+        keysyms::F12 => NamedKey::F12,
+        keysyms::F13 => NamedKey::F13,
+        keysyms::F14 => NamedKey::F14,
+        keysyms::F15 => NamedKey::F15,
+        keysyms::F16 => NamedKey::F16,
+        keysyms::F17 => NamedKey::F17,
+        keysyms::F18 => NamedKey::F18,
+        keysyms::F19 => NamedKey::F19,
+        keysyms::F20 => NamedKey::F20,
+        keysyms::F21 => NamedKey::F21,
+        keysyms::F22 => NamedKey::F22,
+        keysyms::F23 => NamedKey::F23,
+        keysyms::F24 => NamedKey::F24,
+        keysyms::F25 => NamedKey::F25,
+        keysyms::F26 => NamedKey::F26,
+        keysyms::F27 => NamedKey::F27,
+        keysyms::F28 => NamedKey::F28,
+        keysyms::F29 => NamedKey::F29,
+        keysyms::F30 => NamedKey::F30,
+        keysyms::F31 => NamedKey::F31,
+        keysyms::F32 => NamedKey::F32,
+        keysyms::F33 => NamedKey::F33,
+        keysyms::F34 => NamedKey::F34,
+        keysyms::F35 => NamedKey::F35,
+
+        // Modifiers
+        keysyms::Shift_L => NamedKey::Shift,
+        keysyms::Shift_R => NamedKey::Shift,
+        keysyms::Control_L => NamedKey::Control,
+        keysyms::Control_R => NamedKey::Control,
+        keysyms::Caps_Lock => NamedKey::CapsLock,
+        // keysyms::Shift_Lock => NamedKey::ShiftLock,
+
+        // keysyms::Meta_L => NamedKey::Meta,
+        // keysyms::Meta_R => NamedKey::Meta,
+        keysyms::Alt_L => NamedKey::Alt,
+        keysyms::Alt_R => NamedKey::Alt,
+        keysyms::Super_L => NamedKey::Super,
+        keysyms::Super_R => NamedKey::Super,
+        keysyms::Hyper_L => NamedKey::Hyper,
+        keysyms::Hyper_R => NamedKey::Hyper,
+
+        // XKB function and modifier keys
+        // keysyms::ISO_Lock => NamedKey::IsoLock,
+        // keysyms::ISO_Level2_Latch => NamedKey::IsoLevel2Latch,
+        keysyms::ISO_Level3_Shift => NamedKey::AltGraph,
+        keysyms::ISO_Level3_Latch => NamedKey::AltGraph,
+        keysyms::ISO_Level3_Lock => NamedKey::AltGraph,
+        // keysyms::ISO_Level5_Shift => NamedKey::IsoLevel5Shift,
+        // keysyms::ISO_Level5_Latch => NamedKey::IsoLevel5Latch,
+        // keysyms::ISO_Level5_Lock => NamedKey::IsoLevel5Lock,
+        // keysyms::ISO_Group_Shift => NamedKey::IsoGroupShift,
+        // keysyms::ISO_Group_Latch => NamedKey::IsoGroupLatch,
+        // keysyms::ISO_Group_Lock => NamedKey::IsoGroupLock,
+        keysyms::ISO_Next_Group => NamedKey::GroupNext,
+        // keysyms::ISO_Next_Group_Lock => NamedKey::GroupNextLock,
+        keysyms::ISO_Prev_Group => NamedKey::GroupPrevious,
+        // keysyms::ISO_Prev_Group_Lock => NamedKey::GroupPreviousLock,
+        keysyms::ISO_First_Group => NamedKey::GroupFirst,
+        // keysyms::ISO_First_Group_Lock => NamedKey::GroupFirstLock,
+        keysyms::ISO_Last_Group => NamedKey::GroupLast,
+        // keysyms::ISO_Last_Group_Lock => NamedKey::GroupLastLock,
+        keysyms::ISO_Left_Tab => NamedKey::Tab,
+        // keysyms::ISO_Move_Line_Up => NamedKey::IsoMoveLineUp,
+        // keysyms::ISO_Move_Line_Down => NamedKey::IsoMoveLineDown,
+        // keysyms::ISO_Partial_Line_Up => NamedKey::IsoPartialLineUp,
+        // keysyms::ISO_Partial_Line_Down => NamedKey::IsoPartialLineDown,
+        // keysyms::ISO_Partial_Space_Left => NamedKey::IsoPartialSpaceLeft,
+        // keysyms::ISO_Partial_Space_Right => NamedKey::IsoPartialSpaceRight,
+        // keysyms::ISO_Set_Margin_Left => NamedKey::IsoSetMarginLeft,
+        // keysyms::ISO_Set_Margin_Right => NamedKey::IsoSetMarginRight,
+        // keysyms::ISO_Release_Margin_Left => NamedKey::IsoReleaseMarginLeft,
+        // keysyms::ISO_Release_Margin_Right => NamedKey::IsoReleaseMarginRight,
+        // keysyms::ISO_Release_Both_Margins => NamedKey::IsoReleaseBothMargins,
+        // keysyms::ISO_Fast_Cursor_Left => NamedKey::IsoFastCursorLeft,
+        // keysyms::ISO_Fast_Cursor_Right => NamedKey::IsoFastCursorRight,
+        // keysyms::ISO_Fast_Cursor_Up => NamedKey::IsoFastCursorUp,
+        // keysyms::ISO_Fast_Cursor_Down => NamedKey::IsoFastCursorDown,
+        // keysyms::ISO_Continuous_Underline => NamedKey::IsoContinuousUnderline,
+        // keysyms::ISO_Discontinuous_Underline => NamedKey::IsoDiscontinuousUnderline,
+        // keysyms::ISO_Emphasize => NamedKey::IsoEmphasize,
+        // keysyms::ISO_Center_Object => NamedKey::IsoCenterObject,
+        keysyms::ISO_Enter => NamedKey::Enter,
+
+        // dead_grave..dead_currency
+
+        // dead_lowline..dead_longsolidusoverlay
+
+        // dead_a..dead_capital_schwa
+
+        // dead_greek
+
+        // First_Virtual_Screen..Terminate_Server
+
+        // AccessX_Enable..AudibleBell_Enable
+
+        // Pointer_Left..Pointer_Drag5
+
+        // Pointer_EnableKeys..Pointer_DfltBtnPrev
+
+        // ch..C_H
+
+        // 3270 terminal keys
+        // keysyms::3270_Duplicate => NamedKey::Duplicate,
+        // keysyms::3270_FieldMark => NamedKey::FieldMark,
+        // keysyms::3270_Right2 => NamedKey::Right2,
+        // keysyms::3270_Left2 => NamedKey::Left2,
+        // keysyms::3270_BackTab => NamedKey::BackTab,
+        keysyms::_3270_EraseEOF => NamedKey::EraseEof,
+        // keysyms::3270_EraseInput => NamedKey::EraseInput,
+        // keysyms::3270_Reset => NamedKey::Reset,
+        // keysyms::3270_Quit => NamedKey::Quit,
+        // keysyms::3270_PA1 => NamedKey::Pa1,
+        // keysyms::3270_PA2 => NamedKey::Pa2,
+        // keysyms::3270_PA3 => NamedKey::Pa3,
+        // keysyms::3270_Test => NamedKey::Test,
+        keysyms::_3270_Attn => NamedKey::Attn,
+        // keysyms::3270_CursorBlink => NamedKey::CursorBlink,
+        // keysyms::3270_AltCursor => NamedKey::AltCursor,
+        // keysyms::3270_KeyClick => NamedKey::KeyClick,
+        // keysyms::3270_Jump => NamedKey::Jump,
+        // keysyms::3270_Ident => NamedKey::Ident,
+        // keysyms::3270_Rule => NamedKey::Rule,
+        // keysyms::3270_Copy => NamedKey::Copy,
+        keysyms::_3270_Play => NamedKey::Play,
+        // keysyms::3270_Setup => NamedKey::Setup,
+        // keysyms::3270_Record => NamedKey::Record,
+        // keysyms::3270_ChangeScreen => NamedKey::ChangeScreen,
+        // keysyms::3270_DeleteWord => NamedKey::DeleteWord,
+        keysyms::_3270_ExSelect => NamedKey::ExSel,
+        keysyms::_3270_CursorSelect => NamedKey::CrSel,
+        keysyms::_3270_PrintScreen => NamedKey::PrintScreen,
+        keysyms::_3270_Enter => NamedKey::Enter,
+
+        keysyms::space => NamedKey::Space,
+        // exclam..Sinh_kunddaliya
+
+        // XFree86
+        // keysyms::XF86_ModeLock => NamedKey::ModeLock,
+
+        // XFree86 - Backlight controls
+        keysyms::XF86_MonBrightnessUp => NamedKey::BrightnessUp,
+        keysyms::XF86_MonBrightnessDown => NamedKey::BrightnessDown,
+        // keysyms::XF86_KbdLightOnOff => NamedKey::LightOnOff,
+        // keysyms::XF86_KbdBrightnessUp => NamedKey::KeyboardBrightnessUp,
+        // keysyms::XF86_KbdBrightnessDown => NamedKey::KeyboardBrightnessDown,
+
+        // XFree86 - "Internet"
+        keysyms::XF86_Standby => NamedKey::Standby,
+        keysyms::XF86_AudioLowerVolume => NamedKey::AudioVolumeDown,
+        keysyms::XF86_AudioRaiseVolume => NamedKey::AudioVolumeUp,
+        keysyms::XF86_AudioPlay => NamedKey::MediaPlay,
+        keysyms::XF86_AudioStop => NamedKey::MediaStop,
+        keysyms::XF86_AudioPrev => NamedKey::MediaTrackPrevious,
+        keysyms::XF86_AudioNext => NamedKey::MediaTrackNext,
+        keysyms::XF86_HomePage => NamedKey::BrowserHome,
+        keysyms::XF86_Mail => NamedKey::LaunchMail,
+        // keysyms::XF86_Start => NamedKey::Start,
+        keysyms::XF86_Search => NamedKey::BrowserSearch,
+        keysyms::XF86_AudioRecord => NamedKey::MediaRecord,
+
+        // XFree86 - PDA
+        keysyms::XF86_Calculator => NamedKey::LaunchApplication2,
+        // keysyms::XF86_Memo => NamedKey::Memo,
+        // keysyms::XF86_ToDoList => NamedKey::ToDoList,
+        keysyms::XF86_Calendar => NamedKey::LaunchCalendar,
+        keysyms::XF86_PowerDown => NamedKey::Power,
+        // keysyms::XF86_ContrastAdjust => NamedKey::AdjustContrast,
+        // keysyms::XF86_RockerUp => NamedKey::RockerUp,
+        // keysyms::XF86_RockerDown => NamedKey::RockerDown,
+        // keysyms::XF86_RockerEnter => NamedKey::RockerEnter,
+
+        // XFree86 - More "Internet"
+        keysyms::XF86_Back => NamedKey::BrowserBack,
+        keysyms::XF86_Forward => NamedKey::BrowserForward,
+        // keysyms::XF86_Stop => NamedKey::Stop,
+        keysyms::XF86_Refresh => NamedKey::BrowserRefresh,
+        keysyms::XF86_PowerOff => NamedKey::Power,
+        keysyms::XF86_WakeUp => NamedKey::WakeUp,
+        keysyms::XF86_Eject => NamedKey::Eject,
+        keysyms::XF86_ScreenSaver => NamedKey::LaunchScreenSaver,
+        keysyms::XF86_WWW => NamedKey::LaunchWebBrowser,
+        keysyms::XF86_Sleep => NamedKey::Standby,
+        keysyms::XF86_Favorites => NamedKey::BrowserFavorites,
+        keysyms::XF86_AudioPause => NamedKey::MediaPause,
+        // keysyms::XF86_AudioMedia => NamedKey::AudioMedia,
+        keysyms::XF86_MyComputer => NamedKey::LaunchApplication1,
+        // keysyms::XF86_VendorHome => NamedKey::VendorHome,
+        // keysyms::XF86_LightBulb => NamedKey::LightBulb,
+        // keysyms::XF86_Shop => NamedKey::BrowserShop,
+        // keysyms::XF86_History => NamedKey::BrowserHistory,
+        // keysyms::XF86_OpenURL => NamedKey::OpenUrl,
+        // keysyms::XF86_AddFavorite => NamedKey::AddFavorite,
+        // keysyms::XF86_HotLinks => NamedKey::HotLinks,
+        // keysyms::XF86_BrightnessAdjust => NamedKey::BrightnessAdjust,
+        // keysyms::XF86_Finance => NamedKey::BrowserFinance,
+        // keysyms::XF86_Community => NamedKey::BrowserCommunity,
+        keysyms::XF86_AudioRewind => NamedKey::MediaRewind,
+        // keysyms::XF86_BackForward => Key::???,
+        // XF86_Launch0..XF86_LaunchF
+
+        // XF86_ApplicationLeft..XF86_CD
+        keysyms::XF86_Calculater => NamedKey::LaunchApplication2, // Nice typo, libxkbcommon :)
+        // XF86_Clear
+        keysyms::XF86_Close => NamedKey::Close,
+        keysyms::XF86_Copy => NamedKey::Copy,
+        keysyms::XF86_Cut => NamedKey::Cut,
+        // XF86_Display..XF86_Documents
+        keysyms::XF86_Excel => NamedKey::LaunchSpreadsheet,
+        // XF86_Explorer..XF86iTouch
+        keysyms::XF86_LogOff => NamedKey::LogOff,
+        // XF86_Market..XF86_MenuPB
+        keysyms::XF86_MySites => NamedKey::BrowserFavorites,
+        keysyms::XF86_New => NamedKey::New,
+        // XF86_News..XF86_OfficeHome
+        keysyms::XF86_Open => NamedKey::Open,
+        // XF86_Option
+        keysyms::XF86_Paste => NamedKey::Paste,
+        keysyms::XF86_Phone => NamedKey::LaunchPhone,
+        // XF86_Q
+        keysyms::XF86_Reply => NamedKey::MailReply,
+        keysyms::XF86_Reload => NamedKey::BrowserRefresh,
+        // XF86_RotateWindows..XF86_RotationKB
+        keysyms::XF86_Save => NamedKey::Save,
+        // XF86_ScrollUp..XF86_ScrollClick
+        keysyms::XF86_Send => NamedKey::MailSend,
+        keysyms::XF86_Spell => NamedKey::SpellCheck,
+        keysyms::XF86_SplitScreen => NamedKey::SplitScreenToggle,
+        // XF86_Support..XF86_User2KB
+        keysyms::XF86_Video => NamedKey::LaunchMediaPlayer,
+        // XF86_WheelButton
+        keysyms::XF86_Word => NamedKey::LaunchWordProcessor,
+        // XF86_Xfer
+        keysyms::XF86_ZoomIn => NamedKey::ZoomIn,
+        keysyms::XF86_ZoomOut => NamedKey::ZoomOut,
+
+        // XF86_Away..XF86_Messenger
+        keysyms::XF86_WebCam => NamedKey::LaunchWebCam,
+        keysyms::XF86_MailForward => NamedKey::MailForward,
+        // XF86_Pictures
+        keysyms::XF86_Music => NamedKey::LaunchMusicPlayer,
+
+        // XF86_Battery..XF86_UWB
+        keysyms::XF86_AudioForward => NamedKey::MediaFastForward,
+        // XF86_AudioRepeat
+        keysyms::XF86_AudioRandomPlay => NamedKey::RandomToggle,
+        keysyms::XF86_Subtitle => NamedKey::Subtitle,
+        keysyms::XF86_AudioCycleTrack => NamedKey::MediaAudioTrack,
+        // XF86_CycleAngle..XF86_Blue
+        keysyms::XF86_Suspend => NamedKey::Standby,
+        keysyms::XF86_Hibernate => NamedKey::Hibernate,
+        // XF86_TouchpadToggle..XF86_TouchpadOff
+        keysyms::XF86_AudioMute => NamedKey::AudioVolumeMute,
+
+        // XF86_Switch_VT_1..XF86_Switch_VT_12
+
+        // XF86_Ungrab..XF86_ClearGrab
+        keysyms::XF86_Next_VMode => NamedKey::VideoModeNext,
+        // keysyms::XF86_Prev_VMode => NamedKey::VideoModePrevious,
+        // XF86_LogWindowTree..XF86_LogGrabInfo
+
+        // SunFA_Grave..SunFA_Cedilla
+
+        // keysyms::SunF36 => NamedKey::F36 | NamedKey::F11,
+        // keysyms::SunF37 => NamedKey::F37 | NamedKey::F12,
+
+        // keysyms::SunSys_Req => NamedKey::PrintScreen,
+        // The next couple of xkb (until SunStop) are already handled.
+        // SunPrint_Screen..SunPageDown
+
+        // SunUndo..SunFront
+        keysyms::SUN_Copy => NamedKey::Copy,
+        keysyms::SUN_Open => NamedKey::Open,
+        keysyms::SUN_Paste => NamedKey::Paste,
+        keysyms::SUN_Cut => NamedKey::Cut,
+
+        // SunPowerSwitch
+        keysyms::SUN_AudioLowerVolume => NamedKey::AudioVolumeDown,
+        keysyms::SUN_AudioMute => NamedKey::AudioVolumeMute,
+        keysyms::SUN_AudioRaiseVolume => NamedKey::AudioVolumeUp,
+        // SUN_VideoDegauss
+        keysyms::SUN_VideoLowerBrightness => NamedKey::BrightnessDown,
+        keysyms::SUN_VideoRaiseBrightness => NamedKey::BrightnessUp,
+        // SunPowerSwitchShift
+        0 => return Key::Unidentified(NativeKey::Unidentified),
+        _ => return Key::Unidentified(NativeKey::Xkb(keysym)),
+    })
+}
+
+pub fn keysym_location(keysym: u32) -> KeyLocation {
+    use xkbcommon_dl::keysyms;
+    match keysym {
+        keysyms::Shift_L
+        | keysyms::Control_L
+        | keysyms::Meta_L
+        | keysyms::Alt_L
+        | keysyms::Super_L
+        | keysyms::Hyper_L => KeyLocation::Left,
+        keysyms::Shift_R
+        | keysyms::Control_R
+        | keysyms::Meta_R
+        | keysyms::Alt_R
+        | keysyms::Super_R
+        | keysyms::Hyper_R => KeyLocation::Right,
+        keysyms::KP_0
+        | keysyms::KP_1
+        | keysyms::KP_2
+        | keysyms::KP_3
+        | keysyms::KP_4
+        | keysyms::KP_5
+        | keysyms::KP_6
+        | keysyms::KP_7
+        | keysyms::KP_8
+        | keysyms::KP_9
+        | keysyms::KP_Space
+        | keysyms::KP_Tab
+        | keysyms::KP_Enter
+        | keysyms::KP_F1
+        | keysyms::KP_F2
+        | keysyms::KP_F3
+        | keysyms::KP_F4
+        | keysyms::KP_Home
+        | keysyms::KP_Left
+        | keysyms::KP_Up
+        | keysyms::KP_Right
+        | keysyms::KP_Down
+        | keysyms::KP_Page_Up
+        | keysyms::KP_Page_Down
+        | keysyms::KP_End
+        | keysyms::KP_Begin
+        | keysyms::KP_Insert
+        | keysyms::KP_Delete
+        | keysyms::KP_Equal
+        | keysyms::KP_Multiply
+        | keysyms::KP_Add
+        | keysyms::KP_Separator
+        | keysyms::KP_Subtract
+        | keysyms::KP_Decimal
+        | keysyms::KP_Divide => KeyLocation::Numpad,
+        _ => KeyLocation::Standard,
+    }
+}
+
+#[derive(Debug)]
+pub struct XkbKeymap {
+    keymap: NonNull<xkb_keymap>,
+    _mods_indices: ModsIndices,
+    pub _core_keyboard_id: i32,
+}
+
+impl XkbKeymap {
+    #[cfg(wayland_platform)]
+    pub fn from_fd(context: &XkbContext, fd: OwnedFd, size: usize) -> Option<Self> {
+        let map = unsafe { MmapOptions::new().len(size).map_copy_read_only(&fd).ok()? };
+
+        let keymap = unsafe {
+            let keymap = (XKBH.xkb_keymap_new_from_string)(
+                (*context).as_ptr(),
+                map.as_ptr() as *const _,
+                xkb::xkb_keymap_format::XKB_KEYMAP_FORMAT_TEXT_V1,
+                xkb_keymap_compile_flags::XKB_KEYMAP_COMPILE_NO_FLAGS,
+            );
+            NonNull::new(keymap)?
+        };
+
+        Some(Self::new_inner(keymap, 0))
+    }
+
+    #[cfg(x11_platform)]
+    pub fn from_x11_keymap(
+        context: &XkbContext,
+        xcb: *mut xcb_connection_t,
+        core_keyboard_id: i32,
+    ) -> Option<Self> {
+        let keymap = unsafe {
+            (XKBXH.xkb_x11_keymap_new_from_device)(
+                context.as_ptr(),
+                xcb,
+                core_keyboard_id,
+                xkb_keymap_compile_flags::XKB_KEYMAP_COMPILE_NO_FLAGS,
+            )
+        };
+        let keymap = NonNull::new(keymap)?;
+        Some(Self::new_inner(keymap, core_keyboard_id))
+    }
+
+    fn new_inner(keymap: NonNull<xkb_keymap>, _core_keyboard_id: i32) -> Self {
+        let mods_indices = ModsIndices {
+            shift: mod_index_for_name(keymap, xkb::XKB_MOD_NAME_SHIFT),
+            caps: mod_index_for_name(keymap, xkb::XKB_MOD_NAME_CAPS),
+            ctrl: mod_index_for_name(keymap, xkb::XKB_MOD_NAME_CTRL),
+            alt: mod_index_for_name(keymap, xkb::XKB_MOD_NAME_ALT),
+            num: mod_index_for_name(keymap, xkb::XKB_MOD_NAME_NUM),
+            mod3: mod_index_for_name(keymap, b"Mod3\0"),
+            logo: mod_index_for_name(keymap, xkb::XKB_MOD_NAME_LOGO),
+            mod5: mod_index_for_name(keymap, b"Mod5\0"),
+        };
+
+        Self { keymap, _mods_indices: mods_indices, _core_keyboard_id }
+    }
+
+    #[cfg(x11_platform)]
+    pub fn mods_indices(&self) -> ModsIndices {
+        self._mods_indices
+    }
+
+    pub fn first_keysym_by_level(
+        &mut self,
+        layout: xkb_layout_index_t,
+        keycode: xkb_keycode_t,
+    ) -> xkb_keysym_t {
+        unsafe {
+            let mut keysyms = ptr::null();
+            let count = (XKBH.xkb_keymap_key_get_syms_by_level)(
+                self.keymap.as_ptr(),
+                keycode,
+                layout,
+                // NOTE: The level should be zero to ignore modifiers.
+                0,
+                &mut keysyms,
+            );
+
+            if count == 1 {
+                *keysyms
+            } else {
+                0
+            }
+        }
+    }
+
+    /// Check whether the given key repeats.
+    pub fn key_repeats(&mut self, keycode: xkb_keycode_t) -> bool {
+        unsafe { (XKBH.xkb_keymap_key_repeats)(self.keymap.as_ptr(), keycode) == 1 }
+    }
+}
+
+impl Drop for XkbKeymap {
+    fn drop(&mut self) {
+        unsafe {
+            (XKBH.xkb_keymap_unref)(self.keymap.as_ptr());
+        };
+    }
+}
+
+impl Deref for XkbKeymap {
+    type Target = NonNull<xkb_keymap>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.keymap
+    }
+}
+
+/// Modifier index in the keymap.
+#[cfg_attr(not(x11_platform), allow(dead_code))]
+#[derive(Default, Debug, Clone, Copy)]
+pub struct ModsIndices {
+    pub shift: Option<xkb_mod_index_t>,
+    pub caps: Option<xkb_mod_index_t>,
+    pub ctrl: Option<xkb_mod_index_t>,
+    pub alt: Option<xkb_mod_index_t>,
+    pub num: Option<xkb_mod_index_t>,
+    pub mod3: Option<xkb_mod_index_t>,
+    pub logo: Option<xkb_mod_index_t>,
+    pub mod5: Option<xkb_mod_index_t>,
+}
+
+fn mod_index_for_name(keymap: NonNull<xkb_keymap>, name: &[u8]) -> Option<xkb_mod_index_t> {
+    unsafe {
+        let mod_index =
+            (XKBH.xkb_keymap_mod_get_index)(keymap.as_ptr(), name.as_ptr() as *const c_char);
+        if mod_index == XKB_MOD_INVALID {
+            None
+        } else {
+            Some(mod_index)
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/common/xkb/mod.rs b/vendor/winit/src/platform_impl/linux/common/xkb/mod.rs
new file mode 100644
index 00000000..706397f6
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/common/xkb/mod.rs
@@ -0,0 +1,416 @@
+use std::ops::Deref;
+use std::os::raw::c_char;
+use std::ptr::{self, NonNull};
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use crate::utils::Lazy;
+use smol_str::SmolStr;
+#[cfg(wayland_platform)]
+use std::os::unix::io::OwnedFd;
+use tracing::warn;
+use xkbcommon_dl::{
+    self as xkb, xkb_compose_status, xkb_context, xkb_context_flags, xkbcommon_compose_handle,
+    xkbcommon_handle, XkbCommon, XkbCommonCompose,
+};
+#[cfg(x11_platform)]
+use {x11_dl::xlib_xcb::xcb_connection_t, xkbcommon_dl::x11::xkbcommon_x11_handle};
+
+use crate::event::{ElementState, KeyEvent};
+use crate::keyboard::{Key, KeyLocation};
+use crate::platform_impl::KeyEventExtra;
+
+mod compose;
+mod keymap;
+mod state;
+
+use compose::{ComposeStatus, XkbComposeState, XkbComposeTable};
+use keymap::XkbKeymap;
+
+#[cfg(x11_platform)]
+pub use keymap::raw_keycode_to_physicalkey;
+pub use keymap::{physicalkey_to_scancode, scancode_to_physicalkey};
+pub use state::XkbState;
+
+// TODO: Wire this up without using a static `AtomicBool`.
+static RESET_DEAD_KEYS: AtomicBool = AtomicBool::new(false);
+
+static XKBH: Lazy<&'static XkbCommon> = Lazy::new(xkbcommon_handle);
+static XKBCH: Lazy<&'static XkbCommonCompose> = Lazy::new(xkbcommon_compose_handle);
+#[cfg(feature = "x11")]
+static XKBXH: Lazy<&'static xkb::x11::XkbCommonX11> = Lazy::new(xkbcommon_x11_handle);
+
+#[inline(always)]
+pub fn reset_dead_keys() {
+    RESET_DEAD_KEYS.store(true, Ordering::SeqCst);
+}
+
+#[derive(Debug)]
+pub enum Error {
+    /// libxkbcommon is not available
+    XKBNotFound,
+}
+
+#[derive(Debug)]
+pub struct Context {
+    // NOTE: field order matters.
+    #[cfg(x11_platform)]
+    pub core_keyboard_id: i32,
+    state: Option<XkbState>,
+    keymap: Option<XkbKeymap>,
+    compose_state1: Option<XkbComposeState>,
+    compose_state2: Option<XkbComposeState>,
+    _compose_table: Option<XkbComposeTable>,
+    context: XkbContext,
+    scratch_buffer: Vec<u8>,
+}
+
+impl Context {
+    pub fn new() -> Result<Self, Error> {
+        if xkb::xkbcommon_option().is_none() {
+            return Err(Error::XKBNotFound);
+        }
+
+        let context = XkbContext::new()?;
+        let mut compose_table = XkbComposeTable::new(&context);
+        let mut compose_state1 = compose_table.as_ref().and_then(|table| table.new_state());
+        let mut compose_state2 = compose_table.as_ref().and_then(|table| table.new_state());
+
+        // Disable compose if anything compose related failed to initialize.
+        if compose_table.is_none() || compose_state1.is_none() || compose_state2.is_none() {
+            compose_state2 = None;
+            compose_state1 = None;
+            compose_table = None;
+        }
+
+        Ok(Self {
+            state: None,
+            keymap: None,
+            compose_state1,
+            compose_state2,
+            #[cfg(x11_platform)]
+            core_keyboard_id: 0,
+            _compose_table: compose_table,
+            context,
+            scratch_buffer: Vec::with_capacity(8),
+        })
+    }
+
+    #[cfg(feature = "x11")]
+    pub fn from_x11_xkb(xcb: *mut xcb_connection_t) -> Result<Self, Error> {
+        let result = unsafe {
+            (XKBXH.xkb_x11_setup_xkb_extension)(
+                xcb,
+                1,
+                2,
+                xkbcommon_dl::x11::xkb_x11_setup_xkb_extension_flags::XKB_X11_SETUP_XKB_EXTENSION_NO_FLAGS,
+                ptr::null_mut(),
+                ptr::null_mut(),
+                ptr::null_mut(),
+                ptr::null_mut(),
+            )
+        };
+
+        if result != 1 {
+            return Err(Error::XKBNotFound);
+        }
+
+        let mut this = Self::new()?;
+        this.core_keyboard_id = unsafe { (XKBXH.xkb_x11_get_core_keyboard_device_id)(xcb) };
+        this.set_keymap_from_x11(xcb);
+        Ok(this)
+    }
+
+    pub fn state_mut(&mut self) -> Option<&mut XkbState> {
+        self.state.as_mut()
+    }
+
+    pub fn keymap_mut(&mut self) -> Option<&mut XkbKeymap> {
+        self.keymap.as_mut()
+    }
+
+    #[cfg(wayland_platform)]
+    pub fn set_keymap_from_fd(&mut self, fd: OwnedFd, size: usize) {
+        let keymap = XkbKeymap::from_fd(&self.context, fd, size);
+        let state = keymap.as_ref().and_then(XkbState::new_wayland);
+        if keymap.is_none() || state.is_none() {
+            warn!("failed to update xkb keymap");
+        }
+        self.state = state;
+        self.keymap = keymap;
+    }
+
+    #[cfg(x11_platform)]
+    pub fn set_keymap_from_x11(&mut self, xcb: *mut xcb_connection_t) {
+        let keymap = XkbKeymap::from_x11_keymap(&self.context, xcb, self.core_keyboard_id);
+        let state = keymap.as_ref().and_then(|keymap| XkbState::new_x11(xcb, keymap));
+        if keymap.is_none() || state.is_none() {
+            warn!("failed to update xkb keymap");
+        }
+        self.state = state;
+        self.keymap = keymap;
+    }
+
+    /// Key builder context with the user provided xkb state.
+    pub fn key_context(&mut self) -> Option<KeyContext<'_>> {
+        let state = self.state.as_mut()?;
+        let keymap = self.keymap.as_mut()?;
+        let compose_state1 = self.compose_state1.as_mut();
+        let compose_state2 = self.compose_state2.as_mut();
+        let scratch_buffer = &mut self.scratch_buffer;
+        Some(KeyContext { state, keymap, compose_state1, compose_state2, scratch_buffer })
+    }
+
+    /// Key builder context with the user provided xkb state.
+    ///
+    /// Should be used when the original context must not be altered.
+    #[cfg(x11_platform)]
+    pub fn key_context_with_state<'a>(
+        &'a mut self,
+        state: &'a mut XkbState,
+    ) -> Option<KeyContext<'a>> {
+        let keymap = self.keymap.as_mut()?;
+        let compose_state1 = self.compose_state1.as_mut();
+        let compose_state2 = self.compose_state2.as_mut();
+        let scratch_buffer = &mut self.scratch_buffer;
+        Some(KeyContext { state, keymap, compose_state1, compose_state2, scratch_buffer })
+    }
+}
+
+pub struct KeyContext<'a> {
+    pub state: &'a mut XkbState,
+    pub keymap: &'a mut XkbKeymap,
+    compose_state1: Option<&'a mut XkbComposeState>,
+    compose_state2: Option<&'a mut XkbComposeState>,
+    scratch_buffer: &'a mut Vec<u8>,
+}
+
+impl KeyContext<'_> {
+    pub fn process_key_event(
+        &mut self,
+        keycode: u32,
+        state: ElementState,
+        repeat: bool,
+    ) -> KeyEvent {
+        let mut event =
+            KeyEventResults::new(self, keycode, !repeat && state == ElementState::Pressed);
+        let physical_key = keymap::raw_keycode_to_physicalkey(keycode);
+        let (logical_key, location) = event.key();
+        let text = event.text();
+        let (key_without_modifiers, _) = event.key_without_modifiers();
+        let text_with_all_modifiers = event.text_with_all_modifiers();
+
+        let platform_specific = KeyEventExtra { text_with_all_modifiers, key_without_modifiers };
+
+        KeyEvent { physical_key, logical_key, text, location, state, repeat, platform_specific }
+    }
+
+    fn keysym_to_utf8_raw(&mut self, keysym: u32) -> Option<SmolStr> {
+        self.scratch_buffer.clear();
+        self.scratch_buffer.reserve(8);
+        loop {
+            let bytes_written = unsafe {
+                (XKBH.xkb_keysym_to_utf8)(
+                    keysym,
+                    self.scratch_buffer.as_mut_ptr().cast(),
+                    self.scratch_buffer.capacity(),
+                )
+            };
+            if bytes_written == 0 {
+                return None;
+            } else if bytes_written == -1 {
+                self.scratch_buffer.reserve(8);
+            } else {
+                unsafe { self.scratch_buffer.set_len(bytes_written.try_into().unwrap()) };
+                break;
+            }
+        }
+
+        // Remove the null-terminator
+        self.scratch_buffer.pop();
+        byte_slice_to_smol_str(self.scratch_buffer)
+    }
+}
+
+struct KeyEventResults<'a, 'b> {
+    context: &'a mut KeyContext<'b>,
+    keycode: u32,
+    keysym: u32,
+    compose: ComposeStatus,
+}
+
+impl<'a, 'b> KeyEventResults<'a, 'b> {
+    fn new(context: &'a mut KeyContext<'b>, keycode: u32, compose: bool) -> Self {
+        let keysym = context.state.get_one_sym_raw(keycode);
+
+        let compose = if let Some(state) = context.compose_state1.as_mut().filter(|_| compose) {
+            if RESET_DEAD_KEYS.swap(false, Ordering::SeqCst) {
+                state.reset();
+                context.compose_state2.as_mut().unwrap().reset();
+            }
+            state.feed(keysym)
+        } else {
+            ComposeStatus::None
+        };
+
+        KeyEventResults { context, keycode, keysym, compose }
+    }
+
+    pub fn key(&mut self) -> (Key, KeyLocation) {
+        let (key, location) = match self.keysym_to_key(self.keysym) {
+            Ok(known) => return known,
+            Err(undefined) => undefined,
+        };
+
+        if let ComposeStatus::Accepted(xkb_compose_status::XKB_COMPOSE_COMPOSING) = self.compose {
+            let compose_state = self.context.compose_state2.as_mut().unwrap();
+            // When pressing a dead key twice, the non-combining variant of that character will
+            // be produced. Since this function only concerns itself with a single keypress, we
+            // simulate this double press here by feeding the keysym to the compose state
+            // twice.
+
+            compose_state.feed(self.keysym);
+            if matches!(compose_state.feed(self.keysym), ComposeStatus::Accepted(_)) {
+                // Extracting only a single `char` here *should* be fine, assuming that no
+                // dead key's non-combining variant ever occupies more than one `char`.
+                let text = compose_state.get_string(self.context.scratch_buffer);
+                let key = Key::Dead(text.and_then(|s| s.chars().next()));
+                (key, location)
+            } else {
+                (key, location)
+            }
+        } else {
+            let key = self
+                .composed_text()
+                .unwrap_or_else(|_| self.context.keysym_to_utf8_raw(self.keysym))
+                .map(Key::Character)
+                .unwrap_or(key);
+            (key, location)
+        }
+    }
+
+    pub fn key_without_modifiers(&mut self) -> (Key, KeyLocation) {
+        // This will become a pointer to an array which libxkbcommon owns, so we don't need to
+        // deallocate it.
+        let layout = self.context.state.layout(self.keycode);
+        let keysym = self.context.keymap.first_keysym_by_level(layout, self.keycode);
+
+        match self.keysym_to_key(keysym) {
+            Ok((key, location)) => (key, location),
+            Err((key, location)) => {
+                let key =
+                    self.context.keysym_to_utf8_raw(keysym).map(Key::Character).unwrap_or(key);
+                (key, location)
+            },
+        }
+    }
+
+    fn keysym_to_key(&self, keysym: u32) -> Result<(Key, KeyLocation), (Key, KeyLocation)> {
+        let location = keymap::keysym_location(keysym);
+        let key = keymap::keysym_to_key(keysym);
+        if matches!(key, Key::Unidentified(_)) {
+            Err((key, location))
+        } else {
+            Ok((key, location))
+        }
+    }
+
+    pub fn text(&mut self) -> Option<SmolStr> {
+        self.composed_text().unwrap_or_else(|_| self.context.keysym_to_utf8_raw(self.keysym))
+    }
+
+    // The current behaviour makes it so composing a character overrides attempts to input a
+    // control character with the `Ctrl` key. We can potentially add a configuration option
+    // if someone specifically wants the opposite behaviour.
+    pub fn text_with_all_modifiers(&mut self) -> Option<SmolStr> {
+        match self.composed_text() {
+            Ok(text) => text,
+            Err(_) => self.context.state.get_utf8_raw(self.keycode, self.context.scratch_buffer),
+        }
+    }
+
+    fn composed_text(&mut self) -> Result<Option<SmolStr>, ()> {
+        match self.compose {
+            ComposeStatus::Accepted(status) => match status {
+                xkb_compose_status::XKB_COMPOSE_COMPOSED => {
+                    let state = self.context.compose_state1.as_mut().unwrap();
+                    Ok(state.get_string(self.context.scratch_buffer))
+                },
+                xkb_compose_status::XKB_COMPOSE_COMPOSING
+                | xkb_compose_status::XKB_COMPOSE_CANCELLED => Ok(None),
+                xkb_compose_status::XKB_COMPOSE_NOTHING => Err(()),
+            },
+            _ => Err(()),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct XkbContext {
+    context: NonNull<xkb_context>,
+}
+
+impl XkbContext {
+    pub fn new() -> Result<Self, Error> {
+        let context = unsafe { (XKBH.xkb_context_new)(xkb_context_flags::XKB_CONTEXT_NO_FLAGS) };
+
+        let context = match NonNull::new(context) {
+            Some(context) => context,
+            None => return Err(Error::XKBNotFound),
+        };
+
+        Ok(Self { context })
+    }
+}
+
+impl Drop for XkbContext {
+    fn drop(&mut self) {
+        unsafe {
+            (XKBH.xkb_context_unref)(self.context.as_ptr());
+        }
+    }
+}
+
+impl Deref for XkbContext {
+    type Target = NonNull<xkb_context>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.context
+    }
+}
+
+/// Shared logic for constructing a string with `xkb_compose_state_get_utf8` and
+/// `xkb_state_key_get_utf8`.
+fn make_string_with<F>(scratch_buffer: &mut Vec<u8>, mut f: F) -> Option<SmolStr>
+where
+    F: FnMut(*mut c_char, usize) -> i32,
+{
+    let size = f(ptr::null_mut(), 0);
+    if size == 0 {
+        return None;
+    }
+    let size = usize::try_from(size).unwrap();
+    scratch_buffer.clear();
+    // The allocated buffer must include space for the null-terminator.
+    scratch_buffer.reserve(size + 1);
+    unsafe {
+        let written = f(scratch_buffer.as_mut_ptr().cast(), scratch_buffer.capacity());
+        if usize::try_from(written).unwrap() != size {
+            // This will likely never happen.
+            return None;
+        }
+        scratch_buffer.set_len(size);
+    };
+
+    byte_slice_to_smol_str(scratch_buffer)
+}
+
+// NOTE: This is track_caller so we can have more informative line numbers when logging
+#[track_caller]
+fn byte_slice_to_smol_str(bytes: &[u8]) -> Option<SmolStr> {
+    std::str::from_utf8(bytes)
+        .map(SmolStr::new)
+        .map_err(|e| {
+            tracing::warn!("UTF-8 received from libxkbcommon ({:?}) was invalid: {e}", bytes)
+        })
+        .ok()
+}
diff --git a/vendor/winit/src/platform_impl/linux/common/xkb/state.rs b/vendor/winit/src/platform_impl/linux/common/xkb/state.rs
new file mode 100644
index 00000000..27c055aa
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/common/xkb/state.rs
@@ -0,0 +1,189 @@
+//! XKB state.
+
+use std::os::raw::c_char;
+use std::ptr::NonNull;
+
+use smol_str::SmolStr;
+#[cfg(x11_platform)]
+use x11_dl::xlib_xcb::xcb_connection_t;
+use xkbcommon_dl::{
+    self as xkb, xkb_keycode_t, xkb_keysym_t, xkb_layout_index_t, xkb_state, xkb_state_component,
+};
+
+use crate::platform_impl::common::xkb::keymap::XkbKeymap;
+#[cfg(x11_platform)]
+use crate::platform_impl::common::xkb::XKBXH;
+use crate::platform_impl::common::xkb::{make_string_with, XKBH};
+
+#[derive(Debug)]
+pub struct XkbState {
+    state: NonNull<xkb_state>,
+    modifiers: ModifiersState,
+}
+
+impl XkbState {
+    #[cfg(wayland_platform)]
+    pub fn new_wayland(keymap: &XkbKeymap) -> Option<Self> {
+        let state = NonNull::new(unsafe { (XKBH.xkb_state_new)(keymap.as_ptr()) })?;
+        Some(Self::new_inner(state))
+    }
+
+    #[cfg(x11_platform)]
+    pub fn new_x11(xcb: *mut xcb_connection_t, keymap: &XkbKeymap) -> Option<Self> {
+        let state = unsafe {
+            (XKBXH.xkb_x11_state_new_from_device)(keymap.as_ptr(), xcb, keymap._core_keyboard_id)
+        };
+        let state = NonNull::new(state)?;
+        Some(Self::new_inner(state))
+    }
+
+    fn new_inner(state: NonNull<xkb_state>) -> Self {
+        let modifiers = ModifiersState::default();
+        let mut this = Self { state, modifiers };
+        this.reload_modifiers();
+        this
+    }
+
+    pub fn get_one_sym_raw(&mut self, keycode: xkb_keycode_t) -> xkb_keysym_t {
+        unsafe { (XKBH.xkb_state_key_get_one_sym)(self.state.as_ptr(), keycode) }
+    }
+
+    pub fn layout(&mut self, key: xkb_keycode_t) -> xkb_layout_index_t {
+        unsafe { (XKBH.xkb_state_key_get_layout)(self.state.as_ptr(), key) }
+    }
+
+    #[cfg(x11_platform)]
+    pub fn depressed_modifiers(&mut self) -> xkb::xkb_mod_mask_t {
+        unsafe {
+            (XKBH.xkb_state_serialize_mods)(
+                self.state.as_ptr(),
+                xkb_state_component::XKB_STATE_MODS_DEPRESSED,
+            )
+        }
+    }
+
+    #[cfg(x11_platform)]
+    pub fn latched_modifiers(&mut self) -> xkb::xkb_mod_mask_t {
+        unsafe {
+            (XKBH.xkb_state_serialize_mods)(
+                self.state.as_ptr(),
+                xkb_state_component::XKB_STATE_MODS_LATCHED,
+            )
+        }
+    }
+
+    #[cfg(x11_platform)]
+    pub fn locked_modifiers(&mut self) -> xkb::xkb_mod_mask_t {
+        unsafe {
+            (XKBH.xkb_state_serialize_mods)(
+                self.state.as_ptr(),
+                xkb_state_component::XKB_STATE_MODS_LOCKED,
+            )
+        }
+    }
+
+    pub fn get_utf8_raw(
+        &mut self,
+        keycode: xkb_keycode_t,
+        scratch_buffer: &mut Vec<u8>,
+    ) -> Option<SmolStr> {
+        make_string_with(scratch_buffer, |ptr, len| unsafe {
+            (XKBH.xkb_state_key_get_utf8)(self.state.as_ptr(), keycode, ptr, len)
+        })
+    }
+
+    pub fn modifiers(&self) -> ModifiersState {
+        self.modifiers
+    }
+
+    pub fn update_modifiers(
+        &mut self,
+        mods_depressed: u32,
+        mods_latched: u32,
+        mods_locked: u32,
+        depressed_group: u32,
+        latched_group: u32,
+        locked_group: u32,
+    ) {
+        let mask = unsafe {
+            (XKBH.xkb_state_update_mask)(
+                self.state.as_ptr(),
+                mods_depressed,
+                mods_latched,
+                mods_locked,
+                depressed_group,
+                latched_group,
+                locked_group,
+            )
+        };
+
+        if mask.contains(xkb_state_component::XKB_STATE_MODS_EFFECTIVE) {
+            // Effective value of mods have changed, we need to update our state.
+            self.reload_modifiers();
+        }
+    }
+
+    /// Reload the modifiers.
+    fn reload_modifiers(&mut self) {
+        self.modifiers.ctrl = self.mod_name_is_active(xkb::XKB_MOD_NAME_CTRL);
+        self.modifiers.alt = self.mod_name_is_active(xkb::XKB_MOD_NAME_ALT);
+        self.modifiers.shift = self.mod_name_is_active(xkb::XKB_MOD_NAME_SHIFT);
+        self.modifiers.caps_lock = self.mod_name_is_active(xkb::XKB_MOD_NAME_CAPS);
+        self.modifiers.logo = self.mod_name_is_active(xkb::XKB_MOD_NAME_LOGO);
+        self.modifiers.num_lock = self.mod_name_is_active(xkb::XKB_MOD_NAME_NUM);
+    }
+
+    /// Check if the modifier is active within xkb.
+    fn mod_name_is_active(&mut self, name: &[u8]) -> bool {
+        unsafe {
+            (XKBH.xkb_state_mod_name_is_active)(
+                self.state.as_ptr(),
+                name.as_ptr() as *const c_char,
+                xkb_state_component::XKB_STATE_MODS_EFFECTIVE,
+            ) > 0
+        }
+    }
+}
+
+impl Drop for XkbState {
+    fn drop(&mut self) {
+        unsafe {
+            (XKBH.xkb_state_unref)(self.state.as_ptr());
+        }
+    }
+}
+
+/// Represents the current state of the keyboard modifiers
+///
+/// Each field of this struct represents a modifier and is `true` if this modifier is active.
+///
+/// For some modifiers, this means that the key is currently pressed, others are toggled
+/// (like caps lock).
+#[derive(Copy, Clone, Debug, Default, PartialEq, Eq)]
+pub struct ModifiersState {
+    /// The "control" key
+    pub ctrl: bool,
+    /// The "alt" key
+    pub alt: bool,
+    /// The "shift" key
+    pub shift: bool,
+    /// The "Caps lock" key
+    pub caps_lock: bool,
+    /// The "logo" key
+    ///
+    /// Also known as the "windows" key on most keyboards
+    pub logo: bool,
+    /// The "Num lock" key
+    pub num_lock: bool,
+}
+
+impl From<ModifiersState> for crate::keyboard::ModifiersState {
+    fn from(mods: ModifiersState) -> crate::keyboard::ModifiersState {
+        let mut to_mods = crate::keyboard::ModifiersState::empty();
+        to_mods.set(crate::keyboard::ModifiersState::SHIFT, mods.shift);
+        to_mods.set(crate::keyboard::ModifiersState::CONTROL, mods.ctrl);
+        to_mods.set(crate::keyboard::ModifiersState::ALT, mods.alt);
+        to_mods.set(crate::keyboard::ModifiersState::SUPER, mods.logo);
+        to_mods
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/mod.rs b/vendor/winit/src/platform_impl/linux/mod.rs
new file mode 100644
index 00000000..bc0e71c8
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/mod.rs
@@ -0,0 +1,1044 @@
+#![cfg(free_unix)]
+
+#[cfg(all(not(x11_platform), not(wayland_platform)))]
+compile_error!("Please select a feature to build for unix: `x11`, `wayland`");
+
+use std::collections::VecDeque;
+use std::os::unix::io::{AsFd, AsRawFd, BorrowedFd, RawFd};
+use std::sync::Arc;
+use std::time::Duration;
+use std::{env, fmt};
+#[cfg(x11_platform)]
+use std::{ffi::CStr, mem::MaybeUninit, os::raw::*, sync::Mutex};
+
+#[cfg(x11_platform)]
+use crate::utils::Lazy;
+use smol_str::SmolStr;
+
+#[cfg(x11_platform)]
+use self::x11::{X11Error, XConnection, XError, XNotSupported};
+use crate::dpi::{PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{EventLoopError, ExternalError, NotSupportedError, OsError as RootOsError};
+use crate::event_loop::{
+    ActiveEventLoop as RootELW, AsyncRequestSerial, ControlFlow, DeviceEvents, EventLoopClosed,
+};
+use crate::icon::Icon;
+use crate::keyboard::Key;
+use crate::platform::pump_events::PumpStatus;
+#[cfg(x11_platform)]
+use crate::platform::x11::{WindowType as XWindowType, XlibErrorHook};
+use crate::window::{
+    ActivationToken, Cursor, CursorGrabMode, CustomCursor, CustomCursorSource, ImePurpose,
+    ResizeDirection, Theme, UserAttentionType, WindowAttributes, WindowButtons, WindowLevel,
+};
+
+pub(crate) use self::common::xkb::{physicalkey_to_scancode, scancode_to_physicalkey};
+pub(crate) use crate::cursor::OnlyCursorImageSource as PlatformCustomCursorSource;
+pub(crate) use crate::icon::RgbaIcon as PlatformIcon;
+pub(crate) use crate::platform_impl::Fullscreen;
+
+pub(crate) mod common;
+#[cfg(wayland_platform)]
+pub(crate) mod wayland;
+#[cfg(x11_platform)]
+pub(crate) mod x11;
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) enum Backend {
+    #[cfg(x11_platform)]
+    X,
+    #[cfg(wayland_platform)]
+    Wayland,
+}
+
+#[derive(Debug, Default, Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) struct PlatformSpecificEventLoopAttributes {
+    pub(crate) forced_backend: Option<Backend>,
+    pub(crate) any_thread: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ApplicationName {
+    pub general: String,
+    pub instance: String,
+}
+
+impl ApplicationName {
+    pub fn new(general: String, instance: String) -> Self {
+        Self { general, instance }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct PlatformSpecificWindowAttributes {
+    pub name: Option<ApplicationName>,
+    pub activation_token: Option<ActivationToken>,
+    #[cfg(x11_platform)]
+    pub x11: X11WindowAttributes,
+}
+
+#[derive(Clone, Debug)]
+#[cfg(x11_platform)]
+pub struct X11WindowAttributes {
+    pub visual_id: Option<x11rb::protocol::xproto::Visualid>,
+    pub screen_id: Option<i32>,
+    pub base_size: Option<Size>,
+    pub override_redirect: bool,
+    pub x11_window_types: Vec<XWindowType>,
+
+    /// The parent window to embed this window into.
+    pub embed_window: Option<x11rb::protocol::xproto::Window>,
+}
+
+#[cfg_attr(not(x11_platform), allow(clippy::derivable_impls))]
+impl Default for PlatformSpecificWindowAttributes {
+    fn default() -> Self {
+        Self {
+            name: None,
+            activation_token: None,
+            #[cfg(x11_platform)]
+            x11: X11WindowAttributes {
+                visual_id: None,
+                screen_id: None,
+                base_size: None,
+                override_redirect: false,
+                x11_window_types: vec![XWindowType::Normal],
+                embed_window: None,
+            },
+        }
+    }
+}
+
+#[cfg(x11_platform)]
+pub(crate) static X11_BACKEND: Lazy<Mutex<Result<Arc<XConnection>, XNotSupported>>> =
+    Lazy::new(|| Mutex::new(XConnection::new(Some(x_error_callback)).map(Arc::new)));
+
+#[derive(Debug, Clone)]
+pub enum OsError {
+    Misc(&'static str),
+    #[cfg(x11_platform)]
+    XNotSupported(XNotSupported),
+    #[cfg(x11_platform)]
+    XError(Arc<X11Error>),
+    #[cfg(wayland_platform)]
+    WaylandError(Arc<wayland::WaylandError>),
+}
+
+impl fmt::Display for OsError {
+    fn fmt(&self, _f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        match *self {
+            OsError::Misc(e) => _f.pad(e),
+            #[cfg(x11_platform)]
+            OsError::XNotSupported(ref e) => fmt::Display::fmt(e, _f),
+            #[cfg(x11_platform)]
+            OsError::XError(ref e) => fmt::Display::fmt(e, _f),
+            #[cfg(wayland_platform)]
+            OsError::WaylandError(ref e) => fmt::Display::fmt(e, _f),
+        }
+    }
+}
+
+pub(crate) enum Window {
+    #[cfg(x11_platform)]
+    X(x11::Window),
+    #[cfg(wayland_platform)]
+    Wayland(wayland::Window),
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct WindowId(u64);
+
+impl From<WindowId> for u64 {
+    fn from(window_id: WindowId) -> Self {
+        window_id.0
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(raw_id: u64) -> Self {
+        Self(raw_id)
+    }
+}
+
+impl WindowId {
+    pub const fn dummy() -> Self {
+        Self(0)
+    }
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum DeviceId {
+    #[cfg(x11_platform)]
+    X(x11::DeviceId),
+    #[cfg(wayland_platform)]
+    Wayland(wayland::DeviceId),
+}
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        #[cfg(wayland_platform)]
+        return DeviceId::Wayland(wayland::DeviceId::dummy());
+        #[cfg(all(not(wayland_platform), x11_platform))]
+        return DeviceId::X(x11::DeviceId::dummy());
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub enum MonitorHandle {
+    #[cfg(x11_platform)]
+    X(x11::MonitorHandle),
+    #[cfg(wayland_platform)]
+    Wayland(wayland::MonitorHandle),
+}
+
+/// `x11_or_wayland!(match expr; Enum(foo) => foo.something())`
+/// expands to the equivalent of
+/// ```ignore
+/// match self {
+///    Enum::X(foo) => foo.something(),
+///    Enum::Wayland(foo) => foo.something(),
+/// }
+/// ```
+/// The result can be converted to another enum by adding `; as AnotherEnum`
+macro_rules! x11_or_wayland {
+    (match $what:expr; $enum:ident ( $($c1:tt)* ) => $x:expr; as $enum2:ident ) => {
+        match $what {
+            #[cfg(x11_platform)]
+            $enum::X($($c1)*) => $enum2::X($x),
+            #[cfg(wayland_platform)]
+            $enum::Wayland($($c1)*) => $enum2::Wayland($x),
+        }
+    };
+    (match $what:expr; $enum:ident ( $($c1:tt)* ) => $x:expr) => {
+        match $what {
+            #[cfg(x11_platform)]
+            $enum::X($($c1)*) => $x,
+            #[cfg(wayland_platform)]
+            $enum::Wayland($($c1)*) => $x,
+        }
+    };
+}
+
+impl MonitorHandle {
+    #[inline]
+    pub fn name(&self) -> Option<String> {
+        x11_or_wayland!(match self; MonitorHandle(m) => m.name())
+    }
+
+    #[inline]
+    pub fn native_identifier(&self) -> u32 {
+        x11_or_wayland!(match self; MonitorHandle(m) => m.native_identifier())
+    }
+
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        x11_or_wayland!(match self; MonitorHandle(m) => m.size())
+    }
+
+    #[inline]
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        x11_or_wayland!(match self; MonitorHandle(m) => m.position())
+    }
+
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        x11_or_wayland!(match self; MonitorHandle(m) => m.refresh_rate_millihertz())
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        x11_or_wayland!(match self; MonitorHandle(m) => m.scale_factor() as _)
+    }
+
+    #[inline]
+    pub fn video_modes(&self) -> Box<dyn Iterator<Item = VideoModeHandle>> {
+        x11_or_wayland!(match self; MonitorHandle(m) => Box::new(m.video_modes()))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum VideoModeHandle {
+    #[cfg(x11_platform)]
+    X(x11::VideoModeHandle),
+    #[cfg(wayland_platform)]
+    Wayland(wayland::VideoModeHandle),
+}
+
+impl VideoModeHandle {
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        x11_or_wayland!(match self; VideoModeHandle(m) => m.size())
+    }
+
+    #[inline]
+    pub fn bit_depth(&self) -> u16 {
+        x11_or_wayland!(match self; VideoModeHandle(m) => m.bit_depth())
+    }
+
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        x11_or_wayland!(match self; VideoModeHandle(m) => m.refresh_rate_millihertz())
+    }
+
+    #[inline]
+    pub fn monitor(&self) -> MonitorHandle {
+        x11_or_wayland!(match self; VideoModeHandle(m) => m.monitor(); as MonitorHandle)
+    }
+}
+
+impl Window {
+    #[inline]
+    pub(crate) fn new(
+        window_target: &ActiveEventLoop,
+        attribs: WindowAttributes,
+    ) -> Result<Self, RootOsError> {
+        match *window_target {
+            #[cfg(wayland_platform)]
+            ActiveEventLoop::Wayland(ref window_target) => {
+                wayland::Window::new(window_target, attribs).map(Window::Wayland)
+            },
+            #[cfg(x11_platform)]
+            ActiveEventLoop::X(ref window_target) => {
+                x11::Window::new(window_target, attribs).map(Window::X)
+            },
+        }
+    }
+
+    pub(crate) fn maybe_queue_on_main(&self, f: impl FnOnce(&Self) + Send + 'static) {
+        f(self)
+    }
+
+    pub(crate) fn maybe_wait_on_main<R: Send>(&self, f: impl FnOnce(&Self) -> R + Send) -> R {
+        f(self)
+    }
+
+    #[inline]
+    pub fn id(&self) -> WindowId {
+        x11_or_wayland!(match self; Window(w) => w.id())
+    }
+
+    #[inline]
+    pub fn set_title(&self, title: &str) {
+        x11_or_wayland!(match self; Window(w) => w.set_title(title));
+    }
+
+    #[inline]
+    pub fn set_transparent(&self, transparent: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_transparent(transparent));
+    }
+
+    #[inline]
+    pub fn set_blur(&self, blur: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_blur(blur));
+    }
+
+    #[inline]
+    pub fn set_visible(&self, visible: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_visible(visible))
+    }
+
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        x11_or_wayland!(match self; Window(w) => w.is_visible())
+    }
+
+    #[inline]
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        x11_or_wayland!(match self; Window(w) => w.outer_position())
+    }
+
+    #[inline]
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        x11_or_wayland!(match self; Window(w) => w.inner_position())
+    }
+
+    #[inline]
+    pub fn set_outer_position(&self, position: Position) {
+        x11_or_wayland!(match self; Window(w) => w.set_outer_position(position))
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        x11_or_wayland!(match self; Window(w) => w.inner_size())
+    }
+
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        x11_or_wayland!(match self; Window(w) => w.outer_size())
+    }
+
+    #[inline]
+    pub fn request_inner_size(&self, size: Size) -> Option<PhysicalSize<u32>> {
+        x11_or_wayland!(match self; Window(w) => w.request_inner_size(size))
+    }
+
+    #[inline]
+    pub(crate) fn request_activation_token(&self) -> Result<AsyncRequestSerial, NotSupportedError> {
+        x11_or_wayland!(match self; Window(w) => w.request_activation_token())
+    }
+
+    #[inline]
+    pub fn set_min_inner_size(&self, dimensions: Option<Size>) {
+        x11_or_wayland!(match self; Window(w) => w.set_min_inner_size(dimensions))
+    }
+
+    #[inline]
+    pub fn set_max_inner_size(&self, dimensions: Option<Size>) {
+        x11_or_wayland!(match self; Window(w) => w.set_max_inner_size(dimensions))
+    }
+
+    #[inline]
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        x11_or_wayland!(match self; Window(w) => w.resize_increments())
+    }
+
+    #[inline]
+    pub fn set_resize_increments(&self, increments: Option<Size>) {
+        x11_or_wayland!(match self; Window(w) => w.set_resize_increments(increments))
+    }
+
+    #[inline]
+    pub fn set_resizable(&self, resizable: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_resizable(resizable))
+    }
+
+    #[inline]
+    pub fn is_resizable(&self) -> bool {
+        x11_or_wayland!(match self; Window(w) => w.is_resizable())
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, buttons: WindowButtons) {
+        x11_or_wayland!(match self; Window(w) => w.set_enabled_buttons(buttons))
+    }
+
+    #[inline]
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        x11_or_wayland!(match self; Window(w) => w.enabled_buttons())
+    }
+
+    #[inline]
+    pub fn set_cursor(&self, cursor: Cursor) {
+        x11_or_wayland!(match self; Window(w) => w.set_cursor(cursor))
+    }
+
+    #[inline]
+    pub fn set_cursor_grab(&self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        x11_or_wayland!(match self; Window(window) => window.set_cursor_grab(mode))
+    }
+
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        x11_or_wayland!(match self; Window(window) => window.set_cursor_visible(visible))
+    }
+
+    #[inline]
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        x11_or_wayland!(match self; Window(window) => window.drag_window())
+    }
+
+    #[inline]
+    pub fn drag_resize_window(&self, direction: ResizeDirection) -> Result<(), ExternalError> {
+        x11_or_wayland!(match self; Window(window) => window.drag_resize_window(direction))
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, position: Position) {
+        x11_or_wayland!(match self; Window(w) => w.show_window_menu(position))
+    }
+
+    #[inline]
+    pub fn set_cursor_hittest(&self, hittest: bool) -> Result<(), ExternalError> {
+        x11_or_wayland!(match self; Window(w) => w.set_cursor_hittest(hittest))
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        x11_or_wayland!(match self; Window(w) => w.scale_factor())
+    }
+
+    #[inline]
+    pub fn set_cursor_position(&self, position: Position) -> Result<(), ExternalError> {
+        x11_or_wayland!(match self; Window(w) => w.set_cursor_position(position))
+    }
+
+    #[inline]
+    pub fn set_maximized(&self, maximized: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_maximized(maximized))
+    }
+
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        x11_or_wayland!(match self; Window(w) => w.is_maximized())
+    }
+
+    #[inline]
+    pub fn set_minimized(&self, minimized: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_minimized(minimized))
+    }
+
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        x11_or_wayland!(match self; Window(w) => w.is_minimized())
+    }
+
+    #[inline]
+    pub(crate) fn fullscreen(&self) -> Option<Fullscreen> {
+        x11_or_wayland!(match self; Window(w) => w.fullscreen())
+    }
+
+    #[inline]
+    pub(crate) fn set_fullscreen(&self, monitor: Option<Fullscreen>) {
+        x11_or_wayland!(match self; Window(w) => w.set_fullscreen(monitor))
+    }
+
+    #[inline]
+    pub fn set_decorations(&self, decorations: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_decorations(decorations))
+    }
+
+    #[inline]
+    pub fn is_decorated(&self) -> bool {
+        x11_or_wayland!(match self; Window(w) => w.is_decorated())
+    }
+
+    #[inline]
+    pub fn set_window_level(&self, level: WindowLevel) {
+        x11_or_wayland!(match self; Window(w) => w.set_window_level(level))
+    }
+
+    #[inline]
+    pub fn set_window_icon(&self, window_icon: Option<Icon>) {
+        x11_or_wayland!(match self; Window(w) => w.set_window_icon(window_icon.map(|icon| icon.inner)))
+    }
+
+    #[inline]
+    pub fn set_ime_cursor_area(&self, position: Position, size: Size) {
+        x11_or_wayland!(match self; Window(w) => w.set_ime_cursor_area(position, size))
+    }
+
+    #[inline]
+    pub fn reset_dead_keys(&self) {
+        common::xkb::reset_dead_keys()
+    }
+
+    #[inline]
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        x11_or_wayland!(match self; Window(w) => w.set_ime_allowed(allowed))
+    }
+
+    #[inline]
+    pub fn set_ime_purpose(&self, purpose: ImePurpose) {
+        x11_or_wayland!(match self; Window(w) => w.set_ime_purpose(purpose))
+    }
+
+    #[inline]
+    pub fn focus_window(&self) {
+        x11_or_wayland!(match self; Window(w) => w.focus_window())
+    }
+
+    pub fn request_user_attention(&self, request_type: Option<UserAttentionType>) {
+        x11_or_wayland!(match self; Window(w) => w.request_user_attention(request_type))
+    }
+
+    #[inline]
+    pub fn request_redraw(&self) {
+        x11_or_wayland!(match self; Window(w) => w.request_redraw())
+    }
+
+    #[inline]
+    pub fn pre_present_notify(&self) {
+        x11_or_wayland!(match self; Window(w) => w.pre_present_notify())
+    }
+
+    #[inline]
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        Some(x11_or_wayland!(match self; Window(w) => w.current_monitor()?; as MonitorHandle))
+    }
+
+    #[inline]
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        match self {
+            #[cfg(x11_platform)]
+            Window::X(ref window) => {
+                window.available_monitors().into_iter().map(MonitorHandle::X).collect()
+            },
+            #[cfg(wayland_platform)]
+            Window::Wayland(ref window) => {
+                window.available_monitors().into_iter().map(MonitorHandle::Wayland).collect()
+            },
+        }
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        Some(x11_or_wayland!(match self; Window(w) => w.primary_monitor()?; as MonitorHandle))
+    }
+
+    #[cfg(feature = "rwh_04")]
+    #[inline]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        x11_or_wayland!(match self; Window(window) => window.raw_window_handle_rwh_04())
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        x11_or_wayland!(match self; Window(window) => window.raw_window_handle_rwh_05())
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        x11_or_wayland!(match self; Window(window) => window.raw_display_handle_rwh_05())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_window_handle_rwh_06(&self) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        x11_or_wayland!(match self; Window(window) => window.raw_window_handle_rwh_06())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        x11_or_wayland!(match self; Window(window) => window.raw_display_handle_rwh_06())
+    }
+
+    #[inline]
+    pub fn set_theme(&self, theme: Option<Theme>) {
+        x11_or_wayland!(match self; Window(window) => window.set_theme(theme))
+    }
+
+    #[inline]
+    pub fn theme(&self) -> Option<Theme> {
+        x11_or_wayland!(match self; Window(window) => window.theme())
+    }
+
+    pub fn set_content_protected(&self, protected: bool) {
+        x11_or_wayland!(match self; Window(window) => window.set_content_protected(protected))
+    }
+
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        x11_or_wayland!(match self; Window(window) => window.has_focus())
+    }
+
+    pub fn title(&self) -> String {
+        x11_or_wayland!(match self; Window(window) => window.title())
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub struct KeyEventExtra {
+    pub text_with_all_modifiers: Option<SmolStr>,
+    pub key_without_modifiers: Key,
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+pub(crate) enum PlatformCustomCursor {
+    #[cfg(wayland_platform)]
+    Wayland(wayland::CustomCursor),
+    #[cfg(x11_platform)]
+    X(x11::CustomCursor),
+}
+
+/// Hooks for X11 errors.
+#[cfg(x11_platform)]
+pub(crate) static XLIB_ERROR_HOOKS: Mutex<Vec<XlibErrorHook>> = Mutex::new(Vec::new());
+
+#[cfg(x11_platform)]
+unsafe extern "C" fn x_error_callback(
+    display: *mut x11::ffi::Display,
+    event: *mut x11::ffi::XErrorEvent,
+) -> c_int {
+    let xconn_lock = X11_BACKEND.lock().unwrap_or_else(|e| e.into_inner());
+    if let Ok(ref xconn) = *xconn_lock {
+        // Call all the hooks.
+        let mut error_handled = false;
+        for hook in XLIB_ERROR_HOOKS.lock().unwrap().iter() {
+            error_handled |= hook(display as *mut _, event as *mut _);
+        }
+
+        // `assume_init` is safe here because the array consists of `MaybeUninit` values,
+        // which do not require initialization.
+        let mut buf: [MaybeUninit<c_char>; 1024] = unsafe { MaybeUninit::uninit().assume_init() };
+        unsafe {
+            (xconn.xlib.XGetErrorText)(
+                display,
+                (*event).error_code as c_int,
+                buf.as_mut_ptr() as *mut c_char,
+                buf.len() as c_int,
+            )
+        };
+        let description =
+            unsafe { CStr::from_ptr(buf.as_ptr() as *const c_char) }.to_string_lossy();
+
+        let error = unsafe {
+            XError {
+                description: description.into_owned(),
+                error_code: (*event).error_code,
+                request_code: (*event).request_code,
+                minor_code: (*event).minor_code,
+            }
+        };
+
+        // Don't log error.
+        if !error_handled {
+            tracing::error!("X11 error: {:#?}", error);
+            // XXX only update the error, if it wasn't handled by any of the hooks.
+            *xconn.latest_error.lock().unwrap() = Some(error);
+        }
+    }
+    // Fun fact: this return value is completely ignored.
+    0
+}
+
+#[allow(clippy::large_enum_variant)]
+pub enum EventLoop<T: 'static> {
+    #[cfg(wayland_platform)]
+    Wayland(Box<wayland::EventLoop<T>>),
+    #[cfg(x11_platform)]
+    X(x11::EventLoop<T>),
+}
+
+pub enum EventLoopProxy<T: 'static> {
+    #[cfg(x11_platform)]
+    X(x11::EventLoopProxy<T>),
+    #[cfg(wayland_platform)]
+    Wayland(wayland::EventLoopProxy<T>),
+}
+
+impl<T: 'static> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        x11_or_wayland!(match self; EventLoopProxy(proxy) => proxy.clone(); as EventLoopProxy)
+    }
+}
+
+impl<T: 'static> EventLoop<T> {
+    pub(crate) fn new(
+        attributes: &PlatformSpecificEventLoopAttributes,
+    ) -> Result<Self, EventLoopError> {
+        if !attributes.any_thread && !is_main_thread() {
+            panic!(
+                "Initializing the event loop outside of the main thread is a significant \
+                 cross-platform compatibility hazard. If you absolutely need to create an \
+                 EventLoop on a different thread, you can use the \
+                 `EventLoopBuilderExtX11::any_thread` or `EventLoopBuilderExtWayland::any_thread` \
+                 functions."
+            );
+        }
+
+        // NOTE: Wayland first because of X11 could be present under Wayland as well. Empty
+        // variables are also treated as not set.
+        let backend = match (
+            attributes.forced_backend,
+            env::var("WAYLAND_DISPLAY")
+                .ok()
+                .filter(|var| !var.is_empty())
+                .or_else(|| env::var("WAYLAND_SOCKET").ok())
+                .filter(|var| !var.is_empty())
+                .is_some(),
+            env::var("DISPLAY").map(|var| !var.is_empty()).unwrap_or(false),
+        ) {
+            // User is forcing a backend.
+            (Some(backend), ..) => backend,
+            // Wayland is present.
+            #[cfg(wayland_platform)]
+            (None, true, _) => Backend::Wayland,
+            // X11 is present.
+            #[cfg(x11_platform)]
+            (None, _, true) => Backend::X,
+            // No backend is present.
+            (_, wayland_display, x11_display) => {
+                let msg = if wayland_display && !cfg!(wayland_platform) {
+                    "DISPLAY is not set; note: enable the `winit/wayland` feature to support \
+                     Wayland"
+                } else if x11_display && !cfg!(x11_platform) {
+                    "neither WAYLAND_DISPLAY nor WAYLAND_SOCKET is set; note: enable the \
+                     `winit/x11` feature to support X11"
+                } else {
+                    "neither WAYLAND_DISPLAY nor WAYLAND_SOCKET nor DISPLAY is set."
+                };
+                return Err(EventLoopError::Os(os_error!(OsError::Misc(msg))));
+            },
+        };
+
+        // Create the display based on the backend.
+        match backend {
+            #[cfg(wayland_platform)]
+            Backend::Wayland => EventLoop::new_wayland_any_thread(),
+            #[cfg(x11_platform)]
+            Backend::X => EventLoop::new_x11_any_thread(),
+        }
+    }
+
+    #[cfg(wayland_platform)]
+    fn new_wayland_any_thread() -> Result<EventLoop<T>, EventLoopError> {
+        wayland::EventLoop::new().map(|evlp| EventLoop::Wayland(Box::new(evlp)))
+    }
+
+    #[cfg(x11_platform)]
+    fn new_x11_any_thread() -> Result<EventLoop<T>, EventLoopError> {
+        let xconn = match X11_BACKEND.lock().unwrap_or_else(|e| e.into_inner()).as_ref() {
+            Ok(xconn) => xconn.clone(),
+            Err(err) => {
+                return Err(EventLoopError::Os(os_error!(OsError::XNotSupported(err.clone()))))
+            },
+        };
+
+        Ok(EventLoop::X(x11::EventLoop::new(xconn)))
+    }
+
+    #[inline]
+    pub fn is_wayland(&self) -> bool {
+        match *self {
+            #[cfg(wayland_platform)]
+            EventLoop::Wayland(_) => true,
+            #[cfg(x11_platform)]
+            _ => false,
+        }
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        x11_or_wayland!(match self; EventLoop(evlp) => evlp.create_proxy(); as EventLoopProxy)
+    }
+
+    pub fn run<F>(mut self, callback: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(crate::event::Event<T>, &RootELW),
+    {
+        self.run_on_demand(callback)
+    }
+
+    pub fn run_on_demand<F>(&mut self, callback: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(crate::event::Event<T>, &RootELW),
+    {
+        x11_or_wayland!(match self; EventLoop(evlp) => evlp.run_on_demand(callback))
+    }
+
+    pub fn pump_events<F>(&mut self, timeout: Option<Duration>, callback: F) -> PumpStatus
+    where
+        F: FnMut(crate::event::Event<T>, &RootELW),
+    {
+        x11_or_wayland!(match self; EventLoop(evlp) => evlp.pump_events(timeout, callback))
+    }
+
+    pub fn window_target(&self) -> &crate::event_loop::ActiveEventLoop {
+        x11_or_wayland!(match self; EventLoop(evlp) => evlp.window_target())
+    }
+}
+
+impl<T> AsFd for EventLoop<T> {
+    fn as_fd(&self) -> BorrowedFd<'_> {
+        x11_or_wayland!(match self; EventLoop(evlp) => evlp.as_fd())
+    }
+}
+
+impl<T> AsRawFd for EventLoop<T> {
+    fn as_raw_fd(&self) -> RawFd {
+        x11_or_wayland!(match self; EventLoop(evlp) => evlp.as_raw_fd())
+    }
+}
+
+impl<T: 'static> EventLoopProxy<T> {
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        x11_or_wayland!(match self; EventLoopProxy(proxy) => proxy.send_event(event))
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
+pub enum ActiveEventLoop {
+    #[cfg(wayland_platform)]
+    Wayland(wayland::ActiveEventLoop),
+    #[cfg(x11_platform)]
+    X(x11::ActiveEventLoop),
+}
+
+impl ActiveEventLoop {
+    #[inline]
+    pub fn is_wayland(&self) -> bool {
+        match *self {
+            #[cfg(wayland_platform)]
+            ActiveEventLoop::Wayland(_) => true,
+            #[cfg(x11_platform)]
+            _ => false,
+        }
+    }
+
+    pub fn create_custom_cursor(&self, cursor: CustomCursorSource) -> CustomCursor {
+        x11_or_wayland!(match self; ActiveEventLoop(evlp) => evlp.create_custom_cursor(cursor))
+    }
+
+    #[inline]
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        match *self {
+            #[cfg(wayland_platform)]
+            ActiveEventLoop::Wayland(ref evlp) => {
+                evlp.available_monitors().map(MonitorHandle::Wayland).collect()
+            },
+            #[cfg(x11_platform)]
+            ActiveEventLoop::X(ref evlp) => {
+                evlp.available_monitors().map(MonitorHandle::X).collect()
+            },
+        }
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        Some(
+            x11_or_wayland!(match self; ActiveEventLoop(evlp) => evlp.primary_monitor()?; as MonitorHandle),
+        )
+    }
+
+    #[inline]
+    pub fn listen_device_events(&self, allowed: DeviceEvents) {
+        x11_or_wayland!(match self; Self(evlp) => evlp.listen_device_events(allowed))
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        x11_or_wayland!(match self; Self(evlp) => evlp.raw_display_handle_rwh_05())
+    }
+
+    #[inline]
+    pub fn system_theme(&self) -> Option<Theme> {
+        None
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        x11_or_wayland!(match self; Self(evlp) => evlp.raw_display_handle_rwh_06())
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        x11_or_wayland!(match self; Self(evlp) => evlp.set_control_flow(control_flow))
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        x11_or_wayland!(match self; Self(evlp) => evlp.control_flow())
+    }
+
+    pub(crate) fn clear_exit(&self) {
+        x11_or_wayland!(match self; Self(evlp) => evlp.clear_exit())
+    }
+
+    pub(crate) fn exit(&self) {
+        x11_or_wayland!(match self; Self(evlp) => evlp.exit())
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        x11_or_wayland!(match self; Self(evlp) => evlp.exiting())
+    }
+
+    pub(crate) fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        match self {
+            #[cfg(x11_platform)]
+            Self::X(conn) => OwnedDisplayHandle::X(conn.x_connection().clone()),
+            #[cfg(wayland_platform)]
+            Self::Wayland(conn) => OwnedDisplayHandle::Wayland(conn.connection.clone()),
+        }
+    }
+
+    #[allow(dead_code)]
+    fn set_exit_code(&self, code: i32) {
+        x11_or_wayland!(match self; Self(evlp) => evlp.set_exit_code(code))
+    }
+
+    #[allow(dead_code)]
+    fn exit_code(&self) -> Option<i32> {
+        x11_or_wayland!(match self; Self(evlp) => evlp.exit_code())
+    }
+}
+
+#[derive(Clone)]
+#[allow(dead_code)]
+pub(crate) enum OwnedDisplayHandle {
+    #[cfg(x11_platform)]
+    X(Arc<XConnection>),
+    #[cfg(wayland_platform)]
+    Wayland(wayland_client::Connection),
+}
+
+impl OwnedDisplayHandle {
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        match self {
+            #[cfg(x11_platform)]
+            Self::X(xconn) => {
+                let mut xlib_handle = rwh_05::XlibDisplayHandle::empty();
+                xlib_handle.display = xconn.display.cast();
+                xlib_handle.screen = xconn.default_screen_index() as _;
+                xlib_handle.into()
+            },
+
+            #[cfg(wayland_platform)]
+            Self::Wayland(conn) => {
+                use sctk::reexports::client::Proxy;
+
+                let mut wayland_handle = rwh_05::WaylandDisplayHandle::empty();
+                wayland_handle.display = conn.display().id().as_ptr() as *mut _;
+                wayland_handle.into()
+            },
+        }
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        use std::ptr::NonNull;
+
+        match self {
+            #[cfg(x11_platform)]
+            Self::X(xconn) => Ok(rwh_06::XlibDisplayHandle::new(
+                NonNull::new(xconn.display.cast()),
+                xconn.default_screen_index() as _,
+            )
+            .into()),
+
+            #[cfg(wayland_platform)]
+            Self::Wayland(conn) => {
+                use sctk::reexports::client::Proxy;
+
+                Ok(rwh_06::WaylandDisplayHandle::new(
+                    NonNull::new(conn.display().id().as_ptr().cast()).unwrap(),
+                )
+                .into())
+            },
+        }
+    }
+}
+
+/// Returns the minimum `Option<Duration>`, taking into account that `None`
+/// equates to an infinite timeout, not a zero timeout (so can't just use
+/// `Option::min`)
+fn min_timeout(a: Option<Duration>, b: Option<Duration>) -> Option<Duration> {
+    a.map_or(b, |a_timeout| b.map_or(Some(a_timeout), |b_timeout| Some(a_timeout.min(b_timeout))))
+}
+
+#[cfg(target_os = "linux")]
+fn is_main_thread() -> bool {
+    rustix::thread::gettid() == rustix::process::getpid()
+}
+
+#[cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "openbsd"))]
+fn is_main_thread() -> bool {
+    use libc::pthread_main_np;
+
+    unsafe { pthread_main_np() == 1 }
+}
+
+#[cfg(target_os = "netbsd")]
+fn is_main_thread() -> bool {
+    std::thread::current().name() == Some("main")
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/event_loop/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/event_loop/mod.rs
new file mode 100644
index 00000000..fef13f45
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/event_loop/mod.rs
@@ -0,0 +1,810 @@
+//! The event-loop routines.
+
+use std::cell::{Cell, RefCell};
+use std::io::Result as IOResult;
+use std::marker::PhantomData;
+use std::mem;
+use std::os::fd::OwnedFd;
+use std::os::unix::io::{AsFd, AsRawFd, BorrowedFd, RawFd};
+use std::rc::Rc;
+use std::sync::atomic::Ordering;
+use std::sync::{Arc, Condvar, Mutex};
+use std::thread::JoinHandle;
+use std::time::{Duration, Instant};
+
+use calloop::ping::Ping;
+use rustix::event::{PollFd, PollFlags};
+use rustix::pipe::{self, PipeFlags};
+use sctk::reexports::calloop::Error as CalloopError;
+use sctk::reexports::calloop_wayland_source::WaylandSource;
+use sctk::reexports::client::{globals, Connection, QueueHandle};
+use tracing::warn;
+
+use crate::cursor::OnlyCursorImage;
+use crate::dpi::LogicalSize;
+use crate::error::{EventLoopError, OsError as RootOsError};
+use crate::event::{Event, InnerSizeWriter, StartCause, WindowEvent};
+use crate::event_loop::{ActiveEventLoop as RootActiveEventLoop, ControlFlow, DeviceEvents};
+use crate::platform::pump_events::PumpStatus;
+use crate::platform_impl::platform::min_timeout;
+use crate::platform_impl::{
+    ActiveEventLoop as PlatformActiveEventLoop, OsError, PlatformCustomCursor,
+};
+use crate::window::{CustomCursor as RootCustomCursor, CustomCursorSource};
+
+mod proxy;
+pub mod sink;
+
+pub use proxy::EventLoopProxy;
+use sink::EventSink;
+
+use super::state::{WindowCompositorUpdate, WinitState};
+use super::window::state::FrameCallbackState;
+use super::{logical_to_physical_rounded, DeviceId, WaylandError, WindowId};
+
+type WaylandDispatcher = calloop::Dispatcher<'static, WaylandSource<WinitState>, WinitState>;
+
+/// The Wayland event loop.
+pub struct EventLoop<T: 'static> {
+    /// Has `run` or `run_on_demand` been called or a call to `pump_events` that starts the loop
+    loop_running: bool,
+
+    buffer_sink: EventSink,
+    compositor_updates: Vec<WindowCompositorUpdate>,
+    window_ids: Vec<WindowId>,
+
+    /// Sender of user events.
+    user_events_sender: calloop::channel::Sender<T>,
+
+    // XXX can't remove RefCell out of here, unless we can plumb generics into the `Window`, which
+    // we don't really want, since it'll break public API by a lot.
+    /// Pending events from the user.
+    pending_user_events: Rc<RefCell<Vec<T>>>,
+
+    /// The Wayland dispatcher to has raw access to the queue when needed, such as
+    /// when creating a new window.
+    wayland_dispatcher: WaylandDispatcher,
+
+    /// Connection to the wayland server.
+    connection: Connection,
+
+    /// Event loop window target.
+    window_target: RootActiveEventLoop,
+
+    // XXX drop after everything else, just to be safe.
+    /// Calloop's event loop.
+    event_loop: calloop::EventLoop<'static, WinitState>,
+
+    pump_event_notifier: Option<PumpEventNotifier>,
+}
+
+impl<T: 'static> EventLoop<T> {
+    pub fn new() -> Result<EventLoop<T>, EventLoopError> {
+        macro_rules! map_err {
+            ($e:expr, $err:expr) => {
+                $e.map_err(|error| os_error!($err(error).into()))
+            };
+        }
+
+        let connection = map_err!(Connection::connect_to_env(), WaylandError::Connection)?;
+
+        let (globals, mut event_queue) =
+            map_err!(globals::registry_queue_init(&connection), WaylandError::Global)?;
+        let queue_handle = event_queue.handle();
+
+        let event_loop =
+            map_err!(calloop::EventLoop::<WinitState>::try_new(), WaylandError::Calloop)?;
+
+        let mut winit_state = WinitState::new(&globals, &queue_handle, event_loop.handle())
+            .map_err(|error| os_error!(error))?;
+
+        // NOTE: do a roundtrip after binding the globals to prevent potential
+        // races with the server.
+        map_err!(event_queue.roundtrip(&mut winit_state), WaylandError::Dispatch)?;
+
+        // Register Wayland source.
+        let wayland_source = WaylandSource::new(connection.clone(), event_queue);
+        let wayland_dispatcher =
+            calloop::Dispatcher::new(wayland_source, |_, queue, winit_state: &mut WinitState| {
+                let result = queue.dispatch_pending(winit_state);
+                if result.is_ok()
+                    && (!winit_state.events_sink.is_empty()
+                        || !winit_state.window_compositor_updates.is_empty())
+                {
+                    winit_state.dispatched_events = true;
+                }
+                result
+            });
+
+        map_err!(
+            event_loop.handle().register_dispatcher(wayland_dispatcher.clone()),
+            WaylandError::Calloop
+        )?;
+
+        // Setup the user proxy.
+        let pending_user_events = Rc::new(RefCell::new(Vec::new()));
+        let pending_user_events_clone = pending_user_events.clone();
+        let (user_events_sender, user_events_channel) = calloop::channel::channel();
+        let result = event_loop
+            .handle()
+            .insert_source(user_events_channel, move |event, _, winit_state: &mut WinitState| {
+                if let calloop::channel::Event::Msg(msg) = event {
+                    winit_state.dispatched_events = true;
+                    pending_user_events_clone.borrow_mut().push(msg);
+                }
+            })
+            .map_err(|error| error.error);
+        map_err!(result, WaylandError::Calloop)?;
+
+        // An event's loop awakener to wake up for window events from winit's windows.
+        let (event_loop_awakener, event_loop_awakener_source) = map_err!(
+            calloop::ping::make_ping()
+                .map_err(|error| CalloopError::OtherError(Box::new(error).into())),
+            WaylandError::Calloop
+        )?;
+
+        let result = event_loop
+            .handle()
+            .insert_source(event_loop_awakener_source, move |_, _, winit_state: &mut WinitState| {
+                // Mark that we have something to dispatch.
+                winit_state.dispatched_events = true;
+            })
+            .map_err(|error| error.error);
+        map_err!(result, WaylandError::Calloop)?;
+
+        let window_target = ActiveEventLoop {
+            connection: connection.clone(),
+            wayland_dispatcher: wayland_dispatcher.clone(),
+            event_loop_awakener,
+            queue_handle,
+            control_flow: Cell::new(ControlFlow::default()),
+            exit: Cell::new(None),
+            state: RefCell::new(winit_state),
+        };
+
+        let event_loop = Self {
+            loop_running: false,
+            compositor_updates: Vec::new(),
+            buffer_sink: EventSink::default(),
+            window_ids: Vec::new(),
+            connection,
+            wayland_dispatcher,
+            user_events_sender,
+            pending_user_events,
+            event_loop,
+            window_target: RootActiveEventLoop {
+                p: PlatformActiveEventLoop::Wayland(window_target),
+                _marker: PhantomData,
+            },
+            pump_event_notifier: None,
+        };
+
+        Ok(event_loop)
+    }
+
+    pub fn run_on_demand<F>(&mut self, mut event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<T>, &RootActiveEventLoop),
+    {
+        let exit = loop {
+            match self.pump_events(None, &mut event_handler) {
+                PumpStatus::Exit(0) => {
+                    break Ok(());
+                },
+                PumpStatus::Exit(code) => {
+                    break Err(EventLoopError::ExitFailure(code));
+                },
+                _ => {
+                    continue;
+                },
+            }
+        };
+
+        // Applications aren't allowed to carry windows between separate
+        // `run_on_demand` calls but if they have only just dropped their
+        // windows we need to make sure those last requests are sent to the
+        // compositor.
+        let _ = self.roundtrip().map_err(EventLoopError::Os);
+
+        exit
+    }
+
+    pub fn pump_events<F>(&mut self, timeout: Option<Duration>, mut callback: F) -> PumpStatus
+    where
+        F: FnMut(Event<T>, &RootActiveEventLoop),
+    {
+        if !self.loop_running {
+            self.loop_running = true;
+
+            // Run the initial loop iteration.
+            self.single_iteration(&mut callback, StartCause::Init);
+        }
+
+        // Consider the possibility that the `StartCause::Init` iteration could
+        // request to Exit.
+        if !self.exiting() {
+            self.poll_events_with_timeout(timeout, &mut callback);
+        }
+        if let Some(code) = self.exit_code() {
+            self.loop_running = false;
+
+            callback(Event::LoopExiting, self.window_target());
+
+            PumpStatus::Exit(code)
+        } else {
+            // NOTE: spawn a wake-up thread, thus if we have code reading the wayland connection
+            // in parallel to winit, we ensure that the loop itself is marked as having events.
+            if timeout.is_some() && self.pump_event_notifier.is_none() {
+                let awakener = match &self.window_target.p {
+                    PlatformActiveEventLoop::Wayland(window_target) => {
+                        window_target.event_loop_awakener.clone()
+                    },
+                    #[cfg(x11_platform)]
+                    PlatformActiveEventLoop::X(_) => unreachable!(),
+                };
+
+                self.pump_event_notifier =
+                    Some(PumpEventNotifier::spawn(self.connection.clone(), awakener));
+            }
+
+            if let Some(pump_event_notifier) = self.pump_event_notifier.as_ref() {
+                // Notify that we don't have to wait, since we're out of winit.
+                *pump_event_notifier.control.0.lock().unwrap() = PumpEventNotifierAction::Monitor;
+                pump_event_notifier.control.1.notify_one();
+            }
+
+            PumpStatus::Continue
+        }
+    }
+
+    pub fn poll_events_with_timeout<F>(&mut self, mut timeout: Option<Duration>, mut callback: F)
+    where
+        F: FnMut(Event<T>, &RootActiveEventLoop),
+    {
+        let cause = loop {
+            let start = Instant::now();
+
+            timeout = {
+                let control_flow_timeout = match self.control_flow() {
+                    ControlFlow::Wait => None,
+                    ControlFlow::Poll => Some(Duration::ZERO),
+                    ControlFlow::WaitUntil(wait_deadline) => {
+                        Some(wait_deadline.saturating_duration_since(start))
+                    },
+                };
+                min_timeout(control_flow_timeout, timeout)
+            };
+
+            // NOTE Ideally we should flush as the last thing we do before polling
+            // to wait for events, and this should be done by the calloop
+            // WaylandSource but we currently need to flush writes manually.
+            //
+            // Checking for flush error is essential to perform an exit with error, since
+            // once we have a protocol error, we could get stuck retrying...
+            if self.connection.flush().is_err() {
+                self.set_exit_code(1);
+                return;
+            }
+
+            if let Err(error) = self.loop_dispatch(timeout) {
+                // NOTE We exit on errors from dispatches, since if we've got protocol error
+                // libwayland-client/wayland-rs will inform us anyway, but crashing downstream is
+                // not really an option. Instead we inform that the event loop got
+                // destroyed. We may communicate an error that something was
+                // terminated, but winit doesn't provide us with an API to do that
+                // via some event. Still, we set the exit code to the error's OS
+                // error code, or to 1 if not possible.
+                let exit_code = error.raw_os_error().unwrap_or(1);
+                self.set_exit_code(exit_code);
+                return;
+            }
+
+            // NB: `StartCause::Init` is handled as a special case and doesn't need
+            // to be considered here
+            let cause = match self.control_flow() {
+                ControlFlow::Poll => StartCause::Poll,
+                ControlFlow::Wait => StartCause::WaitCancelled { start, requested_resume: None },
+                ControlFlow::WaitUntil(deadline) => {
+                    if Instant::now() < deadline {
+                        StartCause::WaitCancelled { start, requested_resume: Some(deadline) }
+                    } else {
+                        StartCause::ResumeTimeReached { start, requested_resume: deadline }
+                    }
+                },
+            };
+
+            // Reduce spurious wake-ups.
+            let dispatched_events = self.with_state(|state| state.dispatched_events);
+            if matches!(cause, StartCause::WaitCancelled { .. })
+                && !dispatched_events
+                && timeout.is_none()
+            {
+                continue;
+            }
+
+            break cause;
+        };
+
+        self.single_iteration(&mut callback, cause);
+    }
+
+    fn single_iteration<F>(&mut self, callback: &mut F, cause: StartCause)
+    where
+        F: FnMut(Event<T>, &RootActiveEventLoop),
+    {
+        // NOTE currently just indented to simplify the diff
+
+        // We retain these grow-only scratch buffers as part of the EventLoop
+        // for the sake of avoiding lots of reallocs. We take them here to avoid
+        // trying to mutably borrow `self` more than once and we swap them back
+        // when finished.
+        let mut compositor_updates = std::mem::take(&mut self.compositor_updates);
+        let mut buffer_sink = std::mem::take(&mut self.buffer_sink);
+        let mut window_ids = std::mem::take(&mut self.window_ids);
+
+        callback(Event::NewEvents(cause), &self.window_target);
+
+        // NB: For consistency all platforms must emit a 'resumed' event even though Wayland
+        // applications don't themselves have a formal suspend/resume lifecycle.
+        if cause == StartCause::Init {
+            callback(Event::Resumed, &self.window_target);
+        }
+
+        // Handle pending user events. We don't need back buffer, since we can't dispatch
+        // user events indirectly via callback to the user.
+        for user_event in self.pending_user_events.borrow_mut().drain(..) {
+            callback(Event::UserEvent(user_event), &self.window_target);
+        }
+
+        // Drain the pending compositor updates.
+        self.with_state(|state| compositor_updates.append(&mut state.window_compositor_updates));
+
+        for mut compositor_update in compositor_updates.drain(..) {
+            let window_id = compositor_update.window_id;
+            if compositor_update.scale_changed {
+                let (physical_size, scale_factor) = self.with_state(|state| {
+                    let windows = state.windows.get_mut();
+                    let window = windows.get(&window_id).unwrap().lock().unwrap();
+                    let scale_factor = window.scale_factor();
+                    let size = logical_to_physical_rounded(window.inner_size(), scale_factor);
+                    (size, scale_factor)
+                });
+
+                // Stash the old window size.
+                let old_physical_size = physical_size;
+
+                let new_inner_size = Arc::new(Mutex::new(physical_size));
+                callback(
+                    Event::WindowEvent {
+                        window_id: crate::window::WindowId(window_id),
+                        event: WindowEvent::ScaleFactorChanged {
+                            scale_factor,
+                            inner_size_writer: InnerSizeWriter::new(Arc::downgrade(
+                                &new_inner_size,
+                            )),
+                        },
+                    },
+                    &self.window_target,
+                );
+
+                let physical_size = *new_inner_size.lock().unwrap();
+                drop(new_inner_size);
+
+                // Resize the window when user altered the size.
+                if old_physical_size != physical_size {
+                    self.with_state(|state| {
+                        let windows = state.windows.get_mut();
+                        let mut window = windows.get(&window_id).unwrap().lock().unwrap();
+
+                        let new_logical_size: LogicalSize<f64> =
+                            physical_size.to_logical(scale_factor);
+                        window.request_inner_size(new_logical_size.into());
+                    });
+
+                    // Make it queue resize.
+                    compositor_update.resized = true;
+                }
+            }
+
+            // NOTE: Rescale changed the physical size which winit operates in, thus we should
+            // resize.
+            if compositor_update.resized || compositor_update.scale_changed {
+                let physical_size = self.with_state(|state| {
+                    let windows = state.windows.get_mut();
+                    let window = windows.get(&window_id).unwrap().lock().unwrap();
+
+                    let scale_factor = window.scale_factor();
+                    let size = logical_to_physical_rounded(window.inner_size(), scale_factor);
+
+                    // Mark the window as needed a redraw.
+                    state
+                        .window_requests
+                        .get_mut()
+                        .get_mut(&window_id)
+                        .unwrap()
+                        .redraw_requested
+                        .store(true, Ordering::Relaxed);
+
+                    size
+                });
+
+                callback(
+                    Event::WindowEvent {
+                        window_id: crate::window::WindowId(window_id),
+                        event: WindowEvent::Resized(physical_size),
+                    },
+                    &self.window_target,
+                );
+            }
+
+            if compositor_update.close_window {
+                callback(
+                    Event::WindowEvent {
+                        window_id: crate::window::WindowId(window_id),
+                        event: WindowEvent::CloseRequested,
+                    },
+                    &self.window_target,
+                );
+            }
+        }
+
+        // Push the events directly from the window.
+        self.with_state(|state| {
+            buffer_sink.append(&mut state.window_events_sink.lock().unwrap());
+        });
+        for event in buffer_sink.drain() {
+            let event = event.map_nonuser_event().unwrap();
+            callback(event, &self.window_target);
+        }
+
+        // Handle non-synthetic events.
+        self.with_state(|state| {
+            buffer_sink.append(&mut state.events_sink);
+        });
+        for event in buffer_sink.drain() {
+            let event = event.map_nonuser_event().unwrap();
+            callback(event, &self.window_target);
+        }
+
+        // Collect the window ids
+        self.with_state(|state| {
+            window_ids.extend(state.window_requests.get_mut().keys());
+        });
+
+        for window_id in window_ids.iter() {
+            let event = self.with_state(|state| {
+                let window_requests = state.window_requests.get_mut();
+                if window_requests.get(window_id).unwrap().take_closed() {
+                    mem::drop(window_requests.remove(window_id));
+                    mem::drop(state.windows.get_mut().remove(window_id));
+                    return Some(WindowEvent::Destroyed);
+                }
+
+                let mut window =
+                    state.windows.get_mut().get_mut(window_id).unwrap().lock().unwrap();
+
+                if window.frame_callback_state() == FrameCallbackState::Requested {
+                    return None;
+                }
+
+                // Reset the frame callbacks state.
+                window.frame_callback_reset();
+                let mut redraw_requested =
+                    window_requests.get(window_id).unwrap().take_redraw_requested();
+
+                // Redraw the frame while at it.
+                redraw_requested |= window.refresh_frame();
+
+                redraw_requested.then_some(WindowEvent::RedrawRequested)
+            });
+
+            if let Some(event) = event {
+                callback(
+                    Event::WindowEvent { window_id: crate::window::WindowId(*window_id), event },
+                    &self.window_target,
+                );
+            }
+        }
+
+        // Reset the hint that we've dispatched events.
+        self.with_state(|state| {
+            state.dispatched_events = false;
+        });
+
+        // This is always the last event we dispatch before poll again
+        callback(Event::AboutToWait, &self.window_target);
+
+        // Update the window frames and schedule redraws.
+        let mut wake_up = false;
+        for window_id in window_ids.drain(..) {
+            wake_up |= self.with_state(|state| match state.windows.get_mut().get_mut(&window_id) {
+                Some(window) => {
+                    let refresh = window.lock().unwrap().refresh_frame();
+                    if refresh {
+                        state
+                            .window_requests
+                            .get_mut()
+                            .get_mut(&window_id)
+                            .unwrap()
+                            .redraw_requested
+                            .store(true, Ordering::Relaxed);
+                    }
+
+                    refresh
+                },
+                None => false,
+            });
+        }
+
+        // Wakeup event loop if needed.
+        //
+        // If the user draws from the `AboutToWait` this is likely not required, however
+        // we can't do much about it.
+        if wake_up {
+            match &self.window_target.p {
+                PlatformActiveEventLoop::Wayland(window_target) => {
+                    window_target.event_loop_awakener.ping();
+                },
+                #[cfg(x11_platform)]
+                PlatformActiveEventLoop::X(_) => unreachable!(),
+            }
+        }
+
+        std::mem::swap(&mut self.compositor_updates, &mut compositor_updates);
+        std::mem::swap(&mut self.buffer_sink, &mut buffer_sink);
+        std::mem::swap(&mut self.window_ids, &mut window_ids);
+    }
+
+    #[inline]
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy::new(self.user_events_sender.clone())
+    }
+
+    #[inline]
+    pub fn window_target(&self) -> &RootActiveEventLoop {
+        &self.window_target
+    }
+
+    fn with_state<'a, U: 'a, F: FnOnce(&'a mut WinitState) -> U>(&'a mut self, callback: F) -> U {
+        let state = match &mut self.window_target.p {
+            PlatformActiveEventLoop::Wayland(window_target) => window_target.state.get_mut(),
+            #[cfg(x11_platform)]
+            _ => unreachable!(),
+        };
+
+        callback(state)
+    }
+
+    fn loop_dispatch<D: Into<Option<std::time::Duration>>>(&mut self, timeout: D) -> IOResult<()> {
+        let state = match &mut self.window_target.p {
+            PlatformActiveEventLoop::Wayland(window_target) => window_target.state.get_mut(),
+            #[cfg(feature = "x11")]
+            _ => unreachable!(),
+        };
+
+        self.event_loop.dispatch(timeout, state).map_err(|error| {
+            tracing::error!("Error dispatching event loop: {}", error);
+            error.into()
+        })
+    }
+
+    fn roundtrip(&mut self) -> Result<usize, RootOsError> {
+        let state = match &mut self.window_target.p {
+            PlatformActiveEventLoop::Wayland(window_target) => window_target.state.get_mut(),
+            #[cfg(feature = "x11")]
+            _ => unreachable!(),
+        };
+
+        let mut wayland_source = self.wayland_dispatcher.as_source_mut();
+        let event_queue = wayland_source.queue();
+        event_queue.roundtrip(state).map_err(|error| {
+            os_error!(OsError::WaylandError(Arc::new(WaylandError::Dispatch(error))))
+        })
+    }
+
+    fn control_flow(&self) -> ControlFlow {
+        self.window_target.p.control_flow()
+    }
+
+    fn exiting(&self) -> bool {
+        self.window_target.p.exiting()
+    }
+
+    fn set_exit_code(&self, code: i32) {
+        self.window_target.p.set_exit_code(code)
+    }
+
+    fn exit_code(&self) -> Option<i32> {
+        self.window_target.p.exit_code()
+    }
+}
+
+impl<T> AsFd for EventLoop<T> {
+    fn as_fd(&self) -> BorrowedFd<'_> {
+        self.event_loop.as_fd()
+    }
+}
+
+impl<T> AsRawFd for EventLoop<T> {
+    fn as_raw_fd(&self) -> RawFd {
+        self.event_loop.as_raw_fd()
+    }
+}
+
+pub struct ActiveEventLoop {
+    /// The event loop wakeup source.
+    pub event_loop_awakener: Ping,
+
+    /// The main queue used by the event loop.
+    pub queue_handle: QueueHandle<WinitState>,
+
+    /// The application's latest control_flow state
+    pub(crate) control_flow: Cell<ControlFlow>,
+
+    /// The application's exit state.
+    pub(crate) exit: Cell<Option<i32>>,
+
+    // TODO remove that RefCell once we can pass `&mut` in `Window::new`.
+    /// Winit state.
+    pub state: RefCell<WinitState>,
+
+    /// Dispatcher of Wayland events.
+    pub wayland_dispatcher: WaylandDispatcher,
+
+    /// Connection to the wayland server.
+    pub connection: Connection,
+}
+
+impl ActiveEventLoop {
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.control_flow.set(control_flow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.control_flow.get()
+    }
+
+    pub(crate) fn exit(&self) {
+        self.exit.set(Some(0))
+    }
+
+    pub(crate) fn clear_exit(&self) {
+        self.exit.set(None)
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.exit.get().is_some()
+    }
+
+    pub(crate) fn set_exit_code(&self, code: i32) {
+        self.exit.set(Some(code))
+    }
+
+    pub(crate) fn exit_code(&self) -> Option<i32> {
+        self.exit.get()
+    }
+
+    #[inline]
+    pub fn listen_device_events(&self, _allowed: DeviceEvents) {}
+
+    pub(crate) fn create_custom_cursor(&self, cursor: CustomCursorSource) -> RootCustomCursor {
+        RootCustomCursor {
+            inner: PlatformCustomCursor::Wayland(OnlyCursorImage(Arc::from(cursor.inner.0))),
+        }
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        use sctk::reexports::client::Proxy;
+
+        let mut display_handle = rwh_05::WaylandDisplayHandle::empty();
+        display_handle.display = self.connection.display().id().as_ptr() as *mut _;
+        rwh_05::RawDisplayHandle::Wayland(display_handle)
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        use sctk::reexports::client::Proxy;
+
+        Ok(rwh_06::WaylandDisplayHandle::new({
+            let ptr = self.connection.display().id().as_ptr();
+            std::ptr::NonNull::new(ptr as *mut _).expect("wl_display should never be null")
+        })
+        .into())
+    }
+}
+
+#[derive(Debug)]
+struct PumpEventNotifier {
+    /// Whether we're in winit or not.
+    control: Arc<(Mutex<PumpEventNotifierAction>, Condvar)>,
+    /// Waker handle for the working thread.
+    worker_waker: Option<OwnedFd>,
+    /// Thread handle.
+    handle: Option<JoinHandle<()>>,
+}
+
+impl Drop for PumpEventNotifier {
+    fn drop(&mut self) {
+        // Wake-up the thread.
+        if let Some(worker_waker) = self.worker_waker.as_ref() {
+            let _ = rustix::io::write(worker_waker.as_fd(), &[0u8]);
+        }
+        *self.control.0.lock().unwrap() = PumpEventNotifierAction::Shutdown;
+        self.control.1.notify_one();
+
+        if let Some(handle) = self.handle.take() {
+            let _ = handle.join();
+        }
+    }
+}
+
+impl PumpEventNotifier {
+    fn spawn(connection: Connection, awakener: Ping) -> Self {
+        // Start from the waiting state.
+        let control = Arc::new((Mutex::new(PumpEventNotifierAction::Pause), Condvar::new()));
+        let control_thread = Arc::clone(&control);
+
+        let (read, write) = match pipe::pipe_with(PipeFlags::CLOEXEC | PipeFlags::NONBLOCK) {
+            Ok((read, write)) => (read, write),
+            Err(_) => return Self { control, handle: None, worker_waker: None },
+        };
+
+        let handle =
+            std::thread::Builder::new().name(String::from("pump_events mon")).spawn(move || {
+                let (lock, cvar) = &*control_thread;
+                'outer: loop {
+                    let mut wait = lock.lock().unwrap();
+                    while *wait == PumpEventNotifierAction::Pause {
+                        wait = cvar.wait(wait).unwrap();
+                    }
+
+                    // Exit the loop when we're asked to. Given that we poll
+                    // only once we can take the `prepare_read`, but in some cases
+                    // it could be not possible, we may block on `join`.
+                    if *wait == PumpEventNotifierAction::Shutdown {
+                        break 'outer;
+                    }
+
+                    // Wake-up the main loop and put this one back to sleep.
+                    *wait = PumpEventNotifierAction::Pause;
+                    drop(wait);
+
+                    while let Some(read_guard) = connection.prepare_read() {
+                        let _ = connection.flush();
+                        let poll_fd = PollFd::from_borrowed_fd(connection.as_fd(), PollFlags::IN);
+                        let pipe_poll_fd = PollFd::from_borrowed_fd(read.as_fd(), PollFlags::IN);
+                        // Read from the `fd` before going back to poll.
+                        if Ok(1) == rustix::io::read(read.as_fd(), &mut [0u8; 1]) {
+                            break 'outer;
+                        }
+                        let _ = rustix::event::poll(&mut [poll_fd, pipe_poll_fd], -1);
+                        // Non-blocking read the connection.
+                        let _ = read_guard.read_without_dispatch();
+                    }
+
+                    awakener.ping();
+                }
+            });
+
+        if let Some(err) = handle.as_ref().err() {
+            warn!("failed to spawn pump_events wake-up thread: {err}");
+        }
+
+        PumpEventNotifier { control, handle: handle.ok(), worker_waker: Some(write) }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum PumpEventNotifierAction {
+    /// Monitor the wayland queue.
+    Monitor,
+    /// Pause monitoring.
+    Pause,
+    /// Shutdown the thread.
+    Shutdown,
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/event_loop/proxy.rs b/vendor/winit/src/platform_impl/linux/wayland/event_loop/proxy.rs
new file mode 100644
index 00000000..9dc7d992
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/event_loop/proxy.rs
@@ -0,0 +1,28 @@
+//! An event loop proxy.
+
+use std::sync::mpsc::SendError;
+
+use sctk::reexports::calloop::channel::Sender;
+
+use crate::event_loop::EventLoopClosed;
+
+/// A handle that can be sent across the threads and used to wake up the `EventLoop`.
+pub struct EventLoopProxy<T: 'static> {
+    user_events_sender: Sender<T>,
+}
+
+impl<T: 'static> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        EventLoopProxy { user_events_sender: self.user_events_sender.clone() }
+    }
+}
+
+impl<T: 'static> EventLoopProxy<T> {
+    pub fn new(user_events_sender: Sender<T>) -> Self {
+        Self { user_events_sender }
+    }
+
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        self.user_events_sender.send(event).map_err(|SendError(error)| EventLoopClosed(error))
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/event_loop/sink.rs b/vendor/winit/src/platform_impl/linux/wayland/event_loop/sink.rs
new file mode 100644
index 00000000..e506b4a8
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/event_loop/sink.rs
@@ -0,0 +1,53 @@
+//! An event loop's sink to deliver events from the Wayland event callbacks.
+
+use std::vec::Drain;
+
+use crate::event::{DeviceEvent, DeviceId as RootDeviceId, Event, WindowEvent};
+use crate::platform_impl::platform::DeviceId as PlatformDeviceId;
+use crate::window::WindowId as RootWindowId;
+
+use super::{DeviceId, WindowId};
+
+/// An event loop's sink to deliver events from the Wayland event callbacks
+/// to the winit's user.
+#[derive(Default)]
+pub struct EventSink {
+    pub window_events: Vec<Event<()>>,
+}
+
+impl EventSink {
+    pub fn new() -> Self {
+        Default::default()
+    }
+
+    /// Return `true` if there're pending events.
+    #[inline]
+    pub fn is_empty(&self) -> bool {
+        self.window_events.is_empty()
+    }
+
+    /// Add new device event to a queue.
+    #[inline]
+    pub fn push_device_event(&mut self, event: DeviceEvent, device_id: DeviceId) {
+        self.window_events.push(Event::DeviceEvent {
+            event,
+            device_id: RootDeviceId(PlatformDeviceId::Wayland(device_id)),
+        });
+    }
+
+    /// Add new window event to a queue.
+    #[inline]
+    pub fn push_window_event(&mut self, event: WindowEvent, window_id: WindowId) {
+        self.window_events.push(Event::WindowEvent { event, window_id: RootWindowId(window_id) });
+    }
+
+    #[inline]
+    pub fn append(&mut self, other: &mut Self) {
+        self.window_events.append(&mut other.window_events);
+    }
+
+    #[inline]
+    pub fn drain(&mut self) -> Drain<'_, Event<()>> {
+        self.window_events.drain(..)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/mod.rs
new file mode 100644
index 00000000..63052b78
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/mod.rs
@@ -0,0 +1,85 @@
+//! Winit's Wayland backend.
+
+use std::fmt::Display;
+use std::sync::Arc;
+
+use sctk::reexports::client::globals::{BindError, GlobalError};
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{self, ConnectError, DispatchError, Proxy};
+
+pub(super) use crate::cursor::OnlyCursorImage as CustomCursor;
+use crate::dpi::{LogicalSize, PhysicalSize};
+pub use crate::platform_impl::platform::{OsError, WindowId};
+pub use event_loop::{ActiveEventLoop, EventLoop, EventLoopProxy};
+pub use output::{MonitorHandle, VideoModeHandle};
+pub use window::Window;
+
+mod event_loop;
+mod output;
+mod seat;
+mod state;
+mod types;
+mod window;
+
+#[derive(Debug)]
+pub enum WaylandError {
+    /// Error connecting to the socket.
+    Connection(ConnectError),
+
+    /// Error binding the global.
+    Global(GlobalError),
+
+    // Bind error.
+    Bind(BindError),
+
+    /// Error during the dispatching the event queue.
+    Dispatch(DispatchError),
+
+    /// Calloop error.
+    Calloop(calloop::Error),
+
+    /// Wayland
+    Wire(client::backend::WaylandError),
+}
+
+impl Display for WaylandError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            WaylandError::Connection(error) => error.fmt(f),
+            WaylandError::Global(error) => error.fmt(f),
+            WaylandError::Bind(error) => error.fmt(f),
+            WaylandError::Dispatch(error) => error.fmt(f),
+            WaylandError::Calloop(error) => error.fmt(f),
+            WaylandError::Wire(error) => error.fmt(f),
+        }
+    }
+}
+
+impl From<WaylandError> for OsError {
+    fn from(value: WaylandError) -> Self {
+        Self::WaylandError(Arc::new(value))
+    }
+}
+
+/// Dummy device id, since Wayland doesn't have device events.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct DeviceId;
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        DeviceId
+    }
+}
+
+/// Get the WindowId out of the surface.
+#[inline]
+fn make_wid(surface: &WlSurface) -> WindowId {
+    WindowId(surface.id().as_ptr() as u64)
+}
+
+/// The default routine does floor, but we need round on Wayland.
+fn logical_to_physical_rounded(size: LogicalSize<u32>, scale_factor: f64) -> PhysicalSize<u32> {
+    let width = size.width as f64 * scale_factor;
+    let height = size.height as f64 * scale_factor;
+    (width.round(), height.round()).into()
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/output.rs b/vendor/winit/src/platform_impl/linux/wayland/output.rs
new file mode 100644
index 00000000..ae6c1b06
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/output.rs
@@ -0,0 +1,163 @@
+use sctk::reexports::client::protocol::wl_output::WlOutput;
+use sctk::reexports::client::Proxy;
+
+use sctk::output::OutputData;
+
+use crate::dpi::{LogicalPosition, PhysicalPosition, PhysicalSize};
+use crate::platform_impl::platform::VideoModeHandle as PlatformVideoModeHandle;
+
+use super::event_loop::ActiveEventLoop;
+
+impl ActiveEventLoop {
+    #[inline]
+    pub fn available_monitors(&self) -> impl Iterator<Item = MonitorHandle> {
+        self.state.borrow().output_state.outputs().map(MonitorHandle::new)
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        // There's no primary monitor on Wayland.
+        None
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct MonitorHandle {
+    pub(crate) proxy: WlOutput,
+}
+
+impl MonitorHandle {
+    #[inline]
+    pub(crate) fn new(proxy: WlOutput) -> Self {
+        Self { proxy }
+    }
+
+    #[inline]
+    pub fn name(&self) -> Option<String> {
+        let output_data = self.proxy.data::<OutputData>().unwrap();
+        output_data.with_output_info(|info| info.name.clone())
+    }
+
+    #[inline]
+    pub fn native_identifier(&self) -> u32 {
+        let output_data = self.proxy.data::<OutputData>().unwrap();
+        output_data.with_output_info(|info| info.id)
+    }
+
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        let output_data = self.proxy.data::<OutputData>().unwrap();
+        let dimensions = output_data.with_output_info(|info| {
+            info.modes.iter().find_map(|mode| mode.current.then_some(mode.dimensions))
+        });
+
+        match dimensions {
+            Some((width, height)) => (width as u32, height as u32),
+            _ => (0, 0),
+        }
+        .into()
+    }
+
+    #[inline]
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        let output_data = self.proxy.data::<OutputData>().unwrap();
+        output_data.with_output_info(|info| {
+            info.logical_position.map_or_else(
+                || {
+                    LogicalPosition::<i32>::from(info.location)
+                        .to_physical(info.scale_factor as f64)
+                },
+                |logical_position| {
+                    LogicalPosition::<i32>::from(logical_position)
+                        .to_physical(info.scale_factor as f64)
+                },
+            )
+        })
+    }
+
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        let output_data = self.proxy.data::<OutputData>().unwrap();
+        output_data.with_output_info(|info| {
+            info.modes.iter().find_map(|mode| mode.current.then_some(mode.refresh_rate as u32))
+        })
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> i32 {
+        let output_data = self.proxy.data::<OutputData>().unwrap();
+        output_data.scale_factor()
+    }
+
+    #[inline]
+    pub fn video_modes(&self) -> impl Iterator<Item = PlatformVideoModeHandle> {
+        let output_data = self.proxy.data::<OutputData>().unwrap();
+        let modes = output_data.with_output_info(|info| info.modes.clone());
+
+        let monitor = self.clone();
+
+        modes.into_iter().map(move |mode| {
+            PlatformVideoModeHandle::Wayland(VideoModeHandle {
+                size: (mode.dimensions.0 as u32, mode.dimensions.1 as u32).into(),
+                refresh_rate_millihertz: mode.refresh_rate as u32,
+                bit_depth: 32,
+                monitor: monitor.clone(),
+            })
+        })
+    }
+}
+
+impl PartialEq for MonitorHandle {
+    fn eq(&self, other: &Self) -> bool {
+        self.native_identifier() == other.native_identifier()
+    }
+}
+
+impl Eq for MonitorHandle {}
+
+impl PartialOrd for MonitorHandle {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for MonitorHandle {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.native_identifier().cmp(&other.native_identifier())
+    }
+}
+
+impl std::hash::Hash for MonitorHandle {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.native_identifier().hash(state);
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct VideoModeHandle {
+    pub(crate) size: PhysicalSize<u32>,
+    pub(crate) bit_depth: u16,
+    pub(crate) refresh_rate_millihertz: u32,
+    pub(crate) monitor: MonitorHandle,
+}
+
+impl VideoModeHandle {
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.size
+    }
+
+    #[inline]
+    pub fn bit_depth(&self) -> u16 {
+        self.bit_depth
+    }
+
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.refresh_rate_millihertz
+    }
+
+    pub fn monitor(&self) -> MonitorHandle {
+        self.monitor.clone()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/keyboard/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/keyboard/mod.rs
new file mode 100644
index 00000000..f84c3867
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/keyboard/mod.rs
@@ -0,0 +1,380 @@
+//! The keyboard input handling.
+
+use std::sync::Mutex;
+use std::time::Duration;
+
+use calloop::timer::{TimeoutAction, Timer};
+use calloop::{LoopHandle, RegistrationToken};
+use tracing::warn;
+
+use sctk::reexports::client::protocol::wl_keyboard::{
+    Event as WlKeyboardEvent, KeyState as WlKeyState, KeymapFormat as WlKeymapFormat, WlKeyboard,
+};
+use sctk::reexports::client::protocol::wl_seat::WlSeat;
+use sctk::reexports::client::{Connection, Dispatch, Proxy, QueueHandle, WEnum};
+
+use crate::event::{ElementState, WindowEvent};
+use crate::keyboard::ModifiersState;
+
+use crate::platform_impl::common::xkb::Context;
+use crate::platform_impl::wayland::event_loop::sink::EventSink;
+use crate::platform_impl::wayland::state::WinitState;
+use crate::platform_impl::wayland::{self, DeviceId, WindowId};
+
+impl Dispatch<WlKeyboard, KeyboardData, WinitState> for WinitState {
+    fn event(
+        state: &mut WinitState,
+        wl_keyboard: &WlKeyboard,
+        event: <WlKeyboard as Proxy>::Event,
+        data: &KeyboardData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        let seat_state = match state.seats.get_mut(&data.seat.id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received keyboard event {event:?} without seat");
+                return;
+            },
+        };
+        let keyboard_state = match seat_state.keyboard_state.as_mut() {
+            Some(keyboard_state) => keyboard_state,
+            None => {
+                warn!("Received keyboard event {event:?} without keyboard");
+                return;
+            },
+        };
+
+        match event {
+            WlKeyboardEvent::Keymap { format, fd, size } => match format {
+                WEnum::Value(format) => match format {
+                    WlKeymapFormat::NoKeymap => {
+                        warn!("non-xkb compatible keymap")
+                    },
+                    WlKeymapFormat::XkbV1 => {
+                        let context = &mut keyboard_state.xkb_context;
+                        context.set_keymap_from_fd(fd, size as usize);
+                    },
+                    _ => unreachable!(),
+                },
+                WEnum::Unknown(value) => {
+                    warn!("unknown keymap format 0x{:x}", value)
+                },
+            },
+            WlKeyboardEvent::Enter { surface, .. } => {
+                let window_id = wayland::make_wid(&surface);
+
+                // Mark the window as focused.
+                let was_unfocused = match state.windows.get_mut().get(&window_id) {
+                    Some(window) => {
+                        let mut window = window.lock().unwrap();
+                        let was_unfocused = !window.has_focus();
+                        window.add_seat_focus(data.seat.id());
+                        was_unfocused
+                    },
+                    None => return,
+                };
+
+                // Drop the repeat, if there were any.
+                keyboard_state.current_repeat = None;
+                if let Some(token) = keyboard_state.repeat_token.take() {
+                    keyboard_state.loop_handle.remove(token);
+                }
+
+                *data.window_id.lock().unwrap() = Some(window_id);
+
+                // The keyboard focus is considered as general focus.
+                if was_unfocused {
+                    state.events_sink.push_window_event(WindowEvent::Focused(true), window_id);
+                }
+
+                // HACK: this is just for GNOME not fixing their ordering issue of modifiers.
+                if std::mem::take(&mut seat_state.modifiers_pending) {
+                    state.events_sink.push_window_event(
+                        WindowEvent::ModifiersChanged(seat_state.modifiers.into()),
+                        window_id,
+                    );
+                }
+            },
+            WlKeyboardEvent::Leave { surface, .. } => {
+                let window_id = wayland::make_wid(&surface);
+
+                // NOTE: we should drop the repeat regardless whether it was for the present
+                // window of for the window which just went gone.
+                keyboard_state.current_repeat = None;
+                if let Some(token) = keyboard_state.repeat_token.take() {
+                    keyboard_state.loop_handle.remove(token);
+                }
+
+                // NOTE: The check whether the window exists is essential as we might get a
+                // nil surface, regardless of what protocol says.
+                let focused = match state.windows.get_mut().get(&window_id) {
+                    Some(window) => {
+                        let mut window = window.lock().unwrap();
+                        window.remove_seat_focus(&data.seat.id());
+                        window.has_focus()
+                    },
+                    None => return,
+                };
+
+                // We don't need to update it above, because the next `Enter` will overwrite
+                // anyway.
+                *data.window_id.lock().unwrap() = None;
+
+                if !focused {
+                    // Notify that no modifiers are being pressed.
+                    state.events_sink.push_window_event(
+                        WindowEvent::ModifiersChanged(ModifiersState::empty().into()),
+                        window_id,
+                    );
+
+                    state.events_sink.push_window_event(WindowEvent::Focused(false), window_id);
+                }
+            },
+            WlKeyboardEvent::Key { key, state: WEnum::Value(WlKeyState::Pressed), .. } => {
+                let key = key + 8;
+
+                key_input(
+                    keyboard_state,
+                    &mut state.events_sink,
+                    data,
+                    key,
+                    ElementState::Pressed,
+                    false,
+                );
+
+                let delay = match keyboard_state.repeat_info {
+                    RepeatInfo::Repeat { delay, .. } => delay,
+                    RepeatInfo::Disable => return,
+                };
+
+                if !keyboard_state.xkb_context.keymap_mut().unwrap().key_repeats(key) {
+                    return;
+                }
+
+                keyboard_state.current_repeat = Some(key);
+
+                // NOTE terminate ongoing timer and start a new timer.
+
+                if let Some(token) = keyboard_state.repeat_token.take() {
+                    keyboard_state.loop_handle.remove(token);
+                }
+
+                let timer = Timer::from_duration(delay);
+                let wl_keyboard = wl_keyboard.clone();
+                keyboard_state.repeat_token = keyboard_state
+                    .loop_handle
+                    .insert_source(timer, move |_, _, state| {
+                        // Required to handle the wakeups from the repeat sources.
+                        state.dispatched_events = true;
+
+                        let data = wl_keyboard.data::<KeyboardData>().unwrap();
+                        let seat_state = match state.seats.get_mut(&data.seat.id()) {
+                            Some(seat_state) => seat_state,
+                            None => return TimeoutAction::Drop,
+                        };
+
+                        let keyboard_state = match seat_state.keyboard_state.as_mut() {
+                            Some(keyboard_state) => keyboard_state,
+                            None => return TimeoutAction::Drop,
+                        };
+
+                        // NOTE: The removed on event source is batched, but key change to `None`
+                        // is instant.
+                        let repeat_keycode = match keyboard_state.current_repeat {
+                            Some(repeat_keycode) => repeat_keycode,
+                            None => return TimeoutAction::Drop,
+                        };
+
+                        key_input(
+                            keyboard_state,
+                            &mut state.events_sink,
+                            data,
+                            repeat_keycode,
+                            ElementState::Pressed,
+                            true,
+                        );
+
+                        // NOTE: the gap could change dynamically while repeat is going.
+                        match keyboard_state.repeat_info {
+                            RepeatInfo::Repeat { gap, .. } => TimeoutAction::ToDuration(gap),
+                            RepeatInfo::Disable => TimeoutAction::Drop,
+                        }
+                    })
+                    .ok();
+            },
+            WlKeyboardEvent::Key { key, state: WEnum::Value(WlKeyState::Released), .. } => {
+                let key = key + 8;
+
+                key_input(
+                    keyboard_state,
+                    &mut state.events_sink,
+                    data,
+                    key,
+                    ElementState::Released,
+                    false,
+                );
+
+                if keyboard_state.repeat_info != RepeatInfo::Disable
+                    && keyboard_state.xkb_context.keymap_mut().unwrap().key_repeats(key)
+                    && Some(key) == keyboard_state.current_repeat
+                {
+                    keyboard_state.current_repeat = None;
+                    if let Some(token) = keyboard_state.repeat_token.take() {
+                        keyboard_state.loop_handle.remove(token);
+                    }
+                }
+            },
+            WlKeyboardEvent::Modifiers {
+                mods_depressed, mods_latched, mods_locked, group, ..
+            } => {
+                let xkb_context = &mut keyboard_state.xkb_context;
+                let xkb_state = match xkb_context.state_mut() {
+                    Some(state) => state,
+                    None => return,
+                };
+
+                xkb_state.update_modifiers(mods_depressed, mods_latched, mods_locked, 0, 0, group);
+                seat_state.modifiers = xkb_state.modifiers().into();
+
+                // HACK: part of the workaround from `WlKeyboardEvent::Enter`.
+                let window_id = match *data.window_id.lock().unwrap() {
+                    Some(window_id) => window_id,
+                    None => {
+                        seat_state.modifiers_pending = true;
+                        return;
+                    },
+                };
+
+                state.events_sink.push_window_event(
+                    WindowEvent::ModifiersChanged(seat_state.modifiers.into()),
+                    window_id,
+                );
+            },
+            WlKeyboardEvent::RepeatInfo { rate, delay } => {
+                keyboard_state.repeat_info = if rate == 0 {
+                    // Stop the repeat once we get a disable event.
+                    keyboard_state.current_repeat = None;
+                    if let Some(repeat_token) = keyboard_state.repeat_token.take() {
+                        keyboard_state.loop_handle.remove(repeat_token);
+                    }
+                    RepeatInfo::Disable
+                } else {
+                    let gap = Duration::from_micros(1_000_000 / rate as u64);
+                    let delay = Duration::from_millis(delay as u64);
+                    RepeatInfo::Repeat { gap, delay }
+                };
+            },
+            _ => unreachable!(),
+        }
+    }
+}
+
+/// The state of the keyboard on the current seat.
+#[derive(Debug)]
+pub struct KeyboardState {
+    /// The underlying WlKeyboard.
+    pub keyboard: WlKeyboard,
+
+    /// Loop handle to handle key repeat.
+    pub loop_handle: LoopHandle<'static, WinitState>,
+
+    /// The state of the keyboard.
+    pub xkb_context: Context,
+
+    /// The information about the repeat rate obtained from the compositor.
+    pub repeat_info: RepeatInfo,
+
+    /// The token of the current handle inside the calloop's event loop.
+    pub repeat_token: Option<RegistrationToken>,
+
+    /// The current repeat raw key.
+    pub current_repeat: Option<u32>,
+}
+
+impl KeyboardState {
+    pub fn new(keyboard: WlKeyboard, loop_handle: LoopHandle<'static, WinitState>) -> Self {
+        Self {
+            keyboard,
+            loop_handle,
+            xkb_context: Context::new().unwrap(),
+            repeat_info: RepeatInfo::default(),
+            repeat_token: None,
+            current_repeat: None,
+        }
+    }
+}
+
+impl Drop for KeyboardState {
+    fn drop(&mut self) {
+        if self.keyboard.version() >= 3 {
+            self.keyboard.release();
+        }
+
+        if let Some(token) = self.repeat_token.take() {
+            self.loop_handle.remove(token);
+        }
+    }
+}
+
+/// The rate at which a pressed key is repeated.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RepeatInfo {
+    /// Keys will be repeated at the specified rate and delay.
+    Repeat {
+        /// The time between the key repeats.
+        gap: Duration,
+
+        /// Delay (in milliseconds) between a key press and the start of repetition.
+        delay: Duration,
+    },
+
+    /// Keys should not be repeated.
+    Disable,
+}
+
+impl Default for RepeatInfo {
+    /// The default repeat rate is 25 keys per second with the delay of 200ms.
+    ///
+    /// The values are picked based on the default in various compositors and Xorg.
+    fn default() -> Self {
+        Self::Repeat { gap: Duration::from_millis(40), delay: Duration::from_millis(200) }
+    }
+}
+
+/// Keyboard user data.
+#[derive(Debug)]
+pub struct KeyboardData {
+    /// The currently focused window surface. Could be `None` on bugged compositors, like mutter.
+    window_id: Mutex<Option<WindowId>>,
+
+    /// The seat used to create this keyboard.
+    seat: WlSeat,
+}
+
+impl KeyboardData {
+    pub fn new(seat: WlSeat) -> Self {
+        Self { window_id: Default::default(), seat }
+    }
+}
+
+fn key_input(
+    keyboard_state: &mut KeyboardState,
+    event_sink: &mut EventSink,
+    data: &KeyboardData,
+    keycode: u32,
+    state: ElementState,
+    repeat: bool,
+) {
+    let window_id = match *data.window_id.lock().unwrap() {
+        Some(window_id) => window_id,
+        None => return,
+    };
+
+    let device_id = crate::event::DeviceId(crate::platform_impl::DeviceId::Wayland(DeviceId));
+    if let Some(mut key_context) = keyboard_state.xkb_context.key_context() {
+        let event = key_context.process_key_event(keycode, state, repeat);
+        let event = WindowEvent::KeyboardInput { device_id, event, is_synthetic: false };
+        event_sink.push_window_event(event, window_id);
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/mod.rs
new file mode 100644
index 00000000..eaecd93b
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/mod.rs
@@ -0,0 +1,235 @@
+//! Seat handling.
+
+use std::sync::Arc;
+
+use ahash::AHashMap;
+use tracing::warn;
+
+use sctk::reexports::client::backend::ObjectId;
+use sctk::reexports::client::protocol::wl_seat::WlSeat;
+use sctk::reexports::client::protocol::wl_touch::WlTouch;
+use sctk::reexports::client::{Connection, Proxy, QueueHandle};
+use sctk::reexports::protocols::wp::relative_pointer::zv1::client::zwp_relative_pointer_v1::ZwpRelativePointerV1;
+use sctk::reexports::protocols::wp::text_input::zv3::client::zwp_text_input_v3::ZwpTextInputV3;
+
+use sctk::seat::pointer::{ThemeSpec, ThemedPointer};
+use sctk::seat::{Capability as SeatCapability, SeatHandler, SeatState};
+
+use crate::event::WindowEvent;
+use crate::keyboard::ModifiersState;
+use crate::platform_impl::wayland::state::WinitState;
+
+mod keyboard;
+mod pointer;
+mod text_input;
+mod touch;
+
+pub use pointer::relative_pointer::RelativePointerState;
+pub use pointer::{PointerConstraintsState, WinitPointerData, WinitPointerDataExt};
+pub use text_input::{TextInputState, ZwpTextInputV3Ext};
+
+use keyboard::{KeyboardData, KeyboardState};
+use text_input::TextInputData;
+use touch::TouchPoint;
+
+#[derive(Debug, Default)]
+pub struct WinitSeatState {
+    /// The pointer bound on the seat.
+    pointer: Option<Arc<ThemedPointer<WinitPointerData>>>,
+
+    /// The touch bound on the seat.
+    touch: Option<WlTouch>,
+
+    /// The mapping from touched points to the surfaces they're present.
+    touch_map: AHashMap<i32, TouchPoint>,
+
+    /// The text input bound on the seat.
+    text_input: Option<Arc<ZwpTextInputV3>>,
+
+    /// The relative pointer bound on the seat.
+    relative_pointer: Option<ZwpRelativePointerV1>,
+
+    /// The keyboard bound on the seat.
+    keyboard_state: Option<KeyboardState>,
+
+    /// The current modifiers state on the seat.
+    modifiers: ModifiersState,
+
+    /// Whether we have pending modifiers.
+    modifiers_pending: bool,
+}
+
+impl WinitSeatState {
+    pub fn new() -> Self {
+        Default::default()
+    }
+}
+
+impl SeatHandler for WinitState {
+    fn seat_state(&mut self) -> &mut SeatState {
+        &mut self.seat_state
+    }
+
+    fn new_capability(
+        &mut self,
+        _: &Connection,
+        queue_handle: &QueueHandle<Self>,
+        seat: WlSeat,
+        capability: SeatCapability,
+    ) {
+        let seat_state = match self.seats.get_mut(&seat.id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received wl_seat::new_capability for unknown seat");
+                return;
+            },
+        };
+
+        match capability {
+            SeatCapability::Touch if seat_state.touch.is_none() => {
+                seat_state.touch = self.seat_state.get_touch(queue_handle, &seat).ok();
+            },
+            SeatCapability::Keyboard if seat_state.keyboard_state.is_none() => {
+                let keyboard = seat.get_keyboard(queue_handle, KeyboardData::new(seat.clone()));
+                seat_state.keyboard_state =
+                    Some(KeyboardState::new(keyboard, self.loop_handle.clone()));
+            },
+            SeatCapability::Pointer if seat_state.pointer.is_none() => {
+                let surface = self.compositor_state.create_surface(queue_handle);
+                let viewport = self
+                    .viewporter_state
+                    .as_ref()
+                    .map(|state| state.get_viewport(&surface, queue_handle));
+                let surface_id = surface.id();
+                let pointer_data = WinitPointerData::new(seat.clone(), viewport);
+                let themed_pointer = self
+                    .seat_state
+                    .get_pointer_with_theme_and_data(
+                        queue_handle,
+                        &seat,
+                        self.shm.wl_shm(),
+                        surface,
+                        ThemeSpec::System,
+                        pointer_data,
+                    )
+                    .expect("failed to create pointer with present capability.");
+
+                seat_state.relative_pointer = self.relative_pointer.as_ref().map(|manager| {
+                    manager.get_relative_pointer(
+                        themed_pointer.pointer(),
+                        queue_handle,
+                        sctk::globals::GlobalData,
+                    )
+                });
+
+                let themed_pointer = Arc::new(themed_pointer);
+
+                // Register cursor surface.
+                self.pointer_surfaces.insert(surface_id, themed_pointer.clone());
+
+                seat_state.pointer = Some(themed_pointer);
+            },
+            _ => (),
+        }
+
+        if let Some(text_input_state) =
+            seat_state.text_input.is_none().then_some(self.text_input_state.as_ref()).flatten()
+        {
+            seat_state.text_input = Some(Arc::new(text_input_state.get_text_input(
+                &seat,
+                queue_handle,
+                TextInputData::default(),
+            )));
+        }
+    }
+
+    fn remove_capability(
+        &mut self,
+        _: &Connection,
+        _queue_handle: &QueueHandle<Self>,
+        seat: WlSeat,
+        capability: SeatCapability,
+    ) {
+        let seat_state = match self.seats.get_mut(&seat.id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received wl_seat::remove_capability for unknown seat");
+                return;
+            },
+        };
+
+        if let Some(text_input) = seat_state.text_input.take() {
+            text_input.destroy();
+        }
+
+        match capability {
+            SeatCapability::Touch => {
+                if let Some(touch) = seat_state.touch.take() {
+                    if touch.version() >= 3 {
+                        touch.release();
+                    }
+                }
+            },
+            SeatCapability::Pointer => {
+                if let Some(relative_pointer) = seat_state.relative_pointer.take() {
+                    relative_pointer.destroy();
+                }
+
+                if let Some(pointer) = seat_state.pointer.take() {
+                    let pointer_data = pointer.pointer().winit_data();
+
+                    // Remove the cursor from the mapping.
+                    let surface_id = pointer.surface().id();
+                    let _ = self.pointer_surfaces.remove(&surface_id);
+
+                    // Remove the inner locks/confines before dropping the pointer.
+                    pointer_data.unlock_pointer();
+                    pointer_data.unconfine_pointer();
+
+                    if pointer.pointer().version() >= 3 {
+                        pointer.pointer().release();
+                    }
+                }
+            },
+            SeatCapability::Keyboard => {
+                seat_state.keyboard_state = None;
+                self.on_keyboard_destroy(&seat.id());
+            },
+            _ => (),
+        }
+    }
+
+    fn new_seat(
+        &mut self,
+        _connection: &Connection,
+        _queue_handle: &QueueHandle<Self>,
+        seat: WlSeat,
+    ) {
+        self.seats.insert(seat.id(), WinitSeatState::new());
+    }
+
+    fn remove_seat(
+        &mut self,
+        _connection: &Connection,
+        _queue_handle: &QueueHandle<Self>,
+        seat: WlSeat,
+    ) {
+        let _ = self.seats.remove(&seat.id());
+        self.on_keyboard_destroy(&seat.id());
+    }
+}
+
+impl WinitState {
+    fn on_keyboard_destroy(&mut self, seat: &ObjectId) {
+        for (window_id, window) in self.windows.get_mut() {
+            let mut window = window.lock().unwrap();
+            let had_focus = window.has_focus();
+            window.remove_seat_focus(seat);
+            if had_focus != window.has_focus() {
+                self.events_sink.push_window_event(WindowEvent::Focused(false), *window_id);
+            }
+        }
+    }
+}
+
+sctk::delegate_seat!(WinitState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs
new file mode 100644
index 00000000..3dcb00b2
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/mod.rs
@@ -0,0 +1,502 @@
+//! The pointer events.
+
+use std::ops::Deref;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use tracing::warn;
+
+use sctk::reexports::client::delegate_dispatch;
+use sctk::reexports::client::protocol::wl_pointer::WlPointer;
+use sctk::reexports::client::protocol::wl_seat::WlSeat;
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{Connection, Proxy, QueueHandle, Dispatch};
+use sctk::reexports::protocols::wp::pointer_constraints::zv1::client::zwp_confined_pointer_v1::ZwpConfinedPointerV1;
+use sctk::reexports::protocols::wp::pointer_constraints::zv1::client::zwp_locked_pointer_v1::ZwpLockedPointerV1;
+use sctk::reexports::protocols::wp::cursor_shape::v1::client::wp_cursor_shape_device_v1::WpCursorShapeDeviceV1;
+use sctk::reexports::protocols::wp::cursor_shape::v1::client::wp_cursor_shape_manager_v1::WpCursorShapeManagerV1;
+use sctk::reexports::protocols::wp::pointer_constraints::zv1::client::zwp_pointer_constraints_v1::{Lifetime, ZwpPointerConstraintsV1};
+use sctk::reexports::client::globals::{BindError, GlobalList};
+use sctk::reexports::csd_frame::FrameClick;
+use sctk::reexports::protocols::wp::viewporter::client::wp_viewport::WpViewport;
+
+use sctk::compositor::SurfaceData;
+use sctk::globals::GlobalData;
+use sctk::seat::pointer::{
+    PointerData, PointerDataExt, PointerEvent, PointerEventKind, PointerHandler,
+};
+use sctk::seat::SeatState;
+
+use crate::dpi::{LogicalPosition, PhysicalPosition};
+use crate::event::{ElementState, MouseButton, MouseScrollDelta, TouchPhase, WindowEvent};
+
+use crate::platform_impl::wayland::state::WinitState;
+use crate::platform_impl::wayland::{self, DeviceId, WindowId};
+
+pub mod relative_pointer;
+
+impl PointerHandler for WinitState {
+    fn pointer_frame(
+        &mut self,
+        connection: &Connection,
+        _: &QueueHandle<Self>,
+        pointer: &WlPointer,
+        events: &[PointerEvent],
+    ) {
+        let seat = pointer.winit_data().seat();
+        let seat_state = match self.seats.get(&seat.id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received pointer event without seat");
+                return;
+            },
+        };
+
+        let themed_pointer = match seat_state.pointer.as_ref() {
+            Some(pointer) => pointer,
+            None => {
+                warn!("Received pointer event without pointer");
+                return;
+            },
+        };
+
+        let device_id = crate::event::DeviceId(crate::platform_impl::DeviceId::Wayland(DeviceId));
+
+        for event in events {
+            let surface = &event.surface;
+
+            // The parent surface.
+            let parent_surface = match event.surface.data::<SurfaceData>() {
+                Some(data) => data.parent_surface().unwrap_or(surface),
+                None => continue,
+            };
+
+            let window_id = wayland::make_wid(parent_surface);
+
+            // Ensure that window exists.
+            let mut window = match self.windows.get_mut().get_mut(&window_id) {
+                Some(window) => window.lock().unwrap(),
+                None => continue,
+            };
+
+            let scale_factor = window.scale_factor();
+            let position: PhysicalPosition<f64> =
+                LogicalPosition::new(event.position.0, event.position.1).to_physical(scale_factor);
+
+            match event.kind {
+                // Pointer movements on decorations.
+                PointerEventKind::Enter { .. } | PointerEventKind::Motion { .. }
+                    if parent_surface != surface =>
+                {
+                    if let Some(icon) = window.frame_point_moved(
+                        seat,
+                        surface,
+                        Duration::ZERO,
+                        event.position.0,
+                        event.position.1,
+                    ) {
+                        let _ = themed_pointer.set_cursor(connection, icon);
+                    }
+                },
+                PointerEventKind::Leave { .. } if parent_surface != surface => {
+                    window.frame_point_left();
+                },
+                ref kind @ PointerEventKind::Press { button, serial, time }
+                | ref kind @ PointerEventKind::Release { button, serial, time }
+                    if parent_surface != surface =>
+                {
+                    let click = match wayland_button_to_winit(button) {
+                        MouseButton::Left => FrameClick::Normal,
+                        MouseButton::Right => FrameClick::Alternate,
+                        _ => continue,
+                    };
+                    let pressed = matches!(kind, PointerEventKind::Press { .. });
+
+                    // Emulate click on the frame.
+                    window.frame_click(
+                        click,
+                        pressed,
+                        seat,
+                        serial,
+                        Duration::from_millis(time as u64),
+                        window_id,
+                        &mut self.window_compositor_updates,
+                    );
+                },
+                // Regular events on the main surface.
+                PointerEventKind::Enter { .. } => {
+                    self.events_sink
+                        .push_window_event(WindowEvent::CursorEntered { device_id }, window_id);
+
+                    window.pointer_entered(Arc::downgrade(themed_pointer));
+
+                    // Set the currently focused surface.
+                    pointer.winit_data().inner.lock().unwrap().surface = Some(window_id);
+
+                    self.events_sink.push_window_event(
+                        WindowEvent::CursorMoved { device_id, position },
+                        window_id,
+                    );
+                },
+                PointerEventKind::Leave { .. } => {
+                    window.pointer_left(Arc::downgrade(themed_pointer));
+
+                    // Remove the active surface.
+                    pointer.winit_data().inner.lock().unwrap().surface = None;
+
+                    self.events_sink
+                        .push_window_event(WindowEvent::CursorLeft { device_id }, window_id);
+                },
+                PointerEventKind::Motion { .. } => {
+                    self.events_sink.push_window_event(
+                        WindowEvent::CursorMoved { device_id, position },
+                        window_id,
+                    );
+                },
+                ref kind @ PointerEventKind::Press { button, serial, .. }
+                | ref kind @ PointerEventKind::Release { button, serial, .. } => {
+                    // Update the last button serial.
+                    pointer.winit_data().inner.lock().unwrap().latest_button_serial = serial;
+
+                    let button = wayland_button_to_winit(button);
+                    let state = if matches!(kind, PointerEventKind::Press { .. }) {
+                        ElementState::Pressed
+                    } else {
+                        ElementState::Released
+                    };
+                    self.events_sink.push_window_event(
+                        WindowEvent::MouseInput { device_id, state, button },
+                        window_id,
+                    );
+                },
+                PointerEventKind::Axis { horizontal, vertical, .. } => {
+                    // Get the current phase.
+                    let mut pointer_data = pointer.winit_data().inner.lock().unwrap();
+
+                    let has_discrete_scroll = horizontal.discrete != 0 || vertical.discrete != 0;
+
+                    // Figure out what to do about start/ended phases here.
+                    //
+                    // Figure out how to deal with `Started`. Also the `Ended` is not guaranteed
+                    // to be sent for mouse wheels.
+                    let phase = if horizontal.stop || vertical.stop {
+                        TouchPhase::Ended
+                    } else {
+                        match pointer_data.phase {
+                            // Discrete scroll only results in moved events.
+                            _ if has_discrete_scroll => TouchPhase::Moved,
+                            TouchPhase::Started | TouchPhase::Moved => TouchPhase::Moved,
+                            _ => TouchPhase::Started,
+                        }
+                    };
+
+                    // Update the phase.
+                    pointer_data.phase = phase;
+
+                    // Mice events have both pixel and discrete delta's at the same time. So prefer
+                    // the discrete values if they are present.
+                    let delta = if has_discrete_scroll {
+                        // NOTE: Wayland sign convention is the inverse of winit.
+                        MouseScrollDelta::LineDelta(
+                            (-horizontal.discrete) as f32,
+                            (-vertical.discrete) as f32,
+                        )
+                    } else {
+                        // NOTE: Wayland sign convention is the inverse of winit.
+                        MouseScrollDelta::PixelDelta(
+                            LogicalPosition::new(-horizontal.absolute, -vertical.absolute)
+                                .to_physical(scale_factor),
+                        )
+                    };
+
+                    self.events_sink.push_window_event(
+                        WindowEvent::MouseWheel { device_id, delta, phase },
+                        window_id,
+                    )
+                },
+            }
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct WinitPointerData {
+    /// The inner winit data associated with the pointer.
+    inner: Mutex<WinitPointerDataInner>,
+
+    /// The data required by the sctk.
+    sctk_data: PointerData,
+
+    /// Viewport for fractional cursor.
+    viewport: Option<WpViewport>,
+}
+
+impl WinitPointerData {
+    pub fn new(seat: WlSeat, viewport: Option<WpViewport>) -> Self {
+        Self {
+            inner: Mutex::new(WinitPointerDataInner::default()),
+            sctk_data: PointerData::new(seat),
+            viewport,
+        }
+    }
+
+    pub fn lock_pointer(
+        &self,
+        pointer_constraints: &PointerConstraintsState,
+        surface: &WlSurface,
+        pointer: &WlPointer,
+        queue_handle: &QueueHandle<WinitState>,
+    ) {
+        let mut inner = self.inner.lock().unwrap();
+        if inner.locked_pointer.is_none() {
+            inner.locked_pointer = Some(pointer_constraints.lock_pointer(
+                surface,
+                pointer,
+                None,
+                Lifetime::Persistent,
+                queue_handle,
+                GlobalData,
+            ));
+        }
+    }
+
+    pub fn unlock_pointer(&self) {
+        let mut inner = self.inner.lock().unwrap();
+        if let Some(locked_pointer) = inner.locked_pointer.take() {
+            locked_pointer.destroy();
+        }
+    }
+
+    pub fn confine_pointer(
+        &self,
+        pointer_constraints: &PointerConstraintsState,
+        surface: &WlSurface,
+        pointer: &WlPointer,
+        queue_handle: &QueueHandle<WinitState>,
+    ) {
+        self.inner.lock().unwrap().confined_pointer = Some(pointer_constraints.confine_pointer(
+            surface,
+            pointer,
+            None,
+            Lifetime::Persistent,
+            queue_handle,
+            GlobalData,
+        ));
+    }
+
+    pub fn unconfine_pointer(&self) {
+        let inner = self.inner.lock().unwrap();
+        if let Some(confined_pointer) = inner.confined_pointer.as_ref() {
+            confined_pointer.destroy();
+        }
+    }
+
+    /// Seat associated with this pointer.
+    pub fn seat(&self) -> &WlSeat {
+        self.sctk_data.seat()
+    }
+
+    /// Active window.
+    pub fn focused_window(&self) -> Option<WindowId> {
+        self.inner.lock().unwrap().surface
+    }
+
+    /// Last button serial.
+    pub fn latest_button_serial(&self) -> u32 {
+        self.sctk_data.latest_button_serial().unwrap_or_default()
+    }
+
+    /// Last enter serial.
+    pub fn latest_enter_serial(&self) -> u32 {
+        self.sctk_data.latest_enter_serial().unwrap_or_default()
+    }
+
+    pub fn set_locked_cursor_position(&self, surface_x: f64, surface_y: f64) {
+        let inner = self.inner.lock().unwrap();
+        if let Some(locked_pointer) = inner.locked_pointer.as_ref() {
+            locked_pointer.set_cursor_position_hint(surface_x, surface_y);
+        }
+    }
+
+    pub fn viewport(&self) -> Option<&WpViewport> {
+        self.viewport.as_ref()
+    }
+}
+
+impl Drop for WinitPointerData {
+    fn drop(&mut self) {
+        if let Some(viewport) = self.viewport.take() {
+            viewport.destroy();
+        }
+    }
+}
+
+impl PointerDataExt for WinitPointerData {
+    fn pointer_data(&self) -> &PointerData {
+        &self.sctk_data
+    }
+}
+
+#[derive(Debug)]
+pub struct WinitPointerDataInner {
+    /// The associated locked pointer.
+    locked_pointer: Option<ZwpLockedPointerV1>,
+
+    /// The associated confined pointer.
+    confined_pointer: Option<ZwpConfinedPointerV1>,
+
+    /// Serial of the last button event.
+    latest_button_serial: u32,
+
+    /// Currently focused window.
+    surface: Option<WindowId>,
+
+    /// Current axis phase.
+    phase: TouchPhase,
+}
+
+impl Drop for WinitPointerDataInner {
+    fn drop(&mut self) {
+        if let Some(locked_pointer) = self.locked_pointer.take() {
+            locked_pointer.destroy();
+        }
+
+        if let Some(confined_pointer) = self.confined_pointer.take() {
+            confined_pointer.destroy();
+        }
+    }
+}
+
+impl Default for WinitPointerDataInner {
+    fn default() -> Self {
+        Self {
+            surface: None,
+            locked_pointer: None,
+            confined_pointer: None,
+            latest_button_serial: 0,
+            phase: TouchPhase::Ended,
+        }
+    }
+}
+
+/// Convert the Wayland button into winit.
+fn wayland_button_to_winit(button: u32) -> MouseButton {
+    // These values are coming from <linux/input-event-codes.h>.
+    const BTN_LEFT: u32 = 0x110;
+    const BTN_RIGHT: u32 = 0x111;
+    const BTN_MIDDLE: u32 = 0x112;
+    const BTN_SIDE: u32 = 0x113;
+    const BTN_EXTRA: u32 = 0x114;
+    const BTN_FORWARD: u32 = 0x115;
+    const BTN_BACK: u32 = 0x116;
+
+    match button {
+        BTN_LEFT => MouseButton::Left,
+        BTN_RIGHT => MouseButton::Right,
+        BTN_MIDDLE => MouseButton::Middle,
+        BTN_BACK | BTN_SIDE => MouseButton::Back,
+        BTN_FORWARD | BTN_EXTRA => MouseButton::Forward,
+        button => MouseButton::Other(button as u16),
+    }
+}
+
+pub trait WinitPointerDataExt {
+    fn winit_data(&self) -> &WinitPointerData;
+}
+
+impl WinitPointerDataExt for WlPointer {
+    fn winit_data(&self) -> &WinitPointerData {
+        self.data::<WinitPointerData>().expect("failed to get pointer data.")
+    }
+}
+
+pub struct PointerConstraintsState {
+    pointer_constraints: ZwpPointerConstraintsV1,
+}
+
+impl PointerConstraintsState {
+    pub fn new(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> Result<Self, BindError> {
+        let pointer_constraints = globals.bind(queue_handle, 1..=1, GlobalData)?;
+        Ok(Self { pointer_constraints })
+    }
+}
+
+impl Deref for PointerConstraintsState {
+    type Target = ZwpPointerConstraintsV1;
+
+    fn deref(&self) -> &Self::Target {
+        &self.pointer_constraints
+    }
+}
+
+impl Dispatch<ZwpPointerConstraintsV1, GlobalData, WinitState> for PointerConstraintsState {
+    fn event(
+        _state: &mut WinitState,
+        _proxy: &ZwpPointerConstraintsV1,
+        _event: <ZwpPointerConstraintsV1 as wayland_client::Proxy>::Event,
+        _data: &GlobalData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+    }
+}
+
+impl Dispatch<ZwpLockedPointerV1, GlobalData, WinitState> for PointerConstraintsState {
+    fn event(
+        _state: &mut WinitState,
+        _proxy: &ZwpLockedPointerV1,
+        _event: <ZwpLockedPointerV1 as wayland_client::Proxy>::Event,
+        _data: &GlobalData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+    }
+}
+
+impl Dispatch<ZwpConfinedPointerV1, GlobalData, WinitState> for PointerConstraintsState {
+    fn event(
+        _state: &mut WinitState,
+        _proxy: &ZwpConfinedPointerV1,
+        _event: <ZwpConfinedPointerV1 as wayland_client::Proxy>::Event,
+        _data: &GlobalData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+    }
+}
+
+impl Dispatch<WpCursorShapeDeviceV1, GlobalData, WinitState> for SeatState {
+    fn event(
+        _: &mut WinitState,
+        _: &WpCursorShapeDeviceV1,
+        _: <WpCursorShapeDeviceV1 as Proxy>::Event,
+        _: &GlobalData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        unreachable!("wp_cursor_shape_manager has no events")
+    }
+}
+
+impl Dispatch<WpCursorShapeManagerV1, GlobalData, WinitState> for SeatState {
+    fn event(
+        _: &mut WinitState,
+        _: &WpCursorShapeManagerV1,
+        _: <WpCursorShapeManagerV1 as Proxy>::Event,
+        _: &GlobalData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        unreachable!("wp_cursor_device_manager has no events")
+    }
+}
+
+delegate_dispatch!(WinitState: [ WlPointer: WinitPointerData] => SeatState);
+delegate_dispatch!(WinitState: [ WpCursorShapeManagerV1: GlobalData] => SeatState);
+delegate_dispatch!(WinitState: [ WpCursorShapeDeviceV1: GlobalData] => SeatState);
+delegate_dispatch!(WinitState: [ZwpPointerConstraintsV1: GlobalData] => PointerConstraintsState);
+delegate_dispatch!(WinitState: [ZwpLockedPointerV1: GlobalData] => PointerConstraintsState);
+delegate_dispatch!(WinitState: [ZwpConfinedPointerV1: GlobalData] => PointerConstraintsState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/relative_pointer.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/relative_pointer.rs
new file mode 100644
index 00000000..a9ce2760
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/pointer/relative_pointer.rs
@@ -0,0 +1,83 @@
+//! Relative pointer.
+
+use std::ops::Deref;
+
+use sctk::reexports::client::globals::{BindError, GlobalList};
+use sctk::reexports::client::{delegate_dispatch, Dispatch};
+use sctk::reexports::client::{Connection, QueueHandle};
+use sctk::reexports::protocols::wp::relative_pointer::zv1::{
+    client::zwp_relative_pointer_manager_v1::ZwpRelativePointerManagerV1,
+    client::zwp_relative_pointer_v1::{self, ZwpRelativePointerV1},
+};
+
+use sctk::globals::GlobalData;
+
+use crate::event::DeviceEvent;
+use crate::platform_impl::wayland::state::WinitState;
+
+/// Wrapper around the relative pointer.
+pub struct RelativePointerState {
+    manager: ZwpRelativePointerManagerV1,
+}
+
+impl RelativePointerState {
+    /// Create new relative pointer manager.
+    pub fn new(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> Result<Self, BindError> {
+        let manager = globals.bind(queue_handle, 1..=1, GlobalData)?;
+        Ok(Self { manager })
+    }
+}
+
+impl Deref for RelativePointerState {
+    type Target = ZwpRelativePointerManagerV1;
+
+    fn deref(&self) -> &Self::Target {
+        &self.manager
+    }
+}
+
+impl Dispatch<ZwpRelativePointerManagerV1, GlobalData, WinitState> for RelativePointerState {
+    fn event(
+        _state: &mut WinitState,
+        _proxy: &ZwpRelativePointerManagerV1,
+        _event: <ZwpRelativePointerManagerV1 as wayland_client::Proxy>::Event,
+        _data: &GlobalData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+    }
+}
+
+impl Dispatch<ZwpRelativePointerV1, GlobalData, WinitState> for RelativePointerState {
+    fn event(
+        state: &mut WinitState,
+        _proxy: &ZwpRelativePointerV1,
+        event: <ZwpRelativePointerV1 as wayland_client::Proxy>::Event,
+        _data: &GlobalData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+        let (dx_unaccel, dy_unaccel) = match event {
+            zwp_relative_pointer_v1::Event::RelativeMotion { dx_unaccel, dy_unaccel, .. } => {
+                (dx_unaccel, dy_unaccel)
+            },
+            _ => return,
+        };
+        state
+            .events_sink
+            .push_device_event(DeviceEvent::Motion { axis: 0, value: dx_unaccel }, super::DeviceId);
+        state
+            .events_sink
+            .push_device_event(DeviceEvent::Motion { axis: 1, value: dy_unaccel }, super::DeviceId);
+        state.events_sink.push_device_event(
+            DeviceEvent::MouseMotion { delta: (dx_unaccel, dy_unaccel) },
+            super::DeviceId,
+        );
+    }
+}
+
+delegate_dispatch!(WinitState: [ZwpRelativePointerV1: GlobalData] => RelativePointerState);
+delegate_dispatch!(WinitState: [ZwpRelativePointerManagerV1: GlobalData] => RelativePointerState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/text_input/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/text_input/mod.rs
new file mode 100644
index 00000000..db724893
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/text_input/mod.rs
@@ -0,0 +1,201 @@
+use std::ops::Deref;
+
+use sctk::globals::GlobalData;
+use sctk::reexports::client::{Connection, Proxy, QueueHandle};
+
+use sctk::reexports::client::globals::{BindError, GlobalList};
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{delegate_dispatch, Dispatch};
+use sctk::reexports::protocols::wp::text_input::zv3::client::zwp_text_input_manager_v3::ZwpTextInputManagerV3;
+use sctk::reexports::protocols::wp::text_input::zv3::client::zwp_text_input_v3::{
+    ContentHint, ContentPurpose, Event as TextInputEvent, ZwpTextInputV3,
+};
+
+use crate::event::{Ime, WindowEvent};
+use crate::platform_impl::wayland;
+use crate::platform_impl::wayland::state::WinitState;
+use crate::window::ImePurpose;
+
+pub struct TextInputState {
+    text_input_manager: ZwpTextInputManagerV3,
+}
+
+impl TextInputState {
+    pub fn new(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> Result<Self, BindError> {
+        let text_input_manager = globals.bind(queue_handle, 1..=1, GlobalData)?;
+        Ok(Self { text_input_manager })
+    }
+}
+
+impl Deref for TextInputState {
+    type Target = ZwpTextInputManagerV3;
+
+    fn deref(&self) -> &Self::Target {
+        &self.text_input_manager
+    }
+}
+
+impl Dispatch<ZwpTextInputManagerV3, GlobalData, WinitState> for TextInputState {
+    fn event(
+        _state: &mut WinitState,
+        _proxy: &ZwpTextInputManagerV3,
+        _event: <ZwpTextInputManagerV3 as Proxy>::Event,
+        _data: &GlobalData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+    }
+}
+
+impl Dispatch<ZwpTextInputV3, TextInputData, WinitState> for TextInputState {
+    fn event(
+        state: &mut WinitState,
+        text_input: &ZwpTextInputV3,
+        event: <ZwpTextInputV3 as Proxy>::Event,
+        data: &TextInputData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+        let windows = state.windows.get_mut();
+        let mut text_input_data = data.inner.lock().unwrap();
+        match event {
+            TextInputEvent::Enter { surface } => {
+                let window_id = wayland::make_wid(&surface);
+                text_input_data.surface = Some(surface);
+
+                let mut window = match windows.get(&window_id) {
+                    Some(window) => window.lock().unwrap(),
+                    None => return,
+                };
+
+                if window.ime_allowed() {
+                    text_input.enable();
+                    text_input.set_content_type_by_purpose(window.ime_purpose());
+                    text_input.commit();
+                    state.events_sink.push_window_event(WindowEvent::Ime(Ime::Enabled), window_id);
+                }
+
+                window.text_input_entered(text_input);
+            },
+            TextInputEvent::Leave { surface } => {
+                text_input_data.surface = None;
+
+                // Always issue a disable.
+                text_input.disable();
+                text_input.commit();
+
+                let window_id = wayland::make_wid(&surface);
+
+                // XXX this check is essential, because `leave` could have a
+                // reference to nil surface...
+                let mut window = match windows.get(&window_id) {
+                    Some(window) => window.lock().unwrap(),
+                    None => return,
+                };
+
+                window.text_input_left(text_input);
+
+                state.events_sink.push_window_event(WindowEvent::Ime(Ime::Disabled), window_id);
+            },
+            TextInputEvent::PreeditString { text, cursor_begin, cursor_end } => {
+                let text = text.unwrap_or_default();
+                let cursor_begin = usize::try_from(cursor_begin)
+                    .ok()
+                    .and_then(|idx| text.is_char_boundary(idx).then_some(idx));
+                let cursor_end = usize::try_from(cursor_end)
+                    .ok()
+                    .and_then(|idx| text.is_char_boundary(idx).then_some(idx));
+
+                text_input_data.pending_preedit = Some(Preedit { text, cursor_begin, cursor_end })
+            },
+            TextInputEvent::CommitString { text } => {
+                text_input_data.pending_preedit = None;
+                text_input_data.pending_commit = text;
+            },
+            TextInputEvent::Done { .. } => {
+                let window_id = match text_input_data.surface.as_ref() {
+                    Some(surface) => wayland::make_wid(surface),
+                    None => return,
+                };
+
+                // Clear preedit, unless all we'll be doing next is sending a new preedit.
+                if text_input_data.pending_commit.is_some()
+                    || text_input_data.pending_preedit.is_none()
+                {
+                    state.events_sink.push_window_event(
+                        WindowEvent::Ime(Ime::Preedit(String::new(), None)),
+                        window_id,
+                    );
+                }
+
+                // Send `Commit`.
+                if let Some(text) = text_input_data.pending_commit.take() {
+                    state
+                        .events_sink
+                        .push_window_event(WindowEvent::Ime(Ime::Commit(text)), window_id);
+                }
+
+                // Send preedit.
+                if let Some(preedit) = text_input_data.pending_preedit.take() {
+                    let cursor_range =
+                        preedit.cursor_begin.map(|b| (b, preedit.cursor_end.unwrap_or(b)));
+
+                    state.events_sink.push_window_event(
+                        WindowEvent::Ime(Ime::Preedit(preedit.text, cursor_range)),
+                        window_id,
+                    );
+                }
+            },
+            TextInputEvent::DeleteSurroundingText { .. } => {
+                // Not handled.
+            },
+            _ => {},
+        }
+    }
+}
+
+pub trait ZwpTextInputV3Ext {
+    fn set_content_type_by_purpose(&self, purpose: ImePurpose);
+}
+
+impl ZwpTextInputV3Ext for ZwpTextInputV3 {
+    fn set_content_type_by_purpose(&self, purpose: ImePurpose) {
+        let (hint, purpose) = match purpose {
+            ImePurpose::Normal => (ContentHint::None, ContentPurpose::Normal),
+            ImePurpose::Password => (ContentHint::SensitiveData, ContentPurpose::Password),
+            ImePurpose::Terminal => (ContentHint::None, ContentPurpose::Terminal),
+        };
+        self.set_content_type(hint, purpose);
+    }
+}
+
+/// The Data associated with the text input.
+#[derive(Default)]
+pub struct TextInputData {
+    inner: std::sync::Mutex<TextInputDataInner>,
+}
+
+#[derive(Default)]
+pub struct TextInputDataInner {
+    /// The `WlSurface` we're performing input to.
+    surface: Option<WlSurface>,
+
+    /// The commit to submit on `done`.
+    pending_commit: Option<String>,
+
+    /// The preedit to submit on `done`.
+    pending_preedit: Option<Preedit>,
+}
+
+/// The state of the preedit.
+struct Preedit {
+    text: String,
+    cursor_begin: Option<usize>,
+    cursor_end: Option<usize>,
+}
+
+delegate_dispatch!(WinitState: [ZwpTextInputManagerV3: GlobalData] => TextInputState);
+delegate_dispatch!(WinitState: [ZwpTextInputV3: TextInputData] => TextInputState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/seat/touch/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/seat/touch/mod.rs
new file mode 100644
index 00000000..124504fe
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/seat/touch/mod.rs
@@ -0,0 +1,220 @@
+//! Touch handling.
+
+use tracing::warn;
+
+use sctk::reexports::client::protocol::wl_seat::WlSeat;
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::protocol::wl_touch::WlTouch;
+use sctk::reexports::client::{Connection, Proxy, QueueHandle};
+
+use sctk::seat::touch::{TouchData, TouchHandler};
+
+use crate::dpi::LogicalPosition;
+use crate::event::{Touch, TouchPhase, WindowEvent};
+
+use crate::platform_impl::wayland::state::WinitState;
+use crate::platform_impl::wayland::{self, DeviceId};
+
+impl TouchHandler for WinitState {
+    fn down(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        touch: &WlTouch,
+        _: u32,
+        _: u32,
+        surface: WlSurface,
+        id: i32,
+        position: (f64, f64),
+    ) {
+        let window_id = wayland::make_wid(&surface);
+        let scale_factor = match self.windows.get_mut().get(&window_id) {
+            Some(window) => window.lock().unwrap().scale_factor(),
+            None => return,
+        };
+
+        let seat_state = match self.seats.get_mut(&touch.seat().id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received wl_touch::down without seat");
+                return;
+            },
+        };
+
+        // Update the state of the point.
+        let location = LogicalPosition::<f64>::from(position);
+        seat_state.touch_map.insert(id, TouchPoint { surface, location });
+
+        self.events_sink.push_window_event(
+            WindowEvent::Touch(Touch {
+                device_id: crate::event::DeviceId(crate::platform_impl::DeviceId::Wayland(
+                    DeviceId,
+                )),
+                phase: TouchPhase::Started,
+                location: location.to_physical(scale_factor),
+                force: None,
+                id: id as u64,
+            }),
+            window_id,
+        );
+    }
+
+    fn up(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        touch: &WlTouch,
+        _: u32,
+        _: u32,
+        id: i32,
+    ) {
+        let seat_state = match self.seats.get_mut(&touch.seat().id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received wl_touch::up without seat");
+                return;
+            },
+        };
+
+        // Remove the touch point.
+        let touch_point = match seat_state.touch_map.remove(&id) {
+            Some(touch_point) => touch_point,
+            None => return,
+        };
+
+        let window_id = wayland::make_wid(&touch_point.surface);
+        let scale_factor = match self.windows.get_mut().get(&window_id) {
+            Some(window) => window.lock().unwrap().scale_factor(),
+            None => return,
+        };
+
+        self.events_sink.push_window_event(
+            WindowEvent::Touch(Touch {
+                device_id: crate::event::DeviceId(crate::platform_impl::DeviceId::Wayland(
+                    DeviceId,
+                )),
+                phase: TouchPhase::Ended,
+                location: touch_point.location.to_physical(scale_factor),
+                force: None,
+                id: id as u64,
+            }),
+            window_id,
+        );
+    }
+
+    fn motion(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        touch: &WlTouch,
+        _: u32,
+        id: i32,
+        position: (f64, f64),
+    ) {
+        let seat_state = match self.seats.get_mut(&touch.seat().id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received wl_touch::motion without seat");
+                return;
+            },
+        };
+
+        // Remove the touch point.
+        let touch_point = match seat_state.touch_map.get_mut(&id) {
+            Some(touch_point) => touch_point,
+            None => return,
+        };
+
+        let window_id = wayland::make_wid(&touch_point.surface);
+        let scale_factor = match self.windows.get_mut().get(&window_id) {
+            Some(window) => window.lock().unwrap().scale_factor(),
+            None => return,
+        };
+
+        touch_point.location = LogicalPosition::<f64>::from(position);
+
+        self.events_sink.push_window_event(
+            WindowEvent::Touch(Touch {
+                device_id: crate::event::DeviceId(crate::platform_impl::DeviceId::Wayland(
+                    DeviceId,
+                )),
+                phase: TouchPhase::Moved,
+                location: touch_point.location.to_physical(scale_factor),
+                force: None,
+                id: id as u64,
+            }),
+            window_id,
+        );
+    }
+
+    fn cancel(&mut self, _: &Connection, _: &QueueHandle<Self>, touch: &WlTouch) {
+        let seat_state = match self.seats.get_mut(&touch.seat().id()) {
+            Some(seat_state) => seat_state,
+            None => {
+                warn!("Received wl_touch::cancel without seat");
+                return;
+            },
+        };
+
+        for (id, touch_point) in seat_state.touch_map.drain() {
+            let window_id = wayland::make_wid(&touch_point.surface);
+            let scale_factor = match self.windows.get_mut().get(&window_id) {
+                Some(window) => window.lock().unwrap().scale_factor(),
+                None => return,
+            };
+
+            let location = touch_point.location.to_physical(scale_factor);
+
+            self.events_sink.push_window_event(
+                WindowEvent::Touch(Touch {
+                    device_id: crate::event::DeviceId(crate::platform_impl::DeviceId::Wayland(
+                        DeviceId,
+                    )),
+                    phase: TouchPhase::Cancelled,
+                    location,
+                    force: None,
+                    id: id as u64,
+                }),
+                window_id,
+            );
+        }
+    }
+
+    fn shape(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        _: &WlTouch,
+        _: i32,
+        _: f64,
+        _: f64,
+    ) {
+        // Blank.
+    }
+
+    fn orientation(&mut self, _: &Connection, _: &QueueHandle<Self>, _: &WlTouch, _: i32, _: f64) {
+        // Blank.
+    }
+}
+
+/// The state of the touch point.
+#[derive(Debug)]
+pub struct TouchPoint {
+    /// The surface on which the point is present.
+    pub surface: WlSurface,
+
+    /// The location of the point on the surface.
+    pub location: LogicalPosition<f64>,
+}
+
+pub trait TouchDataExt {
+    fn seat(&self) -> &WlSeat;
+}
+
+impl TouchDataExt for WlTouch {
+    fn seat(&self) -> &WlSeat {
+        self.data::<TouchData>().expect("failed to get touch data.").seat()
+    }
+}
+
+sctk::delegate_touch!(WinitState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/state.rs b/vendor/winit/src/platform_impl/linux/wayland/state.rs
new file mode 100644
index 00000000..13ef99c2
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/state.rs
@@ -0,0 +1,435 @@
+use std::cell::RefCell;
+use std::sync::atomic::Ordering;
+use std::sync::{Arc, Mutex};
+
+use ahash::AHashMap;
+
+use sctk::reexports::calloop::LoopHandle;
+use sctk::reexports::client::backend::ObjectId;
+use sctk::reexports::client::globals::GlobalList;
+use sctk::reexports::client::protocol::wl_output::WlOutput;
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{Connection, Proxy, QueueHandle};
+
+use sctk::compositor::{CompositorHandler, CompositorState};
+use sctk::output::{OutputHandler, OutputState};
+use sctk::registry::{ProvidesRegistryState, RegistryState};
+use sctk::seat::pointer::ThemedPointer;
+use sctk::seat::SeatState;
+use sctk::shell::xdg::window::{Window, WindowConfigure, WindowHandler};
+use sctk::shell::xdg::XdgShell;
+use sctk::shell::WaylandSurface;
+use sctk::shm::slot::SlotPool;
+use sctk::shm::{Shm, ShmHandler};
+use sctk::subcompositor::SubcompositorState;
+
+use crate::platform_impl::wayland::event_loop::sink::EventSink;
+use crate::platform_impl::wayland::output::MonitorHandle;
+use crate::platform_impl::wayland::seat::{
+    PointerConstraintsState, RelativePointerState, TextInputState, WinitPointerData,
+    WinitPointerDataExt, WinitSeatState,
+};
+use crate::platform_impl::wayland::types::kwin_blur::KWinBlurManager;
+use crate::platform_impl::wayland::types::wp_fractional_scaling::FractionalScalingManager;
+use crate::platform_impl::wayland::types::wp_viewporter::ViewporterState;
+use crate::platform_impl::wayland::types::xdg_activation::XdgActivationState;
+use crate::platform_impl::wayland::window::{WindowRequests, WindowState};
+use crate::platform_impl::wayland::{WaylandError, WindowId};
+use crate::platform_impl::OsError;
+
+/// Winit's Wayland state.
+pub struct WinitState {
+    /// The WlRegistry.
+    pub registry_state: RegistryState,
+
+    /// The state of the WlOutput handling.
+    pub output_state: OutputState,
+
+    /// The compositor state which is used to create new windows and regions.
+    pub compositor_state: Arc<CompositorState>,
+
+    /// The state of the subcompositor.
+    pub subcompositor_state: Option<Arc<SubcompositorState>>,
+
+    /// The seat state responsible for all sorts of input.
+    pub seat_state: SeatState,
+
+    /// The shm for software buffers, such as cursors.
+    pub shm: Shm,
+
+    /// The pool where custom cursors are allocated.
+    pub custom_cursor_pool: Arc<Mutex<SlotPool>>,
+
+    /// The XDG shell that is used for windows.
+    pub xdg_shell: XdgShell,
+
+    /// The currently present windows.
+    pub windows: RefCell<AHashMap<WindowId, Arc<Mutex<WindowState>>>>,
+
+    /// The requests from the `Window` to EventLoop, such as close operations and redraw requests.
+    pub window_requests: RefCell<AHashMap<WindowId, Arc<WindowRequests>>>,
+
+    /// The events that were generated directly from the window.
+    pub window_events_sink: Arc<Mutex<EventSink>>,
+
+    /// The update for the `windows` coming from the compositor.
+    pub window_compositor_updates: Vec<WindowCompositorUpdate>,
+
+    /// Currently handled seats.
+    pub seats: AHashMap<ObjectId, WinitSeatState>,
+
+    /// Currently present cursor surfaces.
+    pub pointer_surfaces: AHashMap<ObjectId, Arc<ThemedPointer<WinitPointerData>>>,
+
+    /// The state of the text input on the client.
+    pub text_input_state: Option<TextInputState>,
+
+    /// Observed monitors.
+    pub monitors: Arc<Mutex<Vec<MonitorHandle>>>,
+
+    /// Sink to accumulate window events from the compositor, which is latter dispatched in
+    /// event loop run.
+    pub events_sink: EventSink,
+
+    /// Xdg activation.
+    pub xdg_activation: Option<XdgActivationState>,
+
+    /// Relative pointer.
+    pub relative_pointer: Option<RelativePointerState>,
+
+    /// Pointer constraints to handle pointer locking and confining.
+    pub pointer_constraints: Option<Arc<PointerConstraintsState>>,
+
+    /// Viewporter state on the given window.
+    pub viewporter_state: Option<ViewporterState>,
+
+    /// Fractional scaling manager.
+    pub fractional_scaling_manager: Option<FractionalScalingManager>,
+
+    /// KWin blur manager.
+    pub kwin_blur_manager: Option<KWinBlurManager>,
+
+    /// Loop handle to re-register event sources, such as keyboard repeat.
+    pub loop_handle: LoopHandle<'static, Self>,
+
+    /// Whether we have dispatched events to the user thus we want to
+    /// send `AboutToWait` and normally wakeup the user.
+    pub dispatched_events: bool,
+}
+
+impl WinitState {
+    pub fn new(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<Self>,
+        loop_handle: LoopHandle<'static, WinitState>,
+    ) -> Result<Self, OsError> {
+        let registry_state = RegistryState::new(globals);
+        let compositor_state =
+            CompositorState::bind(globals, queue_handle).map_err(WaylandError::Bind)?;
+        let subcompositor_state = match SubcompositorState::bind(
+            compositor_state.wl_compositor().clone(),
+            globals,
+            queue_handle,
+        ) {
+            Ok(c) => Some(c),
+            Err(e) => {
+                tracing::warn!("Subcompositor protocol not available, ignoring CSD: {e:?}");
+                None
+            },
+        };
+
+        let output_state = OutputState::new(globals, queue_handle);
+        let monitors = output_state.outputs().map(MonitorHandle::new).collect();
+
+        let seat_state = SeatState::new(globals, queue_handle);
+
+        let mut seats = AHashMap::default();
+        for seat in seat_state.seats() {
+            seats.insert(seat.id(), WinitSeatState::new());
+        }
+
+        let (viewporter_state, fractional_scaling_manager) =
+            if let Ok(fsm) = FractionalScalingManager::new(globals, queue_handle) {
+                (ViewporterState::new(globals, queue_handle).ok(), Some(fsm))
+            } else {
+                (None, None)
+            };
+
+        let shm = Shm::bind(globals, queue_handle).map_err(WaylandError::Bind)?;
+        let custom_cursor_pool = Arc::new(Mutex::new(SlotPool::new(2, &shm).unwrap()));
+
+        Ok(Self {
+            registry_state,
+            compositor_state: Arc::new(compositor_state),
+            subcompositor_state: subcompositor_state.map(Arc::new),
+            output_state,
+            seat_state,
+            shm,
+            custom_cursor_pool,
+
+            xdg_shell: XdgShell::bind(globals, queue_handle).map_err(WaylandError::Bind)?,
+            xdg_activation: XdgActivationState::bind(globals, queue_handle).ok(),
+
+            windows: Default::default(),
+            window_requests: Default::default(),
+            window_compositor_updates: Vec::new(),
+            window_events_sink: Default::default(),
+            viewporter_state,
+            fractional_scaling_manager,
+            kwin_blur_manager: KWinBlurManager::new(globals, queue_handle).ok(),
+
+            seats,
+            text_input_state: TextInputState::new(globals, queue_handle).ok(),
+
+            relative_pointer: RelativePointerState::new(globals, queue_handle).ok(),
+            pointer_constraints: PointerConstraintsState::new(globals, queue_handle)
+                .map(Arc::new)
+                .ok(),
+            pointer_surfaces: Default::default(),
+
+            monitors: Arc::new(Mutex::new(monitors)),
+            events_sink: EventSink::new(),
+            loop_handle,
+            // Make it true by default.
+            dispatched_events: true,
+        })
+    }
+
+    pub fn scale_factor_changed(
+        &mut self,
+        surface: &WlSurface,
+        scale_factor: f64,
+        is_legacy: bool,
+    ) {
+        // Check if the cursor surface.
+        let window_id = super::make_wid(surface);
+
+        if let Some(window) = self.windows.get_mut().get(&window_id) {
+            // Don't update the scaling factor, when legacy method is used.
+            if is_legacy && self.fractional_scaling_manager.is_some() {
+                return;
+            }
+
+            // The scale factor change is for the window.
+            let pos = if let Some(pos) = self
+                .window_compositor_updates
+                .iter()
+                .position(|update| update.window_id == window_id)
+            {
+                pos
+            } else {
+                self.window_compositor_updates.push(WindowCompositorUpdate::new(window_id));
+                self.window_compositor_updates.len() - 1
+            };
+
+            // Update the scale factor right away.
+            window.lock().unwrap().set_scale_factor(scale_factor);
+            self.window_compositor_updates[pos].scale_changed = true;
+        } else if let Some(pointer) = self.pointer_surfaces.get(&surface.id()) {
+            // Get the window, where the pointer resides right now.
+            let focused_window = match pointer.pointer().winit_data().focused_window() {
+                Some(focused_window) => focused_window,
+                None => return,
+            };
+
+            if let Some(window_state) = self.windows.get_mut().get(&focused_window) {
+                window_state.lock().unwrap().reload_cursor_style()
+            }
+        }
+    }
+
+    pub fn queue_close(updates: &mut Vec<WindowCompositorUpdate>, window_id: WindowId) {
+        let pos = if let Some(pos) = updates.iter().position(|update| update.window_id == window_id)
+        {
+            pos
+        } else {
+            updates.push(WindowCompositorUpdate::new(window_id));
+            updates.len() - 1
+        };
+
+        updates[pos].close_window = true;
+    }
+}
+
+impl ShmHandler for WinitState {
+    fn shm_state(&mut self) -> &mut Shm {
+        &mut self.shm
+    }
+}
+
+impl WindowHandler for WinitState {
+    fn request_close(&mut self, _: &Connection, _: &QueueHandle<Self>, window: &Window) {
+        let window_id = super::make_wid(window.wl_surface());
+        Self::queue_close(&mut self.window_compositor_updates, window_id);
+    }
+
+    fn configure(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        window: &Window,
+        configure: WindowConfigure,
+        _serial: u32,
+    ) {
+        let window_id = super::make_wid(window.wl_surface());
+
+        let pos = if let Some(pos) =
+            self.window_compositor_updates.iter().position(|update| update.window_id == window_id)
+        {
+            pos
+        } else {
+            self.window_compositor_updates.push(WindowCompositorUpdate::new(window_id));
+            self.window_compositor_updates.len() - 1
+        };
+
+        // Populate the configure to the window.
+        self.window_compositor_updates[pos].resized |= self
+            .windows
+            .get_mut()
+            .get_mut(&window_id)
+            .expect("got configure for dead window.")
+            .lock()
+            .unwrap()
+            .configure(configure, &self.shm, &self.subcompositor_state);
+
+        // NOTE: configure demands wl_surface::commit, however winit doesn't commit on behalf of the
+        // users, since it can break a lot of things, thus it'll ask users to redraw instead.
+        self.window_requests
+            .get_mut()
+            .get(&window_id)
+            .unwrap()
+            .redraw_requested
+            .store(true, Ordering::Relaxed);
+
+        // Manually mark that we've got an event, since configure may not generate a resize.
+        self.dispatched_events = true;
+    }
+}
+
+impl OutputHandler for WinitState {
+    fn output_state(&mut self) -> &mut OutputState {
+        &mut self.output_state
+    }
+
+    fn new_output(&mut self, _: &Connection, _: &QueueHandle<Self>, output: WlOutput) {
+        self.monitors.lock().unwrap().push(MonitorHandle::new(output));
+    }
+
+    fn update_output(&mut self, _: &Connection, _: &QueueHandle<Self>, updated: WlOutput) {
+        let mut monitors = self.monitors.lock().unwrap();
+        let updated = MonitorHandle::new(updated);
+        if let Some(pos) = monitors.iter().position(|output| output == &updated) {
+            monitors[pos] = updated
+        } else {
+            monitors.push(updated)
+        }
+    }
+
+    fn output_destroyed(&mut self, _: &Connection, _: &QueueHandle<Self>, removed: WlOutput) {
+        let mut monitors = self.monitors.lock().unwrap();
+        let removed = MonitorHandle::new(removed);
+        if let Some(pos) = monitors.iter().position(|output| output == &removed) {
+            monitors.remove(pos);
+        }
+    }
+}
+
+impl CompositorHandler for WinitState {
+    fn transform_changed(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        _: &WlSurface,
+        _: wayland_client::protocol::wl_output::Transform,
+    ) {
+        // TODO(kchibisov) we need to expose it somehow in winit.
+    }
+
+    fn surface_enter(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        _: &WlSurface,
+        _: &WlOutput,
+    ) {
+    }
+
+    fn surface_leave(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        _: &WlSurface,
+        _: &WlOutput,
+    ) {
+    }
+
+    fn scale_factor_changed(
+        &mut self,
+        _: &Connection,
+        _: &QueueHandle<Self>,
+        surface: &WlSurface,
+        scale_factor: i32,
+    ) {
+        self.scale_factor_changed(surface, scale_factor as f64, true)
+    }
+
+    fn frame(&mut self, _: &Connection, _: &QueueHandle<Self>, surface: &WlSurface, _: u32) {
+        let window_id = super::make_wid(surface);
+        let window = match self.windows.get_mut().get(&window_id) {
+            Some(window) => window,
+            None => return,
+        };
+
+        // In case we have a redraw requested we must indicate the wake up.
+        if self
+            .window_requests
+            .get_mut()
+            .get(&window_id)
+            .unwrap()
+            .redraw_requested
+            .load(Ordering::Relaxed)
+        {
+            self.dispatched_events = true;
+        }
+
+        window.lock().unwrap().frame_callback_received();
+    }
+}
+
+impl ProvidesRegistryState for WinitState {
+    sctk::registry_handlers![OutputState, SeatState];
+
+    fn registry(&mut self) -> &mut RegistryState {
+        &mut self.registry_state
+    }
+}
+
+// The window update coming from the compositor.
+#[derive(Debug, Clone, Copy)]
+pub struct WindowCompositorUpdate {
+    /// The id of the window this updates belongs to.
+    pub window_id: WindowId,
+
+    /// New window size.
+    pub resized: bool,
+
+    /// New scale factor.
+    pub scale_changed: bool,
+
+    /// Close the window.
+    pub close_window: bool,
+}
+
+impl WindowCompositorUpdate {
+    fn new(window_id: WindowId) -> Self {
+        Self { window_id, resized: false, scale_changed: false, close_window: false }
+    }
+}
+
+sctk::delegate_subcompositor!(WinitState);
+sctk::delegate_compositor!(WinitState);
+sctk::delegate_output!(WinitState);
+sctk::delegate_registry!(WinitState);
+sctk::delegate_shm!(WinitState);
+sctk::delegate_xdg_shell!(WinitState);
+sctk::delegate_xdg_window!(WinitState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/types/cursor.rs b/vendor/winit/src/platform_impl/linux/wayland/types/cursor.rs
new file mode 100644
index 00000000..c1a0c261
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/types/cursor.rs
@@ -0,0 +1,59 @@
+use cursor_icon::CursorIcon;
+
+use sctk::reexports::client::protocol::wl_shm::Format;
+use sctk::shm::slot::{Buffer, SlotPool};
+
+use crate::cursor::CursorImage;
+
+#[derive(Debug)]
+pub enum SelectedCursor {
+    Named(CursorIcon),
+    Custom(CustomCursor),
+}
+
+impl Default for SelectedCursor {
+    fn default() -> Self {
+        Self::Named(Default::default())
+    }
+}
+
+#[derive(Debug)]
+pub struct CustomCursor {
+    pub buffer: Buffer,
+    pub w: i32,
+    pub h: i32,
+    pub hotspot_x: i32,
+    pub hotspot_y: i32,
+}
+
+impl CustomCursor {
+    pub(crate) fn new(pool: &mut SlotPool, image: &CursorImage) -> Self {
+        let (buffer, canvas) = pool
+            .create_buffer(
+                image.width as i32,
+                image.height as i32,
+                4 * (image.width as i32),
+                Format::Argb8888,
+            )
+            .unwrap();
+
+        for (canvas_chunk, rgba) in canvas.chunks_exact_mut(4).zip(image.rgba.chunks_exact(4)) {
+            // Alpha in buffer is premultiplied.
+            let alpha = rgba[3] as f32 / 255.;
+            let r = (rgba[0] as f32 * alpha) as u32;
+            let g = (rgba[1] as f32 * alpha) as u32;
+            let b = (rgba[2] as f32 * alpha) as u32;
+            let color = ((rgba[3] as u32) << 24) + (r << 16) + (g << 8) + b;
+            let array: &mut [u8; 4] = canvas_chunk.try_into().unwrap();
+            *array = color.to_le_bytes();
+        }
+
+        CustomCursor {
+            buffer,
+            w: image.width as i32,
+            h: image.height as i32,
+            hotspot_x: image.hotspot_x as i32,
+            hotspot_y: image.hotspot_y as i32,
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/types/kwin_blur.rs b/vendor/winit/src/platform_impl/linux/wayland/types/kwin_blur.rs
new file mode 100644
index 00000000..83e82ad7
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/types/kwin_blur.rs
@@ -0,0 +1,68 @@
+//! Handling of KDE-compatible blur.
+
+use sctk::reexports::client::globals::{BindError, GlobalList};
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{delegate_dispatch, Connection, Dispatch, Proxy, QueueHandle};
+use wayland_protocols_plasma::blur::client::org_kde_kwin_blur::OrgKdeKwinBlur;
+use wayland_protocols_plasma::blur::client::org_kde_kwin_blur_manager::OrgKdeKwinBlurManager;
+
+use sctk::globals::GlobalData;
+
+use crate::platform_impl::wayland::state::WinitState;
+
+/// KWin blur manager.
+#[derive(Debug, Clone)]
+pub struct KWinBlurManager {
+    manager: OrgKdeKwinBlurManager,
+}
+
+impl KWinBlurManager {
+    pub fn new(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> Result<Self, BindError> {
+        let manager = globals.bind(queue_handle, 1..=1, GlobalData)?;
+        Ok(Self { manager })
+    }
+
+    pub fn blur(
+        &self,
+        surface: &WlSurface,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> OrgKdeKwinBlur {
+        self.manager.create(surface, queue_handle, ())
+    }
+
+    pub fn unset(&self, surface: &WlSurface) {
+        self.manager.unset(surface)
+    }
+}
+
+impl Dispatch<OrgKdeKwinBlurManager, GlobalData, WinitState> for KWinBlurManager {
+    fn event(
+        _: &mut WinitState,
+        _: &OrgKdeKwinBlurManager,
+        _: <OrgKdeKwinBlurManager as Proxy>::Event,
+        _: &GlobalData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        unreachable!("no events defined for org_kde_kwin_blur_manager");
+    }
+}
+
+impl Dispatch<OrgKdeKwinBlur, (), WinitState> for KWinBlurManager {
+    fn event(
+        _: &mut WinitState,
+        _: &OrgKdeKwinBlur,
+        _: <OrgKdeKwinBlur as Proxy>::Event,
+        _: &(),
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        unreachable!("no events defined for org_kde_kwin_blur");
+    }
+}
+
+delegate_dispatch!(WinitState: [OrgKdeKwinBlurManager: GlobalData] => KWinBlurManager);
+delegate_dispatch!(WinitState: [OrgKdeKwinBlur: ()] => KWinBlurManager);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/types/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/types/mod.rs
new file mode 100644
index 00000000..77e67f48
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/types/mod.rs
@@ -0,0 +1,7 @@
+//! Wayland protocol implementation boilerplate.
+
+pub mod cursor;
+pub mod kwin_blur;
+pub mod wp_fractional_scaling;
+pub mod wp_viewporter;
+pub mod xdg_activation;
diff --git a/vendor/winit/src/platform_impl/linux/wayland/types/wp_fractional_scaling.rs b/vendor/winit/src/platform_impl/linux/wayland/types/wp_fractional_scaling.rs
new file mode 100644
index 00000000..2dfc9dbb
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/types/wp_fractional_scaling.rs
@@ -0,0 +1,78 @@
+//! Handling of the fractional scaling.
+
+use sctk::reexports::client::globals::{BindError, GlobalList};
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{delegate_dispatch, Connection, Dispatch, Proxy, QueueHandle};
+use sctk::reexports::protocols::wp::fractional_scale::v1::client::wp_fractional_scale_manager_v1::WpFractionalScaleManagerV1;
+use sctk::reexports::protocols::wp::fractional_scale::v1::client::wp_fractional_scale_v1::{
+    Event as FractionalScalingEvent, WpFractionalScaleV1,
+};
+
+use sctk::globals::GlobalData;
+
+use crate::platform_impl::wayland::state::WinitState;
+
+/// The scaling factor denominator.
+const SCALE_DENOMINATOR: f64 = 120.;
+
+/// Fractional scaling manager.
+#[derive(Debug)]
+pub struct FractionalScalingManager {
+    manager: WpFractionalScaleManagerV1,
+}
+
+pub struct FractionalScaling {
+    /// The surface used for scaling.
+    surface: WlSurface,
+}
+
+impl FractionalScalingManager {
+    /// Create new viewporter.
+    pub fn new(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> Result<Self, BindError> {
+        let manager = globals.bind(queue_handle, 1..=1, GlobalData)?;
+        Ok(Self { manager })
+    }
+
+    pub fn fractional_scaling(
+        &self,
+        surface: &WlSurface,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> WpFractionalScaleV1 {
+        let data = FractionalScaling { surface: surface.clone() };
+        self.manager.get_fractional_scale(surface, queue_handle, data)
+    }
+}
+
+impl Dispatch<WpFractionalScaleManagerV1, GlobalData, WinitState> for FractionalScalingManager {
+    fn event(
+        _: &mut WinitState,
+        _: &WpFractionalScaleManagerV1,
+        _: <WpFractionalScaleManagerV1 as Proxy>::Event,
+        _: &GlobalData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        // No events.
+    }
+}
+
+impl Dispatch<WpFractionalScaleV1, FractionalScaling, WinitState> for FractionalScalingManager {
+    fn event(
+        state: &mut WinitState,
+        _: &WpFractionalScaleV1,
+        event: <WpFractionalScaleV1 as Proxy>::Event,
+        data: &FractionalScaling,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        if let FractionalScalingEvent::PreferredScale { scale } = event {
+            state.scale_factor_changed(&data.surface, scale as f64 / SCALE_DENOMINATOR, false);
+        }
+    }
+}
+
+delegate_dispatch!(WinitState: [WpFractionalScaleManagerV1: GlobalData] => FractionalScalingManager);
+delegate_dispatch!(WinitState: [WpFractionalScaleV1: FractionalScaling] => FractionalScalingManager);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/types/wp_viewporter.rs b/vendor/winit/src/platform_impl/linux/wayland/types/wp_viewporter.rs
new file mode 100644
index 00000000..90764825
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/types/wp_viewporter.rs
@@ -0,0 +1,65 @@
+//! Handling of the wp-viewporter.
+
+use sctk::reexports::client::globals::{BindError, GlobalList};
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{delegate_dispatch, Connection, Dispatch, Proxy, QueueHandle};
+use sctk::reexports::protocols::wp::viewporter::client::wp_viewport::WpViewport;
+use sctk::reexports::protocols::wp::viewporter::client::wp_viewporter::WpViewporter;
+
+use sctk::globals::GlobalData;
+
+use crate::platform_impl::wayland::state::WinitState;
+
+/// Viewporter.
+#[derive(Debug)]
+pub struct ViewporterState {
+    viewporter: WpViewporter,
+}
+
+impl ViewporterState {
+    /// Create new viewporter.
+    pub fn new(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> Result<Self, BindError> {
+        let viewporter = globals.bind(queue_handle, 1..=1, GlobalData)?;
+        Ok(Self { viewporter })
+    }
+
+    /// Get the viewport for the given object.
+    pub fn get_viewport(
+        &self,
+        surface: &WlSurface,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> WpViewport {
+        self.viewporter.get_viewport(surface, queue_handle, GlobalData)
+    }
+}
+
+impl Dispatch<WpViewporter, GlobalData, WinitState> for ViewporterState {
+    fn event(
+        _: &mut WinitState,
+        _: &WpViewporter,
+        _: <WpViewporter as Proxy>::Event,
+        _: &GlobalData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        // No events.
+    }
+}
+impl Dispatch<WpViewport, GlobalData, WinitState> for ViewporterState {
+    fn event(
+        _: &mut WinitState,
+        _: &WpViewport,
+        _: <WpViewport as Proxy>::Event,
+        _: &GlobalData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        // No events.
+    }
+}
+
+delegate_dispatch!(WinitState: [WpViewporter: GlobalData] => ViewporterState);
+delegate_dispatch!(WinitState: [WpViewport: GlobalData] => ViewporterState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/types/xdg_activation.rs b/vendor/winit/src/platform_impl/linux/wayland/types/xdg_activation.rs
new file mode 100644
index 00000000..9efc75da
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/types/xdg_activation.rs
@@ -0,0 +1,103 @@
+//! Handling of xdg activation, which is used for user attention requests.
+
+use std::sync::atomic::AtomicBool;
+use std::sync::Weak;
+
+use sctk::reexports::client::globals::{BindError, GlobalList};
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{delegate_dispatch, Connection, Dispatch, Proxy, QueueHandle};
+use sctk::reexports::protocols::xdg::activation::v1::client::xdg_activation_token_v1::{
+    Event as ActivationTokenEvent, XdgActivationTokenV1,
+};
+use sctk::reexports::protocols::xdg::activation::v1::client::xdg_activation_v1::XdgActivationV1;
+
+use sctk::globals::GlobalData;
+
+use crate::event_loop::AsyncRequestSerial;
+use crate::platform_impl::wayland::state::WinitState;
+use crate::platform_impl::WindowId;
+use crate::window::ActivationToken;
+
+pub struct XdgActivationState {
+    xdg_activation: XdgActivationV1,
+}
+
+impl XdgActivationState {
+    pub fn bind(
+        globals: &GlobalList,
+        queue_handle: &QueueHandle<WinitState>,
+    ) -> Result<Self, BindError> {
+        let xdg_activation = globals.bind(queue_handle, 1..=1, GlobalData)?;
+        Ok(Self { xdg_activation })
+    }
+
+    pub fn global(&self) -> &XdgActivationV1 {
+        &self.xdg_activation
+    }
+}
+
+impl Dispatch<XdgActivationV1, GlobalData, WinitState> for XdgActivationState {
+    fn event(
+        _state: &mut WinitState,
+        _proxy: &XdgActivationV1,
+        _event: <XdgActivationV1 as Proxy>::Event,
+        _data: &GlobalData,
+        _conn: &Connection,
+        _qhandle: &QueueHandle<WinitState>,
+    ) {
+    }
+}
+
+impl Dispatch<XdgActivationTokenV1, XdgActivationTokenData, WinitState> for XdgActivationState {
+    fn event(
+        state: &mut WinitState,
+        proxy: &XdgActivationTokenV1,
+        event: <XdgActivationTokenV1 as Proxy>::Event,
+        data: &XdgActivationTokenData,
+        _: &Connection,
+        _: &QueueHandle<WinitState>,
+    ) {
+        let token = match event {
+            ActivationTokenEvent::Done { token } => token,
+            _ => return,
+        };
+
+        let global = state
+            .xdg_activation
+            .as_ref()
+            .expect("got xdg_activation event without global.")
+            .global();
+
+        match data {
+            XdgActivationTokenData::Attention((surface, fence)) => {
+                global.activate(token, surface);
+                // Mark that no request attention is in process.
+                if let Some(attention_requested) = fence.upgrade() {
+                    attention_requested.store(false, std::sync::atomic::Ordering::Relaxed);
+                }
+            },
+            XdgActivationTokenData::Obtain((window_id, serial)) => {
+                state.events_sink.push_window_event(
+                    crate::event::WindowEvent::ActivationTokenDone {
+                        serial: *serial,
+                        token: ActivationToken::from_raw(token),
+                    },
+                    *window_id,
+                );
+            },
+        }
+
+        proxy.destroy();
+    }
+}
+
+/// The data associated with the activation request.
+pub enum XdgActivationTokenData {
+    /// Request user attention for the given surface.
+    Attention((WlSurface, Weak<AtomicBool>)),
+    /// Get a token to be passed outside of the winit.
+    Obtain((WindowId, AsyncRequestSerial)),
+}
+
+delegate_dispatch!(WinitState: [ XdgActivationV1: GlobalData] => XdgActivationState);
+delegate_dispatch!(WinitState: [ XdgActivationTokenV1: XdgActivationTokenData] => XdgActivationState);
diff --git a/vendor/winit/src/platform_impl/linux/wayland/window/mod.rs b/vendor/winit/src/platform_impl/linux/wayland/window/mod.rs
new file mode 100644
index 00000000..6d29a5a5
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/window/mod.rs
@@ -0,0 +1,763 @@
+//! The Wayland window.
+
+use std::ffi::c_void;
+use std::ptr::NonNull;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+
+use sctk::reexports::client::protocol::wl_display::WlDisplay;
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{Proxy, QueueHandle};
+
+use sctk::compositor::{CompositorState, Region, SurfaceData};
+use sctk::reexports::protocols::xdg::activation::v1::client::xdg_activation_v1::XdgActivationV1;
+use sctk::shell::xdg::window::{Window as SctkWindow, WindowDecorations};
+use sctk::shell::WaylandSurface;
+
+use tracing::warn;
+
+use crate::dpi::{LogicalSize, PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{ExternalError, NotSupportedError, OsError as RootOsError};
+use crate::event::{Ime, WindowEvent};
+use crate::event_loop::AsyncRequestSerial;
+use crate::platform_impl::{
+    Fullscreen, MonitorHandle as PlatformMonitorHandle, OsError, PlatformIcon,
+};
+use crate::window::{
+    Cursor, CursorGrabMode, ImePurpose, ResizeDirection, Theme, UserAttentionType,
+    WindowAttributes, WindowButtons, WindowLevel,
+};
+
+use super::event_loop::sink::EventSink;
+use super::output::MonitorHandle;
+use super::state::WinitState;
+use super::types::xdg_activation::XdgActivationTokenData;
+use super::{ActiveEventLoop, WaylandError, WindowId};
+
+pub(crate) mod state;
+
+pub use state::WindowState;
+
+/// The Wayland window.
+pub struct Window {
+    /// Reference to the underlying SCTK window.
+    window: SctkWindow,
+
+    /// Window id.
+    window_id: WindowId,
+
+    /// The state of the window.
+    window_state: Arc<Mutex<WindowState>>,
+
+    /// Compositor to handle WlRegion stuff.
+    compositor: Arc<CompositorState>,
+
+    /// The wayland display used solely for raw window handle.
+    #[allow(dead_code)]
+    display: WlDisplay,
+
+    /// Xdg activation to request user attention.
+    xdg_activation: Option<XdgActivationV1>,
+
+    /// The state of the requested attention from the `xdg_activation`.
+    attention_requested: Arc<AtomicBool>,
+
+    /// Handle to the main queue to perform requests.
+    queue_handle: QueueHandle<WinitState>,
+
+    /// Window requests to the event loop.
+    window_requests: Arc<WindowRequests>,
+
+    /// Observed monitors.
+    monitors: Arc<Mutex<Vec<MonitorHandle>>>,
+
+    /// Source to wake-up the event-loop for window requests.
+    event_loop_awakener: calloop::ping::Ping,
+
+    /// The event sink to deliver synthetic events.
+    window_events_sink: Arc<Mutex<EventSink>>,
+}
+
+impl Window {
+    pub(crate) fn new(
+        event_loop_window_target: &ActiveEventLoop,
+        attributes: WindowAttributes,
+    ) -> Result<Self, RootOsError> {
+        let queue_handle = event_loop_window_target.queue_handle.clone();
+        let mut state = event_loop_window_target.state.borrow_mut();
+
+        let monitors = state.monitors.clone();
+
+        let surface = state.compositor_state.create_surface(&queue_handle);
+        let compositor = state.compositor_state.clone();
+        let xdg_activation =
+            state.xdg_activation.as_ref().map(|activation_state| activation_state.global().clone());
+        let display = event_loop_window_target.connection.display();
+
+        let size: Size = attributes.inner_size.unwrap_or(LogicalSize::new(800., 600.).into());
+
+        // We prefer server side decorations, however to not have decorations we ask for client
+        // side decorations instead.
+        let default_decorations = if attributes.decorations {
+            WindowDecorations::RequestServer
+        } else {
+            WindowDecorations::RequestClient
+        };
+
+        let window =
+            state.xdg_shell.create_window(surface.clone(), default_decorations, &queue_handle);
+
+        let mut window_state = WindowState::new(
+            event_loop_window_target.connection.clone(),
+            &event_loop_window_target.queue_handle,
+            &state,
+            size,
+            window.clone(),
+            attributes.preferred_theme,
+        );
+
+        // Set transparency hint.
+        window_state.set_transparent(attributes.transparent);
+
+        window_state.set_blur(attributes.blur);
+
+        // Set the decorations hint.
+        window_state.set_decorate(attributes.decorations);
+
+        // Set the app_id.
+        if let Some(name) = attributes.platform_specific.name.map(|name| name.general) {
+            window.set_app_id(name);
+        }
+
+        // Set the window title.
+        window_state.set_title(attributes.title);
+
+        // Set the min and max sizes. We must set the hints upon creating a window, so
+        // we use the default `1.` scaling...
+        let min_size = attributes.min_inner_size.map(|size| size.to_logical(1.));
+        let max_size = attributes.max_inner_size.map(|size| size.to_logical(1.));
+        window_state.set_min_inner_size(min_size);
+        window_state.set_max_inner_size(max_size);
+
+        // Non-resizable implies that the min and max sizes are set to the same value.
+        window_state.set_resizable(attributes.resizable);
+
+        // Set startup mode.
+        match attributes.fullscreen.map(Into::into) {
+            Some(Fullscreen::Exclusive(_)) => {
+                warn!("`Fullscreen::Exclusive` is ignored on Wayland");
+            },
+            #[cfg_attr(not(x11_platform), allow(clippy::bind_instead_of_map))]
+            Some(Fullscreen::Borderless(monitor)) => {
+                let output = monitor.and_then(|monitor| match monitor {
+                    PlatformMonitorHandle::Wayland(monitor) => Some(monitor.proxy),
+                    #[cfg(x11_platform)]
+                    PlatformMonitorHandle::X(_) => None,
+                });
+
+                window.set_fullscreen(output.as_ref())
+            },
+            _ if attributes.maximized => window.set_maximized(),
+            _ => (),
+        };
+
+        match attributes.cursor {
+            Cursor::Icon(icon) => window_state.set_cursor(icon),
+            Cursor::Custom(cursor) => window_state.set_custom_cursor(cursor),
+        }
+
+        // Apply resize increments.
+        if let Some(increments) = attributes.resize_increments {
+            let increments = increments.to_logical(window_state.scale_factor());
+            window_state.set_resize_increments(Some(increments));
+        }
+
+        // Activate the window when the token is passed.
+        if let (Some(xdg_activation), Some(token)) =
+            (xdg_activation.as_ref(), attributes.platform_specific.activation_token)
+        {
+            xdg_activation.activate(token.token, &surface);
+        }
+
+        // XXX Do initial commit.
+        window.commit();
+
+        // Add the window and window requests into the state.
+        let window_state = Arc::new(Mutex::new(window_state));
+        let window_id = super::make_wid(&surface);
+        state.windows.get_mut().insert(window_id, window_state.clone());
+
+        let window_requests = WindowRequests {
+            redraw_requested: AtomicBool::new(true),
+            closed: AtomicBool::new(false),
+        };
+        let window_requests = Arc::new(window_requests);
+        state.window_requests.get_mut().insert(window_id, window_requests.clone());
+
+        // Setup the event sync to insert `WindowEvents` right from the window.
+        let window_events_sink = state.window_events_sink.clone();
+
+        let mut wayland_source = event_loop_window_target.wayland_dispatcher.as_source_mut();
+        let event_queue = wayland_source.queue();
+
+        // Do a roundtrip.
+        event_queue.roundtrip(&mut state).map_err(|error| {
+            os_error!(OsError::WaylandError(Arc::new(WaylandError::Dispatch(error))))
+        })?;
+
+        // XXX Wait for the initial configure to arrive.
+        while !window_state.lock().unwrap().is_configured() {
+            event_queue.blocking_dispatch(&mut state).map_err(|error| {
+                os_error!(OsError::WaylandError(Arc::new(WaylandError::Dispatch(error))))
+            })?;
+        }
+
+        // Wake-up event loop, so it'll send initial redraw requested.
+        let event_loop_awakener = event_loop_window_target.event_loop_awakener.clone();
+        event_loop_awakener.ping();
+
+        Ok(Self {
+            window,
+            display,
+            monitors,
+            window_id,
+            compositor,
+            window_state,
+            queue_handle,
+            xdg_activation,
+            attention_requested: Arc::new(AtomicBool::new(false)),
+            event_loop_awakener,
+            window_requests,
+            window_events_sink,
+        })
+    }
+
+    pub(crate) fn xdg_toplevel(&self) -> Option<NonNull<c_void>> {
+        NonNull::new(self.window.xdg_toplevel().id().as_ptr().cast())
+    }
+}
+
+impl Window {
+    #[inline]
+    pub fn id(&self) -> WindowId {
+        self.window_id
+    }
+
+    #[inline]
+    pub fn set_title(&self, title: impl ToString) {
+        let new_title = title.to_string();
+        self.window_state.lock().unwrap().set_title(new_title);
+    }
+
+    #[inline]
+    pub fn set_visible(&self, _visible: bool) {
+        // Not possible on Wayland.
+    }
+
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        None
+    }
+
+    #[inline]
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        Err(NotSupportedError::new())
+    }
+
+    #[inline]
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        Err(NotSupportedError::new())
+    }
+
+    #[inline]
+    pub fn set_outer_position(&self, _: Position) {
+        // Not possible on Wayland.
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        let window_state = self.window_state.lock().unwrap();
+        let scale_factor = window_state.scale_factor();
+        super::logical_to_physical_rounded(window_state.inner_size(), scale_factor)
+    }
+
+    #[inline]
+    pub fn request_redraw(&self) {
+        // NOTE: try to not wake up the loop when the event was already scheduled and not yet
+        // processed by the loop, because if at this point the value was `true` it could only
+        // mean that the loop still haven't dispatched the value to the client and will do
+        // eventually, resetting it to `false`.
+        if self
+            .window_requests
+            .redraw_requested
+            .compare_exchange(false, true, Ordering::Relaxed, Ordering::Relaxed)
+            .is_ok()
+        {
+            self.event_loop_awakener.ping();
+        }
+    }
+
+    #[inline]
+    pub fn pre_present_notify(&self) {
+        self.window_state.lock().unwrap().request_frame_callback();
+    }
+
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        let window_state = self.window_state.lock().unwrap();
+        let scale_factor = window_state.scale_factor();
+        super::logical_to_physical_rounded(window_state.outer_size(), scale_factor)
+    }
+
+    #[inline]
+    pub fn request_inner_size(&self, size: Size) -> Option<PhysicalSize<u32>> {
+        let mut window_state = self.window_state.lock().unwrap();
+        let new_size = window_state.request_inner_size(size);
+        self.request_redraw();
+        Some(new_size)
+    }
+
+    /// Set the minimum inner size for the window.
+    #[inline]
+    pub fn set_min_inner_size(&self, min_size: Option<Size>) {
+        let scale_factor = self.scale_factor();
+        let min_size = min_size.map(|size| size.to_logical(scale_factor));
+        self.window_state.lock().unwrap().set_min_inner_size(min_size);
+        // NOTE: Requires commit to be applied.
+        self.request_redraw();
+    }
+
+    /// Set the maximum inner size for the window.
+    #[inline]
+    pub fn set_max_inner_size(&self, max_size: Option<Size>) {
+        let scale_factor = self.scale_factor();
+        let max_size = max_size.map(|size| size.to_logical(scale_factor));
+        self.window_state.lock().unwrap().set_max_inner_size(max_size);
+        // NOTE: Requires commit to be applied.
+        self.request_redraw();
+    }
+
+    #[inline]
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        let window_state = self.window_state.lock().unwrap();
+        let scale_factor = window_state.scale_factor();
+        window_state
+            .resize_increments()
+            .map(|size| super::logical_to_physical_rounded(size, scale_factor))
+    }
+
+    #[inline]
+    pub fn set_resize_increments(&self, increments: Option<Size>) {
+        let mut window_state = self.window_state.lock().unwrap();
+        let scale_factor = window_state.scale_factor();
+        let increments = increments.map(|size| size.to_logical(scale_factor));
+        window_state.set_resize_increments(increments);
+    }
+
+    #[inline]
+    pub fn set_transparent(&self, transparent: bool) {
+        self.window_state.lock().unwrap().set_transparent(transparent);
+    }
+
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        self.window_state.lock().unwrap().has_focus()
+    }
+
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        // XXX clients don't know whether they are minimized or not.
+        None
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, position: Position) {
+        let scale_factor = self.scale_factor();
+        let position = position.to_logical(scale_factor);
+        self.window_state.lock().unwrap().show_window_menu(position);
+    }
+
+    #[inline]
+    pub fn drag_resize_window(&self, direction: ResizeDirection) -> Result<(), ExternalError> {
+        self.window_state.lock().unwrap().drag_resize_window(direction)
+    }
+
+    #[inline]
+    pub fn set_resizable(&self, resizable: bool) {
+        if self.window_state.lock().unwrap().set_resizable(resizable) {
+            // NOTE: Requires commit to be applied.
+            self.request_redraw();
+        }
+    }
+
+    #[inline]
+    pub fn is_resizable(&self) -> bool {
+        self.window_state.lock().unwrap().resizable()
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, _buttons: WindowButtons) {
+        // TODO(kchibisov) v5 of the xdg_shell allows that.
+    }
+
+    #[inline]
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        // TODO(kchibisov) v5 of the xdg_shell allows that.
+        WindowButtons::all()
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        self.window_state.lock().unwrap().scale_factor()
+    }
+
+    #[inline]
+    pub fn set_blur(&self, blur: bool) {
+        self.window_state.lock().unwrap().set_blur(blur);
+    }
+
+    #[inline]
+    pub fn set_decorations(&self, decorate: bool) {
+        self.window_state.lock().unwrap().set_decorate(decorate)
+    }
+
+    #[inline]
+    pub fn is_decorated(&self) -> bool {
+        self.window_state.lock().unwrap().is_decorated()
+    }
+
+    #[inline]
+    pub fn set_window_level(&self, _level: WindowLevel) {}
+
+    #[inline]
+    pub(crate) fn set_window_icon(&self, _window_icon: Option<PlatformIcon>) {}
+
+    #[inline]
+    pub fn set_minimized(&self, minimized: bool) {
+        // You can't unminimize the window on Wayland.
+        if !minimized {
+            warn!("Unminimizing is ignored on Wayland.");
+            return;
+        }
+
+        self.window.set_minimized();
+    }
+
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        self.window_state
+            .lock()
+            .unwrap()
+            .last_configure
+            .as_ref()
+            .map(|last_configure| last_configure.is_maximized())
+            .unwrap_or_default()
+    }
+
+    #[inline]
+    pub fn set_maximized(&self, maximized: bool) {
+        if maximized {
+            self.window.set_maximized()
+        } else {
+            self.window.unset_maximized()
+        }
+    }
+
+    #[inline]
+    pub(crate) fn fullscreen(&self) -> Option<Fullscreen> {
+        let is_fullscreen = self
+            .window_state
+            .lock()
+            .unwrap()
+            .last_configure
+            .as_ref()
+            .map(|last_configure| last_configure.is_fullscreen())
+            .unwrap_or_default();
+
+        if is_fullscreen {
+            let current_monitor = self.current_monitor().map(PlatformMonitorHandle::Wayland);
+            Some(Fullscreen::Borderless(current_monitor))
+        } else {
+            None
+        }
+    }
+
+    #[inline]
+    pub(crate) fn set_fullscreen(&self, fullscreen: Option<Fullscreen>) {
+        match fullscreen {
+            Some(Fullscreen::Exclusive(_)) => {
+                warn!("`Fullscreen::Exclusive` is ignored on Wayland");
+            },
+            #[cfg_attr(not(x11_platform), allow(clippy::bind_instead_of_map))]
+            Some(Fullscreen::Borderless(monitor)) => {
+                let output = monitor.and_then(|monitor| match monitor {
+                    PlatformMonitorHandle::Wayland(monitor) => Some(monitor.proxy),
+                    #[cfg(x11_platform)]
+                    PlatformMonitorHandle::X(_) => None,
+                });
+
+                self.window.set_fullscreen(output.as_ref())
+            },
+            None => self.window.unset_fullscreen(),
+        }
+    }
+
+    #[inline]
+    pub fn set_cursor(&self, cursor: Cursor) {
+        let window_state = &mut self.window_state.lock().unwrap();
+
+        match cursor {
+            Cursor::Icon(icon) => window_state.set_cursor(icon),
+            Cursor::Custom(cursor) => window_state.set_custom_cursor(cursor),
+        }
+    }
+
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        self.window_state.lock().unwrap().set_cursor_visible(visible);
+    }
+
+    pub fn request_user_attention(&self, request_type: Option<UserAttentionType>) {
+        let xdg_activation = match self.xdg_activation.as_ref() {
+            Some(xdg_activation) => xdg_activation,
+            None => {
+                warn!("`request_user_attention` isn't supported");
+                return;
+            },
+        };
+
+        // Urgency is only removed by the compositor and there's no need to raise urgency when it
+        // was already raised.
+        if request_type.is_none() || self.attention_requested.load(Ordering::Relaxed) {
+            return;
+        }
+
+        self.attention_requested.store(true, Ordering::Relaxed);
+        let surface = self.surface().clone();
+        let data = XdgActivationTokenData::Attention((
+            surface.clone(),
+            Arc::downgrade(&self.attention_requested),
+        ));
+        let xdg_activation_token = xdg_activation.get_activation_token(&self.queue_handle, data);
+        xdg_activation_token.set_surface(&surface);
+        xdg_activation_token.commit();
+    }
+
+    pub fn request_activation_token(&self) -> Result<AsyncRequestSerial, NotSupportedError> {
+        let xdg_activation = match self.xdg_activation.as_ref() {
+            Some(xdg_activation) => xdg_activation,
+            None => return Err(NotSupportedError::new()),
+        };
+
+        let serial = AsyncRequestSerial::get();
+
+        let data = XdgActivationTokenData::Obtain((self.window_id, serial));
+        let xdg_activation_token = xdg_activation.get_activation_token(&self.queue_handle, data);
+        xdg_activation_token.set_surface(self.surface());
+        xdg_activation_token.commit();
+
+        Ok(serial)
+    }
+
+    #[inline]
+    pub fn set_cursor_grab(&self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        self.window_state.lock().unwrap().set_cursor_grab(mode)
+    }
+
+    #[inline]
+    pub fn set_cursor_position(&self, position: Position) -> Result<(), ExternalError> {
+        let scale_factor = self.scale_factor();
+        let position = position.to_logical(scale_factor);
+        self.window_state
+            .lock()
+            .unwrap()
+            .set_cursor_position(position)
+            // Request redraw on success, since the state is double buffered.
+            .map(|_| self.request_redraw())
+    }
+
+    #[inline]
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        self.window_state.lock().unwrap().drag_window()
+    }
+
+    #[inline]
+    pub fn set_cursor_hittest(&self, hittest: bool) -> Result<(), ExternalError> {
+        let surface = self.window.wl_surface();
+
+        if hittest {
+            surface.set_input_region(None);
+            Ok(())
+        } else {
+            let region = Region::new(&*self.compositor).map_err(|_| {
+                ExternalError::Os(os_error!(OsError::Misc("failed to set input region.")))
+            })?;
+            region.add(0, 0, 0, 0);
+            surface.set_input_region(Some(region.wl_region()));
+            Ok(())
+        }
+    }
+
+    #[inline]
+    pub fn set_ime_cursor_area(&self, position: Position, size: Size) {
+        let window_state = self.window_state.lock().unwrap();
+        if window_state.ime_allowed() {
+            let scale_factor = window_state.scale_factor();
+            let position = position.to_logical(scale_factor);
+            let size = size.to_logical(scale_factor);
+            window_state.set_ime_cursor_area(position, size);
+        }
+    }
+
+    #[inline]
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        let mut window_state = self.window_state.lock().unwrap();
+
+        if window_state.ime_allowed() != allowed && window_state.set_ime_allowed(allowed) {
+            let event = WindowEvent::Ime(if allowed { Ime::Enabled } else { Ime::Disabled });
+            self.window_events_sink.lock().unwrap().push_window_event(event, self.window_id);
+            self.event_loop_awakener.ping();
+        }
+    }
+
+    #[inline]
+    pub fn set_ime_purpose(&self, purpose: ImePurpose) {
+        self.window_state.lock().unwrap().set_ime_purpose(purpose);
+    }
+
+    #[inline]
+    pub fn focus_window(&self) {}
+
+    #[inline]
+    pub fn surface(&self) -> &WlSurface {
+        self.window.wl_surface()
+    }
+
+    #[inline]
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        let data = self.window.wl_surface().data::<SurfaceData>()?;
+        data.outputs().next().map(MonitorHandle::new)
+    }
+
+    #[inline]
+    pub fn available_monitors(&self) -> Vec<MonitorHandle> {
+        self.monitors.lock().unwrap().clone()
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        // XXX there's no such concept on Wayland.
+        None
+    }
+
+    #[cfg(feature = "rwh_04")]
+    #[inline]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        let mut window_handle = rwh_04::WaylandHandle::empty();
+        window_handle.surface = self.window.wl_surface().id().as_ptr() as *mut _;
+        window_handle.display = self.display.id().as_ptr() as *mut _;
+        rwh_04::RawWindowHandle::Wayland(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        let mut window_handle = rwh_05::WaylandWindowHandle::empty();
+        window_handle.surface = self.window.wl_surface().id().as_ptr() as *mut _;
+        rwh_05::RawWindowHandle::Wayland(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        let mut display_handle = rwh_05::WaylandDisplayHandle::empty();
+        display_handle.display = self.display.id().as_ptr() as *mut _;
+        rwh_05::RawDisplayHandle::Wayland(display_handle)
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_window_handle_rwh_06(&self) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        Ok(rwh_06::WaylandWindowHandle::new({
+            let ptr = self.window.wl_surface().id().as_ptr();
+            std::ptr::NonNull::new(ptr as *mut _).expect("wl_surface will never be null")
+        })
+        .into())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::WaylandDisplayHandle::new({
+            let ptr = self.display.id().as_ptr();
+            std::ptr::NonNull::new(ptr as *mut _).expect("wl_proxy should never be null")
+        })
+        .into())
+    }
+
+    #[inline]
+    pub fn set_theme(&self, theme: Option<Theme>) {
+        self.window_state.lock().unwrap().set_theme(theme)
+    }
+
+    #[inline]
+    pub fn theme(&self) -> Option<Theme> {
+        self.window_state.lock().unwrap().theme()
+    }
+
+    pub fn set_content_protected(&self, _protected: bool) {}
+
+    #[inline]
+    pub fn title(&self) -> String {
+        self.window_state.lock().unwrap().title().to_owned()
+    }
+}
+
+impl Drop for Window {
+    fn drop(&mut self) {
+        self.window_requests.closed.store(true, Ordering::Relaxed);
+        self.event_loop_awakener.ping();
+    }
+}
+
+/// The request from the window to the event loop.
+#[derive(Debug)]
+pub struct WindowRequests {
+    /// The window was closed.
+    pub closed: AtomicBool,
+
+    /// Redraw Requested.
+    pub redraw_requested: AtomicBool,
+}
+
+impl WindowRequests {
+    pub fn take_closed(&self) -> bool {
+        self.closed.swap(false, Ordering::Relaxed)
+    }
+
+    pub fn take_redraw_requested(&self) -> bool {
+        self.redraw_requested.swap(false, Ordering::Relaxed)
+    }
+}
+
+impl TryFrom<&str> for Theme {
+    type Error = ();
+
+    /// ```
+    /// use winit::window::Theme;
+    ///
+    /// assert_eq!("dark".try_into(), Ok(Theme::Dark));
+    /// assert_eq!("lIghT".try_into(), Ok(Theme::Light));
+    /// ```
+    fn try_from(theme: &str) -> Result<Self, Self::Error> {
+        if theme.eq_ignore_ascii_case("dark") {
+            Ok(Self::Dark)
+        } else if theme.eq_ignore_ascii_case("light") {
+            Ok(Self::Light)
+        } else {
+            Err(())
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/wayland/window/state.rs b/vendor/winit/src/platform_impl/linux/wayland/window/state.rs
new file mode 100644
index 00000000..1ef7a065
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/wayland/window/state.rs
@@ -0,0 +1,1220 @@
+//! The state of the window, which is shared with the event-loop.
+
+use std::num::NonZeroU32;
+use std::sync::{Arc, Mutex, Weak};
+use std::time::Duration;
+
+use ahash::HashSet;
+use tracing::{info, warn};
+
+use sctk::reexports::client::backend::ObjectId;
+use sctk::reexports::client::protocol::wl_seat::WlSeat;
+use sctk::reexports::client::protocol::wl_shm::WlShm;
+use sctk::reexports::client::protocol::wl_surface::WlSurface;
+use sctk::reexports::client::{Connection, Proxy, QueueHandle};
+use sctk::reexports::csd_frame::{
+    DecorationsFrame, FrameAction, FrameClick, ResizeEdge, WindowState as XdgWindowState,
+};
+use sctk::reexports::protocols::wp::fractional_scale::v1::client::wp_fractional_scale_v1::WpFractionalScaleV1;
+use sctk::reexports::protocols::wp::text_input::zv3::client::zwp_text_input_v3::ZwpTextInputV3;
+use sctk::reexports::protocols::wp::viewporter::client::wp_viewport::WpViewport;
+use sctk::reexports::protocols::xdg::shell::client::xdg_toplevel::ResizeEdge as XdgResizeEdge;
+
+use sctk::compositor::{CompositorState, Region, SurfaceData, SurfaceDataExt};
+use sctk::seat::pointer::{PointerDataExt, ThemedPointer};
+use sctk::shell::xdg::window::{DecorationMode, Window, WindowConfigure};
+use sctk::shell::xdg::XdgSurface;
+use sctk::shell::WaylandSurface;
+use sctk::shm::slot::SlotPool;
+use sctk::shm::Shm;
+use sctk::subcompositor::SubcompositorState;
+use wayland_protocols_plasma::blur::client::org_kde_kwin_blur::OrgKdeKwinBlur;
+
+use crate::cursor::CustomCursor as RootCustomCursor;
+use crate::dpi::{LogicalPosition, LogicalSize, PhysicalPosition, PhysicalSize, Size};
+use crate::error::{ExternalError, NotSupportedError};
+use crate::platform_impl::wayland::logical_to_physical_rounded;
+use crate::platform_impl::wayland::types::cursor::{CustomCursor, SelectedCursor};
+use crate::platform_impl::wayland::types::kwin_blur::KWinBlurManager;
+use crate::platform_impl::{PlatformCustomCursor, WindowId};
+use crate::window::{CursorGrabMode, CursorIcon, ImePurpose, ResizeDirection, Theme};
+
+use crate::platform_impl::wayland::seat::{
+    PointerConstraintsState, WinitPointerData, WinitPointerDataExt, ZwpTextInputV3Ext,
+};
+use crate::platform_impl::wayland::state::{WindowCompositorUpdate, WinitState};
+
+#[cfg(feature = "sctk-adwaita")]
+pub type WinitFrame = sctk_adwaita::AdwaitaFrame<WinitState>;
+#[cfg(not(feature = "sctk-adwaita"))]
+pub type WinitFrame = sctk::shell::xdg::fallback_frame::FallbackFrame<WinitState>;
+
+// Minimum window inner size.
+const MIN_WINDOW_SIZE: LogicalSize<u32> = LogicalSize::new(2, 1);
+
+/// The state of the window which is being updated from the [`WinitState`].
+pub struct WindowState {
+    /// The connection to Wayland server.
+    pub connection: Connection,
+
+    /// The `Shm` to set cursor.
+    pub shm: WlShm,
+
+    // A shared pool where to allocate custom cursors.
+    custom_cursor_pool: Arc<Mutex<SlotPool>>,
+
+    /// The last received configure.
+    pub last_configure: Option<WindowConfigure>,
+
+    /// The pointers observed on the window.
+    pub pointers: Vec<Weak<ThemedPointer<WinitPointerData>>>,
+
+    selected_cursor: SelectedCursor,
+
+    /// Whether the cursor is visible.
+    pub cursor_visible: bool,
+
+    /// Pointer constraints to lock/confine pointer.
+    pub pointer_constraints: Option<Arc<PointerConstraintsState>>,
+
+    /// Queue handle.
+    pub queue_handle: QueueHandle<WinitState>,
+
+    /// Theme variant.
+    theme: Option<Theme>,
+
+    /// The current window title.
+    title: String,
+
+    /// Whether the frame is resizable.
+    resizable: bool,
+
+    // NOTE: we can't use simple counter, since it's racy when seat getting destroyed and new
+    // is created, since add/removed stuff could be delivered a bit out of order.
+    /// Seats that has keyboard focus on that window.
+    seat_focus: HashSet<ObjectId>,
+
+    /// The scale factor of the window.
+    scale_factor: f64,
+
+    /// Whether the window is transparent.
+    transparent: bool,
+
+    /// The state of the compositor to create WlRegions.
+    compositor: Arc<CompositorState>,
+
+    /// The current cursor grabbing mode.
+    cursor_grab_mode: GrabState,
+
+    /// Whether the IME input is allowed for that window.
+    ime_allowed: bool,
+
+    /// The current IME purpose.
+    ime_purpose: ImePurpose,
+
+    /// The text inputs observed on the window.
+    text_inputs: Vec<ZwpTextInputV3>,
+
+    /// The inner size of the window, as in without client side decorations.
+    size: LogicalSize<u32>,
+
+    /// Whether the CSD fail to create, so we don't try to create them on each iteration.
+    csd_fails: bool,
+
+    /// Whether we should decorate the frame.
+    decorate: bool,
+
+    /// Min size.
+    min_inner_size: LogicalSize<u32>,
+    max_inner_size: Option<LogicalSize<u32>>,
+    resize_increments: Option<LogicalSize<u32>>,
+
+    /// The size of the window when no states were applied to it. The primary use for it
+    /// is to fallback to original window size, before it was maximized, if the compositor
+    /// sends `None` for the new size in the configure.
+    stateless_size: LogicalSize<u32>,
+
+    /// Initial window size provided by the user. Removed on the first
+    /// configure.
+    initial_size: Option<Size>,
+
+    /// The state of the frame callback.
+    frame_callback_state: FrameCallbackState,
+
+    viewport: Option<WpViewport>,
+    fractional_scale: Option<WpFractionalScaleV1>,
+    blur: Option<OrgKdeKwinBlur>,
+    blur_manager: Option<KWinBlurManager>,
+
+    /// Whether the client side decorations have pending move operations.
+    ///
+    /// The value is the serial of the event triggered moved.
+    has_pending_move: Option<u32>,
+
+    /// The underlying SCTK window.
+    pub window: Window,
+
+    // NOTE: The spec says that destroying parent(`window` in our case), will unmap the
+    // subsurfaces. Thus to achieve atomic unmap of the client, drop the decorations
+    // frame after the `window` is dropped. To achieve that we rely on rust's struct
+    // field drop order guarantees.
+    /// The window frame, which is created from the configure request.
+    frame: Option<WinitFrame>,
+}
+
+impl WindowState {
+    /// Create new window state.
+    pub fn new(
+        connection: Connection,
+        queue_handle: &QueueHandle<WinitState>,
+        winit_state: &WinitState,
+        initial_size: Size,
+        window: Window,
+        theme: Option<Theme>,
+    ) -> Self {
+        let compositor = winit_state.compositor_state.clone();
+        let pointer_constraints = winit_state.pointer_constraints.clone();
+        let viewport = winit_state
+            .viewporter_state
+            .as_ref()
+            .map(|state| state.get_viewport(window.wl_surface(), queue_handle));
+        let fractional_scale = winit_state
+            .fractional_scaling_manager
+            .as_ref()
+            .map(|fsm| fsm.fractional_scaling(window.wl_surface(), queue_handle));
+
+        Self {
+            blur: None,
+            blur_manager: winit_state.kwin_blur_manager.clone(),
+            compositor,
+            connection,
+            csd_fails: false,
+            cursor_grab_mode: GrabState::new(),
+            selected_cursor: Default::default(),
+            cursor_visible: true,
+            decorate: true,
+            fractional_scale,
+            frame: None,
+            frame_callback_state: FrameCallbackState::None,
+            seat_focus: Default::default(),
+            has_pending_move: None,
+            ime_allowed: false,
+            ime_purpose: ImePurpose::Normal,
+            last_configure: None,
+            max_inner_size: None,
+            min_inner_size: MIN_WINDOW_SIZE,
+            resize_increments: None,
+            pointer_constraints,
+            pointers: Default::default(),
+            queue_handle: queue_handle.clone(),
+            resizable: true,
+            scale_factor: 1.,
+            shm: winit_state.shm.wl_shm().clone(),
+            custom_cursor_pool: winit_state.custom_cursor_pool.clone(),
+            size: initial_size.to_logical(1.),
+            stateless_size: initial_size.to_logical(1.),
+            initial_size: Some(initial_size),
+            text_inputs: Vec::new(),
+            theme,
+            title: String::default(),
+            transparent: false,
+            viewport,
+            window,
+        }
+    }
+
+    /// Apply closure on the given pointer.
+    fn apply_on_pointer<F: FnMut(&ThemedPointer<WinitPointerData>, &WinitPointerData)>(
+        &self,
+        mut callback: F,
+    ) {
+        self.pointers.iter().filter_map(Weak::upgrade).for_each(|pointer| {
+            let data = pointer.pointer().winit_data();
+            callback(pointer.as_ref(), data);
+        })
+    }
+
+    /// Get the current state of the frame callback.
+    pub fn frame_callback_state(&self) -> FrameCallbackState {
+        self.frame_callback_state
+    }
+
+    /// The frame callback was received, but not yet sent to the user.
+    pub fn frame_callback_received(&mut self) {
+        self.frame_callback_state = FrameCallbackState::Received;
+    }
+
+    /// Reset the frame callbacks state.
+    pub fn frame_callback_reset(&mut self) {
+        self.frame_callback_state = FrameCallbackState::None;
+    }
+
+    /// Request a frame callback if we don't have one for this window in flight.
+    pub fn request_frame_callback(&mut self) {
+        let surface = self.window.wl_surface();
+        match self.frame_callback_state {
+            FrameCallbackState::None | FrameCallbackState::Received => {
+                self.frame_callback_state = FrameCallbackState::Requested;
+                surface.frame(&self.queue_handle, surface.clone());
+            },
+            FrameCallbackState::Requested => (),
+        }
+    }
+
+    pub fn configure(
+        &mut self,
+        configure: WindowConfigure,
+        shm: &Shm,
+        subcompositor: &Option<Arc<SubcompositorState>>,
+    ) -> bool {
+        // NOTE: when using fractional scaling or wl_compositor@v6 the scaling
+        // should be delivered before the first configure, thus apply it to
+        // properly scale the physical sizes provided by the users.
+        if let Some(initial_size) = self.initial_size.take() {
+            self.size = initial_size.to_logical(self.scale_factor());
+            self.stateless_size = self.size;
+        }
+
+        if let Some(subcompositor) = subcompositor.as_ref().filter(|_| {
+            configure.decoration_mode == DecorationMode::Client
+                && self.frame.is_none()
+                && !self.csd_fails
+        }) {
+            match WinitFrame::new(
+                &self.window,
+                shm,
+                #[cfg(feature = "sctk-adwaita")]
+                self.compositor.clone(),
+                subcompositor.clone(),
+                self.queue_handle.clone(),
+                #[cfg(feature = "sctk-adwaita")]
+                into_sctk_adwaita_config(self.theme),
+            ) {
+                Ok(mut frame) => {
+                    frame.set_title(&self.title);
+                    frame.set_scaling_factor(self.scale_factor);
+                    // Hide the frame if we were asked to not decorate.
+                    frame.set_hidden(!self.decorate);
+                    self.frame = Some(frame);
+                },
+                Err(err) => {
+                    warn!("Failed to create client side decorations frame: {err}");
+                    self.csd_fails = true;
+                },
+            }
+        } else if configure.decoration_mode == DecorationMode::Server {
+            // Drop the frame for server side decorations to save resources.
+            self.frame = None;
+        }
+
+        let stateless = Self::is_stateless(&configure);
+
+        let (mut new_size, constrain) = if let Some(frame) = self.frame.as_mut() {
+            // Configure the window states.
+            frame.update_state(configure.state);
+
+            match configure.new_size {
+                (Some(width), Some(height)) => {
+                    let (width, height) = frame.subtract_borders(width, height);
+                    let width = width.map(|w| w.get()).unwrap_or(1);
+                    let height = height.map(|h| h.get()).unwrap_or(1);
+                    ((width, height).into(), false)
+                },
+                (..) if stateless => (self.stateless_size, true),
+                _ => (self.size, true),
+            }
+        } else {
+            match configure.new_size {
+                (Some(width), Some(height)) => ((width.get(), height.get()).into(), false),
+                _ if stateless => (self.stateless_size, true),
+                _ => (self.size, true),
+            }
+        };
+
+        // Apply configure bounds only when compositor let the user decide what size to pick.
+        if constrain {
+            let bounds = self.inner_size_bounds(&configure);
+            new_size.width =
+                bounds.0.map(|bound_w| new_size.width.min(bound_w.get())).unwrap_or(new_size.width);
+            new_size.height = bounds
+                .1
+                .map(|bound_h| new_size.height.min(bound_h.get()))
+                .unwrap_or(new_size.height);
+        }
+
+        // Apply size increments.
+        //
+        // We conditionally apply increments to avoid conflicts with the compositor's layout rules:
+        // 1. If the window is floating (constrain == true), we snap to increments to ensure the
+        //    app's grid alignment.
+        // 2. If the user is interactively resizing (is_resizing), we snap the size to provide
+        //    feedback.
+        //
+        // However, we MUST NOT snap if the compositor enforces a specific size (constrain == false,
+        // or states like Maximized/Tiled). Snapping in these cases (e.g. corner tiling) would
+        // shrink the window below the allocated area, creating visible gaps between valid
+        // windows or screen edges.
+        if (constrain || configure.is_resizing())
+            && !configure.is_maximized()
+            && !configure.is_fullscreen()
+            && !configure.is_tiled()
+        {
+            if let Some(increments) = self.resize_increments {
+                // We use min size as a base size for the increments, similar to how X11 does it.
+                //
+                // This ensures that we can always reach the min size and the increments are
+                // calculated from it.
+                let (delta_width, delta_height) = (
+                    new_size.width.saturating_sub(self.min_inner_size.width),
+                    new_size.height.saturating_sub(self.min_inner_size.height),
+                );
+
+                let width =
+                    self.min_inner_size.width + (delta_width / increments.width) * increments.width;
+                let height = self.min_inner_size.height
+                    + (delta_height / increments.height) * increments.height;
+
+                new_size = (width, height).into();
+            }
+        }
+
+        let new_state = configure.state;
+        let old_state = self.last_configure.as_ref().map(|configure| configure.state);
+
+        let state_change_requires_resize = old_state
+            .map(|old_state| {
+                !old_state
+                    .symmetric_difference(new_state)
+                    .difference(XdgWindowState::ACTIVATED | XdgWindowState::SUSPENDED)
+                    .is_empty()
+            })
+            // NOTE: `None` is present for the initial configure, thus we must always resize.
+            .unwrap_or(true);
+
+        // NOTE: Set the configure before doing a resize, since we query it during it.
+        self.last_configure = Some(configure);
+
+        if state_change_requires_resize || new_size != self.inner_size() {
+            self.resize(new_size);
+            true
+        } else {
+            false
+        }
+    }
+
+    /// Compute the bounds for the inner size of the surface.
+    fn inner_size_bounds(
+        &self,
+        configure: &WindowConfigure,
+    ) -> (Option<NonZeroU32>, Option<NonZeroU32>) {
+        let configure_bounds = match configure.suggested_bounds {
+            Some((width, height)) => (NonZeroU32::new(width), NonZeroU32::new(height)),
+            None => (None, None),
+        };
+
+        if let Some(frame) = self.frame.as_ref() {
+            let (width, height) = frame.subtract_borders(
+                configure_bounds.0.unwrap_or(NonZeroU32::new(1).unwrap()),
+                configure_bounds.1.unwrap_or(NonZeroU32::new(1).unwrap()),
+            );
+            (configure_bounds.0.and(width), configure_bounds.1.and(height))
+        } else {
+            configure_bounds
+        }
+    }
+
+    #[inline]
+    fn is_stateless(configure: &WindowConfigure) -> bool {
+        !(configure.is_maximized() || configure.is_fullscreen() || configure.is_tiled())
+    }
+
+    /// Start interacting drag resize.
+    pub fn drag_resize_window(&self, direction: ResizeDirection) -> Result<(), ExternalError> {
+        let xdg_toplevel = self.window.xdg_toplevel();
+
+        // TODO(kchibisov) handle touch serials.
+        self.apply_on_pointer(|_, data| {
+            let serial = data.latest_button_serial();
+            let seat = data.seat();
+            xdg_toplevel.resize(seat, serial, direction.into());
+        });
+
+        Ok(())
+    }
+
+    /// Start the window drag.
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        let xdg_toplevel = self.window.xdg_toplevel();
+        // TODO(kchibisov) handle touch serials.
+        self.apply_on_pointer(|_, data| {
+            let serial = data.latest_button_serial();
+            let seat = data.seat();
+            xdg_toplevel._move(seat, serial);
+        });
+
+        Ok(())
+    }
+
+    /// Tells whether the window should be closed.
+    #[allow(clippy::too_many_arguments)]
+    pub fn frame_click(
+        &mut self,
+        click: FrameClick,
+        pressed: bool,
+        seat: &WlSeat,
+        serial: u32,
+        timestamp: Duration,
+        window_id: WindowId,
+        updates: &mut Vec<WindowCompositorUpdate>,
+    ) -> Option<bool> {
+        match self.frame.as_mut()?.on_click(timestamp, click, pressed)? {
+            FrameAction::Minimize => self.window.set_minimized(),
+            FrameAction::Maximize => self.window.set_maximized(),
+            FrameAction::UnMaximize => self.window.unset_maximized(),
+            FrameAction::Close => WinitState::queue_close(updates, window_id),
+            FrameAction::Move => self.has_pending_move = Some(serial),
+            FrameAction::Resize(edge) => {
+                let edge = match edge {
+                    ResizeEdge::None => XdgResizeEdge::None,
+                    ResizeEdge::Top => XdgResizeEdge::Top,
+                    ResizeEdge::Bottom => XdgResizeEdge::Bottom,
+                    ResizeEdge::Left => XdgResizeEdge::Left,
+                    ResizeEdge::TopLeft => XdgResizeEdge::TopLeft,
+                    ResizeEdge::BottomLeft => XdgResizeEdge::BottomLeft,
+                    ResizeEdge::Right => XdgResizeEdge::Right,
+                    ResizeEdge::TopRight => XdgResizeEdge::TopRight,
+                    ResizeEdge::BottomRight => XdgResizeEdge::BottomRight,
+                    _ => return None,
+                };
+                self.window.resize(seat, serial, edge);
+            },
+            FrameAction::ShowMenu(x, y) => self.window.show_window_menu(seat, serial, (x, y)),
+            _ => (),
+        };
+
+        Some(false)
+    }
+
+    pub fn frame_point_left(&mut self) {
+        if let Some(frame) = self.frame.as_mut() {
+            frame.click_point_left();
+        }
+    }
+
+    // Move the point over decorations.
+    pub fn frame_point_moved(
+        &mut self,
+        seat: &WlSeat,
+        surface: &WlSurface,
+        timestamp: Duration,
+        x: f64,
+        y: f64,
+    ) -> Option<CursorIcon> {
+        // Take the serial if we had any, so it doesn't stick around.
+        let serial = self.has_pending_move.take();
+
+        if let Some(frame) = self.frame.as_mut() {
+            let cursor = frame.click_point_moved(timestamp, &surface.id(), x, y);
+            // If we have a cursor change, that means that cursor is over the decorations,
+            // so try to apply move.
+            if let Some(serial) = cursor.is_some().then_some(serial).flatten() {
+                self.window.move_(seat, serial);
+                None
+            } else {
+                cursor
+            }
+        } else {
+            None
+        }
+    }
+
+    /// Get the stored resizable state.
+    #[inline]
+    pub fn resizable(&self) -> bool {
+        self.resizable
+    }
+
+    /// Set the resizable state on the window.
+    ///
+    /// Returns `true` when the state was applied.
+    #[inline]
+    pub fn set_resizable(&mut self, resizable: bool) -> bool {
+        if self.resizable == resizable {
+            return false;
+        }
+
+        self.resizable = resizable;
+        if resizable {
+            // Restore min/max sizes of the window.
+            self.reload_min_max_hints();
+        } else {
+            self.set_min_inner_size(Some(self.size));
+            self.set_max_inner_size(Some(self.size));
+        }
+
+        // Reload the state on the frame as well.
+        if let Some(frame) = self.frame.as_mut() {
+            frame.set_resizable(resizable);
+        }
+
+        true
+    }
+
+    /// Whether the window is focused by any seat.
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        !self.seat_focus.is_empty()
+    }
+
+    /// Whether the IME is allowed.
+    #[inline]
+    pub fn ime_allowed(&self) -> bool {
+        self.ime_allowed
+    }
+
+    /// Get the size of the window.
+    #[inline]
+    pub fn inner_size(&self) -> LogicalSize<u32> {
+        self.size
+    }
+
+    /// Whether the window received initial configure event from the compositor.
+    #[inline]
+    pub fn is_configured(&self) -> bool {
+        self.last_configure.is_some()
+    }
+
+    #[inline]
+    pub fn is_decorated(&mut self) -> bool {
+        let csd = self
+            .last_configure
+            .as_ref()
+            .map(|configure| configure.decoration_mode == DecorationMode::Client)
+            .unwrap_or(false);
+        if let Some(frame) = csd.then_some(self.frame.as_ref()).flatten() {
+            !frame.is_hidden()
+        } else {
+            // Server side decorations.
+            true
+        }
+    }
+
+    /// Get the outer size of the window.
+    #[inline]
+    pub fn outer_size(&self) -> LogicalSize<u32> {
+        self.frame
+            .as_ref()
+            .map(|frame| frame.add_borders(self.size.width, self.size.height).into())
+            .unwrap_or(self.size)
+    }
+
+    /// Register pointer on the top-level.
+    pub fn pointer_entered(&mut self, added: Weak<ThemedPointer<WinitPointerData>>) {
+        self.pointers.push(added);
+        self.reload_cursor_style();
+
+        let mode = self.cursor_grab_mode.user_grab_mode;
+        let _ = self.set_cursor_grab_inner(mode);
+    }
+
+    /// Pointer has left the top-level.
+    pub fn pointer_left(&mut self, removed: Weak<ThemedPointer<WinitPointerData>>) {
+        let mut new_pointers = Vec::new();
+        for pointer in self.pointers.drain(..) {
+            if let Some(pointer) = pointer.upgrade() {
+                if pointer.pointer() != removed.upgrade().unwrap().pointer() {
+                    new_pointers.push(Arc::downgrade(&pointer));
+                }
+            }
+        }
+
+        self.pointers = new_pointers;
+    }
+
+    /// Refresh the decorations frame if it's present returning whether the client should redraw.
+    pub fn refresh_frame(&mut self) -> bool {
+        if let Some(frame) = self.frame.as_mut() {
+            if !frame.is_hidden() && frame.is_dirty() {
+                return frame.draw();
+            }
+        }
+
+        false
+    }
+
+    /// Reload the cursor style on the given window.
+    pub fn reload_cursor_style(&mut self) {
+        if self.cursor_visible {
+            match &self.selected_cursor {
+                SelectedCursor::Named(icon) => self.set_cursor(*icon),
+                SelectedCursor::Custom(cursor) => self.apply_custom_cursor(cursor),
+            }
+        } else {
+            self.set_cursor_visible(self.cursor_visible);
+        }
+    }
+
+    /// Reissue the transparency hint to the compositor.
+    pub fn reload_transparency_hint(&self) {
+        let surface = self.window.wl_surface();
+
+        if self.transparent {
+            surface.set_opaque_region(None);
+        } else if let Ok(region) = Region::new(&*self.compositor) {
+            region.add(0, 0, i32::MAX, i32::MAX);
+            surface.set_opaque_region(Some(region.wl_region()));
+        } else {
+            warn!("Failed to mark window opaque.");
+        }
+    }
+
+    /// Try to resize the window when the user can do so.
+    pub fn request_inner_size(&mut self, inner_size: Size) -> PhysicalSize<u32> {
+        if self.last_configure.as_ref().map(Self::is_stateless).unwrap_or(true) {
+            self.resize(inner_size.to_logical(self.scale_factor()))
+        }
+
+        logical_to_physical_rounded(self.inner_size(), self.scale_factor())
+    }
+
+    /// Resize the window to the new inner size.
+    fn resize(&mut self, inner_size: LogicalSize<u32>) {
+        self.size = inner_size;
+
+        // Update the stateless size.
+        if Some(true) == self.last_configure.as_ref().map(Self::is_stateless) {
+            self.stateless_size = inner_size;
+        }
+
+        // Update the inner frame.
+        let ((x, y), outer_size) = if let Some(frame) = self.frame.as_mut() {
+            // Resize only visible frame.
+            if !frame.is_hidden() {
+                frame.resize(
+                    NonZeroU32::new(self.size.width).unwrap(),
+                    NonZeroU32::new(self.size.height).unwrap(),
+                );
+            }
+
+            (frame.location(), frame.add_borders(self.size.width, self.size.height).into())
+        } else {
+            ((0, 0), self.size)
+        };
+
+        // Reload the hint.
+        self.reload_transparency_hint();
+
+        // Set the window geometry.
+        self.window.xdg_surface().set_window_geometry(
+            x,
+            y,
+            outer_size.width as i32,
+            outer_size.height as i32,
+        );
+
+        // Update the target viewport, this is used if and only if fractional scaling is in use.
+        if let Some(viewport) = self.viewport.as_ref() {
+            // Set inner size without the borders.
+            viewport.set_destination(self.size.width as _, self.size.height as _);
+        }
+    }
+
+    /// Get the scale factor of the window.
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        self.scale_factor
+    }
+
+    /// Set the cursor icon.
+    pub fn set_cursor(&mut self, cursor_icon: CursorIcon) {
+        self.selected_cursor = SelectedCursor::Named(cursor_icon);
+
+        if !self.cursor_visible {
+            return;
+        }
+
+        self.apply_on_pointer(|pointer, _| {
+            if pointer.set_cursor(&self.connection, cursor_icon).is_err() {
+                warn!("Failed to set cursor to {:?}", cursor_icon);
+            }
+        })
+    }
+
+    /// Set the custom cursor icon.
+    pub(crate) fn set_custom_cursor(&mut self, cursor: RootCustomCursor) {
+        let cursor = match cursor {
+            RootCustomCursor { inner: PlatformCustomCursor::Wayland(cursor) } => cursor.0,
+            #[cfg(x11_platform)]
+            RootCustomCursor { inner: PlatformCustomCursor::X(_) } => {
+                tracing::error!("passed a X11 cursor to Wayland backend");
+                return;
+            },
+        };
+
+        let cursor = {
+            let mut pool = self.custom_cursor_pool.lock().unwrap();
+            CustomCursor::new(&mut pool, &cursor)
+        };
+
+        if self.cursor_visible {
+            self.apply_custom_cursor(&cursor);
+        }
+
+        self.selected_cursor = SelectedCursor::Custom(cursor);
+    }
+
+    /// Set the resize increments of the window.
+    pub fn set_resize_increments(&mut self, increments: Option<LogicalSize<u32>>) {
+        self.resize_increments = increments;
+        // NOTE: We don't update the window size here, because it will be done on the next resize
+        // or configure event.
+    }
+
+    /// Get the resize increments of the window.
+    pub fn resize_increments(&self) -> Option<LogicalSize<u32>> {
+        self.resize_increments
+    }
+
+    fn apply_custom_cursor(&self, cursor: &CustomCursor) {
+        self.apply_on_pointer(|pointer, data| {
+            let surface = pointer.surface();
+
+            let scale = if let Some(viewport) = data.viewport() {
+                let scale = self.scale_factor();
+                let size = PhysicalSize::new(cursor.w, cursor.h).to_logical(scale);
+                viewport.set_destination(size.width, size.height);
+                scale
+            } else {
+                let scale = surface.data::<SurfaceData>().unwrap().surface_data().scale_factor();
+                surface.set_buffer_scale(scale);
+                scale as f64
+            };
+
+            surface.attach(Some(cursor.buffer.wl_buffer()), 0, 0);
+            if surface.version() >= 4 {
+                surface.damage_buffer(0, 0, cursor.w, cursor.h);
+            } else {
+                let size = PhysicalSize::new(cursor.w, cursor.h).to_logical(scale);
+                surface.damage(0, 0, size.width, size.height);
+            }
+            surface.commit();
+
+            let serial = pointer
+                .pointer()
+                .data::<WinitPointerData>()
+                .and_then(|data| data.pointer_data().latest_enter_serial())
+                .unwrap();
+
+            let hotspot =
+                PhysicalPosition::new(cursor.hotspot_x, cursor.hotspot_y).to_logical(scale);
+            pointer.pointer().set_cursor(serial, Some(surface), hotspot.x, hotspot.y);
+        });
+    }
+
+    /// Set maximum inner window size.
+    pub fn set_min_inner_size(&mut self, size: Option<LogicalSize<u32>>) {
+        // Ensure that the window has the right minimum size.
+        let mut size = size.unwrap_or(MIN_WINDOW_SIZE);
+        size.width = size.width.max(MIN_WINDOW_SIZE.width);
+        size.height = size.height.max(MIN_WINDOW_SIZE.height);
+
+        // Add the borders.
+        let size = self
+            .frame
+            .as_ref()
+            .map(|frame| frame.add_borders(size.width, size.height).into())
+            .unwrap_or(size);
+
+        self.min_inner_size = size;
+        self.window.set_min_size(Some(size.into()));
+    }
+
+    /// Set maximum inner window size.
+    pub fn set_max_inner_size(&mut self, size: Option<LogicalSize<u32>>) {
+        let size = size.map(|size| {
+            self.frame
+                .as_ref()
+                .map(|frame| frame.add_borders(size.width, size.height).into())
+                .unwrap_or(size)
+        });
+
+        self.max_inner_size = size;
+        self.window.set_max_size(size.map(Into::into));
+    }
+
+    /// Set the CSD theme.
+    pub fn set_theme(&mut self, theme: Option<Theme>) {
+        self.theme = theme;
+        #[cfg(feature = "sctk-adwaita")]
+        if let Some(frame) = self.frame.as_mut() {
+            frame.set_config(into_sctk_adwaita_config(theme))
+        }
+    }
+
+    /// The current theme for CSD decorations.
+    #[inline]
+    pub fn theme(&self) -> Option<Theme> {
+        self.theme
+    }
+
+    /// Set the cursor grabbing state on the top-level.
+    pub fn set_cursor_grab(&mut self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        if self.cursor_grab_mode.user_grab_mode == mode {
+            return Ok(());
+        }
+
+        self.set_cursor_grab_inner(mode)?;
+        // Update user grab on success.
+        self.cursor_grab_mode.user_grab_mode = mode;
+        Ok(())
+    }
+
+    /// Reload the hints for minimum and maximum sizes.
+    pub fn reload_min_max_hints(&mut self) {
+        self.set_min_inner_size(Some(self.min_inner_size));
+        self.set_max_inner_size(self.max_inner_size);
+    }
+
+    /// Set the grabbing state on the surface.
+    fn set_cursor_grab_inner(&mut self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        let pointer_constraints = match self.pointer_constraints.as_ref() {
+            Some(pointer_constraints) => pointer_constraints,
+            None if mode == CursorGrabMode::None => return Ok(()),
+            None => return Err(ExternalError::NotSupported(NotSupportedError::new())),
+        };
+
+        let mut unset_old = false;
+        match self.cursor_grab_mode.current_grab_mode {
+            CursorGrabMode::None => unset_old = true,
+            CursorGrabMode::Confined => self.apply_on_pointer(|_, data| {
+                data.unconfine_pointer();
+                unset_old = true;
+            }),
+            CursorGrabMode::Locked => {
+                self.apply_on_pointer(|_, data| {
+                    data.unlock_pointer();
+                    unset_old = true;
+                });
+            },
+        }
+
+        // In case we haven't unset the old mode, it means that we don't have a cursor above
+        // the window, thus just wait for it to re-appear.
+        if !unset_old {
+            return Ok(());
+        }
+
+        let mut set_mode = false;
+        let surface = self.window.wl_surface();
+        match mode {
+            CursorGrabMode::Locked => self.apply_on_pointer(|pointer, data| {
+                let pointer = pointer.pointer();
+                data.lock_pointer(pointer_constraints, surface, pointer, &self.queue_handle);
+                set_mode = true;
+            }),
+            CursorGrabMode::Confined => self.apply_on_pointer(|pointer, data| {
+                let pointer = pointer.pointer();
+                data.confine_pointer(pointer_constraints, surface, pointer, &self.queue_handle);
+                set_mode = true;
+            }),
+            CursorGrabMode::None => {
+                // Current lock/confine was already removed.
+                set_mode = true;
+            },
+        }
+
+        // Replace the current grab mode after we've ensure that it got updated.
+        if set_mode {
+            self.cursor_grab_mode.current_grab_mode = mode;
+        }
+
+        Ok(())
+    }
+
+    pub fn show_window_menu(&self, position: LogicalPosition<u32>) {
+        // TODO(kchibisov) handle touch serials.
+        self.apply_on_pointer(|_, data| {
+            let serial = data.latest_button_serial();
+            let seat = data.seat();
+            self.window.show_window_menu(seat, serial, position.into());
+        });
+    }
+
+    /// Set the position of the cursor.
+    pub fn set_cursor_position(&self, position: LogicalPosition<f64>) -> Result<(), ExternalError> {
+        if self.pointer_constraints.is_none() {
+            return Err(ExternalError::NotSupported(NotSupportedError::new()));
+        }
+
+        // Position can be set only for locked cursor.
+        if self.cursor_grab_mode.current_grab_mode != CursorGrabMode::Locked {
+            return Err(ExternalError::Os(os_error!(crate::platform_impl::OsError::Misc(
+                "cursor position can be set only for locked cursor."
+            ))));
+        }
+
+        self.apply_on_pointer(|_, data| {
+            data.set_locked_cursor_position(position.x, position.y);
+        });
+
+        Ok(())
+    }
+
+    /// Set the visibility state of the cursor.
+    pub fn set_cursor_visible(&mut self, cursor_visible: bool) {
+        self.cursor_visible = cursor_visible;
+
+        if self.cursor_visible {
+            match &self.selected_cursor {
+                SelectedCursor::Named(icon) => self.set_cursor(*icon),
+                SelectedCursor::Custom(cursor) => self.apply_custom_cursor(cursor),
+            }
+        } else {
+            for pointer in self.pointers.iter().filter_map(|pointer| pointer.upgrade()) {
+                let latest_enter_serial = pointer.pointer().winit_data().latest_enter_serial();
+
+                pointer.pointer().set_cursor(latest_enter_serial, None, 0, 0);
+            }
+        }
+    }
+
+    /// Whether show or hide client side decorations.
+    #[inline]
+    pub fn set_decorate(&mut self, decorate: bool) {
+        if decorate == self.decorate {
+            return;
+        }
+
+        self.decorate = decorate;
+
+        match self.last_configure.as_ref().map(|configure| configure.decoration_mode) {
+            Some(DecorationMode::Server) if !self.decorate => {
+                // To disable decorations we should request client and hide the frame.
+                self.window.request_decoration_mode(Some(DecorationMode::Client))
+            },
+            _ if self.decorate => self.window.request_decoration_mode(Some(DecorationMode::Server)),
+            _ => (),
+        }
+
+        if let Some(frame) = self.frame.as_mut() {
+            frame.set_hidden(!decorate);
+            // Force the resize.
+            self.resize(self.size);
+        }
+    }
+
+    /// Add seat focus for the window.
+    #[inline]
+    pub fn add_seat_focus(&mut self, seat: ObjectId) {
+        self.seat_focus.insert(seat);
+    }
+
+    /// Remove seat focus from the window.
+    #[inline]
+    pub fn remove_seat_focus(&mut self, seat: &ObjectId) {
+        self.seat_focus.remove(seat);
+    }
+
+    /// Returns `true` if the requested state was applied.
+    pub fn set_ime_allowed(&mut self, allowed: bool) -> bool {
+        self.ime_allowed = allowed;
+
+        let mut applied = false;
+        for text_input in &self.text_inputs {
+            applied = true;
+            if allowed {
+                text_input.enable();
+                text_input.set_content_type_by_purpose(self.ime_purpose);
+            } else {
+                text_input.disable();
+            }
+            text_input.commit();
+        }
+
+        applied
+    }
+
+    /// Set the IME position.
+    pub fn set_ime_cursor_area(&self, position: LogicalPosition<u32>, size: LogicalSize<u32>) {
+        // FIXME: This won't fly unless user will have a way to request IME window per seat, since
+        // the ime windows will be overlapping, but winit doesn't expose API to specify for
+        // which seat we're setting IME position.
+        let (x, y) = (position.x as i32, position.y as i32);
+        let (width, height) = (size.width as i32, size.height as i32);
+        for text_input in self.text_inputs.iter() {
+            text_input.set_cursor_rectangle(x, y, width, height);
+            text_input.commit();
+        }
+    }
+
+    /// Set the IME purpose.
+    pub fn set_ime_purpose(&mut self, purpose: ImePurpose) {
+        self.ime_purpose = purpose;
+
+        for text_input in &self.text_inputs {
+            text_input.set_content_type_by_purpose(purpose);
+            text_input.commit();
+        }
+    }
+
+    /// Get the IME purpose.
+    pub fn ime_purpose(&self) -> ImePurpose {
+        self.ime_purpose
+    }
+
+    /// Set the scale factor for the given window.
+    #[inline]
+    pub fn set_scale_factor(&mut self, scale_factor: f64) {
+        self.scale_factor = scale_factor;
+
+        // NOTE: When fractional scaling is not used update the buffer scale.
+        if self.fractional_scale.is_none() {
+            let _ = self.window.set_buffer_scale(self.scale_factor as _);
+        }
+
+        if let Some(frame) = self.frame.as_mut() {
+            frame.set_scaling_factor(scale_factor);
+        }
+    }
+
+    /// Make window background blurred
+    #[inline]
+    pub fn set_blur(&mut self, blurred: bool) {
+        if blurred && self.blur.is_none() {
+            if let Some(blur_manager) = self.blur_manager.as_ref() {
+                let blur = blur_manager.blur(self.window.wl_surface(), &self.queue_handle);
+                blur.commit();
+                self.blur = Some(blur);
+            } else {
+                info!("Blur manager unavailable, unable to change blur")
+            }
+        } else if !blurred && self.blur.is_some() {
+            self.blur_manager.as_ref().unwrap().unset(self.window.wl_surface());
+            self.blur.take().unwrap().release();
+        }
+    }
+
+    /// Set the window title to a new value.
+    ///
+    /// This will automatically truncate the title to something meaningful.
+    pub fn set_title(&mut self, mut title: String) {
+        // Truncate the title to at most 1024 bytes, so that it does not blow up the protocol
+        // messages
+        if title.len() > 1024 {
+            let mut new_len = 1024;
+            while !title.is_char_boundary(new_len) {
+                new_len -= 1;
+            }
+            title.truncate(new_len);
+        }
+
+        // Update the CSD title.
+        if let Some(frame) = self.frame.as_mut() {
+            frame.set_title(&title);
+        }
+
+        self.window.set_title(&title);
+        self.title = title;
+    }
+
+    /// Mark the window as transparent.
+    #[inline]
+    pub fn set_transparent(&mut self, transparent: bool) {
+        self.transparent = transparent;
+        self.reload_transparency_hint();
+    }
+
+    /// Register text input on the top-level.
+    #[inline]
+    pub fn text_input_entered(&mut self, text_input: &ZwpTextInputV3) {
+        if !self.text_inputs.iter().any(|t| t == text_input) {
+            self.text_inputs.push(text_input.clone());
+        }
+    }
+
+    /// The text input left the top-level.
+    #[inline]
+    pub fn text_input_left(&mut self, text_input: &ZwpTextInputV3) {
+        if let Some(position) = self.text_inputs.iter().position(|t| t == text_input) {
+            self.text_inputs.remove(position);
+        }
+    }
+
+    /// Get the cached title.
+    #[inline]
+    pub fn title(&self) -> &str {
+        &self.title
+    }
+}
+
+impl Drop for WindowState {
+    fn drop(&mut self) {
+        if let Some(blur) = self.blur.take() {
+            blur.release();
+        }
+
+        if let Some(fs) = self.fractional_scale.take() {
+            fs.destroy();
+        }
+
+        if let Some(viewport) = self.viewport.take() {
+            viewport.destroy();
+        }
+
+        // NOTE: the wl_surface used by the window is being cleaned up when
+        // dropping SCTK `Window`.
+    }
+}
+
+/// The state of the cursor grabs.
+#[derive(Clone, Copy)]
+struct GrabState {
+    /// The grab mode requested by the user.
+    user_grab_mode: CursorGrabMode,
+
+    /// The current grab mode.
+    current_grab_mode: CursorGrabMode,
+}
+
+impl GrabState {
+    fn new() -> Self {
+        Self { user_grab_mode: CursorGrabMode::None, current_grab_mode: CursorGrabMode::None }
+    }
+}
+
+/// The state of the frame callback.
+#[derive(Default, Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FrameCallbackState {
+    /// No frame callback was requested.
+    #[default]
+    None,
+    /// The frame callback was requested, but not yet arrived, the redraw events are throttled.
+    Requested,
+    /// The callback was marked as done, and user could receive redraw requested
+    Received,
+}
+
+impl From<ResizeDirection> for XdgResizeEdge {
+    fn from(value: ResizeDirection) -> Self {
+        match value {
+            ResizeDirection::North => XdgResizeEdge::Top,
+            ResizeDirection::West => XdgResizeEdge::Left,
+            ResizeDirection::NorthWest => XdgResizeEdge::TopLeft,
+            ResizeDirection::NorthEast => XdgResizeEdge::TopRight,
+            ResizeDirection::East => XdgResizeEdge::Right,
+            ResizeDirection::SouthWest => XdgResizeEdge::BottomLeft,
+            ResizeDirection::SouthEast => XdgResizeEdge::BottomRight,
+            ResizeDirection::South => XdgResizeEdge::Bottom,
+        }
+    }
+}
+
+// NOTE: Rust doesn't allow `From<Option<Theme>>`.
+#[cfg(feature = "sctk-adwaita")]
+fn into_sctk_adwaita_config(theme: Option<Theme>) -> sctk_adwaita::FrameConfig {
+    match theme {
+        Some(Theme::Light) => sctk_adwaita::FrameConfig::light(),
+        Some(Theme::Dark) => sctk_adwaita::FrameConfig::dark(),
+        None => sctk_adwaita::FrameConfig::auto(),
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/activation.rs b/vendor/winit/src/platform_impl/linux/x11/activation.rs
new file mode 100644
index 00000000..8f4aa796
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/activation.rs
@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! X11 activation handling.
+//!
+//! X11 has a "startup notification" specification similar to Wayland's, see this URL:
+//! <https://specifications.freedesktop.org/startup-notification-spec/startup-notification-latest.txt>
+
+use super::atoms::*;
+use super::{VoidCookie, X11Error, XConnection};
+
+use std::ffi::CString;
+use std::fmt::Write;
+
+use x11rb::protocol::xproto::{self, ConnectionExt as _};
+
+impl XConnection {
+    /// "Request" a new activation token from the server.
+    pub(crate) fn request_activation_token(&self, window_title: &str) -> Result<String, X11Error> {
+        // The specification recommends the format "hostname+pid+"_TIME"+current time"
+        let uname = rustix::system::uname();
+        let pid = rustix::process::getpid();
+        let time = self.timestamp();
+
+        let activation_token = format!(
+            "{}{}_TIME{}",
+            uname.nodename().to_str().unwrap_or("winit"),
+            pid.as_raw_nonzero(),
+            time
+        );
+
+        // Set up the new startup notification.
+        let notification = {
+            let mut buffer = Vec::new();
+            buffer.extend_from_slice(b"new: ID=");
+            quote_string(&activation_token, &mut buffer);
+            buffer.extend_from_slice(b" NAME=");
+            quote_string(window_title, &mut buffer);
+            buffer.extend_from_slice(b" SCREEN=");
+            push_display(&mut buffer, &self.default_screen_index());
+
+            CString::new(buffer)
+                .map_err(|err| X11Error::InvalidActivationToken(err.into_vec()))?
+                .into_bytes_with_nul()
+        };
+        self.send_message(&notification)?;
+
+        Ok(activation_token)
+    }
+
+    /// Finish launching a window with the given startup ID.
+    pub(crate) fn remove_activation_token(
+        &self,
+        window: xproto::Window,
+        startup_id: &str,
+    ) -> Result<(), X11Error> {
+        let atoms = self.atoms();
+
+        // Set the _NET_STARTUP_ID property on the window.
+        self.xcb_connection()
+            .change_property(
+                xproto::PropMode::REPLACE,
+                window,
+                atoms[_NET_STARTUP_ID],
+                xproto::AtomEnum::STRING,
+                8,
+                startup_id.len().try_into().unwrap(),
+                startup_id.as_bytes(),
+            )?
+            .check()?;
+
+        // Send the message indicating that the startup is over.
+        let message = {
+            const MESSAGE_ROOT: &str = "remove: ID=";
+
+            let mut buffer = Vec::with_capacity(
+                MESSAGE_ROOT
+                    .len()
+                    .checked_add(startup_id.len())
+                    .and_then(|x| x.checked_add(1))
+                    .unwrap(),
+            );
+            buffer.extend_from_slice(MESSAGE_ROOT.as_bytes());
+            quote_string(startup_id, &mut buffer);
+            CString::new(buffer)
+                .map_err(|err| X11Error::InvalidActivationToken(err.into_vec()))?
+                .into_bytes_with_nul()
+        };
+
+        self.send_message(&message)
+    }
+
+    /// Send a startup notification message to the window manager.
+    fn send_message(&self, message: &[u8]) -> Result<(), X11Error> {
+        let atoms = self.atoms();
+
+        // Create a new window to send the message over.
+        let screen = self.default_root();
+        let window = xproto::WindowWrapper::create_window(
+            self.xcb_connection(),
+            screen.root_depth,
+            screen.root,
+            -100,
+            -100,
+            1,
+            1,
+            0,
+            xproto::WindowClass::INPUT_OUTPUT,
+            screen.root_visual,
+            &xproto::CreateWindowAux::new().override_redirect(1).event_mask(
+                xproto::EventMask::STRUCTURE_NOTIFY | xproto::EventMask::PROPERTY_CHANGE,
+            ),
+        )?;
+
+        // Serialize the messages in 20-byte chunks.
+        let mut message_type = atoms[_NET_STARTUP_INFO_BEGIN];
+        message
+            .chunks(20)
+            .map(|chunk| {
+                let mut buffer = [0u8; 20];
+                buffer[..chunk.len()].copy_from_slice(chunk);
+                let event =
+                    xproto::ClientMessageEvent::new(8, window.window(), message_type, buffer);
+
+                // Set the message type to the continuation atom for the next chunk.
+                message_type = atoms[_NET_STARTUP_INFO];
+
+                event
+            })
+            .try_for_each(|event| {
+                // Send each event in order.
+                self.xcb_connection()
+                    .send_event(false, screen.root, xproto::EventMask::PROPERTY_CHANGE, event)
+                    .map(VoidCookie::ignore_error)
+            })?;
+
+        Ok(())
+    }
+}
+
+/// Quote a literal string as per the startup notification specification.
+fn quote_string(s: &str, target: &mut Vec<u8>) {
+    let total_len = s.len().checked_add(3).expect("quote string overflow");
+    target.reserve(total_len);
+
+    // Add the opening quote.
+    target.push(b'"');
+
+    // Iterate over the string split by literal quotes.
+    s.as_bytes().split(|&b| b == b'"').for_each(|part| {
+        // Add the part.
+        target.extend_from_slice(part);
+
+        // Escape the quote.
+        target.push(b'\\');
+        target.push(b'"');
+    });
+
+    // Un-escape the last quote.
+    target.remove(target.len() - 2);
+}
+
+/// Push a `Display` implementation to the buffer.
+fn push_display(buffer: &mut Vec<u8>, display: &impl std::fmt::Display) {
+    struct Writer<'a> {
+        buffer: &'a mut Vec<u8>,
+    }
+
+    impl std::fmt::Write for Writer<'_> {
+        fn write_str(&mut self, s: &str) -> std::fmt::Result {
+            self.buffer.extend_from_slice(s.as_bytes());
+            Ok(())
+        }
+    }
+
+    write!(Writer { buffer }, "{display}").unwrap();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn properly_escapes_x11_messages() {
+        let assert_eq = |input: &str, output: &[u8]| {
+            let mut buf = vec![];
+            quote_string(input, &mut buf);
+            assert_eq!(buf, output);
+        };
+
+        assert_eq("", b"\"\"");
+        assert_eq("foo", b"\"foo\"");
+        assert_eq("foo\"bar", b"\"foo\\\"bar\"");
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/atoms.rs b/vendor/winit/src/platform_impl/linux/x11/atoms.rs
new file mode 100644
index 00000000..c6d96c8f
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/atoms.rs
@@ -0,0 +1,117 @@
+//! Collects every atom used by the platform implementation.
+
+use core::ops::Index;
+
+macro_rules! atom_manager {
+    ($($name:ident $(:$lit:literal)?),*) => {
+        x11rb::atom_manager! {
+            /// The atoms used by `winit`
+            pub Atoms: AtomsCookie {
+                $($name $(:$lit)?,)*
+            }
+        }
+
+        /// Indices into the `Atoms` struct.
+        #[derive(Copy, Clone, Debug)]
+        #[allow(non_camel_case_types)]
+        pub enum AtomName {
+            $($name,)*
+        }
+
+        impl AtomName {
+            pub(crate) fn atom_from(
+                self,
+                atoms: &Atoms
+            ) -> &x11rb::protocol::xproto::Atom {
+                match self {
+                    $(AtomName::$name => &atoms.$name,)*
+                }
+            }
+        }
+    };
+}
+
+atom_manager! {
+    // General Use Atoms
+    CARD32,
+    UTF8_STRING,
+    WM_CHANGE_STATE,
+    WM_CLIENT_MACHINE,
+    WM_DELETE_WINDOW,
+    WM_PROTOCOLS,
+    WM_STATE,
+    XIM_SERVERS,
+
+    // Assorted ICCCM Atoms
+    _NET_WM_ICON,
+    _NET_WM_MOVERESIZE,
+    _NET_WM_NAME,
+    _NET_WM_PID,
+    _NET_WM_PING,
+    _NET_WM_STATE,
+    _NET_WM_STATE_ABOVE,
+    _NET_WM_STATE_BELOW,
+    _NET_WM_STATE_FULLSCREEN,
+    _NET_WM_STATE_HIDDEN,
+    _NET_WM_STATE_MAXIMIZED_HORZ,
+    _NET_WM_STATE_MAXIMIZED_VERT,
+    _NET_WM_WINDOW_TYPE,
+
+    // Activation atoms.
+    _NET_STARTUP_INFO_BEGIN,
+    _NET_STARTUP_INFO,
+    _NET_STARTUP_ID,
+
+    // WM window types.
+    _NET_WM_WINDOW_TYPE_DESKTOP,
+    _NET_WM_WINDOW_TYPE_DOCK,
+    _NET_WM_WINDOW_TYPE_TOOLBAR,
+    _NET_WM_WINDOW_TYPE_MENU,
+    _NET_WM_WINDOW_TYPE_UTILITY,
+    _NET_WM_WINDOW_TYPE_SPLASH,
+    _NET_WM_WINDOW_TYPE_DIALOG,
+    _NET_WM_WINDOW_TYPE_DROPDOWN_MENU,
+    _NET_WM_WINDOW_TYPE_POPUP_MENU,
+    _NET_WM_WINDOW_TYPE_TOOLTIP,
+    _NET_WM_WINDOW_TYPE_NOTIFICATION,
+    _NET_WM_WINDOW_TYPE_COMBO,
+    _NET_WM_WINDOW_TYPE_DND,
+    _NET_WM_WINDOW_TYPE_NORMAL,
+
+    // Drag-N-Drop Atoms
+    XdndAware,
+    XdndEnter,
+    XdndLeave,
+    XdndDrop,
+    XdndPosition,
+    XdndStatus,
+    XdndActionPrivate,
+    XdndSelection,
+    XdndFinished,
+    XdndTypeList,
+    TextUriList: b"text/uri-list",
+    None: b"None",
+
+    // Miscellaneous Atoms
+    _GTK_THEME_VARIANT,
+    _MOTIF_WM_HINTS,
+    _NET_ACTIVE_WINDOW,
+    _NET_CLIENT_LIST,
+    _NET_FRAME_EXTENTS,
+    _NET_SUPPORTED,
+    _NET_SUPPORTING_WM_CHECK,
+    _XEMBED,
+    _XSETTINGS_SETTINGS
+}
+
+impl Index<AtomName> for Atoms {
+    type Output = x11rb::protocol::xproto::Atom;
+
+    fn index(&self, index: AtomName) -> &Self::Output {
+        index.atom_from(self)
+    }
+}
+
+pub(crate) use AtomName::*;
+// Make sure `None` is still defined.
+pub(crate) use core::option::Option::None;
diff --git a/vendor/winit/src/platform_impl/linux/x11/dnd.rs b/vendor/winit/src/platform_impl/linux/x11/dnd.rs
new file mode 100644
index 00000000..691e40af
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/dnd.rs
@@ -0,0 +1,174 @@
+use std::io;
+use std::os::raw::*;
+use std::path::{Path, PathBuf};
+use std::str::Utf8Error;
+use std::sync::Arc;
+
+use percent_encoding::percent_decode;
+use x11rb::protocol::xproto::{self, ConnectionExt};
+
+use super::atoms::AtomName::None as DndNone;
+use super::atoms::*;
+use super::{util, CookieResultExt, X11Error, XConnection};
+
+#[derive(Debug, Clone, Copy)]
+pub enum DndState {
+    Accepted,
+    Rejected,
+}
+
+#[derive(Debug)]
+pub enum DndDataParseError {
+    EmptyData,
+    InvalidUtf8(#[allow(dead_code)] Utf8Error),
+    HostnameSpecified(#[allow(dead_code)] String),
+    UnexpectedProtocol(#[allow(dead_code)] String),
+    UnresolvablePath(#[allow(dead_code)] io::Error),
+}
+
+impl From<Utf8Error> for DndDataParseError {
+    fn from(e: Utf8Error) -> Self {
+        DndDataParseError::InvalidUtf8(e)
+    }
+}
+
+impl From<io::Error> for DndDataParseError {
+    fn from(e: io::Error) -> Self {
+        DndDataParseError::UnresolvablePath(e)
+    }
+}
+
+pub struct Dnd {
+    xconn: Arc<XConnection>,
+    // Populated by XdndEnter event handler
+    pub version: Option<c_long>,
+    pub type_list: Option<Vec<xproto::Atom>>,
+    // Populated by XdndPosition event handler
+    pub source_window: Option<xproto::Window>,
+    // Populated by SelectionNotify event handler (triggered by XdndPosition event handler)
+    pub result: Option<Result<Vec<PathBuf>, DndDataParseError>>,
+}
+
+impl Dnd {
+    pub fn new(xconn: Arc<XConnection>) -> Result<Self, X11Error> {
+        Ok(Dnd { xconn, version: None, type_list: None, source_window: None, result: None })
+    }
+
+    pub fn reset(&mut self) {
+        self.version = None;
+        self.type_list = None;
+        self.source_window = None;
+        self.result = None;
+    }
+
+    pub unsafe fn send_status(
+        &self,
+        this_window: xproto::Window,
+        target_window: xproto::Window,
+        state: DndState,
+    ) -> Result<(), X11Error> {
+        let atoms = self.xconn.atoms();
+        let (accepted, action) = match state {
+            DndState::Accepted => (1, atoms[XdndActionPrivate]),
+            DndState::Rejected => (0, atoms[DndNone]),
+        };
+        self.xconn
+            .send_client_msg(target_window, target_window, atoms[XdndStatus] as _, None, [
+                this_window,
+                accepted,
+                0,
+                0,
+                action as _,
+            ])?
+            .ignore_error();
+
+        Ok(())
+    }
+
+    pub unsafe fn send_finished(
+        &self,
+        this_window: xproto::Window,
+        target_window: xproto::Window,
+        state: DndState,
+    ) -> Result<(), X11Error> {
+        let atoms = self.xconn.atoms();
+        let (accepted, action) = match state {
+            DndState::Accepted => (1, atoms[XdndActionPrivate]),
+            DndState::Rejected => (0, atoms[DndNone]),
+        };
+        self.xconn
+            .send_client_msg(target_window, target_window, atoms[XdndFinished] as _, None, [
+                this_window,
+                accepted,
+                action as _,
+                0,
+                0,
+            ])?
+            .ignore_error();
+
+        Ok(())
+    }
+
+    pub unsafe fn get_type_list(
+        &self,
+        source_window: xproto::Window,
+    ) -> Result<Vec<xproto::Atom>, util::GetPropertyError> {
+        let atoms = self.xconn.atoms();
+        self.xconn.get_property(
+            source_window,
+            atoms[XdndTypeList],
+            xproto::Atom::from(xproto::AtomEnum::ATOM),
+        )
+    }
+
+    pub unsafe fn convert_selection(&self, window: xproto::Window, time: xproto::Timestamp) {
+        let atoms = self.xconn.atoms();
+        self.xconn
+            .xcb_connection()
+            .convert_selection(
+                window,
+                atoms[XdndSelection],
+                atoms[TextUriList],
+                atoms[XdndSelection],
+                time,
+            )
+            .expect_then_ignore_error("Failed to send XdndSelection event")
+    }
+
+    pub unsafe fn read_data(
+        &self,
+        window: xproto::Window,
+    ) -> Result<Vec<c_uchar>, util::GetPropertyError> {
+        let atoms = self.xconn.atoms();
+        self.xconn.get_property(window, atoms[XdndSelection], atoms[TextUriList])
+    }
+
+    pub fn parse_data(&self, data: &mut [c_uchar]) -> Result<Vec<PathBuf>, DndDataParseError> {
+        if !data.is_empty() {
+            let mut path_list = Vec::new();
+            let decoded = percent_decode(data).decode_utf8()?.into_owned();
+            for uri in decoded.split("\r\n").filter(|u| !u.is_empty()) {
+                // The format is specified as protocol://host/path
+                // However, it's typically simply protocol:///path
+                let path_str = if uri.starts_with("file://") {
+                    let path_str = uri.replace("file://", "");
+                    if !path_str.starts_with('/') {
+                        // A hostname is specified
+                        // Supporting this case is beyond the scope of my mental health
+                        return Err(DndDataParseError::HostnameSpecified(path_str));
+                    }
+                    path_str
+                } else {
+                    // Only the file protocol is supported
+                    return Err(DndDataParseError::UnexpectedProtocol(uri.to_owned()));
+                };
+
+                let path = Path::new(&path_str).canonicalize()?;
+                path_list.push(path);
+            }
+            Ok(path_list)
+        } else {
+            Err(DndDataParseError::EmptyData)
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/event_processor.rs b/vendor/winit/src/platform_impl/linux/x11/event_processor.rs
new file mode 100644
index 00000000..79f5c114
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/event_processor.rs
@@ -0,0 +1,1883 @@
+use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, VecDeque};
+use std::os::raw::{c_char, c_int, c_long, c_ulong};
+use std::slice;
+use std::sync::{Arc, Mutex};
+
+use x11_dl::xinput2::{
+    self, XIDeviceEvent, XIEnterEvent, XIFocusInEvent, XIFocusOutEvent, XIHierarchyEvent,
+    XILeaveEvent, XIModifierState, XIRawEvent,
+};
+use x11_dl::xlib::{
+    self, Display as XDisplay, Window as XWindow, XAnyEvent, XClientMessageEvent, XConfigureEvent,
+    XDestroyWindowEvent, XEvent, XExposeEvent, XKeyEvent, XMapEvent, XPropertyEvent,
+    XReparentEvent, XSelectionEvent, XVisibilityEvent, XkbAnyEvent, XkbStateRec,
+};
+use x11rb::protocol::xinput;
+use x11rb::protocol::xkb::ID as XkbId;
+use x11rb::protocol::xproto::{self, ConnectionExt as _, ModMask};
+use x11rb::x11_utils::{ExtensionInformation, Serialize};
+use xkbcommon_dl::xkb_mod_mask_t;
+
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::event::{
+    DeviceEvent, ElementState, Event, Ime, InnerSizeWriter, MouseButton, MouseScrollDelta,
+    RawKeyEvent, Touch, TouchPhase, WindowEvent,
+};
+use crate::event_loop::ActiveEventLoop as RootAEL;
+use crate::keyboard::ModifiersState;
+use crate::platform_impl::common::xkb::{self, XkbState};
+use crate::platform_impl::platform::common::xkb::Context;
+use crate::platform_impl::platform::x11::ime::{ImeEvent, ImeEventReceiver, ImeRequest};
+use crate::platform_impl::platform::x11::ActiveEventLoop;
+use crate::platform_impl::platform::ActiveEventLoop as PlatformActiveEventLoop;
+use crate::platform_impl::x11::atoms::*;
+use crate::platform_impl::x11::util::cookie::GenericEventCookie;
+use crate::platform_impl::x11::{
+    mkdid, mkwid, util, CookieResultExt, Device, DeviceId, DeviceInfo, Dnd, DndState, ImeReceiver,
+    ScrollOrientation, UnownedWindow, WindowId,
+};
+
+/// The maximum amount of X modifiers to replay.
+pub const MAX_MOD_REPLAY_LEN: usize = 32;
+
+/// The X11 documentation states: "Keycodes lie in the inclusive range `[8, 255]`".
+const KEYCODE_OFFSET: u8 = 8;
+
+pub struct EventProcessor {
+    pub dnd: Dnd,
+    pub ime_receiver: ImeReceiver,
+    pub ime_event_receiver: ImeEventReceiver,
+    pub randr_event_offset: u8,
+    pub devices: RefCell<HashMap<DeviceId, Device>>,
+    pub xi2ext: ExtensionInformation,
+    pub xkbext: ExtensionInformation,
+    pub target: RootAEL,
+    pub xkb_context: Context,
+    // Number of touch events currently in progress
+    pub num_touch: u32,
+    // This is the last pressed key that is repeatable (if it hasn't been
+    // released).
+    //
+    // Used to detect key repeats.
+    pub held_key_press: Option<u32>,
+    pub first_touch: Option<u64>,
+    // Currently focused window belonging to this process
+    pub active_window: Option<xproto::Window>,
+    /// Latest modifiers we've sent for the user to trigger change in event.
+    pub modifiers: Cell<ModifiersState>,
+    // Track modifiers based on keycodes. NOTE: that serials generally don't work for tracking
+    // since they are not unique and could be duplicated in case of sequence of key events is
+    // delivered at near the same time.
+    pub xfiltered_modifiers: VecDeque<u8>,
+    pub xmodmap: util::ModifierKeymap,
+    pub is_composing: bool,
+}
+
+impl EventProcessor {
+    pub fn process_event<T: 'static, F>(&mut self, xev: &mut XEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        self.process_xevent(xev, &mut callback);
+
+        let window_target = Self::window_target_mut(&mut self.target);
+
+        // Handle IME requests.
+        while let Ok(request) = self.ime_receiver.try_recv() {
+            let ime = match window_target.ime.as_mut() {
+                Some(ime) => ime,
+                None => continue,
+            };
+            let ime = ime.get_mut();
+            match request {
+                ImeRequest::Position(window_id, x, y) => {
+                    ime.send_xim_spot(window_id, x, y);
+                },
+                ImeRequest::Allow(window_id, allowed) => {
+                    ime.set_ime_allowed(window_id, allowed);
+                },
+            }
+        }
+
+        // Drain IME events.
+        while let Ok((window, event)) = self.ime_event_receiver.try_recv() {
+            let window_id = mkwid(window as xproto::Window);
+            let event = match event {
+                ImeEvent::Enabled => WindowEvent::Ime(Ime::Enabled),
+                ImeEvent::Start => {
+                    self.is_composing = true;
+                    WindowEvent::Ime(Ime::Preedit("".to_owned(), None))
+                },
+                ImeEvent::Update(text, position) if self.is_composing => {
+                    WindowEvent::Ime(Ime::Preedit(text, Some((position, position))))
+                },
+                ImeEvent::End => {
+                    self.is_composing = false;
+                    // Issue empty preedit on `Done`.
+                    WindowEvent::Ime(Ime::Preedit(String::new(), None))
+                },
+                ImeEvent::Disabled => {
+                    self.is_composing = false;
+                    WindowEvent::Ime(Ime::Disabled)
+                },
+                _ => continue,
+            };
+
+            callback(&self.target, Event::WindowEvent { window_id, event });
+        }
+    }
+
+    /// XFilterEvent tells us when an event has been discarded by the input method.
+    /// Specifically, this involves all of the KeyPress events in compose/pre-edit sequences,
+    /// along with an extra copy of the KeyRelease events. This also prevents backspace and
+    /// arrow keys from being detected twice.
+    #[must_use]
+    fn filter_event(&mut self, xev: &mut XEvent) -> bool {
+        let wt = Self::window_target(&self.target);
+        unsafe {
+            (wt.xconn.xlib.XFilterEvent)(xev, {
+                let xev: &XAnyEvent = xev.as_ref();
+                xev.window
+            }) == xlib::True
+        }
+    }
+
+    fn process_xevent<T: 'static, F>(&mut self, xev: &mut XEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let event_type = xev.get_type();
+
+        // If we have IME disabled, don't try to `filter_event`, since only IME can consume them
+        // and forward back. This is not desired for e.g. games since some IMEs may delay the input
+        // and game can toggle IME back when e.g. typing into some field where latency won't really
+        // matter.
+        let filtered = if event_type == xlib::KeyPress || event_type == xlib::KeyRelease {
+            let wt = Self::window_target(&self.target);
+            let ime = wt.ime.as_ref();
+            let window = self.active_window.map(|window| window as XWindow);
+            let forward_to_ime = ime
+                .and_then(|ime| window.map(|window| ime.borrow().is_ime_allowed(window)))
+                .unwrap_or(false);
+
+            let filtered = forward_to_ime && self.filter_event(xev);
+            if filtered {
+                let xev: &XKeyEvent = xev.as_ref();
+                if self.xmodmap.is_modifier(xev.keycode as u8) {
+                    // Don't grow the buffer past the `MAX_MOD_REPLAY_LEN`. This could happen
+                    // when the modifiers are consumed entirely.
+                    if self.xfiltered_modifiers.len() == MAX_MOD_REPLAY_LEN {
+                        self.xfiltered_modifiers.pop_back();
+                    }
+                    self.xfiltered_modifiers.push_front(xev.keycode as u8);
+                }
+            }
+
+            filtered
+        } else {
+            self.filter_event(xev)
+        };
+
+        // Don't process event if it was filtered.
+        if filtered {
+            return;
+        }
+
+        match event_type {
+            xlib::ClientMessage => self.client_message(xev.as_ref(), &mut callback),
+            xlib::SelectionNotify => self.selection_notify(xev.as_ref(), &mut callback),
+            xlib::ConfigureNotify => self.configure_notify(xev.as_ref(), &mut callback),
+            xlib::ReparentNotify => self.reparent_notify(xev.as_ref()),
+            xlib::MapNotify => self.map_notify(xev.as_ref(), &mut callback),
+            xlib::DestroyNotify => self.destroy_notify(xev.as_ref(), &mut callback),
+            xlib::PropertyNotify => self.property_notify(xev.as_ref(), &mut callback),
+            xlib::VisibilityNotify => self.visibility_notify(xev.as_ref(), &mut callback),
+            xlib::Expose => self.expose(xev.as_ref(), &mut callback),
+            // Note that in compose/pre-edit sequences, we'll always receive KeyRelease events.
+            ty @ xlib::KeyPress | ty @ xlib::KeyRelease => {
+                let state = if ty == xlib::KeyPress {
+                    ElementState::Pressed
+                } else {
+                    ElementState::Released
+                };
+
+                self.xinput_key_input(xev.as_mut(), state, &mut callback);
+            },
+            xlib::GenericEvent => {
+                let wt = Self::window_target(&self.target);
+                let xev: GenericEventCookie =
+                    match GenericEventCookie::from_event(wt.xconn.clone(), *xev) {
+                        Some(xev) if xev.extension() == self.xi2ext.major_opcode => xev,
+                        _ => return,
+                    };
+
+                let evtype = xev.evtype();
+
+                match evtype {
+                    ty @ xinput2::XI_ButtonPress | ty @ xinput2::XI_ButtonRelease => {
+                        let state = if ty == xinput2::XI_ButtonPress {
+                            ElementState::Pressed
+                        } else {
+                            ElementState::Released
+                        };
+
+                        let xev: &XIDeviceEvent = unsafe { xev.as_event() };
+                        self.update_mods_from_xinput2_event(
+                            &xev.mods,
+                            &xev.group,
+                            false,
+                            &mut callback,
+                        );
+                        self.xinput2_button_input(xev, state, &mut callback);
+                    },
+                    xinput2::XI_Motion => {
+                        let xev: &XIDeviceEvent = unsafe { xev.as_event() };
+                        self.update_mods_from_xinput2_event(
+                            &xev.mods,
+                            &xev.group,
+                            false,
+                            &mut callback,
+                        );
+                        self.xinput2_mouse_motion(xev, &mut callback);
+                    },
+                    xinput2::XI_Enter => {
+                        let xev: &XIEnterEvent = unsafe { xev.as_event() };
+                        self.xinput2_mouse_enter(xev, &mut callback);
+                    },
+                    xinput2::XI_Leave => {
+                        let xev: &XILeaveEvent = unsafe { xev.as_event() };
+                        self.update_mods_from_xinput2_event(
+                            &xev.mods,
+                            &xev.group,
+                            false,
+                            &mut callback,
+                        );
+                        self.xinput2_mouse_left(xev, &mut callback);
+                    },
+                    xinput2::XI_FocusIn => {
+                        let xev: &XIFocusInEvent = unsafe { xev.as_event() };
+                        self.xinput2_focused(xev, &mut callback);
+                    },
+                    xinput2::XI_FocusOut => {
+                        let xev: &XIFocusOutEvent = unsafe { xev.as_event() };
+                        self.xinput2_unfocused(xev, &mut callback);
+                    },
+                    xinput2::XI_TouchBegin | xinput2::XI_TouchUpdate | xinput2::XI_TouchEnd => {
+                        let phase = match evtype {
+                            xinput2::XI_TouchBegin => TouchPhase::Started,
+                            xinput2::XI_TouchUpdate => TouchPhase::Moved,
+                            xinput2::XI_TouchEnd => TouchPhase::Ended,
+                            _ => unreachable!(),
+                        };
+
+                        let xev: &XIDeviceEvent = unsafe { xev.as_event() };
+                        self.xinput2_touch(xev, phase, &mut callback);
+                    },
+                    xinput2::XI_RawButtonPress | xinput2::XI_RawButtonRelease => {
+                        let state = match evtype {
+                            xinput2::XI_RawButtonPress => ElementState::Pressed,
+                            xinput2::XI_RawButtonRelease => ElementState::Released,
+                            _ => unreachable!(),
+                        };
+
+                        let xev: &XIRawEvent = unsafe { xev.as_event() };
+                        self.xinput2_raw_button_input(xev, state, &mut callback);
+                    },
+                    xinput2::XI_RawMotion => {
+                        let xev: &XIRawEvent = unsafe { xev.as_event() };
+                        self.xinput2_raw_mouse_motion(xev, &mut callback);
+                    },
+                    xinput2::XI_RawKeyPress | xinput2::XI_RawKeyRelease => {
+                        let state = match evtype {
+                            xinput2::XI_RawKeyPress => ElementState::Pressed,
+                            xinput2::XI_RawKeyRelease => ElementState::Released,
+                            _ => unreachable!(),
+                        };
+
+                        let xev: &xinput2::XIRawEvent = unsafe { xev.as_event() };
+                        self.xinput2_raw_key_input(xev, state, &mut callback);
+                    },
+
+                    xinput2::XI_HierarchyChanged => {
+                        let xev: &XIHierarchyEvent = unsafe { xev.as_event() };
+                        self.xinput2_hierarchy_changed(xev, &mut callback);
+                    },
+                    _ => {},
+                }
+            },
+            _ => {
+                if event_type == self.xkbext.first_event as _ {
+                    let xev: &XkbAnyEvent = unsafe { &*(xev as *const _ as *const XkbAnyEvent) };
+                    self.xkb_event(xev, &mut callback);
+                }
+                if event_type == self.randr_event_offset as c_int {
+                    self.process_dpi_change(&mut callback);
+                }
+            },
+        }
+    }
+
+    pub fn poll(&self) -> bool {
+        let window_target = Self::window_target(&self.target);
+        let result = unsafe { (window_target.xconn.xlib.XPending)(window_target.xconn.display) };
+
+        result != 0
+    }
+
+    pub unsafe fn poll_one_event(&mut self, event_ptr: *mut XEvent) -> bool {
+        let window_target = Self::window_target(&self.target);
+        // This function is used to poll and remove a single event
+        // from the Xlib event queue in a non-blocking, atomic way.
+        // XCheckIfEvent is non-blocking and removes events from queue.
+        // XNextEvent can't be used because it blocks while holding the
+        // global Xlib mutex.
+        // XPeekEvent does not remove events from the queue.
+        unsafe extern "C" fn predicate(
+            _display: *mut XDisplay,
+            _event: *mut XEvent,
+            _arg: *mut c_char,
+        ) -> c_int {
+            // This predicate always returns "true" (1) to accept all events
+            1
+        }
+
+        let result = unsafe {
+            (window_target.xconn.xlib.XCheckIfEvent)(
+                window_target.xconn.display,
+                event_ptr,
+                Some(predicate),
+                std::ptr::null_mut(),
+            )
+        };
+
+        result != 0
+    }
+
+    pub fn init_device(&self, device: xinput::DeviceId) {
+        let window_target = Self::window_target(&self.target);
+        let mut devices = self.devices.borrow_mut();
+        if let Some(info) = DeviceInfo::get(&window_target.xconn, device as _) {
+            for info in info.iter() {
+                devices.insert(DeviceId(info.deviceid as _), Device::new(info));
+            }
+        }
+    }
+
+    pub fn with_window<F, Ret>(&self, window_id: xproto::Window, callback: F) -> Option<Ret>
+    where
+        F: Fn(&Arc<UnownedWindow>) -> Ret,
+    {
+        let mut deleted = false;
+        let window_id = WindowId(window_id as _);
+        let window_target = Self::window_target(&self.target);
+        let result = window_target
+            .windows
+            .borrow()
+            .get(&window_id)
+            .and_then(|window| {
+                let arc = window.upgrade();
+                deleted = arc.is_none();
+                arc
+            })
+            .map(|window| callback(&window));
+
+        if deleted {
+            // Garbage collection
+            window_target.windows.borrow_mut().remove(&window_id);
+        }
+
+        result
+    }
+
+    // NOTE: we avoid `self` to not borrow the entire `self` as not mut.
+    /// Get the platform window target.
+    pub fn window_target(window_target: &RootAEL) -> &ActiveEventLoop {
+        match &window_target.p {
+            PlatformActiveEventLoop::X(target) => target,
+            #[cfg(wayland_platform)]
+            _ => unreachable!(),
+        }
+    }
+
+    /// Get the platform window target.
+    pub fn window_target_mut(window_target: &mut RootAEL) -> &mut ActiveEventLoop {
+        match &mut window_target.p {
+            PlatformActiveEventLoop::X(target) => target,
+            #[cfg(wayland_platform)]
+            _ => unreachable!(),
+        }
+    }
+
+    fn client_message<T: 'static, F>(&mut self, xev: &XClientMessageEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        let atoms = wt.xconn.atoms();
+
+        let window = xev.window as xproto::Window;
+        let window_id = mkwid(window);
+
+        if xev.data.get_long(0) as xproto::Atom == wt.wm_delete_window {
+            let event = Event::WindowEvent { window_id, event: WindowEvent::CloseRequested };
+            callback(&self.target, event);
+            return;
+        }
+
+        if xev.data.get_long(0) as xproto::Atom == wt.net_wm_ping {
+            let client_msg = xproto::ClientMessageEvent {
+                response_type: xproto::CLIENT_MESSAGE_EVENT,
+                format: xev.format as _,
+                sequence: xev.serial as _,
+                window: wt.root,
+                type_: xev.message_type as _,
+                data: xproto::ClientMessageData::from({
+                    let [a, b, c, d, e]: [c_long; 5] = xev.data.as_longs().try_into().unwrap();
+                    [a as u32, b as u32, c as u32, d as u32, e as u32]
+                }),
+            };
+
+            wt.xconn
+                .xcb_connection()
+                .send_event(
+                    false,
+                    wt.root,
+                    xproto::EventMask::SUBSTRUCTURE_NOTIFY
+                        | xproto::EventMask::SUBSTRUCTURE_REDIRECT,
+                    client_msg.serialize(),
+                )
+                .expect_then_ignore_error("Failed to send `ClientMessage` event.");
+            return;
+        }
+
+        if xev.message_type == atoms[XdndEnter] as c_ulong {
+            let source_window = xev.data.get_long(0) as xproto::Window;
+            let flags = xev.data.get_long(1);
+            let version = flags >> 24;
+            self.dnd.version = Some(version);
+            let has_more_types = flags - (flags & (c_long::MAX - 1)) == 1;
+            if !has_more_types {
+                let type_list = vec![
+                    xev.data.get_long(2) as xproto::Atom,
+                    xev.data.get_long(3) as xproto::Atom,
+                    xev.data.get_long(4) as xproto::Atom,
+                ];
+                self.dnd.type_list = Some(type_list);
+            } else if let Ok(more_types) = unsafe { self.dnd.get_type_list(source_window) } {
+                self.dnd.type_list = Some(more_types);
+            }
+            return;
+        }
+
+        if xev.message_type == atoms[XdndPosition] as c_ulong {
+            // This event occurs every time the mouse moves while a file's being dragged
+            // over our window. We emit HoveredFile in response; while the macOS backend
+            // does that upon a drag entering, XDND doesn't have access to the actual drop
+            // data until this event. For parity with other platforms, we only emit
+            // `HoveredFile` the first time, though if winit's API is later extended to
+            // supply position updates with `HoveredFile` or another event, implementing
+            // that here would be trivial.
+
+            let source_window = xev.data.get_long(0) as xproto::Window;
+
+            // Equivalent to `(x << shift) | y`
+            // where `shift = mem::size_of::<c_short>() * 8`
+            // Note that coordinates are in "desktop space", not "window space"
+            // (in X11 parlance, they're root window coordinates)
+            // let packed_coordinates = xev.data.get_long(2);
+            // let shift = mem::size_of::<libc::c_short>() * 8;
+            // let x = packed_coordinates >> shift;
+            // let y = packed_coordinates & !(x << shift);
+
+            // By our own state flow, `version` should never be `None` at this point.
+            let version = self.dnd.version.unwrap_or(5);
+
+            // Action is specified in versions 2 and up, though we don't need it anyway.
+            // let action = xev.data.get_long(4);
+
+            let accepted = if let Some(ref type_list) = self.dnd.type_list {
+                type_list.contains(&atoms[TextUriList])
+            } else {
+                false
+            };
+
+            if !accepted {
+                unsafe {
+                    self.dnd
+                        .send_status(window, source_window, DndState::Rejected)
+                        .expect("Failed to send `XdndStatus` message.");
+                }
+                self.dnd.reset();
+                return;
+            }
+
+            self.dnd.source_window = Some(source_window);
+            if self.dnd.result.is_none() {
+                let time = if version >= 1 {
+                    xev.data.get_long(3) as xproto::Timestamp
+                } else {
+                    // In version 0, time isn't specified
+                    x11rb::CURRENT_TIME
+                };
+
+                // Log this timestamp.
+                wt.xconn.set_timestamp(time);
+
+                // This results in the `SelectionNotify` event below
+                unsafe {
+                    self.dnd.convert_selection(window, time);
+                }
+            }
+
+            unsafe {
+                self.dnd
+                    .send_status(window, source_window, DndState::Accepted)
+                    .expect("Failed to send `XdndStatus` message.");
+            }
+            return;
+        }
+
+        if xev.message_type == atoms[XdndDrop] as c_ulong {
+            let (source_window, state) = if let Some(source_window) = self.dnd.source_window {
+                if let Some(Ok(ref path_list)) = self.dnd.result {
+                    for path in path_list {
+                        let event = Event::WindowEvent {
+                            window_id,
+                            event: WindowEvent::DroppedFile(path.clone()),
+                        };
+                        callback(&self.target, event);
+                    }
+                }
+                (source_window, DndState::Accepted)
+            } else {
+                // `source_window` won't be part of our DND state if we already rejected the drop in
+                // our `XdndPosition` handler.
+                let source_window = xev.data.get_long(0) as xproto::Window;
+                (source_window, DndState::Rejected)
+            };
+
+            unsafe {
+                self.dnd
+                    .send_finished(window, source_window, state)
+                    .expect("Failed to send `XdndFinished` message.");
+            }
+
+            self.dnd.reset();
+            return;
+        }
+
+        if xev.message_type == atoms[XdndLeave] as c_ulong {
+            self.dnd.reset();
+            let event = Event::WindowEvent { window_id, event: WindowEvent::HoveredFileCancelled };
+            callback(&self.target, event);
+        }
+    }
+
+    fn selection_notify<T: 'static, F>(&mut self, xev: &XSelectionEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        let atoms = wt.xconn.atoms();
+
+        let window = xev.requestor as xproto::Window;
+        let window_id = mkwid(window);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        if xev.property != atoms[XdndSelection] as c_ulong {
+            return;
+        }
+
+        // This is where we receive data from drag and drop
+        self.dnd.result = None;
+        if let Ok(mut data) = unsafe { self.dnd.read_data(window) } {
+            let parse_result = self.dnd.parse_data(&mut data);
+            if let Ok(ref path_list) = parse_result {
+                for path in path_list {
+                    let event = Event::WindowEvent {
+                        window_id,
+                        event: WindowEvent::HoveredFile(path.clone()),
+                    };
+                    callback(&self.target, event);
+                }
+            }
+            self.dnd.result = Some(parse_result);
+        }
+    }
+
+    fn configure_notify<T: 'static, F>(&self, xev: &XConfigureEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        let xwindow = xev.window as xproto::Window;
+        let window_id = mkwid(xwindow);
+
+        let window = match self.with_window(xwindow, Arc::clone) {
+            Some(window) => window,
+            None => return,
+        };
+
+        // So apparently...
+        // `XSendEvent` (synthetic `ConfigureNotify`) -> position relative to root
+        // `XConfigureNotify` (real `ConfigureNotify`) -> position relative to parent
+        // https://tronche.com/gui/x/icccm/sec-4.html#s-4.1.5
+        // We don't want to send `Moved` when this is false, since then every `Resized`
+        // (whether the window moved or not) is accompanied by an extraneous `Moved` event
+        // that has a position relative to the parent window.
+        let is_synthetic = xev.send_event == xlib::True;
+
+        // These are both in physical space.
+        let new_inner_size = (xev.width as u32, xev.height as u32);
+        let new_inner_position = (xev.x, xev.y);
+
+        let (mut resized, moved) = {
+            let mut shared_state_lock = window.shared_state_lock();
+
+            let resized = util::maybe_change(&mut shared_state_lock.size, new_inner_size);
+            let moved = if is_synthetic {
+                util::maybe_change(&mut shared_state_lock.inner_position, new_inner_position)
+            } else {
+                // Detect when frame extents change.
+                // Since this isn't synthetic, as per the notes above, this position is relative to
+                // the parent window.
+                let rel_parent = new_inner_position;
+                if util::maybe_change(&mut shared_state_lock.inner_position_rel_parent, rel_parent)
+                {
+                    // This ensures we process the next `Moved`.
+                    shared_state_lock.inner_position = None;
+                    // Extra insurance against stale frame extents.
+                    shared_state_lock.frame_extents = None;
+                }
+                false
+            };
+            (resized, moved)
+        };
+
+        let position = window.shared_state_lock().position;
+
+        let new_outer_position = if let (Some(position), false) = (position, moved) {
+            position
+        } else {
+            let mut shared_state_lock = window.shared_state_lock();
+
+            // We need to convert client area position to window position.
+            let frame_extents =
+                shared_state_lock.frame_extents.as_ref().cloned().unwrap_or_else(|| {
+                    let frame_extents = wt.xconn.get_frame_extents_heuristic(xwindow, wt.root);
+                    shared_state_lock.frame_extents = Some(frame_extents.clone());
+                    frame_extents
+                });
+            let outer =
+                frame_extents.inner_pos_to_outer(new_inner_position.0, new_inner_position.1);
+            shared_state_lock.position = Some(outer);
+
+            // Unlock shared state to prevent deadlock in callback below
+            drop(shared_state_lock);
+
+            if moved {
+                callback(&self.target, Event::WindowEvent {
+                    window_id,
+                    event: WindowEvent::Moved(outer.into()),
+                });
+            }
+            outer
+        };
+
+        if is_synthetic {
+            let mut shared_state_lock = window.shared_state_lock();
+            // If we don't use the existing adjusted value when available, then the user can screw
+            // up the resizing by dragging across monitors *without* dropping the
+            // window.
+            let (width, height) =
+                shared_state_lock.dpi_adjusted.unwrap_or((xev.width as u32, xev.height as u32));
+
+            let last_scale_factor = shared_state_lock.last_monitor.scale_factor;
+            let new_scale_factor = {
+                let window_rect = util::AaRect::new(new_outer_position, new_inner_size);
+                let monitor = wt
+                    .xconn
+                    .get_monitor_for_window(Some(window_rect))
+                    .expect("Failed to find monitor for window");
+
+                if monitor.is_dummy() {
+                    // Avoid updating monitor using a dummy monitor handle
+                    last_scale_factor
+                } else {
+                    shared_state_lock.last_monitor = monitor.clone();
+                    monitor.scale_factor
+                }
+            };
+            if last_scale_factor != new_scale_factor {
+                let (new_width, new_height) = window.adjust_for_dpi(
+                    last_scale_factor,
+                    new_scale_factor,
+                    width,
+                    height,
+                    &shared_state_lock,
+                );
+
+                let old_inner_size = PhysicalSize::new(width, height);
+                let new_inner_size = PhysicalSize::new(new_width, new_height);
+
+                // Unlock shared state to prevent deadlock in callback below
+                drop(shared_state_lock);
+
+                let inner_size = Arc::new(Mutex::new(new_inner_size));
+                callback(&self.target, Event::WindowEvent {
+                    window_id,
+                    event: WindowEvent::ScaleFactorChanged {
+                        scale_factor: new_scale_factor,
+                        inner_size_writer: InnerSizeWriter::new(Arc::downgrade(&inner_size)),
+                    },
+                });
+
+                let new_inner_size = *inner_size.lock().unwrap();
+                drop(inner_size);
+
+                if new_inner_size != old_inner_size {
+                    window.request_inner_size_physical(new_inner_size.width, new_inner_size.height);
+                    window.shared_state_lock().dpi_adjusted = Some(new_inner_size.into());
+                    // if the DPI factor changed, force a resize event to ensure the logical
+                    // size is computed with the right DPI factor
+                    resized = true;
+                }
+            }
+        }
+
+        // NOTE: Ensure that the lock is dropped before handling the resized and
+        // sending the event back to user.
+        let hittest = {
+            let mut shared_state_lock = window.shared_state_lock();
+            let hittest = shared_state_lock.cursor_hittest;
+
+            // This is a hack to ensure that the DPI adjusted resize is actually
+            // applied on all WMs. KWin doesn't need this, but Xfwm does. The hack
+            // should not be run on other WMs, since tiling WMs constrain the window
+            // size, making the resize fail. This would cause an endless stream of
+            // XResizeWindow requests, making Xorg, the winit client, and the WM
+            // consume 100% of CPU.
+            if let Some(adjusted_size) = shared_state_lock.dpi_adjusted {
+                if new_inner_size == adjusted_size || !util::wm_name_is_one_of(&["Xfwm4"]) {
+                    // When this finally happens, the event will not be synthetic.
+                    shared_state_lock.dpi_adjusted = None;
+                } else {
+                    // Unlock shared state to prevent deadlock in callback below
+                    drop(shared_state_lock);
+                    window.request_inner_size_physical(adjusted_size.0, adjusted_size.1);
+                }
+            }
+
+            hittest
+        };
+
+        // Reload hittest.
+        if hittest.unwrap_or(false) {
+            let _ = window.set_cursor_hittest(true);
+        }
+
+        if resized {
+            callback(&self.target, Event::WindowEvent {
+                window_id,
+                event: WindowEvent::Resized(new_inner_size.into()),
+            });
+        }
+    }
+
+    /// This is generally a reliable way to detect when the window manager's been
+    /// replaced, though this event is only fired by reparenting window managers
+    /// (which is almost all of them). Failing to correctly update WM info doesn't
+    /// really have much impact, since on the WMs affected (xmonad, dwm, etc.) the only
+    /// effect is that we waste some time trying to query unsupported properties.
+    fn reparent_notify(&self, xev: &XReparentEvent) {
+        let wt = Self::window_target(&self.target);
+
+        wt.xconn.update_cached_wm_info(wt.root);
+
+        self.with_window(xev.window as xproto::Window, |window| {
+            window.invalidate_cached_frame_extents();
+        });
+    }
+
+    fn map_notify<T: 'static, F>(&self, xev: &XMapEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let window = xev.window as xproto::Window;
+        let window_id = mkwid(window);
+
+        // NOTE: Re-issue the focus state when mapping the window.
+        //
+        // The purpose of it is to deliver initial focused state of the newly created
+        // window, given that we can't rely on `CreateNotify`, due to it being not
+        // sent.
+        let focus = self.with_window(window, |window| window.has_focus()).unwrap_or_default();
+        let event = Event::WindowEvent { window_id, event: WindowEvent::Focused(focus) };
+
+        callback(&self.target, event);
+    }
+
+    fn destroy_notify<T: 'static, F>(&self, xev: &XDestroyWindowEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        let window = xev.window as xproto::Window;
+        let window_id = mkwid(window);
+
+        // In the event that the window's been destroyed without being dropped first, we
+        // cleanup again here.
+        wt.windows.borrow_mut().remove(&WindowId(window as _));
+
+        // Since all XIM stuff needs to happen from the same thread, we destroy the input
+        // context here instead of when dropping the window.
+        if let Some(ime) = wt.ime.as_ref() {
+            ime.borrow_mut()
+                .remove_context(window as XWindow)
+                .expect("Failed to destroy input context");
+        }
+
+        callback(&self.target, Event::WindowEvent { window_id, event: WindowEvent::Destroyed });
+    }
+
+    fn property_notify<T: 'static, F>(&mut self, xev: &XPropertyEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        let atoms = wt.x_connection().atoms();
+        let atom = xev.atom as xproto::Atom;
+
+        if atom == xproto::Atom::from(xproto::AtomEnum::RESOURCE_MANAGER)
+            || atom == atoms[_XSETTINGS_SETTINGS]
+        {
+            self.process_dpi_change(&mut callback);
+        }
+    }
+
+    fn visibility_notify<T: 'static, F>(&self, xev: &XVisibilityEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let xwindow = xev.window as xproto::Window;
+
+        let event = Event::WindowEvent {
+            window_id: mkwid(xwindow),
+            event: WindowEvent::Occluded(xev.state == xlib::VisibilityFullyObscured),
+        };
+        callback(&self.target, event);
+
+        self.with_window(xwindow, |window| {
+            window.visibility_notify();
+        });
+    }
+
+    fn expose<T: 'static, F>(&self, xev: &XExposeEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        // Multiple Expose events may be received for subareas of a window.
+        // We issue `RedrawRequested` only for the last event of such a series.
+        if xev.count == 0 {
+            let window = xev.window as xproto::Window;
+            let window_id = mkwid(window);
+
+            let event = Event::WindowEvent { window_id, event: WindowEvent::RedrawRequested };
+
+            callback(&self.target, event);
+        }
+    }
+
+    fn xinput_key_input<T: 'static, F>(
+        &mut self,
+        xev: &mut XKeyEvent,
+        state: ElementState,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        let window = match self.active_window {
+            Some(window) => window,
+            None => return,
+        };
+
+        let window_id = mkwid(window);
+        let device_id = mkdid(util::VIRTUAL_CORE_KEYBOARD);
+
+        let keycode = xev.keycode as _;
+
+        // Update state to track key repeats and determine whether this key was a repeat.
+        //
+        // Note, when a key is held before focusing on this window the first
+        // (non-synthetic) event will not be flagged as a repeat (also note that the
+        // synthetic press event that is generated before this when the window gains focus
+        // will also not be flagged as a repeat).
+        //
+        // Only keys that can repeat should change the held_key_press state since a
+        // continuously held repeatable key may continue repeating after the press of a
+        // non-repeatable key.
+        let key_repeats =
+            self.xkb_context.keymap_mut().map(|k| k.key_repeats(keycode)).unwrap_or(false);
+        let repeat = if key_repeats {
+            let is_latest_held = self.held_key_press == Some(keycode);
+
+            if state == ElementState::Pressed {
+                self.held_key_press = Some(keycode);
+                is_latest_held
+            } else {
+                // Check that the released key is the latest repeatable key that has been
+                // pressed, since repeats will continue for the latest key press if a
+                // different previously pressed key is released.
+                if is_latest_held {
+                    self.held_key_press = None;
+                }
+                false
+            }
+        } else {
+            false
+        };
+
+        // NOTE: When the modifier was captured by the XFilterEvents the modifiers for the modifier
+        // itself are out of sync due to XkbState being delivered before XKeyEvent, since it's
+        // being replayed by the XIM, thus we should replay ourselves.
+        let replay = if let Some(position) =
+            self.xfiltered_modifiers.iter().rev().position(|&s| s == xev.keycode as u8)
+        {
+            // We don't have to replay modifiers pressed before the current event if some events
+            // were not forwarded to us, since their state is irrelevant.
+            self.xfiltered_modifiers.resize(self.xfiltered_modifiers.len() - 1 - position, 0);
+            true
+        } else {
+            false
+        };
+
+        // Always update the modifiers when we're not replaying.
+        if !replay {
+            self.update_mods_from_core_event(window_id, xev.state as u16, &mut callback);
+        }
+
+        if keycode != 0 && !self.is_composing {
+            // Don't alter the modifiers state from replaying.
+            if replay {
+                self.send_synthic_modifier_from_core(window_id, xev.state as u16, &mut callback);
+            }
+
+            if let Some(mut key_processor) = self.xkb_context.key_context() {
+                let event = key_processor.process_key_event(keycode, state, repeat);
+                let event = Event::WindowEvent {
+                    window_id,
+                    event: WindowEvent::KeyboardInput { device_id, event, is_synthetic: false },
+                };
+                callback(&self.target, event);
+            }
+
+            // Restore the client's modifiers state after replay.
+            if replay {
+                self.send_modifiers(window_id, self.modifiers.get(), true, &mut callback);
+            }
+
+            return;
+        }
+
+        let wt = Self::window_target(&self.target);
+
+        if let Some(ic) =
+            wt.ime.as_ref().and_then(|ime| ime.borrow().get_context(window as XWindow))
+        {
+            let written = wt.xconn.lookup_utf8(ic, xev);
+            if !written.is_empty() {
+                let event = Event::WindowEvent {
+                    window_id,
+                    event: WindowEvent::Ime(Ime::Preedit(String::new(), None)),
+                };
+                callback(&self.target, event);
+
+                let event =
+                    Event::WindowEvent { window_id, event: WindowEvent::Ime(Ime::Commit(written)) };
+
+                self.is_composing = false;
+                callback(&self.target, event);
+            }
+        }
+    }
+
+    fn send_synthic_modifier_from_core<T: 'static, F>(
+        &mut self,
+        window_id: crate::window::WindowId,
+        state: u16,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let keymap = match self.xkb_context.keymap_mut() {
+            Some(keymap) => keymap,
+            None => return,
+        };
+
+        let wt = Self::window_target(&self.target);
+        let xcb = wt.xconn.xcb_connection().get_raw_xcb_connection();
+
+        // Use synthetic state since we're replaying the modifier. The user modifier state
+        // will be restored later.
+        let mut xkb_state = match XkbState::new_x11(xcb, keymap) {
+            Some(xkb_state) => xkb_state,
+            None => return,
+        };
+
+        let mask = self.xkb_mod_mask_from_core(state);
+        xkb_state.update_modifiers(mask, 0, 0, 0, 0, Self::core_keyboard_group(state));
+        let mods: ModifiersState = xkb_state.modifiers().into();
+
+        let event =
+            Event::WindowEvent { window_id, event: WindowEvent::ModifiersChanged(mods.into()) };
+
+        callback(&self.target, event);
+    }
+
+    fn xinput2_button_input<T: 'static, F>(
+        &self,
+        event: &XIDeviceEvent,
+        state: ElementState,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        let window_id = mkwid(event.event as xproto::Window);
+        let device_id = mkdid(event.deviceid as xinput::DeviceId);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(event.time as xproto::Timestamp);
+
+        // Deliver multi-touch events instead of emulated mouse events.
+        if (event.flags & xinput2::XIPointerEmulated) != 0 {
+            return;
+        }
+
+        let event = match event.detail as u32 {
+            xlib::Button1 => {
+                WindowEvent::MouseInput { device_id, state, button: MouseButton::Left }
+            },
+            xlib::Button2 => {
+                WindowEvent::MouseInput { device_id, state, button: MouseButton::Middle }
+            },
+
+            xlib::Button3 => {
+                WindowEvent::MouseInput { device_id, state, button: MouseButton::Right }
+            },
+
+            // Suppress emulated scroll wheel clicks, since we handle the real motion events for
+            // those. In practice, even clicky scroll wheels appear to be reported by
+            // evdev (and XInput2 in turn) as axis motion, so we don't otherwise
+            // special-case these button presses.
+            4..=7 => WindowEvent::MouseWheel {
+                device_id,
+                delta: match event.detail {
+                    4 => MouseScrollDelta::LineDelta(0.0, 1.0),
+                    5 => MouseScrollDelta::LineDelta(0.0, -1.0),
+                    6 => MouseScrollDelta::LineDelta(1.0, 0.0),
+                    7 => MouseScrollDelta::LineDelta(-1.0, 0.0),
+                    _ => unreachable!(),
+                },
+                phase: TouchPhase::Moved,
+            },
+            8 => WindowEvent::MouseInput { device_id, state, button: MouseButton::Back },
+
+            9 => WindowEvent::MouseInput { device_id, state, button: MouseButton::Forward },
+            x => WindowEvent::MouseInput { device_id, state, button: MouseButton::Other(x as u16) },
+        };
+
+        let event = Event::WindowEvent { window_id, event };
+        callback(&self.target, event);
+    }
+
+    fn xinput2_mouse_motion<T: 'static, F>(&self, event: &XIDeviceEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(event.time as xproto::Timestamp);
+
+        let device_id = mkdid(event.deviceid as xinput::DeviceId);
+        let window = event.event as xproto::Window;
+        let window_id = mkwid(window);
+        let new_cursor_pos = (event.event_x, event.event_y);
+
+        let cursor_moved = self.with_window(window, |window| {
+            let mut shared_state_lock = window.shared_state_lock();
+            util::maybe_change(&mut shared_state_lock.cursor_pos, new_cursor_pos)
+        });
+
+        if cursor_moved == Some(true) {
+            let position = PhysicalPosition::new(event.event_x, event.event_y);
+
+            let event = Event::WindowEvent {
+                window_id,
+                event: WindowEvent::CursorMoved { device_id, position },
+            };
+            callback(&self.target, event);
+        } else if cursor_moved.is_none() {
+            return;
+        }
+
+        // More gymnastics, for self.devices
+        let mask = unsafe {
+            slice::from_raw_parts(event.valuators.mask, event.valuators.mask_len as usize)
+        };
+        let mut devices = self.devices.borrow_mut();
+        let physical_device = match devices.get_mut(&DeviceId(event.sourceid as xinput::DeviceId)) {
+            Some(device) => device,
+            None => return,
+        };
+
+        let mut events = Vec::new();
+        let mut value = event.valuators.values;
+        for i in 0..event.valuators.mask_len * 8 {
+            if !xinput2::XIMaskIsSet(mask, i) {
+                continue;
+            }
+
+            let x = unsafe { *value };
+
+            let event = if let Some(&mut (_, ref mut info)) =
+                physical_device.scroll_axes.iter_mut().find(|&&mut (axis, _)| axis == i as _)
+            {
+                let delta = (x - info.position) / info.increment;
+                info.position = x;
+                // X11 vertical scroll coordinates are opposite to winit's
+                let delta = match info.orientation {
+                    ScrollOrientation::Horizontal => {
+                        MouseScrollDelta::LineDelta(-delta as f32, 0.0)
+                    },
+                    ScrollOrientation::Vertical => MouseScrollDelta::LineDelta(0.0, -delta as f32),
+                };
+
+                WindowEvent::MouseWheel { device_id, delta, phase: TouchPhase::Moved }
+            } else {
+                WindowEvent::AxisMotion { device_id, axis: i as u32, value: unsafe { *value } }
+            };
+
+            events.push(Event::WindowEvent { window_id, event });
+
+            value = unsafe { value.offset(1) };
+        }
+
+        for event in events {
+            callback(&self.target, event);
+        }
+    }
+
+    fn xinput2_mouse_enter<T: 'static, F>(&self, event: &XIEnterEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(event.time as xproto::Timestamp);
+
+        let window = event.event as xproto::Window;
+        let window_id = mkwid(window);
+        let device_id = mkdid(event.deviceid as xinput::DeviceId);
+
+        if let Some(all_info) = DeviceInfo::get(&wt.xconn, super::ALL_DEVICES.into()) {
+            let mut devices = self.devices.borrow_mut();
+            for device_info in all_info.iter() {
+                // The second expression is need for resetting to work correctly on i3, and
+                // presumably some other WMs. On those, `XI_Enter` doesn't include the physical
+                // device ID, so both `sourceid` and `deviceid` are the virtual device.
+                if device_info.deviceid == event.sourceid
+                    || device_info.attachment == event.sourceid
+                {
+                    let device_id = DeviceId(device_info.deviceid as _);
+                    if let Some(device) = devices.get_mut(&device_id) {
+                        device.reset_scroll_position(device_info);
+                    }
+                }
+            }
+        }
+
+        if self.window_exists(window) {
+            let position = PhysicalPosition::new(event.event_x, event.event_y);
+
+            let event =
+                Event::WindowEvent { window_id, event: WindowEvent::CursorEntered { device_id } };
+            callback(&self.target, event);
+
+            let event = Event::WindowEvent {
+                window_id,
+                event: WindowEvent::CursorMoved { device_id, position },
+            };
+            callback(&self.target, event);
+        }
+    }
+
+    fn xinput2_mouse_left<T: 'static, F>(&self, event: &XILeaveEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        let window = event.event as xproto::Window;
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(event.time as xproto::Timestamp);
+
+        // Leave, FocusIn, and FocusOut can be received by a window that's already
+        // been destroyed, which the user presumably doesn't want to deal with.
+        if self.window_exists(window) {
+            let event = Event::WindowEvent {
+                window_id: mkwid(window),
+                event: WindowEvent::CursorLeft {
+                    device_id: mkdid(event.deviceid as xinput::DeviceId),
+                },
+            };
+            callback(&self.target, event);
+        }
+    }
+
+    fn xinput2_focused<T: 'static, F>(&mut self, xev: &XIFocusInEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        let window = xev.event as xproto::Window;
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        if let Some(ime) = wt.ime.as_ref() {
+            ime.borrow_mut().focus(xev.event).expect("Failed to focus input context");
+        }
+
+        if self.active_window == Some(window) {
+            return;
+        }
+
+        self.active_window = Some(window);
+
+        wt.update_listen_device_events(true);
+
+        let window_id = mkwid(window);
+        let position = PhysicalPosition::new(xev.event_x, xev.event_y);
+
+        if let Some(window) = self.with_window(window, Arc::clone) {
+            window.shared_state_lock().has_focus = true;
+        }
+
+        let event = Event::WindowEvent { window_id, event: WindowEvent::Focused(true) };
+        callback(&self.target, event);
+
+        // Issue key press events for all pressed keys
+        Self::handle_pressed_keys(
+            &self.target,
+            window_id,
+            ElementState::Pressed,
+            &mut self.xkb_context,
+            &mut callback,
+        );
+
+        self.update_mods_from_query(window_id, &mut callback);
+
+        // The deviceid for this event is for a keyboard instead of a pointer,
+        // so we have to do a little extra work.
+        let pointer_id = self
+            .devices
+            .borrow()
+            .get(&DeviceId(xev.deviceid as xinput::DeviceId))
+            .map(|device| device.attachment)
+            .unwrap_or(2);
+
+        let event = Event::WindowEvent {
+            window_id,
+            event: WindowEvent::CursorMoved { device_id: mkdid(pointer_id as _), position },
+        };
+        callback(&self.target, event);
+    }
+
+    fn xinput2_unfocused<T: 'static, F>(&mut self, xev: &XIFocusOutEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        let window = xev.event as xproto::Window;
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        if !self.window_exists(window) {
+            return;
+        }
+
+        if let Some(ime) = wt.ime.as_ref() {
+            ime.borrow_mut().unfocus(xev.event).expect("Failed to unfocus input context");
+        }
+
+        if self.active_window.take() == Some(window) {
+            let window_id = mkwid(window);
+
+            wt.update_listen_device_events(false);
+
+            // Clear the modifiers when unfocusing the window.
+            if let Some(xkb_state) = self.xkb_context.state_mut() {
+                xkb_state.update_modifiers(0, 0, 0, 0, 0, 0);
+                let mods = xkb_state.modifiers();
+                self.send_modifiers(window_id, mods.into(), true, &mut callback);
+            }
+
+            // Issue key release events for all pressed keys
+            Self::handle_pressed_keys(
+                &self.target,
+                window_id,
+                ElementState::Released,
+                &mut self.xkb_context,
+                &mut callback,
+            );
+
+            // Clear this so detecting key repeats is consistently handled when the
+            // window regains focus.
+            self.held_key_press = None;
+
+            if let Some(window) = self.with_window(window, Arc::clone) {
+                window.shared_state_lock().has_focus = false;
+            }
+
+            let event = Event::WindowEvent { window_id, event: WindowEvent::Focused(false) };
+            callback(&self.target, event)
+        }
+    }
+
+    fn xinput2_touch<T: 'static, F>(
+        &mut self,
+        xev: &XIDeviceEvent,
+        phase: TouchPhase,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        let window = xev.event as xproto::Window;
+        if self.window_exists(window) {
+            let window_id = mkwid(window);
+            let id = xev.detail as u64;
+            let location = PhysicalPosition::new(xev.event_x, xev.event_y);
+
+            // Mouse cursor position changes when touch events are received.
+            // Only the first concurrently active touch ID moves the mouse cursor.
+            if is_first_touch(&mut self.first_touch, &mut self.num_touch, id, phase) {
+                let event = Event::WindowEvent {
+                    window_id,
+                    event: WindowEvent::CursorMoved {
+                        device_id: mkdid(util::VIRTUAL_CORE_POINTER),
+                        position: location.cast(),
+                    },
+                };
+                callback(&self.target, event);
+            }
+
+            let event = Event::WindowEvent {
+                window_id,
+                event: WindowEvent::Touch(Touch {
+                    device_id: mkdid(xev.deviceid as xinput::DeviceId),
+                    phase,
+                    location,
+                    force: None, // TODO
+                    id,
+                }),
+            };
+            callback(&self.target, event)
+        }
+    }
+
+    fn xinput2_raw_button_input<T: 'static, F>(
+        &self,
+        xev: &XIRawEvent,
+        state: ElementState,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        if xev.flags & xinput2::XIPointerEmulated == 0 {
+            let event = Event::DeviceEvent {
+                device_id: mkdid(xev.deviceid as xinput::DeviceId),
+                event: DeviceEvent::Button { state, button: xev.detail as u32 },
+            };
+            callback(&self.target, event);
+        }
+    }
+
+    fn xinput2_raw_mouse_motion<T: 'static, F>(&self, xev: &XIRawEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        let did = mkdid(xev.deviceid as xinput::DeviceId);
+
+        let mask =
+            unsafe { slice::from_raw_parts(xev.valuators.mask, xev.valuators.mask_len as usize) };
+        let mut value = xev.raw_values;
+        let mut mouse_delta = util::Delta::default();
+        let mut scroll_delta = util::Delta::default();
+        for i in 0..xev.valuators.mask_len * 8 {
+            if !xinput2::XIMaskIsSet(mask, i) {
+                continue;
+            }
+            let x = unsafe { value.read_unaligned() };
+
+            // We assume that every XInput2 device with analog axes is a pointing device emitting
+            // relative coordinates.
+            match i {
+                0 => mouse_delta.set_x(x),
+                1 => mouse_delta.set_y(x),
+                2 => scroll_delta.set_x(x as f32),
+                3 => scroll_delta.set_y(x as f32),
+                _ => {},
+            }
+
+            let event = Event::DeviceEvent {
+                device_id: did,
+                event: DeviceEvent::Motion { axis: i as u32, value: x },
+            };
+            callback(&self.target, event);
+
+            value = unsafe { value.offset(1) };
+        }
+
+        if let Some(mouse_delta) = mouse_delta.consume() {
+            let event = Event::DeviceEvent {
+                device_id: did,
+                event: DeviceEvent::MouseMotion { delta: mouse_delta },
+            };
+            callback(&self.target, event);
+        }
+
+        if let Some(scroll_delta) = scroll_delta.consume() {
+            let event = Event::DeviceEvent {
+                device_id: did,
+                event: DeviceEvent::MouseWheel {
+                    delta: MouseScrollDelta::LineDelta(scroll_delta.0, scroll_delta.1),
+                },
+            };
+            callback(&self.target, event);
+        }
+    }
+
+    fn xinput2_raw_key_input<T: 'static, F>(
+        &mut self,
+        xev: &XIRawEvent,
+        state: ElementState,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+        let device_id = mkdid(xev.sourceid as xinput::DeviceId);
+        let keycode = xev.detail as u32;
+        if keycode < KEYCODE_OFFSET as u32 {
+            return;
+        }
+        let physical_key = xkb::raw_keycode_to_physicalkey(keycode);
+
+        callback(&self.target, Event::DeviceEvent {
+            device_id,
+            event: DeviceEvent::Key(RawKeyEvent { physical_key, state }),
+        });
+    }
+
+    fn xinput2_hierarchy_changed<T: 'static, F>(&mut self, xev: &XIHierarchyEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        // Set the timestamp.
+        wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+        let infos = unsafe { slice::from_raw_parts(xev.info, xev.num_info as usize) };
+        for info in infos {
+            if 0 != info.flags & (xinput2::XISlaveAdded | xinput2::XIMasterAdded) {
+                self.init_device(info.deviceid as xinput::DeviceId);
+                callback(&self.target, Event::DeviceEvent {
+                    device_id: mkdid(info.deviceid as xinput::DeviceId),
+                    event: DeviceEvent::Added,
+                });
+            } else if 0 != info.flags & (xinput2::XISlaveRemoved | xinput2::XIMasterRemoved) {
+                callback(&self.target, Event::DeviceEvent {
+                    device_id: mkdid(info.deviceid as xinput::DeviceId),
+                    event: DeviceEvent::Removed,
+                });
+                let mut devices = self.devices.borrow_mut();
+                devices.remove(&DeviceId(info.deviceid as xinput::DeviceId));
+            }
+        }
+    }
+
+    fn xkb_event<T: 'static, F>(&mut self, xev: &XkbAnyEvent, mut callback: F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        match xev.xkb_type {
+            xlib::XkbNewKeyboardNotify => {
+                let xev = unsafe { &*(xev as *const _ as *const xlib::XkbNewKeyboardNotifyEvent) };
+
+                // Set the timestamp.
+                wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+                let keycodes_changed_flag = 0x1;
+                let geometry_changed_flag = 0x1 << 1;
+
+                let keycodes_changed = util::has_flag(xev.changed, keycodes_changed_flag);
+                let geometry_changed = util::has_flag(xev.changed, geometry_changed_flag);
+
+                if xev.device == self.xkb_context.core_keyboard_id
+                    && (keycodes_changed || geometry_changed)
+                {
+                    let xcb = wt.xconn.xcb_connection().get_raw_xcb_connection();
+                    self.xkb_context.set_keymap_from_x11(xcb);
+                    self.xmodmap.reload_from_x_connection(&wt.xconn);
+
+                    let window_id = match self.active_window.map(super::mkwid) {
+                        Some(window_id) => window_id,
+                        None => return,
+                    };
+
+                    if let Some(state) = self.xkb_context.state_mut() {
+                        let mods = state.modifiers().into();
+                        self.send_modifiers(window_id, mods, true, &mut callback);
+                    }
+                }
+            },
+            xlib::XkbMapNotify => {
+                let xcb = wt.xconn.xcb_connection().get_raw_xcb_connection();
+                self.xkb_context.set_keymap_from_x11(xcb);
+                self.xmodmap.reload_from_x_connection(&wt.xconn);
+                let window_id = match self.active_window.map(super::mkwid) {
+                    Some(window_id) => window_id,
+                    None => return,
+                };
+
+                if let Some(state) = self.xkb_context.state_mut() {
+                    let mods = state.modifiers().into();
+                    self.send_modifiers(window_id, mods, true, &mut callback);
+                }
+            },
+            xlib::XkbStateNotify => {
+                let xev = unsafe { &*(xev as *const _ as *const xlib::XkbStateNotifyEvent) };
+
+                // Set the timestamp.
+                wt.xconn.set_timestamp(xev.time as xproto::Timestamp);
+
+                if let Some(state) = self.xkb_context.state_mut() {
+                    state.update_modifiers(
+                        xev.base_mods,
+                        xev.latched_mods,
+                        xev.locked_mods,
+                        xev.base_group as u32,
+                        xev.latched_group as u32,
+                        xev.locked_group as u32,
+                    );
+
+                    let window_id = match self.active_window.map(super::mkwid) {
+                        Some(window_id) => window_id,
+                        None => return,
+                    };
+
+                    let mods = state.modifiers().into();
+                    self.send_modifiers(window_id, mods, true, &mut callback);
+                }
+            },
+            _ => {},
+        }
+    }
+
+    pub fn update_mods_from_xinput2_event<T: 'static, F>(
+        &mut self,
+        mods: &XIModifierState,
+        group: &XIModifierState,
+        force: bool,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        if let Some(state) = self.xkb_context.state_mut() {
+            state.update_modifiers(
+                mods.base as u32,
+                mods.latched as u32,
+                mods.locked as u32,
+                group.base as u32,
+                group.latched as u32,
+                group.locked as u32,
+            );
+
+            // NOTE: we use active window since generally sub windows don't have keyboard input,
+            // and winit assumes that unfocused window doesn't have modifiers.
+            let window_id = match self.active_window.map(super::mkwid) {
+                Some(window_id) => window_id,
+                None => return,
+            };
+
+            let mods = state.modifiers();
+            self.send_modifiers(window_id, mods.into(), force, &mut callback);
+        }
+    }
+
+    fn update_mods_from_query<T: 'static, F>(
+        &mut self,
+        window_id: crate::window::WindowId,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+
+        let xkb_state = match self.xkb_context.state_mut() {
+            Some(xkb_state) => xkb_state,
+            None => return,
+        };
+
+        unsafe {
+            let mut state: XkbStateRec = std::mem::zeroed();
+            if (wt.xconn.xlib.XkbGetState)(wt.xconn.display, XkbId::USE_CORE_KBD.into(), &mut state)
+                == xlib::True
+            {
+                xkb_state.update_modifiers(
+                    state.base_mods as u32,
+                    state.latched_mods as u32,
+                    state.locked_mods as u32,
+                    state.base_group as u32,
+                    state.latched_group as u32,
+                    state.locked_group as u32,
+                );
+            }
+        }
+
+        let mods = xkb_state.modifiers();
+        self.send_modifiers(window_id, mods.into(), true, &mut callback)
+    }
+
+    pub fn update_mods_from_core_event<T: 'static, F>(
+        &mut self,
+        window_id: crate::window::WindowId,
+        state: u16,
+        mut callback: F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let xkb_mask = self.xkb_mod_mask_from_core(state);
+        let xkb_state = match self.xkb_context.state_mut() {
+            Some(xkb_state) => xkb_state,
+            None => return,
+        };
+
+        // NOTE: this is inspired by Qt impl.
+        let mut depressed = xkb_state.depressed_modifiers() & xkb_mask;
+        let latched = xkb_state.latched_modifiers() & xkb_mask;
+        let locked = xkb_state.locked_modifiers() & xkb_mask;
+        // Set modifiers in depressed if they don't appear in any of the final masks.
+        depressed |= !(depressed | latched | locked) & xkb_mask;
+
+        xkb_state.update_modifiers(
+            depressed,
+            latched,
+            locked,
+            0,
+            0,
+            Self::core_keyboard_group(state),
+        );
+
+        let mods = xkb_state.modifiers();
+        self.send_modifiers(window_id, mods.into(), false, &mut callback);
+    }
+
+    // Bits 13 and 14 report the state keyboard group.
+    pub fn core_keyboard_group(state: u16) -> u32 {
+        ((state >> 13) & 3) as u32
+    }
+
+    pub fn xkb_mod_mask_from_core(&mut self, state: u16) -> xkb_mod_mask_t {
+        let mods_indices = match self.xkb_context.keymap_mut() {
+            Some(keymap) => keymap.mods_indices(),
+            None => return 0,
+        };
+
+        // Build the XKB modifiers from the regular state.
+        let mut depressed = 0u32;
+        if let Some(shift) = mods_indices.shift.filter(|_| ModMask::SHIFT.intersects(state)) {
+            depressed |= 1 << shift;
+        }
+        if let Some(caps) = mods_indices.caps.filter(|_| ModMask::LOCK.intersects(state)) {
+            depressed |= 1 << caps;
+        }
+        if let Some(ctrl) = mods_indices.ctrl.filter(|_| ModMask::CONTROL.intersects(state)) {
+            depressed |= 1 << ctrl;
+        }
+        if let Some(alt) = mods_indices.alt.filter(|_| ModMask::M1.intersects(state)) {
+            depressed |= 1 << alt;
+        }
+        if let Some(num) = mods_indices.num.filter(|_| ModMask::M2.intersects(state)) {
+            depressed |= 1 << num;
+        }
+        if let Some(mod3) = mods_indices.mod3.filter(|_| ModMask::M3.intersects(state)) {
+            depressed |= 1 << mod3;
+        }
+        if let Some(logo) = mods_indices.logo.filter(|_| ModMask::M4.intersects(state)) {
+            depressed |= 1 << logo;
+        }
+        if let Some(mod5) = mods_indices.mod5.filter(|_| ModMask::M5.intersects(state)) {
+            depressed |= 1 << mod5;
+        }
+
+        depressed
+    }
+
+    /// Send modifiers for the active window.
+    ///
+    /// The event won't be sent when the `modifiers` match the previously `sent` modifiers value,
+    /// unless `force` is passed. The `force` should be passed when the active window changes.
+    fn send_modifiers<T: 'static, F: FnMut(&RootAEL, Event<T>)>(
+        &self,
+        window_id: crate::window::WindowId,
+        modifiers: ModifiersState,
+        force: bool,
+        callback: &mut F,
+    ) {
+        // NOTE: Always update the modifiers to account for case when they've changed
+        // and forced was `true`.
+        if self.modifiers.replace(modifiers) != modifiers || force {
+            let event = Event::WindowEvent {
+                window_id,
+                event: WindowEvent::ModifiersChanged(self.modifiers.get().into()),
+            };
+            callback(&self.target, event);
+        }
+    }
+
+    fn handle_pressed_keys<T: 'static, F>(
+        target: &RootAEL,
+        window_id: crate::window::WindowId,
+        state: ElementState,
+        xkb_context: &mut Context,
+        callback: &mut F,
+    ) where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let device_id = mkdid(util::VIRTUAL_CORE_KEYBOARD);
+
+        // Update modifiers state and emit key events based on which keys are currently pressed.
+        let window_target = Self::window_target(target);
+        let xcb = window_target.xconn.xcb_connection().get_raw_xcb_connection();
+
+        let keymap = match xkb_context.keymap_mut() {
+            Some(keymap) => keymap,
+            None => return,
+        };
+
+        // Send the keys using the synthetic state to not alter the main state.
+        let mut xkb_state = match XkbState::new_x11(xcb, keymap) {
+            Some(xkb_state) => xkb_state,
+            None => return,
+        };
+        let mut key_processor = match xkb_context.key_context_with_state(&mut xkb_state) {
+            Some(key_processor) => key_processor,
+            None => return,
+        };
+
+        for keycode in
+            window_target.xconn.query_keymap().into_iter().filter(|k| *k >= KEYCODE_OFFSET)
+        {
+            let event = key_processor.process_key_event(keycode as u32, state, false);
+            let event = Event::WindowEvent {
+                window_id,
+                event: WindowEvent::KeyboardInput { device_id, event, is_synthetic: true },
+            };
+            callback(target, event);
+        }
+    }
+
+    fn process_dpi_change<T: 'static, F>(&self, callback: &mut F)
+    where
+        F: FnMut(&RootAEL, Event<T>),
+    {
+        let wt = Self::window_target(&self.target);
+        wt.xconn.reload_database().expect("failed to reload Xft database");
+
+        // In the future, it would be quite easy to emit monitor hotplug events.
+        let prev_list = {
+            let prev_list = wt.xconn.invalidate_cached_monitor_list();
+            match prev_list {
+                Some(prev_list) => prev_list,
+                None => return,
+            }
+        };
+
+        let new_list = wt.xconn.available_monitors().expect("Failed to get monitor list");
+        for new_monitor in new_list {
+            // Previous list may be empty, in case of disconnecting and
+            // reconnecting the only one monitor. We still need to emit events in
+            // this case.
+            let maybe_prev_scale_factor = prev_list
+                .iter()
+                .find(|prev_monitor| prev_monitor.name == new_monitor.name)
+                .map(|prev_monitor| prev_monitor.scale_factor);
+            if Some(new_monitor.scale_factor) != maybe_prev_scale_factor {
+                for window in wt.windows.borrow().iter().filter_map(|(_, w)| w.upgrade()) {
+                    window.refresh_dpi_for_monitor(&new_monitor, maybe_prev_scale_factor, |event| {
+                        callback(&self.target, event);
+                    })
+                }
+            }
+        }
+    }
+
+    fn window_exists(&self, window_id: xproto::Window) -> bool {
+        self.with_window(window_id, |_| ()).is_some()
+    }
+}
+
+fn is_first_touch(first: &mut Option<u64>, num: &mut u32, id: u64, phase: TouchPhase) -> bool {
+    match phase {
+        TouchPhase::Started => {
+            if *num == 0 {
+                *first = Some(id);
+            }
+            *num += 1;
+        },
+        TouchPhase::Cancelled | TouchPhase::Ended => {
+            if *first == Some(id) {
+                *first = None;
+            }
+            *num = num.saturating_sub(1);
+        },
+        _ => (),
+    }
+
+    *first == Some(id)
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/ffi.rs b/vendor/winit/src/platform_impl/linux/x11/ffi.rs
new file mode 100644
index 00000000..57bd78e9
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/ffi.rs
@@ -0,0 +1,5 @@
+pub use x11_dl::error::OpenError;
+pub use x11_dl::xcursor::*;
+pub use x11_dl::xinput2::*;
+pub use x11_dl::xlib::*;
+pub use x11_dl::xlib_xcb::*;
diff --git a/vendor/winit/src/platform_impl/linux/x11/ime/callbacks.rs b/vendor/winit/src/platform_impl/linux/x11/ime/callbacks.rs
new file mode 100644
index 00000000..fa0fa5c6
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/ime/callbacks.rs
@@ -0,0 +1,206 @@
+use std::collections::HashMap;
+use std::os::raw::c_char;
+use std::ptr;
+use std::sync::Arc;
+
+use super::{ffi, XConnection, XError};
+
+use super::context::{ImeContext, ImeContextCreationError};
+use super::inner::{close_im, ImeInner};
+use super::input_method::PotentialInputMethods;
+
+pub(crate) unsafe fn xim_set_callback(
+    xconn: &Arc<XConnection>,
+    xim: ffi::XIM,
+    field: *const c_char,
+    callback: *mut ffi::XIMCallback,
+) -> Result<(), XError> {
+    // It's advisable to wrap variadic FFI functions in our own functions, as we want to minimize
+    // access that isn't type-checked.
+    unsafe { (xconn.xlib.XSetIMValues)(xim, field, callback, ptr::null_mut::<()>()) };
+    xconn.check_errors()
+}
+
+// Set a callback for when an input method matching the current locale modifiers becomes
+// available. Note that this has nothing to do with what input methods are open or able to be
+// opened, and simply uses the modifiers that are set when the callback is set.
+// * This is called per locale modifier, not per input method opened with that locale modifier.
+// * Trying to set this for multiple locale modifiers causes problems, i.e. one of the rebuilt input
+//   contexts would always silently fail to use the input method.
+pub(crate) unsafe fn set_instantiate_callback(
+    xconn: &Arc<XConnection>,
+    client_data: ffi::XPointer,
+) -> Result<(), XError> {
+    unsafe {
+        (xconn.xlib.XRegisterIMInstantiateCallback)(
+            xconn.display,
+            ptr::null_mut(),
+            ptr::null_mut(),
+            ptr::null_mut(),
+            Some(xim_instantiate_callback),
+            client_data,
+        )
+    };
+    xconn.check_errors()
+}
+
+pub(crate) unsafe fn unset_instantiate_callback(
+    xconn: &Arc<XConnection>,
+    client_data: ffi::XPointer,
+) -> Result<(), XError> {
+    unsafe {
+        (xconn.xlib.XUnregisterIMInstantiateCallback)(
+            xconn.display,
+            ptr::null_mut(),
+            ptr::null_mut(),
+            ptr::null_mut(),
+            Some(xim_instantiate_callback),
+            client_data,
+        )
+    };
+    xconn.check_errors()
+}
+
+pub(crate) unsafe fn set_destroy_callback(
+    xconn: &Arc<XConnection>,
+    im: ffi::XIM,
+    inner: &ImeInner,
+) -> Result<(), XError> {
+    unsafe {
+        xim_set_callback(
+            xconn,
+            im,
+            ffi::XNDestroyCallback_0.as_ptr() as *const _,
+            &inner.destroy_callback as *const _ as *mut _,
+        )
+    }
+}
+
+#[derive(Debug)]
+#[allow(clippy::enum_variant_names)]
+enum ReplaceImError {
+    // Boxed to prevent large error type
+    MethodOpenFailed(#[allow(dead_code)] Box<PotentialInputMethods>),
+    ContextCreationFailed(#[allow(dead_code)] ImeContextCreationError),
+    SetDestroyCallbackFailed(#[allow(dead_code)] XError),
+}
+
+// Attempt to replace current IM (which may or may not be presently valid) with a new one. This
+// includes replacing all existing input contexts and free'ing resources as necessary. This only
+// modifies existing state if all operations succeed.
+unsafe fn replace_im(inner: *mut ImeInner) -> Result<(), ReplaceImError> {
+    let xconn = unsafe { &(*inner).xconn };
+
+    let (new_im, is_fallback) = {
+        let new_im = unsafe { (*inner).potential_input_methods.open_im(xconn, None) };
+        let is_fallback = new_im.is_fallback();
+        (
+            new_im.ok().ok_or_else(|| {
+                ReplaceImError::MethodOpenFailed(Box::new(unsafe {
+                    (*inner).potential_input_methods.clone()
+                }))
+            })?,
+            is_fallback,
+        )
+    };
+
+    // It's important to always set a destroy callback, since there's otherwise potential for us
+    // to try to use or free a resource that's already been destroyed on the server.
+    {
+        let result = unsafe { set_destroy_callback(xconn, new_im.im, &*inner) };
+        if result.is_err() {
+            let _ = unsafe { close_im(xconn, new_im.im) };
+        }
+        result
+    }
+    .map_err(ReplaceImError::SetDestroyCallbackFailed)?;
+
+    let mut new_contexts = HashMap::new();
+    for (window, old_context) in unsafe { (*inner).contexts.iter() } {
+        let spot = old_context.as_ref().map(|old_context| old_context.ic_spot);
+
+        // Check if the IME was allowed on that context.
+        let is_allowed =
+            old_context.as_ref().map(|old_context| old_context.is_allowed()).unwrap_or_default();
+
+        let new_context = {
+            let result = unsafe {
+                ImeContext::new(
+                    xconn,
+                    &new_im,
+                    *window,
+                    spot,
+                    (*inner).event_sender.clone(),
+                    is_allowed,
+                )
+            };
+            if result.is_err() {
+                let _ = unsafe { close_im(xconn, new_im.im) };
+            }
+            result.map_err(ReplaceImError::ContextCreationFailed)?
+        };
+        new_contexts.insert(*window, Some(new_context));
+    }
+
+    // If we've made it this far, everything succeeded.
+    unsafe {
+        let _ = (*inner).destroy_all_contexts_if_necessary();
+        let _ = (*inner).close_im_if_necessary();
+        (*inner).im = Some(new_im);
+        (*inner).contexts = new_contexts;
+        (*inner).is_destroyed = false;
+        (*inner).is_fallback = is_fallback;
+    }
+    Ok(())
+}
+
+pub unsafe extern "C" fn xim_instantiate_callback(
+    _display: *mut ffi::Display,
+    client_data: ffi::XPointer,
+    // This field is unsupplied.
+    _call_data: ffi::XPointer,
+) {
+    let inner: *mut ImeInner = client_data as _;
+    if !inner.is_null() {
+        let xconn = unsafe { &(*inner).xconn };
+        match unsafe { replace_im(inner) } {
+            Ok(()) => unsafe {
+                let _ = unset_instantiate_callback(xconn, client_data);
+                (*inner).is_fallback = false;
+            },
+            Err(err) => unsafe {
+                if (*inner).is_destroyed {
+                    // We have no usable input methods!
+                    panic!("Failed to reopen input method: {err:?}");
+                }
+            },
+        }
+    }
+}
+
+// This callback is triggered when the input method is closed on the server end. When this
+// happens, XCloseIM/XDestroyIC doesn't need to be called, as the resources have already been
+// free'd (attempting to do so causes our connection to freeze).
+pub unsafe extern "C" fn xim_destroy_callback(
+    _xim: ffi::XIM,
+    client_data: ffi::XPointer,
+    // This field is unsupplied.
+    _call_data: ffi::XPointer,
+) {
+    let inner: *mut ImeInner = client_data as _;
+    if !inner.is_null() {
+        unsafe { (*inner).is_destroyed = true };
+        let xconn = unsafe { &(*inner).xconn };
+        if unsafe { !(*inner).is_fallback } {
+            let _ = unsafe { set_instantiate_callback(xconn, client_data) };
+            // Attempt to open fallback input method.
+            match unsafe { replace_im(inner) } {
+                Ok(()) => unsafe { (*inner).is_fallback = true },
+                Err(err) => {
+                    // We have no usable input methods!
+                    panic!("Failed to open fallback input method: {err:?}");
+                },
+            }
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/ime/context.rs b/vendor/winit/src/platform_impl/linux/x11/ime/context.rs
new file mode 100644
index 00000000..2c6c075e
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/ime/context.rs
@@ -0,0 +1,376 @@
+use std::ffi::CStr;
+use std::os::raw::c_short;
+use std::sync::Arc;
+use std::{mem, ptr};
+
+use x11_dl::xlib::{XIMCallback, XIMPreeditCaretCallbackStruct, XIMPreeditDrawCallbackStruct};
+
+use super::{ffi, util, XConnection, XError};
+use crate::platform_impl::platform::x11::ime::input_method::{InputMethod, Style, XIMStyle};
+use crate::platform_impl::platform::x11::ime::{ImeEvent, ImeEventSender};
+
+/// IME creation error.
+#[derive(Debug)]
+pub enum ImeContextCreationError {
+    /// Got the error from Xlib.
+    XError(XError),
+
+    /// Got null pointer from Xlib but without exact reason.
+    Null,
+}
+
+/// The callback used by XIM preedit functions.
+type XIMProcNonnull = unsafe extern "C" fn(ffi::XIM, ffi::XPointer, ffi::XPointer);
+
+/// Wrapper for creating XIM callbacks.
+#[inline]
+fn create_xim_callback(client_data: ffi::XPointer, callback: XIMProcNonnull) -> ffi::XIMCallback {
+    XIMCallback { client_data, callback: Some(callback) }
+}
+
+/// The server started preedit.
+extern "C" fn preedit_start_callback(
+    _xim: ffi::XIM,
+    client_data: ffi::XPointer,
+    _call_data: ffi::XPointer,
+) -> i32 {
+    let client_data = unsafe { &mut *(client_data as *mut ImeContextClientData) };
+
+    client_data.text.clear();
+    client_data.cursor_pos = 0;
+    client_data
+        .event_sender
+        .send((client_data.window, ImeEvent::Start))
+        .expect("failed to send preedit start event");
+    -1
+}
+
+/// Done callback is used when the preedit should be hidden.
+extern "C" fn preedit_done_callback(
+    _xim: ffi::XIM,
+    client_data: ffi::XPointer,
+    _call_data: ffi::XPointer,
+) {
+    let client_data = unsafe { &mut *(client_data as *mut ImeContextClientData) };
+
+    // Drop text buffer and reset cursor position on done.
+    client_data.text = Vec::new();
+    client_data.cursor_pos = 0;
+
+    client_data
+        .event_sender
+        .send((client_data.window, ImeEvent::End))
+        .expect("failed to send preedit end event");
+}
+
+fn calc_byte_position(text: &[char], pos: usize) -> usize {
+    text.iter().take(pos).fold(0, |byte_pos, text| byte_pos + text.len_utf8())
+}
+
+/// Preedit text information to be drawn inline by the client.
+extern "C" fn preedit_draw_callback(
+    _xim: ffi::XIM,
+    client_data: ffi::XPointer,
+    call_data: ffi::XPointer,
+) {
+    let client_data = unsafe { &mut *(client_data as *mut ImeContextClientData) };
+    let call_data = unsafe { &mut *(call_data as *mut XIMPreeditDrawCallbackStruct) };
+    client_data.cursor_pos = call_data.caret as usize;
+
+    let chg_range =
+        call_data.chg_first as usize..(call_data.chg_first + call_data.chg_length) as usize;
+    if chg_range.start > client_data.text.len() || chg_range.end > client_data.text.len() {
+        tracing::warn!(
+            "invalid chg range: buffer length={}, but chg_first={} chg_length={}",
+            client_data.text.len(),
+            call_data.chg_first,
+            call_data.chg_length
+        );
+        return;
+    }
+
+    // NULL indicate text deletion
+    let mut new_chars = if call_data.text.is_null() {
+        Vec::new()
+    } else {
+        let xim_text = unsafe { &mut *(call_data.text) };
+        if xim_text.encoding_is_wchar > 0 {
+            return;
+        }
+
+        let new_text = unsafe { xim_text.string.multi_byte };
+
+        if new_text.is_null() {
+            return;
+        }
+
+        let new_text = unsafe { CStr::from_ptr(new_text) };
+
+        String::from(new_text.to_str().expect("Invalid UTF-8 String from IME")).chars().collect()
+    };
+    let mut old_text_tail = client_data.text.split_off(chg_range.end);
+    client_data.text.truncate(chg_range.start);
+    client_data.text.append(&mut new_chars);
+    client_data.text.append(&mut old_text_tail);
+    let cursor_byte_pos = calc_byte_position(&client_data.text, client_data.cursor_pos);
+
+    client_data
+        .event_sender
+        .send((
+            client_data.window,
+            ImeEvent::Update(client_data.text.iter().collect(), cursor_byte_pos),
+        ))
+        .expect("failed to send preedit update event");
+}
+
+/// Handling of cursor movements in preedit text.
+extern "C" fn preedit_caret_callback(
+    _xim: ffi::XIM,
+    client_data: ffi::XPointer,
+    call_data: ffi::XPointer,
+) {
+    let client_data = unsafe { &mut *(client_data as *mut ImeContextClientData) };
+    let call_data = unsafe { &mut *(call_data as *mut XIMPreeditCaretCallbackStruct) };
+
+    if call_data.direction == ffi::XIMCaretDirection::XIMAbsolutePosition {
+        client_data.cursor_pos = call_data.position as usize;
+        let cursor_byte_pos = calc_byte_position(&client_data.text, client_data.cursor_pos);
+
+        client_data
+            .event_sender
+            .send((
+                client_data.window,
+                ImeEvent::Update(client_data.text.iter().collect(), cursor_byte_pos),
+            ))
+            .expect("failed to send preedit update event");
+    }
+}
+
+/// Struct to simplify callback creation and latter passing into Xlib XIM.
+struct PreeditCallbacks {
+    start_callback: ffi::XIMCallback,
+    done_callback: ffi::XIMCallback,
+    draw_callback: ffi::XIMCallback,
+    caret_callback: ffi::XIMCallback,
+}
+
+impl PreeditCallbacks {
+    pub fn new(client_data: ffi::XPointer) -> PreeditCallbacks {
+        let start_callback = create_xim_callback(client_data, unsafe {
+            mem::transmute::<usize, unsafe extern "C" fn(ffi::XIM, ffi::XPointer, ffi::XPointer)>(
+                preedit_start_callback as *const () as usize,
+            )
+        });
+        let done_callback = create_xim_callback(client_data, preedit_done_callback);
+        let caret_callback = create_xim_callback(client_data, preedit_caret_callback);
+        let draw_callback = create_xim_callback(client_data, preedit_draw_callback);
+
+        PreeditCallbacks { start_callback, done_callback, caret_callback, draw_callback }
+    }
+}
+
+struct ImeContextClientData {
+    window: ffi::Window,
+    event_sender: ImeEventSender,
+    text: Vec<char>,
+    cursor_pos: usize,
+}
+
+// XXX: this struct doesn't destroy its XIC resource when dropped.
+// This is intentional, as it doesn't have enough information to know whether or not the context
+// still exists on the server. Since `ImeInner` has that awareness, destruction must be handled
+// through `ImeInner`.
+pub struct ImeContext {
+    pub(crate) ic: ffi::XIC,
+    pub(crate) ic_spot: ffi::XPoint,
+    pub(crate) allowed: bool,
+    // Since the data is passed shared between X11 XIM callbacks, but couldn't be directly free
+    // from there we keep the pointer to automatically deallocate it.
+    _client_data: Box<ImeContextClientData>,
+}
+
+impl ImeContext {
+    pub(crate) unsafe fn new(
+        xconn: &Arc<XConnection>,
+        im: &InputMethod,
+        window: ffi::Window,
+        ic_spot: Option<ffi::XPoint>,
+        event_sender: ImeEventSender,
+        allowed: bool,
+    ) -> Result<Self, ImeContextCreationError> {
+        let client_data = Box::into_raw(Box::new(ImeContextClientData {
+            window,
+            event_sender,
+            text: Vec::new(),
+            cursor_pos: 0,
+        }));
+
+        let style = if allowed { im.preedit_style } else { im.none_style };
+
+        let ic = match style as _ {
+            Style::Preedit(style) => unsafe {
+                ImeContext::create_preedit_ic(
+                    xconn,
+                    im.im,
+                    style,
+                    window,
+                    client_data as ffi::XPointer,
+                )
+            },
+            Style::Nothing(style) => unsafe {
+                ImeContext::create_nothing_ic(xconn, im.im, style, window)
+            },
+            Style::None(style) => unsafe {
+                ImeContext::create_none_ic(xconn, im.im, style, window)
+            },
+        }
+        .ok_or(ImeContextCreationError::Null)?;
+
+        xconn.check_errors().map_err(ImeContextCreationError::XError)?;
+
+        let mut context = ImeContext {
+            ic,
+            ic_spot: ffi::XPoint { x: 0, y: 0 },
+            allowed,
+            _client_data: unsafe { Box::from_raw(client_data) },
+        };
+
+        // Set the spot location, if it's present.
+        if let Some(ic_spot) = ic_spot {
+            context.set_spot(xconn, ic_spot.x, ic_spot.y)
+        }
+
+        Ok(context)
+    }
+
+    unsafe fn create_none_ic(
+        xconn: &Arc<XConnection>,
+        im: ffi::XIM,
+        style: XIMStyle,
+        window: ffi::Window,
+    ) -> Option<ffi::XIC> {
+        let ic = unsafe {
+            (xconn.xlib.XCreateIC)(
+                im,
+                ffi::XNInputStyle_0.as_ptr() as *const _,
+                style,
+                ffi::XNClientWindow_0.as_ptr() as *const _,
+                window,
+                ptr::null_mut::<()>(),
+            )
+        };
+
+        (!ic.is_null()).then_some(ic)
+    }
+
+    unsafe fn create_preedit_ic(
+        xconn: &Arc<XConnection>,
+        im: ffi::XIM,
+        style: XIMStyle,
+        window: ffi::Window,
+        client_data: ffi::XPointer,
+    ) -> Option<ffi::XIC> {
+        let preedit_callbacks = PreeditCallbacks::new(client_data);
+        let preedit_attr = util::memory::XSmartPointer::new(xconn, unsafe {
+            (xconn.xlib.XVaCreateNestedList)(
+                0,
+                ffi::XNPreeditStartCallback_0.as_ptr() as *const _,
+                &(preedit_callbacks.start_callback) as *const _,
+                ffi::XNPreeditDoneCallback_0.as_ptr() as *const _,
+                &(preedit_callbacks.done_callback) as *const _,
+                ffi::XNPreeditCaretCallback_0.as_ptr() as *const _,
+                &(preedit_callbacks.caret_callback) as *const _,
+                ffi::XNPreeditDrawCallback_0.as_ptr() as *const _,
+                &(preedit_callbacks.draw_callback) as *const _,
+                ptr::null_mut::<()>(),
+            )
+        })
+        .expect("XVaCreateNestedList returned NULL");
+
+        let ic = unsafe {
+            (xconn.xlib.XCreateIC)(
+                im,
+                ffi::XNInputStyle_0.as_ptr() as *const _,
+                style,
+                ffi::XNClientWindow_0.as_ptr() as *const _,
+                window,
+                ffi::XNPreeditAttributes_0.as_ptr() as *const _,
+                preedit_attr.ptr,
+                ptr::null_mut::<()>(),
+            )
+        };
+
+        (!ic.is_null()).then_some(ic)
+    }
+
+    unsafe fn create_nothing_ic(
+        xconn: &Arc<XConnection>,
+        im: ffi::XIM,
+        style: XIMStyle,
+        window: ffi::Window,
+    ) -> Option<ffi::XIC> {
+        let ic = unsafe {
+            (xconn.xlib.XCreateIC)(
+                im,
+                ffi::XNInputStyle_0.as_ptr() as *const _,
+                style,
+                ffi::XNClientWindow_0.as_ptr() as *const _,
+                window,
+                ptr::null_mut::<()>(),
+            )
+        };
+
+        (!ic.is_null()).then_some(ic)
+    }
+
+    pub(crate) fn focus(&self, xconn: &Arc<XConnection>) -> Result<(), XError> {
+        unsafe {
+            (xconn.xlib.XSetICFocus)(self.ic);
+        }
+        xconn.check_errors()
+    }
+
+    pub(crate) fn unfocus(&self, xconn: &Arc<XConnection>) -> Result<(), XError> {
+        unsafe {
+            (xconn.xlib.XUnsetICFocus)(self.ic);
+        }
+        xconn.check_errors()
+    }
+
+    pub fn is_allowed(&self) -> bool {
+        self.allowed
+    }
+
+    // Set the spot for preedit text. Setting spot isn't working with libX11 when preedit callbacks
+    // are being used. Certain IMEs do show selection window, but it's placed in bottom left of the
+    // window and couldn't be changed.
+    //
+    // For me see: https://bugs.freedesktop.org/show_bug.cgi?id=1580.
+    pub(crate) fn set_spot(&mut self, xconn: &Arc<XConnection>, x: c_short, y: c_short) {
+        if !self.is_allowed() || self.ic_spot.x == x && self.ic_spot.y == y {
+            return;
+        }
+
+        self.ic_spot = ffi::XPoint { x, y };
+
+        unsafe {
+            let preedit_attr = util::memory::XSmartPointer::new(
+                xconn,
+                (xconn.xlib.XVaCreateNestedList)(
+                    0,
+                    ffi::XNSpotLocation_0.as_ptr(),
+                    &self.ic_spot,
+                    ptr::null_mut::<()>(),
+                ),
+            )
+            .expect("XVaCreateNestedList returned NULL");
+
+            (xconn.xlib.XSetICValues)(
+                self.ic,
+                ffi::XNPreeditAttributes_0.as_ptr() as *const _,
+                preedit_attr.ptr,
+                ptr::null_mut::<()>(),
+            );
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/ime/inner.rs b/vendor/winit/src/platform_impl/linux/x11/ime/inner.rs
new file mode 100644
index 00000000..da1ccf40
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/ime/inner.rs
@@ -0,0 +1,74 @@
+use std::collections::HashMap;
+use std::mem;
+use std::sync::Arc;
+
+use super::{ffi, XConnection, XError};
+
+use super::context::ImeContext;
+use super::input_method::{InputMethod, PotentialInputMethods};
+use crate::platform_impl::platform::x11::ime::ImeEventSender;
+
+pub(crate) unsafe fn close_im(xconn: &Arc<XConnection>, im: ffi::XIM) -> Result<(), XError> {
+    unsafe { (xconn.xlib.XCloseIM)(im) };
+    xconn.check_errors()
+}
+
+pub(crate) unsafe fn destroy_ic(xconn: &Arc<XConnection>, ic: ffi::XIC) -> Result<(), XError> {
+    unsafe { (xconn.xlib.XDestroyIC)(ic) };
+    xconn.check_errors()
+}
+
+pub(crate) struct ImeInner {
+    pub xconn: Arc<XConnection>,
+    pub im: Option<InputMethod>,
+    pub potential_input_methods: PotentialInputMethods,
+    pub contexts: HashMap<ffi::Window, Option<ImeContext>>,
+    // WARNING: this is initially zeroed!
+    pub destroy_callback: ffi::XIMCallback,
+    pub event_sender: ImeEventSender,
+    // Indicates whether or not the input method was destroyed on the server end
+    // (i.e. if ibus/fcitx/etc. was terminated/restarted)
+    pub is_destroyed: bool,
+    pub is_fallback: bool,
+}
+
+impl ImeInner {
+    pub(crate) fn new(
+        xconn: Arc<XConnection>,
+        potential_input_methods: PotentialInputMethods,
+        event_sender: ImeEventSender,
+    ) -> Self {
+        ImeInner {
+            xconn,
+            im: None,
+            potential_input_methods,
+            contexts: HashMap::new(),
+            destroy_callback: unsafe { mem::zeroed() },
+            event_sender,
+            is_destroyed: false,
+            is_fallback: false,
+        }
+    }
+
+    pub unsafe fn close_im_if_necessary(&self) -> Result<bool, XError> {
+        match self.im.as_ref() {
+            Some(im) if !self.is_destroyed => unsafe { close_im(&self.xconn, im.im).map(|_| true) },
+            _ => Ok(false),
+        }
+    }
+
+    pub unsafe fn destroy_ic_if_necessary(&self, ic: ffi::XIC) -> Result<bool, XError> {
+        if !self.is_destroyed {
+            unsafe { destroy_ic(&self.xconn, ic) }.map(|_| true)
+        } else {
+            Ok(false)
+        }
+    }
+
+    pub unsafe fn destroy_all_contexts_if_necessary(&self) -> Result<bool, XError> {
+        for context in self.contexts.values().flatten() {
+            unsafe { self.destroy_ic_if_necessary(context.ic)? };
+        }
+        Ok(!self.is_destroyed)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/ime/input_method.rs b/vendor/winit/src/platform_impl/linux/x11/ime/input_method.rs
new file mode 100644
index 00000000..e1f2fbd2
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/ime/input_method.rs
@@ -0,0 +1,345 @@
+use std::ffi::{CStr, CString, IntoStringError};
+use std::os::raw::{c_char, c_ulong, c_ushort};
+use std::sync::{Arc, Mutex};
+use std::{env, fmt, ptr};
+
+use super::super::atoms::*;
+use super::{ffi, util, XConnection, XError};
+use x11rb::protocol::xproto;
+
+static GLOBAL_LOCK: Mutex<()> = Mutex::new(());
+
+unsafe fn open_im(xconn: &Arc<XConnection>, locale_modifiers: &CStr) -> Option<ffi::XIM> {
+    let _lock = GLOBAL_LOCK.lock();
+
+    // XSetLocaleModifiers returns...
+    // * The current locale modifiers if it's given a NULL pointer.
+    // * The new locale modifiers if we succeeded in setting them.
+    // * NULL if the locale modifiers string is malformed or if the current locale is not supported
+    //   by Xlib.
+    unsafe { (xconn.xlib.XSetLocaleModifiers)(locale_modifiers.as_ptr()) };
+
+    let im = unsafe {
+        (xconn.xlib.XOpenIM)(xconn.display, ptr::null_mut(), ptr::null_mut(), ptr::null_mut())
+    };
+
+    if im.is_null() {
+        None
+    } else {
+        Some(im)
+    }
+}
+
+#[derive(Debug)]
+pub struct InputMethod {
+    pub im: ffi::XIM,
+    pub preedit_style: Style,
+    pub none_style: Style,
+    _name: String,
+}
+
+impl InputMethod {
+    fn new(xconn: &Arc<XConnection>, im: ffi::XIM, name: String) -> Option<Self> {
+        let mut styles: *mut XIMStyles = std::ptr::null_mut();
+
+        // Query the styles supported by the XIM.
+        unsafe {
+            if !(xconn.xlib.XGetIMValues)(
+                im,
+                ffi::XNQueryInputStyle_0.as_ptr() as *const _,
+                (&mut styles) as *mut _,
+                std::ptr::null_mut::<()>(),
+            )
+            .is_null()
+            {
+                return None;
+            }
+        }
+
+        let mut preedit_style = None;
+        let mut none_style = None;
+
+        unsafe {
+            std::slice::from_raw_parts((*styles).supported_styles, (*styles).count_styles as _)
+                .iter()
+                .for_each(|style| match *style {
+                    XIM_PREEDIT_STYLE => {
+                        preedit_style = Some(Style::Preedit(*style));
+                    },
+                    XIM_NOTHING_STYLE if preedit_style.is_none() => {
+                        preedit_style = Some(Style::Nothing(*style))
+                    },
+                    XIM_NONE_STYLE => none_style = Some(Style::None(*style)),
+                    _ => (),
+                });
+
+            (xconn.xlib.XFree)(styles.cast());
+        };
+
+        if preedit_style.is_none() && none_style.is_none() {
+            return None;
+        }
+
+        let preedit_style = preedit_style.unwrap_or_else(|| none_style.unwrap());
+        let none_style = none_style.unwrap_or(preedit_style);
+
+        Some(InputMethod { im, _name: name, preedit_style, none_style })
+    }
+}
+
+const XIM_PREEDIT_STYLE: XIMStyle = (ffi::XIMPreeditCallbacks | ffi::XIMStatusNothing) as XIMStyle;
+const XIM_NOTHING_STYLE: XIMStyle = (ffi::XIMPreeditNothing | ffi::XIMStatusNothing) as XIMStyle;
+const XIM_NONE_STYLE: XIMStyle = (ffi::XIMPreeditNone | ffi::XIMStatusNone) as XIMStyle;
+
+/// Style of the IME context.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Style {
+    /// Preedit callbacks.
+    Preedit(XIMStyle),
+
+    /// Nothing.
+    Nothing(XIMStyle),
+
+    /// No IME.
+    None(XIMStyle),
+}
+
+impl Default for Style {
+    fn default() -> Self {
+        Style::None(XIM_NONE_STYLE)
+    }
+}
+
+#[repr(C)]
+#[derive(Debug)]
+struct XIMStyles {
+    count_styles: c_ushort,
+    supported_styles: *const XIMStyle,
+}
+
+pub(crate) type XIMStyle = c_ulong;
+
+#[derive(Debug)]
+pub enum InputMethodResult {
+    /// Input method used locale modifier from `XMODIFIERS` environment variable.
+    XModifiers(InputMethod),
+    /// Input method used internal fallback locale modifier.
+    Fallback(InputMethod),
+    /// Input method could not be opened using any locale modifier tried.
+    Failure,
+}
+
+impl InputMethodResult {
+    pub fn is_fallback(&self) -> bool {
+        matches!(self, InputMethodResult::Fallback(_))
+    }
+
+    pub fn ok(self) -> Option<InputMethod> {
+        use self::InputMethodResult::*;
+        match self {
+            XModifiers(im) | Fallback(im) => Some(im),
+            Failure => None,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+enum GetXimServersError {
+    XError(#[allow(dead_code)] XError),
+    GetPropertyError(#[allow(dead_code)] util::GetPropertyError),
+    InvalidUtf8(#[allow(dead_code)] IntoStringError),
+}
+
+impl From<util::GetPropertyError> for GetXimServersError {
+    fn from(error: util::GetPropertyError) -> Self {
+        GetXimServersError::GetPropertyError(error)
+    }
+}
+
+// The root window has a property named XIM_SERVERS, which contains a list of atoms representing
+// the available XIM servers. For instance, if you're using ibus, it would contain an atom named
+// "@server=ibus". It's possible for this property to contain multiple atoms, though presumably
+// rare. Note that we replace "@server=" with "@im=" in order to match the format of locale
+// modifiers, since we don't want a user who's looking at logs to ask "am I supposed to set
+// XMODIFIERS to `@server=ibus`?!?"
+unsafe fn get_xim_servers(xconn: &Arc<XConnection>) -> Result<Vec<String>, GetXimServersError> {
+    let atoms = xconn.atoms();
+    let servers_atom = atoms[XIM_SERVERS];
+
+    let root = unsafe { (xconn.xlib.XDefaultRootWindow)(xconn.display) };
+
+    let mut atoms: Vec<ffi::Atom> = xconn
+        .get_property::<xproto::Atom>(
+            root as xproto::Window,
+            servers_atom,
+            xproto::Atom::from(xproto::AtomEnum::ATOM),
+        )
+        .map_err(GetXimServersError::GetPropertyError)?
+        .into_iter()
+        .map(|atom| atom as _)
+        .collect::<Vec<_>>();
+
+    let mut names: Vec<*const c_char> = Vec::with_capacity(atoms.len());
+    unsafe {
+        (xconn.xlib.XGetAtomNames)(
+            xconn.display,
+            atoms.as_mut_ptr(),
+            atoms.len() as _,
+            names.as_mut_ptr() as _,
+        )
+    };
+    unsafe { names.set_len(atoms.len()) };
+
+    let mut formatted_names = Vec::with_capacity(names.len());
+    for name in names {
+        let string = unsafe { CStr::from_ptr(name) }
+            .to_owned()
+            .into_string()
+            .map_err(GetXimServersError::InvalidUtf8)?;
+        unsafe { (xconn.xlib.XFree)(name as _) };
+        formatted_names.push(string.replace("@server=", "@im="));
+    }
+    xconn.check_errors().map_err(GetXimServersError::XError)?;
+    Ok(formatted_names)
+}
+
+#[derive(Clone)]
+struct InputMethodName {
+    c_string: CString,
+    string: String,
+}
+
+impl InputMethodName {
+    pub fn from_string(string: String) -> Self {
+        let c_string = CString::new(string.clone())
+            .expect("String used to construct CString contained null byte");
+        InputMethodName { c_string, string }
+    }
+
+    pub fn from_str(string: &str) -> Self {
+        let c_string =
+            CString::new(string).expect("String used to construct CString contained null byte");
+        InputMethodName { c_string, string: string.to_owned() }
+    }
+}
+
+impl fmt::Debug for InputMethodName {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.string.fmt(f)
+    }
+}
+
+#[derive(Debug, Clone)]
+struct PotentialInputMethod {
+    name: InputMethodName,
+    successful: Option<bool>,
+}
+
+impl PotentialInputMethod {
+    pub fn from_string(string: String) -> Self {
+        PotentialInputMethod { name: InputMethodName::from_string(string), successful: None }
+    }
+
+    pub fn from_str(string: &str) -> Self {
+        PotentialInputMethod { name: InputMethodName::from_str(string), successful: None }
+    }
+
+    pub fn reset(&mut self) {
+        self.successful = None;
+    }
+
+    pub fn open_im(&mut self, xconn: &Arc<XConnection>) -> Option<InputMethod> {
+        let im = unsafe { open_im(xconn, &self.name.c_string) };
+        self.successful = Some(im.is_some());
+        im.and_then(|im| InputMethod::new(xconn, im, self.name.string.clone()))
+    }
+}
+
+// By logging this struct, you get a sequential listing of every locale modifier tried, where it
+// came from, and if it succeeded.
+#[derive(Debug, Clone)]
+pub(crate) struct PotentialInputMethods {
+    // On correctly configured systems, the XMODIFIERS environment variable tells us everything we
+    // need to know.
+    xmodifiers: Option<PotentialInputMethod>,
+    // We have some standard options at our disposal that should ostensibly always work. For users
+    // who only need compose sequences, this ensures that the program launches without a hitch
+    // For users who need more sophisticated IME features, this is more or less a silent failure.
+    // Logging features should be added in the future to allow both audiences to be effectively
+    // served.
+    fallbacks: [PotentialInputMethod; 2],
+    // For diagnostic purposes, we include the list of XIM servers that the server reports as
+    // being available.
+    _xim_servers: Result<Vec<String>, GetXimServersError>,
+}
+
+impl PotentialInputMethods {
+    pub fn new(xconn: &Arc<XConnection>) -> Self {
+        let xmodifiers = env::var("XMODIFIERS").ok().map(PotentialInputMethod::from_string);
+        PotentialInputMethods {
+            // Since passing "" to XSetLocaleModifiers results in it defaulting to the value of
+            // XMODIFIERS, it's worth noting what happens if XMODIFIERS is also "". If simply
+            // running the program with `XMODIFIERS="" cargo run`, then assuming XMODIFIERS is
+            // defined in the profile (or parent environment) then that parent XMODIFIERS is used.
+            // If that XMODIFIERS value is also "" (i.e. if you ran `export XMODIFIERS=""`), then
+            // XSetLocaleModifiers uses the default local input method. Note that defining
+            // XMODIFIERS as "" is different from XMODIFIERS not being defined at all, since in
+            // that case, we get `None` and end up skipping ahead to the next method.
+            xmodifiers,
+            fallbacks: [
+                // This is a standard input method that supports compose sequences, which should
+                // always be available. `@im=none` appears to mean the same thing.
+                PotentialInputMethod::from_str("@im=local"),
+                // This explicitly specifies to use the implementation-dependent default, though
+                // that seems to be equivalent to just using the local input method.
+                PotentialInputMethod::from_str("@im="),
+            ],
+            // The XIM_SERVERS property can have surprising values. For instance, when I exited
+            // ibus to run fcitx, it retained the value denoting ibus. Even more surprising is
+            // that the fcitx input method could only be successfully opened using "@im=ibus".
+            // Presumably due to this quirk, it's actually possible to alternate between ibus and
+            // fcitx in a running application.
+            _xim_servers: unsafe { get_xim_servers(xconn) },
+        }
+    }
+
+    // This resets the `successful` field of every potential input method, ensuring we have
+    // accurate information when this struct is re-used by the destruction/instantiation callbacks.
+    fn reset(&mut self) {
+        if let Some(ref mut input_method) = self.xmodifiers {
+            input_method.reset();
+        }
+
+        for input_method in &mut self.fallbacks {
+            input_method.reset();
+        }
+    }
+
+    pub fn open_im(
+        &mut self,
+        xconn: &Arc<XConnection>,
+        callback: Option<&dyn Fn()>,
+    ) -> InputMethodResult {
+        use self::InputMethodResult::*;
+
+        self.reset();
+
+        if let Some(ref mut input_method) = self.xmodifiers {
+            let im = input_method.open_im(xconn);
+            if let Some(im) = im {
+                return XModifiers(im);
+            } else if let Some(ref callback) = callback {
+                callback();
+            }
+        }
+
+        for input_method in &mut self.fallbacks {
+            let im = input_method.open_im(xconn);
+            if let Some(im) = im {
+                return Fallback(im);
+            }
+        }
+
+        Failure
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/ime/mod.rs b/vendor/winit/src/platform_impl/linux/x11/ime/mod.rs
new file mode 100644
index 00000000..0a419c8d
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/ime/mod.rs
@@ -0,0 +1,233 @@
+// Important: all XIM calls need to happen from the same thread!
+
+mod callbacks;
+mod context;
+mod inner;
+mod input_method;
+
+use std::sync::mpsc::{Receiver, Sender};
+use std::sync::Arc;
+
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+
+use self::callbacks::*;
+use self::context::ImeContext;
+pub use self::context::ImeContextCreationError;
+use self::inner::{close_im, ImeInner};
+use self::input_method::PotentialInputMethods;
+use super::{ffi, util, XConnection, XError};
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum ImeEvent {
+    Enabled,
+    Start,
+    Update(String, usize),
+    End,
+    Disabled,
+}
+
+pub type ImeReceiver = Receiver<ImeRequest>;
+pub type ImeSender = Sender<ImeRequest>;
+pub type ImeEventReceiver = Receiver<(ffi::Window, ImeEvent)>;
+pub type ImeEventSender = Sender<(ffi::Window, ImeEvent)>;
+
+/// Request to control XIM handler from the window.
+pub enum ImeRequest {
+    /// Set IME spot position for given `window_id`.
+    Position(ffi::Window, i16, i16),
+
+    /// Allow IME input for the given `window_id`.
+    Allow(ffi::Window, bool),
+}
+
+#[derive(Debug)]
+pub(crate) enum ImeCreationError {
+    // Boxed to prevent large error type
+    OpenFailure(Box<PotentialInputMethods>),
+    SetDestroyCallbackFailed(#[allow(dead_code)] XError),
+}
+
+pub(crate) struct Ime {
+    xconn: Arc<XConnection>,
+    // The actual meat of this struct is boxed away, since it needs to have a fixed location in
+    // memory so we can pass a pointer to it around.
+    inner: Box<ImeInner>,
+}
+
+impl Ime {
+    pub fn new(
+        xconn: Arc<XConnection>,
+        event_sender: ImeEventSender,
+    ) -> Result<Self, ImeCreationError> {
+        let potential_input_methods = PotentialInputMethods::new(&xconn);
+
+        let (mut inner, client_data) = {
+            let mut inner = Box::new(ImeInner::new(xconn, potential_input_methods, event_sender));
+            let inner_ptr = Box::into_raw(inner);
+            let client_data = inner_ptr as _;
+            let destroy_callback =
+                ffi::XIMCallback { client_data, callback: Some(xim_destroy_callback) };
+            inner = unsafe { Box::from_raw(inner_ptr) };
+            inner.destroy_callback = destroy_callback;
+            (inner, client_data)
+        };
+
+        let xconn = Arc::clone(&inner.xconn);
+
+        let input_method = inner.potential_input_methods.open_im(
+            &xconn,
+            Some(&|| {
+                let _ = unsafe { set_instantiate_callback(&xconn, client_data) };
+            }),
+        );
+
+        let is_fallback = input_method.is_fallback();
+        if let Some(input_method) = input_method.ok() {
+            inner.is_fallback = is_fallback;
+            unsafe {
+                let result = set_destroy_callback(&xconn, input_method.im, &inner)
+                    .map_err(ImeCreationError::SetDestroyCallbackFailed);
+                if result.is_err() {
+                    let _ = close_im(&xconn, input_method.im);
+                }
+                result?;
+            }
+            inner.im = Some(input_method);
+            Ok(Ime { xconn, inner })
+        } else {
+            Err(ImeCreationError::OpenFailure(Box::new(inner.potential_input_methods)))
+        }
+    }
+
+    pub fn is_destroyed(&self) -> bool {
+        self.inner.is_destroyed
+    }
+
+    // This pattern is used for various methods here:
+    // Ok(_) indicates that nothing went wrong internally
+    // Ok(true) indicates that the action was actually performed
+    // Ok(false) indicates that the action is not presently applicable
+    pub fn create_context(
+        &mut self,
+        window: ffi::Window,
+        with_ime: bool,
+    ) -> Result<bool, ImeContextCreationError> {
+        let context = if self.is_destroyed() {
+            // Create empty entry in map, so that when IME is rebuilt, this window has a context.
+            None
+        } else {
+            let im = self.inner.im.as_ref().unwrap();
+
+            let context = unsafe {
+                ImeContext::new(
+                    &self.inner.xconn,
+                    im,
+                    window,
+                    None,
+                    self.inner.event_sender.clone(),
+                    with_ime,
+                )?
+            };
+
+            let event = if context.is_allowed() { ImeEvent::Enabled } else { ImeEvent::Disabled };
+            self.inner.event_sender.send((window, event)).expect("Failed to send enabled event");
+
+            Some(context)
+        };
+
+        self.inner.contexts.insert(window, context);
+        Ok(!self.is_destroyed())
+    }
+
+    pub fn get_context(&self, window: ffi::Window) -> Option<ffi::XIC> {
+        if self.is_destroyed() {
+            return None;
+        }
+        if let Some(Some(context)) = self.inner.contexts.get(&window) {
+            Some(context.ic)
+        } else {
+            None
+        }
+    }
+
+    pub fn remove_context(&mut self, window: ffi::Window) -> Result<bool, XError> {
+        if let Some(Some(context)) = self.inner.contexts.remove(&window) {
+            unsafe {
+                self.inner.destroy_ic_if_necessary(context.ic)?;
+            }
+            Ok(true)
+        } else {
+            Ok(false)
+        }
+    }
+
+    pub fn focus(&mut self, window: ffi::Window) -> Result<bool, XError> {
+        if self.is_destroyed() {
+            return Ok(false);
+        }
+        if let Some(&mut Some(ref mut context)) = self.inner.contexts.get_mut(&window) {
+            context.focus(&self.xconn).map(|_| true)
+        } else {
+            Ok(false)
+        }
+    }
+
+    pub fn unfocus(&mut self, window: ffi::Window) -> Result<bool, XError> {
+        if self.is_destroyed() {
+            return Ok(false);
+        }
+        if let Some(&mut Some(ref mut context)) = self.inner.contexts.get_mut(&window) {
+            context.unfocus(&self.xconn).map(|_| true)
+        } else {
+            Ok(false)
+        }
+    }
+
+    pub fn send_xim_spot(&mut self, window: ffi::Window, x: i16, y: i16) {
+        if self.is_destroyed() {
+            return;
+        }
+        if let Some(&mut Some(ref mut context)) = self.inner.contexts.get_mut(&window) {
+            context.set_spot(&self.xconn, x as _, y as _);
+        }
+    }
+
+    pub fn set_ime_allowed(&mut self, window: ffi::Window, allowed: bool) {
+        if self.is_destroyed() {
+            return;
+        }
+
+        if let Some(&mut Some(ref mut context)) = self.inner.contexts.get_mut(&window) {
+            if allowed == context.is_allowed() {
+                return;
+            }
+        }
+
+        // Remove context for that window.
+        let _ = self.remove_context(window);
+
+        // Create new context supporting IME input.
+        let _ = self.create_context(window, allowed);
+    }
+
+    pub fn is_ime_allowed(&self, window: ffi::Window) -> bool {
+        if self.is_destroyed() {
+            false
+        } else if let Some(Some(context)) = self.inner.contexts.get(&window) {
+            context.is_allowed()
+        } else {
+            false
+        }
+    }
+}
+
+impl Drop for Ime {
+    fn drop(&mut self) {
+        unsafe {
+            let _ = self.inner.destroy_all_contexts_if_necessary();
+            let _ = self.inner.close_im_if_necessary();
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/mod.rs b/vendor/winit/src/platform_impl/linux/x11/mod.rs
new file mode 100644
index 00000000..f29b314a
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/mod.rs
@@ -0,0 +1,1064 @@
+use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::ffi::CStr;
+use std::marker::PhantomData;
+use std::mem::MaybeUninit;
+use std::ops::Deref;
+use std::os::raw::*;
+use std::os::unix::io::{AsFd, AsRawFd, BorrowedFd, RawFd};
+use std::sync::mpsc::{self, Receiver, Sender, TryRecvError};
+use std::sync::{Arc, Weak};
+use std::time::{Duration, Instant};
+use std::{fmt, ptr, slice, str};
+
+use calloop::generic::Generic;
+use calloop::ping::Ping;
+use calloop::{EventLoop as Loop, Readiness};
+use libc::{setlocale, LC_CTYPE};
+use tracing::warn;
+
+use x11rb::connection::RequestConnection;
+use x11rb::errors::{ConnectError, ConnectionError, IdsExhausted, ReplyError};
+use x11rb::protocol::xinput::{self, ConnectionExt as _};
+use x11rb::protocol::xkb;
+use x11rb::protocol::xproto::{self, ConnectionExt as _};
+use x11rb::x11_utils::X11Error as LogicalError;
+use x11rb::xcb_ffi::ReplyOrIdError;
+
+use crate::error::{EventLoopError, OsError as RootOsError};
+use crate::event::{Event, StartCause, WindowEvent};
+use crate::event_loop::{ActiveEventLoop as RootAEL, ControlFlow, DeviceEvents, EventLoopClosed};
+use crate::platform::pump_events::PumpStatus;
+use crate::platform_impl::common::xkb::Context;
+use crate::platform_impl::platform::{min_timeout, WindowId};
+use crate::platform_impl::{
+    ActiveEventLoop as PlatformActiveEventLoop, OsError, PlatformCustomCursor,
+};
+use crate::window::{CustomCursor as RootCustomCursor, CustomCursorSource, WindowAttributes};
+
+mod activation;
+mod atoms;
+mod dnd;
+mod event_processor;
+pub mod ffi;
+mod ime;
+mod monitor;
+mod util;
+mod window;
+mod xdisplay;
+mod xsettings;
+
+pub use util::CustomCursor;
+
+use atoms::*;
+use dnd::{Dnd, DndState};
+use event_processor::{EventProcessor, MAX_MOD_REPLAY_LEN};
+use ime::{Ime, ImeCreationError, ImeReceiver, ImeRequest, ImeSender};
+pub(crate) use monitor::{MonitorHandle, VideoModeHandle};
+use window::UnownedWindow;
+pub(crate) use xdisplay::{XConnection, XError, XNotSupported};
+
+// Xinput constants not defined in x11rb
+const ALL_DEVICES: u16 = 0;
+const ALL_MASTER_DEVICES: u16 = 1;
+const ICONIC_STATE: u32 = 3;
+
+/// The underlying x11rb connection that we are using.
+type X11rbConnection = x11rb::xcb_ffi::XCBConnection;
+
+type X11Source = Generic<BorrowedFd<'static>>;
+
+struct WakeSender<T> {
+    sender: Sender<T>,
+    waker: Ping,
+}
+
+impl<T> Clone for WakeSender<T> {
+    fn clone(&self) -> Self {
+        Self { sender: self.sender.clone(), waker: self.waker.clone() }
+    }
+}
+
+impl<T> WakeSender<T> {
+    pub fn send(&self, t: T) -> Result<(), EventLoopClosed<T>> {
+        let res = self.sender.send(t).map_err(|e| EventLoopClosed(e.0));
+        if res.is_ok() {
+            self.waker.ping();
+        }
+        res
+    }
+}
+
+struct PeekableReceiver<T> {
+    recv: Receiver<T>,
+    first: Option<T>,
+}
+
+impl<T> PeekableReceiver<T> {
+    pub fn from_recv(recv: Receiver<T>) -> Self {
+        Self { recv, first: None }
+    }
+
+    pub fn has_incoming(&mut self) -> bool {
+        if self.first.is_some() {
+            return true;
+        }
+
+        match self.recv.try_recv() {
+            Ok(v) => {
+                self.first = Some(v);
+                true
+            },
+            Err(TryRecvError::Empty) => false,
+            Err(TryRecvError::Disconnected) => {
+                warn!("Channel was disconnected when checking incoming");
+                false
+            },
+        }
+    }
+
+    pub fn try_recv(&mut self) -> Result<T, TryRecvError> {
+        if let Some(first) = self.first.take() {
+            return Ok(first);
+        }
+        self.recv.try_recv()
+    }
+}
+
+pub struct ActiveEventLoop {
+    xconn: Arc<XConnection>,
+    wm_delete_window: xproto::Atom,
+    net_wm_ping: xproto::Atom,
+    ime_sender: ImeSender,
+    control_flow: Cell<ControlFlow>,
+    exit: Cell<Option<i32>>,
+    root: xproto::Window,
+    ime: Option<RefCell<Ime>>,
+    windows: RefCell<HashMap<WindowId, Weak<UnownedWindow>>>,
+    redraw_sender: WakeSender<WindowId>,
+    activation_sender: WakeSender<ActivationToken>,
+    device_events: Cell<DeviceEvents>,
+}
+
+pub struct EventLoop<T: 'static> {
+    loop_running: bool,
+    event_loop: Loop<'static, EventLoopState>,
+    waker: calloop::ping::Ping,
+    event_processor: EventProcessor,
+    redraw_receiver: PeekableReceiver<WindowId>,
+    user_receiver: PeekableReceiver<T>,
+    activation_receiver: PeekableReceiver<ActivationToken>,
+    user_sender: Sender<T>,
+
+    /// The current state of the event loop.
+    state: EventLoopState,
+}
+
+type ActivationToken = (WindowId, crate::event_loop::AsyncRequestSerial);
+
+struct EventLoopState {
+    /// The latest readiness state for the x11 file descriptor
+    x11_readiness: Readiness,
+}
+
+pub struct EventLoopProxy<T: 'static> {
+    user_sender: WakeSender<T>,
+}
+
+impl<T: 'static> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        EventLoopProxy { user_sender: self.user_sender.clone() }
+    }
+}
+
+impl<T: 'static> EventLoop<T> {
+    pub(crate) fn new(xconn: Arc<XConnection>) -> EventLoop<T> {
+        let root = xconn.default_root().root;
+        let atoms = xconn.atoms();
+
+        let wm_delete_window = atoms[WM_DELETE_WINDOW];
+        let net_wm_ping = atoms[_NET_WM_PING];
+
+        let dnd = Dnd::new(Arc::clone(&xconn))
+            .expect("Failed to call XInternAtoms when initializing drag and drop");
+
+        let (ime_sender, ime_receiver) = mpsc::channel();
+        let (ime_event_sender, ime_event_receiver) = mpsc::channel();
+        // Input methods will open successfully without setting the locale, but it won't be
+        // possible to actually commit pre-edit sequences.
+        unsafe {
+            // Remember default locale to restore it if target locale is unsupported
+            // by Xlib
+            let default_locale = setlocale(LC_CTYPE, ptr::null());
+            setlocale(LC_CTYPE, b"\0".as_ptr() as *const _);
+
+            // Check if set locale is supported by Xlib.
+            // If not, calls to some Xlib functions like `XSetLocaleModifiers`
+            // will fail.
+            let locale_supported = (xconn.xlib.XSupportsLocale)() == 1;
+            if !locale_supported {
+                let unsupported_locale = setlocale(LC_CTYPE, ptr::null());
+                warn!(
+                    "Unsupported locale \"{}\". Restoring default locale \"{}\".",
+                    CStr::from_ptr(unsupported_locale).to_string_lossy(),
+                    CStr::from_ptr(default_locale).to_string_lossy()
+                );
+                // Restore default locale
+                setlocale(LC_CTYPE, default_locale);
+            }
+        }
+
+        let ime = Ime::new(Arc::clone(&xconn), ime_event_sender);
+        if let Err(ImeCreationError::OpenFailure(state)) = ime.as_ref() {
+            warn!("Failed to open input method: {state:#?}");
+        } else if let Err(err) = ime.as_ref() {
+            warn!("Failed to set input method destruction callback: {err:?}");
+        }
+
+        let ime = ime.ok().map(RefCell::new);
+
+        let randr_event_offset =
+            xconn.select_xrandr_input(root).expect("Failed to query XRandR extension");
+
+        let xi2ext = xconn
+            .xcb_connection()
+            .extension_information(xinput::X11_EXTENSION_NAME)
+            .expect("Failed to query XInput extension")
+            .expect("X server missing XInput extension");
+        let xkbext = xconn
+            .xcb_connection()
+            .extension_information(xkb::X11_EXTENSION_NAME)
+            .expect("Failed to query XKB extension")
+            .expect("X server missing XKB extension");
+
+        // Check for XInput2 support.
+        xconn
+            .xcb_connection()
+            .xinput_xi_query_version(2, 3)
+            .expect("Failed to send XInput2 query version request")
+            .reply()
+            .expect("Error while checking for XInput2 query version reply");
+
+        xconn.update_cached_wm_info(root);
+
+        // Create an event loop.
+        let event_loop =
+            Loop::<EventLoopState>::try_new().expect("Failed to initialize the event loop");
+        let handle = event_loop.handle();
+
+        // Create the X11 event dispatcher.
+        let source = X11Source::new(
+            // SAFETY: xcb owns the FD and outlives the source.
+            unsafe { BorrowedFd::borrow_raw(xconn.xcb_connection().as_raw_fd()) },
+            calloop::Interest::READ,
+            calloop::Mode::Level,
+        );
+        handle
+            .insert_source(source, |readiness, _, state| {
+                state.x11_readiness = readiness;
+                Ok(calloop::PostAction::Continue)
+            })
+            .expect("Failed to register the X11 event dispatcher");
+
+        let (waker, waker_source) =
+            calloop::ping::make_ping().expect("Failed to create event loop waker");
+        event_loop
+            .handle()
+            .insert_source(waker_source, move |_, _, _| {
+                // No extra handling is required, we just need to wake-up.
+            })
+            .expect("Failed to register the event loop waker source");
+
+        // Create a channel for handling redraw requests.
+        let (redraw_sender, redraw_channel) = mpsc::channel();
+
+        // Create a channel for sending activation tokens.
+        let (activation_token_sender, activation_token_channel) = mpsc::channel();
+
+        // Create a channel for sending user events.
+        let (user_sender, user_channel) = mpsc::channel();
+
+        let xkb_context =
+            Context::from_x11_xkb(xconn.xcb_connection().get_raw_xcb_connection()).unwrap();
+
+        let mut xmodmap = util::ModifierKeymap::new();
+        xmodmap.reload_from_x_connection(&xconn);
+
+        let window_target = ActiveEventLoop {
+            ime,
+            root,
+            control_flow: Cell::new(ControlFlow::default()),
+            exit: Cell::new(None),
+            windows: Default::default(),
+            ime_sender,
+            xconn,
+            wm_delete_window,
+            net_wm_ping,
+            redraw_sender: WakeSender {
+                sender: redraw_sender, // not used again so no clone
+                waker: waker.clone(),
+            },
+            activation_sender: WakeSender {
+                sender: activation_token_sender, // not used again so no clone
+                waker: waker.clone(),
+            },
+            device_events: Default::default(),
+        };
+
+        // Set initial device event filter.
+        window_target.update_listen_device_events(true);
+
+        let root_window_target =
+            RootAEL { p: PlatformActiveEventLoop::X(window_target), _marker: PhantomData };
+
+        let event_processor = EventProcessor {
+            target: root_window_target,
+            dnd,
+            devices: Default::default(),
+            randr_event_offset,
+            ime_receiver,
+            ime_event_receiver,
+            xi2ext,
+            xfiltered_modifiers: VecDeque::with_capacity(MAX_MOD_REPLAY_LEN),
+            xmodmap,
+            xkbext,
+            xkb_context,
+            num_touch: 0,
+            held_key_press: None,
+            first_touch: None,
+            active_window: None,
+            modifiers: Default::default(),
+            is_composing: false,
+        };
+
+        // Register for device hotplug events
+        // (The request buffer is flushed during `init_device`)
+        let xconn = &EventProcessor::window_target(&event_processor.target).xconn;
+
+        xconn
+            .select_xinput_events(
+                root,
+                ALL_DEVICES,
+                x11rb::protocol::xinput::XIEventMask::HIERARCHY,
+            )
+            .expect_then_ignore_error("Failed to register for XInput2 device hotplug events");
+
+        xconn
+            .select_xkb_events(
+                0x100, // Use the "core keyboard device"
+                xkb::EventType::NEW_KEYBOARD_NOTIFY
+                    | xkb::EventType::MAP_NOTIFY
+                    | xkb::EventType::STATE_NOTIFY,
+            )
+            .unwrap();
+
+        event_processor.init_device(ALL_DEVICES);
+
+        EventLoop {
+            loop_running: false,
+            event_loop,
+            waker,
+            event_processor,
+            redraw_receiver: PeekableReceiver::from_recv(redraw_channel),
+            activation_receiver: PeekableReceiver::from_recv(activation_token_channel),
+            user_receiver: PeekableReceiver::from_recv(user_channel),
+            user_sender,
+            state: EventLoopState { x11_readiness: Readiness::EMPTY },
+        }
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy {
+            user_sender: WakeSender { sender: self.user_sender.clone(), waker: self.waker.clone() },
+        }
+    }
+
+    pub(crate) fn window_target(&self) -> &RootAEL {
+        &self.event_processor.target
+    }
+
+    pub fn run_on_demand<F>(&mut self, mut event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        let exit = loop {
+            match self.pump_events(None, &mut event_handler) {
+                PumpStatus::Exit(0) => {
+                    break Ok(());
+                },
+                PumpStatus::Exit(code) => {
+                    break Err(EventLoopError::ExitFailure(code));
+                },
+                _ => {
+                    continue;
+                },
+            }
+        };
+
+        // Applications aren't allowed to carry windows between separate
+        // `run_on_demand` calls but if they have only just dropped their
+        // windows we need to make sure those last requests are sent to the
+        // X Server.
+        let wt = EventProcessor::window_target(&self.event_processor.target);
+        wt.x_connection().sync_with_server().map_err(|x_err| {
+            EventLoopError::Os(os_error!(OsError::XError(Arc::new(X11Error::Xlib(x_err)))))
+        })?;
+
+        exit
+    }
+
+    pub fn pump_events<F>(&mut self, timeout: Option<Duration>, mut callback: F) -> PumpStatus
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        if !self.loop_running {
+            self.loop_running = true;
+
+            // run the initial loop iteration
+            self.single_iteration(&mut callback, StartCause::Init);
+        }
+
+        // Consider the possibility that the `StartCause::Init` iteration could
+        // request to Exit.
+        if !self.exiting() {
+            self.poll_events_with_timeout(timeout, &mut callback);
+        }
+        if let Some(code) = self.exit_code() {
+            self.loop_running = false;
+
+            callback(Event::LoopExiting, self.window_target());
+
+            PumpStatus::Exit(code)
+        } else {
+            PumpStatus::Continue
+        }
+    }
+
+    fn has_pending(&mut self) -> bool {
+        self.event_processor.poll()
+            || self.user_receiver.has_incoming()
+            || self.redraw_receiver.has_incoming()
+    }
+
+    pub fn poll_events_with_timeout<F>(&mut self, mut timeout: Option<Duration>, mut callback: F)
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        let start = Instant::now();
+
+        let has_pending = self.has_pending();
+
+        timeout = if has_pending {
+            // If we already have work to do then we don't want to block on the next poll.
+            Some(Duration::ZERO)
+        } else {
+            let control_flow_timeout = match self.control_flow() {
+                ControlFlow::Wait => None,
+                ControlFlow::Poll => Some(Duration::ZERO),
+                ControlFlow::WaitUntil(wait_deadline) => {
+                    Some(wait_deadline.saturating_duration_since(start))
+                },
+            };
+
+            min_timeout(control_flow_timeout, timeout)
+        };
+
+        self.state.x11_readiness = Readiness::EMPTY;
+        if let Err(error) =
+            self.event_loop.dispatch(timeout, &mut self.state).map_err(std::io::Error::from)
+        {
+            tracing::error!("Failed to poll for events: {error:?}");
+            let exit_code = error.raw_os_error().unwrap_or(1);
+            self.set_exit_code(exit_code);
+            return;
+        }
+
+        // NB: `StartCause::Init` is handled as a special case and doesn't need
+        // to be considered here
+        let cause = match self.control_flow() {
+            ControlFlow::Poll => StartCause::Poll,
+            ControlFlow::Wait => StartCause::WaitCancelled { start, requested_resume: None },
+            ControlFlow::WaitUntil(deadline) => {
+                if Instant::now() < deadline {
+                    StartCause::WaitCancelled { start, requested_resume: Some(deadline) }
+                } else {
+                    StartCause::ResumeTimeReached { start, requested_resume: deadline }
+                }
+            },
+        };
+
+        // False positive / spurious wake ups could lead to us spamming
+        // redundant iterations of the event loop with no new events to
+        // dispatch.
+        //
+        // If there's no readable event source then we just double check if we
+        // have any pending `_receiver` events and if not we return without
+        // running a loop iteration.
+        // If we don't have any pending `_receiver`
+        if !self.has_pending()
+            && !matches!(&cause, StartCause::ResumeTimeReached { .. } | StartCause::Poll)
+            && timeout.is_none()
+        {
+            return;
+        }
+
+        self.single_iteration(&mut callback, cause);
+    }
+
+    fn single_iteration<F>(&mut self, callback: &mut F, cause: StartCause)
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        callback(Event::NewEvents(cause), &self.event_processor.target);
+
+        // NB: For consistency all platforms must emit a 'resumed' event even though X11
+        // applications don't themselves have a formal suspend/resume lifecycle.
+        if cause == StartCause::Init {
+            callback(Event::Resumed, &self.event_processor.target);
+        }
+
+        // Process all pending events
+        self.drain_events(callback);
+
+        // Empty activation tokens.
+        while let Ok((window_id, serial)) = self.activation_receiver.try_recv() {
+            let token = self.event_processor.with_window(window_id.0 as xproto::Window, |window| {
+                window.generate_activation_token()
+            });
+
+            match token {
+                Some(Ok(token)) => {
+                    let event = Event::WindowEvent {
+                        window_id: crate::window::WindowId(window_id),
+                        event: WindowEvent::ActivationTokenDone {
+                            serial,
+                            token: crate::window::ActivationToken::from_raw(token),
+                        },
+                    };
+                    callback(event, &self.event_processor.target)
+                },
+                Some(Err(e)) => {
+                    tracing::error!("Failed to get activation token: {}", e);
+                },
+                None => {},
+            }
+        }
+
+        // Empty the user event buffer
+        {
+            while let Ok(event) = self.user_receiver.try_recv() {
+                callback(Event::UserEvent(event), &self.event_processor.target);
+            }
+        }
+
+        // Empty the redraw requests
+        {
+            let mut windows = HashSet::new();
+
+            while let Ok(window_id) = self.redraw_receiver.try_recv() {
+                windows.insert(window_id);
+            }
+
+            for window_id in windows {
+                let window_id = crate::window::WindowId(window_id);
+                callback(
+                    Event::WindowEvent { window_id, event: WindowEvent::RedrawRequested },
+                    &self.event_processor.target,
+                );
+            }
+        }
+
+        // This is always the last event we dispatch before poll again
+        {
+            callback(Event::AboutToWait, &self.event_processor.target);
+        }
+    }
+
+    fn drain_events<F>(&mut self, callback: &mut F)
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        let mut xev = MaybeUninit::uninit();
+
+        while unsafe { self.event_processor.poll_one_event(xev.as_mut_ptr()) } {
+            let mut xev = unsafe { xev.assume_init() };
+            self.event_processor.process_event(&mut xev, |window_target, event| {
+                if let Event::WindowEvent {
+                    window_id: crate::window::WindowId(wid),
+                    event: WindowEvent::RedrawRequested,
+                } = event
+                {
+                    let window_target = EventProcessor::window_target(window_target);
+                    window_target.redraw_sender.send(wid).unwrap();
+                } else {
+                    callback(event, window_target);
+                }
+            });
+        }
+    }
+
+    fn control_flow(&self) -> ControlFlow {
+        let window_target = EventProcessor::window_target(&self.event_processor.target);
+        window_target.control_flow()
+    }
+
+    fn exiting(&self) -> bool {
+        let window_target = EventProcessor::window_target(&self.event_processor.target);
+        window_target.exiting()
+    }
+
+    fn set_exit_code(&self, code: i32) {
+        let window_target = EventProcessor::window_target(&self.event_processor.target);
+        window_target.set_exit_code(code);
+    }
+
+    fn exit_code(&self) -> Option<i32> {
+        let window_target = EventProcessor::window_target(&self.event_processor.target);
+        window_target.exit_code()
+    }
+}
+
+impl<T> AsFd for EventLoop<T> {
+    fn as_fd(&self) -> BorrowedFd<'_> {
+        self.event_loop.as_fd()
+    }
+}
+
+impl<T> AsRawFd for EventLoop<T> {
+    fn as_raw_fd(&self) -> RawFd {
+        self.event_loop.as_raw_fd()
+    }
+}
+
+impl ActiveEventLoop {
+    /// Returns the `XConnection` of this events loop.
+    #[inline]
+    pub(crate) fn x_connection(&self) -> &Arc<XConnection> {
+        &self.xconn
+    }
+
+    pub fn available_monitors(&self) -> impl Iterator<Item = MonitorHandle> {
+        self.xconn.available_monitors().into_iter().flatten()
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        self.xconn.primary_monitor().ok()
+    }
+
+    pub(crate) fn create_custom_cursor(&self, cursor: CustomCursorSource) -> RootCustomCursor {
+        RootCustomCursor { inner: PlatformCustomCursor::X(CustomCursor::new(self, cursor.inner)) }
+    }
+
+    pub fn listen_device_events(&self, allowed: DeviceEvents) {
+        self.device_events.set(allowed);
+    }
+
+    /// Update the device event based on window focus.
+    pub fn update_listen_device_events(&self, focus: bool) {
+        let device_events = self.device_events.get() == DeviceEvents::Always
+            || (focus && self.device_events.get() == DeviceEvents::WhenFocused);
+
+        let mut mask = xinput::XIEventMask::from(0u32);
+        if device_events {
+            mask = xinput::XIEventMask::RAW_MOTION
+                | xinput::XIEventMask::RAW_BUTTON_PRESS
+                | xinput::XIEventMask::RAW_BUTTON_RELEASE
+                | xinput::XIEventMask::RAW_KEY_PRESS
+                | xinput::XIEventMask::RAW_KEY_RELEASE;
+        }
+
+        self.xconn
+            .select_xinput_events(self.root, ALL_MASTER_DEVICES, mask)
+            .expect_then_ignore_error("Failed to update device event filter");
+    }
+
+    #[cfg(feature = "rwh_05")]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        let mut display_handle = rwh_05::XlibDisplayHandle::empty();
+        display_handle.display = self.xconn.display as *mut _;
+        display_handle.screen = self.xconn.default_screen_index() as c_int;
+        display_handle.into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        let display_handle = rwh_06::XlibDisplayHandle::new(
+            // SAFETY: display will never be null
+            Some(
+                std::ptr::NonNull::new(self.xconn.display as *mut _)
+                    .expect("X11 display should never be null"),
+            ),
+            self.xconn.default_screen_index() as c_int,
+        );
+        Ok(display_handle.into())
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.control_flow.set(control_flow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.control_flow.get()
+    }
+
+    pub(crate) fn exit(&self) {
+        self.exit.set(Some(0))
+    }
+
+    pub(crate) fn clear_exit(&self) {
+        self.exit.set(None)
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.exit.get().is_some()
+    }
+
+    pub(crate) fn set_exit_code(&self, code: i32) {
+        self.exit.set(Some(code))
+    }
+
+    pub(crate) fn exit_code(&self) -> Option<i32> {
+        self.exit.get()
+    }
+}
+
+impl<T: 'static> EventLoopProxy<T> {
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        self.user_sender.send(event).map_err(|e| EventLoopClosed(e.0))
+    }
+}
+
+struct DeviceInfo<'a> {
+    xconn: &'a XConnection,
+    info: *const ffi::XIDeviceInfo,
+    count: usize,
+}
+
+impl<'a> DeviceInfo<'a> {
+    fn get(xconn: &'a XConnection, device: c_int) -> Option<Self> {
+        unsafe {
+            let mut count = 0;
+            let info = (xconn.xinput2.XIQueryDevice)(xconn.display, device, &mut count);
+            xconn.check_errors().ok()?;
+
+            if info.is_null() || count == 0 {
+                None
+            } else {
+                Some(DeviceInfo { xconn, info, count: count as usize })
+            }
+        }
+    }
+}
+
+impl Drop for DeviceInfo<'_> {
+    fn drop(&mut self) {
+        assert!(!self.info.is_null());
+        unsafe { (self.xconn.xinput2.XIFreeDeviceInfo)(self.info as *mut _) };
+    }
+}
+
+impl Deref for DeviceInfo<'_> {
+    type Target = [ffi::XIDeviceInfo];
+
+    fn deref(&self) -> &Self::Target {
+        unsafe { slice::from_raw_parts(self.info, self.count) }
+    }
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct DeviceId(xinput::DeviceId);
+
+impl DeviceId {
+    #[allow(unused)]
+    pub const fn dummy() -> Self {
+        DeviceId(0)
+    }
+}
+
+pub(crate) struct Window(Arc<UnownedWindow>);
+
+impl Deref for Window {
+    type Target = UnownedWindow;
+
+    #[inline]
+    fn deref(&self) -> &UnownedWindow {
+        &self.0
+    }
+}
+
+impl Window {
+    pub(crate) fn new(
+        event_loop: &ActiveEventLoop,
+        attribs: WindowAttributes,
+    ) -> Result<Self, RootOsError> {
+        let window = Arc::new(UnownedWindow::new(event_loop, attribs)?);
+        event_loop.windows.borrow_mut().insert(window.id(), Arc::downgrade(&window));
+        Ok(Window(window))
+    }
+}
+
+impl Drop for Window {
+    fn drop(&mut self) {
+        let window = self.deref();
+        let xconn = &window.xconn;
+
+        if let Ok(c) = xconn.xcb_connection().destroy_window(window.id().0 as xproto::Window) {
+            c.ignore_error();
+        }
+    }
+}
+
+/// Generic sum error type for X11 errors.
+#[derive(Debug)]
+pub enum X11Error {
+    /// An error from the Xlib library.
+    Xlib(XError),
+
+    /// An error that occurred while trying to connect to the X server.
+    Connect(ConnectError),
+
+    /// An error that occurred over the connection medium.
+    Connection(ConnectionError),
+
+    /// An error that occurred logically on the X11 end.
+    X11(LogicalError),
+
+    /// The XID range has been exhausted.
+    XidsExhausted(IdsExhausted),
+
+    /// Got `null` from an Xlib function without a reason.
+    UnexpectedNull(&'static str),
+
+    /// Got an invalid activation token.
+    InvalidActivationToken(Vec<u8>),
+
+    /// An extension that we rely on is not available.
+    MissingExtension(&'static str),
+
+    /// Could not find a matching X11 visual for this visualid
+    NoSuchVisual(xproto::Visualid),
+
+    /// Unable to parse xsettings.
+    XsettingsParse(xsettings::ParserError),
+
+    /// Failed to get property.
+    GetProperty(util::GetPropertyError),
+}
+
+impl fmt::Display for X11Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            X11Error::Xlib(e) => write!(f, "Xlib error: {e}"),
+            X11Error::Connect(e) => write!(f, "X11 connection error: {e}"),
+            X11Error::Connection(e) => write!(f, "X11 connection error: {e}"),
+            X11Error::XidsExhausted(e) => write!(f, "XID range exhausted: {e}"),
+            X11Error::GetProperty(e) => write!(f, "Failed to get X property {e}"),
+            X11Error::X11(e) => write!(f, "X11 error: {e:?}"),
+            X11Error::UnexpectedNull(s) => write!(f, "Xlib function returned null: {s}"),
+            X11Error::InvalidActivationToken(s) => write!(
+                f,
+                "Invalid activation token: {}",
+                std::str::from_utf8(s).unwrap_or("<invalid utf8>")
+            ),
+            X11Error::MissingExtension(s) => write!(f, "Missing X11 extension: {s}"),
+            X11Error::NoSuchVisual(visualid) => {
+                write!(f, "Could not find a matching X11 visual for ID `{visualid:x}`")
+            },
+            X11Error::XsettingsParse(err) => {
+                write!(f, "Failed to parse xsettings: {err:?}")
+            },
+        }
+    }
+}
+
+impl std::error::Error for X11Error {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            X11Error::Xlib(e) => Some(e),
+            X11Error::Connect(e) => Some(e),
+            X11Error::Connection(e) => Some(e),
+            X11Error::XidsExhausted(e) => Some(e),
+            _ => None,
+        }
+    }
+}
+
+impl From<XError> for X11Error {
+    fn from(e: XError) -> Self {
+        X11Error::Xlib(e)
+    }
+}
+
+impl From<ConnectError> for X11Error {
+    fn from(e: ConnectError) -> Self {
+        X11Error::Connect(e)
+    }
+}
+
+impl From<ConnectionError> for X11Error {
+    fn from(e: ConnectionError) -> Self {
+        X11Error::Connection(e)
+    }
+}
+
+impl From<LogicalError> for X11Error {
+    fn from(e: LogicalError) -> Self {
+        X11Error::X11(e)
+    }
+}
+
+impl From<ReplyError> for X11Error {
+    fn from(value: ReplyError) -> Self {
+        match value {
+            ReplyError::ConnectionError(e) => e.into(),
+            ReplyError::X11Error(e) => e.into(),
+        }
+    }
+}
+
+impl From<ime::ImeContextCreationError> for X11Error {
+    fn from(value: ime::ImeContextCreationError) -> Self {
+        match value {
+            ime::ImeContextCreationError::XError(e) => e.into(),
+            ime::ImeContextCreationError::Null => Self::UnexpectedNull("XOpenIM"),
+        }
+    }
+}
+
+impl From<ReplyOrIdError> for X11Error {
+    fn from(value: ReplyOrIdError) -> Self {
+        match value {
+            ReplyOrIdError::ConnectionError(e) => e.into(),
+            ReplyOrIdError::X11Error(e) => e.into(),
+            ReplyOrIdError::IdsExhausted => Self::XidsExhausted(IdsExhausted),
+        }
+    }
+}
+
+impl From<xsettings::ParserError> for X11Error {
+    fn from(value: xsettings::ParserError) -> Self {
+        Self::XsettingsParse(value)
+    }
+}
+
+impl From<util::GetPropertyError> for X11Error {
+    fn from(value: util::GetPropertyError) -> Self {
+        Self::GetProperty(value)
+    }
+}
+
+/// Type alias for a void cookie.
+type VoidCookie<'a> = x11rb::cookie::VoidCookie<'a, X11rbConnection>;
+
+/// Extension trait for `Result<VoidCookie, E>`.
+trait CookieResultExt {
+    /// Unwrap the send error and ignore the result.
+    fn expect_then_ignore_error(self, msg: &str);
+}
+
+impl<E: fmt::Debug> CookieResultExt for Result<VoidCookie<'_>, E> {
+    fn expect_then_ignore_error(self, msg: &str) {
+        self.expect(msg).ignore_error()
+    }
+}
+
+fn mkwid(w: xproto::Window) -> crate::window::WindowId {
+    crate::window::WindowId(crate::platform_impl::platform::WindowId(w as _))
+}
+fn mkdid(w: xinput::DeviceId) -> crate::event::DeviceId {
+    crate::event::DeviceId(crate::platform_impl::DeviceId::X(DeviceId(w)))
+}
+
+#[derive(Debug)]
+pub struct Device {
+    _name: String,
+    scroll_axes: Vec<(i32, ScrollAxis)>,
+    // For master devices, this is the paired device (pointer <-> keyboard).
+    // For slave devices, this is the master.
+    attachment: c_int,
+}
+
+#[derive(Debug, Copy, Clone)]
+struct ScrollAxis {
+    increment: f64,
+    orientation: ScrollOrientation,
+    position: f64,
+}
+
+#[derive(Debug, Copy, Clone)]
+enum ScrollOrientation {
+    Vertical,
+    Horizontal,
+}
+
+impl Device {
+    fn new(info: &ffi::XIDeviceInfo) -> Self {
+        let name = unsafe { CStr::from_ptr(info.name).to_string_lossy() };
+        let mut scroll_axes = Vec::new();
+
+        if Device::physical_device(info) {
+            // Identify scroll axes
+            for &class_ptr in Device::classes(info) {
+                let ty = unsafe { (*class_ptr)._type };
+                if ty == ffi::XIScrollClass {
+                    let info = unsafe { &*(class_ptr as *const ffi::XIScrollClassInfo) };
+                    scroll_axes.push((info.number, ScrollAxis {
+                        increment: info.increment,
+                        orientation: match info.scroll_type {
+                            ffi::XIScrollTypeHorizontal => ScrollOrientation::Horizontal,
+                            ffi::XIScrollTypeVertical => ScrollOrientation::Vertical,
+                            _ => unreachable!(),
+                        },
+                        position: 0.0,
+                    }));
+                }
+            }
+        }
+
+        let mut device =
+            Device { _name: name.into_owned(), scroll_axes, attachment: info.attachment };
+        device.reset_scroll_position(info);
+        device
+    }
+
+    fn reset_scroll_position(&mut self, info: &ffi::XIDeviceInfo) {
+        if Device::physical_device(info) {
+            for &class_ptr in Device::classes(info) {
+                let ty = unsafe { (*class_ptr)._type };
+                if ty == ffi::XIValuatorClass {
+                    let info = unsafe { &*(class_ptr as *const ffi::XIValuatorClassInfo) };
+                    if let Some(&mut (_, ref mut axis)) =
+                        self.scroll_axes.iter_mut().find(|&&mut (axis, _)| axis == info.number)
+                    {
+                        axis.position = info.value;
+                    }
+                }
+            }
+        }
+    }
+
+    #[inline]
+    fn physical_device(info: &ffi::XIDeviceInfo) -> bool {
+        info._use == ffi::XISlaveKeyboard
+            || info._use == ffi::XISlavePointer
+            || info._use == ffi::XIFloatingSlave
+    }
+
+    #[inline]
+    fn classes(info: &ffi::XIDeviceInfo) -> &[*const ffi::XIAnyClassInfo] {
+        unsafe {
+            slice::from_raw_parts(
+                info.classes as *const *const ffi::XIAnyClassInfo,
+                info.num_classes as usize,
+            )
+        }
+    }
+}
+
+/// Convert the raw X11 representation for a 32-bit floating point to a double.
+#[inline]
+fn xinput_fp1616_to_float(fp: xinput::Fp1616) -> f64 {
+    (fp as f64) / ((1 << 16) as f64)
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/monitor.rs b/vendor/winit/src/platform_impl/linux/x11/monitor.rs
new file mode 100644
index 00000000..1964bc93
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/monitor.rs
@@ -0,0 +1,355 @@
+use super::{util, X11Error, XConnection};
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::platform_impl::VideoModeHandle as PlatformVideoModeHandle;
+use x11rb::connection::RequestConnection;
+use x11rb::protocol::randr::{self, ConnectionExt as _};
+use x11rb::protocol::xproto;
+
+// Used for testing. This should always be committed as false.
+const DISABLE_MONITOR_LIST_CACHING: bool = false;
+
+impl XConnection {
+    pub fn invalidate_cached_monitor_list(&self) -> Option<Vec<MonitorHandle>> {
+        // We update this lazily.
+        self.monitor_handles.lock().unwrap().take()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct VideoModeHandle {
+    pub(crate) size: (u32, u32),
+    pub(crate) bit_depth: u16,
+    pub(crate) refresh_rate_millihertz: u32,
+    pub(crate) native_mode: randr::Mode,
+    pub(crate) monitor: Option<MonitorHandle>,
+}
+
+impl VideoModeHandle {
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.size.into()
+    }
+
+    #[inline]
+    pub fn bit_depth(&self) -> u16 {
+        self.bit_depth
+    }
+
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.refresh_rate_millihertz
+    }
+
+    #[inline]
+    pub fn monitor(&self) -> MonitorHandle {
+        self.monitor.clone().unwrap()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct MonitorHandle {
+    /// The actual id
+    pub(crate) id: randr::Crtc,
+    /// The name of the monitor
+    pub(crate) name: String,
+    /// The size of the monitor
+    dimensions: (u32, u32),
+    /// The position of the monitor in the X screen
+    position: (i32, i32),
+    /// If the monitor is the primary one
+    primary: bool,
+    /// The refresh rate used by monitor.
+    refresh_rate_millihertz: Option<u32>,
+    /// The DPI scale factor
+    pub(crate) scale_factor: f64,
+    /// Used to determine which windows are on this monitor
+    pub(crate) rect: util::AaRect,
+    /// Supported video modes on this monitor
+    video_modes: Vec<VideoModeHandle>,
+}
+
+impl PartialEq for MonitorHandle {
+    fn eq(&self, other: &Self) -> bool {
+        self.id == other.id
+    }
+}
+
+impl Eq for MonitorHandle {}
+
+impl PartialOrd for MonitorHandle {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for MonitorHandle {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.id.cmp(&other.id)
+    }
+}
+
+impl std::hash::Hash for MonitorHandle {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.id.hash(state);
+    }
+}
+
+#[inline]
+pub fn mode_refresh_rate_millihertz(mode: &randr::ModeInfo) -> Option<u32> {
+    if mode.dot_clock > 0 && mode.htotal > 0 && mode.vtotal > 0 {
+        #[allow(clippy::unnecessary_cast)]
+        Some((mode.dot_clock as u64 * 1000 / (mode.htotal as u64 * mode.vtotal as u64)) as u32)
+    } else {
+        None
+    }
+}
+
+impl MonitorHandle {
+    fn new(
+        xconn: &XConnection,
+        resources: &ScreenResources,
+        id: randr::Crtc,
+        crtc: &randr::GetCrtcInfoReply,
+        primary: bool,
+    ) -> Option<Self> {
+        let (name, scale_factor, video_modes) = xconn.get_output_info(resources, crtc)?;
+        let dimensions = (crtc.width as u32, crtc.height as u32);
+        let position = (crtc.x as i32, crtc.y as i32);
+
+        // Get the refresh rate of the current video mode.
+        let current_mode = crtc.mode;
+        let screen_modes = resources.modes();
+        let refresh_rate_millihertz = screen_modes
+            .iter()
+            .find(|mode| mode.id == current_mode)
+            .and_then(mode_refresh_rate_millihertz);
+
+        let rect = util::AaRect::new(position, dimensions);
+
+        Some(MonitorHandle {
+            id,
+            name,
+            refresh_rate_millihertz,
+            scale_factor,
+            dimensions,
+            position,
+            primary,
+            rect,
+            video_modes,
+        })
+    }
+
+    pub fn dummy() -> Self {
+        MonitorHandle {
+            id: 0,
+            name: "<dummy monitor>".into(),
+            scale_factor: 1.0,
+            dimensions: (1, 1),
+            position: (0, 0),
+            refresh_rate_millihertz: None,
+            primary: true,
+            rect: util::AaRect::new((0, 0), (1, 1)),
+            video_modes: Vec::new(),
+        }
+    }
+
+    pub(crate) fn is_dummy(&self) -> bool {
+        // Zero is an invalid XID value; no real monitor will have it
+        self.id == 0
+    }
+
+    pub fn name(&self) -> Option<String> {
+        Some(self.name.clone())
+    }
+
+    #[inline]
+    pub fn native_identifier(&self) -> u32 {
+        self.id as _
+    }
+
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.dimensions.into()
+    }
+
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        self.position.into()
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        self.refresh_rate_millihertz
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        self.scale_factor
+    }
+
+    #[inline]
+    pub fn video_modes(&self) -> impl Iterator<Item = PlatformVideoModeHandle> {
+        let monitor = self.clone();
+        self.video_modes.clone().into_iter().map(move |mut x| {
+            x.monitor = Some(monitor.clone());
+            PlatformVideoModeHandle::X(x)
+        })
+    }
+}
+
+impl XConnection {
+    pub fn get_monitor_for_window(
+        &self,
+        window_rect: Option<util::AaRect>,
+    ) -> Result<MonitorHandle, X11Error> {
+        let monitors = self.available_monitors()?;
+
+        if monitors.is_empty() {
+            // Return a dummy monitor to avoid panicking
+            return Ok(MonitorHandle::dummy());
+        }
+
+        let default = monitors.first().unwrap();
+
+        let window_rect = match window_rect {
+            Some(rect) => rect,
+            None => return Ok(default.to_owned()),
+        };
+
+        let mut largest_overlap = 0;
+        let mut matched_monitor = default;
+        for monitor in &monitors {
+            let overlapping_area = window_rect.get_overlapping_area(&monitor.rect);
+            if overlapping_area > largest_overlap {
+                largest_overlap = overlapping_area;
+                matched_monitor = monitor;
+            }
+        }
+
+        Ok(matched_monitor.to_owned())
+    }
+
+    fn query_monitor_list(&self) -> Result<Vec<MonitorHandle>, X11Error> {
+        let root = self.default_root();
+        let resources =
+            ScreenResources::from_connection(self.xcb_connection(), root, self.randr_version())?;
+
+        // Pipeline all of the get-crtc requests.
+        let mut crtc_cookies = Vec::with_capacity(resources.crtcs().len());
+        for &crtc in resources.crtcs() {
+            crtc_cookies
+                .push(self.xcb_connection().randr_get_crtc_info(crtc, x11rb::CURRENT_TIME)?);
+        }
+
+        // Do this here so we do all of our requests in one shot.
+        let primary = self.xcb_connection().randr_get_output_primary(root.root)?.reply()?.output;
+
+        let mut crtc_infos = Vec::with_capacity(crtc_cookies.len());
+        for cookie in crtc_cookies {
+            let reply = cookie.reply()?;
+            crtc_infos.push(reply);
+        }
+
+        let mut has_primary = false;
+        let mut available_monitors = Vec::with_capacity(resources.crtcs().len());
+        for (crtc_id, crtc) in resources.crtcs().iter().zip(crtc_infos.iter()) {
+            if crtc.width == 0 || crtc.height == 0 || crtc.outputs.is_empty() {
+                continue;
+            }
+
+            let is_primary = crtc.outputs[0] == primary;
+            has_primary |= is_primary;
+            let monitor = MonitorHandle::new(self, &resources, *crtc_id, crtc, is_primary);
+            available_monitors.extend(monitor);
+        }
+
+        // If we don't have a primary monitor, just pick one ourselves!
+        if !has_primary {
+            if let Some(ref mut fallback) = available_monitors.first_mut() {
+                // Setting this here will come in handy if we ever add an `is_primary` method.
+                fallback.primary = true;
+            }
+        }
+
+        Ok(available_monitors)
+    }
+
+    pub fn available_monitors(&self) -> Result<Vec<MonitorHandle>, X11Error> {
+        let mut monitors_lock = self.monitor_handles.lock().unwrap();
+        match *monitors_lock {
+            Some(ref monitors) => Ok(monitors.clone()),
+            None => {
+                let monitors = self.query_monitor_list()?;
+                if !DISABLE_MONITOR_LIST_CACHING {
+                    *monitors_lock = Some(monitors.clone());
+                }
+                Ok(monitors)
+            },
+        }
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Result<MonitorHandle, X11Error> {
+        Ok(self
+            .available_monitors()?
+            .into_iter()
+            .find(|monitor| monitor.primary)
+            .unwrap_or_else(MonitorHandle::dummy))
+    }
+
+    pub fn select_xrandr_input(&self, root: xproto::Window) -> Result<u8, X11Error> {
+        use randr::NotifyMask;
+
+        // Get extension info.
+        let info = self
+            .xcb_connection()
+            .extension_information(randr::X11_EXTENSION_NAME)?
+            .ok_or(X11Error::MissingExtension(randr::X11_EXTENSION_NAME))?;
+
+        // Select input data.
+        let event_mask =
+            NotifyMask::CRTC_CHANGE | NotifyMask::OUTPUT_PROPERTY | NotifyMask::SCREEN_CHANGE;
+        self.xcb_connection().randr_select_input(root, event_mask)?;
+
+        Ok(info.first_event)
+    }
+}
+
+pub struct ScreenResources {
+    /// List of attached modes.
+    modes: Vec<randr::ModeInfo>,
+
+    /// List of attached CRTCs.
+    crtcs: Vec<randr::Crtc>,
+}
+
+impl ScreenResources {
+    pub(crate) fn modes(&self) -> &[randr::ModeInfo] {
+        &self.modes
+    }
+
+    pub(crate) fn crtcs(&self) -> &[randr::Crtc] {
+        &self.crtcs
+    }
+
+    pub(crate) fn from_connection(
+        conn: &impl x11rb::connection::Connection,
+        root: &x11rb::protocol::xproto::Screen,
+        (major_version, minor_version): (u32, u32),
+    ) -> Result<Self, X11Error> {
+        if (major_version == 1 && minor_version >= 3) || major_version > 1 {
+            let reply = conn.randr_get_screen_resources_current(root.root)?.reply()?;
+            Ok(Self::from_get_screen_resources_current_reply(reply))
+        } else {
+            let reply = conn.randr_get_screen_resources(root.root)?.reply()?;
+            Ok(Self::from_get_screen_resources_reply(reply))
+        }
+    }
+
+    pub(crate) fn from_get_screen_resources_reply(reply: randr::GetScreenResourcesReply) -> Self {
+        Self { modes: reply.modes, crtcs: reply.crtcs }
+    }
+
+    pub(crate) fn from_get_screen_resources_current_reply(
+        reply: randr::GetScreenResourcesCurrentReply,
+    ) -> Self {
+        Self { modes: reply.modes, crtcs: reply.crtcs }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/tests/xsettings.dat b/vendor/winit/src/platform_impl/linux/x11/tests/xsettings.dat
new file mode 100644
index 00000000..e04eeb14
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/tests/xsettings.dat
@@ -0,0 +1 @@
+0x6c,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x22,0x00,0x00,0x00,0x00,0x00,0x0b,0x00,0x58,0x66,0x74,0x2f,0x48,0x69,0x6e,0x74,0x69,0x6e,0x67,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x14,0x00,0x47,0x74,0x6b,0x2f,0x44,0x69,0x61,0x6c,0x6f,0x67,0x73,0x55,0x73,0x65,0x48,0x65,0x61,0x64,0x65,0x72,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x0c,0x00,0x47,0x74,0x6b,0x2f,0x46,0x6f,0x6e,0x74,0x4e,0x61,0x6d,0x65,0x00,0x00,0x00,0x00,0x0b,0x00,0x00,0x00,0x4e,0x6f,0x74,0x6f,0x20,0x53,0x61,0x6e,0x73,0x20,0x39,0x00,0x01,0x00,0x0d,0x00,0x58,0x66,0x74,0x2f,0x4c,0x63,0x64,0x66,0x69,0x6c,0x74,0x65,0x72,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x6c,0x63,0x64,0x64,0x65,0x66,0x61,0x75,0x6c,0x74,0x00,0x00,0x01,0x00,0x10,0x00,0x47,0x74,0x6b,0x2f,0x4b,0x65,0x79,0x54,0x68,0x65,0x6d,0x65,0x4e,0x61,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x0d,0x00,0x58,0x66,0x74,0x2f,0x48,0x69,0x6e,0x74,0x53,0x74,0x79,0x6c,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x68,0x69,0x6e,0x74,0x73,0x6c,0x69,0x67,0x68,0x74,0x00,0x00,0x01,0x00,0x11,0x00,0x4e,0x65,0x74,0x2f,0x49,0x63,0x6f,0x6e,0x54,0x68,0x65,0x6d,0x65,0x4e,0x61,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x00,0x00,0x00,0x65,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x61,0x72,0x79,0x2d,0x78,0x66,0x63,0x65,0x2d,0x64,0x61,0x72,0x6b,0x00,0x00,0x0d,0x00,0x58,0x66,0x74,0x2f,0x41,0x6e,0x74,0x69,0x61,0x6c,0x69,0x61,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x08,0x00,0x58,0x66,0x74,0x2f,0x52,0x47,0x42,0x41,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x72,0x67,0x62,0x00,0x00,0x00,0x13,0x00,0x4e,0x65,0x74,0x2f,0x43,0x75,0x72,0x73,0x6f,0x72,0x42,0x6c,0x69,0x6e,0x6b,0x54,0x69,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0xb0,0x04,0x00,0x00,0x00,0x00,0x13,0x00,0x47,0x74,0x6b,0x2f,0x43,0x75,0x72,0x73,0x6f,0x72,0x54,0x68,0x65,0x6d,0x65,0x53,0x69,0x7a,0x65,0x00,0x00,0x00,0x00,0x00,0x18,0x00,0x00,0x00,0x01,0x00,0x15,0x00,0x4e,0x65,0x74,0x2f,0x46,0x61,0x6c,0x6c,0x62,0x61,0x63,0x6b,0x49,0x63,0x6f,0x6e,0x54,0x68,0x65,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x67,0x6e,0x6f,0x6d,0x65,0x00,0x00,0x00,0x01,0x00,0x10,0x00,0x47,0x74,0x6b,0x2f,0x54,0x6f,0x6f,0x6c,0x62,0x61,0x72,0x53,0x74,0x79,0x6c,0x65,0x00,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x69,0x63,0x6f,0x6e,0x73,0x00,0x00,0x00,0x01,0x00,0x12,0x00,0x4e,0x65,0x74,0x2f,0x53,0x6f,0x75,0x6e,0x64,0x54,0x68,0x65,0x6d,0x65,0x4e,0x61,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x64,0x65,0x66,0x61,0x75,0x6c,0x74,0x00,0x00,0x00,0x15,0x00,0x4e,0x65,0x74,0x2f,0x45,0x6e,0x61,0x62,0x6c,0x65,0x45,0x76,0x65,0x6e,0x74,0x53,0x6f,0x75,0x6e,0x64,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0f,0x00,0x4e,0x65,0x74,0x2f,0x43,0x75,0x72,0x73,0x6f,0x72,0x42,0x6c,0x69,0x6e,0x6b,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x10,0x00,0x47,0x74,0x6b,0x2f,0x43,0x6f,0x6c,0x6f,0x72,0x50,0x61,0x6c,0x65,0x74,0x74,0x65,0x00,0x00,0x00,0x00,0x94,0x00,0x00,0x00,0x62,0x6c,0x61,0x63,0x6b,0x3a,0x77,0x68,0x69,0x74,0x65,0x3a,0x67,0x72,0x61,0x79,0x35,0x30,0x3a,0x72,0x65,0x64,0x3a,0x70,0x75,0x72,0x70,0x6c,0x65,0x3a,0x62,0x6c,0x75,0x65,0x3a,0x6c,0x69,0x67,0x68,0x74,0x20,0x62,0x6c,0x75,0x65,0x3a,0x67,0x72,0x65,0x65,0x6e,0x3a,0x79,0x65,0x6c,0x6c,0x6f,0x77,0x3a,0x6f,0x72,0x61,0x6e,0x67,0x65,0x3a,0x6c,0x61,0x76,0x65,0x6e,0x64,0x65,0x72,0x3a,0x62,0x72,0x6f,0x77,0x6e,0x3a,0x67,0x6f,0x6c,0x64,0x65,0x6e,0x72,0x6f,0x64,0x34,0x3a,0x64,0x6f,0x64,0x67,0x65,0x72,0x20,0x62,0x6c,0x75,0x65,0x3a,0x70,0x69,0x6e,0x6b,0x3a,0x6c,0x69,0x67,0x68,0x74,0x20,0x67,0x72,0x65,0x65,0x6e,0x3a,0x67,0x72,0x61,0x79,0x31,0x30,0x3a,0x67,0x72,0x61,0x79,0x33,0x30,0x3a,0x67,0x72,0x61,0x79,0x37,0x35,0x3a,0x67,0x72,0x61,0x79,0x39,0x30,0x00,0x00,0x13,0x00,0x4e,0x65,0x74,0x2f,0x44,0x6f,0x75,0x62,0x6c,0x65,0x43,0x6c,0x69,0x63,0x6b,0x54,0x69,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x90,0x01,0x00,0x00,0x00,0x00,0x13,0x00,0x47,0x74,0x6b,0x2f,0x43,0x61,0x6e,0x43,0x68,0x61,0x6e,0x67,0x65,0x41,0x63,0x63,0x65,0x6c,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x10,0x00,0x47,0x74,0x6b,0x2f,0x4d,0x65,0x6e,0x75,0x42,0x61,0x72,0x41,0x63,0x63,0x65,0x6c,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x31,0x30,0x00,0x01,0x00,0x0d,0x00,0x4e,0x65,0x74,0x2f,0x54,0x68,0x65,0x6d,0x65,0x4e,0x61,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x47,0x72,0x65,0x79,0x62,0x69,0x72,0x64,0x01,0x00,0x17,0x00,0x47,0x74,0x6b,0x2f,0x54,0x69,0x74,0x6c,0x65,0x62,0x61,0x72,0x4d,0x69,0x64,0x64,0x6c,0x65,0x43,0x6c,0x69,0x63,0x6b,0x00,0x00,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x6c,0x6f,0x77,0x65,0x72,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x47,0x74,0x6b,0x2f,0x42,0x75,0x74,0x74,0x6f,0x6e,0x49,0x6d,0x61,0x67,0x65,0x73,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x17,0x00,0x4e,0x65,0x74,0x2f,0x44,0x6f,0x75,0x62,0x6c,0x65,0x43,0x6c,0x69,0x63,0x6b,0x44,0x69,0x73,0x74,0x61,0x6e,0x63,0x65,0x00,0x00,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x01,0x00,0x15,0x00,0x47,0x74,0x6b,0x2f,0x4d,0x6f,0x6e,0x6f,0x73,0x70,0x61,0x63,0x65,0x46,0x6f,0x6e,0x74,0x4e,0x61,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x4d,0x6f,0x6e,0x6f,0x73,0x70,0x61,0x63,0x65,0x20,0x31,0x30,0x00,0x00,0x07,0x00,0x58,0x66,0x74,0x2f,0x44,0x50,0x49,0x00,0x02,0x00,0x00,0x00,0x00,0x80,0x01,0x00,0x01,0x00,0x13,0x00,0x47,0x74,0x6b,0x2f,0x43,0x75,0x72,0x73,0x6f,0x72,0x54,0x68,0x65,0x6d,0x65,0x4e,0x61,0x6d,0x65,0x00,0x00,0x00,0x00,0x00,0x09,0x00,0x00,0x00,0x44,0x4d,0x5a,0x2d,0x57,0x68,0x69,0x74,0x65,0x00,0x00,0x00,0x00,0x00,0x13,0x00,0x47,0x74,0x6b,0x2f,0x54,0x6f,0x6f,0x6c,0x62,0x61,0x72,0x49,0x63,0x6f,0x6e,0x53,0x69,0x7a,0x65,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x14,0x00,0x4e,0x65,0x74,0x2f,0x44,0x6e,0x64,0x44,0x72,0x61,0x67,0x54,0x68,0x72,0x65,0x73,0x68,0x6f,0x6c,0x64,0x00,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x01,0x00,0x14,0x00,0x47,0x74,0x6b,0x2f,0x44,0x65,0x63,0x6f,0x72,0x61,0x74,0x69,0x6f,0x6e,0x4c,0x61,0x79,0x6f,0x75,0x74,0x00,0x00,0x00,0x00,0x1c,0x00,0x00,0x00,0x6d,0x65,0x6e,0x75,0x3a,0x6d,0x69,0x6e,0x69,0x6d,0x69,0x7a,0x65,0x2c,0x6d,0x61,0x78,0x69,0x6d,0x69,0x7a,0x65,0x2c,0x63,0x6c,0x6f,0x73,0x65,0x00,0x00,0x1d,0x00,0x4e,0x65,0x74,0x2f,0x45,0x6e,0x61,0x62,0x6c,0x65,0x49,0x6e,0x70,0x75,0x74,0x46,0x65,0x65,0x64,0x62,0x61,0x63,0x6b,0x53,0x6f,0x75,0x6e,0x64,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x17,0x00,0x47,0x64,0x6b,0x2f,0x57,0x69,0x6e,0x64,0x6f,0x77,0x53,0x63,0x61,0x6c,0x69,0x6e,0x67,0x46,0x61,0x63,0x74,0x6f,0x72,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x0d,0x00,0x47,0x74,0x6b,0x2f,0x49,0x63,0x6f,0x6e,0x53,0x69,0x7a,0x65,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x67,0x74,0x6b,0x2d,0x62,0x75,0x74,0x74,0x6f,0x6e,0x3d,0x31,0x36,0x2c,0x31,0x36,0x00,0x00,0x0e,0x00,0x47,0x74,0x6b,0x2f,0x4d,0x65,0x6e,0x75,0x49,0x6d,0x61,0x67,0x65,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/client_msg.rs b/vendor/winit/src/platform_impl/linux/x11/util/client_msg.rs
new file mode 100644
index 00000000..cf551776
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/client_msg.rs
@@ -0,0 +1,31 @@
+use super::*;
+use x11rb::x11_utils::Serialize;
+
+impl XConnection {
+    pub fn send_client_msg(
+        &self,
+        window: xproto::Window, // The window this is "about"; not necessarily this window
+        target_window: xproto::Window, // The window we're sending to
+        message_type: xproto::Atom,
+        event_mask: Option<xproto::EventMask>,
+        data: impl Into<xproto::ClientMessageData>,
+    ) -> Result<VoidCookie<'_>, X11Error> {
+        let event = xproto::ClientMessageEvent {
+            response_type: xproto::CLIENT_MESSAGE_EVENT,
+            window,
+            format: 32,
+            data: data.into(),
+            sequence: 0,
+            type_: message_type,
+        };
+
+        self.xcb_connection()
+            .send_event(
+                false,
+                target_window,
+                event_mask.unwrap_or(xproto::EventMask::NO_EVENT),
+                event.serialize(),
+            )
+            .map_err(Into::into)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/cookie.rs b/vendor/winit/src/platform_impl/linux/x11/util/cookie.rs
new file mode 100644
index 00000000..ccdfa8cd
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/cookie.rs
@@ -0,0 +1,55 @@
+use std::ffi::c_int;
+use std::sync::Arc;
+
+use x11_dl::xlib::{self, XEvent, XGenericEventCookie};
+
+use crate::platform_impl::x11::XConnection;
+
+/// XEvents of type GenericEvent store their actual data in an XGenericEventCookie data structure.
+/// This is a wrapper to extract the cookie from a GenericEvent XEvent and release the cookie data
+/// once it has been processed
+pub struct GenericEventCookie {
+    cookie: XGenericEventCookie,
+    xconn: Arc<XConnection>,
+}
+
+impl GenericEventCookie {
+    pub fn from_event(xconn: Arc<XConnection>, event: XEvent) -> Option<GenericEventCookie> {
+        unsafe {
+            let mut cookie: XGenericEventCookie = From::from(event);
+            if (xconn.xlib.XGetEventData)(xconn.display, &mut cookie) == xlib::True {
+                Some(GenericEventCookie { cookie, xconn })
+            } else {
+                None
+            }
+        }
+    }
+
+    #[inline]
+    pub fn extension(&self) -> u8 {
+        self.cookie.extension as u8
+    }
+
+    #[inline]
+    pub fn evtype(&self) -> c_int {
+        self.cookie.evtype
+    }
+
+    /// Borrow inner event data as `&T`.
+    ///
+    /// ## SAFETY
+    ///
+    /// The caller must ensure that the event has the `T` inside of it.
+    #[inline]
+    pub unsafe fn as_event<T>(&self) -> &T {
+        unsafe { &*(self.cookie.data as *const _) }
+    }
+}
+
+impl Drop for GenericEventCookie {
+    fn drop(&mut self) {
+        unsafe {
+            (self.xconn.xlib.XFreeEventData)(self.xconn.display, &mut self.cookie);
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/cursor.rs b/vendor/winit/src/platform_impl/linux/x11/util/cursor.rs
new file mode 100644
index 00000000..169748d1
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/cursor.rs
@@ -0,0 +1,174 @@
+use std::ffi::CString;
+use std::hash::{Hash, Hasher};
+use std::sync::Arc;
+use std::{iter, slice};
+
+use x11rb::connection::Connection;
+
+use crate::platform_impl::PlatformCustomCursorSource;
+use crate::window::CursorIcon;
+
+use super::super::ActiveEventLoop;
+use super::*;
+
+impl XConnection {
+    pub fn set_cursor_icon(&self, window: xproto::Window, cursor: Option<CursorIcon>) {
+        let cursor = *self
+            .cursor_cache
+            .lock()
+            .unwrap()
+            .entry(cursor)
+            .or_insert_with(|| self.get_cursor(cursor));
+
+        self.update_cursor(window, cursor).expect("Failed to set cursor");
+    }
+
+    pub(crate) fn set_custom_cursor(&self, window: xproto::Window, cursor: &CustomCursor) {
+        self.update_cursor(window, cursor.inner.cursor).expect("Failed to set cursor");
+    }
+
+    fn create_empty_cursor(&self) -> ffi::Cursor {
+        let data = 0;
+        let pixmap = unsafe {
+            let screen = (self.xlib.XDefaultScreen)(self.display);
+            let window = (self.xlib.XRootWindow)(self.display, screen);
+            (self.xlib.XCreateBitmapFromData)(self.display, window, &data, 1, 1)
+        };
+
+        if pixmap == 0 {
+            panic!("failed to allocate pixmap for cursor");
+        }
+
+        unsafe {
+            // We don't care about this color, since it only fills bytes
+            // in the pixmap which are not 0 in the mask.
+            let mut dummy_color = MaybeUninit::uninit();
+            let cursor = (self.xlib.XCreatePixmapCursor)(
+                self.display,
+                pixmap,
+                pixmap,
+                dummy_color.as_mut_ptr(),
+                dummy_color.as_mut_ptr(),
+                0,
+                0,
+            );
+            (self.xlib.XFreePixmap)(self.display, pixmap);
+
+            cursor
+        }
+    }
+
+    fn get_cursor(&self, cursor: Option<CursorIcon>) -> ffi::Cursor {
+        let cursor = match cursor {
+            Some(cursor) => cursor,
+            None => return self.create_empty_cursor(),
+        };
+
+        let mut xcursor = 0;
+        for &name in iter::once(&cursor.name()).chain(cursor.alt_names().iter()) {
+            let name = CString::new(name).unwrap();
+            xcursor = unsafe {
+                (self.xcursor.XcursorLibraryLoadCursor)(
+                    self.display,
+                    name.as_ptr() as *const c_char,
+                )
+            };
+
+            if xcursor != 0 {
+                break;
+            }
+        }
+
+        xcursor
+    }
+
+    fn update_cursor(&self, window: xproto::Window, cursor: ffi::Cursor) -> Result<(), X11Error> {
+        self.xcb_connection()
+            .change_window_attributes(
+                window,
+                &xproto::ChangeWindowAttributesAux::new().cursor(cursor as xproto::Cursor),
+            )?
+            .ignore_error();
+
+        self.xcb_connection().flush()?;
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SelectedCursor {
+    Custom(CustomCursor),
+    Named(CursorIcon),
+}
+
+#[derive(Debug, Clone)]
+pub struct CustomCursor {
+    inner: Arc<CustomCursorInner>,
+}
+
+impl Hash for CustomCursor {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        Arc::as_ptr(&self.inner).hash(state);
+    }
+}
+
+impl PartialEq for CustomCursor {
+    fn eq(&self, other: &Self) -> bool {
+        Arc::ptr_eq(&self.inner, &other.inner)
+    }
+}
+
+impl Eq for CustomCursor {}
+
+impl CustomCursor {
+    pub(crate) fn new(
+        event_loop: &ActiveEventLoop,
+        cursor: PlatformCustomCursorSource,
+    ) -> CustomCursor {
+        unsafe {
+            let ximage = (event_loop.xconn.xcursor.XcursorImageCreate)(
+                cursor.0.width as i32,
+                cursor.0.height as i32,
+            );
+            if ximage.is_null() {
+                panic!("failed to allocate cursor image");
+            }
+            (*ximage).xhot = cursor.0.hotspot_x as u32;
+            (*ximage).yhot = cursor.0.hotspot_y as u32;
+            (*ximage).delay = 0;
+
+            let dst = slice::from_raw_parts_mut((*ximage).pixels, cursor.0.rgba.len() / 4);
+            for (dst, chunk) in dst.iter_mut().zip(cursor.0.rgba.chunks_exact(4)) {
+                *dst = (chunk[0] as u32) << 16
+                    | (chunk[1] as u32) << 8
+                    | (chunk[2] as u32)
+                    | (chunk[3] as u32) << 24;
+            }
+
+            let cursor =
+                (event_loop.xconn.xcursor.XcursorImageLoadCursor)(event_loop.xconn.display, ximage);
+            (event_loop.xconn.xcursor.XcursorImageDestroy)(ximage);
+            Self { inner: Arc::new(CustomCursorInner { xconn: event_loop.xconn.clone(), cursor }) }
+        }
+    }
+}
+
+#[derive(Debug)]
+struct CustomCursorInner {
+    xconn: Arc<XConnection>,
+    cursor: ffi::Cursor,
+}
+
+impl Drop for CustomCursorInner {
+    fn drop(&mut self) {
+        unsafe {
+            (self.xconn.xlib.XFreeCursor)(self.xconn.display, self.cursor);
+        }
+    }
+}
+
+impl Default for SelectedCursor {
+    fn default() -> Self {
+        SelectedCursor::Named(Default::default())
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/geometry.rs b/vendor/winit/src/platform_impl/linux/x11/util/geometry.rs
new file mode 100644
index 00000000..63ec5647
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/geometry.rs
@@ -0,0 +1,265 @@
+use std::cmp;
+
+use super::*;
+
+// Friendly neighborhood axis-aligned rectangle
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AaRect {
+    x: i64,
+    y: i64,
+    width: i64,
+    height: i64,
+}
+
+impl AaRect {
+    pub fn new((x, y): (i32, i32), (width, height): (u32, u32)) -> Self {
+        let (x, y) = (x as i64, y as i64);
+        let (width, height) = (width as i64, height as i64);
+        AaRect { x, y, width, height }
+    }
+
+    pub fn contains_point(&self, x: i64, y: i64) -> bool {
+        x >= self.x && x <= self.x + self.width && y >= self.y && y <= self.y + self.height
+    }
+
+    pub fn get_overlapping_area(&self, other: &Self) -> i64 {
+        let x_overlap = cmp::max(
+            0,
+            cmp::min(self.x + self.width, other.x + other.width) - cmp::max(self.x, other.x),
+        );
+        let y_overlap = cmp::max(
+            0,
+            cmp::min(self.y + self.height, other.y + other.height) - cmp::max(self.y, other.y),
+        );
+        x_overlap * y_overlap
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct FrameExtents {
+    pub left: u32,
+    pub right: u32,
+    pub top: u32,
+    pub bottom: u32,
+}
+
+impl FrameExtents {
+    pub fn new(left: u32, right: u32, top: u32, bottom: u32) -> Self {
+        FrameExtents { left, right, top, bottom }
+    }
+
+    pub fn from_border(border: u32) -> Self {
+        Self::new(border, border, border, border)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum FrameExtentsHeuristicPath {
+    Supported,
+    UnsupportedNested,
+    UnsupportedBordered,
+}
+
+#[derive(Debug, Clone)]
+pub struct FrameExtentsHeuristic {
+    pub frame_extents: FrameExtents,
+    pub heuristic_path: FrameExtentsHeuristicPath,
+}
+
+impl FrameExtentsHeuristic {
+    pub fn inner_pos_to_outer(&self, x: i32, y: i32) -> (i32, i32) {
+        use self::FrameExtentsHeuristicPath::*;
+        if self.heuristic_path != UnsupportedBordered {
+            (x - self.frame_extents.left as i32, y - self.frame_extents.top as i32)
+        } else {
+            (x, y)
+        }
+    }
+
+    pub fn inner_size_to_outer(&self, width: u32, height: u32) -> (u32, u32) {
+        (
+            width.saturating_add(
+                self.frame_extents.left.saturating_add(self.frame_extents.right) as _
+            ),
+            height.saturating_add(
+                self.frame_extents.top.saturating_add(self.frame_extents.bottom) as _
+            ),
+        )
+    }
+}
+
+impl XConnection {
+    // This is adequate for inner_position
+    pub fn translate_coords(
+        &self,
+        window: xproto::Window,
+        root: xproto::Window,
+    ) -> Result<xproto::TranslateCoordinatesReply, X11Error> {
+        self.xcb_connection().translate_coordinates(window, root, 0, 0)?.reply().map_err(Into::into)
+    }
+
+    // This is adequate for inner_size
+    pub fn get_geometry(
+        &self,
+        window: xproto::Window,
+    ) -> Result<xproto::GetGeometryReply, X11Error> {
+        self.xcb_connection().get_geometry(window)?.reply().map_err(Into::into)
+    }
+
+    fn get_frame_extents(&self, window: xproto::Window) -> Option<FrameExtents> {
+        let atoms = self.atoms();
+        let extents_atom = atoms[_NET_FRAME_EXTENTS];
+
+        if !hint_is_supported(extents_atom) {
+            return None;
+        }
+
+        // Of the WMs tested, xmonad, i3, dwm, IceWM (1.3.x and earlier), and blackbox don't
+        // support this. As this is part of EWMH (Extended Window Manager Hints), it's likely to
+        // be unsupported by many smaller WMs.
+        let extents: Option<Vec<u32>> = self
+            .get_property(window, extents_atom, xproto::Atom::from(xproto::AtomEnum::CARDINAL))
+            .ok();
+
+        extents.and_then(|extents| {
+            if extents.len() >= 4 {
+                Some(FrameExtents {
+                    left: extents[0],
+                    right: extents[1],
+                    top: extents[2],
+                    bottom: extents[3],
+                })
+            } else {
+                None
+            }
+        })
+    }
+
+    pub fn is_top_level(&self, window: xproto::Window, root: xproto::Window) -> Option<bool> {
+        let atoms = self.atoms();
+        let client_list_atom = atoms[_NET_CLIENT_LIST];
+
+        if !hint_is_supported(client_list_atom) {
+            return None;
+        }
+
+        let client_list: Option<Vec<xproto::Window>> = self
+            .get_property(root, client_list_atom, xproto::Atom::from(xproto::AtomEnum::WINDOW))
+            .ok();
+
+        client_list.map(|client_list| client_list.contains(&(window as xproto::Window)))
+    }
+
+    fn get_parent_window(&self, window: xproto::Window) -> Result<xproto::Window, X11Error> {
+        let parent = self.xcb_connection().query_tree(window)?.reply()?.parent;
+        Ok(parent)
+    }
+
+    fn climb_hierarchy(
+        &self,
+        window: xproto::Window,
+        root: xproto::Window,
+    ) -> Result<xproto::Window, X11Error> {
+        let mut outer_window = window;
+        loop {
+            let candidate = self.get_parent_window(outer_window)?;
+            if candidate == root {
+                break;
+            }
+            outer_window = candidate;
+        }
+        Ok(outer_window)
+    }
+
+    pub fn get_frame_extents_heuristic(
+        &self,
+        window: xproto::Window,
+        root: xproto::Window,
+    ) -> FrameExtentsHeuristic {
+        use self::FrameExtentsHeuristicPath::*;
+
+        // Position relative to root window.
+        // With rare exceptions, this is the position of a nested window. Cases where the window
+        // isn't nested are outlined in the comments throughout this function, but in addition to
+        // that, fullscreen windows often aren't nested.
+        let (inner_y_rel_root, child) = {
+            let coords = self
+                .translate_coords(window, root)
+                .expect("Failed to translate window coordinates");
+            (coords.dst_y, coords.child)
+        };
+
+        let (width, height, border) = {
+            let inner_geometry =
+                self.get_geometry(window).expect("Failed to get inner window geometry");
+            (inner_geometry.width, inner_geometry.height, inner_geometry.border_width)
+        };
+
+        // The first condition is only false for un-nested windows, but isn't always false for
+        // un-nested windows. Mutter/Muffin/Budgie and Marco present a mysterious discrepancy:
+        // when y is on the range [0, 2] and if the window has been unfocused since being
+        // undecorated (or was undecorated upon construction), the first condition is true,
+        // requiring us to rely on the second condition.
+        let nested = !(window == child || self.is_top_level(child, root) == Some(true));
+
+        // Hopefully the WM supports EWMH, allowing us to get exact info on the window frames.
+        if let Some(mut frame_extents) = self.get_frame_extents(window) {
+            // Mutter/Muffin/Budgie and Marco preserve their decorated frame extents when
+            // decorations are disabled, but since the window becomes un-nested, it's easy to
+            // catch.
+            if !nested {
+                frame_extents = FrameExtents::new(0, 0, 0, 0);
+            }
+
+            // The difference between the nested window's position and the outermost window's
+            // position is equivalent to the frame size. In most scenarios, this is equivalent to
+            // manually climbing the hierarchy as is done in the case below. Here's a list of
+            // known discrepancies:
+            // * Mutter/Muffin/Budgie gives decorated windows a margin of 9px (only 7px on top) in
+            //   addition to a 1px semi-transparent border. The margin can be easily observed by
+            //   using a screenshot tool to get a screenshot of a selected window, and is presumably
+            //   used for drawing drop shadows. Getting window geometry information via
+            //   hierarchy-climbing results in this margin being included in both the position and
+            //   outer size, so a window positioned at (0, 0) would be reported as having a position
+            //   (-10, -8).
+            // * Compiz has a drop shadow margin just like Mutter/Muffin/Budgie, though it's 10px on
+            //   all sides, and there's no additional border.
+            // * Enlightenment otherwise gets a y position equivalent to inner_y_rel_root. Without
+            //   decorations, there's no difference. This is presumably related to Enlightenment's
+            //   fairly unique concept of window position; it interprets positions given to
+            //   XMoveWindow as a client area position rather than a position of the overall window.
+
+            FrameExtentsHeuristic { frame_extents, heuristic_path: Supported }
+        } else if nested {
+            // If the position value we have is for a nested window used as the client area, we'll
+            // just climb up the hierarchy and get the geometry of the outermost window we're
+            // nested in.
+            let outer_window =
+                self.climb_hierarchy(window, root).expect("Failed to climb window hierarchy");
+            let (outer_y, outer_width, outer_height) = {
+                let outer_geometry =
+                    self.get_geometry(outer_window).expect("Failed to get outer window geometry");
+                (outer_geometry.y, outer_geometry.width, outer_geometry.height)
+            };
+
+            // Since we have the geometry of the outermost window and the geometry of the client
+            // area, we can figure out what's in between.
+            let diff_x = outer_width.saturating_sub(width) as u32;
+            let diff_y = outer_height.saturating_sub(height) as u32;
+            let offset_y = inner_y_rel_root.saturating_sub(outer_y) as u32;
+
+            let left = diff_x / 2;
+            let right = left;
+            let top = offset_y;
+            let bottom = diff_y.saturating_sub(offset_y);
+
+            let frame_extents = FrameExtents::new(left, right, top, bottom);
+            FrameExtentsHeuristic { frame_extents, heuristic_path: UnsupportedNested }
+        } else {
+            // This is the case for xmonad and dwm, AKA the only WMs tested that supplied a
+            // border value. This is convenient, since we can use it to get an accurate frame.
+            let frame_extents = FrameExtents::from_border(border.into());
+            FrameExtentsHeuristic { frame_extents, heuristic_path: UnsupportedBordered }
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/hint.rs b/vendor/winit/src/platform_impl/linux/x11/util/hint.rs
new file mode 100644
index 00000000..a31872d5
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/hint.rs
@@ -0,0 +1,169 @@
+use crate::platform::x11::WindowType;
+use std::sync::Arc;
+
+use super::*;
+
+#[derive(Debug)]
+#[allow(dead_code)]
+pub enum StateOperation {
+    Remove = 0, // _NET_WM_STATE_REMOVE
+    Add = 1,    // _NET_WM_STATE_ADD
+    Toggle = 2, // _NET_WM_STATE_TOGGLE
+}
+
+impl From<bool> for StateOperation {
+    fn from(op: bool) -> Self {
+        if op {
+            StateOperation::Add
+        } else {
+            StateOperation::Remove
+        }
+    }
+}
+
+impl WindowType {
+    pub(crate) fn as_atom(&self, xconn: &Arc<XConnection>) -> xproto::Atom {
+        use self::WindowType::*;
+        let atom_name = match *self {
+            Desktop => _NET_WM_WINDOW_TYPE_DESKTOP,
+            Dock => _NET_WM_WINDOW_TYPE_DOCK,
+            Toolbar => _NET_WM_WINDOW_TYPE_TOOLBAR,
+            Menu => _NET_WM_WINDOW_TYPE_MENU,
+            Utility => _NET_WM_WINDOW_TYPE_UTILITY,
+            Splash => _NET_WM_WINDOW_TYPE_SPLASH,
+            Dialog => _NET_WM_WINDOW_TYPE_DIALOG,
+            DropdownMenu => _NET_WM_WINDOW_TYPE_DROPDOWN_MENU,
+            PopupMenu => _NET_WM_WINDOW_TYPE_POPUP_MENU,
+            Tooltip => _NET_WM_WINDOW_TYPE_TOOLTIP,
+            Notification => _NET_WM_WINDOW_TYPE_NOTIFICATION,
+            Combo => _NET_WM_WINDOW_TYPE_COMBO,
+            Dnd => _NET_WM_WINDOW_TYPE_DND,
+            Normal => _NET_WM_WINDOW_TYPE_NORMAL,
+        };
+
+        let atoms = xconn.atoms();
+        atoms[atom_name]
+    }
+}
+
+pub struct MotifHints {
+    hints: MwmHints,
+}
+
+struct MwmHints {
+    flags: u32,
+    functions: u32,
+    decorations: u32,
+    input_mode: u32,
+    status: u32,
+}
+
+#[allow(dead_code)]
+mod mwm {
+    // Motif WM hints are obsolete, but still widely supported.
+    // https://stackoverflow.com/a/1909708
+    pub const MWM_HINTS_FUNCTIONS: u32 = 1 << 0;
+    pub const MWM_HINTS_DECORATIONS: u32 = 1 << 1;
+
+    pub const MWM_FUNC_ALL: u32 = 1 << 0;
+    pub const MWM_FUNC_RESIZE: u32 = 1 << 1;
+    pub const MWM_FUNC_MOVE: u32 = 1 << 2;
+    pub const MWM_FUNC_MINIMIZE: u32 = 1 << 3;
+    pub const MWM_FUNC_MAXIMIZE: u32 = 1 << 4;
+    pub const MWM_FUNC_CLOSE: u32 = 1 << 5;
+}
+
+impl MotifHints {
+    pub fn new() -> MotifHints {
+        MotifHints {
+            hints: MwmHints { flags: 0, functions: 0, decorations: 0, input_mode: 0, status: 0 },
+        }
+    }
+
+    pub fn set_decorations(&mut self, decorations: bool) {
+        self.hints.flags |= mwm::MWM_HINTS_DECORATIONS;
+        self.hints.decorations = decorations as u32;
+    }
+
+    pub fn set_maximizable(&mut self, maximizable: bool) {
+        if maximizable {
+            self.add_func(mwm::MWM_FUNC_MAXIMIZE);
+        } else {
+            self.remove_func(mwm::MWM_FUNC_MAXIMIZE);
+        }
+    }
+
+    fn add_func(&mut self, func: u32) {
+        if self.hints.flags & mwm::MWM_HINTS_FUNCTIONS != 0 {
+            if self.hints.functions & mwm::MWM_FUNC_ALL != 0 {
+                self.hints.functions &= !func;
+            } else {
+                self.hints.functions |= func;
+            }
+        }
+    }
+
+    fn remove_func(&mut self, func: u32) {
+        if self.hints.flags & mwm::MWM_HINTS_FUNCTIONS == 0 {
+            self.hints.flags |= mwm::MWM_HINTS_FUNCTIONS;
+            self.hints.functions = mwm::MWM_FUNC_ALL;
+        }
+
+        if self.hints.functions & mwm::MWM_FUNC_ALL != 0 {
+            self.hints.functions |= func;
+        } else {
+            self.hints.functions &= !func;
+        }
+    }
+}
+
+impl Default for MotifHints {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl XConnection {
+    pub fn get_motif_hints(&self, window: xproto::Window) -> MotifHints {
+        let atoms = self.atoms();
+        let motif_hints = atoms[_MOTIF_WM_HINTS];
+
+        let mut hints = MotifHints::new();
+
+        if let Ok(props) = self.get_property::<u32>(window, motif_hints, motif_hints) {
+            hints.hints.flags = props.first().cloned().unwrap_or(0);
+            hints.hints.functions = props.get(1).cloned().unwrap_or(0);
+            hints.hints.decorations = props.get(2).cloned().unwrap_or(0);
+            hints.hints.input_mode = props.get(3).cloned().unwrap_or(0);
+            hints.hints.status = props.get(4).cloned().unwrap_or(0);
+        }
+
+        hints
+    }
+
+    #[allow(clippy::unnecessary_cast)]
+    pub fn set_motif_hints(
+        &self,
+        window: xproto::Window,
+        hints: &MotifHints,
+    ) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.atoms();
+        let motif_hints = atoms[_MOTIF_WM_HINTS];
+
+        let hints_data: [u32; 5] = [
+            hints.hints.flags as u32,
+            hints.hints.functions as u32,
+            hints.hints.decorations as u32,
+            hints.hints.input_mode as u32,
+            hints.hints.status as u32,
+        ];
+
+        self.change_property(
+            window,
+            motif_hints,
+            motif_hints,
+            xproto::PropMode::REPLACE,
+            &hints_data,
+        )
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/icon.rs b/vendor/winit/src/platform_impl/linux/x11/util/icon.rs
new file mode 100644
index 00000000..07b5fee6
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/icon.rs
@@ -0,0 +1,36 @@
+#![allow(clippy::assertions_on_constants)]
+
+use super::*;
+use crate::icon::{Pixel, RgbaIcon, PIXEL_SIZE};
+
+impl Pixel {
+    pub fn to_packed_argb(&self) -> Cardinal {
+        let mut cardinal = 0;
+        assert!(CARDINAL_SIZE >= PIXEL_SIZE);
+        let as_bytes = &mut cardinal as *mut _ as *mut u8;
+        unsafe {
+            *as_bytes.offset(0) = self.b;
+            *as_bytes.offset(1) = self.g;
+            *as_bytes.offset(2) = self.r;
+            *as_bytes.offset(3) = self.a;
+        }
+        cardinal
+    }
+}
+
+impl RgbaIcon {
+    pub(crate) fn to_cardinals(&self) -> Vec<Cardinal> {
+        assert_eq!(self.rgba.len() % PIXEL_SIZE, 0);
+        let pixel_count = self.rgba.len() / PIXEL_SIZE;
+        assert_eq!(pixel_count, (self.width * self.height) as usize);
+        let mut data = Vec::with_capacity(pixel_count);
+        data.push(self.width as Cardinal);
+        data.push(self.height as Cardinal);
+        let pixels = self.rgba.as_ptr() as *const Pixel;
+        for pixel_index in 0..pixel_count {
+            let pixel = unsafe { &*pixels.add(pixel_index) };
+            data.push(pixel.to_packed_argb());
+        }
+        data
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/input.rs b/vendor/winit/src/platform_impl/linux/x11/util/input.rs
new file mode 100644
index 00000000..37d21d11
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/input.rs
@@ -0,0 +1,106 @@
+use std::{slice, str};
+use x11rb::protocol::xinput::{self, ConnectionExt as _};
+use x11rb::protocol::xkb;
+
+use super::*;
+
+pub const VIRTUAL_CORE_POINTER: u16 = 2;
+pub const VIRTUAL_CORE_KEYBOARD: u16 = 3;
+
+// A base buffer size of 1kB uses a negligible amount of RAM while preventing us from having to
+// re-allocate (and make another round-trip) in the *vast* majority of cases.
+// To test if `lookup_utf8` works correctly, set this to 1.
+const TEXT_BUFFER_SIZE: usize = 1024;
+
+impl XConnection {
+    pub fn select_xinput_events(
+        &self,
+        window: xproto::Window,
+        device_id: u16,
+        mask: xinput::XIEventMask,
+    ) -> Result<VoidCookie<'_>, X11Error> {
+        self.xcb_connection()
+            .xinput_xi_select_events(window, &[xinput::EventMask {
+                deviceid: device_id,
+                mask: vec![mask],
+            }])
+            .map_err(Into::into)
+    }
+
+    pub fn select_xkb_events(
+        &self,
+        device_id: xkb::DeviceSpec,
+        mask: xkb::EventType,
+    ) -> Result<bool, X11Error> {
+        let mask = u16::from(mask) as _;
+        let status =
+            unsafe { (self.xlib.XkbSelectEvents)(self.display, device_id as _, mask, mask) };
+
+        if status == ffi::True {
+            self.flush_requests()?;
+            Ok(true)
+        } else {
+            tracing::error!("Could not select XKB events: The XKB extension is not initialized!");
+            Ok(false)
+        }
+    }
+
+    pub fn query_pointer(
+        &self,
+        window: xproto::Window,
+        device_id: u16,
+    ) -> Result<xinput::XIQueryPointerReply, X11Error> {
+        self.xcb_connection()
+            .xinput_xi_query_pointer(window, device_id)?
+            .reply()
+            .map_err(Into::into)
+    }
+
+    fn lookup_utf8_inner(
+        &self,
+        ic: ffi::XIC,
+        key_event: &mut ffi::XKeyEvent,
+        buffer: *mut u8,
+        size: usize,
+    ) -> (ffi::KeySym, ffi::Status, c_int) {
+        let mut keysym: ffi::KeySym = 0;
+        let mut status: ffi::Status = 0;
+        let count = unsafe {
+            (self.xlib.Xutf8LookupString)(
+                ic,
+                key_event,
+                buffer as *mut c_char,
+                size as c_int,
+                &mut keysym,
+                &mut status,
+            )
+        };
+        (keysym, status, count)
+    }
+
+    pub fn lookup_utf8(&self, ic: ffi::XIC, key_event: &mut ffi::XKeyEvent) -> String {
+        // `assume_init` is safe here because the array consists of `MaybeUninit` values,
+        // which do not require initialization.
+        let mut buffer: [MaybeUninit<u8>; TEXT_BUFFER_SIZE] =
+            unsafe { MaybeUninit::uninit().assume_init() };
+        // If the buffer overflows, we'll make a new one on the heap.
+        let mut vec;
+
+        let (_, status, count) =
+            self.lookup_utf8_inner(ic, key_event, buffer.as_mut_ptr() as *mut u8, buffer.len());
+
+        let bytes = if status == ffi::XBufferOverflow {
+            vec = Vec::with_capacity(count as usize);
+            let (_, _, new_count) =
+                self.lookup_utf8_inner(ic, key_event, vec.as_mut_ptr(), vec.capacity());
+            debug_assert_eq!(count, new_count);
+
+            unsafe { vec.set_len(count as usize) };
+            &vec[..count as usize]
+        } else {
+            unsafe { slice::from_raw_parts(buffer.as_ptr() as *const u8, count as usize) }
+        };
+
+        str::from_utf8(bytes).unwrap_or("").to_string()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/keys.rs b/vendor/winit/src/platform_impl/linux/x11/util/keys.rs
new file mode 100644
index 00000000..a6ad291c
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/keys.rs
@@ -0,0 +1,75 @@
+use std::iter::Enumerate;
+use std::slice::Iter;
+
+use super::*;
+
+pub struct Keymap {
+    keys: [u8; 32],
+}
+
+pub struct KeymapIter<'a> {
+    iter: Enumerate<Iter<'a, u8>>,
+    index: usize,
+    item: Option<u8>,
+}
+
+impl Keymap {
+    pub fn iter(&self) -> KeymapIter<'_> {
+        KeymapIter { iter: self.keys.iter().enumerate(), index: 0, item: None }
+    }
+}
+
+impl<'a> IntoIterator for &'a Keymap {
+    type IntoIter = KeymapIter<'a>;
+    type Item = ffi::KeyCode;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.iter()
+    }
+}
+
+impl Iterator for KeymapIter<'_> {
+    type Item = ffi::KeyCode;
+
+    fn next(&mut self) -> Option<ffi::KeyCode> {
+        if self.item.is_none() {
+            for (index, &item) in self.iter.by_ref() {
+                if item != 0 {
+                    self.index = index;
+                    self.item = Some(item);
+                    break;
+                }
+            }
+        }
+
+        self.item.take().map(|item| {
+            debug_assert!(item != 0);
+
+            let bit = first_bit(item);
+
+            if item != bit {
+                // Remove the first bit; save the rest for further iterations
+                self.item = Some(item ^ bit);
+            }
+
+            let shift = bit.trailing_zeros() + (self.index * 8) as u32;
+            shift as ffi::KeyCode
+        })
+    }
+}
+
+impl XConnection {
+    pub fn query_keymap(&self) -> Keymap {
+        let mut keys = [0; 32];
+
+        unsafe {
+            (self.xlib.XQueryKeymap)(self.display, keys.as_mut_ptr() as *mut c_char);
+        }
+
+        Keymap { keys }
+    }
+}
+
+fn first_bit(b: u8) -> u8 {
+    1 << b.trailing_zeros()
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/memory.rs b/vendor/winit/src/platform_impl/linux/x11/util/memory.rs
new file mode 100644
index 00000000..4e052a75
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/memory.rs
@@ -0,0 +1,42 @@
+use std::ops::{Deref, DerefMut};
+
+use super::*;
+
+pub(crate) struct XSmartPointer<'a, T> {
+    xconn: &'a XConnection,
+    pub ptr: *mut T,
+}
+
+impl<'a, T> XSmartPointer<'a, T> {
+    // You're responsible for only passing things to this that should be XFree'd.
+    // Returns None if ptr is null.
+    pub fn new(xconn: &'a XConnection, ptr: *mut T) -> Option<Self> {
+        if !ptr.is_null() {
+            Some(XSmartPointer { xconn, ptr })
+        } else {
+            None
+        }
+    }
+}
+
+impl<T> Deref for XSmartPointer<'_, T> {
+    type Target = T;
+
+    fn deref(&self) -> &T {
+        unsafe { &*self.ptr }
+    }
+}
+
+impl<T> DerefMut for XSmartPointer<'_, T> {
+    fn deref_mut(&mut self) -> &mut T {
+        unsafe { &mut *self.ptr }
+    }
+}
+
+impl<T> Drop for XSmartPointer<'_, T> {
+    fn drop(&mut self) {
+        unsafe {
+            (self.xconn.xlib.XFree)(self.ptr as *mut _);
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/mod.rs b/vendor/winit/src/platform_impl/linux/x11/util/mod.rs
new file mode 100644
index 00000000..55e6c2dd
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/mod.rs
@@ -0,0 +1,77 @@
+// Welcome to the util module, where we try to keep you from shooting yourself in the foot.
+// *results may vary
+
+use std::mem::{self, MaybeUninit};
+use std::ops::BitAnd;
+use std::os::raw::*;
+
+mod client_msg;
+pub mod cookie;
+mod cursor;
+mod geometry;
+mod hint;
+mod icon;
+mod input;
+pub mod keys;
+pub(crate) mod memory;
+mod mouse;
+mod randr;
+mod window_property;
+mod wm;
+mod xmodmap;
+
+pub use self::cursor::*;
+pub use self::geometry::*;
+pub use self::hint::*;
+pub use self::input::*;
+pub use self::mouse::*;
+pub use self::window_property::*;
+pub use self::wm::*;
+pub use self::xmodmap::ModifierKeymap;
+
+use super::atoms::*;
+use super::{ffi, VoidCookie, X11Error, XConnection, XError};
+use x11rb::protocol::xproto::{self, ConnectionExt as _};
+
+pub fn maybe_change<T: PartialEq>(field: &mut Option<T>, value: T) -> bool {
+    let wrapped = Some(value);
+    if *field != wrapped {
+        *field = wrapped;
+        true
+    } else {
+        false
+    }
+}
+
+pub fn has_flag<T>(bitset: T, flag: T) -> bool
+where
+    T: Copy + PartialEq + BitAnd<T, Output = T>,
+{
+    bitset & flag == flag
+}
+
+impl XConnection {
+    // This is important, so pay attention!
+    // Xlib has an output buffer, and tries to hide the async nature of X from you.
+    // This buffer contains the requests you make, and is flushed under various circumstances:
+    // 1. `XPending`, `XNextEvent`, and `XWindowEvent` flush "as needed"
+    // 2. `XFlush` explicitly flushes
+    // 3. `XSync` flushes and blocks until all requests are responded to
+    // 4. Calls that have a return dependent on a response (i.e. `XGetWindowProperty`) sync
+    //    internally. When in doubt, check the X11 source; if a function calls `_XReply`, it flushes
+    //    and waits.
+    // All util functions that abstract an async function will return a `Flusher`.
+    pub fn flush_requests(&self) -> Result<(), XError> {
+        unsafe { (self.xlib.XFlush)(self.display) };
+        // println!("XFlush");
+        // This isn't necessarily a useful time to check for errors (since our request hasn't
+        // necessarily been processed yet)
+        self.check_errors()
+    }
+
+    pub fn sync_with_server(&self) -> Result<(), XError> {
+        unsafe { (self.xlib.XSync)(self.display, ffi::False) };
+        // println!("XSync");
+        self.check_errors()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/modifiers.rs b/vendor/winit/src/platform_impl/linux/x11/util/modifiers.rs
new file mode 100644
index 00000000..bb157e44
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/modifiers.rs
@@ -0,0 +1,187 @@
+use std::{collections::HashMap, slice};
+
+use super::*;
+
+use crate::event::{ElementState, ModifiersState};
+
+// Offsets within XModifierKeymap to each set of keycodes.
+// We are only interested in Shift, Control, Alt, and Logo.
+//
+// There are 8 sets total. The order of keycode sets is:
+//     Shift, Lock, Control, Mod1 (Alt), Mod2, Mod3, Mod4 (Logo), Mod5
+//
+// https://tronche.com/gui/x/xlib/input/XSetModifierMapping.html
+const SHIFT_OFFSET: usize = 0;
+const CONTROL_OFFSET: usize = 2;
+const ALT_OFFSET: usize = 3;
+const LOGO_OFFSET: usize = 6;
+const NUM_MODS: usize = 8;
+
+#[derive(Copy, Clone, Debug, Eq, PartialEq)]
+pub enum Modifier {
+    Alt,
+    Ctrl,
+    Shift,
+    Logo,
+}
+
+#[derive(Debug, Default)]
+pub(crate) struct ModifierKeymap {
+    // Maps keycodes to modifiers
+    keys: HashMap<ffi::KeyCode, Modifier>,
+}
+
+#[derive(Clone, Debug, Default)]
+pub(crate) struct ModifierKeyState {
+    // Contains currently pressed modifier keys and their corresponding modifiers
+    keys: HashMap<ffi::KeyCode, Modifier>,
+    state: ModifiersState,
+}
+
+impl ModifierKeymap {
+    pub fn new() -> ModifierKeymap {
+        ModifierKeymap::default()
+    }
+
+    pub fn get_modifier(&self, keycode: ffi::KeyCode) -> Option<Modifier> {
+        self.keys.get(&keycode).cloned()
+    }
+
+    pub fn reset_from_x_connection(&mut self, xconn: &XConnection) {
+        {
+            let keymap = xconn.xcb_connection().get_modifier_mapping().expect("get_modifier_mapping failed").reply().expect("get_modifier_mapping failed");
+
+            if keymap.is_null() {
+                panic!("failed to allocate XModifierKeymap");
+            }
+
+            self.reset_from_x_keymap(&*keymap);
+
+            (xconn.xlib.XFreeModifiermap)(keymap);
+        }
+    }
+
+    pub fn reset_from_x_keymap(&mut self, keymap: &ffi::XModifierKeymap) {
+        let keys_per_mod = keymap.max_keypermod as usize;
+
+        let keys = unsafe {
+            slice::from_raw_parts(keymap.modifiermap as *const _, keys_per_mod * NUM_MODS)
+        };
+
+        self.keys.clear();
+
+        self.read_x_keys(keys, SHIFT_OFFSET, keys_per_mod, Modifier::Shift);
+        self.read_x_keys(keys, CONTROL_OFFSET, keys_per_mod, Modifier::Ctrl);
+        self.read_x_keys(keys, ALT_OFFSET, keys_per_mod, Modifier::Alt);
+        self.read_x_keys(keys, LOGO_OFFSET, keys_per_mod, Modifier::Logo);
+    }
+
+    fn read_x_keys(
+        &mut self,
+        keys: &[ffi::KeyCode],
+        offset: usize,
+        keys_per_mod: usize,
+        modifier: Modifier,
+    ) {
+        let start = offset * keys_per_mod;
+        let end = start + keys_per_mod;
+
+        for &keycode in &keys[start..end] {
+            if keycode != 0 {
+                self.keys.insert(keycode, modifier);
+            }
+        }
+    }
+}
+
+impl ModifierKeyState {
+    pub fn update_keymap(&mut self, mods: &ModifierKeymap) {
+        self.keys.retain(|k, v| {
+            if let Some(m) = mods.get_modifier(*k) {
+                *v = m;
+                true
+            } else {
+                false
+            }
+        });
+
+        self.reset_state();
+    }
+
+    pub fn update_state(
+        &mut self,
+        state: &ModifiersState,
+        except: Option<Modifier>,
+    ) -> Option<ModifiersState> {
+        let mut new_state = *state;
+
+        match except {
+            Some(Modifier::Alt) => new_state.set(ModifiersState::ALT, self.state.alt()),
+            Some(Modifier::Ctrl) => new_state.set(ModifiersState::CTRL, self.state.ctrl()),
+            Some(Modifier::Shift) => new_state.set(ModifiersState::SHIFT, self.state.shift()),
+            Some(Modifier::Logo) => new_state.set(ModifiersState::LOGO, self.state.logo()),
+            None => (),
+        }
+
+        if self.state == new_state {
+            None
+        } else {
+            self.keys.retain(|_k, v| get_modifier(&new_state, *v));
+            self.state = new_state;
+            Some(new_state)
+        }
+    }
+
+    pub fn modifiers(&self) -> ModifiersState {
+        self.state
+    }
+
+    pub fn key_event(&mut self, state: ElementState, keycode: ffi::KeyCode, modifier: Modifier) {
+        match state {
+            ElementState::Pressed => self.key_press(keycode, modifier),
+            ElementState::Released => self.key_release(keycode),
+        }
+    }
+
+    pub fn key_press(&mut self, keycode: ffi::KeyCode, modifier: Modifier) {
+        self.keys.insert(keycode, modifier);
+
+        set_modifier(&mut self.state, modifier, true);
+    }
+
+    pub fn key_release(&mut self, keycode: ffi::KeyCode) {
+        if let Some(modifier) = self.keys.remove(&keycode) {
+            if !self.keys.values().any(|&m| m == modifier) {
+                set_modifier(&mut self.state, modifier, false);
+            }
+        }
+    }
+
+    fn reset_state(&mut self) {
+        let mut new_state = ModifiersState::default();
+
+        for &m in self.keys.values() {
+            set_modifier(&mut new_state, m, true);
+        }
+
+        self.state = new_state;
+    }
+}
+
+fn get_modifier(state: &ModifiersState, modifier: Modifier) -> bool {
+    match modifier {
+        Modifier::Alt => state.alt(),
+        Modifier::Ctrl => state.ctrl(),
+        Modifier::Shift => state.shift(),
+        Modifier::Logo => state.logo(),
+    }
+}
+
+fn set_modifier(state: &mut ModifiersState, modifier: Modifier, value: bool) {
+    match modifier {
+        Modifier::Alt => state.set(ModifiersState::ALT, value),
+        Modifier::Ctrl => state.set(ModifiersState::CTRL, value),
+        Modifier::Shift => state.set(ModifiersState::SHIFT, value),
+        Modifier::Logo => state.set(ModifiersState::LOGO, value),
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/mouse.rs b/vendor/winit/src/platform_impl/linux/x11/util/mouse.rs
new file mode 100644
index 00000000..e66a76c3
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/mouse.rs
@@ -0,0 +1,49 @@
+//! Utilities for handling mouse events.
+
+/// Recorded mouse delta designed to filter out noise.
+pub struct Delta<T> {
+    x: T,
+    y: T,
+}
+
+impl<T: Default> Default for Delta<T> {
+    fn default() -> Self {
+        Self { x: Default::default(), y: Default::default() }
+    }
+}
+
+impl<T: Default> Delta<T> {
+    pub(crate) fn set_x(&mut self, x: T) {
+        self.x = x;
+    }
+
+    pub(crate) fn set_y(&mut self, y: T) {
+        self.y = y;
+    }
+}
+
+macro_rules! consume {
+    ($this:expr, $ty:ty) => {{
+        let this = $this;
+        let (x, y) = match (this.x.abs() < <$ty>::EPSILON, this.y.abs() < <$ty>::EPSILON) {
+            (true, true) => return None,
+            (false, true) => (this.x, 0.0),
+            (true, false) => (0.0, this.y),
+            (false, false) => (this.x, this.y),
+        };
+
+        Some((x, y))
+    }};
+}
+
+impl Delta<f32> {
+    pub(crate) fn consume(self) -> Option<(f32, f32)> {
+        consume!(self, f32)
+    }
+}
+
+impl Delta<f64> {
+    pub(crate) fn consume(self) -> Option<(f64, f64)> {
+        consume!(self, f64)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/randr.rs b/vendor/winit/src/platform_impl/linux/x11/util/randr.rs
new file mode 100644
index 00000000..d10c97e5
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/randr.rs
@@ -0,0 +1,186 @@
+use std::str::FromStr;
+use std::{env, str};
+
+use super::*;
+use crate::dpi::validate_scale_factor;
+use crate::platform_impl::platform::x11::{monitor, VideoModeHandle};
+
+use tracing::warn;
+use x11rb::protocol::randr::{self, ConnectionExt as _};
+
+/// Represents values of `WINIT_HIDPI_FACTOR`.
+pub enum EnvVarDPI {
+    Randr,
+    Scale(f64),
+    NotSet,
+}
+
+pub fn calc_dpi_factor(
+    (width_px, height_px): (u32, u32),
+    (width_mm, height_mm): (u64, u64),
+) -> f64 {
+    // See http://xpra.org/trac/ticket/728 for more information.
+    if width_mm == 0 || height_mm == 0 {
+        warn!("XRandR reported that the display's 0mm in size, which is certifiably insane");
+        return 1.0;
+    }
+
+    let ppmm = ((width_px as f64 * height_px as f64) / (width_mm as f64 * height_mm as f64)).sqrt();
+    // Quantize 1/12 step size
+    let dpi_factor = ((ppmm * (12.0 * 25.4 / 96.0)).round() / 12.0).max(1.0);
+    assert!(validate_scale_factor(dpi_factor));
+    if dpi_factor <= 20. {
+        dpi_factor
+    } else {
+        1.
+    }
+}
+
+impl XConnection {
+    // Retrieve DPI from Xft.dpi property
+    pub fn get_xft_dpi(&self) -> Option<f64> {
+        // Try to get it from XSETTINGS first.
+        if let Some(xsettings_screen) = self.xsettings_screen() {
+            match self.xsettings_dpi(xsettings_screen) {
+                Ok(Some(dpi)) => return Some(dpi),
+                Ok(None) => {},
+                Err(err) => {
+                    tracing::warn!("failed to fetch XSettings: {err}");
+                },
+            }
+        }
+
+        self.database().get_string("Xft.dpi", "").and_then(|s| f64::from_str(s).ok())
+    }
+
+    pub fn get_output_info(
+        &self,
+        resources: &monitor::ScreenResources,
+        crtc: &randr::GetCrtcInfoReply,
+    ) -> Option<(String, f64, Vec<VideoModeHandle>)> {
+        let output_info = match self
+            .xcb_connection()
+            .randr_get_output_info(crtc.outputs[0], x11rb::CURRENT_TIME)
+            .map_err(X11Error::from)
+            .and_then(|r| r.reply().map_err(X11Error::from))
+        {
+            Ok(output_info) => output_info,
+            Err(err) => {
+                warn!("Failed to get output info: {:?}", err);
+                return None;
+            },
+        };
+
+        let bit_depth = self.default_root().root_depth;
+        let output_modes = &output_info.modes;
+        let resource_modes = resources.modes();
+
+        let modes = resource_modes
+            .iter()
+            // XRROutputInfo contains an array of mode ids that correspond to
+            // modes in the array in XRRScreenResources
+            .filter(|x| output_modes.contains(&x.id))
+            .map(|mode| {
+                VideoModeHandle {
+                    size: (mode.width.into(), mode.height.into()),
+                    refresh_rate_millihertz: monitor::mode_refresh_rate_millihertz(mode)
+                        .unwrap_or(0),
+                    bit_depth: bit_depth as u16,
+                    native_mode: mode.id,
+                    // This is populated in `MonitorHandle::video_modes` as the
+                    // video mode is returned to the user
+                    monitor: None,
+                }
+            })
+            .collect();
+
+        let name = match str::from_utf8(&output_info.name) {
+            Ok(name) => name.to_owned(),
+            Err(err) => {
+                warn!("Failed to get output name: {:?}", err);
+                return None;
+            },
+        };
+        // Override DPI if `WINIT_X11_SCALE_FACTOR` variable is set
+        let deprecated_dpi_override = env::var("WINIT_HIDPI_FACTOR").ok();
+        if deprecated_dpi_override.is_some() {
+            warn!(
+                "The WINIT_HIDPI_FACTOR environment variable is deprecated; use \
+                 WINIT_X11_SCALE_FACTOR"
+            )
+        }
+        let dpi_env = env::var("WINIT_X11_SCALE_FACTOR").ok().map_or_else(
+            || EnvVarDPI::NotSet,
+            |var| {
+                if var.to_lowercase() == "randr" {
+                    EnvVarDPI::Randr
+                } else if let Ok(dpi) = f64::from_str(&var) {
+                    EnvVarDPI::Scale(dpi)
+                } else if var.is_empty() {
+                    EnvVarDPI::NotSet
+                } else {
+                    panic!(
+                        "`WINIT_X11_SCALE_FACTOR` invalid; DPI factors must be either normal \
+                         floats greater than 0, or `randr`. Got `{var}`"
+                    );
+                }
+            },
+        );
+
+        let scale_factor = match dpi_env {
+            EnvVarDPI::Randr => calc_dpi_factor(
+                (crtc.width.into(), crtc.height.into()),
+                (output_info.mm_width as _, output_info.mm_height as _),
+            ),
+            EnvVarDPI::Scale(dpi_override) => {
+                if !validate_scale_factor(dpi_override) {
+                    panic!(
+                        "`WINIT_X11_SCALE_FACTOR` invalid; DPI factors must be either normal \
+                         floats greater than 0, or `randr`. Got `{dpi_override}`",
+                    );
+                }
+                dpi_override
+            },
+            EnvVarDPI::NotSet => {
+                if let Some(dpi) = self.get_xft_dpi() {
+                    dpi / 96.
+                } else {
+                    calc_dpi_factor(
+                        (crtc.width.into(), crtc.height.into()),
+                        (output_info.mm_width as _, output_info.mm_height as _),
+                    )
+                }
+            },
+        };
+
+        Some((name, scale_factor, modes))
+    }
+
+    pub fn set_crtc_config(
+        &self,
+        crtc_id: randr::Crtc,
+        mode_id: randr::Mode,
+    ) -> Result<(), X11Error> {
+        let crtc =
+            self.xcb_connection().randr_get_crtc_info(crtc_id, x11rb::CURRENT_TIME)?.reply()?;
+
+        self.xcb_connection()
+            .randr_set_crtc_config(
+                crtc_id,
+                crtc.timestamp,
+                x11rb::CURRENT_TIME,
+                crtc.x,
+                crtc.y,
+                mode_id,
+                crtc.rotation,
+                &crtc.outputs,
+            )?
+            .reply()
+            .map(|_| ())
+            .map_err(Into::into)
+    }
+
+    pub fn get_crtc_mode(&self, crtc_id: randr::Crtc) -> Result<randr::Mode, X11Error> {
+        Ok(self.xcb_connection().randr_get_crtc_info(crtc_id, x11rb::CURRENT_TIME)?.reply()?.mode)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/window_property.rs b/vendor/winit/src/platform_impl/linux/x11/util/window_property.rs
new file mode 100644
index 00000000..0f4ca165
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/window_property.rs
@@ -0,0 +1,196 @@
+use std::error::Error;
+use std::fmt;
+use std::sync::Arc;
+
+use bytemuck::{NoUninit, Pod};
+
+use x11rb::connection::Connection;
+use x11rb::errors::ReplyError;
+
+use super::*;
+
+pub const CARDINAL_SIZE: usize = mem::size_of::<u32>();
+
+pub type Cardinal = u32;
+
+#[derive(Debug, Clone)]
+pub enum GetPropertyError {
+    X11rbError(Arc<ReplyError>),
+    TypeMismatch(xproto::Atom),
+    FormatMismatch(c_int),
+}
+
+impl GetPropertyError {
+    pub fn is_actual_property_type(&self, t: xproto::Atom) -> bool {
+        if let GetPropertyError::TypeMismatch(actual_type) = *self {
+            actual_type == t
+        } else {
+            false
+        }
+    }
+}
+
+impl<T: Into<ReplyError>> From<T> for GetPropertyError {
+    fn from(e: T) -> Self {
+        Self::X11rbError(Arc::new(e.into()))
+    }
+}
+
+impl fmt::Display for GetPropertyError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            GetPropertyError::X11rbError(err) => err.fmt(f),
+            GetPropertyError::TypeMismatch(err) => write!(f, "type mismatch: {err}"),
+            GetPropertyError::FormatMismatch(err) => write!(f, "format mismatch: {err}"),
+        }
+    }
+}
+
+impl Error for GetPropertyError {}
+
+// Number of 32-bit chunks to retrieve per iteration of get_property's inner loop.
+// To test if `get_property` works correctly, set this to 1.
+const PROPERTY_BUFFER_SIZE: u32 = 1024; // 4k of RAM ought to be enough for anyone!
+
+impl XConnection {
+    pub fn get_property<T: Pod>(
+        &self,
+        window: xproto::Window,
+        property: xproto::Atom,
+        property_type: xproto::Atom,
+    ) -> Result<Vec<T>, GetPropertyError> {
+        let mut iter = PropIterator::new(self.xcb_connection(), window, property, property_type);
+        let mut data = vec![];
+
+        loop {
+            if !iter.next_window(&mut data)? {
+                break;
+            }
+        }
+
+        Ok(data)
+    }
+
+    pub fn change_property<'a, T: NoUninit>(
+        &'a self,
+        window: xproto::Window,
+        property: xproto::Atom,
+        property_type: xproto::Atom,
+        mode: xproto::PropMode,
+        new_value: &[T],
+    ) -> Result<VoidCookie<'a>, X11Error> {
+        assert!([1usize, 2, 4].contains(&mem::size_of::<T>()));
+        self.xcb_connection()
+            .change_property(
+                mode,
+                window,
+                property,
+                property_type,
+                (mem::size_of::<T>() * 8) as u8,
+                new_value.len().try_into().expect("too many items for property"),
+                bytemuck::cast_slice::<T, u8>(new_value),
+            )
+            .map_err(Into::into)
+    }
+}
+
+/// An iterator over the "windows" of the property that we are fetching.
+struct PropIterator<'a, C: ?Sized, T> {
+    /// Handle to the connection.
+    conn: &'a C,
+
+    /// The window that we're fetching the property from.
+    window: xproto::Window,
+
+    /// The property that we're fetching.
+    property: xproto::Atom,
+
+    /// The type of the property that we're fetching.
+    property_type: xproto::Atom,
+
+    /// The offset of the next window, in 32-bit chunks.
+    offset: u32,
+
+    /// The format of the type.
+    format: u8,
+
+    /// Keep a reference to `T`.
+    _phantom: std::marker::PhantomData<T>,
+}
+
+impl<'a, C: Connection + ?Sized, T: Pod> PropIterator<'a, C, T> {
+    /// Create a new property iterator.
+    fn new(
+        conn: &'a C,
+        window: xproto::Window,
+        property: xproto::Atom,
+        property_type: xproto::Atom,
+    ) -> Self {
+        let format = match mem::size_of::<T>() {
+            1 => 8,
+            2 => 16,
+            4 => 32,
+            _ => unreachable!(),
+        };
+
+        Self {
+            conn,
+            window,
+            property,
+            property_type,
+            offset: 0,
+            format,
+            _phantom: Default::default(),
+        }
+    }
+
+    /// Get the next window and append it to `data`.
+    ///
+    /// Returns whether there are more windows to fetch.
+    fn next_window(&mut self, data: &mut Vec<T>) -> Result<bool, GetPropertyError> {
+        // Send the request and wait for the reply.
+        let reply = self
+            .conn
+            .get_property(
+                false,
+                self.window,
+                self.property,
+                self.property_type,
+                self.offset,
+                PROPERTY_BUFFER_SIZE,
+            )?
+            .reply()?;
+
+        // Make sure that the reply is of the correct type.
+        if reply.type_ != self.property_type {
+            return Err(GetPropertyError::TypeMismatch(reply.type_));
+        }
+
+        // Make sure that the reply is of the correct format.
+        if reply.format != self.format {
+            return Err(GetPropertyError::FormatMismatch(reply.format.into()));
+        }
+
+        // Append the data to the output.
+        if mem::size_of::<T>() == 1 && mem::align_of::<T>() == 1 {
+            // We can just do a bytewise append.
+            data.extend_from_slice(bytemuck::cast_slice(&reply.value));
+        } else {
+            // Rust's borrowing and types system makes this a bit tricky.
+            //
+            // We need to make sure that the data is properly aligned. Unfortunately the best
+            // safe way to do this is to copy the data to another buffer and then append.
+            //
+            // TODO(notgull): It may be worth it to use `unsafe` to copy directly from
+            // `reply.value` to `data`; check if this is faster. Use benchmarks!
+            let old_len = data.len();
+            let added_len = reply.value.len() / mem::size_of::<T>();
+            data.resize(old_len + added_len, T::zeroed());
+            bytemuck::cast_slice_mut::<T, u8>(&mut data[old_len..]).copy_from_slice(&reply.value);
+        }
+
+        // Check `bytes_after` to see if there are more windows to fetch.
+        self.offset += PROPERTY_BUFFER_SIZE;
+        Ok(reply.bytes_after != 0)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/wm.rs b/vendor/winit/src/platform_impl/linux/x11/util/wm.rs
new file mode 100644
index 00000000..be70b835
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/wm.rs
@@ -0,0 +1,137 @@
+use std::sync::Mutex;
+
+use super::*;
+
+// https://specifications.freedesktop.org/wm-spec/latest/ar01s04.html#idm46075117309248
+pub const MOVERESIZE_TOPLEFT: isize = 0;
+pub const MOVERESIZE_TOP: isize = 1;
+pub const MOVERESIZE_TOPRIGHT: isize = 2;
+pub const MOVERESIZE_RIGHT: isize = 3;
+pub const MOVERESIZE_BOTTOMRIGHT: isize = 4;
+pub const MOVERESIZE_BOTTOM: isize = 5;
+pub const MOVERESIZE_BOTTOMLEFT: isize = 6;
+pub const MOVERESIZE_LEFT: isize = 7;
+pub const MOVERESIZE_MOVE: isize = 8;
+
+// This info is global to the window manager.
+static SUPPORTED_HINTS: Mutex<Vec<xproto::Atom>> = Mutex::new(Vec::new());
+static WM_NAME: Mutex<Option<String>> = Mutex::new(None);
+
+pub fn hint_is_supported(hint: xproto::Atom) -> bool {
+    (*SUPPORTED_HINTS.lock().unwrap()).contains(&hint)
+}
+
+pub fn wm_name_is_one_of(names: &[&str]) -> bool {
+    if let Some(ref name) = *WM_NAME.lock().unwrap() {
+        names.contains(&name.as_str())
+    } else {
+        false
+    }
+}
+
+impl XConnection {
+    pub fn update_cached_wm_info(&self, root: xproto::Window) {
+        *SUPPORTED_HINTS.lock().unwrap() = self.get_supported_hints(root);
+        *WM_NAME.lock().unwrap() = self.get_wm_name(root);
+    }
+
+    fn get_supported_hints(&self, root: xproto::Window) -> Vec<xproto::Atom> {
+        let atoms = self.atoms();
+        let supported_atom = atoms[_NET_SUPPORTED];
+        self.get_property(root, supported_atom, xproto::Atom::from(xproto::AtomEnum::ATOM))
+            .unwrap_or_else(|_| Vec::with_capacity(0))
+    }
+
+    #[allow(clippy::useless_conversion)]
+    fn get_wm_name(&self, root: xproto::Window) -> Option<String> {
+        let atoms = self.atoms();
+        let check_atom = atoms[_NET_SUPPORTING_WM_CHECK];
+        let wm_name_atom = atoms[_NET_WM_NAME];
+
+        // Mutter/Muffin/Budgie doesn't have _NET_SUPPORTING_WM_CHECK in its _NET_SUPPORTED, despite
+        // it working and being supported. This has been reported upstream, but due to the
+        // inavailability of time machines, we'll just try to get _NET_SUPPORTING_WM_CHECK
+        // regardless of whether or not the WM claims to support it.
+        //
+        // Blackbox 0.70 also incorrectly reports not supporting this, though that appears to be
+        // fixed in 0.72.
+        // if !supported_hints.contains(&check_atom) {
+        // return None;
+        // }
+
+        // IceWM (1.3.x and earlier) doesn't report supporting _NET_WM_NAME, but will nonetheless
+        // provide us with a value for it. Note that the unofficial 1.4 fork of IceWM works fine.
+        // if !supported_hints.contains(&wm_name_atom) {
+        // return None;
+        // }
+
+        // Of the WMs tested, only xmonad and dwm fail to provide a WM name.
+
+        // Querying this property on the root window will give us the ID of a child window created
+        // by the WM.
+        let root_window_wm_check = {
+            let result = self.get_property::<xproto::Window>(
+                root,
+                check_atom,
+                xproto::Atom::from(xproto::AtomEnum::WINDOW),
+            );
+
+            let wm_check = result.ok().and_then(|wm_check| wm_check.first().cloned());
+
+            wm_check?
+        };
+
+        // Querying the same property on the child window we were given, we should get this child
+        // window's ID again.
+        let child_window_wm_check = {
+            let result = self.get_property::<xproto::Window>(
+                root_window_wm_check.into(),
+                check_atom,
+                xproto::Atom::from(xproto::AtomEnum::WINDOW),
+            );
+
+            let wm_check = result.ok().and_then(|wm_check| wm_check.first().cloned());
+
+            wm_check?
+        };
+
+        // These values should be the same.
+        if root_window_wm_check != child_window_wm_check {
+            return None;
+        }
+
+        // All of that work gives us a window ID that we can get the WM name from.
+        let wm_name = {
+            let atoms = self.atoms();
+            let utf8_string_atom = atoms[UTF8_STRING];
+
+            let result =
+                self.get_property(root_window_wm_check.into(), wm_name_atom, utf8_string_atom);
+
+            // IceWM requires this. IceWM was also the only WM tested that returns a null-terminated
+            // string. For more fun trivia, IceWM is also unique in including version and uname
+            // information in this string (this means you'll have to be careful if you want to match
+            // against it, though).
+            // The unofficial 1.4 fork of IceWM still includes the extra details, but properly
+            // returns a UTF8 string that isn't null-terminated.
+            let no_utf8 = if let Err(ref err) = result {
+                err.is_actual_property_type(xproto::Atom::from(xproto::AtomEnum::STRING))
+            } else {
+                false
+            };
+
+            if no_utf8 {
+                self.get_property(
+                    root_window_wm_check.into(),
+                    wm_name_atom,
+                    xproto::Atom::from(xproto::AtomEnum::STRING),
+                )
+            } else {
+                result
+            }
+        }
+        .ok();
+
+        wm_name.and_then(|wm_name| String::from_utf8(wm_name).ok())
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/util/xmodmap.rs b/vendor/winit/src/platform_impl/linux/x11/util/xmodmap.rs
new file mode 100644
index 00000000..565fd729
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/util/xmodmap.rs
@@ -0,0 +1,56 @@
+use std::collections::HashSet;
+use std::slice;
+
+use x11_dl::xlib::{KeyCode as XKeyCode, XModifierKeymap};
+
+// Offsets within XModifierKeymap to each set of keycodes.
+// We are only interested in Shift, Control, Alt, and Logo.
+//
+// There are 8 sets total. The order of keycode sets is:
+//     Shift, Lock, Control, Mod1 (Alt), Mod2, Mod3, Mod4 (Logo), Mod5
+//
+// https://tronche.com/gui/x/xlib/input/XSetModifierMapping.html
+const NUM_MODS: usize = 8;
+
+/// Track which keys are modifiers, so we can properly replay them when they were filtered.
+#[derive(Debug, Default)]
+pub struct ModifierKeymap {
+    // Maps keycodes to modifiers
+    modifiers: HashSet<XKeyCode>,
+}
+
+impl ModifierKeymap {
+    pub fn new() -> ModifierKeymap {
+        ModifierKeymap::default()
+    }
+
+    pub fn is_modifier(&self, keycode: XKeyCode) -> bool {
+        self.modifiers.contains(&keycode)
+    }
+
+    pub fn reload_from_x_connection(&mut self, xconn: &super::XConnection) {
+        unsafe {
+            let keymap = (xconn.xlib.XGetModifierMapping)(xconn.display);
+
+            if keymap.is_null() {
+                return;
+            }
+
+            self.reset_from_x_keymap(&*keymap);
+
+            (xconn.xlib.XFreeModifiermap)(keymap);
+        }
+    }
+
+    fn reset_from_x_keymap(&mut self, keymap: &XModifierKeymap) {
+        let keys_per_mod = keymap.max_keypermod as usize;
+
+        let keys = unsafe {
+            slice::from_raw_parts(keymap.modifiermap as *const _, keys_per_mod * NUM_MODS)
+        };
+        self.modifiers.clear();
+        for key in keys {
+            self.modifiers.insert(*key);
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/window.rs b/vendor/winit/src/platform_impl/linux/x11/window.rs
new file mode 100644
index 00000000..7e15d5f2
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/window.rs
@@ -0,0 +1,1938 @@
+use std::ffi::CString;
+use std::mem::replace;
+use std::os::raw::*;
+use std::path::Path;
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::{cmp, env};
+
+use tracing::{debug, info, warn};
+use x11rb::connection::Connection;
+use x11rb::properties::{WmHints, WmSizeHints, WmSizeHintsSpecification};
+use x11rb::protocol::shape::{ConnectionExt as ShapeExt, SK, SO};
+use x11rb::protocol::xproto::{self, ClipOrdering, ConnectionExt as _, Rectangle};
+use x11rb::protocol::{randr, xinput};
+
+use crate::cursor::{Cursor, CustomCursor as RootCustomCursor};
+use crate::dpi::{PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{ExternalError, NotSupportedError, OsError as RootOsError};
+use crate::event::{Event, InnerSizeWriter, WindowEvent};
+use crate::event_loop::AsyncRequestSerial;
+use crate::platform::x11::WindowType;
+use crate::platform_impl::x11::atoms::*;
+use crate::platform_impl::x11::{
+    xinput_fp1616_to_float, MonitorHandle as X11MonitorHandle, WakeSender, X11Error,
+};
+use crate::platform_impl::{
+    Fullscreen, MonitorHandle as PlatformMonitorHandle, OsError, PlatformCustomCursor,
+    PlatformIcon, VideoModeHandle as PlatformVideoModeHandle,
+};
+use crate::window::{
+    CursorGrabMode, ImePurpose, ResizeDirection, Theme, UserAttentionType, WindowAttributes,
+    WindowButtons, WindowLevel,
+};
+
+use super::util::{self, SelectedCursor};
+use super::{
+    ffi, ActiveEventLoop, CookieResultExt, ImeRequest, ImeSender, VoidCookie, WindowId, XConnection,
+};
+
+#[derive(Debug)]
+pub struct SharedState {
+    pub cursor_pos: Option<(f64, f64)>,
+    pub size: Option<(u32, u32)>,
+    pub position: Option<(i32, i32)>,
+    pub inner_position: Option<(i32, i32)>,
+    pub inner_position_rel_parent: Option<(i32, i32)>,
+    pub is_resizable: bool,
+    pub is_decorated: bool,
+    pub last_monitor: X11MonitorHandle,
+    pub dpi_adjusted: Option<(u32, u32)>,
+    pub(crate) fullscreen: Option<Fullscreen>,
+    // Set when application calls `set_fullscreen` when window is not visible
+    pub(crate) desired_fullscreen: Option<Option<Fullscreen>>,
+    // Used to restore position after exiting fullscreen
+    pub restore_position: Option<(i32, i32)>,
+    // Used to restore video mode after exiting fullscreen
+    pub desktop_video_mode: Option<(randr::Crtc, randr::Mode)>,
+    pub frame_extents: Option<util::FrameExtentsHeuristic>,
+    pub min_inner_size: Option<Size>,
+    pub max_inner_size: Option<Size>,
+    pub resize_increments: Option<Size>,
+    pub base_size: Option<Size>,
+    pub visibility: Visibility,
+    pub has_focus: bool,
+    // Use `Option` to not apply hittest logic when it was never requested.
+    pub cursor_hittest: Option<bool>,
+}
+
+#[derive(Copy, Clone, Debug, Eq, PartialEq)]
+pub enum Visibility {
+    No,
+    Yes,
+    // Waiting for VisibilityNotify
+    YesWait,
+}
+
+impl SharedState {
+    fn new(last_monitor: X11MonitorHandle, window_attributes: &WindowAttributes) -> Mutex<Self> {
+        let visibility =
+            if window_attributes.visible { Visibility::YesWait } else { Visibility::No };
+
+        Mutex::new(SharedState {
+            last_monitor,
+            visibility,
+
+            is_resizable: window_attributes.resizable,
+            is_decorated: window_attributes.decorations,
+            cursor_pos: None,
+            size: None,
+            position: None,
+            inner_position: None,
+            inner_position_rel_parent: None,
+            dpi_adjusted: None,
+            fullscreen: None,
+            desired_fullscreen: None,
+            restore_position: None,
+            desktop_video_mode: None,
+            frame_extents: None,
+            min_inner_size: None,
+            max_inner_size: None,
+            resize_increments: None,
+            base_size: None,
+            has_focus: false,
+            cursor_hittest: None,
+        })
+    }
+}
+
+unsafe impl Send for UnownedWindow {}
+unsafe impl Sync for UnownedWindow {}
+
+pub struct UnownedWindow {
+    pub(crate) xconn: Arc<XConnection>, // never changes
+    xwindow: xproto::Window,            // never changes
+    #[allow(dead_code)]
+    visual: u32, // never changes
+    root: xproto::Window,               // never changes
+    #[allow(dead_code)]
+    screen_id: i32, // never changes
+    selected_cursor: Mutex<SelectedCursor>,
+    cursor_grabbed_mode: Mutex<CursorGrabMode>,
+    #[allow(clippy::mutex_atomic)]
+    cursor_visible: Mutex<bool>,
+    ime_sender: Mutex<ImeSender>,
+    pub shared_state: Mutex<SharedState>,
+    redraw_sender: WakeSender<WindowId>,
+    activation_sender: WakeSender<super::ActivationToken>,
+}
+
+macro_rules! leap {
+    ($e:expr) => {
+        match $e {
+            Ok(x) => x,
+            Err(err) => return Err(os_error!(OsError::XError(X11Error::from(err).into()))),
+        }
+    };
+}
+
+impl UnownedWindow {
+    #[allow(clippy::unnecessary_cast)]
+    pub(crate) fn new(
+        event_loop: &ActiveEventLoop,
+        window_attrs: WindowAttributes,
+    ) -> Result<UnownedWindow, RootOsError> {
+        let xconn = &event_loop.xconn;
+        let atoms = xconn.atoms();
+
+        let screen_id = match window_attrs.platform_specific.x11.screen_id {
+            Some(id) => id,
+            None => xconn.default_screen_index() as c_int,
+        };
+
+        let screen = {
+            let screen_id_usize = usize::try_from(screen_id)
+                .map_err(|_| os_error!(OsError::Misc("screen id must be non-negative")))?;
+            xconn.xcb_connection().setup().roots.get(screen_id_usize).ok_or(os_error!(
+                OsError::Misc("requested screen id not present in server's response")
+            ))?
+        };
+
+        #[cfg(feature = "rwh_06")]
+        let root = match window_attrs.parent_window.as_ref().map(|handle| handle.0) {
+            Some(rwh_06::RawWindowHandle::Xlib(handle)) => handle.window as xproto::Window,
+            Some(rwh_06::RawWindowHandle::Xcb(handle)) => handle.window.get(),
+            Some(raw) => unreachable!("Invalid raw window handle {raw:?} on X11"),
+            None => screen.root,
+        };
+        #[cfg(not(feature = "rwh_06"))]
+        let root = event_loop.root;
+
+        let mut monitors = leap!(xconn.available_monitors());
+        let guessed_monitor = if monitors.is_empty() {
+            X11MonitorHandle::dummy()
+        } else {
+            xconn
+                .query_pointer(root, util::VIRTUAL_CORE_POINTER)
+                .ok()
+                .and_then(|pointer_state| {
+                    let (x, y) = (pointer_state.root_x as i64, pointer_state.root_y as i64);
+
+                    for i in 0..monitors.len() {
+                        if monitors[i].rect.contains_point(x, y) {
+                            return Some(monitors.swap_remove(i));
+                        }
+                    }
+
+                    None
+                })
+                .unwrap_or_else(|| monitors.swap_remove(0))
+        };
+        let scale_factor = guessed_monitor.scale_factor();
+
+        info!("Guessed window scale factor: {}", scale_factor);
+
+        let max_inner_size: Option<(u32, u32)> =
+            window_attrs.max_inner_size.map(|size| size.to_physical::<u32>(scale_factor).into());
+        let min_inner_size: Option<(u32, u32)> =
+            window_attrs.min_inner_size.map(|size| size.to_physical::<u32>(scale_factor).into());
+
+        let position =
+            window_attrs.position.map(|position| position.to_physical::<i32>(scale_factor));
+
+        let dimensions = {
+            // x11 only applies constraints when the window is actively resized
+            // by the user, so we have to manually apply the initial constraints
+            let mut dimensions: (u32, u32) = window_attrs
+                .inner_size
+                .map(|size| size.to_physical::<u32>(scale_factor))
+                .or_else(|| Some((800, 600).into()))
+                .map(Into::into)
+                .unwrap();
+            if let Some(max) = max_inner_size {
+                dimensions.0 = cmp::min(dimensions.0, max.0);
+                dimensions.1 = cmp::min(dimensions.1, max.1);
+            }
+            if let Some(min) = min_inner_size {
+                dimensions.0 = cmp::max(dimensions.0, min.0);
+                dimensions.1 = cmp::max(dimensions.1, min.1);
+            }
+            debug!("Calculated physical dimensions: {}x{}", dimensions.0, dimensions.1);
+            dimensions
+        };
+
+        // An iterator over the visuals matching screen id combined with their depths.
+        let mut all_visuals = screen
+            .allowed_depths
+            .iter()
+            .flat_map(|depth| depth.visuals.iter().map(move |visual| (visual, depth.depth)));
+
+        // creating
+        let (visualtype, depth, require_colormap) =
+            match window_attrs.platform_specific.x11.visual_id {
+                Some(vi) => {
+                    // Find this specific visual.
+                    let (visualtype, depth) =
+                        all_visuals.find(|(visual, _)| visual.visual_id == vi).ok_or_else(
+                            || os_error!(OsError::XError(X11Error::NoSuchVisual(vi).into())),
+                        )?;
+
+                    (Some(visualtype), depth, true)
+                },
+                None if window_attrs.transparent => {
+                    // Find a suitable visual, true color with 32 bits of depth.
+                    all_visuals
+                        .find_map(|(visual, depth)| {
+                            (depth == 32 && visual.class == xproto::VisualClass::TRUE_COLOR)
+                                .then_some((Some(visual), depth, true))
+                        })
+                        .unwrap_or_else(|| {
+                            debug!(
+                                "Could not set transparency, because XMatchVisualInfo returned \
+                                 zero for the required parameters"
+                            );
+                            (None as _, x11rb::COPY_FROM_PARENT as _, false)
+                        })
+                },
+                _ => (None, x11rb::COPY_FROM_PARENT as _, false),
+            };
+        let mut visual = visualtype.map_or(x11rb::COPY_FROM_PARENT, |v| v.visual_id);
+
+        let window_attributes = {
+            use xproto::EventMask;
+
+            let mut aux = xproto::CreateWindowAux::new();
+            let event_mask = EventMask::EXPOSURE
+                | EventMask::STRUCTURE_NOTIFY
+                | EventMask::VISIBILITY_CHANGE
+                | EventMask::KEY_PRESS
+                | EventMask::KEY_RELEASE
+                | EventMask::KEYMAP_STATE
+                | EventMask::BUTTON_PRESS
+                | EventMask::BUTTON_RELEASE
+                | EventMask::POINTER_MOTION
+                | EventMask::PROPERTY_CHANGE;
+
+            aux = aux.event_mask(event_mask).border_pixel(0);
+
+            if window_attrs.platform_specific.x11.override_redirect {
+                aux = aux.override_redirect(true as u32);
+            }
+
+            // Add a colormap if needed.
+            let colormap_visual = match window_attrs.platform_specific.x11.visual_id {
+                Some(vi) => Some(vi),
+                None if require_colormap => Some(visual),
+                _ => None,
+            };
+
+            if let Some(visual) = colormap_visual {
+                let colormap = leap!(xconn.xcb_connection().generate_id());
+                leap!(xconn.xcb_connection().create_colormap(
+                    xproto::ColormapAlloc::NONE,
+                    colormap,
+                    root,
+                    visual,
+                ));
+                aux = aux.colormap(colormap);
+            } else {
+                aux = aux.colormap(0);
+            }
+
+            aux
+        };
+
+        // Figure out the window's parent.
+        let parent = window_attrs.platform_specific.x11.embed_window.unwrap_or(root);
+
+        // finally creating the window
+        let xwindow = {
+            let (x, y) = position.map_or((0, 0), Into::into);
+            let wid = leap!(xconn.xcb_connection().generate_id());
+            let result = xconn.xcb_connection().create_window(
+                depth,
+                wid,
+                parent,
+                x,
+                y,
+                dimensions.0.try_into().unwrap(),
+                dimensions.1.try_into().unwrap(),
+                0,
+                xproto::WindowClass::INPUT_OUTPUT,
+                visual,
+                &window_attributes,
+            );
+            leap!(leap!(result).check());
+
+            wid
+        };
+
+        // The COPY_FROM_PARENT is a special value for the visual used to copy
+        // the visual from the parent window, thus we have to query the visual
+        // we've got when we built the window above.
+        if visual == x11rb::COPY_FROM_PARENT {
+            visual = leap!(leap!(xconn
+                .xcb_connection()
+                .get_window_attributes(xwindow as xproto::Window))
+            .reply())
+            .visual;
+        }
+
+        #[allow(clippy::mutex_atomic)]
+        let mut window = UnownedWindow {
+            xconn: Arc::clone(xconn),
+            xwindow: xwindow as xproto::Window,
+            visual,
+            root,
+            screen_id,
+            selected_cursor: Default::default(),
+            cursor_grabbed_mode: Mutex::new(CursorGrabMode::None),
+            cursor_visible: Mutex::new(true),
+            ime_sender: Mutex::new(event_loop.ime_sender.clone()),
+            shared_state: SharedState::new(guessed_monitor, &window_attrs),
+            redraw_sender: event_loop.redraw_sender.clone(),
+            activation_sender: event_loop.activation_sender.clone(),
+        };
+
+        // Title must be set before mapping. Some tiling window managers (i.e. i3) use the window
+        // title to determine placement/etc., so doing this after mapping would cause the WM to
+        // act on the wrong title state.
+        leap!(window.set_title_inner(&window_attrs.title)).ignore_error();
+        leap!(window.set_decorations_inner(window_attrs.decorations)).ignore_error();
+
+        if let Some(theme) = window_attrs.preferred_theme {
+            leap!(window.set_theme_inner(Some(theme))).ignore_error();
+        }
+
+        // Embed the window if needed.
+        if window_attrs.platform_specific.x11.embed_window.is_some() {
+            window.embed_window()?;
+        }
+
+        {
+            // Enable drag and drop (TODO: extend API to make this toggleable)
+            {
+                let dnd_aware_atom = atoms[XdndAware];
+                let version = &[5u32]; // Latest version; hasn't changed since 2002
+                leap!(xconn.change_property(
+                    window.xwindow,
+                    dnd_aware_atom,
+                    u32::from(xproto::AtomEnum::ATOM),
+                    xproto::PropMode::REPLACE,
+                    version,
+                ))
+                .ignore_error();
+            }
+
+            // WM_CLASS must be set *before* mapping the window, as per ICCCM!
+            {
+                let (instance, class) = if let Some(name) = window_attrs.platform_specific.name {
+                    (name.instance, name.general)
+                } else {
+                    let class = env::args_os()
+                        .next()
+                        .as_ref()
+                        // Default to the name of the binary (via argv[0])
+                        .and_then(|path| Path::new(path).file_name())
+                        .and_then(|bin_name| bin_name.to_str())
+                        .map(|bin_name| bin_name.to_owned())
+                        .unwrap_or_else(|| window_attrs.title.clone());
+                    // This environment variable is extraordinarily unlikely to actually be used...
+                    let instance = env::var("RESOURCE_NAME").ok().unwrap_or_else(|| class.clone());
+                    (instance, class)
+                };
+
+                let class = format!("{instance}\0{class}\0");
+                leap!(xconn.change_property(
+                    window.xwindow,
+                    xproto::Atom::from(xproto::AtomEnum::WM_CLASS),
+                    xproto::Atom::from(xproto::AtomEnum::STRING),
+                    xproto::PropMode::REPLACE,
+                    class.as_bytes(),
+                ))
+                .ignore_error();
+            }
+
+            if let Some(flusher) = leap!(window.set_pid()) {
+                flusher.ignore_error()
+            }
+
+            leap!(window.set_window_types(window_attrs.platform_specific.x11.x11_window_types))
+                .ignore_error();
+
+            // Set size hints.
+            let mut min_inner_size =
+                window_attrs.min_inner_size.map(|size| size.to_physical::<u32>(scale_factor));
+            let mut max_inner_size =
+                window_attrs.max_inner_size.map(|size| size.to_physical::<u32>(scale_factor));
+
+            if !window_attrs.resizable {
+                if util::wm_name_is_one_of(&["Xfwm4"]) {
+                    warn!("To avoid a WM bug, disabling resizing has no effect on Xfwm4");
+                } else {
+                    max_inner_size = Some(dimensions.into());
+                    min_inner_size = Some(dimensions.into());
+                }
+            }
+
+            let shared_state = window.shared_state.get_mut().unwrap();
+            shared_state.min_inner_size = min_inner_size.map(Into::into);
+            shared_state.max_inner_size = max_inner_size.map(Into::into);
+            shared_state.resize_increments = window_attrs.resize_increments;
+            shared_state.base_size = window_attrs.platform_specific.x11.base_size;
+
+            let normal_hints = WmSizeHints {
+                position: position.map(|PhysicalPosition { x, y }| {
+                    (WmSizeHintsSpecification::UserSpecified, x, y)
+                }),
+                size: Some((
+                    WmSizeHintsSpecification::UserSpecified,
+                    cast_dimension_to_hint(dimensions.0),
+                    cast_dimension_to_hint(dimensions.1),
+                )),
+                max_size: max_inner_size.map(cast_physical_size_to_hint),
+                min_size: min_inner_size.map(cast_physical_size_to_hint),
+                size_increment: window_attrs
+                    .resize_increments
+                    .map(|size| cast_size_to_hint(size, scale_factor)),
+                base_size: window_attrs
+                    .platform_specific
+                    .x11
+                    .base_size
+                    .map(|size| cast_size_to_hint(size, scale_factor)),
+                aspect: None,
+                win_gravity: None,
+            };
+            leap!(leap!(normal_hints.set(
+                xconn.xcb_connection(),
+                window.xwindow as xproto::Window,
+                xproto::AtomEnum::WM_NORMAL_HINTS,
+            ))
+            .check());
+
+            // Set window icons
+            if let Some(icon) = window_attrs.window_icon {
+                leap!(window.set_icon_inner(icon.inner)).ignore_error();
+            }
+
+            // Opt into handling window close
+            let result = xconn.xcb_connection().change_property(
+                xproto::PropMode::REPLACE,
+                window.xwindow,
+                atoms[WM_PROTOCOLS],
+                xproto::AtomEnum::ATOM,
+                32,
+                2,
+                bytemuck::cast_slice::<xproto::Atom, u8>(&[
+                    atoms[WM_DELETE_WINDOW],
+                    atoms[_NET_WM_PING],
+                ]),
+            );
+            leap!(result).ignore_error();
+
+            // Select XInput2 events
+            let mask = xinput::XIEventMask::MOTION
+                | xinput::XIEventMask::BUTTON_PRESS
+                | xinput::XIEventMask::BUTTON_RELEASE
+                | xinput::XIEventMask::ENTER
+                | xinput::XIEventMask::LEAVE
+                | xinput::XIEventMask::FOCUS_IN
+                | xinput::XIEventMask::FOCUS_OUT
+                | xinput::XIEventMask::TOUCH_BEGIN
+                | xinput::XIEventMask::TOUCH_UPDATE
+                | xinput::XIEventMask::TOUCH_END;
+            leap!(xconn.select_xinput_events(window.xwindow, super::ALL_MASTER_DEVICES, mask))
+                .ignore_error();
+
+            // Set visibility (map window)
+            if window_attrs.visible {
+                leap!(xconn.xcb_connection().map_window(window.xwindow)).ignore_error();
+                leap!(xconn.xcb_connection().configure_window(
+                    xwindow,
+                    &xproto::ConfigureWindowAux::new().stack_mode(xproto::StackMode::ABOVE)
+                ))
+                .ignore_error();
+            }
+
+            // Attempt to make keyboard input repeat detectable
+            unsafe {
+                let mut supported_ptr = ffi::False;
+                (xconn.xlib.XkbSetDetectableAutoRepeat)(
+                    xconn.display,
+                    ffi::True,
+                    &mut supported_ptr,
+                );
+                if supported_ptr == ffi::False {
+                    return Err(os_error!(OsError::Misc("`XkbSetDetectableAutoRepeat` failed")));
+                }
+            }
+
+            // Try to create input context for the window.
+            if let Some(ime) = event_loop.ime.as_ref() {
+                let result = ime.borrow_mut().create_context(window.xwindow as ffi::Window, false);
+                leap!(result);
+            }
+
+            // These properties must be set after mapping
+            if window_attrs.maximized {
+                leap!(window.set_maximized_inner(window_attrs.maximized)).ignore_error();
+            }
+            if window_attrs.fullscreen.is_some() {
+                if let Some(flusher) =
+                    leap!(window
+                        .set_fullscreen_inner(window_attrs.fullscreen.clone().map(Into::into)))
+                {
+                    flusher.ignore_error()
+                }
+
+                if let Some(PhysicalPosition { x, y }) = position {
+                    let shared_state = window.shared_state.get_mut().unwrap();
+
+                    shared_state.restore_position = Some((x, y));
+                }
+            }
+
+            leap!(window.set_window_level_inner(window_attrs.window_level)).ignore_error();
+        }
+
+        window.set_cursor(window_attrs.cursor);
+
+        // Remove the startup notification if we have one.
+        if let Some(startup) = window_attrs.platform_specific.activation_token.as_ref() {
+            leap!(xconn.remove_activation_token(xwindow, &startup.token));
+        }
+
+        // We never want to give the user a broken window, since by then, it's too late to handle.
+        let window = leap!(xconn.sync_with_server().map(|_| window));
+
+        Ok(window)
+    }
+
+    /// Embed this window into a parent window.
+    pub(super) fn embed_window(&self) -> Result<(), RootOsError> {
+        let atoms = self.xconn.atoms();
+        leap!(leap!(self.xconn.change_property(
+            self.xwindow,
+            atoms[_XEMBED],
+            atoms[_XEMBED],
+            xproto::PropMode::REPLACE,
+            &[0u32, 1u32],
+        ))
+        .check());
+
+        Ok(())
+    }
+
+    pub(super) fn shared_state_lock(&self) -> MutexGuard<'_, SharedState> {
+        self.shared_state.lock().unwrap()
+    }
+
+    fn set_pid(&self) -> Result<Option<VoidCookie<'_>>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let pid_atom = atoms[_NET_WM_PID];
+        let client_machine_atom = atoms[WM_CLIENT_MACHINE];
+
+        // Get the hostname and the PID.
+        let uname = rustix::system::uname();
+        let pid = rustix::process::getpid();
+
+        self.xconn
+            .change_property(
+                self.xwindow,
+                pid_atom,
+                xproto::Atom::from(xproto::AtomEnum::CARDINAL),
+                xproto::PropMode::REPLACE,
+                &[pid.as_raw_nonzero().get() as util::Cardinal],
+            )?
+            .ignore_error();
+        let flusher = self.xconn.change_property(
+            self.xwindow,
+            client_machine_atom,
+            xproto::Atom::from(xproto::AtomEnum::STRING),
+            xproto::PropMode::REPLACE,
+            uname.nodename().to_bytes(),
+        );
+        flusher.map(Some)
+    }
+
+    fn set_window_types(&self, window_types: Vec<WindowType>) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let hint_atom = atoms[_NET_WM_WINDOW_TYPE];
+        let atoms: Vec<_> = window_types.iter().map(|t| t.as_atom(&self.xconn)).collect();
+
+        self.xconn.change_property(
+            self.xwindow,
+            hint_atom,
+            xproto::Atom::from(xproto::AtomEnum::ATOM),
+            xproto::PropMode::REPLACE,
+            &atoms,
+        )
+    }
+
+    pub fn set_theme_inner(&self, theme: Option<Theme>) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let hint_atom = atoms[_GTK_THEME_VARIANT];
+        let utf8_atom = atoms[UTF8_STRING];
+        let variant = match theme {
+            Some(Theme::Dark) => "dark",
+            Some(Theme::Light) => "light",
+            None => "dark",
+        };
+        let variant = CString::new(variant).expect("`_GTK_THEME_VARIANT` contained null byte");
+        self.xconn.change_property(
+            self.xwindow,
+            hint_atom,
+            utf8_atom,
+            xproto::PropMode::REPLACE,
+            variant.as_bytes(),
+        )
+    }
+
+    #[inline]
+    pub fn set_theme(&self, theme: Option<Theme>) {
+        self.set_theme_inner(theme).expect("Failed to change window theme").ignore_error();
+
+        self.xconn.flush_requests().expect("Failed to change window theme");
+    }
+
+    fn set_netwm(
+        &self,
+        operation: util::StateOperation,
+        properties: (u32, u32, u32, u32),
+    ) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let state_atom = atoms[_NET_WM_STATE];
+        self.xconn.send_client_msg(
+            self.xwindow,
+            self.root,
+            state_atom,
+            Some(xproto::EventMask::SUBSTRUCTURE_REDIRECT | xproto::EventMask::SUBSTRUCTURE_NOTIFY),
+            [operation as u32, properties.0, properties.1, properties.2, properties.3],
+        )
+    }
+
+    fn set_fullscreen_hint(&self, fullscreen: bool) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let fullscreen_atom = atoms[_NET_WM_STATE_FULLSCREEN];
+        let flusher = self.set_netwm(fullscreen.into(), (fullscreen_atom, 0, 0, 0));
+
+        if fullscreen {
+            // Ensure that the fullscreen window receives input focus to prevent
+            // locking up the user's display.
+            self.xconn
+                .xcb_connection()
+                .set_input_focus(xproto::InputFocus::PARENT, self.xwindow, x11rb::CURRENT_TIME)?
+                .ignore_error();
+        }
+
+        flusher
+    }
+
+    fn set_fullscreen_inner(
+        &self,
+        fullscreen: Option<Fullscreen>,
+    ) -> Result<Option<VoidCookie<'_>>, X11Error> {
+        let mut shared_state_lock = self.shared_state_lock();
+
+        match shared_state_lock.visibility {
+            // Setting fullscreen on a window that is not visible will generate an error.
+            Visibility::No | Visibility::YesWait => {
+                shared_state_lock.desired_fullscreen = Some(fullscreen);
+                return Ok(None);
+            },
+            Visibility::Yes => (),
+        }
+
+        let old_fullscreen = shared_state_lock.fullscreen.clone();
+        if old_fullscreen == fullscreen {
+            return Ok(None);
+        }
+        shared_state_lock.fullscreen.clone_from(&fullscreen);
+
+        match (&old_fullscreen, &fullscreen) {
+            // Store the desktop video mode before entering exclusive
+            // fullscreen, so we can restore it upon exit, as XRandR does not
+            // provide a mechanism to set this per app-session or restore this
+            // to the desktop video mode as macOS and Windows do
+            (&None, &Some(Fullscreen::Exclusive(PlatformVideoModeHandle::X(ref video_mode))))
+            | (
+                &Some(Fullscreen::Borderless(_)),
+                &Some(Fullscreen::Exclusive(PlatformVideoModeHandle::X(ref video_mode))),
+            ) => {
+                let monitor = video_mode.monitor.as_ref().unwrap();
+                shared_state_lock.desktop_video_mode = Some((
+                    monitor.id,
+                    self.xconn.get_crtc_mode(monitor.id).expect("Failed to get desktop video mode"),
+                ));
+            },
+            // Restore desktop video mode upon exiting exclusive fullscreen
+            (&Some(Fullscreen::Exclusive(_)), &None)
+            | (&Some(Fullscreen::Exclusive(_)), &Some(Fullscreen::Borderless(_))) => {
+                let (monitor_id, mode_id) = shared_state_lock.desktop_video_mode.take().unwrap();
+                self.xconn
+                    .set_crtc_config(monitor_id, mode_id)
+                    .expect("failed to restore desktop video mode");
+            },
+            _ => (),
+        }
+
+        drop(shared_state_lock);
+
+        match fullscreen {
+            None => {
+                let flusher = self.set_fullscreen_hint(false);
+                let mut shared_state_lock = self.shared_state_lock();
+                if let Some(position) = shared_state_lock.restore_position.take() {
+                    drop(shared_state_lock);
+                    self.set_position_inner(position.0, position.1)
+                        .expect_then_ignore_error("Failed to restore window position");
+                }
+                flusher.map(Some)
+            },
+            Some(fullscreen) => {
+                let (video_mode, monitor) = match fullscreen {
+                    Fullscreen::Exclusive(PlatformVideoModeHandle::X(ref video_mode)) => {
+                        (Some(video_mode), video_mode.monitor.clone().unwrap())
+                    },
+                    Fullscreen::Borderless(Some(PlatformMonitorHandle::X(monitor))) => {
+                        (None, monitor)
+                    },
+                    Fullscreen::Borderless(None) => {
+                        (None, self.shared_state_lock().last_monitor.clone())
+                    },
+                    #[cfg(wayland_platform)]
+                    _ => unreachable!(),
+                };
+
+                // Don't set fullscreen on an invalid dummy monitor handle
+                if monitor.is_dummy() {
+                    return Ok(None);
+                }
+
+                if let Some(video_mode) = video_mode {
+                    // FIXME: this is actually not correct if we're setting the
+                    // video mode to a resolution higher than the current
+                    // desktop resolution, because XRandR does not automatically
+                    // reposition the monitors to the right and below this
+                    // monitor.
+                    //
+                    // What ends up happening is we will get the fullscreen
+                    // window showing up on those monitors as well, because
+                    // their virtual position now overlaps with the monitor that
+                    // we just made larger..
+                    //
+                    // It'd be quite a bit of work to handle this correctly (and
+                    // nobody else seems to bother doing this correctly either),
+                    // so we're just leaving this broken. Fixing this would
+                    // involve storing all CRTCs upon entering fullscreen,
+                    // restoring them upon exit, and after entering fullscreen,
+                    // repositioning displays to the right and below this
+                    // display. I think there would still be edge cases that are
+                    // difficult or impossible to handle correctly, e.g. what if
+                    // a new monitor was plugged in while in fullscreen?
+                    //
+                    // I think we might just want to disallow setting the video
+                    // mode higher than the current desktop video mode (I'm sure
+                    // this will make someone unhappy, but it's very unusual for
+                    // games to want to do this anyway).
+                    self.xconn
+                        .set_crtc_config(monitor.id, video_mode.native_mode)
+                        .expect("failed to set video mode");
+                }
+
+                let window_position = self.outer_position_physical();
+                self.shared_state_lock().restore_position = Some(window_position);
+                let monitor_origin: (i32, i32) = monitor.position().into();
+                self.set_position_inner(monitor_origin.0, monitor_origin.1)
+                    .expect_then_ignore_error("Failed to set window position");
+                self.set_fullscreen_hint(true).map(Some)
+            },
+        }
+    }
+
+    #[inline]
+    pub(crate) fn fullscreen(&self) -> Option<Fullscreen> {
+        let shared_state = self.shared_state_lock();
+
+        shared_state.desired_fullscreen.clone().unwrap_or_else(|| shared_state.fullscreen.clone())
+    }
+
+    #[inline]
+    pub(crate) fn set_fullscreen(&self, fullscreen: Option<Fullscreen>) {
+        if let Some(flusher) =
+            self.set_fullscreen_inner(fullscreen).expect("Failed to change window fullscreen state")
+        {
+            flusher.check().expect("Failed to change window fullscreen state");
+            self.invalidate_cached_frame_extents();
+        }
+    }
+
+    // Called by EventProcessor when a VisibilityNotify event is received
+    pub(crate) fn visibility_notify(&self) {
+        let mut shared_state = self.shared_state_lock();
+
+        match shared_state.visibility {
+            Visibility::No => self
+                .xconn
+                .xcb_connection()
+                .unmap_window(self.xwindow)
+                .expect_then_ignore_error("Failed to unmap window"),
+            Visibility::Yes => (),
+            Visibility::YesWait => {
+                shared_state.visibility = Visibility::Yes;
+
+                if let Some(fullscreen) = shared_state.desired_fullscreen.take() {
+                    drop(shared_state);
+                    self.set_fullscreen(fullscreen);
+                }
+            },
+        }
+    }
+
+    pub fn current_monitor(&self) -> Option<X11MonitorHandle> {
+        Some(self.shared_state_lock().last_monitor.clone())
+    }
+
+    pub fn available_monitors(&self) -> Vec<X11MonitorHandle> {
+        self.xconn.available_monitors().expect("Failed to get available monitors")
+    }
+
+    pub fn primary_monitor(&self) -> Option<X11MonitorHandle> {
+        Some(self.xconn.primary_monitor().expect("Failed to get primary monitor"))
+    }
+
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        let atoms = self.xconn.atoms();
+        let state_atom = atoms[_NET_WM_STATE];
+        let state = self.xconn.get_property(
+            self.xwindow,
+            state_atom,
+            xproto::Atom::from(xproto::AtomEnum::ATOM),
+        );
+        let hidden_atom = atoms[_NET_WM_STATE_HIDDEN];
+
+        Some(match state {
+            Ok(atoms) => {
+                atoms.iter().any(|atom: &xproto::Atom| *atom as xproto::Atom == hidden_atom)
+            },
+            _ => false,
+        })
+    }
+
+    /// Refresh the API for the given monitor.
+    #[inline]
+    pub(super) fn refresh_dpi_for_monitor<T: 'static>(
+        &self,
+        new_monitor: &X11MonitorHandle,
+        maybe_prev_scale_factor: Option<f64>,
+        mut callback: impl FnMut(Event<T>),
+    ) {
+        // Check if the self is on this monitor
+        let monitor = self.shared_state_lock().last_monitor.clone();
+        if monitor.name == new_monitor.name {
+            let (width, height) = self.inner_size_physical();
+            let (new_width, new_height) = self.adjust_for_dpi(
+                // If we couldn't determine the previous scale
+                // factor (e.g., because all monitors were closed
+                // before), just pick whatever the current monitor
+                // has set as a baseline.
+                maybe_prev_scale_factor.unwrap_or(monitor.scale_factor),
+                new_monitor.scale_factor,
+                width,
+                height,
+                &self.shared_state_lock(),
+            );
+
+            let window_id = crate::window::WindowId(self.id());
+            let old_inner_size = PhysicalSize::new(width, height);
+            let inner_size = Arc::new(Mutex::new(PhysicalSize::new(new_width, new_height)));
+            callback(Event::WindowEvent {
+                window_id,
+                event: WindowEvent::ScaleFactorChanged {
+                    scale_factor: new_monitor.scale_factor,
+                    inner_size_writer: InnerSizeWriter::new(Arc::downgrade(&inner_size)),
+                },
+            });
+
+            let new_inner_size = *inner_size.lock().unwrap();
+            drop(inner_size);
+
+            if new_inner_size != old_inner_size {
+                let (new_width, new_height) = new_inner_size.into();
+                self.request_inner_size_physical(new_width, new_height);
+            }
+        }
+    }
+
+    fn set_minimized_inner(&self, minimized: bool) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+
+        if minimized {
+            let root_window = self.xconn.default_root().root;
+
+            self.xconn.send_client_msg(
+                self.xwindow,
+                root_window,
+                atoms[WM_CHANGE_STATE],
+                Some(
+                    xproto::EventMask::SUBSTRUCTURE_REDIRECT
+                        | xproto::EventMask::SUBSTRUCTURE_NOTIFY,
+                ),
+                [3u32, 0, 0, 0, 0],
+            )
+        } else {
+            self.xconn.send_client_msg(
+                self.xwindow,
+                self.root,
+                atoms[_NET_ACTIVE_WINDOW],
+                Some(
+                    xproto::EventMask::SUBSTRUCTURE_REDIRECT
+                        | xproto::EventMask::SUBSTRUCTURE_NOTIFY,
+                ),
+                [1, x11rb::CURRENT_TIME, 0, 0, 0],
+            )
+        }
+    }
+
+    #[inline]
+    pub fn set_minimized(&self, minimized: bool) {
+        self.set_minimized_inner(minimized)
+            .expect_then_ignore_error("Failed to change window minimization");
+
+        self.xconn.flush_requests().expect("Failed to change window minimization");
+    }
+
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        let atoms = self.xconn.atoms();
+        let state_atom = atoms[_NET_WM_STATE];
+        let state = self.xconn.get_property(
+            self.xwindow,
+            state_atom,
+            xproto::Atom::from(xproto::AtomEnum::ATOM),
+        );
+        let horz_atom = atoms[_NET_WM_STATE_MAXIMIZED_HORZ];
+        let vert_atom = atoms[_NET_WM_STATE_MAXIMIZED_VERT];
+        match state {
+            Ok(atoms) => {
+                let horz_maximized = atoms.contains(&horz_atom);
+                let vert_maximized = atoms.contains(&vert_atom);
+                horz_maximized && vert_maximized
+            },
+            _ => false,
+        }
+    }
+
+    fn set_maximized_inner(&self, maximized: bool) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let horz_atom = atoms[_NET_WM_STATE_MAXIMIZED_HORZ];
+        let vert_atom = atoms[_NET_WM_STATE_MAXIMIZED_VERT];
+
+        self.set_netwm(maximized.into(), (horz_atom, vert_atom, 0, 0))
+    }
+
+    #[inline]
+    pub fn set_maximized(&self, maximized: bool) {
+        self.set_maximized_inner(maximized)
+            .expect_then_ignore_error("Failed to change window maximization");
+        self.xconn.flush_requests().expect("Failed to change window maximization");
+        self.invalidate_cached_frame_extents();
+    }
+
+    fn set_title_inner(&self, title: &str) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+
+        let title = CString::new(title).expect("Window title contained null byte");
+        self.xconn
+            .change_property(
+                self.xwindow,
+                xproto::Atom::from(xproto::AtomEnum::WM_NAME),
+                xproto::Atom::from(xproto::AtomEnum::STRING),
+                xproto::PropMode::REPLACE,
+                title.as_bytes(),
+            )?
+            .ignore_error();
+        self.xconn.change_property(
+            self.xwindow,
+            atoms[_NET_WM_NAME],
+            atoms[UTF8_STRING],
+            xproto::PropMode::REPLACE,
+            title.as_bytes(),
+        )
+    }
+
+    #[inline]
+    pub fn set_title(&self, title: &str) {
+        self.set_title_inner(title).expect_then_ignore_error("Failed to set window title");
+
+        self.xconn.flush_requests().expect("Failed to set window title");
+    }
+
+    #[inline]
+    pub fn set_transparent(&self, _transparent: bool) {}
+
+    #[inline]
+    pub fn set_blur(&self, _blur: bool) {}
+
+    fn set_decorations_inner(&self, decorations: bool) -> Result<VoidCookie<'_>, X11Error> {
+        self.shared_state_lock().is_decorated = decorations;
+        let mut hints = self.xconn.get_motif_hints(self.xwindow);
+
+        hints.set_decorations(decorations);
+
+        self.xconn.set_motif_hints(self.xwindow, &hints)
+    }
+
+    #[inline]
+    pub fn set_decorations(&self, decorations: bool) {
+        self.set_decorations_inner(decorations)
+            .expect_then_ignore_error("Failed to set decoration state");
+        self.xconn.flush_requests().expect("Failed to set decoration state");
+        self.invalidate_cached_frame_extents();
+    }
+
+    #[inline]
+    pub fn is_decorated(&self) -> bool {
+        self.shared_state_lock().is_decorated
+    }
+
+    fn set_maximizable_inner(&self, maximizable: bool) -> Result<VoidCookie<'_>, X11Error> {
+        let mut hints = self.xconn.get_motif_hints(self.xwindow);
+
+        hints.set_maximizable(maximizable);
+
+        self.xconn.set_motif_hints(self.xwindow, &hints)
+    }
+
+    fn toggle_atom(&self, atom_name: AtomName, enable: bool) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let atom = atoms[atom_name];
+        self.set_netwm(enable.into(), (atom, 0, 0, 0))
+    }
+
+    fn set_window_level_inner(&self, level: WindowLevel) -> Result<VoidCookie<'_>, X11Error> {
+        self.toggle_atom(_NET_WM_STATE_ABOVE, level == WindowLevel::AlwaysOnTop)?.ignore_error();
+        self.toggle_atom(_NET_WM_STATE_BELOW, level == WindowLevel::AlwaysOnBottom)
+    }
+
+    #[inline]
+    pub fn set_window_level(&self, level: WindowLevel) {
+        self.set_window_level_inner(level)
+            .expect_then_ignore_error("Failed to set window-level state");
+        self.xconn.flush_requests().expect("Failed to set window-level state");
+    }
+
+    fn set_icon_inner(&self, icon: PlatformIcon) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let icon_atom = atoms[_NET_WM_ICON];
+        let data = icon.to_cardinals();
+        self.xconn.change_property(
+            self.xwindow,
+            icon_atom,
+            xproto::Atom::from(xproto::AtomEnum::CARDINAL),
+            xproto::PropMode::REPLACE,
+            data.as_slice(),
+        )
+    }
+
+    fn unset_icon_inner(&self) -> Result<VoidCookie<'_>, X11Error> {
+        let atoms = self.xconn.atoms();
+        let icon_atom = atoms[_NET_WM_ICON];
+        let empty_data: [util::Cardinal; 0] = [];
+        self.xconn.change_property(
+            self.xwindow,
+            icon_atom,
+            xproto::Atom::from(xproto::AtomEnum::CARDINAL),
+            xproto::PropMode::REPLACE,
+            &empty_data,
+        )
+    }
+
+    #[inline]
+    pub(crate) fn set_window_icon(&self, icon: Option<PlatformIcon>) {
+        match icon {
+            Some(icon) => self.set_icon_inner(icon),
+            None => self.unset_icon_inner(),
+        }
+        .expect_then_ignore_error("Failed to set icons");
+
+        self.xconn.flush_requests().expect("Failed to set icons");
+    }
+
+    #[inline]
+    pub fn set_visible(&self, visible: bool) {
+        let mut shared_state = self.shared_state_lock();
+
+        match (visible, shared_state.visibility) {
+            (true, Visibility::Yes) | (true, Visibility::YesWait) | (false, Visibility::No) => {
+                return
+            },
+            _ => (),
+        }
+
+        if visible {
+            self.xconn
+                .xcb_connection()
+                .map_window(self.xwindow)
+                .expect_then_ignore_error("Failed to call `xcb_map_window`");
+            self.xconn
+                .xcb_connection()
+                .configure_window(
+                    self.xwindow,
+                    &xproto::ConfigureWindowAux::new().stack_mode(xproto::StackMode::ABOVE),
+                )
+                .expect_then_ignore_error("Failed to call `xcb_configure_window`");
+            self.xconn.flush_requests().expect("Failed to call XMapRaised");
+            shared_state.visibility = Visibility::YesWait;
+        } else {
+            self.xconn
+                .xcb_connection()
+                .unmap_window(self.xwindow)
+                .expect_then_ignore_error("Failed to call `xcb_unmap_window`");
+            self.xconn.flush_requests().expect("Failed to call XUnmapWindow");
+            shared_state.visibility = Visibility::No;
+        }
+    }
+
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        Some(self.shared_state_lock().visibility == Visibility::Yes)
+    }
+
+    fn update_cached_frame_extents(&self) {
+        let extents = self.xconn.get_frame_extents_heuristic(self.xwindow, self.root);
+        self.shared_state_lock().frame_extents = Some(extents);
+    }
+
+    pub(crate) fn invalidate_cached_frame_extents(&self) {
+        self.shared_state_lock().frame_extents.take();
+    }
+
+    pub(crate) fn outer_position_physical(&self) -> (i32, i32) {
+        let extents = self.shared_state_lock().frame_extents.clone();
+        if let Some(extents) = extents {
+            let (x, y) = self.inner_position_physical();
+            extents.inner_pos_to_outer(x, y)
+        } else {
+            self.update_cached_frame_extents();
+            self.outer_position_physical()
+        }
+    }
+
+    #[inline]
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let extents = self.shared_state_lock().frame_extents.clone();
+        if let Some(extents) = extents {
+            let (x, y) = self.inner_position_physical();
+            Ok(extents.inner_pos_to_outer(x, y).into())
+        } else {
+            self.update_cached_frame_extents();
+            self.outer_position()
+        }
+    }
+
+    pub(crate) fn inner_position_physical(&self) -> (i32, i32) {
+        // This should be okay to unwrap since the only error XTranslateCoordinates can return
+        // is BadWindow, and if the window handle is bad we have bigger problems.
+        self.xconn
+            .translate_coords(self.xwindow, self.root)
+            .map(|coords| (coords.dst_x.into(), coords.dst_y.into()))
+            .unwrap()
+    }
+
+    #[inline]
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        Ok(self.inner_position_physical().into())
+    }
+
+    pub(crate) fn set_position_inner(
+        &self,
+        mut x: i32,
+        mut y: i32,
+    ) -> Result<VoidCookie<'_>, X11Error> {
+        // There are a few WMs that set client area position rather than window position, so
+        // we'll translate for consistency.
+        if util::wm_name_is_one_of(&["Enlightenment", "FVWM"]) {
+            let extents = self.shared_state_lock().frame_extents.clone();
+            if let Some(extents) = extents {
+                x += cast_dimension_to_hint(extents.frame_extents.left);
+                y += cast_dimension_to_hint(extents.frame_extents.top);
+            } else {
+                self.update_cached_frame_extents();
+                return self.set_position_inner(x, y);
+            }
+        }
+
+        self.xconn
+            .xcb_connection()
+            .configure_window(self.xwindow, &xproto::ConfigureWindowAux::new().x(x).y(y))
+            .map_err(Into::into)
+    }
+
+    pub(crate) fn set_position_physical(&self, x: i32, y: i32) {
+        self.set_position_inner(x, y).expect_then_ignore_error("Failed to call `XMoveWindow`");
+    }
+
+    #[inline]
+    pub fn set_outer_position(&self, position: Position) {
+        let (x, y) = position.to_physical::<i32>(self.scale_factor()).into();
+        self.set_position_physical(x, y);
+    }
+
+    pub(crate) fn inner_size_physical(&self) -> (u32, u32) {
+        // This should be okay to unwrap since the only error XGetGeometry can return
+        // is BadWindow, and if the window handle is bad we have bigger problems.
+        self.xconn
+            .get_geometry(self.xwindow)
+            .map(|geo| (geo.width.into(), geo.height.into()))
+            .unwrap()
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        self.inner_size_physical().into()
+    }
+
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        let extents = self.shared_state_lock().frame_extents.clone();
+        if let Some(extents) = extents {
+            let (width, height) = self.inner_size_physical();
+            extents.inner_size_to_outer(width, height).into()
+        } else {
+            self.update_cached_frame_extents();
+            self.outer_size()
+        }
+    }
+
+    pub(crate) fn request_inner_size_physical(&self, width: u32, height: u32) {
+        self.xconn
+            .xcb_connection()
+            .configure_window(
+                self.xwindow,
+                &xproto::ConfigureWindowAux::new().width(width).height(height),
+            )
+            .expect_then_ignore_error("Failed to call `xcb_configure_window`");
+        self.xconn.flush_requests().expect("Failed to call XResizeWindow");
+        // cursor_hittest needs to be reapplied after each window resize.
+        if self.shared_state_lock().cursor_hittest.unwrap_or(false) {
+            let _ = self.set_cursor_hittest(true);
+        }
+    }
+
+    #[inline]
+    pub fn request_inner_size(&self, size: Size) -> Option<PhysicalSize<u32>> {
+        let scale_factor = self.scale_factor();
+        let size = size.to_physical::<u32>(scale_factor).into();
+        if !self.shared_state_lock().is_resizable {
+            self.update_normal_hints(|normal_hints| {
+                normal_hints.min_size = Some(size);
+                normal_hints.max_size = Some(size);
+            })
+            .expect("Failed to call `XSetWMNormalHints`");
+        }
+        self.request_inner_size_physical(size.0 as u32, size.1 as u32);
+
+        None
+    }
+
+    fn update_normal_hints<F>(&self, callback: F) -> Result<(), X11Error>
+    where
+        F: FnOnce(&mut WmSizeHints),
+    {
+        let mut normal_hints = WmSizeHints::get(
+            self.xconn.xcb_connection(),
+            self.xwindow as xproto::Window,
+            xproto::AtomEnum::WM_NORMAL_HINTS,
+        )?
+        .reply()?
+        .unwrap_or_default();
+        callback(&mut normal_hints);
+        normal_hints
+            .set(
+                self.xconn.xcb_connection(),
+                self.xwindow as xproto::Window,
+                xproto::AtomEnum::WM_NORMAL_HINTS,
+            )?
+            .ignore_error();
+        Ok(())
+    }
+
+    pub(crate) fn set_min_inner_size_physical(&self, dimensions: Option<(u32, u32)>) {
+        self.update_normal_hints(|normal_hints| {
+            normal_hints.min_size =
+                dimensions.map(|(w, h)| (cast_dimension_to_hint(w), cast_dimension_to_hint(h)))
+        })
+        .expect("Failed to call `XSetWMNormalHints`");
+    }
+
+    #[inline]
+    pub fn set_min_inner_size(&self, dimensions: Option<Size>) {
+        self.shared_state_lock().min_inner_size = dimensions;
+        let physical_dimensions =
+            dimensions.map(|dimensions| dimensions.to_physical::<u32>(self.scale_factor()).into());
+        self.set_min_inner_size_physical(physical_dimensions);
+    }
+
+    pub(crate) fn set_max_inner_size_physical(&self, dimensions: Option<(u32, u32)>) {
+        self.update_normal_hints(|normal_hints| {
+            normal_hints.max_size =
+                dimensions.map(|(w, h)| (cast_dimension_to_hint(w), cast_dimension_to_hint(h)))
+        })
+        .expect("Failed to call `XSetWMNormalHints`");
+    }
+
+    #[inline]
+    pub fn set_max_inner_size(&self, dimensions: Option<Size>) {
+        self.shared_state_lock().max_inner_size = dimensions;
+        let physical_dimensions =
+            dimensions.map(|dimensions| dimensions.to_physical::<u32>(self.scale_factor()).into());
+        self.set_max_inner_size_physical(physical_dimensions);
+    }
+
+    #[inline]
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        WmSizeHints::get(
+            self.xconn.xcb_connection(),
+            self.xwindow as xproto::Window,
+            xproto::AtomEnum::WM_NORMAL_HINTS,
+        )
+        .ok()
+        .and_then(|cookie| cookie.reply().ok())
+        .flatten()
+        .and_then(|hints| hints.size_increment)
+        .map(|(width, height)| (width as u32, height as u32).into())
+    }
+
+    #[inline]
+    pub fn set_resize_increments(&self, increments: Option<Size>) {
+        self.shared_state_lock().resize_increments = increments;
+        let physical_increments =
+            increments.map(|increments| cast_size_to_hint(increments, self.scale_factor()));
+        self.update_normal_hints(|hints| hints.size_increment = physical_increments)
+            .expect("Failed to call `XSetWMNormalHints`");
+    }
+
+    pub(crate) fn adjust_for_dpi(
+        &self,
+        old_scale_factor: f64,
+        new_scale_factor: f64,
+        width: u32,
+        height: u32,
+        shared_state: &SharedState,
+    ) -> (u32, u32) {
+        let scale_factor = new_scale_factor / old_scale_factor;
+        self.update_normal_hints(|normal_hints| {
+            let dpi_adjuster = |size: Size| -> (i32, i32) { cast_size_to_hint(size, scale_factor) };
+            let max_size = shared_state.max_inner_size.map(dpi_adjuster);
+            let min_size = shared_state.min_inner_size.map(dpi_adjuster);
+            let resize_increments = shared_state.resize_increments.map(dpi_adjuster);
+            let base_size = shared_state.base_size.map(dpi_adjuster);
+
+            normal_hints.max_size = max_size;
+            normal_hints.min_size = min_size;
+            normal_hints.size_increment = resize_increments;
+            normal_hints.base_size = base_size;
+        })
+        .expect("Failed to update normal hints");
+
+        let new_width = (width as f64 * scale_factor).round() as u32;
+        let new_height = (height as f64 * scale_factor).round() as u32;
+
+        (new_width, new_height)
+    }
+
+    pub fn set_resizable(&self, resizable: bool) {
+        if util::wm_name_is_one_of(&["Xfwm4"]) {
+            // Making the window unresizable on Xfwm prevents further changes to `WM_NORMAL_HINTS`
+            // from being detected. This makes it impossible for resizing to be
+            // re-enabled, and also breaks DPI scaling. As such, we choose the lesser of
+            // two evils and do nothing.
+            warn!("To avoid a WM bug, disabling resizing has no effect on Xfwm4");
+            return;
+        }
+
+        let (min_size, max_size) = if resizable {
+            let shared_state_lock = self.shared_state_lock();
+            (shared_state_lock.min_inner_size, shared_state_lock.max_inner_size)
+        } else {
+            let window_size = Some(Size::from(self.inner_size()));
+            (window_size, window_size)
+        };
+        self.shared_state_lock().is_resizable = resizable;
+
+        self.set_maximizable_inner(resizable)
+            .expect_then_ignore_error("Failed to call `XSetWMNormalHints`");
+
+        let scale_factor = self.scale_factor();
+        let min_inner_size = min_size.map(|size| cast_size_to_hint(size, scale_factor));
+        let max_inner_size = max_size.map(|size| cast_size_to_hint(size, scale_factor));
+        self.update_normal_hints(|normal_hints| {
+            normal_hints.min_size = min_inner_size;
+            normal_hints.max_size = max_inner_size;
+        })
+        .expect("Failed to call `XSetWMNormalHints`");
+    }
+
+    #[inline]
+    pub fn is_resizable(&self) -> bool {
+        self.shared_state_lock().is_resizable
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, _buttons: WindowButtons) {}
+
+    #[inline]
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        WindowButtons::all()
+    }
+
+    #[allow(dead_code)]
+    #[inline]
+    pub fn xlib_display(&self) -> *mut c_void {
+        self.xconn.display as _
+    }
+
+    #[allow(dead_code)]
+    #[inline]
+    pub fn xlib_window(&self) -> c_ulong {
+        self.xwindow as ffi::Window
+    }
+
+    #[inline]
+    pub fn set_cursor(&self, cursor: Cursor) {
+        match cursor {
+            Cursor::Icon(icon) => {
+                let old_cursor = replace(
+                    &mut *self.selected_cursor.lock().unwrap(),
+                    SelectedCursor::Named(icon),
+                );
+
+                #[allow(clippy::mutex_atomic)]
+                if SelectedCursor::Named(icon) != old_cursor && *self.cursor_visible.lock().unwrap()
+                {
+                    self.xconn.set_cursor_icon(self.xwindow, Some(icon));
+                }
+            },
+            Cursor::Custom(RootCustomCursor { inner: PlatformCustomCursor::X(cursor) }) => {
+                #[allow(clippy::mutex_atomic)]
+                if *self.cursor_visible.lock().unwrap() {
+                    self.xconn.set_custom_cursor(self.xwindow, &cursor);
+                }
+
+                *self.selected_cursor.lock().unwrap() = SelectedCursor::Custom(cursor);
+            },
+            #[cfg(wayland_platform)]
+            Cursor::Custom(RootCustomCursor { inner: PlatformCustomCursor::Wayland(_) }) => {
+                tracing::error!("passed a Wayland cursor to X11 backend")
+            },
+        }
+    }
+
+    #[inline]
+    pub fn set_cursor_grab(&self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        // We don't support the locked cursor yet, so ignore it early on.
+        if mode == CursorGrabMode::Locked {
+            return Err(ExternalError::NotSupported(NotSupportedError::new()));
+        }
+
+        let mut grabbed_lock = self.cursor_grabbed_mode.lock().unwrap();
+        if mode == *grabbed_lock {
+            return Ok(());
+        }
+
+        // We ungrab before grabbing to prevent passive grabs from causing `AlreadyGrabbed`.
+        // Therefore, this is common to both codepaths.
+        self.xconn
+            .xcb_connection()
+            .ungrab_pointer(x11rb::CURRENT_TIME)
+            .expect_then_ignore_error("Failed to call `xcb_ungrab_pointer`");
+        *grabbed_lock = CursorGrabMode::None;
+
+        let result = match mode {
+            CursorGrabMode::None => self.xconn.flush_requests().map_err(|err| {
+                ExternalError::Os(os_error!(OsError::XError(X11Error::Xlib(err).into())))
+            }),
+            CursorGrabMode::Confined => {
+                let result = self
+                    .xconn
+                    .xcb_connection()
+                    .grab_pointer(
+                        true as _,
+                        self.xwindow,
+                        xproto::EventMask::BUTTON_PRESS
+                            | xproto::EventMask::BUTTON_RELEASE
+                            | xproto::EventMask::ENTER_WINDOW
+                            | xproto::EventMask::LEAVE_WINDOW
+                            | xproto::EventMask::POINTER_MOTION
+                            | xproto::EventMask::POINTER_MOTION_HINT
+                            | xproto::EventMask::BUTTON1_MOTION
+                            | xproto::EventMask::BUTTON2_MOTION
+                            | xproto::EventMask::BUTTON3_MOTION
+                            | xproto::EventMask::BUTTON4_MOTION
+                            | xproto::EventMask::BUTTON5_MOTION
+                            | xproto::EventMask::KEYMAP_STATE,
+                        xproto::GrabMode::ASYNC,
+                        xproto::GrabMode::ASYNC,
+                        self.xwindow,
+                        0u32,
+                        x11rb::CURRENT_TIME,
+                    )
+                    .expect("Failed to call `grab_pointer`")
+                    .reply()
+                    .expect("Failed to receive reply from `grab_pointer`");
+
+                match result.status {
+                    xproto::GrabStatus::SUCCESS => Ok(()),
+                    xproto::GrabStatus::ALREADY_GRABBED => {
+                        Err("Cursor could not be confined: already confined by another client")
+                    },
+                    xproto::GrabStatus::INVALID_TIME => {
+                        Err("Cursor could not be confined: invalid time")
+                    },
+                    xproto::GrabStatus::NOT_VIEWABLE => {
+                        Err("Cursor could not be confined: confine location not viewable")
+                    },
+                    xproto::GrabStatus::FROZEN => {
+                        Err("Cursor could not be confined: frozen by another client")
+                    },
+                    _ => unreachable!(),
+                }
+                .map_err(|err| ExternalError::Os(os_error!(OsError::Misc(err))))
+            },
+            CursorGrabMode::Locked => return Ok(()),
+        };
+
+        if result.is_ok() {
+            *grabbed_lock = mode;
+        }
+
+        result
+    }
+
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        #[allow(clippy::mutex_atomic)]
+        let mut visible_lock = self.cursor_visible.lock().unwrap();
+        if visible == *visible_lock {
+            return;
+        }
+        let cursor =
+            if visible { Some((*self.selected_cursor.lock().unwrap()).clone()) } else { None };
+        *visible_lock = visible;
+        drop(visible_lock);
+        match cursor {
+            Some(SelectedCursor::Custom(cursor)) => {
+                self.xconn.set_custom_cursor(self.xwindow, &cursor);
+            },
+            Some(SelectedCursor::Named(cursor)) => {
+                self.xconn.set_cursor_icon(self.xwindow, Some(cursor));
+            },
+            None => {
+                self.xconn.set_cursor_icon(self.xwindow, None);
+            },
+        }
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        self.shared_state_lock().last_monitor.scale_factor
+    }
+
+    pub fn set_cursor_position_physical(&self, x: i32, y: i32) -> Result<(), ExternalError> {
+        {
+            self.xconn
+                .xcb_connection()
+                .warp_pointer(x11rb::NONE, self.xwindow, 0, 0, 0, 0, x as _, y as _)
+                .map_err(|e| {
+                    ExternalError::Os(os_error!(OsError::XError(X11Error::from(e).into())))
+                })?;
+            self.xconn.flush_requests().map_err(|e| {
+                ExternalError::Os(os_error!(OsError::XError(X11Error::Xlib(e).into())))
+            })
+        }
+    }
+
+    #[inline]
+    pub fn set_cursor_position(&self, position: Position) -> Result<(), ExternalError> {
+        let (x, y) = position.to_physical::<i32>(self.scale_factor()).into();
+        self.set_cursor_position_physical(x, y)
+    }
+
+    #[inline]
+    pub fn set_cursor_hittest(&self, hittest: bool) -> Result<(), ExternalError> {
+        // Implement cursor hittest for X11 by either setting an empty or full window input shape.
+
+        // In X11, every window has two "shapes":
+        //   * Bounding shape: defines the visible outline of the window.
+        //   * Input shape: defines the region of the window that receives pointer/keyboard events.
+        // If the input shape is the full window rectangle, the window behaves normally.
+        // If the input shape is empty, the window is completely click‑through.
+        // Here, we implement hit test by mapping `hittest = true` to "restore a full input shape"
+        // and `hittest = false` to "clear the input shape" (empty list of rectangles).
+        let mut rectangles: Vec<Rectangle> = Vec::new();
+        if hittest {
+            let size = self.inner_size();
+            rectangles.push(Rectangle {
+                x: 0,
+                y: 0,
+                width: size.width as u16,
+                height: size.height as u16,
+            })
+        }
+
+        self.xconn
+            .xcb_connection()
+            .shape_rectangles(
+                SO::SET,
+                SK::INPUT,
+                ClipOrdering::UNSORTED,
+                self.xwindow,
+                0,
+                0,
+                &rectangles,
+            )
+            .map_err(|_e| ExternalError::Ignored)?;
+        self.shared_state_lock().cursor_hittest = Some(hittest);
+        Ok(())
+    }
+
+    /// Moves the window while it is being dragged.
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        self.drag_initiate(util::MOVERESIZE_MOVE)
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, _position: Position) {}
+
+    /// Resizes the window while it is being dragged.
+    pub fn drag_resize_window(&self, direction: ResizeDirection) -> Result<(), ExternalError> {
+        self.drag_initiate(match direction {
+            ResizeDirection::East => util::MOVERESIZE_RIGHT,
+            ResizeDirection::North => util::MOVERESIZE_TOP,
+            ResizeDirection::NorthEast => util::MOVERESIZE_TOPRIGHT,
+            ResizeDirection::NorthWest => util::MOVERESIZE_TOPLEFT,
+            ResizeDirection::South => util::MOVERESIZE_BOTTOM,
+            ResizeDirection::SouthEast => util::MOVERESIZE_BOTTOMRIGHT,
+            ResizeDirection::SouthWest => util::MOVERESIZE_BOTTOMLEFT,
+            ResizeDirection::West => util::MOVERESIZE_LEFT,
+        })
+    }
+
+    /// Initiates a drag operation while the left mouse button is pressed.
+    fn drag_initiate(&self, action: isize) -> Result<(), ExternalError> {
+        let pointer = self
+            .xconn
+            .query_pointer(self.xwindow, util::VIRTUAL_CORE_POINTER)
+            .map_err(|err| ExternalError::Os(os_error!(OsError::XError(err.into()))))?;
+
+        let window = self.inner_position().map_err(ExternalError::NotSupported)?;
+
+        let atoms = self.xconn.atoms();
+        let message = atoms[_NET_WM_MOVERESIZE];
+
+        // we can't use `set_cursor_grab(false)` here because it doesn't run `XUngrabPointer`
+        // if the cursor isn't currently grabbed
+        let mut grabbed_lock = self.cursor_grabbed_mode.lock().unwrap();
+        self.xconn
+            .xcb_connection()
+            .ungrab_pointer(x11rb::CURRENT_TIME)
+            .map_err(|err| {
+                ExternalError::Os(os_error!(OsError::XError(X11Error::from(err).into())))
+            })?
+            .ignore_error();
+        self.xconn.flush_requests().map_err(|err| {
+            ExternalError::Os(os_error!(OsError::XError(X11Error::Xlib(err).into())))
+        })?;
+        *grabbed_lock = CursorGrabMode::None;
+
+        // we keep the lock until we are done
+        self.xconn
+            .send_client_msg(
+                self.xwindow,
+                self.root,
+                message,
+                Some(
+                    xproto::EventMask::SUBSTRUCTURE_REDIRECT
+                        | xproto::EventMask::SUBSTRUCTURE_NOTIFY,
+                ),
+                [
+                    (window.x + xinput_fp1616_to_float(pointer.win_x) as i32) as u32,
+                    (window.y + xinput_fp1616_to_float(pointer.win_y) as i32) as u32,
+                    action.try_into().unwrap(),
+                    1, // Button 1
+                    1,
+                ],
+            )
+            .map_err(|err| ExternalError::Os(os_error!(OsError::XError(err.into()))))?;
+
+        self.xconn.flush_requests().map_err(|err| {
+            ExternalError::Os(os_error!(OsError::XError(X11Error::Xlib(err).into())))
+        })
+    }
+
+    #[inline]
+    pub fn set_ime_cursor_area(&self, spot: Position, _size: Size) {
+        let (x, y) = spot.to_physical::<i32>(self.scale_factor()).into();
+        let _ = self.ime_sender.lock().unwrap().send(ImeRequest::Position(
+            self.xwindow as ffi::Window,
+            x,
+            y,
+        ));
+    }
+
+    #[inline]
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        let _ = self
+            .ime_sender
+            .lock()
+            .unwrap()
+            .send(ImeRequest::Allow(self.xwindow as ffi::Window, allowed));
+    }
+
+    #[inline]
+    pub fn set_ime_purpose(&self, _purpose: ImePurpose) {}
+
+    #[inline]
+    pub fn focus_window(&self) {
+        let atoms = self.xconn.atoms();
+        let state_atom = atoms[WM_STATE];
+        let state_type_atom = atoms[CARD32];
+        let is_minimized = if let Ok(state) =
+            self.xconn.get_property::<u32>(self.xwindow, state_atom, state_type_atom)
+        {
+            state.contains(&super::ICONIC_STATE)
+        } else {
+            false
+        };
+        let is_visible = match self.shared_state_lock().visibility {
+            Visibility::Yes => true,
+            Visibility::YesWait | Visibility::No => false,
+        };
+
+        if is_visible && !is_minimized {
+            self.xconn
+                .send_client_msg(
+                    self.xwindow,
+                    self.root,
+                    atoms[_NET_ACTIVE_WINDOW],
+                    Some(
+                        xproto::EventMask::SUBSTRUCTURE_REDIRECT
+                            | xproto::EventMask::SUBSTRUCTURE_NOTIFY,
+                    ),
+                    [1, x11rb::CURRENT_TIME, 0, 0, 0],
+                )
+                .expect_then_ignore_error("Failed to send client message");
+            if let Err(e) = self.xconn.flush_requests() {
+                tracing::error!(
+                    "`flush` returned an error when focusing the window. Error was: {}",
+                    e
+                );
+            }
+        }
+    }
+
+    #[inline]
+    pub fn request_user_attention(&self, request_type: Option<UserAttentionType>) {
+        let mut wm_hints =
+            WmHints::get(self.xconn.xcb_connection(), self.xwindow as xproto::Window)
+                .ok()
+                .and_then(|cookie| cookie.reply().ok())
+                .flatten()
+                .unwrap_or_default();
+
+        wm_hints.urgent = request_type.is_some();
+        wm_hints
+            .set(self.xconn.xcb_connection(), self.xwindow as xproto::Window)
+            .expect_then_ignore_error("Failed to set WM hints");
+    }
+
+    #[inline]
+    pub(crate) fn generate_activation_token(&self) -> Result<String, X11Error> {
+        // Get the title from the WM_NAME property.
+        let atoms = self.xconn.atoms();
+        let title = {
+            let title_bytes = self
+                .xconn
+                .get_property(self.xwindow, atoms[_NET_WM_NAME], atoms[UTF8_STRING])
+                .expect("Failed to get title");
+
+            String::from_utf8(title_bytes).expect("Bad title")
+        };
+
+        // Get the activation token and then put it in the event queue.
+        let token = self.xconn.request_activation_token(&title)?;
+
+        Ok(token)
+    }
+
+    #[inline]
+    pub fn request_activation_token(&self) -> Result<AsyncRequestSerial, NotSupportedError> {
+        let serial = AsyncRequestSerial::get();
+        self.activation_sender
+            .send((self.id(), serial))
+            .expect("activation token channel should never be closed");
+        Ok(serial)
+    }
+
+    #[inline]
+    pub fn id(&self) -> WindowId {
+        WindowId(self.xwindow as _)
+    }
+
+    #[inline]
+    pub fn request_redraw(&self) {
+        self.redraw_sender.send(WindowId(self.xwindow as _)).unwrap();
+    }
+
+    #[inline]
+    pub fn pre_present_notify(&self) {
+        // TODO timer
+    }
+
+    #[cfg(feature = "rwh_04")]
+    #[inline]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        let mut window_handle = rwh_04::XlibHandle::empty();
+        window_handle.display = self.xlib_display();
+        window_handle.window = self.xlib_window();
+        window_handle.visual_id = self.visual as c_ulong;
+        rwh_04::RawWindowHandle::Xlib(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        let mut window_handle = rwh_05::XlibWindowHandle::empty();
+        window_handle.window = self.xlib_window();
+        window_handle.visual_id = self.visual as c_ulong;
+        window_handle.into()
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        let mut display_handle = rwh_05::XlibDisplayHandle::empty();
+        display_handle.display = self.xlib_display();
+        display_handle.screen = self.screen_id;
+        display_handle.into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_window_handle_rwh_06(&self) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        let mut window_handle = rwh_06::XlibWindowHandle::new(self.xlib_window());
+        window_handle.visual_id = self.visual as c_ulong;
+        Ok(window_handle.into())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::XlibDisplayHandle::new(
+            Some(
+                std::ptr::NonNull::new(self.xlib_display())
+                    .expect("display pointer should never be null"),
+            ),
+            self.screen_id,
+        )
+        .into())
+    }
+
+    #[inline]
+    pub fn theme(&self) -> Option<Theme> {
+        None
+    }
+
+    pub fn set_content_protected(&self, _protected: bool) {}
+
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        self.shared_state_lock().has_focus
+    }
+
+    pub fn title(&self) -> String {
+        String::new()
+    }
+}
+
+/// Cast a dimension value into a hinted dimension for `WmSizeHints`, clamping if too large.
+fn cast_dimension_to_hint(val: u32) -> i32 {
+    val.try_into().unwrap_or(i32::MAX)
+}
+
+/// Use the above strategy to cast a physical size into a hinted size.
+fn cast_physical_size_to_hint(size: PhysicalSize<u32>) -> (i32, i32) {
+    let PhysicalSize { width, height } = size;
+    (cast_dimension_to_hint(width), cast_dimension_to_hint(height))
+}
+
+/// Use the above strategy to cast a size into a hinted size.
+fn cast_size_to_hint(size: Size, scale_factor: f64) -> (i32, i32) {
+    match size {
+        Size::Physical(size) => cast_physical_size_to_hint(size),
+        Size::Logical(size) => size.to_physical::<i32>(scale_factor).into(),
+    }
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/xdisplay.rs b/vendor/winit/src/platform_impl/linux/x11/xdisplay.rs
new file mode 100644
index 00000000..79da0d1f
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/xdisplay.rs
@@ -0,0 +1,356 @@
+use std::collections::HashMap;
+use std::error::Error;
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::{Arc, Mutex, RwLock, RwLockReadGuard};
+use std::{fmt, ptr};
+
+use crate::window::CursorIcon;
+
+use super::atoms::Atoms;
+use super::ffi;
+use super::monitor::MonitorHandle;
+use x11rb::connection::Connection;
+use x11rb::protocol::randr::ConnectionExt as _;
+use x11rb::protocol::xproto::{self, ConnectionExt};
+use x11rb::resource_manager;
+use x11rb::xcb_ffi::XCBConnection;
+
+/// A connection to an X server.
+pub struct XConnection {
+    pub xlib: ffi::Xlib,
+    pub xcursor: ffi::Xcursor,
+
+    // TODO(notgull): I'd like to remove this, but apparently Xlib and Xinput2 are tied together
+    // for some reason.
+    pub xinput2: ffi::XInput2,
+
+    pub display: *mut ffi::Display,
+
+    /// The manager for the XCB connection.
+    ///
+    /// The `Option` ensures that we can drop it before we close the `Display`.
+    xcb: Option<XCBConnection>,
+
+    /// The atoms used by `winit`.
+    ///
+    /// This is a large structure, so I've elected to Box it to make accessing the fields of
+    /// this struct easier. Feel free to unbox it if you like kicking puppies.
+    atoms: Box<Atoms>,
+
+    /// The index of the default screen.
+    default_screen: usize,
+
+    /// The last timestamp received by this connection.
+    timestamp: AtomicU32,
+
+    /// List of monitor handles.
+    pub monitor_handles: Mutex<Option<Vec<MonitorHandle>>>,
+
+    /// The resource database.
+    database: RwLock<resource_manager::Database>,
+
+    /// RandR version.
+    randr_version: (u32, u32),
+
+    /// Atom for the XSettings screen.
+    xsettings_screen: Option<xproto::Atom>,
+
+    pub latest_error: Mutex<Option<XError>>,
+    pub cursor_cache: Mutex<HashMap<Option<CursorIcon>, ffi::Cursor>>,
+}
+
+unsafe impl Send for XConnection {}
+unsafe impl Sync for XConnection {}
+
+pub type XErrorHandler =
+    Option<unsafe extern "C" fn(*mut ffi::Display, *mut ffi::XErrorEvent) -> std::os::raw::c_int>;
+
+impl XConnection {
+    pub fn new(error_handler: XErrorHandler) -> Result<XConnection, XNotSupported> {
+        // opening the libraries
+        let xlib = ffi::Xlib::open()?;
+        let xcursor = ffi::Xcursor::open()?;
+        let xlib_xcb = ffi::Xlib_xcb::open()?;
+        let xinput2 = ffi::XInput2::open()?;
+
+        unsafe { (xlib.XInitThreads)() };
+        unsafe { (xlib.XSetErrorHandler)(error_handler) };
+
+        // calling XOpenDisplay
+        let display = unsafe {
+            let display = (xlib.XOpenDisplay)(ptr::null());
+            if display.is_null() {
+                return Err(XNotSupported::XOpenDisplayFailed);
+            }
+            display
+        };
+
+        // Open the x11rb XCB connection.
+        let xcb = {
+            // Get a pointer to the underlying XCB connection
+            let xcb_connection =
+                unsafe { (xlib_xcb.XGetXCBConnection)(display as *mut ffi::Display) };
+            assert!(!xcb_connection.is_null());
+
+            // Wrap the XCB connection in an x11rb XCB connection
+            let conn =
+                unsafe { XCBConnection::from_raw_xcb_connection(xcb_connection.cast(), false) };
+
+            conn.map_err(|e| XNotSupported::XcbConversionError(Arc::new(WrapConnectError(e))))?
+        };
+
+        // Get the default screen.
+        let default_screen = unsafe { (xlib.XDefaultScreen)(display) } as usize;
+
+        // Load the database.
+        let database = resource_manager::new_from_default(&xcb)
+            .map_err(|e| XNotSupported::XcbConversionError(Arc::new(e)))?;
+
+        // Load the RandR version.
+        let randr_version = xcb
+            .randr_query_version(1, 3)
+            .expect("failed to request XRandR version")
+            .reply()
+            .expect("failed to query XRandR version");
+
+        let xsettings_screen = Self::new_xsettings_screen(&xcb, default_screen);
+        if xsettings_screen.is_none() {
+            tracing::warn!("error setting XSETTINGS; Xft options won't reload automatically")
+        }
+
+        // Fetch atoms.
+        let atoms = Atoms::new(&xcb)
+            .map_err(|e| XNotSupported::XcbConversionError(Arc::new(e)))?
+            .reply()
+            .map_err(|e| XNotSupported::XcbConversionError(Arc::new(e)))?;
+
+        Ok(XConnection {
+            xlib,
+            xcursor,
+            xinput2,
+            display,
+            xcb: Some(xcb),
+            atoms: Box::new(atoms),
+            default_screen,
+            timestamp: AtomicU32::new(0),
+            latest_error: Mutex::new(None),
+            monitor_handles: Mutex::new(None),
+            database: RwLock::new(database),
+            cursor_cache: Default::default(),
+            randr_version: (randr_version.major_version, randr_version.minor_version),
+            xsettings_screen,
+        })
+    }
+
+    fn new_xsettings_screen(xcb: &XCBConnection, default_screen: usize) -> Option<xproto::Atom> {
+        // Fetch the _XSETTINGS_S[screen number] atom.
+        let xsettings_screen = xcb
+            .intern_atom(false, format!("_XSETTINGS_S{default_screen}").as_bytes())
+            .ok()?
+            .reply()
+            .ok()?
+            .atom;
+
+        // Get PropertyNotify events from the XSETTINGS window.
+        // TODO: The XSETTINGS window here can change. In the future, listen for DestroyNotify on
+        // this window in order to accommodate for a changed window here.
+        let selector_window = xcb.get_selection_owner(xsettings_screen).ok()?.reply().ok()?.owner;
+
+        xcb.change_window_attributes(
+            selector_window,
+            &xproto::ChangeWindowAttributesAux::new()
+                .event_mask(xproto::EventMask::PROPERTY_CHANGE),
+        )
+        .ok()?
+        .check()
+        .ok()?;
+
+        Some(xsettings_screen)
+    }
+
+    /// Checks whether an error has been triggered by the previous function calls.
+    #[inline]
+    pub fn check_errors(&self) -> Result<(), XError> {
+        let error = self.latest_error.lock().unwrap().take();
+        if let Some(error) = error {
+            Err(error)
+        } else {
+            Ok(())
+        }
+    }
+
+    #[inline]
+    pub fn randr_version(&self) -> (u32, u32) {
+        self.randr_version
+    }
+
+    /// Get the underlying XCB connection.
+    #[inline]
+    pub fn xcb_connection(&self) -> &XCBConnection {
+        self.xcb.as_ref().expect("xcb_connection somehow called after drop?")
+    }
+
+    /// Get the list of atoms.
+    #[inline]
+    pub fn atoms(&self) -> &Atoms {
+        &self.atoms
+    }
+
+    /// Get the index of the default screen.
+    #[inline]
+    pub fn default_screen_index(&self) -> usize {
+        self.default_screen
+    }
+
+    /// Get the default screen.
+    #[inline]
+    pub fn default_root(&self) -> &xproto::Screen {
+        &self.xcb_connection().setup().roots[self.default_screen]
+    }
+
+    /// Get the resource database.
+    #[inline]
+    pub fn database(&self) -> RwLockReadGuard<'_, resource_manager::Database> {
+        self.database.read().unwrap_or_else(|e| e.into_inner())
+    }
+
+    /// Reload the resource database.
+    #[inline]
+    pub fn reload_database(&self) -> Result<(), super::X11Error> {
+        let database = resource_manager::new_from_default(self.xcb_connection())?;
+        *self.database.write().unwrap_or_else(|e| e.into_inner()) = database;
+        Ok(())
+    }
+
+    /// Get the latest timestamp.
+    #[inline]
+    pub fn timestamp(&self) -> u32 {
+        self.timestamp.load(Ordering::Relaxed)
+    }
+
+    /// Set the last witnessed timestamp.
+    #[inline]
+    pub fn set_timestamp(&self, timestamp: u32) {
+        // Store the timestamp in the slot if it's greater than the last one.
+        let mut last_timestamp = self.timestamp.load(Ordering::Relaxed);
+        loop {
+            if (timestamp as i32).wrapping_sub(last_timestamp as i32) <= 0 {
+                break;
+            }
+
+            match self.timestamp.compare_exchange(
+                last_timestamp,
+                timestamp,
+                Ordering::Relaxed,
+                Ordering::Relaxed,
+            ) {
+                Ok(_) => break,
+                Err(x) => last_timestamp = x,
+            }
+        }
+    }
+
+    /// Get the atom for Xsettings.
+    #[inline]
+    pub fn xsettings_screen(&self) -> Option<xproto::Atom> {
+        self.xsettings_screen
+    }
+}
+
+impl fmt::Debug for XConnection {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.display.fmt(f)
+    }
+}
+
+impl Drop for XConnection {
+    #[inline]
+    fn drop(&mut self) {
+        self.xcb = None;
+        unsafe { (self.xlib.XCloseDisplay)(self.display) };
+    }
+}
+
+/// Error triggered by xlib.
+#[derive(Debug, Clone)]
+pub struct XError {
+    pub description: String,
+    pub error_code: u8,
+    pub request_code: u8,
+    pub minor_code: u8,
+}
+
+impl Error for XError {}
+
+impl fmt::Display for XError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        write!(
+            formatter,
+            "X error: {} (code: {}, request code: {}, minor code: {})",
+            self.description, self.error_code, self.request_code, self.minor_code
+        )
+    }
+}
+
+/// Error returned if this system doesn't have XLib or can't create an X connection.
+#[derive(Clone, Debug)]
+pub enum XNotSupported {
+    /// Failed to load one or several shared libraries.
+    LibraryOpenError(ffi::OpenError),
+
+    /// Connecting to the X server with `XOpenDisplay` failed.
+    XOpenDisplayFailed, // TODO: add better message.
+
+    /// We encountered an error while converting the connection to XCB.
+    XcbConversionError(Arc<dyn Error + Send + Sync + 'static>),
+}
+
+impl From<ffi::OpenError> for XNotSupported {
+    #[inline]
+    fn from(err: ffi::OpenError) -> XNotSupported {
+        XNotSupported::LibraryOpenError(err)
+    }
+}
+
+impl XNotSupported {
+    fn description(&self) -> &'static str {
+        match self {
+            XNotSupported::LibraryOpenError(_) => "Failed to load one of xlib's shared libraries",
+            XNotSupported::XOpenDisplayFailed => "Failed to open connection to X server",
+            XNotSupported::XcbConversionError(_) => "Failed to convert Xlib connection to XCB",
+        }
+    }
+}
+
+impl Error for XNotSupported {
+    #[inline]
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match *self {
+            XNotSupported::LibraryOpenError(ref err) => Some(err),
+            XNotSupported::XcbConversionError(ref err) => Some(&**err),
+            _ => None,
+        }
+    }
+}
+
+impl fmt::Display for XNotSupported {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        formatter.write_str(self.description())
+    }
+}
+
+/// A newtype wrapper around a `ConnectError` that can't be accessed by downstream libraries.
+///
+/// Without this, `x11rb` would become a public dependency.
+#[derive(Debug)]
+struct WrapConnectError(x11rb::rust_connection::ConnectError);
+
+impl fmt::Display for WrapConnectError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(&self.0, f)
+    }
+}
+
+impl Error for WrapConnectError {
+    // We can't implement `source()` here or otherwise risk exposing `x11rb`.
+}
diff --git a/vendor/winit/src/platform_impl/linux/x11/xsettings.rs b/vendor/winit/src/platform_impl/linux/x11/xsettings.rs
new file mode 100644
index 00000000..dd5b074f
--- /dev/null
+++ b/vendor/winit/src/platform_impl/linux/x11/xsettings.rs
@@ -0,0 +1,325 @@
+//! Parser for the xsettings data format.
+//!
+//! Some of this code is referenced from [here].
+//!
+//! [here]: https://github.com/derat/xsettingsd
+
+use std::iter;
+use std::num::NonZeroUsize;
+
+use x11rb::protocol::xproto::{self, ConnectionExt};
+
+use super::atoms::*;
+use super::XConnection;
+
+type Result<T> = core::result::Result<T, ParserError>;
+
+const DPI_NAME: &[u8] = b"Xft/DPI";
+const DPI_MULTIPLIER: f64 = 1024.0;
+const LITTLE_ENDIAN: u8 = b'l';
+const BIG_ENDIAN: u8 = b'B';
+
+impl XConnection {
+    /// Get the DPI from XSettings.
+    pub(crate) fn xsettings_dpi(
+        &self,
+        xsettings_screen: xproto::Atom,
+    ) -> core::result::Result<Option<f64>, super::X11Error> {
+        let atoms = self.atoms();
+
+        // Get the current owner of the screen's settings.
+        let owner = self.xcb_connection().get_selection_owner(xsettings_screen)?.reply()?;
+
+        // Read the _XSETTINGS_SETTINGS property.
+        let data: Vec<u8> =
+            self.get_property(owner.owner, atoms[_XSETTINGS_SETTINGS], atoms[_XSETTINGS_SETTINGS])?;
+
+        // Parse the property.
+        let dpi_setting = read_settings(&data)?
+            .find(|res| res.as_ref().map_or(true, |s| s.name == DPI_NAME))
+            .transpose()?;
+        if let Some(dpi_setting) = dpi_setting {
+            let base_dpi = match dpi_setting.data {
+                SettingData::Integer(dpi) => dpi as f64,
+                SettingData::String(_) => {
+                    return Err(ParserError::BadType(SettingType::String).into())
+                },
+                SettingData::Color(_) => {
+                    return Err(ParserError::BadType(SettingType::Color).into())
+                },
+            };
+
+            Ok(Some(base_dpi / DPI_MULTIPLIER))
+        } else {
+            Ok(None)
+        }
+    }
+}
+
+/// Read over the settings in the block of data.
+fn read_settings(data: &[u8]) -> Result<impl Iterator<Item = Result<Setting<'_>>> + '_> {
+    // Create a parser. This automatically parses the first 8 bytes for metadata.
+    let mut parser = Parser::new(data)?;
+
+    // Read the total number of settings.
+    let total_settings = parser.i32()?;
+
+    // Iterate over the settings.
+    let iter = iter::repeat_with(move || Setting::parse(&mut parser)).take(total_settings as usize);
+    Ok(iter)
+}
+
+/// A setting in the settings list.
+struct Setting<'a> {
+    /// The name of the setting.
+    name: &'a [u8],
+
+    /// The data contained in the setting.
+    data: SettingData<'a>,
+}
+
+/// The data contained in a setting.
+enum SettingData<'a> {
+    Integer(i32),
+    String(#[allow(dead_code)] &'a [u8]),
+    Color(#[allow(dead_code)] [i16; 4]),
+}
+
+impl<'a> Setting<'a> {
+    /// Parse a new `SettingData`.
+    fn parse(parser: &mut Parser<'a>) -> Result<Self> {
+        // Read the type.
+        let ty: SettingType = parser.i8()?.try_into()?;
+
+        // Read another byte of padding.
+        parser.advance(1)?;
+
+        // Read the name of the setting.
+        let name_len = parser.i16()?;
+        let name = parser.advance(name_len as usize)?;
+        parser.pad(name.len(), 4)?;
+
+        // Ignore the serial number.
+        parser.advance(4)?;
+
+        let data = match ty {
+            SettingType::Integer => {
+                // Read a 32-bit integer.
+                SettingData::Integer(parser.i32()?)
+            },
+
+            SettingType::String => {
+                // Read the data.
+                let data_len = parser.i32()?;
+                let data = parser.advance(data_len as usize)?;
+                parser.pad(data.len(), 4)?;
+
+                SettingData::String(data)
+            },
+
+            SettingType::Color => {
+                // Read i16's of color.
+                let (red, blue, green, alpha) =
+                    (parser.i16()?, parser.i16()?, parser.i16()?, parser.i16()?);
+
+                SettingData::Color([red, blue, green, alpha])
+            },
+        };
+
+        Ok(Setting { name, data })
+    }
+}
+
+#[derive(Debug)]
+pub enum SettingType {
+    Integer = 0,
+    String = 1,
+    Color = 2,
+}
+
+impl TryFrom<i8> for SettingType {
+    type Error = ParserError;
+
+    fn try_from(value: i8) -> Result<Self> {
+        Ok(match value {
+            0 => Self::Integer,
+            1 => Self::String,
+            2 => Self::Color,
+            x => return Err(ParserError::InvalidType(x)),
+        })
+    }
+}
+
+/// Parser for the incoming byte stream.
+struct Parser<'a> {
+    bytes: &'a [u8],
+    endianness: Endianness,
+}
+
+impl<'a> Parser<'a> {
+    /// Create a new parser.
+    fn new(bytes: &'a [u8]) -> Result<Self> {
+        let (endianness, bytes) = bytes.split_first().ok_or_else(|| ParserError::ran_out(1, 0))?;
+        let endianness = match *endianness {
+            BIG_ENDIAN => Endianness::Big,
+            LITTLE_ENDIAN => Endianness::Little,
+            _ => Endianness::native(),
+        };
+
+        Ok(Self {
+            // Ignore three bytes of padding and the four-byte serial.
+            bytes: bytes.get(7..).ok_or_else(|| ParserError::ran_out(7, bytes.len()))?,
+            endianness,
+        })
+    }
+
+    /// Get a slice of bytes.
+    fn advance(&mut self, n: usize) -> Result<&'a [u8]> {
+        if n == 0 {
+            return Ok(&[]);
+        }
+
+        if n > self.bytes.len() {
+            Err(ParserError::ran_out(n, self.bytes.len()))
+        } else {
+            let (part, rem) = self.bytes.split_at(n);
+            self.bytes = rem;
+            Ok(part)
+        }
+    }
+
+    /// Skip some padding.
+    fn pad(&mut self, size: usize, pad: usize) -> Result<()> {
+        let advance = (pad - (size % pad)) % pad;
+        self.advance(advance)?;
+        Ok(())
+    }
+
+    /// Get a single byte.
+    fn i8(&mut self) -> Result<i8> {
+        self.advance(1).map(|s| s[0] as i8)
+    }
+
+    /// Get two bytes.
+    fn i16(&mut self) -> Result<i16> {
+        self.advance(2).map(|s| {
+            let bytes: &[u8; 2] = s.try_into().unwrap();
+            match self.endianness {
+                Endianness::Big => i16::from_be_bytes(*bytes),
+                Endianness::Little => i16::from_le_bytes(*bytes),
+            }
+        })
+    }
+
+    /// Get four bytes.
+    fn i32(&mut self) -> Result<i32> {
+        self.advance(4).map(|s| {
+            let bytes: &[u8; 4] = s.try_into().unwrap();
+            match self.endianness {
+                Endianness::Big => i32::from_be_bytes(*bytes),
+                Endianness::Little => i32::from_le_bytes(*bytes),
+            }
+        })
+    }
+}
+
+/// Endianness of the incoming data.
+enum Endianness {
+    Little,
+    Big,
+}
+
+impl Endianness {
+    #[cfg(target_endian = "little")]
+    fn native() -> Self {
+        Endianness::Little
+    }
+
+    #[cfg(target_endian = "big")]
+    fn native() -> Self {
+        Endianness::Big
+    }
+}
+
+/// Parser errors.
+#[allow(dead_code)]
+#[derive(Debug)]
+pub enum ParserError {
+    /// Ran out of bytes.
+    NoMoreBytes { expected: NonZeroUsize, found: usize },
+
+    /// Invalid type.
+    InvalidType(i8),
+
+    /// Bad setting type.
+    BadType(SettingType),
+}
+
+impl ParserError {
+    fn ran_out(expected: usize, found: usize) -> ParserError {
+        let expected = NonZeroUsize::new(expected).unwrap();
+        Self::NoMoreBytes { expected, found }
+    }
+}
+
+#[cfg(test)]
+/// Tests for the XSETTINGS parser.
+mod tests {
+    use super::*;
+
+    const XSETTINGS: &str = include_str!("tests/xsettings.dat");
+
+    #[test]
+    fn empty() {
+        let err = match read_settings(&[]) {
+            Ok(_) => panic!(),
+            Err(err) => err,
+        };
+        match err {
+            ParserError::NoMoreBytes { expected, found } => {
+                assert_eq!(expected.get(), 1);
+                assert_eq!(found, 0);
+            },
+
+            _ => panic!(),
+        }
+    }
+
+    #[test]
+    fn parse_xsettings() {
+        let data = XSETTINGS
+            .trim()
+            .split(',')
+            .map(|tok| {
+                let val = tok.strip_prefix("0x").unwrap();
+                u8::from_str_radix(val, 16).unwrap()
+            })
+            .collect::<Vec<_>>();
+
+        let settings = read_settings(&data).unwrap().collect::<Result<Vec<_>>>().unwrap();
+
+        let dpi = settings.iter().find(|s| s.name == b"Xft/DPI").unwrap();
+        assert_int(&dpi.data, 96 * 1024);
+        let hinting = settings.iter().find(|s| s.name == b"Xft/Hinting").unwrap();
+        assert_int(&hinting.data, 1);
+
+        let rgba = settings.iter().find(|s| s.name == b"Xft/RGBA").unwrap();
+        assert_string(&rgba.data, "rgb");
+        let lcd = settings.iter().find(|s| s.name == b"Xft/Lcdfilter").unwrap();
+        assert_string(&lcd.data, "lcddefault");
+    }
+
+    fn assert_string(dat: &SettingData<'_>, s: &str) {
+        match dat {
+            SettingData::String(left) => assert_eq!(*left, s.as_bytes()),
+            _ => panic!("invalid data type"),
+        }
+    }
+
+    fn assert_int(dat: &SettingData<'_>, i: i32) {
+        match dat {
+            SettingData::Integer(left) => assert_eq!(*left, i),
+            _ => panic!("invalid data type"),
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/app.rs b/vendor/winit/src/platform_impl/macos/app.rs
new file mode 100644
index 00000000..4fb95dbd
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/app.rs
@@ -0,0 +1,195 @@
+#![allow(clippy::unnecessary_cast)]
+#![allow(unknown_lints)] // New lint below
+#![allow(static_mut_refs)] // Uses `MainThreadBound` in new version.
+
+use std::cell::Cell;
+use std::mem;
+
+use objc2::runtime::{Imp, Sel};
+use objc2::sel;
+use objc2_app_kit::{NSApplication, NSEvent, NSEventModifierFlags, NSEventType};
+use objc2_foundation::MainThreadMarker;
+
+use super::app_state::ApplicationDelegate;
+use crate::event::{DeviceEvent, ElementState};
+
+type SendEvent = extern "C" fn(&NSApplication, Sel, &NSEvent);
+
+// NOTE: Only used on the main thread. Ideally, we'd use `MainThreadBound`, but that isn't
+// constructible from `const` with this `objc2` version.
+static mut ORIGINAL: Cell<Option<SendEvent>> = Cell::new(None);
+
+extern "C" fn send_event(app: &NSApplication, sel: Sel, event: &NSEvent) {
+    let mtm = MainThreadMarker::from(app);
+
+    // Normally, holding Cmd + any key never sends us a `keyUp` event for that key.
+    // Overriding `sendEvent:` fixes that. (https://stackoverflow.com/a/15294196)
+    // Fun fact: Firefox still has this bug! (https://bugzilla.mozilla.org/show_bug.cgi?id=1299553)
+    //
+    // For posterity, there are some undocumented event types
+    // (https://github.com/servo/cocoa-rs/issues/155)
+    // but that doesn't really matter here.
+    let event_type = unsafe { event.r#type() };
+    let modifier_flags = unsafe { event.modifierFlags() };
+    if event_type == NSEventType::KeyUp
+        && modifier_flags.contains(NSEventModifierFlags::NSEventModifierFlagCommand)
+    {
+        if let Some(key_window) = app.keyWindow() {
+            key_window.sendEvent(event);
+        }
+        return;
+    }
+
+    // Events are generally scoped to the window level, so the best way
+    // to get device events is to listen for them on NSApplication.
+    let delegate = ApplicationDelegate::get(mtm);
+    maybe_dispatch_device_event(&delegate, event);
+
+    let _ = mtm;
+    let original = unsafe { ORIGINAL.get().expect("no existing sendEvent: handler set") };
+    original(app, sel, event)
+}
+
+/// Override the [`sendEvent:`][NSApplication::sendEvent] method on the given application class.
+///
+/// The previous implementation created a subclass of [`NSApplication`], however we would like to
+/// give the user full control over their `NSApplication`, so we override the method here using
+/// method swizzling instead.
+///
+/// This _should_ also allow two versions of Winit to exist in the same application.
+///
+/// See the following links for more info on method swizzling:
+/// - <https://nshipster.com/method-swizzling/>
+/// - <https://spin.atomicobject.com/method-swizzling-objective-c/>
+/// - <https://web.archive.org/web/20130308110627/http://cocoadev.com/wiki/MethodSwizzling>
+///
+/// NOTE: This function assumes that the passed in application object is the one returned from
+/// [`NSApplication::sharedApplication`], i.e. the one and only global shared application object.
+/// For testing though, we allow it to be a different object.
+pub(crate) fn override_send_event(global_app: &NSApplication) {
+    let mtm = MainThreadMarker::from(global_app);
+    let class = global_app.class();
+
+    let method =
+        class.instance_method(sel!(sendEvent:)).expect("NSApplication must have sendEvent: method");
+
+    // SAFETY: Converting our `sendEvent:` implementation to an IMP.
+    let overridden = unsafe { mem::transmute::<SendEvent, Imp>(send_event) };
+
+    // If we've already overridden the method, don't do anything.
+    // FIXME(madsmtm): Use `std::ptr::fn_addr_eq` (Rust 1.85) once available in MSRV.
+    #[allow(unknown_lints, unpredictable_function_pointer_comparisons)]
+    if overridden == method.implementation() {
+        return;
+    }
+
+    // SAFETY: Our implementation has:
+    // 1. The same signature as `sendEvent:`.
+    // 2. Does not impose extra safety requirements on callers.
+    let original = unsafe { method.set_implementation(overridden) };
+
+    // SAFETY: This is the actual signature of `sendEvent:`.
+    let original = unsafe { mem::transmute::<Imp, SendEvent>(original) };
+
+    // NOTE: If NSApplication was safe to use from multiple threads, then this would potentially be
+    // a (checked) race-condition, since one could call `sendEvent:` before the original had been
+    // stored here.
+    //
+    // It is only usable from the main thread, however, so we're good!
+    let _ = mtm;
+    unsafe { ORIGINAL.set(Some(original)) };
+}
+
+fn maybe_dispatch_device_event(delegate: &ApplicationDelegate, event: &NSEvent) {
+    let event_type = unsafe { event.r#type() };
+    #[allow(non_upper_case_globals)]
+    match event_type {
+        NSEventType::MouseMoved
+        | NSEventType::LeftMouseDragged
+        | NSEventType::OtherMouseDragged
+        | NSEventType::RightMouseDragged => {
+            let delta_x = unsafe { event.deltaX() } as f64;
+            let delta_y = unsafe { event.deltaY() } as f64;
+
+            if delta_x != 0.0 {
+                delegate.maybe_queue_device_event(DeviceEvent::Motion { axis: 0, value: delta_x });
+            }
+
+            if delta_y != 0.0 {
+                delegate.maybe_queue_device_event(DeviceEvent::Motion { axis: 1, value: delta_y })
+            }
+
+            if delta_x != 0.0 || delta_y != 0.0 {
+                delegate.maybe_queue_device_event(DeviceEvent::MouseMotion {
+                    delta: (delta_x, delta_y),
+                });
+            }
+        },
+        NSEventType::LeftMouseDown | NSEventType::RightMouseDown | NSEventType::OtherMouseDown => {
+            delegate.maybe_queue_device_event(DeviceEvent::Button {
+                button: unsafe { event.buttonNumber() } as u32,
+                state: ElementState::Pressed,
+            });
+        },
+        NSEventType::LeftMouseUp | NSEventType::RightMouseUp | NSEventType::OtherMouseUp => {
+            delegate.maybe_queue_device_event(DeviceEvent::Button {
+                button: unsafe { event.buttonNumber() } as u32,
+                state: ElementState::Released,
+            });
+        },
+        _ => (),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use objc2::rc::Retained;
+    use objc2::{declare_class, msg_send_id, mutability, ClassType, DeclaredClass};
+
+    use super::*;
+
+    #[test]
+    fn test_override() {
+        // FIXME(madsmtm): Ensure this always runs (maybe use cargo-nextest or `--test-threads=1`?)
+        let Some(mtm) = MainThreadMarker::new() else { return };
+
+        // Create a new application, without making it the shared application.
+        let app = unsafe { NSApplication::new(mtm) };
+        override_send_event(&app);
+        // Test calling twice works.
+        override_send_event(&app);
+
+        // FIXME(madsmtm): Can't test this yet, need some way to mock AppState.
+        // unsafe {
+        //     let event = super::super::event::dummy_event().unwrap();
+        //     app.sendEvent(&event)
+        // }
+    }
+
+    #[test]
+    fn test_custom_class() {
+        let Some(_mtm) = MainThreadMarker::new() else { return };
+
+        declare_class!(
+            struct TestApplication;
+
+            unsafe impl ClassType for TestApplication {
+                type Super = NSApplication;
+                type Mutability = mutability::MainThreadOnly;
+                const NAME: &'static str = "TestApplication";
+            }
+
+            impl DeclaredClass for TestApplication {}
+
+            unsafe impl TestApplication {
+                #[method(sendEvent:)]
+                fn send_event(&self, _event: &NSEvent) {
+                    todo!()
+                }
+            }
+        );
+
+        let app: Retained<TestApplication> = unsafe { msg_send_id![TestApplication::class(), new] };
+        override_send_event(&app);
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/app_state.rs b/vendor/winit/src/platform_impl/macos/app_state.rs
new file mode 100644
index 00000000..dd2ccd11
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/app_state.rs
@@ -0,0 +1,446 @@
+use std::cell::{Cell, RefCell};
+use std::mem;
+use std::rc::Weak;
+use std::time::Instant;
+
+use objc2::rc::Retained;
+use objc2::{declare_class, msg_send_id, mutability, ClassType, DeclaredClass};
+use objc2_app_kit::{
+    NSApplication, NSApplicationActivationPolicy, NSApplicationDelegate, NSRunningApplication,
+};
+use objc2_foundation::{MainThreadMarker, NSNotification, NSObject, NSObjectProtocol};
+
+use super::event_handler::EventHandler;
+use super::event_loop::{notify_windows_of_exit, stop_app_immediately, ActiveEventLoop, PanicInfo};
+use super::observer::{EventLoopWaker, RunLoop};
+use super::{menu, WindowId, DEVICE_ID};
+use crate::event::{DeviceEvent, Event, StartCause, WindowEvent};
+use crate::event_loop::{ActiveEventLoop as RootActiveEventLoop, ControlFlow};
+use crate::window::WindowId as RootWindowId;
+
+#[derive(Debug)]
+pub(super) struct AppState {
+    activation_policy: Option<NSApplicationActivationPolicy>,
+    default_menu: bool,
+    activate_ignoring_other_apps: bool,
+    run_loop: RunLoop,
+    event_handler: EventHandler,
+    stop_on_launch: Cell<bool>,
+    stop_before_wait: Cell<bool>,
+    stop_after_wait: Cell<bool>,
+    stop_on_redraw: Cell<bool>,
+    /// Whether `applicationDidFinishLaunching:` has been run or not.
+    is_launched: Cell<bool>,
+    /// Whether an `EventLoop` is currently running.
+    is_running: Cell<bool>,
+    /// Whether the user has requested the event loop to exit.
+    exit: Cell<bool>,
+    control_flow: Cell<ControlFlow>,
+    waker: RefCell<EventLoopWaker>,
+    start_time: Cell<Option<Instant>>,
+    wait_timeout: Cell<Option<Instant>>,
+    pending_redraw: RefCell<Vec<WindowId>>,
+    // NOTE: This is strongly referenced by our `NSWindowDelegate` and our `NSView` subclass, and
+    // as such should be careful to not add fields that, in turn, strongly reference those.
+}
+
+declare_class!(
+    #[derive(Debug)]
+    pub(super) struct ApplicationDelegate;
+
+    unsafe impl ClassType for ApplicationDelegate {
+        type Super = NSObject;
+        type Mutability = mutability::MainThreadOnly;
+        const NAME: &'static str = "WinitApplicationDelegate";
+    }
+
+    impl DeclaredClass for ApplicationDelegate {
+        type Ivars = AppState;
+    }
+
+    unsafe impl NSObjectProtocol for ApplicationDelegate {}
+
+    unsafe impl NSApplicationDelegate for ApplicationDelegate {
+        #[method(applicationDidFinishLaunching:)]
+        fn app_did_finish_launching(&self, notification: &NSNotification) {
+            self.did_finish_launching(notification)
+        }
+
+        #[method(applicationWillTerminate:)]
+        fn app_will_terminate(&self, notification: &NSNotification) {
+            self.will_terminate(notification)
+        }
+    }
+);
+
+impl ApplicationDelegate {
+    pub(super) fn new(
+        mtm: MainThreadMarker,
+        activation_policy: Option<NSApplicationActivationPolicy>,
+        default_menu: bool,
+        activate_ignoring_other_apps: bool,
+    ) -> Retained<Self> {
+        let this = mtm.alloc().set_ivars(AppState {
+            activation_policy,
+            default_menu,
+            activate_ignoring_other_apps,
+            run_loop: RunLoop::main(mtm),
+            event_handler: EventHandler::new(),
+            stop_on_launch: Cell::new(false),
+            stop_before_wait: Cell::new(false),
+            stop_after_wait: Cell::new(false),
+            stop_on_redraw: Cell::new(false),
+            is_launched: Cell::new(false),
+            is_running: Cell::new(false),
+            exit: Cell::new(false),
+            control_flow: Cell::new(ControlFlow::default()),
+            waker: RefCell::new(EventLoopWaker::new()),
+            start_time: Cell::new(None),
+            wait_timeout: Cell::new(None),
+            pending_redraw: RefCell::new(vec![]),
+        });
+        unsafe { msg_send_id![super(this), init] }
+    }
+
+    // NOTE: This will, globally, only be run once, no matter how many
+    // `EventLoop`s the user creates.
+    fn did_finish_launching(&self, _notification: &NSNotification) {
+        trace_scope!("applicationDidFinishLaunching:");
+        self.ivars().is_launched.set(true);
+
+        let mtm = MainThreadMarker::from(self);
+        let app = NSApplication::sharedApplication(mtm);
+        // We need to delay setting the activation policy and activating the app
+        // until `applicationDidFinishLaunching` has been called. Otherwise the
+        // menu bar is initially unresponsive on macOS 10.15.
+        // If no activation policy is explicitly provided, do not set it at all
+        // to allow the package manifest to define behavior via LSUIElement.
+        if let Some(activation_policy) = self.ivars().activation_policy {
+            app.setActivationPolicy(activation_policy);
+        } else {
+            // If no activation policy is explicitly provided, and the application
+            // is bundled, do not set the activation policy at all, to allow the
+            // package manifest to define the behavior via LSUIElement.
+            //
+            // See:
+            // - https://github.com/rust-windowing/winit/issues/261
+            // - https://github.com/rust-windowing/winit/issues/3958
+            let is_bundled =
+                unsafe { NSRunningApplication::currentApplication().bundleIdentifier().is_some() };
+            if !is_bundled {
+                app.setActivationPolicy(NSApplicationActivationPolicy::Regular);
+            }
+        }
+
+        window_activation_hack(&app);
+        #[allow(deprecated)]
+        app.activateIgnoringOtherApps(self.ivars().activate_ignoring_other_apps);
+
+        if self.ivars().default_menu {
+            // The menubar initialization should be before the `NewEvents` event, to allow
+            // overriding of the default menu even if it's created
+            menu::initialize(&app);
+        }
+
+        self.ivars().waker.borrow_mut().start();
+
+        self.set_is_running(true);
+        self.dispatch_init_events();
+
+        // If the application is being launched via `EventLoop::pump_app_events()` then we'll
+        // want to stop the app once it is launched (and return to the external loop)
+        //
+        // In this case we still want to consider Winit's `EventLoop` to be "running",
+        // so we call `start_running()` above.
+        if self.ivars().stop_on_launch.get() {
+            // NOTE: the original idea had been to only stop the underlying `RunLoop`
+            // for the app but that didn't work as expected (`-[NSApplication run]`
+            // effectively ignored the attempt to stop the RunLoop and re-started it).
+            //
+            // So we return from `pump_events` by stopping the application.
+            let app = NSApplication::sharedApplication(mtm);
+            stop_app_immediately(&app);
+        }
+    }
+
+    fn will_terminate(&self, _notification: &NSNotification) {
+        trace_scope!("applicationWillTerminate:");
+        let mtm = MainThreadMarker::from(self);
+        let app = NSApplication::sharedApplication(mtm);
+        notify_windows_of_exit(&app);
+        self.internal_exit();
+    }
+
+    pub fn get(mtm: MainThreadMarker) -> Retained<Self> {
+        let app = NSApplication::sharedApplication(mtm);
+        let delegate =
+            unsafe { app.delegate() }.expect("a delegate was not configured on the application");
+        if delegate.is_kind_of::<Self>() {
+            // SAFETY: Just checked that the delegate is an instance of `ApplicationDelegate`
+            unsafe { Retained::cast(delegate) }
+        } else {
+            panic!("tried to get a delegate that was not the one Winit has registered")
+        }
+    }
+
+    /// Place the event handler in the application delegate for the duration
+    /// of the given closure.
+    pub fn set_event_handler<R>(
+        &self,
+        handler: impl FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop),
+        closure: impl FnOnce() -> R,
+    ) -> R {
+        self.ivars().event_handler.set(handler, closure)
+    }
+
+    /// If `pump_events` is called to progress the event loop then we
+    /// bootstrap the event loop via `-[NSApplication run]` but will use
+    /// `CFRunLoopRunInMode` for subsequent calls to `pump_events`.
+    pub fn set_stop_on_launch(&self) {
+        self.ivars().stop_on_launch.set(true);
+    }
+
+    pub fn set_stop_before_wait(&self, value: bool) {
+        self.ivars().stop_before_wait.set(value)
+    }
+
+    pub fn set_stop_after_wait(&self, value: bool) {
+        self.ivars().stop_after_wait.set(value)
+    }
+
+    pub fn set_stop_on_redraw(&self, value: bool) {
+        self.ivars().stop_on_redraw.set(value)
+    }
+
+    pub fn set_wait_timeout(&self, value: Option<Instant>) {
+        self.ivars().wait_timeout.set(value)
+    }
+
+    /// Clears the `running` state and resets the `control_flow` state when an `EventLoop` exits.
+    ///
+    /// NOTE: that if the `NSApplication` has been launched then that state is preserved,
+    /// and we won't need to re-launch the app if subsequent EventLoops are run.
+    pub fn internal_exit(&self) {
+        self.handle_event(Event::LoopExiting);
+
+        self.set_is_running(false);
+        self.set_stop_on_redraw(false);
+        self.set_stop_before_wait(false);
+        self.set_stop_after_wait(false);
+        self.set_wait_timeout(None);
+    }
+
+    pub fn is_launched(&self) -> bool {
+        self.ivars().is_launched.get()
+    }
+
+    pub fn set_is_running(&self, value: bool) {
+        self.ivars().is_running.set(value)
+    }
+
+    pub fn is_running(&self) -> bool {
+        self.ivars().is_running.get()
+    }
+
+    pub fn exit(&self) {
+        self.ivars().exit.set(true)
+    }
+
+    pub fn clear_exit(&self) {
+        self.ivars().exit.set(false)
+    }
+
+    pub fn exiting(&self) -> bool {
+        self.ivars().exit.get()
+    }
+
+    pub fn set_control_flow(&self, value: ControlFlow) {
+        self.ivars().control_flow.set(value)
+    }
+
+    pub fn control_flow(&self) -> ControlFlow {
+        self.ivars().control_flow.get()
+    }
+
+    pub fn maybe_queue_window_event(&self, window_id: WindowId, event: WindowEvent) {
+        self.maybe_queue_event(Event::WindowEvent { window_id: RootWindowId(window_id), event });
+    }
+
+    pub fn handle_window_event(&self, window_id: WindowId, event: WindowEvent) {
+        self.handle_event(Event::WindowEvent { window_id: RootWindowId(window_id), event });
+    }
+
+    pub fn maybe_queue_device_event(&self, event: DeviceEvent) {
+        self.maybe_queue_event(Event::DeviceEvent { device_id: DEVICE_ID, event });
+    }
+
+    pub fn handle_redraw(&self, window_id: WindowId) {
+        let mtm = MainThreadMarker::from(self);
+        // Redraw request might come out of order from the OS.
+        // -> Don't go back into the event handler when our callstack originates from there
+        if !self.ivars().event_handler.in_use() {
+            self.handle_event(Event::WindowEvent {
+                window_id: RootWindowId(window_id),
+                event: WindowEvent::RedrawRequested,
+            });
+
+            // `pump_events` will request to stop immediately _after_ dispatching RedrawRequested
+            // events as a way to ensure that `pump_events` can't block an external loop
+            // indefinitely
+            if self.ivars().stop_on_redraw.get() {
+                let app = NSApplication::sharedApplication(mtm);
+                stop_app_immediately(&app);
+            }
+        }
+    }
+
+    pub fn queue_redraw(&self, window_id: WindowId) {
+        let mut pending_redraw = self.ivars().pending_redraw.borrow_mut();
+        if !pending_redraw.contains(&window_id) {
+            pending_redraw.push(window_id);
+        }
+        self.ivars().run_loop.wakeup();
+    }
+
+    #[track_caller]
+    fn maybe_queue_event(&self, event: Event<HandlePendingUserEvents>) {
+        // Most programmer actions in AppKit (e.g. change window fullscreen, set focused, etc.)
+        // result in an event being queued, and applied at a later point.
+        //
+        // However, it is not documented which actions do this, and which ones are done immediately,
+        // so to make sure that we don't encounter re-entrancy issues, we first check if we're
+        // currently handling another event, and if we are, we queue the event instead.
+        if !self.ivars().event_handler.in_use() {
+            self.handle_event(event);
+        } else {
+            tracing::debug!(?event, "had to queue event since another is currently being handled");
+            let this = self.retain();
+            self.ivars().run_loop.queue_closure(move || this.handle_event(event));
+        }
+    }
+
+    #[track_caller]
+    fn handle_event(&self, event: Event<HandlePendingUserEvents>) {
+        self.ivars().event_handler.handle_event(event, &ActiveEventLoop::new_root(self.retain()))
+    }
+
+    /// dispatch `NewEvents(Init)` + `Resumed`
+    pub fn dispatch_init_events(&self) {
+        self.handle_event(Event::NewEvents(StartCause::Init));
+        // NB: For consistency all platforms must emit a 'resumed' event even though macOS
+        // applications don't themselves have a formal suspend/resume lifecycle.
+        self.handle_event(Event::Resumed);
+    }
+
+    // Called by RunLoopObserver after finishing waiting for new events
+    pub fn wakeup(&self, panic_info: Weak<PanicInfo>) {
+        let mtm = MainThreadMarker::from(self);
+        let panic_info = panic_info
+            .upgrade()
+            .expect("The panic info must exist here. This failure indicates a developer error.");
+
+        // Return when in event handler due to https://github.com/rust-windowing/winit/issues/1779
+        if panic_info.is_panicking() || !self.ivars().event_handler.ready() || !self.is_running() {
+            return;
+        }
+
+        if self.ivars().stop_after_wait.get() {
+            let app = NSApplication::sharedApplication(mtm);
+            stop_app_immediately(&app);
+        }
+
+        let start = self.ivars().start_time.get().unwrap();
+        let cause = match self.control_flow() {
+            ControlFlow::Poll => StartCause::Poll,
+            ControlFlow::Wait => StartCause::WaitCancelled { start, requested_resume: None },
+            ControlFlow::WaitUntil(requested_resume) => {
+                if Instant::now() >= requested_resume {
+                    StartCause::ResumeTimeReached { start, requested_resume }
+                } else {
+                    StartCause::WaitCancelled { start, requested_resume: Some(requested_resume) }
+                }
+            },
+        };
+
+        self.handle_event(Event::NewEvents(cause));
+    }
+
+    // Called by RunLoopObserver before waiting for new events
+    pub fn cleared(&self, panic_info: Weak<PanicInfo>) {
+        let mtm = MainThreadMarker::from(self);
+        let panic_info = panic_info
+            .upgrade()
+            .expect("The panic info must exist here. This failure indicates a developer error.");
+
+        // Return when in event handler due to https://github.com/rust-windowing/winit/issues/1779
+        // XXX: how does it make sense that `event_handler.ready()` can ever return `false` here if
+        // we're about to return to the `CFRunLoop` to poll for new events?
+        if panic_info.is_panicking() || !self.ivars().event_handler.ready() || !self.is_running() {
+            return;
+        }
+
+        self.handle_event(Event::UserEvent(HandlePendingUserEvents));
+
+        let redraw = mem::take(&mut *self.ivars().pending_redraw.borrow_mut());
+        for window_id in redraw {
+            self.handle_event(Event::WindowEvent {
+                window_id: RootWindowId(window_id),
+                event: WindowEvent::RedrawRequested,
+            });
+        }
+
+        self.handle_event(Event::AboutToWait);
+
+        if self.exiting() {
+            let app = NSApplication::sharedApplication(mtm);
+            stop_app_immediately(&app);
+            notify_windows_of_exit(&app);
+        }
+
+        if self.ivars().stop_before_wait.get() {
+            let app = NSApplication::sharedApplication(mtm);
+            stop_app_immediately(&app);
+        }
+        self.ivars().start_time.set(Some(Instant::now()));
+        let wait_timeout = self.ivars().wait_timeout.get(); // configured by pump_events
+        let app_timeout = match self.control_flow() {
+            ControlFlow::Wait => None,
+            ControlFlow::Poll => Some(Instant::now()),
+            ControlFlow::WaitUntil(instant) => Some(instant),
+        };
+        self.ivars().waker.borrow_mut().start_at(min_timeout(wait_timeout, app_timeout));
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct HandlePendingUserEvents;
+
+/// Returns the minimum `Option<Instant>`, taking into account that `None`
+/// equates to an infinite timeout, not a zero timeout (so can't just use
+/// `Option::min`)
+fn min_timeout(a: Option<Instant>, b: Option<Instant>) -> Option<Instant> {
+    a.map_or(b, |a_timeout| b.map_or(Some(a_timeout), |b_timeout| Some(a_timeout.min(b_timeout))))
+}
+
+/// A hack to make activation of multiple windows work when creating them before
+/// `applicationDidFinishLaunching:` / `Event::Event::NewEvents(StartCause::Init)`.
+///
+/// Alternative to this would be the user calling `window.set_visible(true)` in
+/// `StartCause::Init`.
+///
+/// If this becomes too bothersome to maintain, it can probably be removed
+/// without too much damage.
+fn window_activation_hack(app: &NSApplication) {
+    // TODO: Proper ordering of the windows
+    app.windows().into_iter().for_each(|window| {
+        // Call `makeKeyAndOrderFront` if it was called on the window in `WinitWindow::new`
+        // This way we preserve the user's desired initial visibility status
+        // TODO: Also filter on the type/"level" of the window, and maybe other things?
+        if window.isVisible() {
+            tracing::trace!("Activating visible window");
+            window.makeKeyAndOrderFront(None);
+        } else {
+            tracing::trace!("Skipping activating invisible window");
+        }
+    })
+}
diff --git a/vendor/winit/src/platform_impl/macos/cursor.rs b/vendor/winit/src/platform_impl/macos/cursor.rs
new file mode 100644
index 00000000..9e14e8be
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/cursor.rs
@@ -0,0 +1,225 @@
+use std::ffi::c_uchar;
+use std::slice;
+use std::sync::OnceLock;
+
+use objc2::rc::Retained;
+use objc2::runtime::Sel;
+use objc2::{msg_send, msg_send_id, sel, ClassType};
+use objc2_app_kit::{NSBitmapImageRep, NSCursor, NSDeviceRGBColorSpace, NSImage};
+use objc2_foundation::{
+    ns_string, NSData, NSDictionary, NSNumber, NSObject, NSObjectProtocol, NSPoint, NSSize,
+    NSString,
+};
+
+use crate::cursor::{CursorImage, OnlyCursorImageSource};
+use crate::window::CursorIcon;
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct CustomCursor(pub(crate) Retained<NSCursor>);
+
+// SAFETY: NSCursor is immutable and thread-safe
+// TODO(madsmtm): Put this logic in objc2-app-kit itself
+unsafe impl Send for CustomCursor {}
+unsafe impl Sync for CustomCursor {}
+
+impl CustomCursor {
+    pub(crate) fn new(cursor: OnlyCursorImageSource) -> CustomCursor {
+        Self(cursor_from_image(&cursor.0))
+    }
+}
+
+pub(crate) fn cursor_from_image(cursor: &CursorImage) -> Retained<NSCursor> {
+    let width = cursor.width;
+    let height = cursor.height;
+
+    let bitmap = unsafe {
+        NSBitmapImageRep::initWithBitmapDataPlanes_pixelsWide_pixelsHigh_bitsPerSample_samplesPerPixel_hasAlpha_isPlanar_colorSpaceName_bytesPerRow_bitsPerPixel(
+            NSBitmapImageRep::alloc(),
+            std::ptr::null_mut::<*mut c_uchar>(),
+            width as isize,
+            height as isize,
+            8,
+            4,
+            true,
+            false,
+            NSDeviceRGBColorSpace,
+            width as isize * 4,
+            32,
+        ).unwrap()
+    };
+    let bitmap_data = unsafe { slice::from_raw_parts_mut(bitmap.bitmapData(), cursor.rgba.len()) };
+    bitmap_data.copy_from_slice(&cursor.rgba);
+
+    let image = unsafe {
+        NSImage::initWithSize(NSImage::alloc(), NSSize::new(width.into(), height.into()))
+    };
+    unsafe { image.addRepresentation(&bitmap) };
+
+    let hotspot = NSPoint::new(cursor.hotspot_x as f64, cursor.hotspot_y as f64);
+
+    NSCursor::initWithImage_hotSpot(NSCursor::alloc(), &image, hotspot)
+}
+
+pub(crate) fn default_cursor() -> Retained<NSCursor> {
+    NSCursor::arrowCursor()
+}
+
+unsafe fn try_cursor_from_selector(sel: Sel) -> Option<Retained<NSCursor>> {
+    let cls = NSCursor::class();
+    if msg_send![cls, respondsToSelector: sel] {
+        let cursor: Retained<NSCursor> = unsafe { msg_send_id![cls, performSelector: sel] };
+        Some(cursor)
+    } else {
+        tracing::warn!("cursor `{sel}` appears to be invalid");
+        None
+    }
+}
+
+macro_rules! def_undocumented_cursor {
+    {$(
+        $(#[$($m:meta)*])*
+        fn $name:ident();
+    )*} => {$(
+        $(#[$($m)*])*
+        #[allow(non_snake_case)]
+        fn $name() -> Retained<NSCursor> {
+            unsafe { try_cursor_from_selector(sel!($name)).unwrap_or_else(|| default_cursor()) }
+        }
+    )*};
+}
+
+def_undocumented_cursor!(
+    // Undocumented cursors: https://stackoverflow.com/a/46635398/5435443
+    fn _helpCursor();
+    fn _zoomInCursor();
+    fn _zoomOutCursor();
+    fn _windowResizeNorthEastCursor();
+    fn _windowResizeNorthWestCursor();
+    fn _windowResizeSouthEastCursor();
+    fn _windowResizeSouthWestCursor();
+    fn _windowResizeNorthEastSouthWestCursor();
+    fn _windowResizeNorthWestSouthEastCursor();
+
+    // While these two are available, the former just loads a white arrow,
+    // and the latter loads an ugly deflated beachball!
+    // pub fn _moveCursor();
+    // pub fn _waitCursor();
+
+    // An even more undocumented cursor...
+    // https://bugs.eclipse.org/bugs/show_bug.cgi?id=522349
+    fn busyButClickableCursor();
+);
+
+// Note that loading `busybutclickable` with this code won't animate
+// the frames; instead you'll just get them all in a column.
+unsafe fn load_webkit_cursor(name: &NSString) -> Retained<NSCursor> {
+    // Snatch a cursor from WebKit; They fit the style of the native
+    // cursors, and will seem completely standard to macOS users.
+    //
+    // https://stackoverflow.com/a/21786835/5435443
+    let root = ns_string!(
+        "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/\
+         HIServices.framework/Versions/A/Resources/cursors"
+    );
+    let cursor_path = root.stringByAppendingPathComponent(name);
+
+    let pdf_path = cursor_path.stringByAppendingPathComponent(ns_string!("cursor.pdf"));
+    let image = NSImage::initByReferencingFile(NSImage::alloc(), &pdf_path).unwrap();
+
+    // TODO: Handle PLists better
+    let info_path = cursor_path.stringByAppendingPathComponent(ns_string!("info.plist"));
+    let info: Retained<NSDictionary<NSObject, NSObject>> = unsafe {
+        msg_send_id![
+            <NSDictionary<NSObject, NSObject>>::class(),
+            dictionaryWithContentsOfFile: &*info_path,
+        ]
+    };
+    let mut x = 0.0;
+    if let Some(n) = info.get(&*ns_string!("hotx")) {
+        if n.is_kind_of::<NSNumber>() {
+            let ptr: *const NSObject = n;
+            let ptr: *const NSNumber = ptr.cast();
+            x = unsafe { &*ptr }.as_cgfloat()
+        }
+    }
+    let mut y = 0.0;
+    if let Some(n) = info.get(&*ns_string!("hotx")) {
+        if n.is_kind_of::<NSNumber>() {
+            let ptr: *const NSObject = n;
+            let ptr: *const NSNumber = ptr.cast();
+            y = unsafe { &*ptr }.as_cgfloat()
+        }
+    }
+
+    let hotspot = NSPoint::new(x, y);
+    NSCursor::initWithImage_hotSpot(NSCursor::alloc(), &image, hotspot)
+}
+
+fn webkit_move() -> Retained<NSCursor> {
+    unsafe { load_webkit_cursor(ns_string!("move")) }
+}
+
+fn webkit_cell() -> Retained<NSCursor> {
+    unsafe { load_webkit_cursor(ns_string!("cell")) }
+}
+
+pub(crate) fn invisible_cursor() -> Retained<NSCursor> {
+    // 16x16 GIF data for invisible cursor
+    // You can reproduce this via ImageMagick.
+    // $ convert -size 16x16 xc:none cursor.gif
+    static CURSOR_BYTES: &[u8] = &[
+        0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x10, 0x00, 0x10, 0x00, 0xf0, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x21, 0xf9, 0x04, 0x01, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x00,
+        0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x00, 0x02, 0x0e, 0x84, 0x8f, 0xa9, 0xcb, 0xed, 0x0f,
+        0xa3, 0x9c, 0xb4, 0xda, 0x8b, 0xb3, 0x3e, 0x05, 0x00, 0x3b,
+    ];
+
+    fn new_invisible() -> Retained<NSCursor> {
+        // TODO: Consider using `dataWithBytesNoCopy:`
+        let data = NSData::with_bytes(CURSOR_BYTES);
+        let image = NSImage::initWithData(NSImage::alloc(), &data).unwrap();
+        let hotspot = NSPoint::new(0.0, 0.0);
+        NSCursor::initWithImage_hotSpot(NSCursor::alloc(), &image, hotspot)
+    }
+
+    // Cache this for efficiency
+    static CURSOR: OnceLock<CustomCursor> = OnceLock::new();
+    CURSOR.get_or_init(|| CustomCursor(new_invisible())).0.clone()
+}
+
+pub(crate) fn cursor_from_icon(icon: CursorIcon) -> Retained<NSCursor> {
+    match icon {
+        CursorIcon::Default => default_cursor(),
+        CursorIcon::Pointer => NSCursor::pointingHandCursor(),
+        CursorIcon::Grab => NSCursor::openHandCursor(),
+        CursorIcon::Grabbing => NSCursor::closedHandCursor(),
+        CursorIcon::Text => NSCursor::IBeamCursor(),
+        CursorIcon::VerticalText => NSCursor::IBeamCursorForVerticalLayout(),
+        CursorIcon::Copy => NSCursor::dragCopyCursor(),
+        CursorIcon::Alias => NSCursor::dragLinkCursor(),
+        CursorIcon::NotAllowed | CursorIcon::NoDrop => NSCursor::operationNotAllowedCursor(),
+        CursorIcon::ContextMenu => NSCursor::contextualMenuCursor(),
+        CursorIcon::Crosshair => NSCursor::crosshairCursor(),
+        CursorIcon::EResize => NSCursor::resizeRightCursor(),
+        CursorIcon::NResize => NSCursor::resizeUpCursor(),
+        CursorIcon::WResize => NSCursor::resizeLeftCursor(),
+        CursorIcon::SResize => NSCursor::resizeDownCursor(),
+        CursorIcon::EwResize | CursorIcon::ColResize => NSCursor::resizeLeftRightCursor(),
+        CursorIcon::NsResize | CursorIcon::RowResize => NSCursor::resizeUpDownCursor(),
+        CursorIcon::Help => _helpCursor(),
+        CursorIcon::ZoomIn => _zoomInCursor(),
+        CursorIcon::ZoomOut => _zoomOutCursor(),
+        CursorIcon::NeResize => _windowResizeNorthEastCursor(),
+        CursorIcon::NwResize => _windowResizeNorthWestCursor(),
+        CursorIcon::SeResize => _windowResizeSouthEastCursor(),
+        CursorIcon::SwResize => _windowResizeSouthWestCursor(),
+        CursorIcon::NeswResize => _windowResizeNorthEastSouthWestCursor(),
+        CursorIcon::NwseResize => _windowResizeNorthWestSouthEastCursor(),
+        // This is the wrong semantics for `Wait`, but it's the same as
+        // what's used in Safari and Chrome.
+        CursorIcon::Wait | CursorIcon::Progress => busyButClickableCursor(),
+        CursorIcon::Move | CursorIcon::AllScroll => webkit_move(),
+        CursorIcon::Cell => webkit_cell(),
+        _ => default_cursor(),
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/event.rs b/vendor/winit/src/platform_impl/macos/event.rs
new file mode 100644
index 00000000..9b7f35b0
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/event.rs
@@ -0,0 +1,616 @@
+use std::ffi::c_void;
+
+use core_foundation::base::CFRelease;
+use core_foundation::data::{CFDataGetBytePtr, CFDataRef};
+use objc2::rc::Retained;
+use objc2_app_kit::{NSEvent, NSEventModifierFlags, NSEventSubtype, NSEventType};
+use objc2_foundation::{run_on_main, NSPoint};
+use smol_str::SmolStr;
+
+use crate::event::{ElementState, KeyEvent, Modifiers};
+use crate::keyboard::{
+    Key, KeyCode, KeyLocation, ModifiersKeys, ModifiersState, NamedKey, NativeKey, NativeKeyCode,
+    PhysicalKey,
+};
+use crate::platform_impl::platform::ffi;
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct KeyEventExtra {
+    pub text_with_all_modifiers: Option<SmolStr>,
+    pub key_without_modifiers: Key,
+}
+
+/// Ignores ALL modifiers.
+pub fn get_modifierless_char(scancode: u16) -> Key {
+    let mut string = [0; 16];
+    let input_source;
+    let layout;
+    unsafe {
+        input_source = ffi::TISCopyCurrentKeyboardLayoutInputSource();
+        if input_source.is_null() {
+            tracing::error!("`TISCopyCurrentKeyboardLayoutInputSource` returned null ptr");
+            return Key::Unidentified(NativeKey::MacOS(scancode));
+        }
+        let layout_data =
+            ffi::TISGetInputSourceProperty(input_source, ffi::kTISPropertyUnicodeKeyLayoutData);
+        if layout_data.is_null() {
+            CFRelease(input_source as *mut c_void);
+            tracing::error!("`TISGetInputSourceProperty` returned null ptr");
+            return Key::Unidentified(NativeKey::MacOS(scancode));
+        }
+        layout = CFDataGetBytePtr(layout_data as CFDataRef) as *const ffi::UCKeyboardLayout;
+    }
+    let keyboard_type = run_on_main(|_mtm| unsafe { ffi::LMGetKbdType() });
+
+    let mut result_len = 0;
+    let mut dead_keys = 0;
+    let modifiers = 0;
+    let translate_result = unsafe {
+        ffi::UCKeyTranslate(
+            layout,
+            scancode,
+            ffi::kUCKeyActionDisplay,
+            modifiers,
+            keyboard_type as u32,
+            ffi::kUCKeyTranslateNoDeadKeysMask,
+            &mut dead_keys,
+            string.len() as ffi::UniCharCount,
+            &mut result_len,
+            string.as_mut_ptr(),
+        )
+    };
+    unsafe {
+        CFRelease(input_source as *mut c_void);
+    }
+    if translate_result != 0 {
+        tracing::error!("`UCKeyTranslate` returned with the non-zero value: {}", translate_result);
+        return Key::Unidentified(NativeKey::MacOS(scancode));
+    }
+    if result_len == 0 {
+        // This is fine - not all keys have text representation.
+        // For instance, users that have mapped the `Fn` key to toggle
+        // keyboard layouts will hit this code path.
+        return Key::Unidentified(NativeKey::MacOS(scancode));
+    }
+    let chars = String::from_utf16_lossy(&string[0..result_len as usize]);
+    Key::Character(SmolStr::new(chars))
+}
+
+// Ignores all modifiers except for SHIFT (yes, even ALT is ignored).
+fn get_logical_key_char(ns_event: &NSEvent, modifierless_chars: &str) -> Key {
+    let string = unsafe { ns_event.charactersIgnoringModifiers() }
+        .map(|s| s.to_string())
+        .unwrap_or_default();
+    if string.is_empty() {
+        // Probably a dead key
+        let first_char = modifierless_chars.chars().next();
+        return Key::Dead(first_char);
+    }
+    Key::Character(SmolStr::new(string))
+}
+
+/// Create `KeyEvent` for the given `NSEvent`.
+///
+/// This function shouldn't be called when the IME input is in process.
+pub(crate) fn create_key_event(ns_event: &NSEvent, is_press: bool, is_repeat: bool) -> KeyEvent {
+    use ElementState::{Pressed, Released};
+    let state = if is_press { Pressed } else { Released };
+
+    let scancode = unsafe { ns_event.keyCode() };
+    let mut physical_key = scancode_to_physicalkey(scancode as u32);
+
+    // NOTE: The logical key should heed both SHIFT and ALT if possible.
+    // For instance:
+    // * Pressing the A key: logical key should be "a"
+    // * Pressing SHIFT A: logical key should be "A"
+    // * Pressing CTRL SHIFT A: logical key should also be "A"
+    // This is not easy to tease out of `NSEvent`, but we do our best.
+
+    let characters = unsafe { ns_event.characters() }.map(|s| s.to_string()).unwrap_or_default();
+    let text_with_all_modifiers = if characters.is_empty() {
+        None
+    } else {
+        if matches!(physical_key, PhysicalKey::Unidentified(_)) {
+            // The key may be one of the funky function keys
+            physical_key = extra_function_key_to_code(scancode, &characters);
+        }
+        Some(SmolStr::new(characters))
+    };
+
+    let key_from_code = code_to_key(physical_key, scancode);
+    let (logical_key, key_without_modifiers) = if matches!(key_from_code, Key::Unidentified(_)) {
+        // `get_modifierless_char/key_without_modifiers` ignores ALL modifiers.
+        let key_without_modifiers = get_modifierless_char(scancode);
+
+        let modifiers = unsafe { ns_event.modifierFlags() };
+        let has_ctrl = modifiers.contains(NSEventModifierFlags::NSEventModifierFlagControl);
+        let has_cmd = modifiers.contains(NSEventModifierFlags::NSEventModifierFlagCommand);
+
+        let logical_key = match text_with_all_modifiers.as_ref() {
+            // Only checking for ctrl and cmd here, not checking for alt because we DO want to
+            // include its effect in the key. For example if -on the German layout- one
+            // presses alt+8, the logical key should be "{"
+            // Also not checking if this is a release event because then this issue would
+            // still affect the key release.
+            Some(text) if !has_ctrl && !has_cmd => {
+                // Character heeding both SHIFT and ALT.
+                Key::Character(text.clone())
+            },
+
+            _ => match key_without_modifiers.as_ref() {
+                // Character heeding just SHIFT, ignoring ALT.
+                Key::Character(ch) => get_logical_key_char(ns_event, ch),
+
+                // Character ignoring ALL modifiers.
+                _ => key_without_modifiers.clone(),
+            },
+        };
+
+        (logical_key, key_without_modifiers)
+    } else {
+        (key_from_code.clone(), key_from_code)
+    };
+
+    let text = if is_press { logical_key.to_text().map(SmolStr::new) } else { None };
+
+    let location = code_to_location(physical_key);
+
+    KeyEvent {
+        location,
+        logical_key,
+        physical_key,
+        repeat: is_repeat,
+        state,
+        text,
+        platform_specific: KeyEventExtra { text_with_all_modifiers, key_without_modifiers },
+    }
+}
+
+pub fn code_to_key(key: PhysicalKey, scancode: u16) -> Key {
+    let code = match key {
+        PhysicalKey::Code(code) => code,
+        PhysicalKey::Unidentified(code) => return Key::Unidentified(code.into()),
+    };
+
+    Key::Named(match code {
+        KeyCode::Enter => NamedKey::Enter,
+        KeyCode::Tab => NamedKey::Tab,
+        KeyCode::Space => NamedKey::Space,
+        KeyCode::Backspace => NamedKey::Backspace,
+        KeyCode::Escape => NamedKey::Escape,
+        KeyCode::SuperRight => NamedKey::Super,
+        KeyCode::SuperLeft => NamedKey::Super,
+        KeyCode::ShiftLeft => NamedKey::Shift,
+        KeyCode::AltLeft => NamedKey::Alt,
+        KeyCode::ControlLeft => NamedKey::Control,
+        KeyCode::ShiftRight => NamedKey::Shift,
+        KeyCode::AltRight => NamedKey::Alt,
+        KeyCode::ControlRight => NamedKey::Control,
+
+        KeyCode::NumLock => NamedKey::NumLock,
+        KeyCode::AudioVolumeUp => NamedKey::AudioVolumeUp,
+        KeyCode::AudioVolumeDown => NamedKey::AudioVolumeDown,
+
+        // Other numpad keys all generate text on macOS (if I understand correctly)
+        KeyCode::NumpadEnter => NamedKey::Enter,
+
+        KeyCode::F1 => NamedKey::F1,
+        KeyCode::F2 => NamedKey::F2,
+        KeyCode::F3 => NamedKey::F3,
+        KeyCode::F4 => NamedKey::F4,
+        KeyCode::F5 => NamedKey::F5,
+        KeyCode::F6 => NamedKey::F6,
+        KeyCode::F7 => NamedKey::F7,
+        KeyCode::F8 => NamedKey::F8,
+        KeyCode::F9 => NamedKey::F9,
+        KeyCode::F10 => NamedKey::F10,
+        KeyCode::F11 => NamedKey::F11,
+        KeyCode::F12 => NamedKey::F12,
+        KeyCode::F13 => NamedKey::F13,
+        KeyCode::F14 => NamedKey::F14,
+        KeyCode::F15 => NamedKey::F15,
+        KeyCode::F16 => NamedKey::F16,
+        KeyCode::F17 => NamedKey::F17,
+        KeyCode::F18 => NamedKey::F18,
+        KeyCode::F19 => NamedKey::F19,
+        KeyCode::F20 => NamedKey::F20,
+
+        KeyCode::Insert => NamedKey::Insert,
+        KeyCode::Home => NamedKey::Home,
+        KeyCode::PageUp => NamedKey::PageUp,
+        KeyCode::Delete => NamedKey::Delete,
+        KeyCode::End => NamedKey::End,
+        KeyCode::PageDown => NamedKey::PageDown,
+        KeyCode::ArrowLeft => NamedKey::ArrowLeft,
+        KeyCode::ArrowRight => NamedKey::ArrowRight,
+        KeyCode::ArrowDown => NamedKey::ArrowDown,
+        KeyCode::ArrowUp => NamedKey::ArrowUp,
+        _ => return Key::Unidentified(NativeKey::MacOS(scancode)),
+    })
+}
+
+pub fn code_to_location(key: PhysicalKey) -> KeyLocation {
+    let code = match key {
+        PhysicalKey::Code(code) => code,
+        PhysicalKey::Unidentified(_) => return KeyLocation::Standard,
+    };
+
+    match code {
+        KeyCode::SuperRight => KeyLocation::Right,
+        KeyCode::SuperLeft => KeyLocation::Left,
+        KeyCode::ShiftLeft => KeyLocation::Left,
+        KeyCode::AltLeft => KeyLocation::Left,
+        KeyCode::ControlLeft => KeyLocation::Left,
+        KeyCode::ShiftRight => KeyLocation::Right,
+        KeyCode::AltRight => KeyLocation::Right,
+        KeyCode::ControlRight => KeyLocation::Right,
+
+        KeyCode::NumLock => KeyLocation::Numpad,
+        KeyCode::NumpadDecimal => KeyLocation::Numpad,
+        KeyCode::NumpadMultiply => KeyLocation::Numpad,
+        KeyCode::NumpadAdd => KeyLocation::Numpad,
+        KeyCode::NumpadDivide => KeyLocation::Numpad,
+        KeyCode::NumpadEnter => KeyLocation::Numpad,
+        KeyCode::NumpadSubtract => KeyLocation::Numpad,
+        KeyCode::NumpadEqual => KeyLocation::Numpad,
+        KeyCode::Numpad0 => KeyLocation::Numpad,
+        KeyCode::Numpad1 => KeyLocation::Numpad,
+        KeyCode::Numpad2 => KeyLocation::Numpad,
+        KeyCode::Numpad3 => KeyLocation::Numpad,
+        KeyCode::Numpad4 => KeyLocation::Numpad,
+        KeyCode::Numpad5 => KeyLocation::Numpad,
+        KeyCode::Numpad6 => KeyLocation::Numpad,
+        KeyCode::Numpad7 => KeyLocation::Numpad,
+        KeyCode::Numpad8 => KeyLocation::Numpad,
+        KeyCode::Numpad9 => KeyLocation::Numpad,
+
+        _ => KeyLocation::Standard,
+    }
+}
+
+// While F1-F20 have scancodes we can match on, we have to check against UTF-16
+// constants for the rest.
+// https://developer.apple.com/documentation/appkit/1535851-function-key_unicodes?preferredLanguage=occ
+pub fn extra_function_key_to_code(scancode: u16, string: &str) -> PhysicalKey {
+    if let Some(ch) = string.encode_utf16().next() {
+        match ch {
+            0xf718 => PhysicalKey::Code(KeyCode::F21),
+            0xf719 => PhysicalKey::Code(KeyCode::F22),
+            0xf71a => PhysicalKey::Code(KeyCode::F23),
+            0xf71b => PhysicalKey::Code(KeyCode::F24),
+            _ => PhysicalKey::Unidentified(NativeKeyCode::MacOS(scancode)),
+        }
+    } else {
+        PhysicalKey::Unidentified(NativeKeyCode::MacOS(scancode))
+    }
+}
+
+// The values are from the https://github.com/apple-oss-distributions/IOHIDFamily/blob/19666c840a6d896468416ff0007040a10b7b46b8/IOHIDSystem/IOKit/hidsystem/IOLLEvent.h#L258-L259
+const NX_DEVICELCTLKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00000001);
+const NX_DEVICELSHIFTKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00000002);
+const NX_DEVICERSHIFTKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00000004);
+const NX_DEVICELCMDKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00000008);
+const NX_DEVICERCMDKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00000010);
+const NX_DEVICELALTKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00000020);
+const NX_DEVICERALTKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00000040);
+const NX_DEVICERCTLKEYMASK: NSEventModifierFlags = NSEventModifierFlags(0x00002000);
+
+pub(super) fn lalt_pressed(event: &NSEvent) -> bool {
+    unsafe { event.modifierFlags() }.contains(NX_DEVICELALTKEYMASK)
+}
+
+pub(super) fn ralt_pressed(event: &NSEvent) -> bool {
+    unsafe { event.modifierFlags() }.contains(NX_DEVICERALTKEYMASK)
+}
+
+pub(super) fn event_mods(event: &NSEvent) -> Modifiers {
+    let flags = unsafe { event.modifierFlags() };
+    let mut state = ModifiersState::empty();
+    let mut pressed_mods = ModifiersKeys::empty();
+
+    state
+        .set(ModifiersState::SHIFT, flags.contains(NSEventModifierFlags::NSEventModifierFlagShift));
+    pressed_mods.set(ModifiersKeys::LSHIFT, flags.contains(NX_DEVICELSHIFTKEYMASK));
+    pressed_mods.set(ModifiersKeys::RSHIFT, flags.contains(NX_DEVICERSHIFTKEYMASK));
+
+    state.set(
+        ModifiersState::CONTROL,
+        flags.contains(NSEventModifierFlags::NSEventModifierFlagControl),
+    );
+    pressed_mods.set(ModifiersKeys::LCONTROL, flags.contains(NX_DEVICELCTLKEYMASK));
+    pressed_mods.set(ModifiersKeys::RCONTROL, flags.contains(NX_DEVICERCTLKEYMASK));
+
+    state.set(ModifiersState::ALT, flags.contains(NSEventModifierFlags::NSEventModifierFlagOption));
+    pressed_mods.set(ModifiersKeys::LALT, flags.contains(NX_DEVICELALTKEYMASK));
+    pressed_mods.set(ModifiersKeys::RALT, flags.contains(NX_DEVICERALTKEYMASK));
+
+    state.set(
+        ModifiersState::SUPER,
+        flags.contains(NSEventModifierFlags::NSEventModifierFlagCommand),
+    );
+    pressed_mods.set(ModifiersKeys::LSUPER, flags.contains(NX_DEVICELCMDKEYMASK));
+    pressed_mods.set(ModifiersKeys::RSUPER, flags.contains(NX_DEVICERCMDKEYMASK));
+
+    Modifiers { state, pressed_mods }
+}
+
+pub(super) fn dummy_event() -> Option<Retained<NSEvent>> {
+    unsafe {
+        NSEvent::otherEventWithType_location_modifierFlags_timestamp_windowNumber_context_subtype_data1_data2(
+            NSEventType::ApplicationDefined,
+            NSPoint::new(0.0, 0.0),
+            NSEventModifierFlags(0),
+            0.0,
+            0,
+            None,
+            NSEventSubtype::WindowExposed.0,
+            0,
+            0,
+        )
+    }
+}
+
+pub(crate) fn physicalkey_to_scancode(physical_key: PhysicalKey) -> Option<u32> {
+    let code = match physical_key {
+        PhysicalKey::Code(code) => code,
+        PhysicalKey::Unidentified(_) => return None,
+    };
+
+    match code {
+        KeyCode::KeyA => Some(0x00),
+        KeyCode::KeyS => Some(0x01),
+        KeyCode::KeyD => Some(0x02),
+        KeyCode::KeyF => Some(0x03),
+        KeyCode::KeyH => Some(0x04),
+        KeyCode::KeyG => Some(0x05),
+        KeyCode::KeyZ => Some(0x06),
+        KeyCode::KeyX => Some(0x07),
+        KeyCode::KeyC => Some(0x08),
+        KeyCode::KeyV => Some(0x09),
+        KeyCode::KeyB => Some(0x0b),
+        KeyCode::KeyQ => Some(0x0c),
+        KeyCode::KeyW => Some(0x0d),
+        KeyCode::KeyE => Some(0x0e),
+        KeyCode::KeyR => Some(0x0f),
+        KeyCode::KeyY => Some(0x10),
+        KeyCode::KeyT => Some(0x11),
+        KeyCode::Digit1 => Some(0x12),
+        KeyCode::Digit2 => Some(0x13),
+        KeyCode::Digit3 => Some(0x14),
+        KeyCode::Digit4 => Some(0x15),
+        KeyCode::Digit6 => Some(0x16),
+        KeyCode::Digit5 => Some(0x17),
+        KeyCode::Equal => Some(0x18),
+        KeyCode::Digit9 => Some(0x19),
+        KeyCode::Digit7 => Some(0x1a),
+        KeyCode::Minus => Some(0x1b),
+        KeyCode::Digit8 => Some(0x1c),
+        KeyCode::Digit0 => Some(0x1d),
+        KeyCode::BracketRight => Some(0x1e),
+        KeyCode::KeyO => Some(0x1f),
+        KeyCode::KeyU => Some(0x20),
+        KeyCode::BracketLeft => Some(0x21),
+        KeyCode::KeyI => Some(0x22),
+        KeyCode::KeyP => Some(0x23),
+        KeyCode::Enter => Some(0x24),
+        KeyCode::KeyL => Some(0x25),
+        KeyCode::KeyJ => Some(0x26),
+        KeyCode::Quote => Some(0x27),
+        KeyCode::KeyK => Some(0x28),
+        KeyCode::Semicolon => Some(0x29),
+        KeyCode::Backslash => Some(0x2a),
+        KeyCode::Comma => Some(0x2b),
+        KeyCode::Slash => Some(0x2c),
+        KeyCode::KeyN => Some(0x2d),
+        KeyCode::KeyM => Some(0x2e),
+        KeyCode::Period => Some(0x2f),
+        KeyCode::Tab => Some(0x30),
+        KeyCode::Space => Some(0x31),
+        KeyCode::Backquote => Some(0x32),
+        KeyCode::Backspace => Some(0x33),
+        KeyCode::Escape => Some(0x35),
+        KeyCode::SuperRight => Some(0x36),
+        KeyCode::SuperLeft => Some(0x37),
+        KeyCode::ShiftLeft => Some(0x38),
+        KeyCode::AltLeft => Some(0x3a),
+        KeyCode::ControlLeft => Some(0x3b),
+        KeyCode::ShiftRight => Some(0x3c),
+        KeyCode::AltRight => Some(0x3d),
+        KeyCode::ControlRight => Some(0x3e),
+        KeyCode::F17 => Some(0x40),
+        KeyCode::NumpadDecimal => Some(0x41),
+        KeyCode::NumpadMultiply => Some(0x43),
+        KeyCode::NumpadAdd => Some(0x45),
+        KeyCode::NumLock => Some(0x47),
+        KeyCode::AudioVolumeUp => Some(0x49),
+        KeyCode::AudioVolumeDown => Some(0x4a),
+        KeyCode::NumpadDivide => Some(0x4b),
+        KeyCode::NumpadEnter => Some(0x4c),
+        KeyCode::NumpadSubtract => Some(0x4e),
+        KeyCode::F18 => Some(0x4f),
+        KeyCode::F19 => Some(0x50),
+        KeyCode::NumpadEqual => Some(0x51),
+        KeyCode::Numpad0 => Some(0x52),
+        KeyCode::Numpad1 => Some(0x53),
+        KeyCode::Numpad2 => Some(0x54),
+        KeyCode::Numpad3 => Some(0x55),
+        KeyCode::Numpad4 => Some(0x56),
+        KeyCode::Numpad5 => Some(0x57),
+        KeyCode::Numpad6 => Some(0x58),
+        KeyCode::Numpad7 => Some(0x59),
+        KeyCode::F20 => Some(0x5a),
+        KeyCode::Numpad8 => Some(0x5b),
+        KeyCode::Numpad9 => Some(0x5c),
+        KeyCode::IntlYen => Some(0x5d),
+        KeyCode::F5 => Some(0x60),
+        KeyCode::F6 => Some(0x61),
+        KeyCode::F7 => Some(0x62),
+        KeyCode::F3 => Some(0x63),
+        KeyCode::F8 => Some(0x64),
+        KeyCode::F9 => Some(0x65),
+        KeyCode::F11 => Some(0x67),
+        KeyCode::F13 => Some(0x69),
+        KeyCode::F16 => Some(0x6a),
+        KeyCode::F14 => Some(0x6b),
+        KeyCode::F10 => Some(0x6d),
+        KeyCode::F12 => Some(0x6f),
+        KeyCode::F15 => Some(0x71),
+        KeyCode::Insert => Some(0x72),
+        KeyCode::Home => Some(0x73),
+        KeyCode::PageUp => Some(0x74),
+        KeyCode::Delete => Some(0x75),
+        KeyCode::F4 => Some(0x76),
+        KeyCode::End => Some(0x77),
+        KeyCode::F2 => Some(0x78),
+        KeyCode::PageDown => Some(0x79),
+        KeyCode::F1 => Some(0x7a),
+        KeyCode::ArrowLeft => Some(0x7b),
+        KeyCode::ArrowRight => Some(0x7c),
+        KeyCode::ArrowDown => Some(0x7d),
+        KeyCode::ArrowUp => Some(0x7e),
+        _ => None,
+    }
+}
+
+pub(crate) fn scancode_to_physicalkey(scancode: u32) -> PhysicalKey {
+    PhysicalKey::Code(match scancode {
+        0x00 => KeyCode::KeyA,
+        0x01 => KeyCode::KeyS,
+        0x02 => KeyCode::KeyD,
+        0x03 => KeyCode::KeyF,
+        0x04 => KeyCode::KeyH,
+        0x05 => KeyCode::KeyG,
+        0x06 => KeyCode::KeyZ,
+        0x07 => KeyCode::KeyX,
+        0x08 => KeyCode::KeyC,
+        0x09 => KeyCode::KeyV,
+        // 0x0a => World 1,
+        0x0b => KeyCode::KeyB,
+        0x0c => KeyCode::KeyQ,
+        0x0d => KeyCode::KeyW,
+        0x0e => KeyCode::KeyE,
+        0x0f => KeyCode::KeyR,
+        0x10 => KeyCode::KeyY,
+        0x11 => KeyCode::KeyT,
+        0x12 => KeyCode::Digit1,
+        0x13 => KeyCode::Digit2,
+        0x14 => KeyCode::Digit3,
+        0x15 => KeyCode::Digit4,
+        0x16 => KeyCode::Digit6,
+        0x17 => KeyCode::Digit5,
+        0x18 => KeyCode::Equal,
+        0x19 => KeyCode::Digit9,
+        0x1a => KeyCode::Digit7,
+        0x1b => KeyCode::Minus,
+        0x1c => KeyCode::Digit8,
+        0x1d => KeyCode::Digit0,
+        0x1e => KeyCode::BracketRight,
+        0x1f => KeyCode::KeyO,
+        0x20 => KeyCode::KeyU,
+        0x21 => KeyCode::BracketLeft,
+        0x22 => KeyCode::KeyI,
+        0x23 => KeyCode::KeyP,
+        0x24 => KeyCode::Enter,
+        0x25 => KeyCode::KeyL,
+        0x26 => KeyCode::KeyJ,
+        0x27 => KeyCode::Quote,
+        0x28 => KeyCode::KeyK,
+        0x29 => KeyCode::Semicolon,
+        0x2a => KeyCode::Backslash,
+        0x2b => KeyCode::Comma,
+        0x2c => KeyCode::Slash,
+        0x2d => KeyCode::KeyN,
+        0x2e => KeyCode::KeyM,
+        0x2f => KeyCode::Period,
+        0x30 => KeyCode::Tab,
+        0x31 => KeyCode::Space,
+        0x32 => KeyCode::Backquote,
+        0x33 => KeyCode::Backspace,
+        // 0x34 => unknown,
+        0x35 => KeyCode::Escape,
+        0x36 => KeyCode::SuperRight,
+        0x37 => KeyCode::SuperLeft,
+        0x38 => KeyCode::ShiftLeft,
+        0x39 => KeyCode::CapsLock,
+        0x3a => KeyCode::AltLeft,
+        0x3b => KeyCode::ControlLeft,
+        0x3c => KeyCode::ShiftRight,
+        0x3d => KeyCode::AltRight,
+        0x3e => KeyCode::ControlRight,
+        0x3f => KeyCode::Fn,
+        0x40 => KeyCode::F17,
+        0x41 => KeyCode::NumpadDecimal,
+        // 0x42 -> unknown,
+        0x43 => KeyCode::NumpadMultiply,
+        // 0x44 => unknown,
+        0x45 => KeyCode::NumpadAdd,
+        // 0x46 => unknown,
+        0x47 => KeyCode::NumLock,
+        // 0x48 => KeyCode::NumpadClear,
+
+        // TODO: (Artur) for me, kVK_VolumeUp is 0x48
+        // macOS 10.11
+        // /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/
+        // Versions/A/Headers/Events.h
+        0x49 => KeyCode::AudioVolumeUp,
+        0x4a => KeyCode::AudioVolumeDown,
+        0x4b => KeyCode::NumpadDivide,
+        0x4c => KeyCode::NumpadEnter,
+        // 0x4d => unknown,
+        0x4e => KeyCode::NumpadSubtract,
+        0x4f => KeyCode::F18,
+        0x50 => KeyCode::F19,
+        0x51 => KeyCode::NumpadEqual,
+        0x52 => KeyCode::Numpad0,
+        0x53 => KeyCode::Numpad1,
+        0x54 => KeyCode::Numpad2,
+        0x55 => KeyCode::Numpad3,
+        0x56 => KeyCode::Numpad4,
+        0x57 => KeyCode::Numpad5,
+        0x58 => KeyCode::Numpad6,
+        0x59 => KeyCode::Numpad7,
+        0x5a => KeyCode::F20,
+        0x5b => KeyCode::Numpad8,
+        0x5c => KeyCode::Numpad9,
+        0x5d => KeyCode::IntlYen,
+        // 0x5e => JIS Ro,
+        // 0x5f => unknown,
+        0x60 => KeyCode::F5,
+        0x61 => KeyCode::F6,
+        0x62 => KeyCode::F7,
+        0x63 => KeyCode::F3,
+        0x64 => KeyCode::F8,
+        0x65 => KeyCode::F9,
+        // 0x66 => JIS Eisuu (macOS),
+        0x67 => KeyCode::F11,
+        // 0x68 => JIS Kanna (macOS),
+        0x69 => KeyCode::F13,
+        0x6a => KeyCode::F16,
+        0x6b => KeyCode::F14,
+        // 0x6c => unknown,
+        0x6d => KeyCode::F10,
+        // 0x6e => unknown,
+        0x6f => KeyCode::F12,
+        // 0x70 => unknown,
+        0x71 => KeyCode::F15,
+        0x72 => KeyCode::Insert,
+        0x73 => KeyCode::Home,
+        0x74 => KeyCode::PageUp,
+        0x75 => KeyCode::Delete,
+        0x76 => KeyCode::F4,
+        0x77 => KeyCode::End,
+        0x78 => KeyCode::F2,
+        0x79 => KeyCode::PageDown,
+        0x7a => KeyCode::F1,
+        0x7b => KeyCode::ArrowLeft,
+        0x7c => KeyCode::ArrowRight,
+        0x7d => KeyCode::ArrowDown,
+        0x7e => KeyCode::ArrowUp,
+        // 0x7f =>  unknown,
+
+        // 0xA is the caret (^) an macOS's German QERTZ layout. This key is at the same location as
+        // backquote (`) on Windows' US layout.
+        0xa => KeyCode::Backquote,
+        _ => return PhysicalKey::Unidentified(NativeKeyCode::MacOS(scancode as u16)),
+    })
+}
diff --git a/vendor/winit/src/platform_impl/macos/event_handler.rs b/vendor/winit/src/platform_impl/macos/event_handler.rs
new file mode 100644
index 00000000..5c353c14
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/event_handler.rs
@@ -0,0 +1,139 @@
+use std::cell::RefCell;
+use std::{fmt, mem};
+
+use super::app_state::HandlePendingUserEvents;
+use crate::event::Event;
+use crate::event_loop::ActiveEventLoop as RootActiveEventLoop;
+
+struct EventHandlerData {
+    #[allow(clippy::type_complexity)]
+    handler: Box<dyn FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop) + 'static>,
+}
+
+impl fmt::Debug for EventHandlerData {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EventHandlerData").finish_non_exhaustive()
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct EventHandler {
+    /// This can be in the following states:
+    /// - Not registered by the event loop (None).
+    /// - Present (Some(handler)).
+    /// - Currently executing the handler / in use (RefCell borrowed).
+    inner: RefCell<Option<EventHandlerData>>,
+}
+
+impl EventHandler {
+    pub(crate) const fn new() -> Self {
+        Self { inner: RefCell::new(None) }
+    }
+
+    /// Set the event loop handler for the duration of the given closure.
+    ///
+    /// This is similar to using the `scoped-tls` or `scoped-tls-hkt` crates
+    /// to store the handler in a thread local, such that it can be accessed
+    /// from within the closure.
+    pub(crate) fn set<'handler, R>(
+        &self,
+        handler: impl FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop) + 'handler,
+        closure: impl FnOnce() -> R,
+    ) -> R {
+        // SAFETY: We extend the lifetime of the handler here so that we can
+        // store it in `EventHandler`'s `RefCell`.
+        //
+        // This is sound, since we make sure to unset the handler again at the
+        // end of this function, and as such the lifetime isn't actually
+        // extended beyond `'handler`.
+        let handler = unsafe {
+            mem::transmute::<
+                Box<dyn FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop) + 'handler>,
+                Box<dyn FnMut(Event<HandlePendingUserEvents>, &RootActiveEventLoop) + 'static>,
+            >(Box::new(handler))
+        };
+
+        match self.inner.try_borrow_mut().as_deref_mut() {
+            Ok(Some(_)) => {
+                unreachable!("tried to set handler while another was already set");
+            },
+            Ok(data @ None) => {
+                *data = Some(EventHandlerData { handler });
+            },
+            Err(_) => {
+                unreachable!("tried to set handler that is currently in use");
+            },
+        }
+
+        struct ClearOnDrop<'a>(&'a EventHandler);
+
+        impl Drop for ClearOnDrop<'_> {
+            fn drop(&mut self) {
+                match self.0.inner.try_borrow_mut().as_deref_mut() {
+                    Ok(data @ Some(_)) => {
+                        *data = None;
+                    },
+                    Ok(None) => {
+                        tracing::error!("tried to clear handler, but no handler was set");
+                    },
+                    Err(_) => {
+                        // Note: This is not expected to ever happen, this
+                        // module generally controls the `RefCell`, and
+                        // prevents it from ever being borrowed outside of it.
+                        //
+                        // But if it _does_ happen, it is a serious error, and
+                        // we must abort the process, it'd be unsound if we
+                        // weren't able to unset the handler.
+                        eprintln!("tried to clear handler that is currently in use");
+                        std::process::abort();
+                    },
+                }
+            }
+        }
+
+        let _clear_on_drop = ClearOnDrop(self);
+
+        // Note: The RefCell should not be borrowed while executing the
+        // closure, that'd defeat the whole point.
+        closure()
+
+        // `_clear_on_drop` will be dropped here, or when unwinding, ensuring
+        // soundness.
+    }
+
+    pub(crate) fn in_use(&self) -> bool {
+        self.inner.try_borrow().is_err()
+    }
+
+    pub(crate) fn ready(&self) -> bool {
+        matches!(self.inner.try_borrow().as_deref(), Ok(Some(_)))
+    }
+
+    pub(crate) fn handle_event(
+        &self,
+        event: Event<HandlePendingUserEvents>,
+        event_loop: &RootActiveEventLoop,
+    ) {
+        match self.inner.try_borrow_mut().as_deref_mut() {
+            Ok(Some(EventHandlerData { handler })) => {
+                // It is important that we keep the reference borrowed here,
+                // so that `in_use` can properly detect that the handler is
+                // still in use.
+                //
+                // If the handler unwinds, the `RefMut` will ensure that the
+                // handler is no longer borrowed.
+                (handler)(event, event_loop);
+            },
+            Ok(None) => {
+                // `NSApplication`, our app delegate and this handler are all
+                // global state and so it's not impossible that we could get
+                // an event after the application has exited the `EventLoop`.
+                tracing::error!("tried to run event handler, but no handler was set");
+            },
+            Err(_) => {
+                // Prevent re-entrancy.
+                panic!("tried to handle event while another event is currently being handled");
+            },
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/event_loop.rs b/vendor/winit/src/platform_impl/macos/event_loop.rs
new file mode 100644
index 00000000..5c093d5a
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/event_loop.rs
@@ -0,0 +1,523 @@
+use std::any::Any;
+use std::cell::Cell;
+use std::collections::VecDeque;
+use std::marker::PhantomData;
+use std::os::raw::c_void;
+use std::panic::{catch_unwind, resume_unwind, RefUnwindSafe, UnwindSafe};
+use std::ptr;
+use std::rc::{Rc, Weak};
+use std::sync::mpsc;
+use std::time::{Duration, Instant};
+
+use core_foundation::base::{CFIndex, CFRelease};
+use core_foundation::runloop::{
+    kCFRunLoopCommonModes, CFRunLoopAddSource, CFRunLoopGetMain, CFRunLoopSourceContext,
+    CFRunLoopSourceCreate, CFRunLoopSourceRef, CFRunLoopSourceSignal, CFRunLoopWakeUp,
+};
+use objc2::rc::{autoreleasepool, Retained};
+use objc2::runtime::ProtocolObject;
+use objc2::sel;
+use objc2_app_kit::{NSApplication, NSApplicationActivationPolicy, NSWindow};
+use objc2_foundation::{MainThreadMarker, NSObjectProtocol};
+
+use super::app::override_send_event;
+use super::app_state::{ApplicationDelegate, HandlePendingUserEvents};
+use super::event::dummy_event;
+use super::monitor::{self, MonitorHandle};
+use super::observer::setup_control_flow_observers;
+use crate::error::EventLoopError;
+use crate::event::Event;
+use crate::event_loop::{
+    ActiveEventLoop as RootWindowTarget, ControlFlow, DeviceEvents, EventLoopClosed,
+};
+use crate::platform::macos::ActivationPolicy;
+use crate::platform::pump_events::PumpStatus;
+use crate::platform_impl::platform::cursor::CustomCursor;
+use crate::window::{CustomCursor as RootCustomCursor, CustomCursorSource, Theme};
+
+#[derive(Default)]
+pub struct PanicInfo {
+    inner: Cell<Option<Box<dyn Any + Send + 'static>>>,
+}
+
+// WARNING:
+// As long as this struct is used through its `impl`, it is UnwindSafe.
+// (If `get_mut` is called on `inner`, unwind safety may get broken.)
+impl UnwindSafe for PanicInfo {}
+impl RefUnwindSafe for PanicInfo {}
+impl PanicInfo {
+    pub fn is_panicking(&self) -> bool {
+        let inner = self.inner.take();
+        let result = inner.is_some();
+        self.inner.set(inner);
+        result
+    }
+
+    /// Overwrites the current state if the current state is not panicking
+    pub fn set_panic(&self, p: Box<dyn Any + Send + 'static>) {
+        if !self.is_panicking() {
+            self.inner.set(Some(p));
+        }
+    }
+
+    pub fn take(&self) -> Option<Box<dyn Any + Send + 'static>> {
+        self.inner.take()
+    }
+}
+
+#[derive(Debug)]
+pub struct ActiveEventLoop {
+    delegate: Retained<ApplicationDelegate>,
+    pub(super) mtm: MainThreadMarker,
+}
+
+impl ActiveEventLoop {
+    pub(super) fn new_root(delegate: Retained<ApplicationDelegate>) -> RootWindowTarget {
+        let mtm = MainThreadMarker::from(&*delegate);
+        let p = Self { delegate, mtm };
+        RootWindowTarget { p, _marker: PhantomData }
+    }
+
+    pub(super) fn app_delegate(&self) -> &ApplicationDelegate {
+        &self.delegate
+    }
+
+    pub fn create_custom_cursor(&self, source: CustomCursorSource) -> RootCustomCursor {
+        RootCustomCursor { inner: CustomCursor::new(source.inner) }
+    }
+
+    #[inline]
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        monitor::available_monitors()
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        let monitor = monitor::primary_monitor();
+        Some(monitor)
+    }
+
+    #[inline]
+    pub fn listen_device_events(&self, _allowed: DeviceEvents) {}
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::AppKit(rwh_05::AppKitDisplayHandle::empty())
+    }
+
+    #[inline]
+    pub fn system_theme(&self) -> Option<Theme> {
+        let app = NSApplication::sharedApplication(self.mtm);
+
+        if app.respondsToSelector(sel!(effectiveAppearance)) {
+            Some(super::window_delegate::appearance_to_theme(&app.effectiveAppearance()))
+        } else {
+            Some(Theme::Light)
+        }
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::AppKit(rwh_06::AppKitDisplayHandle::new()))
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.delegate.set_control_flow(control_flow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.delegate.control_flow()
+    }
+
+    pub(crate) fn exit(&self) {
+        self.delegate.exit()
+    }
+
+    pub(crate) fn clear_exit(&self) {
+        self.delegate.clear_exit()
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.delegate.exiting()
+    }
+
+    pub(crate) fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle
+    }
+
+    pub(crate) fn hide_application(&self) {
+        NSApplication::sharedApplication(self.mtm).hide(None)
+    }
+
+    pub(crate) fn hide_other_applications(&self) {
+        NSApplication::sharedApplication(self.mtm).hideOtherApplications(None)
+    }
+
+    pub(crate) fn set_allows_automatic_window_tabbing(&self, enabled: bool) {
+        NSWindow::setAllowsAutomaticWindowTabbing(enabled, self.mtm)
+    }
+
+    pub(crate) fn allows_automatic_window_tabbing(&self) -> bool {
+        NSWindow::allowsAutomaticWindowTabbing(self.mtm)
+    }
+}
+
+fn map_user_event<T: 'static>(
+    mut handler: impl FnMut(Event<T>, &RootWindowTarget),
+    receiver: Rc<mpsc::Receiver<T>>,
+) -> impl FnMut(Event<HandlePendingUserEvents>, &RootWindowTarget) {
+    move |event, window_target| match event.map_nonuser_event() {
+        Ok(event) => (handler)(event, window_target),
+        Err(_) => {
+            for event in receiver.try_iter() {
+                (handler)(Event::UserEvent(event), window_target);
+            }
+        },
+    }
+}
+
+pub struct EventLoop<T: 'static> {
+    /// Store a reference to the application for convenience.
+    ///
+    /// We intentionally don't store `WinitApplication` since we want to have
+    /// the possibility of swapping that out at some point.
+    app: Retained<NSApplication>,
+    /// The application delegate that we've registered.
+    ///
+    /// The delegate is only weakly referenced by NSApplication, so we must
+    /// keep it around here as well.
+    delegate: Retained<ApplicationDelegate>,
+
+    // Event sender and receiver, used for EventLoopProxy.
+    sender: mpsc::Sender<T>,
+    receiver: Rc<mpsc::Receiver<T>>,
+
+    window_target: RootWindowTarget,
+    panic_info: Rc<PanicInfo>,
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) struct PlatformSpecificEventLoopAttributes {
+    pub(crate) activation_policy: Option<ActivationPolicy>,
+    pub(crate) default_menu: bool,
+    pub(crate) activate_ignoring_other_apps: bool,
+}
+
+impl Default for PlatformSpecificEventLoopAttributes {
+    fn default() -> Self {
+        Self { activation_policy: None, default_menu: true, activate_ignoring_other_apps: true }
+    }
+}
+
+impl<T> EventLoop<T> {
+    pub(crate) fn new(
+        attributes: &PlatformSpecificEventLoopAttributes,
+    ) -> Result<Self, EventLoopError> {
+        let mtm = MainThreadMarker::new()
+            .expect("on macOS, `EventLoop` must be created on the main thread!");
+
+        // Initialize the application (if it has not already been).
+        let app = NSApplication::sharedApplication(mtm);
+
+        let activation_policy = match attributes.activation_policy {
+            None => None,
+            Some(ActivationPolicy::Regular) => Some(NSApplicationActivationPolicy::Regular),
+            Some(ActivationPolicy::Accessory) => Some(NSApplicationActivationPolicy::Accessory),
+            Some(ActivationPolicy::Prohibited) => Some(NSApplicationActivationPolicy::Prohibited),
+        };
+        let delegate = ApplicationDelegate::new(
+            mtm,
+            activation_policy,
+            attributes.default_menu,
+            attributes.activate_ignoring_other_apps,
+        );
+
+        autoreleasepool(|_| {
+            app.setDelegate(Some(ProtocolObject::from_ref(&*delegate)));
+        });
+
+        // Override `sendEvent:` on the application to forward to our application state.
+        override_send_event(&app);
+
+        let panic_info: Rc<PanicInfo> = Default::default();
+        setup_control_flow_observers(mtm, Rc::downgrade(&panic_info));
+
+        let (sender, receiver) = mpsc::channel();
+        Ok(EventLoop {
+            app,
+            delegate: delegate.clone(),
+            sender,
+            receiver: Rc::new(receiver),
+            window_target: RootWindowTarget {
+                p: ActiveEventLoop { delegate, mtm },
+                _marker: PhantomData,
+            },
+            panic_info,
+        })
+    }
+
+    pub fn window_target(&self) -> &RootWindowTarget {
+        &self.window_target
+    }
+
+    pub fn run<F>(mut self, handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<T>, &RootWindowTarget),
+    {
+        self.run_on_demand(handler)
+    }
+
+    // NB: we don't base this on `pump_events` because for `MacOs` we can't support
+    // `pump_events` elegantly (we just ask to run the loop for a "short" amount of
+    // time and so a layered implementation would end up using a lot of CPU due to
+    // redundant wake ups.
+    pub fn run_on_demand<F>(&mut self, handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<T>, &RootWindowTarget),
+    {
+        let handler = map_user_event(handler, self.receiver.clone());
+
+        self.delegate.set_event_handler(handler, || {
+            autoreleasepool(|_| {
+                // clear / normalize pump_events state
+                self.delegate.set_wait_timeout(None);
+                self.delegate.set_stop_before_wait(false);
+                self.delegate.set_stop_after_wait(false);
+                self.delegate.set_stop_on_redraw(false);
+
+                if self.delegate.is_launched() {
+                    debug_assert!(!self.delegate.is_running());
+                    self.delegate.set_is_running(true);
+                    self.delegate.dispatch_init_events();
+                }
+
+                // SAFETY: We do not run the application re-entrantly
+                unsafe { self.app.run() };
+
+                // While the app is running it's possible that we catch a panic
+                // to avoid unwinding across an objective-c ffi boundary, which
+                // will lead to us stopping the `NSApplication` and saving the
+                // `PanicInfo` so that we can resume the unwind at a controlled,
+                // safe point in time.
+                if let Some(panic) = self.panic_info.take() {
+                    resume_unwind(panic);
+                }
+
+                self.delegate.internal_exit()
+            })
+        });
+
+        Ok(())
+    }
+
+    pub fn pump_events<F>(&mut self, timeout: Option<Duration>, handler: F) -> PumpStatus
+    where
+        F: FnMut(Event<T>, &RootWindowTarget),
+    {
+        let handler = map_user_event(handler, self.receiver.clone());
+
+        self.delegate.set_event_handler(handler, || {
+            autoreleasepool(|_| {
+                // As a special case, if the application hasn't been launched yet then we at least
+                // run the loop until it has fully launched.
+                if !self.delegate.is_launched() {
+                    debug_assert!(!self.delegate.is_running());
+
+                    self.delegate.set_stop_on_launch();
+                    // SAFETY: We do not run the application re-entrantly
+                    unsafe { self.app.run() };
+
+                    // Note: we dispatch `NewEvents(Init)` + `Resumed` events after the application
+                    // has launched
+                } else if !self.delegate.is_running() {
+                    // Even though the application may have been launched, it's possible we aren't
+                    // running if the `EventLoop` was run before and has since
+                    // exited. This indicates that we just starting to re-run
+                    // the same `EventLoop` again.
+                    self.delegate.set_is_running(true);
+                    self.delegate.dispatch_init_events();
+                } else {
+                    // Only run for as long as the given `Duration` allows so we don't block the
+                    // external loop.
+                    match timeout {
+                        Some(Duration::ZERO) => {
+                            self.delegate.set_wait_timeout(None);
+                            self.delegate.set_stop_before_wait(true);
+                        },
+                        Some(duration) => {
+                            self.delegate.set_stop_before_wait(false);
+                            let timeout = Instant::now() + duration;
+                            self.delegate.set_wait_timeout(Some(timeout));
+                            self.delegate.set_stop_after_wait(true);
+                        },
+                        None => {
+                            self.delegate.set_wait_timeout(None);
+                            self.delegate.set_stop_before_wait(false);
+                            self.delegate.set_stop_after_wait(true);
+                        },
+                    }
+                    self.delegate.set_stop_on_redraw(true);
+                    // SAFETY: We do not run the application re-entrantly
+                    unsafe { self.app.run() };
+                }
+
+                // While the app is running it's possible that we catch a panic
+                // to avoid unwinding across an objective-c ffi boundary, which
+                // will lead to us stopping the application and saving the
+                // `PanicInfo` so that we can resume the unwind at a controlled,
+                // safe point in time.
+                if let Some(panic) = self.panic_info.take() {
+                    resume_unwind(panic);
+                }
+
+                if self.delegate.exiting() {
+                    self.delegate.internal_exit();
+                    PumpStatus::Exit(0)
+                } else {
+                    PumpStatus::Continue
+                }
+            })
+        })
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy::new(self.sender.clone())
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct OwnedDisplayHandle;
+
+impl OwnedDisplayHandle {
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::AppKitDisplayHandle::empty().into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::AppKitDisplayHandle::new().into())
+    }
+}
+
+pub(super) fn stop_app_immediately(app: &NSApplication) {
+    autoreleasepool(|_| {
+        app.stop(None);
+        // To stop event loop immediately, we need to post some event here.
+        // See: https://stackoverflow.com/questions/48041279/stopping-the-nsapplication-main-event-loop/48064752#48064752
+        app.postEvent_atStart(&dummy_event().unwrap(), true);
+    });
+}
+
+/// Tell all windows to close.
+///
+/// This will synchronously trigger `WindowEvent::Destroyed` within
+/// `windowWillClose:`, giving the application one last chance to handle
+/// those events. It doesn't matter if the user also ends up closing the
+/// windows in `Window`'s `Drop` impl, once a window has been closed once, it
+/// stays closed.
+///
+/// This ensures that no windows linger on after the event loop has exited,
+/// see <https://github.com/rust-windowing/winit/issues/4135>.
+pub(super) fn notify_windows_of_exit(app: &NSApplication) {
+    for window in app.windows() {
+        window.close();
+    }
+}
+
+/// Catches panics that happen inside `f` and when a panic
+/// happens, stops the `sharedApplication`
+#[inline]
+pub fn stop_app_on_panic<F: FnOnce() -> R + UnwindSafe, R>(
+    mtm: MainThreadMarker,
+    panic_info: Weak<PanicInfo>,
+    f: F,
+) -> Option<R> {
+    match catch_unwind(f) {
+        Ok(r) => Some(r),
+        Err(e) => {
+            // It's important that we set the panic before requesting a `stop`
+            // because some callback are still called during the `stop` message
+            // and we need to know in those callbacks if the application is currently
+            // panicking
+            {
+                let panic_info = panic_info.upgrade().unwrap();
+                panic_info.set_panic(e);
+            }
+            let app = NSApplication::sharedApplication(mtm);
+            stop_app_immediately(&app);
+            None
+        },
+    }
+}
+
+pub struct EventLoopProxy<T> {
+    sender: mpsc::Sender<T>,
+    source: CFRunLoopSourceRef,
+}
+
+unsafe impl<T: Send> Send for EventLoopProxy<T> {}
+unsafe impl<T: Send> Sync for EventLoopProxy<T> {}
+
+impl<T> Drop for EventLoopProxy<T> {
+    fn drop(&mut self) {
+        unsafe {
+            CFRelease(self.source as _);
+        }
+    }
+}
+
+impl<T> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        EventLoopProxy::new(self.sender.clone())
+    }
+}
+
+impl<T> EventLoopProxy<T> {
+    fn new(sender: mpsc::Sender<T>) -> Self {
+        unsafe {
+            // just wake up the eventloop
+            extern "C" fn event_loop_proxy_handler(_: *const c_void) {}
+
+            // adding a Source to the main CFRunLoop lets us wake it up and
+            // process user events through the normal OS EventLoop mechanisms.
+            let rl = CFRunLoopGetMain();
+            let mut context = CFRunLoopSourceContext {
+                version: 0,
+                info: ptr::null_mut(),
+                retain: None,
+                release: None,
+                copyDescription: None,
+                equal: None,
+                hash: None,
+                schedule: None,
+                cancel: None,
+                perform: event_loop_proxy_handler,
+            };
+            let source = CFRunLoopSourceCreate(ptr::null_mut(), CFIndex::MAX - 1, &mut context);
+            CFRunLoopAddSource(rl, source, kCFRunLoopCommonModes);
+            CFRunLoopWakeUp(rl);
+
+            EventLoopProxy { sender, source }
+        }
+    }
+
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        self.sender.send(event).map_err(|mpsc::SendError(x)| EventLoopClosed(x))?;
+        unsafe {
+            // let the main thread know there's a new event
+            CFRunLoopSourceSignal(self.source);
+            let rl = CFRunLoopGetMain();
+            CFRunLoopWakeUp(rl);
+        }
+        Ok(())
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/ffi.rs b/vendor/winit/src/platform_impl/macos/ffi.rs
new file mode 100644
index 00000000..1daee071
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/ffi.rs
@@ -0,0 +1,256 @@
+// TODO: Upstream these
+
+#![allow(dead_code, non_snake_case, non_upper_case_globals)]
+
+use std::ffi::c_void;
+
+use core_foundation::array::CFArrayRef;
+use core_foundation::dictionary::CFDictionaryRef;
+use core_foundation::string::CFStringRef;
+use core_foundation::uuid::CFUUIDRef;
+use core_graphics::base::CGError;
+use core_graphics::display::{CGDirectDisplayID, CGDisplayConfigRef};
+use objc2::ffi::NSInteger;
+use objc2::runtime::AnyObject;
+
+pub type CGDisplayFadeInterval = f32;
+pub type CGDisplayReservationInterval = f32;
+pub type CGDisplayBlendFraction = f32;
+
+pub const kCGDisplayBlendNormal: f32 = 0.0;
+pub const kCGDisplayBlendSolidColor: f32 = 1.0;
+
+pub type CGDisplayFadeReservationToken = u32;
+pub const kCGDisplayFadeReservationInvalidToken: CGDisplayFadeReservationToken = 0;
+
+pub type Boolean = u8;
+pub const FALSE: Boolean = 0;
+pub const TRUE: Boolean = 1;
+
+pub const kCGErrorSuccess: i32 = 0;
+pub const kCGErrorFailure: i32 = 1000;
+pub const kCGErrorIllegalArgument: i32 = 1001;
+pub const kCGErrorInvalidConnection: i32 = 1002;
+pub const kCGErrorInvalidContext: i32 = 1003;
+pub const kCGErrorCannotComplete: i32 = 1004;
+pub const kCGErrorNotImplemented: i32 = 1006;
+pub const kCGErrorRangeCheck: i32 = 1007;
+pub const kCGErrorTypeCheck: i32 = 1008;
+pub const kCGErrorInvalidOperation: i32 = 1010;
+pub const kCGErrorNoneAvailable: i32 = 1011;
+
+pub const IO1BitIndexedPixels: &str = "P";
+pub const IO2BitIndexedPixels: &str = "PP";
+pub const IO4BitIndexedPixels: &str = "PPPP";
+pub const IO8BitIndexedPixels: &str = "PPPPPPPP";
+pub const IO16BitDirectPixels: &str = "-RRRRRGGGGGBBBBB";
+pub const IO32BitDirectPixels: &str = "--------RRRRRRRRGGGGGGGGBBBBBBBB";
+
+pub const kIO30BitDirectPixels: &str = "--RRRRRRRRRRGGGGGGGGGGBBBBBBBBBB";
+pub const kIO64BitDirectPixels: &str = "-16R16G16B16";
+
+pub const kIO16BitFloatPixels: &str = "-16FR16FG16FB16";
+pub const kIO32BitFloatPixels: &str = "-32FR32FG32FB32";
+
+pub const IOYUV422Pixels: &str = "Y4U2V2";
+pub const IO8BitOverlayPixels: &str = "O8";
+
+pub type CGWindowLevel = i32;
+pub type CGDisplayModeRef = *mut c_void;
+
+// `CGDisplayCreateUUIDFromDisplayID` comes from the `ColorSync` framework.
+// However, that framework was only introduced "publicly" in macOS 10.13.
+//
+// Since we want to support older versions, we can't link to `ColorSync`
+// directly. Fortunately, it has always been available as a subframework of
+// `ApplicationServices`, see:
+// https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/SystemFrameworks/SystemFrameworks.html#//apple_ref/doc/uid/TP40001067-CH210-BBCFFIEG
+#[link(name = "ApplicationServices", kind = "framework")]
+extern "C" {
+    pub fn CGDisplayCreateUUIDFromDisplayID(display: CGDirectDisplayID) -> CFUUIDRef;
+
+    pub fn CGDisplayGetDisplayIDFromUUID(uuid: CFUUIDRef) -> CGDirectDisplayID;
+}
+
+#[link(name = "CoreGraphics", kind = "framework")]
+extern "C" {
+    pub fn CGRestorePermanentDisplayConfiguration();
+    pub fn CGDisplayCapture(display: CGDirectDisplayID) -> CGError;
+    pub fn CGDisplayRelease(display: CGDirectDisplayID) -> CGError;
+    pub fn CGConfigureDisplayFadeEffect(
+        config: CGDisplayConfigRef,
+        fadeOutSeconds: CGDisplayFadeInterval,
+        fadeInSeconds: CGDisplayFadeInterval,
+        fadeRed: f32,
+        fadeGreen: f32,
+        fadeBlue: f32,
+    ) -> CGError;
+    pub fn CGAcquireDisplayFadeReservation(
+        seconds: CGDisplayReservationInterval,
+        token: *mut CGDisplayFadeReservationToken,
+    ) -> CGError;
+    pub fn CGDisplayFade(
+        token: CGDisplayFadeReservationToken,
+        duration: CGDisplayFadeInterval,
+        startBlend: CGDisplayBlendFraction,
+        endBlend: CGDisplayBlendFraction,
+        redBlend: f32,
+        greenBlend: f32,
+        blueBlend: f32,
+        synchronous: Boolean,
+    ) -> CGError;
+    pub fn CGReleaseDisplayFadeReservation(token: CGDisplayFadeReservationToken) -> CGError;
+    pub fn CGShieldingWindowLevel() -> CGWindowLevel;
+    pub fn CGDisplaySetDisplayMode(
+        display: CGDirectDisplayID,
+        mode: CGDisplayModeRef,
+        options: CFDictionaryRef,
+    ) -> CGError;
+    pub fn CGDisplayCopyAllDisplayModes(
+        display: CGDirectDisplayID,
+        options: CFDictionaryRef,
+    ) -> CFArrayRef;
+    pub fn CGDisplayModeGetPixelWidth(mode: CGDisplayModeRef) -> usize;
+    pub fn CGDisplayModeGetPixelHeight(mode: CGDisplayModeRef) -> usize;
+    pub fn CGDisplayModeGetRefreshRate(mode: CGDisplayModeRef) -> f64;
+    pub fn CGDisplayModeCopyPixelEncoding(mode: CGDisplayModeRef) -> CFStringRef;
+    pub fn CGDisplayModeRetain(mode: CGDisplayModeRef);
+    pub fn CGDisplayModeRelease(mode: CGDisplayModeRef);
+
+    // Wildly used private APIs; Apple uses them for their Terminal.app.
+    pub fn CGSMainConnectionID() -> *mut AnyObject;
+    pub fn CGSSetWindowBackgroundBlurRadius(
+        connection_id: *mut AnyObject,
+        window_id: NSInteger,
+        radius: i64,
+    ) -> i32;
+}
+
+mod core_video {
+    use super::*;
+
+    #[link(name = "CoreVideo", kind = "framework")]
+    extern "C" {}
+
+    // CVBase.h
+
+    pub type CVTimeFlags = i32; // int32_t
+    pub const kCVTimeIsIndefinite: CVTimeFlags = 1 << 0;
+
+    #[repr(C)]
+    #[derive(Debug, Clone)]
+    pub struct CVTime {
+        pub time_value: i64, // int64_t
+        pub time_scale: i32, // int32_t
+        pub flags: i32,      // int32_t
+    }
+
+    // CVReturn.h
+
+    pub type CVReturn = i32; // int32_t
+    pub const kCVReturnSuccess: CVReturn = 0;
+
+    // CVDisplayLink.h
+
+    pub type CVDisplayLinkRef = *mut c_void;
+
+    extern "C" {
+        pub fn CVDisplayLinkCreateWithCGDisplay(
+            displayID: CGDirectDisplayID,
+            displayLinkOut: *mut CVDisplayLinkRef,
+        ) -> CVReturn;
+        pub fn CVDisplayLinkGetNominalOutputVideoRefreshPeriod(
+            displayLink: CVDisplayLinkRef,
+        ) -> CVTime;
+        pub fn CVDisplayLinkRelease(displayLink: CVDisplayLinkRef);
+    }
+}
+
+pub use core_video::*;
+#[repr(transparent)]
+pub struct TISInputSource(std::ffi::c_void);
+pub type TISInputSourceRef = *mut TISInputSource;
+
+#[repr(transparent)]
+pub struct UCKeyboardLayout(std::ffi::c_void);
+
+pub type OptionBits = u32;
+pub type UniCharCount = std::os::raw::c_ulong;
+pub type UniChar = std::os::raw::c_ushort;
+pub type OSStatus = i32;
+
+#[allow(non_upper_case_globals)]
+pub const kUCKeyActionDisplay: u16 = 3;
+#[allow(non_upper_case_globals)]
+pub const kUCKeyTranslateNoDeadKeysMask: OptionBits = 1;
+
+#[link(name = "Carbon", kind = "framework")]
+extern "C" {
+    pub static kTISPropertyUnicodeKeyLayoutData: CFStringRef;
+
+    #[allow(non_snake_case)]
+    pub fn TISGetInputSourceProperty(
+        inputSource: TISInputSourceRef,
+        propertyKey: CFStringRef,
+    ) -> *mut c_void;
+
+    pub fn TISCopyCurrentKeyboardLayoutInputSource() -> TISInputSourceRef;
+
+    pub fn LMGetKbdType() -> u8;
+
+    #[allow(non_snake_case)]
+    pub fn UCKeyTranslate(
+        keyLayoutPtr: *const UCKeyboardLayout,
+        virtualKeyCode: u16,
+        keyAction: u16,
+        modifierKeyState: u32,
+        keyboardType: u32,
+        keyTranslateOptions: OptionBits,
+        deadKeyState: *mut u32,
+        maxStringLength: UniCharCount,
+        actualStringLength: *mut UniCharCount,
+        unicodeString: *mut UniChar,
+    ) -> OSStatus;
+}
+
+// CGWindowLevel.h
+//
+// Note: There are two different things at play in this header:
+// `CGWindowLevel` and `CGWindowLevelKey`.
+//
+// It seems like there was a push towards using "key" values instead of the
+// raw window level values, and then you were supposed to use
+// `CGWindowLevelForKey` to get the actual level.
+//
+// But the values that `NSWindowLevel` has are compiled in, and as such has
+// to remain ABI compatible, so they're safe for us to hardcode as well.
+#[allow(dead_code, non_upper_case_globals)]
+mod window_level {
+    const kCGNumReservedWindowLevels: i32 = 16;
+    const kCGNumReservedBaseWindowLevels: i32 = 5;
+
+    pub const kCGBaseWindowLevel: i32 = i32::MIN;
+    pub const kCGMinimumWindowLevel: i32 = kCGBaseWindowLevel + kCGNumReservedBaseWindowLevels;
+    pub const kCGMaximumWindowLevel: i32 = i32::MAX - kCGNumReservedWindowLevels;
+
+    pub const kCGDesktopWindowLevel: i32 = kCGMinimumWindowLevel + 20;
+    pub const kCGDesktopIconWindowLevel: i32 = kCGDesktopWindowLevel + 20;
+    pub const kCGBackstopMenuLevel: i32 = -20;
+    pub const kCGNormalWindowLevel: i32 = 0;
+    pub const kCGFloatingWindowLevel: i32 = 3;
+    pub const kCGTornOffMenuWindowLevel: i32 = 3;
+    pub const kCGModalPanelWindowLevel: i32 = 8;
+    pub const kCGUtilityWindowLevel: i32 = 19;
+    pub const kCGDockWindowLevel: i32 = 20;
+    pub const kCGMainMenuWindowLevel: i32 = 24;
+    pub const kCGStatusWindowLevel: i32 = 25;
+    pub const kCGPopUpMenuWindowLevel: i32 = 101;
+    pub const kCGOverlayWindowLevel: i32 = 102;
+    pub const kCGHelpWindowLevel: i32 = 200;
+    pub const kCGDraggingWindowLevel: i32 = 500;
+    pub const kCGScreenSaverWindowLevel: i32 = 1000;
+    pub const kCGAssistiveTechHighWindowLevel: i32 = 1500;
+    pub const kCGCursorWindowLevel: i32 = kCGMaximumWindowLevel - 1;
+}
+
+pub use window_level::*;
diff --git a/vendor/winit/src/platform_impl/macos/menu.rs b/vendor/winit/src/platform_impl/macos/menu.rs
new file mode 100644
index 00000000..cdebea0b
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/menu.rs
@@ -0,0 +1,107 @@
+use objc2::rc::Retained;
+use objc2::runtime::Sel;
+use objc2::sel;
+use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSMenu, NSMenuItem};
+use objc2_foundation::{ns_string, MainThreadMarker, NSProcessInfo, NSString};
+
+struct KeyEquivalent<'a> {
+    key: &'a NSString,
+    masks: Option<NSEventModifierFlags>,
+}
+
+pub fn initialize(app: &NSApplication) {
+    let mtm = MainThreadMarker::from(app);
+    let menubar = NSMenu::new(mtm);
+    let app_menu_item = NSMenuItem::new(mtm);
+    menubar.addItem(&app_menu_item);
+
+    let app_menu = NSMenu::new(mtm);
+    let process_name = NSProcessInfo::processInfo().processName();
+
+    // About menu item
+    let about_item_title = ns_string!("About ").stringByAppendingString(&process_name);
+    let about_item =
+        menu_item(mtm, &about_item_title, Some(sel!(orderFrontStandardAboutPanel:)), None);
+
+    // Services menu item
+    let services_menu = NSMenu::new(mtm);
+    let services_item = menu_item(mtm, ns_string!("Services"), None, None);
+    services_item.setSubmenu(Some(&services_menu));
+
+    // Separator menu item
+    let sep_first = NSMenuItem::separatorItem(mtm);
+
+    // Hide application menu item
+    let hide_item_title = ns_string!("Hide ").stringByAppendingString(&process_name);
+    let hide_item = menu_item(
+        mtm,
+        &hide_item_title,
+        Some(sel!(hide:)),
+        Some(KeyEquivalent { key: ns_string!("h"), masks: None }),
+    );
+
+    // Hide other applications menu item
+    let hide_others_item_title = ns_string!("Hide Others");
+    let hide_others_item = menu_item(
+        mtm,
+        hide_others_item_title,
+        Some(sel!(hideOtherApplications:)),
+        Some(KeyEquivalent {
+            key: ns_string!("h"),
+            masks: Some(
+                NSEventModifierFlags::NSEventModifierFlagOption
+                    | NSEventModifierFlags::NSEventModifierFlagCommand,
+            ),
+        }),
+    );
+
+    // Show applications menu item
+    let show_all_item_title = ns_string!("Show All");
+    let show_all_item =
+        menu_item(mtm, show_all_item_title, Some(sel!(unhideAllApplications:)), None);
+
+    // Separator menu item
+    let sep = NSMenuItem::separatorItem(mtm);
+
+    // Quit application menu item
+    let quit_item_title = ns_string!("Quit ").stringByAppendingString(&process_name);
+    let quit_item = menu_item(
+        mtm,
+        &quit_item_title,
+        Some(sel!(terminate:)),
+        Some(KeyEquivalent { key: ns_string!("q"), masks: None }),
+    );
+
+    app_menu.addItem(&about_item);
+    app_menu.addItem(&sep_first);
+    app_menu.addItem(&services_item);
+    app_menu.addItem(&hide_item);
+    app_menu.addItem(&hide_others_item);
+    app_menu.addItem(&show_all_item);
+    app_menu.addItem(&sep);
+    app_menu.addItem(&quit_item);
+    app_menu_item.setSubmenu(Some(&app_menu));
+
+    unsafe { app.setServicesMenu(Some(&services_menu)) };
+    app.setMainMenu(Some(&menubar));
+}
+
+fn menu_item(
+    mtm: MainThreadMarker,
+    title: &NSString,
+    selector: Option<Sel>,
+    key_equivalent: Option<KeyEquivalent<'_>>,
+) -> Retained<NSMenuItem> {
+    let (key, masks) = match key_equivalent {
+        Some(ke) => (ke.key, ke.masks),
+        None => (ns_string!(""), None),
+    };
+    let item = unsafe {
+        NSMenuItem::initWithTitle_action_keyEquivalent(mtm.alloc(), title, selector, key)
+    };
+    if let Some(masks) = masks {
+        item.setKeyEquivalentModifierMask(masks)
+    }
+
+    item
+}
diff --git a/vendor/winit/src/platform_impl/macos/mod.rs b/vendor/winit/src/platform_impl/macos/mod.rs
new file mode 100644
index 00000000..1b427a87
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/mod.rs
@@ -0,0 +1,61 @@
+#[macro_use]
+mod util;
+
+mod app;
+mod app_state;
+mod cursor;
+mod event;
+mod event_handler;
+mod event_loop;
+mod ffi;
+mod menu;
+mod monitor;
+mod observer;
+mod view;
+mod window;
+mod window_delegate;
+
+use std::fmt;
+
+pub(crate) use self::event::{physicalkey_to_scancode, scancode_to_physicalkey, KeyEventExtra};
+pub(crate) use self::event_loop::{
+    ActiveEventLoop, EventLoop, EventLoopProxy, OwnedDisplayHandle,
+    PlatformSpecificEventLoopAttributes,
+};
+pub(crate) use self::monitor::{MonitorHandle, VideoModeHandle};
+pub(crate) use self::window::WindowId;
+pub(crate) use self::window_delegate::PlatformSpecificWindowAttributes;
+use crate::event::DeviceId as RootDeviceId;
+
+pub(crate) use self::cursor::CustomCursor as PlatformCustomCursor;
+pub(crate) use self::window::Window;
+pub(crate) use crate::cursor::OnlyCursorImageSource as PlatformCustomCursorSource;
+pub(crate) use crate::icon::NoIcon as PlatformIcon;
+pub(crate) use crate::platform_impl::Fullscreen;
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct DeviceId;
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        DeviceId
+    }
+}
+
+// Constant device ID; to be removed when if backend is updated to report real device IDs.
+pub(crate) const DEVICE_ID: RootDeviceId = RootDeviceId(DeviceId);
+
+#[derive(Debug)]
+pub enum OsError {
+    CGError(core_graphics::base::CGError),
+    CreationError(&'static str),
+}
+
+impl fmt::Display for OsError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            OsError::CGError(e) => f.pad(&format!("CGError {e}")),
+            OsError::CreationError(e) => f.pad(e),
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/monitor.rs b/vendor/winit/src/platform_impl/macos/monitor.rs
new file mode 100644
index 00000000..44e6316b
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/monitor.rs
@@ -0,0 +1,409 @@
+#![allow(clippy::unnecessary_cast)]
+
+use std::collections::VecDeque;
+use std::fmt;
+
+use core_foundation::array::{CFArrayGetCount, CFArrayGetValueAtIndex};
+use core_foundation::base::{CFRelease, TCFType};
+use core_foundation::string::CFString;
+use core_foundation::uuid::{CFUUIDGetUUIDBytes, CFUUID};
+use core_graphics::display::{
+    CGDirectDisplayID, CGDisplay, CGDisplayBounds, CGDisplayCopyDisplayMode,
+};
+use objc2::rc::Retained;
+use objc2::runtime::AnyObject;
+use objc2_app_kit::NSScreen;
+use objc2_foundation::{ns_string, run_on_main, MainThreadMarker, NSNumber, NSPoint, NSRect};
+use tracing::warn;
+
+use super::ffi;
+use crate::dpi::{LogicalPosition, PhysicalPosition, PhysicalSize};
+
+#[derive(Clone)]
+pub struct VideoModeHandle {
+    size: PhysicalSize<u32>,
+    bit_depth: u16,
+    refresh_rate_millihertz: u32,
+    pub(crate) monitor: MonitorHandle,
+    pub(crate) native_mode: NativeDisplayMode,
+}
+
+impl PartialEq for VideoModeHandle {
+    fn eq(&self, other: &Self) -> bool {
+        self.size == other.size
+            && self.bit_depth == other.bit_depth
+            && self.refresh_rate_millihertz == other.refresh_rate_millihertz
+            && self.monitor == other.monitor
+    }
+}
+
+impl Eq for VideoModeHandle {}
+
+impl std::hash::Hash for VideoModeHandle {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.size.hash(state);
+        self.bit_depth.hash(state);
+        self.refresh_rate_millihertz.hash(state);
+        self.monitor.hash(state);
+    }
+}
+
+impl std::fmt::Debug for VideoModeHandle {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("VideoModeHandle")
+            .field("size", &self.size)
+            .field("bit_depth", &self.bit_depth)
+            .field("refresh_rate_millihertz", &self.refresh_rate_millihertz)
+            .field("monitor", &self.monitor)
+            .finish()
+    }
+}
+
+pub struct NativeDisplayMode(pub ffi::CGDisplayModeRef);
+
+unsafe impl Send for NativeDisplayMode {}
+unsafe impl Sync for NativeDisplayMode {}
+
+impl Drop for NativeDisplayMode {
+    fn drop(&mut self) {
+        unsafe {
+            ffi::CGDisplayModeRelease(self.0);
+        }
+    }
+}
+
+impl Clone for NativeDisplayMode {
+    fn clone(&self) -> Self {
+        unsafe {
+            ffi::CGDisplayModeRetain(self.0);
+        }
+        NativeDisplayMode(self.0)
+    }
+}
+
+impl VideoModeHandle {
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.size
+    }
+
+    pub fn bit_depth(&self) -> u16 {
+        self.bit_depth
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.refresh_rate_millihertz
+    }
+
+    pub fn monitor(&self) -> MonitorHandle {
+        self.monitor.clone()
+    }
+}
+
+/// `CGDirectDisplayID` is documented as:
+/// > a framebuffer, a color correction (gamma) table, and possibly an attached monitor.
+///
+/// That is, it doesn't actually represent the monitor itself. Instead, we use the UUID of the
+/// monitor, as retrieved from `CGDisplayCreateUUIDFromDisplayID` (this makes the monitor ID stable,
+/// even across reboots and video mode changes).
+///
+/// NOTE: I'd be perfectly valid to store `[u8; 16]` in here instead, we only store `CFUUID` to
+/// avoid having to re-create it when we want to fetch the display ID.
+#[derive(Clone)]
+pub struct MonitorHandle(CFUUID);
+
+// SAFETY: CFUUID is immutable.
+// FIXME(madsmtm): Upstream this into `objc2-core-foundation`.
+unsafe impl Send for MonitorHandle {}
+unsafe impl Sync for MonitorHandle {}
+
+type MonitorUuid = [u8; 16];
+
+impl MonitorHandle {
+    /// Internal comparisons of [`MonitorHandle`]s are done first requesting a UUID for the handle.
+    fn uuid(&self) -> MonitorUuid {
+        let uuid = unsafe { CFUUIDGetUUIDBytes(self.0.as_concrete_TypeRef()) };
+        MonitorUuid::from([
+            uuid.byte0,
+            uuid.byte1,
+            uuid.byte2,
+            uuid.byte3,
+            uuid.byte4,
+            uuid.byte5,
+            uuid.byte6,
+            uuid.byte7,
+            uuid.byte8,
+            uuid.byte9,
+            uuid.byte10,
+            uuid.byte11,
+            uuid.byte12,
+            uuid.byte13,
+            uuid.byte14,
+            uuid.byte15,
+        ])
+    }
+
+    fn display_id(&self) -> CGDirectDisplayID {
+        unsafe { ffi::CGDisplayGetDisplayIDFromUUID(self.0.as_concrete_TypeRef()) }
+    }
+
+    #[track_caller]
+    pub(crate) fn new(display_id: CGDirectDisplayID) -> Option<Self> {
+        // kCGNullDirectDisplay
+        if display_id == 0 {
+            // `CGDisplayCreateUUIDFromDisplayID` checks kCGNullDirectDisplay internally.
+            warn!("constructing monitor from invalid display ID 0; falling back to main monitor");
+        }
+        let ptr = unsafe { ffi::CGDisplayCreateUUIDFromDisplayID(display_id) };
+        if ptr.is_null() {
+            return None;
+        }
+        Some(Self(unsafe { CFUUID::wrap_under_create_rule(ptr) }))
+    }
+}
+
+impl PartialEq for MonitorHandle {
+    fn eq(&self, other: &Self) -> bool {
+        self.uuid() == other.uuid()
+    }
+}
+
+impl Eq for MonitorHandle {}
+
+impl PartialOrd for MonitorHandle {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for MonitorHandle {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.uuid().cmp(&other.uuid())
+    }
+}
+
+impl std::hash::Hash for MonitorHandle {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.uuid().hash(state);
+    }
+}
+
+pub fn available_monitors() -> VecDeque<MonitorHandle> {
+    if let Ok(displays) = CGDisplay::active_displays() {
+        let mut monitors = VecDeque::with_capacity(displays.len());
+        for display in displays {
+            // Display ID just fetched from `CGGetActiveDisplayList`, should be fine to unwrap.
+            monitors.push_back(MonitorHandle::new(display).expect("invalid display ID"));
+        }
+        monitors
+    } else {
+        VecDeque::with_capacity(0)
+    }
+}
+
+pub fn primary_monitor() -> MonitorHandle {
+    // Display ID just fetched from `CGMainDisplayID`, should be fine to unwrap.
+    MonitorHandle::new(CGDisplay::main().id).expect("invalid display ID")
+}
+
+impl fmt::Debug for MonitorHandle {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("MonitorHandle")
+            .field("name", &self.name())
+            .field("native_identifier", &self.native_identifier())
+            .field("size", &self.size())
+            .field("position", &self.position())
+            .field("scale_factor", &self.scale_factor())
+            .field("refresh_rate_millihertz", &self.refresh_rate_millihertz())
+            .finish_non_exhaustive()
+    }
+}
+
+impl MonitorHandle {
+    // TODO: Be smarter about this:
+    // <https://github.com/glfw/glfw/blob/57cbded0760a50b9039ee0cb3f3c14f60145567c/src/cocoa_monitor.m#L44-L126>
+    pub fn name(&self) -> Option<String> {
+        let screen_num = CGDisplay::new(self.display_id()).model_number();
+        Some(format!("Monitor #{screen_num}"))
+    }
+
+    #[inline]
+    pub fn native_identifier(&self) -> u32 {
+        self.display_id()
+    }
+
+    pub fn size(&self) -> PhysicalSize<u32> {
+        let display = CGDisplay::new(self.display_id());
+        let height = display.pixels_high();
+        let width = display.pixels_wide();
+        PhysicalSize::from_logical::<_, f64>((width as f64, height as f64), self.scale_factor())
+    }
+
+    #[inline]
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        // This is already in screen coordinates. If we were using `NSScreen`,
+        // then a conversion would've been needed:
+        // flip_window_screen_coordinates(self.ns_screen(mtm)?.frame())
+        let bounds = unsafe { CGDisplayBounds(self.native_identifier()) };
+        let position = LogicalPosition::new(bounds.origin.x, bounds.origin.y);
+        position.to_physical(self.scale_factor())
+    }
+
+    pub fn scale_factor(&self) -> f64 {
+        run_on_main(|mtm| {
+            match self.ns_screen(mtm) {
+                Some(screen) => screen.backingScaleFactor() as f64,
+                None => 1.0, // default to 1.0 when we can't find the screen
+            }
+        })
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        unsafe {
+            let current_display_mode =
+                NativeDisplayMode(CGDisplayCopyDisplayMode(self.display_id()) as _);
+            let refresh_rate = ffi::CGDisplayModeGetRefreshRate(current_display_mode.0);
+            if refresh_rate > 0.0 {
+                return Some((refresh_rate * 1000.0).round() as u32);
+            }
+
+            let mut display_link = std::ptr::null_mut();
+            if ffi::CVDisplayLinkCreateWithCGDisplay(self.display_id(), &mut display_link)
+                != ffi::kCVReturnSuccess
+            {
+                return None;
+            }
+            let time = ffi::CVDisplayLinkGetNominalOutputVideoRefreshPeriod(display_link);
+            ffi::CVDisplayLinkRelease(display_link);
+
+            // This value is indefinite if an invalid display link was specified
+            if time.flags & ffi::kCVTimeIsIndefinite != 0 {
+                return None;
+            }
+
+            (time.time_scale as i64).checked_div(time.time_value).map(|v| (v * 1000) as u32)
+        }
+    }
+
+    pub fn video_modes(&self) -> impl Iterator<Item = VideoModeHandle> {
+        let refresh_rate_millihertz = self.refresh_rate_millihertz().unwrap_or(0);
+        let monitor = self.clone();
+
+        unsafe {
+            let modes = {
+                let array = ffi::CGDisplayCopyAllDisplayModes(self.display_id(), std::ptr::null());
+                if array.is_null() {
+                    // Occasionally, certain CalDigit Thunderbolt Hubs report a spurious monitor
+                    // during sleep/wake/cycling monitors. It tends to have null
+                    // or 1 video mode only. See <https://github.com/bevyengine/bevy/issues/17827>.
+                    warn!(monitor = ?self, "failed to get a list of display modes");
+                    Vec::new()
+                } else {
+                    let array_count = CFArrayGetCount(array);
+                    let modes: Vec<_> = (0..array_count)
+                        .map(move |i| {
+                            let mode = CFArrayGetValueAtIndex(array, i) as *mut _;
+                            ffi::CGDisplayModeRetain(mode);
+                            mode
+                        })
+                        .collect();
+                    CFRelease(array as *const _);
+                    modes
+                }
+            };
+
+            modes.into_iter().map(move |mode| {
+                let cg_refresh_rate_hertz = ffi::CGDisplayModeGetRefreshRate(mode);
+
+                // CGDisplayModeGetRefreshRate returns 0.0 for any display that
+                // isn't a CRT
+                let refresh_rate_millihertz = if cg_refresh_rate_hertz > 0.0 {
+                    (cg_refresh_rate_hertz * 1000.0).round() as u32
+                } else {
+                    refresh_rate_millihertz
+                };
+
+                let pixel_encoding =
+                    CFString::wrap_under_create_rule(ffi::CGDisplayModeCopyPixelEncoding(mode))
+                        .to_string();
+                let bit_depth = if pixel_encoding.eq_ignore_ascii_case(ffi::IO32BitDirectPixels) {
+                    32
+                } else if pixel_encoding.eq_ignore_ascii_case(ffi::IO16BitDirectPixels) {
+                    16
+                } else if pixel_encoding.eq_ignore_ascii_case(ffi::kIO30BitDirectPixels) {
+                    30
+                } else {
+                    unimplemented!()
+                };
+
+                VideoModeHandle {
+                    size: PhysicalSize::new(
+                        ffi::CGDisplayModeGetPixelWidth(mode) as u32,
+                        ffi::CGDisplayModeGetPixelHeight(mode) as u32,
+                    ),
+                    refresh_rate_millihertz,
+                    bit_depth,
+                    monitor: monitor.clone(),
+                    native_mode: NativeDisplayMode(mode),
+                }
+            })
+        }
+    }
+
+    pub(crate) fn ns_screen(&self, mtm: MainThreadMarker) -> Option<Retained<NSScreen>> {
+        let uuid = self.uuid();
+        NSScreen::screens(mtm).into_iter().find(|screen| {
+            let other_native_id = get_display_id(screen);
+            if let Some(other) = MonitorHandle::new(other_native_id) {
+                uuid == other.uuid()
+            } else {
+                // Display ID was just fetched from live NSScreen, but can still result in `None`
+                // with certain Thunderbolt docked monitors.
+                warn!(other_native_id, "comparing against screen with invalid display ID");
+                false
+            }
+        })
+    }
+}
+
+pub(crate) fn get_display_id(screen: &NSScreen) -> u32 {
+    let key = ns_string!("NSScreenNumber");
+
+    objc2::rc::autoreleasepool(|_| {
+        let device_description = screen.deviceDescription();
+
+        // Retrieve the CGDirectDisplayID associated with this screen
+        //
+        // SAFETY: The value from @"NSScreenNumber" in deviceDescription is guaranteed
+        // to be an NSNumber. See documentation for `deviceDescription` for details:
+        // <https://developer.apple.com/documentation/appkit/nsscreen/1388360-devicedescription?language=objc>
+        let obj = device_description
+            .get(key)
+            .expect("failed getting screen display id from device description");
+        let obj: *const AnyObject = obj;
+        let obj: *const NSNumber = obj.cast();
+        let obj: &NSNumber = unsafe { &*obj };
+
+        obj.as_u32()
+    })
+}
+
+/// Core graphics screen coordinates are relative to the top-left corner of
+/// the so-called "main" display, with y increasing downwards - which is
+/// exactly what we want in Winit.
+///
+/// However, `NSWindow` and `NSScreen` changes these coordinates to:
+/// 1. Be relative to the bottom-left corner of the "main" screen.
+/// 2. Be relative to the bottom-left corner of the window/screen itself.
+/// 3. Have y increasing upwards.
+///
+/// This conversion happens to be symmetric, so we only need this one function
+/// to convert between the two coordinate systems.
+pub(crate) fn flip_window_screen_coordinates(frame: NSRect) -> NSPoint {
+    // It is intentional that we use `CGMainDisplayID` (as opposed to
+    // `NSScreen::mainScreen`), because that's what the screen coordinates
+    // are relative to, no matter which display the window is currently on.
+    let main_screen_height = CGDisplay::main().bounds().size.height;
+
+    let y = main_screen_height - frame.size.height - frame.origin.y;
+    NSPoint::new(frame.origin.x, y)
+}
diff --git a/vendor/winit/src/platform_impl/macos/observer.rs b/vendor/winit/src/platform_impl/macos/observer.rs
new file mode 100644
index 00000000..83398030
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/observer.rs
@@ -0,0 +1,312 @@
+//! Utilities for working with `CFRunLoop`.
+//!
+//! See Apple's documentation on Run Loops for details:
+//! <https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/Multithreading/RunLoopManagement/RunLoopManagement.html>
+use std::cell::Cell;
+use std::ffi::c_void;
+use std::panic::{AssertUnwindSafe, UnwindSafe};
+use std::ptr;
+use std::rc::Weak;
+use std::time::Instant;
+
+use block2::Block;
+use core_foundation::base::{CFIndex, CFOptionFlags, CFRelease, CFTypeRef};
+use core_foundation::date::CFAbsoluteTimeGetCurrent;
+use core_foundation::runloop::{
+    kCFRunLoopAfterWaiting, kCFRunLoopBeforeWaiting, kCFRunLoopCommonModes, kCFRunLoopDefaultMode,
+    kCFRunLoopExit, CFRunLoopActivity, CFRunLoopAddObserver, CFRunLoopAddTimer, CFRunLoopGetMain,
+    CFRunLoopObserverCallBack, CFRunLoopObserverContext, CFRunLoopObserverCreate,
+    CFRunLoopObserverRef, CFRunLoopRef, CFRunLoopTimerCreate, CFRunLoopTimerInvalidate,
+    CFRunLoopTimerRef, CFRunLoopTimerSetNextFireDate, CFRunLoopWakeUp,
+};
+use objc2_foundation::MainThreadMarker;
+use tracing::error;
+
+use super::app_state::ApplicationDelegate;
+use super::event_loop::{stop_app_on_panic, PanicInfo};
+use super::ffi;
+
+unsafe fn control_flow_handler<F>(panic_info: *mut c_void, f: F)
+where
+    F: FnOnce(Weak<PanicInfo>) + UnwindSafe,
+{
+    let info_from_raw = unsafe { Weak::from_raw(panic_info as *mut PanicInfo) };
+    // Asserting unwind safety on this type should be fine because `PanicInfo` is
+    // `RefUnwindSafe` and `Rc<T>` is `UnwindSafe` if `T` is `RefUnwindSafe`.
+    let panic_info = AssertUnwindSafe(Weak::clone(&info_from_raw));
+    // `from_raw` takes ownership of the data behind the pointer.
+    // But if this scope takes ownership of the weak pointer, then
+    // the weak pointer will get free'd at the end of the scope.
+    // However we want to keep that weak reference around after the function.
+    std::mem::forget(info_from_raw);
+
+    let mtm = MainThreadMarker::new().unwrap();
+    stop_app_on_panic(mtm, Weak::clone(&panic_info), move || {
+        let _ = &panic_info;
+        f(panic_info.0)
+    });
+}
+
+// begin is queued with the highest priority to ensure it is processed before other observers
+extern "C" fn control_flow_begin_handler(
+    _: CFRunLoopObserverRef,
+    activity: CFRunLoopActivity,
+    panic_info: *mut c_void,
+) {
+    unsafe {
+        control_flow_handler(panic_info, |panic_info| {
+            #[allow(non_upper_case_globals)]
+            match activity {
+                kCFRunLoopAfterWaiting => {
+                    // trace!("Triggered `CFRunLoopAfterWaiting`");
+                    ApplicationDelegate::get(MainThreadMarker::new().unwrap()).wakeup(panic_info);
+                    // trace!("Completed `CFRunLoopAfterWaiting`");
+                },
+                _ => unreachable!(),
+            }
+        });
+    }
+}
+
+// end is queued with the lowest priority to ensure it is processed after other observers
+// without that, LoopExiting would  get sent after AboutToWait
+extern "C" fn control_flow_end_handler(
+    _: CFRunLoopObserverRef,
+    activity: CFRunLoopActivity,
+    panic_info: *mut c_void,
+) {
+    unsafe {
+        control_flow_handler(panic_info, |panic_info| {
+            #[allow(non_upper_case_globals)]
+            match activity {
+                kCFRunLoopBeforeWaiting => {
+                    // trace!("Triggered `CFRunLoopBeforeWaiting`");
+                    ApplicationDelegate::get(MainThreadMarker::new().unwrap()).cleared(panic_info);
+                    // trace!("Completed `CFRunLoopBeforeWaiting`");
+                },
+                kCFRunLoopExit => (), // unimplemented!(), // not expected to ever happen
+                _ => unreachable!(),
+            }
+        });
+    }
+}
+
+#[derive(Debug)]
+pub struct RunLoop(CFRunLoopRef);
+
+impl Default for RunLoop {
+    fn default() -> Self {
+        Self(ptr::null_mut())
+    }
+}
+
+impl RunLoop {
+    pub fn main(mtm: MainThreadMarker) -> Self {
+        // SAFETY: We have a MainThreadMarker here, which means we know we're on the main thread, so
+        // scheduling (and scheduling a non-`Send` block) to that thread is allowed.
+        let _ = mtm;
+        RunLoop(unsafe { CFRunLoopGetMain() })
+    }
+
+    pub fn wakeup(&self) {
+        unsafe { CFRunLoopWakeUp(self.0) }
+    }
+
+    unsafe fn add_observer(
+        &self,
+        flags: CFOptionFlags,
+        priority: CFIndex,
+        handler: CFRunLoopObserverCallBack,
+        context: *mut CFRunLoopObserverContext,
+    ) {
+        let observer = unsafe {
+            CFRunLoopObserverCreate(
+                ptr::null_mut(),
+                flags,
+                ffi::TRUE, // Indicates we want this to run repeatedly
+                priority,  // The lower the value, the sooner this will run
+                handler,
+                context,
+            )
+        };
+        unsafe { CFRunLoopAddObserver(self.0, observer, kCFRunLoopCommonModes) };
+    }
+
+    /// Submit a closure to run on the main thread as the next step in the run loop, before other
+    /// event sources are processed.
+    ///
+    /// This is used for running event handlers, as those are not allowed to run re-entrantly.
+    ///
+    /// # Implementation
+    ///
+    /// This queuing could be implemented in the following several ways with subtle differences in
+    /// timing. This list is sorted in rough order in which they are run:
+    ///
+    /// 1. Using `CFRunLoopPerformBlock` or `-[NSRunLoop performBlock:]`.
+    ///
+    /// 2. Using `-[NSObject performSelectorOnMainThread:withObject:waitUntilDone:]` or wrapping the
+    ///    event in `NSEvent` and posting that to `-[NSApplication postEvent:atStart:]` (both
+    ///    creates a custom `CFRunLoopSource`, and signals that to wake up the main event loop).
+    ///
+    ///    a. `atStart = true`.
+    ///
+    ///    b. `atStart = false`.
+    ///
+    /// 3. `dispatch_async` or `dispatch_async_f`. Note that this may appear before 2b, it does not
+    ///    respect the ordering that runloop events have.
+    ///
+    /// We choose the first one, both for ease-of-implementation, but mostly for consistency, as we
+    /// want the event to be queued in a way that preserves the order the events originally arrived
+    /// in.
+    ///
+    /// As an example, let's assume that we receive two events from the user, a mouse click which we
+    /// handled by queuing it, and a window resize which we handled immediately. If we allowed
+    /// AppKit to choose the ordering when queuing the mouse event, it might get put in the back of
+    /// the queue, and the events would appear out of order to the user of Winit. So we must instead
+    /// put the event at the very front of the queue, to be handled as soon as possible after
+    /// handling whatever event it's currently handling.
+    pub fn queue_closure(&self, closure: impl FnOnce() + 'static) {
+        extern "C" {
+            fn CFRunLoopPerformBlock(rl: CFRunLoopRef, mode: CFTypeRef, block: &Block<dyn Fn()>);
+        }
+
+        // Convert `FnOnce()` to `Block<dyn Fn()>`.
+        let closure = Cell::new(Some(closure));
+        let block = block2::RcBlock::new(move || {
+            if let Some(closure) = closure.take() {
+                closure()
+            } else {
+                error!("tried to execute queued closure on main thread twice");
+            }
+        });
+
+        // There are a few common modes (`kCFRunLoopCommonModes`) defined by Cocoa:
+        // - `NSDefaultRunLoopMode`, alias of `kCFRunLoopDefaultMode`.
+        // - `NSEventTrackingRunLoopMode`, used when mouse-dragging and live-resizing a window.
+        // - `NSModalPanelRunLoopMode`, used when running a modal inside the Winit event loop.
+        // - `NSConnectionReplyMode`: TODO.
+        //
+        // We only want to run event handlers in the default mode, as we support running a blocking
+        // modal inside a Winit event handler (see [#1779]) which outrules the modal panel mode, and
+        // resizing such panel window enters the event tracking run loop mode, so we can't directly
+        // trigger events inside that mode either.
+        //
+        // Any events that are queued while running a modal or when live-resizing will instead wait,
+        // and be delivered to the application afterwards.
+        //
+        // [#1779]: https://github.com/rust-windowing/winit/issues/1779
+        let mode = unsafe { kCFRunLoopDefaultMode as CFTypeRef };
+
+        // SAFETY: The runloop is valid, the mode is a `CFStringRef`, and the block is `'static`.
+        unsafe { CFRunLoopPerformBlock(self.0, mode, &block) }
+    }
+}
+
+pub fn setup_control_flow_observers(mtm: MainThreadMarker, panic_info: Weak<PanicInfo>) {
+    let run_loop = RunLoop::main(mtm);
+    unsafe {
+        let mut context = CFRunLoopObserverContext {
+            info: Weak::into_raw(panic_info) as *mut _,
+            version: 0,
+            retain: None,
+            release: None,
+            copyDescription: None,
+        };
+        run_loop.add_observer(
+            kCFRunLoopAfterWaiting,
+            CFIndex::MIN,
+            control_flow_begin_handler,
+            &mut context as *mut _,
+        );
+        run_loop.add_observer(
+            kCFRunLoopExit | kCFRunLoopBeforeWaiting,
+            CFIndex::MAX,
+            control_flow_end_handler,
+            &mut context as *mut _,
+        );
+    }
+}
+
+#[derive(Debug)]
+pub struct EventLoopWaker {
+    timer: CFRunLoopTimerRef,
+
+    /// An arbitrary instant in the past, that will trigger an immediate wake
+    /// We save this as the `next_fire_date` for consistency so we can
+    /// easily check if the next_fire_date needs updating.
+    start_instant: Instant,
+
+    /// This is what the `NextFireDate` has been set to.
+    /// `None` corresponds to `waker.stop()` and `start_instant` is used
+    /// for `waker.start()`
+    next_fire_date: Option<Instant>,
+}
+
+impl Drop for EventLoopWaker {
+    fn drop(&mut self) {
+        unsafe {
+            CFRunLoopTimerInvalidate(self.timer);
+            CFRelease(self.timer as _);
+        }
+    }
+}
+
+impl EventLoopWaker {
+    pub(crate) fn new() -> Self {
+        extern "C" fn wakeup_main_loop(_timer: CFRunLoopTimerRef, _info: *mut c_void) {}
+        unsafe {
+            // Create a timer with a 0.1µs interval (1ns does not work) to mimic polling.
+            // It is initially setup with a first fire time really far into the
+            // future, but that gets changed to fire immediately in did_finish_launching
+            let timer = CFRunLoopTimerCreate(
+                ptr::null_mut(),
+                f64::MAX,
+                0.000_000_1,
+                0,
+                0,
+                wakeup_main_loop,
+                ptr::null_mut(),
+            );
+            CFRunLoopAddTimer(CFRunLoopGetMain(), timer, kCFRunLoopCommonModes);
+            Self { timer, start_instant: Instant::now(), next_fire_date: None }
+        }
+    }
+
+    pub fn stop(&mut self) {
+        if self.next_fire_date.is_some() {
+            self.next_fire_date = None;
+            unsafe { CFRunLoopTimerSetNextFireDate(self.timer, f64::MAX) }
+        }
+    }
+
+    pub fn start(&mut self) {
+        if self.next_fire_date != Some(self.start_instant) {
+            self.next_fire_date = Some(self.start_instant);
+            unsafe { CFRunLoopTimerSetNextFireDate(self.timer, f64::MIN) }
+        }
+    }
+
+    pub fn start_at(&mut self, instant: Option<Instant>) {
+        let now = Instant::now();
+        match instant {
+            Some(instant) if now >= instant => {
+                self.start();
+            },
+            Some(instant) => {
+                if self.next_fire_date != Some(instant) {
+                    self.next_fire_date = Some(instant);
+                    unsafe {
+                        let current = CFAbsoluteTimeGetCurrent();
+                        let duration = instant - now;
+                        let fsecs = duration.subsec_nanos() as f64 / 1_000_000_000.0
+                            + duration.as_secs() as f64;
+                        CFRunLoopTimerSetNextFireDate(self.timer, current + fsecs)
+                    }
+                }
+            },
+            None => {
+                self.stop();
+            },
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/util.rs b/vendor/winit/src/platform_impl/macos/util.rs
new file mode 100644
index 00000000..8110573a
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/util.rs
@@ -0,0 +1,27 @@
+use tracing::trace;
+
+macro_rules! trace_scope {
+    ($s:literal) => {
+        let _crate = $crate::platform_impl::platform::util::TraceGuard::new(module_path!(), $s);
+    };
+}
+
+pub(crate) struct TraceGuard {
+    module_path: &'static str,
+    called_from_fn: &'static str,
+}
+
+impl TraceGuard {
+    #[inline]
+    pub(crate) fn new(module_path: &'static str, called_from_fn: &'static str) -> Self {
+        trace!(target = module_path, "Triggered `{}`", called_from_fn);
+        Self { module_path, called_from_fn }
+    }
+}
+
+impl Drop for TraceGuard {
+    #[inline]
+    fn drop(&mut self) {
+        trace!(target = self.module_path, "Completed `{}`", self.called_from_fn);
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/view.rs b/vendor/winit/src/platform_impl/macos/view.rs
new file mode 100644
index 00000000..c7ca5bc6
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/view.rs
@@ -0,0 +1,1142 @@
+#![allow(clippy::unnecessary_cast)]
+use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, VecDeque};
+use std::ptr;
+
+use objc2::rc::{Retained, WeakId};
+use objc2::runtime::{AnyObject, Sel};
+use objc2::{declare_class, msg_send_id, mutability, sel, ClassType, DeclaredClass};
+use objc2_app_kit::{
+    NSApplication, NSCursor, NSEvent, NSEventPhase, NSResponder, NSTextInputClient,
+    NSTrackingRectTag, NSView, NSViewFrameDidChangeNotification,
+};
+use objc2_foundation::{
+    MainThreadMarker, NSArray, NSAttributedString, NSAttributedStringKey, NSCopying,
+    NSMutableAttributedString, NSNotFound, NSNotificationCenter, NSObject, NSObjectProtocol,
+    NSPoint, NSRange, NSRect, NSSize, NSString, NSUInteger,
+};
+
+use super::app_state::ApplicationDelegate;
+use super::cursor::{default_cursor, invisible_cursor};
+use super::event::{
+    code_to_key, code_to_location, create_key_event, event_mods, lalt_pressed, ralt_pressed,
+    scancode_to_physicalkey, KeyEventExtra,
+};
+use super::window::WinitWindow;
+use super::DEVICE_ID;
+use crate::dpi::{LogicalPosition, LogicalSize};
+use crate::event::{
+    DeviceEvent, ElementState, Ime, KeyEvent, Modifiers, MouseButton, MouseScrollDelta, TouchPhase,
+    WindowEvent,
+};
+use crate::keyboard::{Key, KeyCode, KeyLocation, ModifiersState, NamedKey};
+use crate::platform::macos::OptionAsAlt;
+
+#[derive(Debug)]
+struct CursorState {
+    visible: bool,
+    cursor: Retained<NSCursor>,
+}
+
+impl Default for CursorState {
+    fn default() -> Self {
+        Self { visible: true, cursor: default_cursor() }
+    }
+}
+
+#[derive(Debug, Eq, PartialEq, Clone, Copy, Default)]
+enum ImeState {
+    #[default]
+    /// The IME events are disabled, so only `ReceivedCharacter` is being sent to the user.
+    Disabled,
+
+    /// The ground state of enabled IME input. It means that both Preedit and regular keyboard
+    /// input could be start from it.
+    Ground,
+
+    /// The IME is in preedit.
+    Preedit,
+
+    /// The text was just committed, so the next input from the keyboard must be ignored.
+    Committed,
+}
+
+bitflags::bitflags! {
+    #[derive(Debug, Clone, Copy, PartialEq)]
+    struct ModLocationMask: u8 {
+        const LEFT     = 0b0001;
+        const RIGHT    = 0b0010;
+    }
+}
+impl ModLocationMask {
+    fn from_location(loc: KeyLocation) -> ModLocationMask {
+        match loc {
+            KeyLocation::Left => ModLocationMask::LEFT,
+            KeyLocation::Right => ModLocationMask::RIGHT,
+            _ => unreachable!(),
+        }
+    }
+}
+
+fn key_to_modifier(key: &Key) -> Option<ModifiersState> {
+    match key {
+        Key::Named(NamedKey::Alt) => Some(ModifiersState::ALT),
+        Key::Named(NamedKey::Control) => Some(ModifiersState::CONTROL),
+        Key::Named(NamedKey::Super) => Some(ModifiersState::SUPER),
+        Key::Named(NamedKey::Shift) => Some(ModifiersState::SHIFT),
+        _ => None,
+    }
+}
+
+fn get_right_modifier_code(key: &Key) -> KeyCode {
+    match key {
+        Key::Named(NamedKey::Alt) => KeyCode::AltRight,
+        Key::Named(NamedKey::Control) => KeyCode::ControlRight,
+        Key::Named(NamedKey::Shift) => KeyCode::ShiftRight,
+        Key::Named(NamedKey::Super) => KeyCode::SuperRight,
+        _ => unreachable!(),
+    }
+}
+
+fn get_left_modifier_code(key: &Key) -> KeyCode {
+    match key {
+        Key::Named(NamedKey::Alt) => KeyCode::AltLeft,
+        Key::Named(NamedKey::Control) => KeyCode::ControlLeft,
+        Key::Named(NamedKey::Shift) => KeyCode::ShiftLeft,
+        Key::Named(NamedKey::Super) => KeyCode::SuperLeft,
+        _ => unreachable!(),
+    }
+}
+
+#[derive(Debug)]
+pub struct ViewState {
+    /// Strong reference to the global application state.
+    app_delegate: Retained<ApplicationDelegate>,
+
+    cursor_state: RefCell<CursorState>,
+    ime_position: Cell<NSPoint>,
+    ime_size: Cell<NSSize>,
+    modifiers: Cell<Modifiers>,
+    phys_modifiers: RefCell<HashMap<Key, ModLocationMask>>,
+    tracking_rect: Cell<Option<NSTrackingRectTag>>,
+    ime_state: Cell<ImeState>,
+    input_source: RefCell<String>,
+
+    /// True iff the application wants IME events.
+    ///
+    /// Can be set using `set_ime_allowed`
+    ime_allowed: Cell<bool>,
+
+    /// True if the current key event should be forwarded
+    /// to the application, even during IME
+    forward_key_to_app: Cell<bool>,
+
+    marked_text: RefCell<Retained<NSMutableAttributedString>>,
+    accepts_first_mouse: bool,
+
+    // Weak reference because the window keeps a strong reference to the view
+    _ns_window: WeakId<WinitWindow>,
+
+    /// The state of the `Option` as `Alt`.
+    option_as_alt: Cell<OptionAsAlt>,
+}
+
+declare_class!(
+    pub(super) struct WinitView;
+
+    unsafe impl ClassType for WinitView {
+        #[inherits(NSResponder, NSObject)]
+        type Super = NSView;
+        type Mutability = mutability::MainThreadOnly;
+        const NAME: &'static str = "WinitView";
+    }
+
+    impl DeclaredClass for WinitView {
+        type Ivars = ViewState;
+    }
+
+    unsafe impl WinitView {
+        #[method(isFlipped)]
+        fn is_flipped(&self) -> bool {
+            // `winit` uses the upper-left corner as the origin.
+            true
+        }
+
+        #[method(viewDidMoveToWindow)]
+        fn view_did_move_to_window(&self) {
+            trace_scope!("viewDidMoveToWindow");
+            if let Some(tracking_rect) = self.ivars().tracking_rect.take() {
+                self.removeTrackingRect(tracking_rect);
+            }
+
+            let rect = self.frame();
+            let tracking_rect = unsafe {
+                self.addTrackingRect_owner_userData_assumeInside(rect, self, ptr::null_mut(), false)
+            };
+            assert_ne!(tracking_rect, 0, "failed adding tracking rect");
+            self.ivars().tracking_rect.set(Some(tracking_rect));
+        }
+
+        #[method(frameDidChange:)]
+        fn frame_did_change(&self, _event: &NSEvent) {
+            trace_scope!("frameDidChange:");
+            if let Some(tracking_rect) = self.ivars().tracking_rect.take() {
+                self.removeTrackingRect(tracking_rect);
+            }
+
+            let rect = self.frame();
+            let tracking_rect = unsafe {
+                self.addTrackingRect_owner_userData_assumeInside(rect, self, ptr::null_mut(), false)
+            };
+            assert_ne!(tracking_rect, 0, "failed adding tracking rect");
+            self.ivars().tracking_rect.set(Some(tracking_rect));
+
+            // Emit resize event here rather than from windowDidResize because:
+            // 1. When a new window is created as a tab, the frame size may change without a window resize occurring.
+            // 2. Even when a window resize does occur on a new tabbed window, it contains the wrong size (includes tab height).
+            let logical_size = LogicalSize::new(rect.size.width as f64, rect.size.height as f64);
+            let size = logical_size.to_physical::<u32>(self.scale_factor());
+            self.queue_event(WindowEvent::Resized(size));
+        }
+
+        #[method(drawRect:)]
+        fn draw_rect(&self, _rect: NSRect) {
+            trace_scope!("drawRect:");
+
+            // It's a workaround for https://github.com/rust-windowing/winit/issues/2640, don't replace with `self.window_id()`.
+            if let Some(window) = self.ivars()._ns_window.load() {
+                self.ivars().app_delegate.handle_redraw(window.id());
+            }
+
+            // This is a direct subclass of NSView, no need to call superclass' drawRect:
+        }
+
+        #[method(acceptsFirstResponder)]
+        fn accepts_first_responder(&self) -> bool {
+            trace_scope!("acceptsFirstResponder");
+            true
+        }
+
+        // This is necessary to prevent a beefy terminal error on MacBook Pros:
+        // IMKInputSession [0x7fc573576ff0 presentFunctionRowItemTextInputViewWithEndpoint:completionHandler:] : [self textInputContext]=0x7fc573558e10 *NO* NSRemoteViewController to client, NSError=Error Domain=NSCocoaErrorDomain Code=4099 "The connection from pid 0 was invalidated from this process." UserInfo={NSDebugDescription=The connection from pid 0 was invalidated from this process.}, com.apple.inputmethod.EmojiFunctionRowItem
+        // TODO: Add an API extension for using `NSTouchBar`
+        #[method_id(touchBar)]
+        fn touch_bar(&self) -> Option<Retained<NSObject>> {
+            trace_scope!("touchBar");
+            None
+        }
+
+        #[method(resetCursorRects)]
+        fn reset_cursor_rects(&self) {
+            trace_scope!("resetCursorRects");
+            let bounds = self.bounds();
+            let cursor_state = self.ivars().cursor_state.borrow();
+            // We correctly invoke `addCursorRect` only from inside `resetCursorRects`
+            if cursor_state.visible {
+                self.addCursorRect_cursor(bounds, &cursor_state.cursor);
+            } else {
+                self.addCursorRect_cursor(bounds, &invisible_cursor());
+            }
+        }
+    }
+
+    unsafe impl NSTextInputClient for WinitView {
+        #[method(hasMarkedText)]
+        fn has_marked_text(&self) -> bool {
+            trace_scope!("hasMarkedText");
+            self.ivars().marked_text.borrow().length() > 0
+        }
+
+        #[method(markedRange)]
+        fn marked_range(&self) -> NSRange {
+            trace_scope!("markedRange");
+            let length = self.ivars().marked_text.borrow().length();
+            if length > 0 {
+                NSRange::new(0, length)
+            } else {
+                // Documented to return `{NSNotFound, 0}` if there is no marked range.
+                NSRange::new(NSNotFound as NSUInteger, 0)
+            }
+        }
+
+        #[method(selectedRange)]
+        fn selected_range(&self) -> NSRange {
+            trace_scope!("selectedRange");
+            // Documented to return `{NSNotFound, 0}` if there is no selection.
+            NSRange::new(NSNotFound as NSUInteger, 0)
+        }
+
+        #[method(setMarkedText:selectedRange:replacementRange:)]
+        fn set_marked_text(
+            &self,
+            string: &NSObject,
+            selected_range: NSRange,
+            _replacement_range: NSRange,
+        ) {
+            // TODO: Use _replacement_range, requires changing the event to report surrounding text.
+            trace_scope!("setMarkedText:selectedRange:replacementRange:");
+
+            // SAFETY: This method is guaranteed to get either a `NSString` or a `NSAttributedString`.
+            let (marked_text, string) = if string.is_kind_of::<NSAttributedString>() {
+                let string: *const NSObject = string;
+                let string: *const NSAttributedString = string.cast();
+                let string = unsafe { &*string };
+                (
+                    NSMutableAttributedString::from_attributed_nsstring(string),
+                    string.string(),
+                )
+            } else {
+                let string: *const NSObject = string;
+                let string: *const NSString = string.cast();
+                let string = unsafe { &*string };
+                (
+                    NSMutableAttributedString::from_nsstring(string),
+                    string.copy(),
+                )
+            };
+
+            // Update marked text.
+            *self.ivars().marked_text.borrow_mut() = marked_text;
+
+            // Notify IME is active if application still doesn't know it.
+            if self.ivars().ime_state.get() == ImeState::Disabled {
+                *self.ivars().input_source.borrow_mut() = self.current_input_source();
+                self.queue_event(WindowEvent::Ime(Ime::Enabled));
+            }
+
+            if unsafe { self.hasMarkedText() } {
+                self.ivars().ime_state.set(ImeState::Preedit);
+            } else {
+                // In case the preedit was cleared, set IME into the Ground state.
+                self.ivars().ime_state.set(ImeState::Ground);
+            }
+
+            let cursor_range = if string.is_empty() {
+                // An empty string basically means that there's no preedit, so indicate that by
+                // sending a `None` cursor range.
+                None
+            } else {
+                // Clamp to string length to avoid NSRangeException from out-of-bounds
+                // indices sent by macOS IME (e.g. native Pinyin, see
+                // https://github.com/alacritty/alacritty/issues/8791).
+                let len = string.length();
+                let location = selected_range.location.min(len);
+                let end = selected_range.end().min(len);
+                // Convert the selected range from UTF-16 indices to UTF-8 indices.
+                let sub_string_a = unsafe { string.substringToIndex(location) };
+                let sub_string_b = unsafe { string.substringToIndex(end) };
+                let lowerbound_utf8 = sub_string_a.len();
+                let upperbound_utf8 = sub_string_b.len();
+                Some((lowerbound_utf8, upperbound_utf8))
+            };
+
+            // Send WindowEvent for updating marked text
+            self.queue_event(WindowEvent::Ime(Ime::Preedit(string.to_string(), cursor_range)));
+        }
+
+        #[method(unmarkText)]
+        fn unmark_text(&self) {
+            trace_scope!("unmarkText");
+            *self.ivars().marked_text.borrow_mut() = NSMutableAttributedString::new();
+
+            let input_context = self.inputContext().expect("input context");
+            input_context.discardMarkedText();
+
+            self.queue_event(WindowEvent::Ime(Ime::Preedit(String::new(), None)));
+            if self.is_ime_enabled() {
+                // Leave the Preedit self.ivars()
+                self.ivars().ime_state.set(ImeState::Ground);
+            } else {
+                tracing::warn!("Expected to have IME enabled when receiving unmarkText");
+            }
+        }
+
+        #[method_id(validAttributesForMarkedText)]
+        fn valid_attributes_for_marked_text(&self) -> Retained<NSArray<NSAttributedStringKey>> {
+            trace_scope!("validAttributesForMarkedText");
+            NSArray::new()
+        }
+
+        #[method_id(attributedSubstringForProposedRange:actualRange:)]
+        fn attributed_substring_for_proposed_range(
+            &self,
+            _range: NSRange,
+            _actual_range: *mut NSRange,
+        ) -> Option<Retained<NSAttributedString>> {
+            trace_scope!("attributedSubstringForProposedRange:actualRange:");
+            None
+        }
+
+        #[method(characterIndexForPoint:)]
+        fn character_index_for_point(&self, _point: NSPoint) -> NSUInteger {
+            trace_scope!("characterIndexForPoint:");
+            0
+        }
+
+        #[method(firstRectForCharacterRange:actualRange:)]
+        fn first_rect_for_character_range(
+            &self,
+            _range: NSRange,
+            _actual_range: *mut NSRange,
+        ) -> NSRect {
+            trace_scope!("firstRectForCharacterRange:actualRange:");
+            let rect = NSRect::new(
+                self.ivars().ime_position.get(),
+                self.ivars().ime_size.get()
+            );
+            // Return value is expected to be in screen coordinates, so we need a conversion here
+            self.window()
+                .convertRectToScreen(self.convertRect_toView(rect, None))
+        }
+
+        #[method(insertText:replacementRange:)]
+        fn insert_text(&self, string: &NSObject, _replacement_range: NSRange) {
+            // TODO: Use _replacement_range, requires changing the event to report surrounding text.
+            trace_scope!("insertText:replacementRange:");
+
+            // SAFETY: This method is guaranteed to get either a `NSString` or a `NSAttributedString`.
+            let string = if string.is_kind_of::<NSAttributedString>() {
+                let string: *const NSObject = string;
+                let string: *const NSAttributedString = string.cast();
+                unsafe { &*string }.string().to_string()
+            } else {
+                let string: *const NSObject = string;
+                let string: *const NSString = string.cast();
+                unsafe { &*string }.to_string()
+            };
+
+            let is_control = string.chars().next().is_some_and(|c| c.is_control());
+
+            // Commit only if we have marked text.
+            if unsafe { self.hasMarkedText() } && self.is_ime_enabled() && !is_control {
+                self.queue_event(WindowEvent::Ime(Ime::Preedit(String::new(), None)));
+                self.queue_event(WindowEvent::Ime(Ime::Commit(string)));
+                self.ivars().ime_state.set(ImeState::Committed);
+            }
+        }
+
+        // Basically, we're sent this message whenever a keyboard event that doesn't generate a "human
+        // readable" character happens, i.e. newlines, tabs, and Ctrl+C.
+        #[method(doCommandBySelector:)]
+        fn do_command_by_selector(&self, _command: Sel) {
+            trace_scope!("doCommandBySelector:");
+            // We shouldn't forward any character from just committed text, since we'll end up sending
+            // it twice with some IMEs like Korean one. We'll also always send `Enter` in that case,
+            // which is not desired given it was used to confirm IME input.
+            if self.ivars().ime_state.get() == ImeState::Committed {
+                return;
+            }
+
+            self.ivars().forward_key_to_app.set(true);
+
+            if unsafe { self.hasMarkedText() } && self.ivars().ime_state.get() == ImeState::Preedit
+            {
+                // Leave preedit so that we also report the key-up for this key.
+                self.ivars().ime_state.set(ImeState::Ground);
+            }
+        }
+    }
+
+    unsafe impl WinitView {
+        #[method(keyDown:)]
+        fn key_down(&self, event: &NSEvent) {
+            trace_scope!("keyDown:");
+            {
+                let mut prev_input_source = self.ivars().input_source.borrow_mut();
+                let current_input_source = self.current_input_source();
+                if *prev_input_source != current_input_source && self.is_ime_enabled() {
+                    *prev_input_source = current_input_source;
+                    drop(prev_input_source);
+                    self.ivars().ime_state.set(ImeState::Disabled);
+                    self.queue_event(WindowEvent::Ime(Ime::Disabled));
+                }
+            }
+
+            // Get the characters from the event.
+            let old_ime_state = self.ivars().ime_state.get();
+            self.ivars().forward_key_to_app.set(false);
+            let event = replace_event(event, self.option_as_alt());
+
+            // The `interpretKeyEvents` function might call
+            // `setMarkedText`, `insertText`, and `doCommandBySelector`.
+            // It's important that we call this before queuing the KeyboardInput, because
+            // we must send the `KeyboardInput` event during IME if it triggered
+            // `doCommandBySelector`. (doCommandBySelector means that the keyboard input
+            // is not handled by IME and should be handled by the application)
+            if self.ivars().ime_allowed.get() {
+                let events_for_nsview = NSArray::from_slice(&[&*event]);
+                unsafe { self.interpretKeyEvents(&events_for_nsview) };
+
+                // If the text was committed we must treat the next keyboard event as IME related.
+                if self.ivars().ime_state.get() == ImeState::Committed {
+                    // Remove any marked text, so normal input can continue.
+                    *self.ivars().marked_text.borrow_mut() = NSMutableAttributedString::new();
+                }
+            }
+
+            self.update_modifiers(&event, false);
+
+            let had_ime_input = match self.ivars().ime_state.get() {
+                ImeState::Committed => {
+                    // Allow normal input after the commit.
+                    self.ivars().ime_state.set(ImeState::Ground);
+                    true
+                }
+                ImeState::Preedit => true,
+                // `key_down` could result in preedit clear, so compare old and current state.
+                _ => old_ime_state != self.ivars().ime_state.get(),
+            };
+
+            if !had_ime_input || self.ivars().forward_key_to_app.get() {
+                let key_event = create_key_event(&event, true, unsafe { event.isARepeat() });
+                self.queue_event(WindowEvent::KeyboardInput {
+                    device_id: DEVICE_ID,
+                    event: key_event,
+                    is_synthetic: false,
+                });
+            }
+        }
+
+        #[method(keyUp:)]
+        fn key_up(&self, event: &NSEvent) {
+            trace_scope!("keyUp:");
+
+            let event = replace_event(event, self.option_as_alt());
+            self.update_modifiers(&event, false);
+
+            // We want to send keyboard input when we are currently in the ground state.
+            if matches!(
+                self.ivars().ime_state.get(),
+                ImeState::Ground | ImeState::Disabled
+            ) {
+                self.queue_event(WindowEvent::KeyboardInput {
+                    device_id: DEVICE_ID,
+                    event: create_key_event(&event, false, false),
+                    is_synthetic: false,
+                });
+            }
+        }
+
+        #[method(flagsChanged:)]
+        fn flags_changed(&self, event: &NSEvent) {
+            trace_scope!("flagsChanged:");
+
+            self.update_modifiers(event, true);
+        }
+
+        #[method(insertTab:)]
+        fn insert_tab(&self, _sender: Option<&AnyObject>) {
+            trace_scope!("insertTab:");
+            let window = self.window();
+            if let Some(first_responder) = window.firstResponder() {
+                if *first_responder == ***self {
+                    window.selectNextKeyView(Some(self))
+                }
+            }
+        }
+
+        #[method(insertBackTab:)]
+        fn insert_back_tab(&self, _sender: Option<&AnyObject>) {
+            trace_scope!("insertBackTab:");
+            let window = self.window();
+            if let Some(first_responder) = window.firstResponder() {
+                if *first_responder == ***self {
+                    window.selectPreviousKeyView(Some(self))
+                }
+            }
+        }
+
+        // Allows us to receive Cmd-. (the shortcut for closing a dialog)
+        // https://bugs.eclipse.org/bugs/show_bug.cgi?id=300620#c6
+        #[method(cancelOperation:)]
+        fn cancel_operation(&self, _sender: Option<&AnyObject>) {
+            let mtm = MainThreadMarker::from(self);
+            trace_scope!("cancelOperation:");
+
+            let event = NSApplication::sharedApplication(mtm)
+                .currentEvent()
+                .expect("could not find current event");
+
+            self.update_modifiers(&event, false);
+            let event = create_key_event(&event, true, unsafe { event.isARepeat() });
+
+            self.queue_event(WindowEvent::KeyboardInput {
+                device_id: DEVICE_ID,
+                event,
+                is_synthetic: false,
+            });
+        }
+
+        // In the past (?), `mouseMoved:` events were not generated when the
+        // user hovered over a window from a separate window, and as such the
+        // application might not know the location of the mouse in the event.
+        //
+        // To fix this, we emit `mouse_motion` inside of mouse click, mouse
+        // scroll, magnify and other gesture event handlers, to ensure that
+        // the application's state of where the mouse click was located is up
+        // to date.
+        //
+        // See https://github.com/rust-windowing/winit/pull/1490 for history.
+
+        #[method(mouseDown:)]
+        fn mouse_down(&self, event: &NSEvent) {
+            trace_scope!("mouseDown:");
+            self.mouse_motion(event);
+            self.mouse_click(event, ElementState::Pressed);
+        }
+
+        #[method(mouseUp:)]
+        fn mouse_up(&self, event: &NSEvent) {
+            trace_scope!("mouseUp:");
+            self.mouse_motion(event);
+            self.mouse_click(event, ElementState::Released);
+        }
+
+        #[method(rightMouseDown:)]
+        fn right_mouse_down(&self, event: &NSEvent) {
+            trace_scope!("rightMouseDown:");
+            self.mouse_motion(event);
+            self.mouse_click(event, ElementState::Pressed);
+        }
+
+        #[method(rightMouseUp:)]
+        fn right_mouse_up(&self, event: &NSEvent) {
+            trace_scope!("rightMouseUp:");
+            self.mouse_motion(event);
+            self.mouse_click(event, ElementState::Released);
+        }
+
+        #[method(otherMouseDown:)]
+        fn other_mouse_down(&self, event: &NSEvent) {
+            trace_scope!("otherMouseDown:");
+            self.mouse_motion(event);
+            self.mouse_click(event, ElementState::Pressed);
+        }
+
+        #[method(otherMouseUp:)]
+        fn other_mouse_up(&self, event: &NSEvent) {
+            trace_scope!("otherMouseUp:");
+            self.mouse_motion(event);
+            self.mouse_click(event, ElementState::Released);
+        }
+
+        // No tracing on these because that would be overly verbose
+
+        #[method(mouseMoved:)]
+        fn mouse_moved(&self, event: &NSEvent) {
+            self.mouse_motion(event);
+        }
+
+        #[method(mouseDragged:)]
+        fn mouse_dragged(&self, event: &NSEvent) {
+            self.mouse_motion(event);
+        }
+
+        #[method(rightMouseDragged:)]
+        fn right_mouse_dragged(&self, event: &NSEvent) {
+            self.mouse_motion(event);
+        }
+
+        #[method(otherMouseDragged:)]
+        fn other_mouse_dragged(&self, event: &NSEvent) {
+            self.mouse_motion(event);
+        }
+
+        #[method(mouseEntered:)]
+        fn mouse_entered(&self, _event: &NSEvent) {
+            trace_scope!("mouseEntered:");
+            self.queue_event(WindowEvent::CursorEntered {
+                device_id: DEVICE_ID,
+            });
+        }
+
+        #[method(mouseExited:)]
+        fn mouse_exited(&self, _event: &NSEvent) {
+            trace_scope!("mouseExited:");
+
+            self.queue_event(WindowEvent::CursorLeft {
+                device_id: DEVICE_ID,
+            });
+        }
+
+        #[method(scrollWheel:)]
+        fn scroll_wheel(&self, event: &NSEvent) {
+            trace_scope!("scrollWheel:");
+
+            self.mouse_motion(event);
+
+            let delta = {
+                let (x, y) = unsafe { (event.scrollingDeltaX(), event.scrollingDeltaY()) };
+                if unsafe { event.hasPreciseScrollingDeltas() } {
+                    let delta = LogicalPosition::new(x, y).to_physical(self.scale_factor());
+                    MouseScrollDelta::PixelDelta(delta)
+                } else {
+                    MouseScrollDelta::LineDelta(x as f32, y as f32)
+                }
+            };
+
+            // The "momentum phase," if any, has higher priority than touch phase (the two should
+            // be mutually exclusive anyhow, which is why the API is rather incoherent). If no momentum
+            // phase is recorded (or rather, the started/ended cases of the momentum phase) then we
+            // report the touch phase.
+            #[allow(non_upper_case_globals)]
+            let phase = match unsafe { event.momentumPhase() } {
+                NSEventPhase::MayBegin | NSEventPhase::Began => TouchPhase::Started,
+                NSEventPhase::Ended | NSEventPhase::Cancelled => TouchPhase::Ended,
+                _ => match unsafe { event.phase() } {
+                    NSEventPhase::MayBegin | NSEventPhase::Began => TouchPhase::Started,
+                    NSEventPhase::Ended | NSEventPhase::Cancelled => TouchPhase::Ended,
+                    _ => TouchPhase::Moved,
+                },
+            };
+
+            self.update_modifiers(event, false);
+
+            self.ivars().app_delegate.maybe_queue_device_event(DeviceEvent::MouseWheel { delta });
+            self.queue_event(WindowEvent::MouseWheel {
+                device_id: DEVICE_ID,
+                delta,
+                phase,
+            });
+        }
+
+        #[method(magnifyWithEvent:)]
+        fn magnify_with_event(&self, event: &NSEvent) {
+            trace_scope!("magnifyWithEvent:");
+
+            self.mouse_motion(event);
+
+            #[allow(non_upper_case_globals)]
+            let phase = match unsafe { event.phase() } {
+                NSEventPhase::Began => TouchPhase::Started,
+                NSEventPhase::Changed => TouchPhase::Moved,
+                NSEventPhase::Cancelled => TouchPhase::Cancelled,
+                NSEventPhase::Ended => TouchPhase::Ended,
+                _ => return,
+            };
+
+            self.queue_event(WindowEvent::PinchGesture {
+                device_id: DEVICE_ID,
+                delta: unsafe { event.magnification() },
+                phase,
+            });
+        }
+
+        #[method(smartMagnifyWithEvent:)]
+        fn smart_magnify_with_event(&self, event: &NSEvent) {
+            trace_scope!("smartMagnifyWithEvent:");
+
+            self.mouse_motion(event);
+
+            self.queue_event(WindowEvent::DoubleTapGesture {
+                device_id: DEVICE_ID,
+            });
+        }
+
+        #[method(rotateWithEvent:)]
+        fn rotate_with_event(&self, event: &NSEvent) {
+            trace_scope!("rotateWithEvent:");
+
+            self.mouse_motion(event);
+
+            #[allow(non_upper_case_globals)]
+            let phase = match unsafe { event.phase() } {
+                NSEventPhase::Began => TouchPhase::Started,
+                NSEventPhase::Changed => TouchPhase::Moved,
+                NSEventPhase::Cancelled => TouchPhase::Cancelled,
+                NSEventPhase::Ended => TouchPhase::Ended,
+                _ => return,
+            };
+
+            self.queue_event(WindowEvent::RotationGesture {
+                device_id: DEVICE_ID,
+                delta: unsafe { event.rotation() },
+                phase,
+            });
+        }
+
+        #[method(pressureChangeWithEvent:)]
+        fn pressure_change_with_event(&self, event: &NSEvent) {
+            trace_scope!("pressureChangeWithEvent:");
+
+            self.queue_event(WindowEvent::TouchpadPressure {
+                device_id: DEVICE_ID,
+                pressure: unsafe { event.pressure() },
+                stage: unsafe { event.stage() } as i64,
+            });
+        }
+
+        // Allows us to receive Ctrl-Tab and Ctrl-Esc.
+        // Note that this *doesn't* help with any missing Cmd inputs.
+        // https://github.com/chromium/chromium/blob/a86a8a6bcfa438fa3ac2eba6f02b3ad1f8e0756f/ui/views/cocoa/bridged_content_view.mm#L816
+        #[method(_wantsKeyDownForEvent:)]
+        fn wants_key_down_for_event(&self, _event: &NSEvent) -> bool {
+            trace_scope!("_wantsKeyDownForEvent:");
+            true
+        }
+
+        #[method(acceptsFirstMouse:)]
+        fn accepts_first_mouse(&self, _event: &NSEvent) -> bool {
+            trace_scope!("acceptsFirstMouse:");
+            self.ivars().accepts_first_mouse
+        }
+    }
+);
+
+impl WinitView {
+    pub(super) fn new(
+        app_delegate: &ApplicationDelegate,
+        window: &WinitWindow,
+        accepts_first_mouse: bool,
+        option_as_alt: OptionAsAlt,
+    ) -> Retained<Self> {
+        let mtm = MainThreadMarker::from(window);
+        let this = mtm.alloc().set_ivars(ViewState {
+            app_delegate: app_delegate.retain(),
+            cursor_state: Default::default(),
+            ime_position: Default::default(),
+            ime_size: Default::default(),
+            modifiers: Default::default(),
+            phys_modifiers: Default::default(),
+            tracking_rect: Default::default(),
+            ime_state: Default::default(),
+            input_source: Default::default(),
+            ime_allowed: Default::default(),
+            forward_key_to_app: Default::default(),
+            marked_text: Default::default(),
+            accepts_first_mouse,
+            _ns_window: WeakId::new(&window.retain()),
+            option_as_alt: Cell::new(option_as_alt),
+        });
+        let this: Retained<Self> = unsafe { msg_send_id![super(this), init] };
+
+        this.setPostsFrameChangedNotifications(true);
+        let notification_center = unsafe { NSNotificationCenter::defaultCenter() };
+        unsafe {
+            notification_center.addObserver_selector_name_object(
+                &this,
+                sel!(frameDidChange:),
+                Some(NSViewFrameDidChangeNotification),
+                Some(&this),
+            )
+        }
+
+        *this.ivars().input_source.borrow_mut() = this.current_input_source();
+
+        this
+    }
+
+    fn window(&self) -> Retained<WinitWindow> {
+        // TODO: Simply use `window` property on `NSView`.
+        // That only returns a window _after_ the view has been attached though!
+        // (which is incompatible with `frameDidChange:`)
+        //
+        // unsafe { msg_send_id![self, window] }
+        self.ivars()._ns_window.load().expect("view to have a window")
+    }
+
+    fn queue_event(&self, event: WindowEvent) {
+        self.ivars().app_delegate.maybe_queue_window_event(self.window().id(), event);
+    }
+
+    fn scale_factor(&self) -> f64 {
+        self.window().backingScaleFactor() as f64
+    }
+
+    fn is_ime_enabled(&self) -> bool {
+        !matches!(self.ivars().ime_state.get(), ImeState::Disabled)
+    }
+
+    fn current_input_source(&self) -> String {
+        self.inputContext()
+            .expect("input context")
+            .selectedKeyboardInputSource()
+            .map(|input_source| input_source.to_string())
+            .unwrap_or_default()
+    }
+
+    pub(super) fn cursor_icon(&self) -> Retained<NSCursor> {
+        self.ivars().cursor_state.borrow().cursor.clone()
+    }
+
+    pub(super) fn set_cursor_icon(&self, icon: Retained<NSCursor>) {
+        let mut cursor_state = self.ivars().cursor_state.borrow_mut();
+        cursor_state.cursor = icon;
+    }
+
+    /// Set whether the cursor should be visible or not.
+    ///
+    /// Returns whether the state changed.
+    pub(super) fn set_cursor_visible(&self, visible: bool) -> bool {
+        let mut cursor_state = self.ivars().cursor_state.borrow_mut();
+        if visible != cursor_state.visible {
+            cursor_state.visible = visible;
+            true
+        } else {
+            false
+        }
+    }
+
+    pub(super) fn set_ime_allowed(&self, ime_allowed: bool) {
+        if self.ivars().ime_allowed.get() == ime_allowed {
+            return;
+        }
+        self.ivars().ime_allowed.set(ime_allowed);
+        if self.ivars().ime_allowed.get() {
+            return;
+        }
+
+        // Clear markedText
+        *self.ivars().marked_text.borrow_mut() = NSMutableAttributedString::new();
+
+        if self.ivars().ime_state.get() != ImeState::Disabled {
+            self.ivars().ime_state.set(ImeState::Disabled);
+            self.queue_event(WindowEvent::Ime(Ime::Disabled));
+        }
+    }
+
+    pub(super) fn set_ime_cursor_area(&self, position: NSPoint, size: NSSize) {
+        self.ivars().ime_position.set(position);
+        self.ivars().ime_size.set(size);
+        let input_context = self.inputContext().expect("input context");
+        input_context.invalidateCharacterCoordinates();
+    }
+
+    /// Reset modifiers and emit a synthetic ModifiersChanged event if deemed necessary.
+    pub(super) fn reset_modifiers(&self) {
+        if !self.ivars().modifiers.get().state().is_empty() {
+            self.ivars().modifiers.set(Modifiers::default());
+            self.queue_event(WindowEvent::ModifiersChanged(self.ivars().modifiers.get()));
+        }
+    }
+
+    pub(super) fn set_option_as_alt(&self, value: OptionAsAlt) {
+        self.ivars().option_as_alt.set(value)
+    }
+
+    pub(super) fn option_as_alt(&self) -> OptionAsAlt {
+        self.ivars().option_as_alt.get()
+    }
+
+    /// Update modifiers if `event` has something different
+    fn update_modifiers(&self, ns_event: &NSEvent, is_flags_changed_event: bool) {
+        use ElementState::{Pressed, Released};
+
+        let current_modifiers = event_mods(ns_event);
+        let prev_modifiers = self.ivars().modifiers.get();
+        self.ivars().modifiers.set(current_modifiers);
+
+        // This function was called form the flagsChanged event, which is triggered
+        // when the user presses/releases a modifier even if the same kind of modifier
+        // has already been pressed.
+        //
+        // When flags changed event has key code of zero it means that event doesn't carry any key
+        // event, thus we can't generate regular presses based on that. The `ModifiersChanged`
+        // later will work though, since the flags are attached to the event and contain valid
+        // information.
+        'send_event: {
+            if is_flags_changed_event && unsafe { ns_event.keyCode() } != 0 {
+                let scancode = unsafe { ns_event.keyCode() };
+                let physical_key = scancode_to_physicalkey(scancode as u32);
+
+                let logical_key = code_to_key(physical_key, scancode);
+                // Ignore processing of unknown modifiers because we can't determine whether
+                // it was pressed or release reliably.
+                //
+                // Furthermore, sometimes normal keys are reported inside flagsChanged:, such as
+                // when holding Caps Lock while pressing another key, see:
+                // https://github.com/alacritty/alacritty/issues/8268
+                let Some(event_modifier) = key_to_modifier(&logical_key) else {
+                    break 'send_event;
+                };
+
+                let mut event = KeyEvent {
+                    location: code_to_location(physical_key),
+                    logical_key: logical_key.clone(),
+                    physical_key,
+                    repeat: false,
+                    // We'll correct this later.
+                    state: Pressed,
+                    text: None,
+                    platform_specific: KeyEventExtra {
+                        text_with_all_modifiers: None,
+                        key_without_modifiers: logical_key.clone(),
+                    },
+                };
+
+                let location_mask = ModLocationMask::from_location(event.location);
+
+                let mut phys_mod_state = self.ivars().phys_modifiers.borrow_mut();
+                let phys_mod =
+                    phys_mod_state.entry(logical_key).or_insert(ModLocationMask::empty());
+
+                let is_active = current_modifiers.state().contains(event_modifier);
+                let mut events = VecDeque::with_capacity(2);
+
+                // There is no API for getting whether the button was pressed or released
+                // during this event. For this reason we have to do a bit of magic below
+                // to come up with a good guess whether this key was pressed or released.
+                // (This is not trivial because there are multiple buttons that may affect
+                // the same modifier)
+                if !is_active {
+                    event.state = Released;
+                    if phys_mod.contains(ModLocationMask::LEFT) {
+                        let mut event = event.clone();
+                        event.location = KeyLocation::Left;
+                        event.physical_key = get_left_modifier_code(&event.logical_key).into();
+                        events.push_back(WindowEvent::KeyboardInput {
+                            device_id: DEVICE_ID,
+                            event,
+                            is_synthetic: false,
+                        });
+                    }
+                    if phys_mod.contains(ModLocationMask::RIGHT) {
+                        event.location = KeyLocation::Right;
+                        event.physical_key = get_right_modifier_code(&event.logical_key).into();
+                        events.push_back(WindowEvent::KeyboardInput {
+                            device_id: DEVICE_ID,
+                            event,
+                            is_synthetic: false,
+                        });
+                    }
+                    *phys_mod = ModLocationMask::empty();
+                } else {
+                    if *phys_mod == location_mask {
+                        // Here we hit a contradiction:
+                        // The modifier state was "changed" to active,
+                        // yet the only pressed modifier key was the one that we
+                        // just got a change event for.
+                        // This seemingly means that the only pressed modifier is now released,
+                        // but at the same time the modifier became active.
+                        //
+                        // But this scenario is possible if we released modifiers
+                        // while the application was not in focus. (Because we don't
+                        // get informed of modifier key events while the application
+                        // is not focused)
+
+                        // In this case we prioritize the information
+                        // about the current modifier state which means
+                        // that the button was pressed.
+                        event.state = Pressed;
+                    } else {
+                        phys_mod.toggle(location_mask);
+                        let is_pressed = phys_mod.contains(location_mask);
+                        event.state = if is_pressed { Pressed } else { Released };
+                    }
+
+                    events.push_back(WindowEvent::KeyboardInput {
+                        device_id: DEVICE_ID,
+                        event,
+                        is_synthetic: false,
+                    });
+                }
+
+                drop(phys_mod_state);
+
+                for event in events {
+                    self.queue_event(event);
+                }
+            }
+        }
+
+        if prev_modifiers == current_modifiers {
+            return;
+        }
+
+        self.queue_event(WindowEvent::ModifiersChanged(self.ivars().modifiers.get()));
+    }
+
+    fn mouse_click(&self, event: &NSEvent, button_state: ElementState) {
+        let button = mouse_button(event);
+
+        self.update_modifiers(event, false);
+
+        self.queue_event(WindowEvent::MouseInput {
+            device_id: DEVICE_ID,
+            state: button_state,
+            button,
+        });
+    }
+
+    fn mouse_motion(&self, event: &NSEvent) {
+        let window_point = unsafe { event.locationInWindow() };
+        let view_point = self.convertPoint_fromView(window_point, None);
+        let frame = self.frame();
+
+        if view_point.x.is_sign_negative()
+            || view_point.y.is_sign_negative()
+            || view_point.x > frame.size.width
+            || view_point.y > frame.size.height
+        {
+            let mouse_buttons_down = unsafe { NSEvent::pressedMouseButtons() };
+            if mouse_buttons_down == 0 {
+                // Point is outside of the client area (view) and no buttons are pressed
+                return;
+            }
+        }
+
+        let view_point = LogicalPosition::new(view_point.x, view_point.y);
+
+        self.update_modifiers(event, false);
+
+        self.queue_event(WindowEvent::CursorMoved {
+            device_id: DEVICE_ID,
+            position: view_point.to_physical(self.scale_factor()),
+        });
+    }
+}
+
+/// Get the mouse button from the NSEvent.
+fn mouse_button(event: &NSEvent) -> MouseButton {
+    // The buttonNumber property only makes sense for the mouse events:
+    // NSLeftMouse.../NSRightMouse.../NSOtherMouse...
+    // For the other events, it's always set to 0.
+    // MacOS only defines the left, right and middle buttons, 3..=31 are left as generic buttons,
+    // but 3 and 4 are very commonly used as Back and Forward by hardware vendors and applications.
+    match unsafe { event.buttonNumber() } {
+        0 => MouseButton::Left,
+        1 => MouseButton::Right,
+        2 => MouseButton::Middle,
+        3 => MouseButton::Back,
+        4 => MouseButton::Forward,
+        n => MouseButton::Other(n as u16),
+    }
+}
+
+// NOTE: to get option as alt working we need to rewrite events
+// we're getting from the operating system, which makes it
+// impossible to provide such events as extra in `KeyEvent`.
+fn replace_event(event: &NSEvent, option_as_alt: OptionAsAlt) -> Retained<NSEvent> {
+    let ev_mods = event_mods(event).state;
+    let ignore_alt_characters = match option_as_alt {
+        OptionAsAlt::OnlyLeft if lalt_pressed(event) => true,
+        OptionAsAlt::OnlyRight if ralt_pressed(event) => true,
+        OptionAsAlt::Both if ev_mods.alt_key() => true,
+        _ => false,
+    } && !ev_mods.control_key()
+        && !ev_mods.super_key();
+
+    if ignore_alt_characters {
+        let ns_chars = unsafe {
+            event.charactersIgnoringModifiers().expect("expected characters to be non-null")
+        };
+
+        unsafe {
+            NSEvent::keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode(
+                event.r#type(),
+                event.locationInWindow(),
+                event.modifierFlags(),
+                event.timestamp(),
+                event.windowNumber(),
+                None,
+                &ns_chars,
+                &ns_chars,
+                event.isARepeat(),
+                event.keyCode(),
+            )
+            .unwrap()
+        }
+    } else {
+        event.copy()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/window.rs b/vendor/winit/src/platform_impl/macos/window.rs
new file mode 100644
index 00000000..04da8b29
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/window.rs
@@ -0,0 +1,126 @@
+#![allow(clippy::unnecessary_cast)]
+
+use objc2::rc::{autoreleasepool, Retained};
+use objc2::{declare_class, mutability, ClassType, DeclaredClass};
+use objc2_app_kit::{NSResponder, NSWindow};
+use objc2_foundation::{MainThreadBound, MainThreadMarker, NSObject};
+
+use super::event_loop::ActiveEventLoop;
+use super::window_delegate::WindowDelegate;
+use crate::error::OsError as RootOsError;
+use crate::window::WindowAttributes;
+
+pub(crate) struct Window {
+    window: MainThreadBound<Retained<WinitWindow>>,
+    /// The window only keeps a weak reference to this, so we must keep it around here.
+    delegate: MainThreadBound<Retained<WindowDelegate>>,
+}
+
+impl Drop for Window {
+    fn drop(&mut self) {
+        self.window.get_on_main(|window| autoreleasepool(|_| window.close()))
+    }
+}
+
+impl Window {
+    pub(crate) fn new(
+        window_target: &ActiveEventLoop,
+        attributes: WindowAttributes,
+    ) -> Result<Self, RootOsError> {
+        let mtm = window_target.mtm;
+        let delegate = autoreleasepool(|_| {
+            WindowDelegate::new(window_target.app_delegate(), attributes, mtm)
+        })?;
+        Ok(Window {
+            window: MainThreadBound::new(delegate.window().retain(), mtm),
+            delegate: MainThreadBound::new(delegate, mtm),
+        })
+    }
+
+    pub(crate) fn maybe_queue_on_main(&self, f: impl FnOnce(&WindowDelegate) + Send + 'static) {
+        // For now, don't actually do queuing, since it may be less predictable
+        self.maybe_wait_on_main(f)
+    }
+
+    pub(crate) fn maybe_wait_on_main<R: Send>(
+        &self,
+        f: impl FnOnce(&WindowDelegate) -> R + Send,
+    ) -> R {
+        self.delegate.get_on_main(|delegate| f(delegate))
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub(crate) fn raw_window_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        if let Some(mtm) = MainThreadMarker::new() {
+            Ok(self.delegate.get(mtm).raw_window_handle_rwh_06())
+        } else {
+            Err(rwh_06::HandleError::Unavailable)
+        }
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub(crate) fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::AppKit(rwh_06::AppKitDisplayHandle::new()))
+    }
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct WindowId(pub usize);
+
+impl WindowId {
+    pub const fn dummy() -> Self {
+        Self(0)
+    }
+}
+
+impl From<WindowId> for u64 {
+    fn from(window_id: WindowId) -> Self {
+        window_id.0 as u64
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(raw_id: u64) -> Self {
+        Self(raw_id as usize)
+    }
+}
+
+declare_class!(
+    #[derive(Debug)]
+    pub struct WinitWindow;
+
+    unsafe impl ClassType for WinitWindow {
+        #[inherits(NSResponder, NSObject)]
+        type Super = NSWindow;
+        type Mutability = mutability::MainThreadOnly;
+        const NAME: &'static str = "WinitWindow";
+    }
+
+    impl DeclaredClass for WinitWindow {}
+
+    unsafe impl WinitWindow {
+        #[method(canBecomeMainWindow)]
+        fn can_become_main_window(&self) -> bool {
+            trace_scope!("canBecomeMainWindow");
+            true
+        }
+
+        #[method(canBecomeKeyWindow)]
+        fn can_become_key_window(&self) -> bool {
+            trace_scope!("canBecomeKeyWindow");
+            true
+        }
+    }
+);
+
+impl WinitWindow {
+    pub(super) fn id(&self) -> WindowId {
+        WindowId(self as *const Self as usize)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/macos/window_delegate.rs b/vendor/winit/src/platform_impl/macos/window_delegate.rs
new file mode 100644
index 00000000..e293505e
--- /dev/null
+++ b/vendor/winit/src/platform_impl/macos/window_delegate.rs
@@ -0,0 +1,1910 @@
+#![allow(clippy::unnecessary_cast)]
+use std::cell::{Cell, RefCell};
+use std::collections::VecDeque;
+use std::ffi::c_void;
+use std::ptr;
+use std::sync::{Arc, Mutex};
+
+use core_graphics::display::{CGDisplay, CGPoint};
+use monitor::VideoModeHandle;
+use objc2::rc::{autoreleasepool, Retained};
+use objc2::runtime::{AnyObject, ProtocolObject};
+use objc2::{declare_class, msg_send_id, mutability, sel, ClassType, DeclaredClass};
+use objc2_app_kit::{
+    NSAppKitVersionNumber, NSAppKitVersionNumber10_12, NSAppearance, NSAppearanceCustomization,
+    NSAppearanceNameAqua, NSApplication, NSApplicationPresentationOptions, NSBackingStoreType,
+    NSColor, NSDraggingDestination, NSFilenamesPboardType, NSPasteboard,
+    NSRequestUserAttentionType, NSScreen, NSView, NSWindowButton, NSWindowDelegate,
+    NSWindowFullScreenButton, NSWindowLevel, NSWindowOcclusionState, NSWindowOrderingMode,
+    NSWindowSharingType, NSWindowStyleMask, NSWindowTabbingMode, NSWindowTitleVisibility,
+};
+use objc2_foundation::{
+    ns_string, CGFloat, MainThreadMarker, NSArray, NSCopying, NSDictionary, NSKeyValueChangeKey,
+    NSKeyValueChangeNewKey, NSKeyValueChangeOldKey, NSKeyValueObservingOptions, NSObject,
+    NSObjectNSDelayedPerforming, NSObjectNSKeyValueObserverRegistration, NSObjectProtocol, NSPoint,
+    NSRect, NSSize, NSString,
+};
+use tracing::{trace, warn};
+
+use super::app_state::ApplicationDelegate;
+use super::cursor::cursor_from_icon;
+use super::monitor::{self, flip_window_screen_coordinates, get_display_id};
+use super::observer::RunLoop;
+use super::view::WinitView;
+use super::window::WinitWindow;
+use super::{ffi, Fullscreen, MonitorHandle, OsError, WindowId};
+use crate::dpi::{LogicalPosition, LogicalSize, PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{ExternalError, NotSupportedError, OsError as RootOsError};
+use crate::event::{InnerSizeWriter, WindowEvent};
+use crate::platform::macos::{OptionAsAlt, WindowExtMacOS};
+use crate::window::{
+    Cursor, CursorGrabMode, Icon, ImePurpose, ResizeDirection, Theme, UserAttentionType,
+    WindowAttributes, WindowButtons, WindowLevel,
+};
+
+#[derive(Clone, Debug)]
+pub struct PlatformSpecificWindowAttributes {
+    pub movable_by_window_background: bool,
+    pub titlebar_transparent: bool,
+    pub title_hidden: bool,
+    pub titlebar_hidden: bool,
+    pub titlebar_buttons_hidden: bool,
+    pub fullsize_content_view: bool,
+    pub disallow_hidpi: bool,
+    pub has_shadow: bool,
+    pub accepts_first_mouse: bool,
+    pub tabbing_identifier: Option<String>,
+    pub option_as_alt: OptionAsAlt,
+    pub borderless_game: bool,
+}
+
+impl Default for PlatformSpecificWindowAttributes {
+    #[inline]
+    fn default() -> Self {
+        Self {
+            movable_by_window_background: false,
+            titlebar_transparent: false,
+            title_hidden: false,
+            titlebar_hidden: false,
+            titlebar_buttons_hidden: false,
+            fullsize_content_view: false,
+            disallow_hidpi: false,
+            has_shadow: true,
+            accepts_first_mouse: true,
+            tabbing_identifier: None,
+            option_as_alt: Default::default(),
+            borderless_game: false,
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct State {
+    /// Strong reference to the global application state.
+    app_delegate: Retained<ApplicationDelegate>,
+
+    window: Retained<WinitWindow>,
+
+    // During `windowDidResize`, we use this to only send Moved if the position changed.
+    //
+    // This is expressed in desktop coordinates, and flipped to match Winit's coordinate system.
+    previous_position: Cell<NSPoint>,
+
+    // Used to prevent redundant events.
+    previous_scale_factor: Cell<f64>,
+
+    /// The current resize increments for the window content.
+    resize_increments: Cell<NSSize>,
+    /// Whether the window is showing decorations.
+    decorations: Cell<bool>,
+    resizable: Cell<bool>,
+    maximized: Cell<bool>,
+
+    /// Presentation options saved before entering `set_simple_fullscreen`, and
+    /// restored upon exiting it. Also used when transitioning from Borderless to
+    /// Exclusive fullscreen in `set_fullscreen` because we need to disable the menu
+    /// bar in exclusive fullscreen but want to restore the original options when
+    /// transitioning back to borderless fullscreen.
+    save_presentation_opts: Cell<Option<NSApplicationPresentationOptions>>,
+    // This is set when WindowAttributes::with_fullscreen was set,
+    // see comments of `window_did_fail_to_enter_fullscreen`
+    initial_fullscreen: Cell<bool>,
+    /// This field tracks the current fullscreen state of the window
+    /// (as seen by `WindowDelegate`).
+    fullscreen: RefCell<Option<Fullscreen>>,
+    // If it is attempted to toggle fullscreen when in_fullscreen_transition is true,
+    // Set target_fullscreen and do after fullscreen transition is end.
+    target_fullscreen: RefCell<Option<Option<Fullscreen>>>,
+    // This is true between windowWillEnterFullScreen and windowDidEnterFullScreen
+    // or windowWillExitFullScreen and windowDidExitFullScreen.
+    // We must not toggle fullscreen when this is true.
+    in_fullscreen_transition: Cell<bool>,
+    standard_frame: Cell<Option<NSRect>>,
+    is_simple_fullscreen: Cell<bool>,
+    saved_style: Cell<Option<NSWindowStyleMask>>,
+    is_borderless_game: Cell<bool>,
+}
+
+declare_class!(
+    pub(crate) struct WindowDelegate;
+
+    unsafe impl ClassType for WindowDelegate {
+        type Super = NSObject;
+        type Mutability = mutability::MainThreadOnly;
+        const NAME: &'static str = "WinitWindowDelegate";
+    }
+
+    impl DeclaredClass for WindowDelegate {
+        type Ivars = State;
+    }
+
+    unsafe impl NSObjectProtocol for WindowDelegate {}
+
+    unsafe impl NSWindowDelegate for WindowDelegate {
+        #[method(windowShouldClose:)]
+        fn window_should_close(&self, _: Option<&AnyObject>) -> bool {
+            trace_scope!("windowShouldClose:");
+            self.queue_event(WindowEvent::CloseRequested);
+            false
+        }
+
+        #[method(windowWillClose:)]
+        fn window_will_close(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowWillClose:");
+            // `setDelegate:` retains the previous value and then autoreleases it
+            autoreleasepool(|_| {
+                // Since El Capitan, we need to be careful that delegate methods can't
+                // be called after the window closes.
+                self.window().setDelegate(None);
+            });
+            self.queue_event(WindowEvent::Destroyed);
+        }
+
+        #[method(windowDidResize:)]
+        fn window_did_resize(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidResize:");
+            // NOTE: WindowEvent::Resized is reported in frameDidChange.
+            self.emit_move_event();
+        }
+
+        #[method(windowWillStartLiveResize:)]
+        fn window_will_start_live_resize(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowWillStartLiveResize:");
+
+            let increments = self.ivars().resize_increments.get();
+            self.set_resize_increments_inner(increments);
+        }
+
+        #[method(windowDidEndLiveResize:)]
+        fn window_did_end_live_resize(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidEndLiveResize:");
+            self.set_resize_increments_inner(NSSize::new(1., 1.));
+        }
+
+        // This won't be triggered if the move was part of a resize.
+        #[method(windowDidMove:)]
+        fn window_did_move(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidMove:");
+            self.emit_move_event();
+        }
+
+        #[method(windowDidChangeBackingProperties:)]
+        fn window_did_change_backing_properties(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidChangeBackingProperties:");
+            let scale_factor = self.scale_factor();
+            if scale_factor == self.ivars().previous_scale_factor.get() {
+                return;
+            };
+            self.ivars().previous_scale_factor.set(scale_factor);
+
+            let mtm = MainThreadMarker::from(self);
+            let this = self.retain();
+            RunLoop::main(mtm).queue_closure(move || {
+                this.handle_scale_factor_changed(scale_factor);
+            });
+        }
+
+        #[method(windowDidBecomeKey:)]
+        fn window_did_become_key(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidBecomeKey:");
+            // TODO: center the cursor if the window had mouse grab when it
+            // lost focus
+            self.queue_event(WindowEvent::Focused(true));
+        }
+
+        #[method(windowDidResignKey:)]
+        fn window_did_resign_key(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidResignKey:");
+            // It happens rather often, e.g. when the user is Cmd+Tabbing, that the
+            // NSWindowDelegate will receive a didResignKey event despite no event
+            // being received when the modifiers are released.  This is because
+            // flagsChanged events are received by the NSView instead of the
+            // NSWindowDelegate, and as a result a tracked modifiers state can quite
+            // easily fall out of synchrony with reality.  This requires us to emit
+            // a synthetic ModifiersChanged event when we lose focus.
+            self.view().reset_modifiers();
+
+            self.queue_event(WindowEvent::Focused(false));
+        }
+
+        /// Invoked when before enter fullscreen
+        #[method(windowWillEnterFullScreen:)]
+        fn window_will_enter_fullscreen(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowWillEnterFullScreen:");
+
+            self.ivars().maximized.set(self.is_zoomed());
+            let mut fullscreen = self.ivars().fullscreen.borrow_mut();
+            match &*fullscreen {
+                // Exclusive mode sets the state in `set_fullscreen` as the user
+                // can't enter exclusive mode by other means (like the
+                // fullscreen button on the window decorations)
+                Some(Fullscreen::Exclusive(_)) => (),
+                // `window_will_enter_fullscreen` was triggered and we're already
+                // in fullscreen, so we must've reached here by `set_fullscreen`
+                // as it updates the state
+                Some(Fullscreen::Borderless(_)) => (),
+                // Otherwise, we must've reached fullscreen by the user clicking
+                // on the green fullscreen button. Update state!
+                None => {
+                    let current_monitor = self.current_monitor_inner();
+                    *fullscreen = Some(Fullscreen::Borderless(current_monitor));
+                },
+            }
+            self.ivars().in_fullscreen_transition.set(true);
+        }
+
+        /// Invoked when before exit fullscreen
+        #[method(windowWillExitFullScreen:)]
+        fn window_will_exit_fullscreen(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowWillExitFullScreen:");
+
+            self.ivars().in_fullscreen_transition.set(true);
+        }
+
+        #[method(window:willUseFullScreenPresentationOptions:)]
+        fn window_will_use_fullscreen_presentation_options(
+            &self,
+            _: Option<&AnyObject>,
+            proposed_options: NSApplicationPresentationOptions,
+        ) -> NSApplicationPresentationOptions {
+            trace_scope!("window:willUseFullScreenPresentationOptions:");
+            // Generally, games will want to disable the menu bar and the dock. Ideally,
+            // this would be configurable by the user. Unfortunately because of our
+            // `CGShieldingWindowLevel() + 1` hack (see `set_fullscreen`), our window is
+            // placed on top of the menu bar in exclusive fullscreen mode. This looks
+            // broken so we always disable the menu bar in exclusive fullscreen. We may
+            // still want to make this configurable for borderless fullscreen. Right now
+            // we don't, for consistency. If we do, it should be documented that the
+            // user-provided options are ignored in exclusive fullscreen.
+            let mut options = proposed_options;
+            let fullscreen = self.ivars().fullscreen.borrow();
+            if let Some(Fullscreen::Exclusive(_)) = &*fullscreen {
+                options = NSApplicationPresentationOptions::NSApplicationPresentationFullScreen
+                    | NSApplicationPresentationOptions::NSApplicationPresentationHideDock
+                    | NSApplicationPresentationOptions::NSApplicationPresentationHideMenuBar;
+            }
+
+            options
+        }
+
+        /// Invoked when entered fullscreen
+        #[method(windowDidEnterFullScreen:)]
+        fn window_did_enter_fullscreen(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidEnterFullScreen:");
+            self.ivars().initial_fullscreen.set(false);
+            self.ivars().in_fullscreen_transition.set(false);
+            if let Some(target_fullscreen) = self.ivars().target_fullscreen.take() {
+                self.set_fullscreen(target_fullscreen);
+            }
+        }
+
+        /// Invoked when exited fullscreen
+        #[method(windowDidExitFullScreen:)]
+        fn window_did_exit_fullscreen(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidExitFullScreen:");
+
+            self.restore_state_from_fullscreen();
+            self.ivars().in_fullscreen_transition.set(false);
+            if let Some(target_fullscreen) = self.ivars().target_fullscreen.take() {
+                self.set_fullscreen(target_fullscreen);
+            }
+        }
+
+        /// Invoked when fail to enter fullscreen
+        ///
+        /// When this window launch from a fullscreen app (e.g. launch from VS Code
+        /// terminal), it creates a new virtual desktop and a transition animation.
+        /// This animation takes one second and cannot be disable without
+        /// elevated privileges. In this animation time, all toggleFullscreen events
+        /// will be failed. In this implementation, we will try again by using
+        /// performSelector:withObject:afterDelay: until window_did_enter_fullscreen.
+        /// It should be fine as we only do this at initialization (i.e with_fullscreen
+        /// was set).
+        ///
+        /// From Apple doc:
+        /// In some cases, the transition to enter full-screen mode can fail,
+        /// due to being in the midst of handling some other animation or user gesture.
+        /// This method indicates that there was an error, and you should clean up any
+        /// work you may have done to prepare to enter full-screen mode.
+        #[method(windowDidFailToEnterFullScreen:)]
+        fn window_did_fail_to_enter_fullscreen(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidFailToEnterFullScreen:");
+            self.ivars().in_fullscreen_transition.set(false);
+            self.ivars().target_fullscreen.replace(None);
+            if self.ivars().initial_fullscreen.get() {
+                unsafe {
+                    self.window().performSelector_withObject_afterDelay(
+                        sel!(toggleFullScreen:),
+                        None,
+                        0.5,
+                    )
+                };
+            } else {
+                self.restore_state_from_fullscreen();
+            }
+        }
+
+        // Invoked when the occlusion state of the window changes
+        #[method(windowDidChangeOcclusionState:)]
+        fn window_did_change_occlusion_state(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidChangeOcclusionState:");
+            let visible = self.window().occlusionState().contains(NSWindowOcclusionState::Visible);
+            self.queue_event(WindowEvent::Occluded(!visible));
+        }
+
+        #[method(windowDidChangeScreen:)]
+        fn window_did_change_screen(&self, _: Option<&AnyObject>) {
+            trace_scope!("windowDidChangeScreen:");
+            let is_simple_fullscreen = self.ivars().is_simple_fullscreen.get();
+            if is_simple_fullscreen {
+                if let Some(screen) = self.window().screen() {
+                    self.window().setFrame_display(screen.frame(), true);
+                }
+            }
+        }
+    }
+
+    unsafe impl NSDraggingDestination for WindowDelegate {
+        /// Invoked when the dragged image enters destination bounds or frame
+        #[method(draggingEntered:)]
+        fn dragging_entered(&self, sender: &NSObject) -> bool {
+            trace_scope!("draggingEntered:");
+
+            use std::path::PathBuf;
+
+            let pb: Retained<NSPasteboard> = unsafe { msg_send_id![sender, draggingPasteboard] };
+            let filenames = match pb.propertyListForType(unsafe { NSFilenamesPboardType }) {
+                Some(filenames) => filenames,
+                None => return false.into(),
+            };
+            let filenames: Retained<NSArray<NSString>> = unsafe { Retained::cast(filenames) };
+
+            filenames.into_iter().for_each(|file| {
+                let path = PathBuf::from(file.to_string());
+                self.queue_event(WindowEvent::HoveredFile(path));
+            });
+
+            true
+        }
+
+        /// Invoked when the image is released
+        #[method(prepareForDragOperation:)]
+        fn prepare_for_drag_operation(&self, _sender: &NSObject) -> bool {
+            trace_scope!("prepareForDragOperation:");
+            true
+        }
+
+        /// Invoked after the released image has been removed from the screen
+        #[method(performDragOperation:)]
+        fn perform_drag_operation(&self, sender: &NSObject) -> bool {
+            trace_scope!("performDragOperation:");
+
+            use std::path::PathBuf;
+
+            let pb: Retained<NSPasteboard> = unsafe { msg_send_id![sender, draggingPasteboard] };
+            let filenames = match pb.propertyListForType(unsafe { NSFilenamesPboardType }) {
+                Some(filenames) => filenames,
+                None => return false.into(),
+            };
+            let filenames: Retained<NSArray<NSString>> = unsafe { Retained::cast(filenames) };
+
+            filenames.into_iter().for_each(|file| {
+                let path = PathBuf::from(file.to_string());
+                self.queue_event(WindowEvent::DroppedFile(path));
+            });
+
+            true
+        }
+
+        /// Invoked when the dragging operation is complete
+        #[method(concludeDragOperation:)]
+        fn conclude_drag_operation(&self, _sender: Option<&NSObject>) {
+            trace_scope!("concludeDragOperation:");
+        }
+
+        /// Invoked when the dragging operation is cancelled
+        #[method(draggingExited:)]
+        fn dragging_exited(&self, _sender: Option<&NSObject>) {
+            trace_scope!("draggingExited:");
+            self.queue_event(WindowEvent::HoveredFileCancelled);
+        }
+    }
+
+    // Key-Value Observing
+    unsafe impl WindowDelegate {
+        #[method(observeValueForKeyPath:ofObject:change:context:)]
+        fn observe_value(
+            &self,
+            key_path: Option<&NSString>,
+            _object: Option<&AnyObject>,
+            change: Option<&NSDictionary<NSKeyValueChangeKey, AnyObject>>,
+            _context: *mut c_void,
+        ) {
+            trace_scope!("observeValueForKeyPath:ofObject:change:context:");
+            // NOTE: We don't _really_ need to check the key path, as there should only be one, but
+            // in the future we might want to observe other key paths.
+            if key_path == Some(ns_string!("effectiveAppearance")) {
+                let change = change.expect("requested a change dictionary in `addObserver`, but none was provided");
+                let old = change.get(unsafe { NSKeyValueChangeOldKey }).expect("requested change dictionary did not contain `NSKeyValueChangeOldKey`");
+                let new = change.get(unsafe { NSKeyValueChangeNewKey }).expect("requested change dictionary did not contain `NSKeyValueChangeNewKey`");
+
+                // SAFETY: The value of `effectiveAppearance` is `NSAppearance`
+                let old: *const AnyObject = old;
+                let old: *const NSAppearance = old.cast();
+                let old: &NSAppearance = unsafe { &*old };
+                let new: *const AnyObject = new;
+                let new: *const NSAppearance = new.cast();
+                let new: &NSAppearance = unsafe { &*new };
+
+                trace!(old = %unsafe { old.name() }, new = %unsafe { new.name() }, "effectiveAppearance changed");
+
+                // Ignore the change if the window's theme is customized by the user (since in that
+                // case the `effectiveAppearance` is only emitted upon said customization, and then
+                // it's triggered directly by a user action, and we don't want to emit the event).
+                if unsafe { self.window().appearance() }.is_some() {
+                    return;
+                }
+
+                let old = appearance_to_theme(old);
+                let new = appearance_to_theme(new);
+                // Check that the theme changed in Winit's terms (the theme might have changed on
+                // other parameters, such as level of contrast, but the event should not be emitted
+                // in those cases).
+                if old == new {
+                    return;
+                }
+
+                self.queue_event(WindowEvent::ThemeChanged(new));
+            } else {
+                panic!("unknown observed keypath {key_path:?}");
+            }
+        }
+    }
+);
+
+impl Drop for WindowDelegate {
+    fn drop(&mut self) {
+        unsafe {
+            self.window().removeObserver_forKeyPath(self, ns_string!("effectiveAppearance"));
+        }
+    }
+}
+
+fn new_window(
+    app_delegate: &ApplicationDelegate,
+    attrs: &WindowAttributes,
+    mtm: MainThreadMarker,
+) -> Option<Retained<WinitWindow>> {
+    autoreleasepool(|_| {
+        let screen = match attrs.fullscreen.clone().map(Into::into) {
+            Some(Fullscreen::Borderless(Some(monitor)))
+            | Some(Fullscreen::Exclusive(VideoModeHandle { monitor, .. })) => {
+                monitor.ns_screen(mtm).or_else(|| NSScreen::mainScreen(mtm))
+            },
+            Some(Fullscreen::Borderless(None)) => NSScreen::mainScreen(mtm),
+            None => None,
+        };
+        let frame = match &screen {
+            Some(screen) => screen.frame(),
+            None => {
+                let scale_factor = NSScreen::mainScreen(mtm)
+                    .map(|screen| screen.backingScaleFactor() as f64)
+                    .unwrap_or(1.0);
+                let size = match attrs.inner_size {
+                    Some(size) => {
+                        let size = size.to_logical(scale_factor);
+                        NSSize::new(size.width, size.height)
+                    },
+                    None => NSSize::new(800.0, 600.0),
+                };
+                let position = match attrs.position {
+                    Some(position) => {
+                        let position = position.to_logical(scale_factor);
+                        flip_window_screen_coordinates(NSRect::new(
+                            NSPoint::new(position.x, position.y),
+                            size,
+                        ))
+                    },
+                    // This value is ignored by calling win.center() below
+                    None => NSPoint::new(0.0, 0.0),
+                };
+                NSRect::new(position, size)
+            },
+        };
+
+        let mut masks = if (!attrs.decorations && screen.is_none())
+            || attrs.platform_specific.titlebar_hidden
+        {
+            // Resizable without a titlebar or borders
+            // if decorations is set to false, ignore pl_attrs
+            //
+            // if the titlebar is hidden, ignore other pl_attrs
+            NSWindowStyleMask::Borderless
+                | NSWindowStyleMask::Resizable
+                | NSWindowStyleMask::Miniaturizable
+        } else {
+            // default case, resizable window with titlebar and titlebar buttons
+            NSWindowStyleMask::Closable
+                | NSWindowStyleMask::Miniaturizable
+                | NSWindowStyleMask::Resizable
+                | NSWindowStyleMask::Titled
+        };
+
+        if !attrs.resizable {
+            masks &= !NSWindowStyleMask::Resizable;
+        }
+
+        if !attrs.enabled_buttons.contains(WindowButtons::MINIMIZE) {
+            masks &= !NSWindowStyleMask::Miniaturizable;
+        }
+
+        if !attrs.enabled_buttons.contains(WindowButtons::CLOSE) {
+            masks &= !NSWindowStyleMask::Closable;
+        }
+
+        if attrs.platform_specific.fullsize_content_view {
+            masks |= NSWindowStyleMask::FullSizeContentView;
+        }
+
+        let window: Option<Retained<WinitWindow>> = unsafe {
+            msg_send_id![
+                super(mtm.alloc().set_ivars(())),
+                initWithContentRect: frame,
+                styleMask: masks,
+                backing: NSBackingStoreType::NSBackingStoreBuffered,
+                defer: false,
+            ]
+        };
+        let window = window?;
+
+        // It is very important for correct memory management that we
+        // disable the extra release that would otherwise happen when
+        // calling `close` on the window.
+        unsafe { window.setReleasedWhenClosed(false) };
+
+        window.setTitle(&NSString::from_str(&attrs.title));
+        window.setAcceptsMouseMovedEvents(true);
+
+        if let Some(identifier) = &attrs.platform_specific.tabbing_identifier {
+            window.setTabbingIdentifier(&NSString::from_str(identifier));
+            window.setTabbingMode(NSWindowTabbingMode::Preferred);
+        }
+
+        if attrs.content_protected {
+            window.setSharingType(NSWindowSharingType::NSWindowSharingNone);
+        }
+
+        if attrs.platform_specific.titlebar_transparent {
+            window.setTitlebarAppearsTransparent(true);
+        }
+        if attrs.platform_specific.title_hidden {
+            window.setTitleVisibility(NSWindowTitleVisibility::NSWindowTitleHidden);
+        }
+        if attrs.platform_specific.titlebar_buttons_hidden {
+            for titlebar_button in &[
+                #[allow(deprecated)]
+                NSWindowFullScreenButton,
+                NSWindowButton::NSWindowMiniaturizeButton,
+                NSWindowButton::NSWindowCloseButton,
+                NSWindowButton::NSWindowZoomButton,
+            ] {
+                if let Some(button) = window.standardWindowButton(*titlebar_button) {
+                    button.setHidden(true);
+                }
+            }
+        }
+        if attrs.platform_specific.movable_by_window_background {
+            window.setMovableByWindowBackground(true);
+        }
+
+        if !attrs.enabled_buttons.contains(WindowButtons::MAXIMIZE) {
+            if let Some(button) = window.standardWindowButton(NSWindowButton::NSWindowZoomButton) {
+                button.setEnabled(false);
+            }
+        }
+
+        if !attrs.platform_specific.has_shadow {
+            window.setHasShadow(false);
+        }
+        if attrs.position.is_none() {
+            window.center();
+        }
+
+        let view = WinitView::new(
+            app_delegate,
+            &window,
+            attrs.platform_specific.accepts_first_mouse,
+            attrs.platform_specific.option_as_alt,
+        );
+
+        // The default value of `setWantsBestResolutionOpenGLSurface:` was `false` until
+        // macos 10.14 and `true` after 10.15, we should set it to `YES` or `NO` to avoid
+        // always the default system value in favour of the user's code
+        #[allow(deprecated)]
+        view.setWantsBestResolutionOpenGLSurface(!attrs.platform_specific.disallow_hidpi);
+
+        // On Mojave, views automatically become layer-backed shortly after being added to
+        // a window. Changing the layer-backedness of a view breaks the association between
+        // the view and its associated OpenGL context. To work around this, on Mojave we
+        // explicitly make the view layer-backed up front so that AppKit doesn't do it
+        // itself and break the association with its context.
+        if unsafe { NSAppKitVersionNumber }.floor() > NSAppKitVersionNumber10_12 {
+            view.setWantsLayer(true);
+        }
+
+        // Configure the new view as the "key view" for the window
+        window.setContentView(Some(&view));
+        window.setInitialFirstResponder(Some(&view));
+
+        if attrs.transparent {
+            window.setOpaque(false);
+            // See `set_transparent` for details on why we do this.
+            window.setBackgroundColor(unsafe { Some(&NSColor::clearColor()) });
+        }
+
+        // register for drag and drop operations.
+        window
+            .registerForDraggedTypes(&NSArray::from_id_slice(&[
+                unsafe { NSFilenamesPboardType }.copy()
+            ]));
+
+        Some(window)
+    })
+}
+
+impl WindowDelegate {
+    pub(super) fn new(
+        app_delegate: &ApplicationDelegate,
+        attrs: WindowAttributes,
+        mtm: MainThreadMarker,
+    ) -> Result<Retained<Self>, RootOsError> {
+        let window = new_window(app_delegate, &attrs, mtm)
+            .ok_or_else(|| os_error!(OsError::CreationError("couldn't create `NSWindow`")))?;
+
+        #[cfg(feature = "rwh_06")]
+        match attrs.parent_window.map(|handle| handle.0) {
+            Some(rwh_06::RawWindowHandle::AppKit(handle)) => {
+                // SAFETY: Caller ensures the pointer is valid or NULL
+                // Unwrap is fine, since the pointer comes from `NonNull`.
+                let parent_view: Retained<NSView> =
+                    unsafe { Retained::retain(handle.ns_view.as_ptr().cast()) }.unwrap();
+                let parent = parent_view.window().ok_or_else(|| {
+                    os_error!(OsError::CreationError("parent view should be installed in a window"))
+                })?;
+
+                // SAFETY: We know that there are no parent -> child -> parent cycles since the only
+                // place in `winit` where we allow making a window a child window is
+                // right here, just after it's been created.
+                unsafe {
+                    parent.addChildWindow_ordered(&window, NSWindowOrderingMode::NSWindowAbove)
+                };
+            },
+            Some(raw) => panic!("invalid raw window handle {raw:?} on macOS"),
+            None => (),
+        }
+
+        let resize_increments =
+            match attrs.resize_increments.map(|i| i.to_logical(window.backingScaleFactor() as _)) {
+                Some(LogicalSize { width, height }) if width >= 1. && height >= 1. => {
+                    NSSize::new(width, height)
+                },
+                _ => NSSize::new(1., 1.),
+            };
+
+        let scale_factor = window.backingScaleFactor() as _;
+
+        if let Some(appearance) = theme_to_appearance(attrs.preferred_theme) {
+            unsafe { window.setAppearance(Some(&appearance)) };
+        }
+
+        let delegate = mtm.alloc().set_ivars(State {
+            app_delegate: app_delegate.retain(),
+            window: window.retain(),
+            previous_position: Cell::new(flip_window_screen_coordinates(window.frame())),
+            previous_scale_factor: Cell::new(scale_factor),
+            resize_increments: Cell::new(resize_increments),
+            decorations: Cell::new(attrs.decorations),
+            resizable: Cell::new(attrs.resizable),
+            maximized: Cell::new(attrs.maximized),
+            save_presentation_opts: Cell::new(None),
+            initial_fullscreen: Cell::new(attrs.fullscreen.is_some()),
+            fullscreen: RefCell::new(None),
+            target_fullscreen: RefCell::new(None),
+            in_fullscreen_transition: Cell::new(false),
+            standard_frame: Cell::new(None),
+            is_simple_fullscreen: Cell::new(false),
+            saved_style: Cell::new(None),
+            is_borderless_game: Cell::new(attrs.platform_specific.borderless_game),
+        });
+        let delegate: Retained<WindowDelegate> = unsafe { msg_send_id![super(delegate), init] };
+
+        if scale_factor != 1.0 {
+            let delegate = delegate.clone();
+            RunLoop::main(mtm).queue_closure(move || {
+                delegate.handle_scale_factor_changed(scale_factor);
+            });
+        }
+        window.setDelegate(Some(ProtocolObject::from_ref(&*delegate)));
+
+        // Listen for theme change event.
+        //
+        // SAFETY: The observer is un-registered in the `Drop` of the delegate.
+        unsafe {
+            window.addObserver_forKeyPath_options_context(
+                &delegate,
+                ns_string!("effectiveAppearance"),
+                NSKeyValueObservingOptions::NSKeyValueObservingOptionNew
+                    | NSKeyValueObservingOptions::NSKeyValueObservingOptionOld,
+                ptr::null_mut(),
+            )
+        };
+
+        if attrs.blur {
+            delegate.set_blur(attrs.blur);
+        }
+
+        if let Some(dim) = attrs.min_inner_size {
+            delegate.set_min_inner_size(Some(dim));
+        }
+        if let Some(dim) = attrs.max_inner_size {
+            delegate.set_max_inner_size(Some(dim));
+        }
+
+        delegate.set_window_level(attrs.window_level);
+
+        delegate.set_cursor(attrs.cursor);
+
+        // XXX Send `Focused(false)` right after creating the window delegate, so we won't
+        // obscure the real focused events on the startup.
+        delegate.queue_event(WindowEvent::Focused(false));
+
+        // Set fullscreen mode after we setup everything
+        delegate.set_fullscreen(attrs.fullscreen.map(Into::into));
+
+        // Setting the window as key has to happen *after* we set the fullscreen
+        // state, since otherwise we'll briefly see the window at normal size
+        // before it transitions.
+        if attrs.visible {
+            if attrs.active {
+                // Tightly linked with `app_state::window_activation_hack`
+                window.makeKeyAndOrderFront(None);
+            } else {
+                window.orderFront(None);
+            }
+        }
+
+        if attrs.maximized {
+            delegate.set_maximized(attrs.maximized);
+        }
+
+        Ok(delegate)
+    }
+
+    #[track_caller]
+    pub(super) fn view(&self) -> Retained<WinitView> {
+        // SAFETY: The view inside WinitWindow is always `WinitView`
+        unsafe { Retained::cast(self.window().contentView().unwrap()) }
+    }
+
+    #[track_caller]
+    pub(super) fn window(&self) -> &WinitWindow {
+        &self.ivars().window
+    }
+
+    #[track_caller]
+    pub(crate) fn id(&self) -> WindowId {
+        self.window().id()
+    }
+
+    pub(crate) fn queue_event(&self, event: WindowEvent) {
+        self.ivars().app_delegate.maybe_queue_window_event(self.window().id(), event);
+    }
+
+    fn handle_scale_factor_changed(&self, scale_factor: CGFloat) {
+        let app_delegate = &self.ivars().app_delegate;
+        let window = self.window();
+
+        let content_size = window.contentRectForFrameRect(window.frame()).size;
+        let content_size = LogicalSize::new(content_size.width, content_size.height);
+
+        let suggested_size = content_size.to_physical(scale_factor);
+        let new_inner_size = Arc::new(Mutex::new(suggested_size));
+        app_delegate.handle_window_event(window.id(), WindowEvent::ScaleFactorChanged {
+            scale_factor,
+            inner_size_writer: InnerSizeWriter::new(Arc::downgrade(&new_inner_size)),
+        });
+        let physical_size = *new_inner_size.lock().unwrap();
+        drop(new_inner_size);
+
+        if physical_size != suggested_size {
+            let logical_size = physical_size.to_logical(scale_factor);
+            let size = NSSize::new(logical_size.width, logical_size.height);
+            window.setContentSize(size);
+        }
+        app_delegate.handle_window_event(window.id(), WindowEvent::Resized(physical_size));
+    }
+
+    fn emit_move_event(&self) {
+        let position = flip_window_screen_coordinates(self.window().frame());
+        if self.ivars().previous_position.get() == position {
+            return;
+        }
+        self.ivars().previous_position.set(position);
+
+        let position =
+            LogicalPosition::new(position.x, position.y).to_physical(self.scale_factor());
+        self.queue_event(WindowEvent::Moved(position));
+    }
+
+    fn set_style_mask(&self, mask: NSWindowStyleMask) {
+        self.window().setStyleMask(mask);
+        // If we don't do this, key handling will break
+        // (at least until the window is clicked again/etc.)
+        let _ = self.window().makeFirstResponder(Some(&self.view()));
+    }
+
+    pub fn set_title(&self, title: &str) {
+        self.window().setTitle(&NSString::from_str(title))
+    }
+
+    pub fn set_transparent(&self, transparent: bool) {
+        // This is just a hint for Quartz, it doesn't actually speculate with window alpha.
+        // Providing a wrong value here could result in visual artifacts, when the window is
+        // transparent.
+        self.window().setOpaque(!transparent);
+
+        // AppKit draws the window with a background color by default, which is usually really
+        // nice, but gets in the way when we want to allow the contents of the window to be
+        // transparent, as in that case, the transparent contents will just be drawn on top of
+        // the background color. As such, to allow the window to be transparent, we must also set
+        // the background color to one with an empty alpha channel.
+        let color = if transparent {
+            unsafe { NSColor::clearColor() }
+        } else {
+            unsafe { NSColor::windowBackgroundColor() }
+        };
+
+        self.window().setBackgroundColor(Some(&color));
+    }
+
+    pub fn set_blur(&self, blur: bool) {
+        // NOTE: in general we want to specify the blur radius, but the choice of 80
+        // should be a reasonable default.
+        let radius = if blur { 80 } else { 0 };
+        let window_number = unsafe { self.window().windowNumber() };
+        unsafe {
+            ffi::CGSSetWindowBackgroundBlurRadius(
+                ffi::CGSMainConnectionID(),
+                window_number,
+                radius,
+            );
+        }
+    }
+
+    pub fn set_visible(&self, visible: bool) {
+        match visible {
+            true => self.window().makeKeyAndOrderFront(None),
+            false => self.window().orderOut(None),
+        }
+    }
+
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        Some(self.window().isVisible())
+    }
+
+    pub fn request_redraw(&self) {
+        self.ivars().app_delegate.queue_redraw(self.window().id());
+    }
+
+    #[inline]
+    pub fn pre_present_notify(&self) {}
+
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let position = flip_window_screen_coordinates(self.window().frame());
+        Ok(LogicalPosition::new(position.x, position.y).to_physical(self.scale_factor()))
+    }
+
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let content_rect = self.window().contentRectForFrameRect(self.window().frame());
+        let position = flip_window_screen_coordinates(content_rect);
+        Ok(LogicalPosition::new(position.x, position.y).to_physical(self.scale_factor()))
+    }
+
+    pub fn set_outer_position(&self, position: Position) {
+        let position = position.to_logical(self.scale_factor());
+        let point = flip_window_screen_coordinates(NSRect::new(
+            NSPoint::new(position.x, position.y),
+            self.window().frame().size,
+        ));
+        unsafe { self.window().setFrameOrigin(point) };
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        let content_rect = self.window().contentRectForFrameRect(self.window().frame());
+        let logical = LogicalSize::new(content_rect.size.width, content_rect.size.height);
+        logical.to_physical(self.scale_factor())
+    }
+
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        let frame = self.window().frame();
+        let logical = LogicalSize::new(frame.size.width, frame.size.height);
+        logical.to_physical(self.scale_factor())
+    }
+
+    #[inline]
+    pub fn request_inner_size(&self, size: Size) -> Option<PhysicalSize<u32>> {
+        let scale_factor = self.scale_factor();
+        let size = size.to_logical(scale_factor);
+        self.window().setContentSize(NSSize::new(size.width, size.height));
+        None
+    }
+
+    pub fn set_min_inner_size(&self, dimensions: Option<Size>) {
+        let dimensions =
+            dimensions.unwrap_or(Size::Logical(LogicalSize { width: 0.0, height: 0.0 }));
+        let min_size = dimensions.to_logical::<CGFloat>(self.scale_factor());
+
+        let min_size = NSSize::new(min_size.width, min_size.height);
+        unsafe { self.window().setContentMinSize(min_size) };
+
+        // If necessary, resize the window to match constraint
+        let mut current_size = self.window().contentRectForFrameRect(self.window().frame()).size;
+        if current_size.width < min_size.width {
+            current_size.width = min_size.width;
+        }
+        if current_size.height < min_size.height {
+            current_size.height = min_size.height;
+        }
+        self.window().setContentSize(current_size);
+    }
+
+    pub fn set_max_inner_size(&self, dimensions: Option<Size>) {
+        let dimensions = dimensions.unwrap_or(Size::Logical(LogicalSize {
+            width: f32::MAX as f64,
+            height: f32::MAX as f64,
+        }));
+        let scale_factor = self.scale_factor();
+        let max_size = dimensions.to_logical::<CGFloat>(scale_factor);
+
+        let max_size = NSSize::new(max_size.width, max_size.height);
+        unsafe { self.window().setContentMaxSize(max_size) };
+
+        // If necessary, resize the window to match constraint
+        let mut current_size = self.window().contentRectForFrameRect(self.window().frame()).size;
+        if max_size.width < current_size.width {
+            current_size.width = max_size.width;
+        }
+        if max_size.height < current_size.height {
+            current_size.height = max_size.height;
+        }
+        self.window().setContentSize(current_size);
+    }
+
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        let increments = self.ivars().resize_increments.get();
+        let (w, h) = (increments.width, increments.height);
+        if w > 1.0 || h > 1.0 {
+            Some(LogicalSize::new(w, h).to_physical(self.scale_factor()))
+        } else {
+            None
+        }
+    }
+
+    pub fn set_resize_increments(&self, increments: Option<Size>) {
+        // XXX the resize increments are only used during live resizes.
+        self.ivars().resize_increments.set(
+            increments
+                .map(|increments| {
+                    let logical = increments.to_logical::<f64>(self.scale_factor());
+                    NSSize::new(logical.width.max(1.0), logical.height.max(1.0))
+                })
+                .unwrap_or_else(|| NSSize::new(1.0, 1.0)),
+        );
+    }
+
+    pub(crate) fn set_resize_increments_inner(&self, size: NSSize) {
+        // It was concluded (#2411) that there is never a use-case for
+        // "outer" resize increments, hence we set "inner" ones here.
+        // ("outer" in macOS being just resizeIncrements, and "inner" - contentResizeIncrements)
+        // This is consistent with X11 size hints behavior
+        self.window().setContentResizeIncrements(size);
+    }
+
+    #[inline]
+    pub fn set_resizable(&self, resizable: bool) {
+        self.ivars().resizable.set(resizable);
+        let fullscreen = self.ivars().fullscreen.borrow().is_some();
+        if !fullscreen {
+            let mut mask = self.window().styleMask();
+            if resizable {
+                mask |= NSWindowStyleMask::Resizable;
+            } else {
+                mask &= !NSWindowStyleMask::Resizable;
+            }
+            self.set_style_mask(mask);
+        }
+        // Otherwise, we don't change the mask until we exit fullscreen.
+    }
+
+    #[inline]
+    pub fn is_resizable(&self) -> bool {
+        self.window().isResizable()
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, buttons: WindowButtons) {
+        let mut mask = self.window().styleMask();
+
+        if buttons.contains(WindowButtons::CLOSE) {
+            mask |= NSWindowStyleMask::Closable;
+        } else {
+            mask &= !NSWindowStyleMask::Closable;
+        }
+
+        if buttons.contains(WindowButtons::MINIMIZE) {
+            mask |= NSWindowStyleMask::Miniaturizable;
+        } else {
+            mask &= !NSWindowStyleMask::Miniaturizable;
+        }
+
+        // This must happen before the button's "enabled" status has been set,
+        // hence we do it synchronously.
+        self.set_style_mask(mask);
+
+        // We edit the button directly instead of using `NSResizableWindowMask`,
+        // since that mask also affect the resizability of the window (which is
+        // controllable by other means in `winit`).
+        if let Some(button) = self.window().standardWindowButton(NSWindowButton::NSWindowZoomButton)
+        {
+            button.setEnabled(buttons.contains(WindowButtons::MAXIMIZE));
+        }
+    }
+
+    #[inline]
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        let mut buttons = WindowButtons::empty();
+        if self.window().isMiniaturizable() {
+            buttons |= WindowButtons::MINIMIZE;
+        }
+        if self
+            .window()
+            .standardWindowButton(NSWindowButton::NSWindowZoomButton)
+            .map(|b| b.isEnabled())
+            .unwrap_or(true)
+        {
+            buttons |= WindowButtons::MAXIMIZE;
+        }
+        if self.window().hasCloseBox() {
+            buttons |= WindowButtons::CLOSE;
+        }
+        buttons
+    }
+
+    pub fn set_cursor(&self, cursor: Cursor) {
+        let view = self.view();
+
+        let cursor = match cursor {
+            Cursor::Icon(icon) => cursor_from_icon(icon),
+            Cursor::Custom(cursor) => cursor.inner.0,
+        };
+
+        if view.cursor_icon() == cursor {
+            return;
+        }
+
+        view.set_cursor_icon(cursor);
+        self.window().invalidateCursorRectsForView(&view);
+    }
+
+    #[inline]
+    pub fn set_cursor_grab(&self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        let associate_mouse_cursor = match mode {
+            CursorGrabMode::Locked => false,
+            CursorGrabMode::None => true,
+            CursorGrabMode::Confined => {
+                return Err(ExternalError::NotSupported(NotSupportedError::new()))
+            },
+        };
+
+        // TODO: Do this for real https://stackoverflow.com/a/40922095/5435443
+        CGDisplay::associate_mouse_and_mouse_cursor_position(associate_mouse_cursor)
+            .map_err(|status| ExternalError::Os(os_error!(OsError::CGError(status))))
+    }
+
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        let view = self.view();
+        let state_changed = view.set_cursor_visible(visible);
+        if state_changed {
+            self.window().invalidateCursorRectsForView(&view);
+        }
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        self.window().backingScaleFactor() as _
+    }
+
+    #[inline]
+    pub fn set_cursor_position(&self, cursor_position: Position) -> Result<(), ExternalError> {
+        let physical_window_position = self.inner_position().unwrap();
+        let scale_factor = self.scale_factor();
+        let window_position = physical_window_position.to_logical::<CGFloat>(scale_factor);
+        let logical_cursor_position = cursor_position.to_logical::<CGFloat>(scale_factor);
+        let point = CGPoint {
+            x: logical_cursor_position.x + window_position.x,
+            y: logical_cursor_position.y + window_position.y,
+        };
+        CGDisplay::warp_mouse_cursor_position(point)
+            .map_err(|e| ExternalError::Os(os_error!(OsError::CGError(e))))?;
+        CGDisplay::associate_mouse_and_mouse_cursor_position(true)
+            .map_err(|e| ExternalError::Os(os_error!(OsError::CGError(e))))?;
+
+        Ok(())
+    }
+
+    #[inline]
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        let mtm = MainThreadMarker::from(self);
+        let event =
+            NSApplication::sharedApplication(mtm).currentEvent().ok_or(ExternalError::Ignored)?;
+        self.window().performWindowDragWithEvent(&event);
+        Ok(())
+    }
+
+    #[inline]
+    pub fn drag_resize_window(&self, _direction: ResizeDirection) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, _position: Position) {}
+
+    #[inline]
+    pub fn set_cursor_hittest(&self, hittest: bool) -> Result<(), ExternalError> {
+        self.window().setIgnoresMouseEvents(!hittest);
+        Ok(())
+    }
+
+    pub(crate) fn is_zoomed(&self) -> bool {
+        // because `isZoomed` doesn't work if the window's borderless,
+        // we make it resizable temporarily.
+        let curr_mask = self.window().styleMask();
+
+        let required = NSWindowStyleMask::Titled | NSWindowStyleMask::Resizable;
+        let needs_temp_mask = !curr_mask.contains(required);
+        if needs_temp_mask {
+            self.set_style_mask(required);
+        }
+
+        let is_zoomed = self.window().isZoomed();
+
+        // Roll back temp styles
+        if needs_temp_mask {
+            self.set_style_mask(curr_mask);
+        }
+
+        is_zoomed
+    }
+
+    fn saved_style(&self) -> NSWindowStyleMask {
+        let base_mask =
+            self.ivars().saved_style.take().unwrap_or_else(|| self.window().styleMask());
+        if self.ivars().resizable.get() {
+            base_mask | NSWindowStyleMask::Resizable
+        } else {
+            base_mask & !NSWindowStyleMask::Resizable
+        }
+    }
+
+    /// This is called when the window is exiting fullscreen, whether by the
+    /// user clicking on the green fullscreen button or programmatically by
+    /// `toggleFullScreen:`
+    pub(crate) fn restore_state_from_fullscreen(&self) {
+        self.ivars().fullscreen.replace(None);
+
+        let maximized = self.ivars().maximized.get();
+        let mask = self.saved_style();
+
+        self.set_style_mask(mask);
+        self.set_maximized(maximized);
+    }
+
+    #[inline]
+    pub fn set_minimized(&self, minimized: bool) {
+        let is_minimized = self.window().isMiniaturized();
+        if is_minimized == minimized {
+            return;
+        }
+
+        if minimized {
+            self.window().miniaturize(Some(self));
+        } else {
+            unsafe { self.window().deminiaturize(Some(self)) };
+        }
+    }
+
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        Some(self.window().isMiniaturized())
+    }
+
+    #[inline]
+    pub fn set_maximized(&self, maximized: bool) {
+        let mtm = MainThreadMarker::from(self);
+        let is_zoomed = self.is_zoomed();
+        if is_zoomed == maximized {
+            return;
+        };
+
+        // Save the standard frame sized if it is not zoomed
+        if !is_zoomed {
+            self.ivars().standard_frame.set(Some(self.window().frame()));
+        }
+
+        self.ivars().maximized.set(maximized);
+
+        if self.ivars().fullscreen.borrow().is_some() {
+            // Handle it in window_did_exit_fullscreen
+            return;
+        }
+
+        if self.window().styleMask().contains(NSWindowStyleMask::Resizable) {
+            // Just use the native zoom if resizable
+            self.window().zoom(None);
+        } else {
+            // if it's not resizable, we set the frame directly
+            let new_rect = if maximized {
+                let screen = NSScreen::mainScreen(mtm).expect("no screen found");
+                screen.visibleFrame()
+            } else {
+                self.ivars().standard_frame.get().unwrap_or(DEFAULT_STANDARD_FRAME)
+            };
+            self.window().setFrame_display(new_rect, false);
+        }
+    }
+
+    #[inline]
+    pub(crate) fn fullscreen(&self) -> Option<Fullscreen> {
+        self.ivars().fullscreen.borrow().clone()
+    }
+
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        self.is_zoomed()
+    }
+
+    #[inline]
+    pub(crate) fn set_fullscreen(&self, fullscreen: Option<Fullscreen>) {
+        let mtm = MainThreadMarker::from(self);
+        let app = NSApplication::sharedApplication(mtm);
+
+        if self.ivars().is_simple_fullscreen.get() {
+            return;
+        }
+        if self.ivars().in_fullscreen_transition.get() {
+            // We can't set fullscreen here.
+            // Set fullscreen after transition.
+            self.ivars().target_fullscreen.replace(Some(fullscreen));
+            return;
+        }
+        let old_fullscreen = self.ivars().fullscreen.borrow().clone();
+        if fullscreen == old_fullscreen {
+            return;
+        }
+
+        // If the fullscreen is on a different monitor, we must move the window
+        // to that monitor before we toggle fullscreen (as `toggleFullScreen`
+        // does not take a screen parameter, but uses the current screen)
+        if let Some(ref fullscreen) = fullscreen {
+            let new_screen = match fullscreen {
+                Fullscreen::Borderless(Some(monitor)) => monitor.clone(),
+                Fullscreen::Borderless(None) => {
+                    if let Some(monitor) = self.current_monitor_inner() {
+                        monitor
+                    } else {
+                        return;
+                    }
+                },
+                Fullscreen::Exclusive(video_mode) => video_mode.monitor(),
+            }
+            .ns_screen(mtm)
+            .unwrap();
+
+            let old_screen = self.window().screen().unwrap();
+            if old_screen != new_screen {
+                unsafe { self.window().setFrameOrigin(new_screen.frame().origin) };
+            }
+        }
+
+        if let Some(Fullscreen::Exclusive(ref video_mode)) = fullscreen {
+            // Note: `enterFullScreenMode:withOptions:` seems to do the exact
+            // same thing as we're doing here (captures the display, sets the
+            // video mode, and hides the menu bar and dock), with the exception
+            // of that I couldn't figure out how to set the display mode with
+            // it. I think `enterFullScreenMode:withOptions:` is still using the
+            // older display mode API where display modes were of the type
+            // `CFDictionary`, but this has changed, so we can't obtain the
+            // correct parameter for this any longer. Apple's code samples for
+            // this function seem to just pass in "YES" for the display mode
+            // parameter, which is not consistent with the docs saying that it
+            // takes a `NSDictionary`..
+
+            let display_id = video_mode.monitor().native_identifier();
+
+            let mut fade_token = ffi::kCGDisplayFadeReservationInvalidToken;
+
+            if matches!(old_fullscreen, Some(Fullscreen::Borderless(_))) {
+                self.ivars().save_presentation_opts.replace(Some(app.presentationOptions()));
+            }
+
+            unsafe {
+                // Fade to black (and wait for the fade to complete) to hide the
+                // flicker from capturing the display and switching display mode
+                if ffi::CGAcquireDisplayFadeReservation(5.0, &mut fade_token)
+                    == ffi::kCGErrorSuccess
+                {
+                    ffi::CGDisplayFade(
+                        fade_token,
+                        0.3,
+                        ffi::kCGDisplayBlendNormal,
+                        ffi::kCGDisplayBlendSolidColor,
+                        0.0,
+                        0.0,
+                        0.0,
+                        ffi::TRUE,
+                    );
+                }
+
+                assert_eq!(ffi::CGDisplayCapture(display_id), ffi::kCGErrorSuccess);
+            }
+
+            unsafe {
+                let result = ffi::CGDisplaySetDisplayMode(
+                    display_id,
+                    video_mode.native_mode.0,
+                    std::ptr::null(),
+                );
+                assert!(result == ffi::kCGErrorSuccess, "failed to set video mode");
+
+                // After the display has been configured, fade back in
+                // asynchronously
+                if fade_token != ffi::kCGDisplayFadeReservationInvalidToken {
+                    ffi::CGDisplayFade(
+                        fade_token,
+                        0.6,
+                        ffi::kCGDisplayBlendSolidColor,
+                        ffi::kCGDisplayBlendNormal,
+                        0.0,
+                        0.0,
+                        0.0,
+                        ffi::FALSE,
+                    );
+                    ffi::CGReleaseDisplayFadeReservation(fade_token);
+                }
+            }
+        }
+
+        self.ivars().fullscreen.replace(fullscreen.clone());
+
+        fn toggle_fullscreen(window: &WinitWindow) {
+            // Window level must be restored from `CGShieldingWindowLevel()
+            // + 1` back to normal in order for `toggleFullScreen` to do
+            // anything
+            window.setLevel(ffi::kCGNormalWindowLevel as NSWindowLevel);
+            window.toggleFullScreen(None);
+        }
+
+        match (old_fullscreen, fullscreen) {
+            (None, Some(fullscreen)) => {
+                // `toggleFullScreen` doesn't work if the `StyleMask` is none, so we
+                // set a normal style temporarily. The previous state will be
+                // restored in `WindowDelegate::window_did_exit_fullscreen`.
+                let curr_mask = self.window().styleMask();
+                let required = NSWindowStyleMask::Titled | NSWindowStyleMask::Resizable;
+                if !curr_mask.contains(required) {
+                    self.set_style_mask(required);
+                    self.ivars().saved_style.set(Some(curr_mask));
+                }
+
+                // In borderless games, we want to disable the dock and menu bar
+                // by setting the presentation options. We do this here rather than in
+                // `window:willUseFullScreenPresentationOptions` because for some reason
+                // the menu bar remains interactable despite being hidden.
+                if self.is_borderless_game() && matches!(fullscreen, Fullscreen::Borderless(_)) {
+                    let presentation_options = NSApplicationPresentationOptions::NSApplicationPresentationHideDock
+                            | NSApplicationPresentationOptions::NSApplicationPresentationHideMenuBar;
+                    app.setPresentationOptions(presentation_options);
+                }
+
+                toggle_fullscreen(self.window());
+            },
+            (Some(Fullscreen::Borderless(_)), None) => {
+                // State is restored by `window_did_exit_fullscreen`
+                toggle_fullscreen(self.window());
+            },
+            (Some(Fullscreen::Exclusive(ref video_mode)), None) => {
+                restore_and_release_display(&video_mode.monitor());
+                toggle_fullscreen(self.window());
+            },
+            (Some(Fullscreen::Borderless(_)), Some(Fullscreen::Exclusive(_))) => {
+                // If we're already in fullscreen mode, calling
+                // `CGDisplayCapture` will place the shielding window on top of
+                // our window, which results in a black display and is not what
+                // we want. So, we must place our window on top of the shielding
+                // window. Unfortunately, this also makes our window be on top
+                // of the menu bar, and this looks broken, so we must make sure
+                // that the menu bar is disabled. This is done in the window
+                // delegate in `window:willUseFullScreenPresentationOptions:`.
+                self.ivars().save_presentation_opts.set(Some(app.presentationOptions()));
+
+                let presentation_options =
+                    NSApplicationPresentationOptions::NSApplicationPresentationFullScreen
+                        | NSApplicationPresentationOptions::NSApplicationPresentationHideDock
+                        | NSApplicationPresentationOptions::NSApplicationPresentationHideMenuBar;
+                app.setPresentationOptions(presentation_options);
+
+                let window_level = unsafe { ffi::CGShieldingWindowLevel() } as NSWindowLevel + 1;
+                self.window().setLevel(window_level);
+            },
+            (Some(Fullscreen::Exclusive(ref video_mode)), Some(Fullscreen::Borderless(_))) => {
+                let presentation_options = self.ivars().save_presentation_opts.get().unwrap_or(
+                    NSApplicationPresentationOptions::NSApplicationPresentationFullScreen
+                        | NSApplicationPresentationOptions::NSApplicationPresentationAutoHideDock
+                        | NSApplicationPresentationOptions::NSApplicationPresentationAutoHideMenuBar
+                );
+                app.setPresentationOptions(presentation_options);
+
+                restore_and_release_display(&video_mode.monitor());
+
+                // Restore the normal window level following the Borderless fullscreen
+                // `CGShieldingWindowLevel() + 1` hack.
+                self.window().setLevel(ffi::kCGNormalWindowLevel as NSWindowLevel);
+            },
+            _ => {},
+        };
+    }
+
+    #[inline]
+    pub fn set_decorations(&self, decorations: bool) {
+        if decorations == self.ivars().decorations.get() {
+            return;
+        }
+
+        self.ivars().decorations.set(decorations);
+
+        let fullscreen = self.ivars().fullscreen.borrow().is_some();
+        let resizable = self.ivars().resizable.get();
+
+        // If we're in fullscreen mode, we wait to apply decoration changes
+        // until we're in `window_did_exit_fullscreen`.
+        if fullscreen {
+            return;
+        }
+
+        let new_mask = {
+            let mut new_mask = if decorations {
+                NSWindowStyleMask::Closable
+                    | NSWindowStyleMask::Miniaturizable
+                    | NSWindowStyleMask::Resizable
+                    | NSWindowStyleMask::Titled
+            } else {
+                NSWindowStyleMask::Borderless | NSWindowStyleMask::Resizable
+            };
+            if !resizable {
+                new_mask &= !NSWindowStyleMask::Resizable;
+            }
+            new_mask
+        };
+        self.set_style_mask(new_mask);
+    }
+
+    #[inline]
+    pub fn is_decorated(&self) -> bool {
+        self.ivars().decorations.get()
+    }
+
+    #[inline]
+    pub fn set_window_level(&self, level: WindowLevel) {
+        let level = match level {
+            WindowLevel::AlwaysOnTop => ffi::kCGFloatingWindowLevel as NSWindowLevel,
+            WindowLevel::AlwaysOnBottom => (ffi::kCGNormalWindowLevel - 1) as NSWindowLevel,
+            WindowLevel::Normal => ffi::kCGNormalWindowLevel as NSWindowLevel,
+        };
+        self.window().setLevel(level);
+    }
+
+    #[inline]
+    pub fn set_window_icon(&self, _icon: Option<Icon>) {
+        // macOS doesn't have window icons. Though, there is
+        // `setRepresentedFilename`, but that's semantically distinct and should
+        // only be used when the window is in some way representing a specific
+        // file/directory. For instance, Terminal.app uses this for the CWD.
+        // Anyway, that should eventually be implemented as
+        // `WindowAttributesExt::with_represented_file` or something, and doesn't
+        // have anything to do with `set_window_icon`.
+        // https://developer.apple.com/library/content/documentation/Cocoa/Conceptual/WinPanel/Tasks/SettingWindowTitle.html
+    }
+
+    #[inline]
+    pub fn set_ime_cursor_area(&self, spot: Position, size: Size) {
+        let scale_factor = self.scale_factor();
+        let logical_spot = spot.to_logical(scale_factor);
+        let logical_spot = NSPoint::new(logical_spot.x, logical_spot.y);
+
+        let size = size.to_logical(scale_factor);
+        let size = NSSize::new(size.width, size.height);
+
+        self.view().set_ime_cursor_area(logical_spot, size);
+    }
+
+    #[inline]
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        self.view().set_ime_allowed(allowed);
+    }
+
+    #[inline]
+    pub fn set_ime_purpose(&self, _purpose: ImePurpose) {}
+
+    #[inline]
+    pub fn focus_window(&self) {
+        let mtm = MainThreadMarker::from(self);
+        let is_minimized = self.window().isMiniaturized();
+        let is_visible = self.window().isVisible();
+
+        if !is_minimized && is_visible {
+            #[allow(deprecated)]
+            NSApplication::sharedApplication(mtm).activateIgnoringOtherApps(true);
+            self.window().makeKeyAndOrderFront(None);
+        }
+    }
+
+    #[inline]
+    pub fn request_user_attention(&self, request_type: Option<UserAttentionType>) {
+        let mtm = MainThreadMarker::from(self);
+        let ns_request_type = request_type.map(|ty| match ty {
+            UserAttentionType::Critical => NSRequestUserAttentionType::NSCriticalRequest,
+            UserAttentionType::Informational => NSRequestUserAttentionType::NSInformationalRequest,
+        });
+        if let Some(ty) = ns_request_type {
+            NSApplication::sharedApplication(mtm).requestUserAttention(ty);
+        }
+    }
+
+    #[inline]
+    // Allow directly accessing the current monitor internally without unwrapping.
+    pub(crate) fn current_monitor_inner(&self) -> Option<MonitorHandle> {
+        let display_id = get_display_id(&*self.window().screen()?);
+        if let Some(monitor) = MonitorHandle::new(display_id) {
+            Some(monitor)
+        } else {
+            // NOTE: Display ID was just fetched from live NSScreen, but can still result in `None`
+            // with certain Thunderbolt docked monitors.
+            warn!(display_id, "got screen with invalid display ID");
+            None
+        }
+    }
+
+    #[inline]
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        self.current_monitor_inner()
+    }
+
+    #[inline]
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        monitor::available_monitors()
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        let monitor = monitor::primary_monitor();
+        Some(monitor)
+    }
+
+    #[cfg(feature = "rwh_04")]
+    #[inline]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        let mut window_handle = rwh_04::AppKitHandle::empty();
+        window_handle.ns_window = self.window() as *const WinitWindow as *mut _;
+        window_handle.ns_view = Retained::as_ptr(&self.view()) as *mut _;
+        rwh_04::RawWindowHandle::AppKit(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        let mut window_handle = rwh_05::AppKitWindowHandle::empty();
+        window_handle.ns_window = self.window() as *const WinitWindow as *mut _;
+        window_handle.ns_view = Retained::as_ptr(&self.view()) as *mut _;
+        rwh_05::RawWindowHandle::AppKit(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::AppKit(rwh_05::AppKitDisplayHandle::empty())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_window_handle_rwh_06(&self) -> rwh_06::RawWindowHandle {
+        let window_handle = rwh_06::AppKitWindowHandle::new({
+            let ptr = Retained::as_ptr(&self.view()) as *mut _;
+            std::ptr::NonNull::new(ptr).expect("Retained<T> should never be null")
+        });
+        rwh_06::RawWindowHandle::AppKit(window_handle)
+    }
+
+    fn toggle_style_mask(&self, mask: NSWindowStyleMask, on: bool) {
+        let current_style_mask = self.window().styleMask();
+        if on {
+            self.set_style_mask(current_style_mask | mask);
+        } else {
+            self.set_style_mask(current_style_mask & !mask);
+        }
+    }
+
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        self.window().isKeyWindow()
+    }
+
+    pub fn theme(&self) -> Option<Theme> {
+        unsafe { self.window().appearance() }
+            .map(|appearance| appearance_to_theme(&appearance))
+            .or_else(|| {
+                let mtm = MainThreadMarker::from(self);
+                let app = NSApplication::sharedApplication(mtm);
+
+                if app.respondsToSelector(sel!(effectiveAppearance)) {
+                    Some(super::window_delegate::appearance_to_theme(&app.effectiveAppearance()))
+                } else {
+                    Some(Theme::Light)
+                }
+            })
+    }
+
+    pub fn set_theme(&self, theme: Option<Theme>) {
+        unsafe { self.window().setAppearance(theme_to_appearance(theme).as_deref()) };
+    }
+
+    #[inline]
+    pub fn set_content_protected(&self, protected: bool) {
+        self.window().setSharingType(if protected {
+            NSWindowSharingType::NSWindowSharingNone
+        } else {
+            NSWindowSharingType::NSWindowSharingReadOnly
+        })
+    }
+
+    pub fn title(&self) -> String {
+        self.window().title().to_string()
+    }
+
+    pub fn reset_dead_keys(&self) {
+        // (Artur) I couldn't find a way to implement this.
+    }
+}
+
+fn restore_and_release_display(monitor: &MonitorHandle) {
+    let available_monitors = monitor::available_monitors();
+    if available_monitors.contains(monitor) {
+        unsafe {
+            ffi::CGRestorePermanentDisplayConfiguration();
+            assert_eq!(ffi::CGDisplayRelease(monitor.native_identifier()), ffi::kCGErrorSuccess);
+        };
+    } else {
+        warn!(
+            monitor = monitor.name(),
+            "Tried to restore exclusive fullscreen on a monitor that is no longer available"
+        );
+    }
+}
+
+impl WindowExtMacOS for WindowDelegate {
+    #[inline]
+    fn simple_fullscreen(&self) -> bool {
+        self.ivars().is_simple_fullscreen.get()
+    }
+
+    #[inline]
+    fn set_simple_fullscreen(&self, fullscreen: bool) -> bool {
+        let mtm = MainThreadMarker::from(self);
+
+        let app = NSApplication::sharedApplication(mtm);
+        let is_native_fullscreen = self.ivars().fullscreen.borrow().is_some();
+        let is_simple_fullscreen = self.ivars().is_simple_fullscreen.get();
+
+        // Do nothing if native fullscreen is active.
+        if is_native_fullscreen
+            || (fullscreen && is_simple_fullscreen)
+            || (!fullscreen && !is_simple_fullscreen)
+        {
+            return false;
+        }
+
+        if fullscreen {
+            // Remember the original window's settings
+            // Exclude title bar
+            self.ivars()
+                .standard_frame
+                .set(Some(self.window().contentRectForFrameRect(self.window().frame())));
+            self.ivars().saved_style.set(Some(self.window().styleMask()));
+            self.ivars().save_presentation_opts.set(Some(app.presentationOptions()));
+
+            // Tell our window's state that we're in fullscreen
+            self.ivars().is_simple_fullscreen.set(true);
+
+            // Simulate pre-Lion fullscreen by hiding the dock and menu bar
+            let presentation_options = if self.is_borderless_game() {
+                NSApplicationPresentationOptions::NSApplicationPresentationHideDock
+                    | NSApplicationPresentationOptions::NSApplicationPresentationHideMenuBar
+            } else {
+                NSApplicationPresentationOptions::NSApplicationPresentationAutoHideDock
+                    | NSApplicationPresentationOptions::NSApplicationPresentationAutoHideMenuBar
+            };
+            app.setPresentationOptions(presentation_options);
+
+            // Hide the titlebar
+            self.toggle_style_mask(NSWindowStyleMask::Titled, false);
+
+            // Set the window frame to the screen frame size
+            let screen = self.window().screen().expect("expected screen to be available");
+            self.window().setFrame_display(screen.frame(), true);
+
+            // Fullscreen windows can't be resized, minimized, or moved
+            self.toggle_style_mask(NSWindowStyleMask::Miniaturizable, false);
+            self.toggle_style_mask(NSWindowStyleMask::Resizable, false);
+            self.window().setMovable(false);
+        } else {
+            let new_mask = self.saved_style();
+            self.ivars().is_simple_fullscreen.set(false);
+
+            let save_presentation_opts = self.ivars().save_presentation_opts.get();
+            let frame = self.ivars().standard_frame.get().unwrap_or(DEFAULT_STANDARD_FRAME);
+
+            if let Some(presentation_opts) = save_presentation_opts {
+                app.setPresentationOptions(presentation_opts);
+            }
+
+            self.window().setFrame_display(frame, true);
+            self.window().setMovable(true);
+            self.set_style_mask(new_mask);
+        }
+
+        true
+    }
+
+    #[inline]
+    fn has_shadow(&self) -> bool {
+        self.window().hasShadow()
+    }
+
+    #[inline]
+    fn set_has_shadow(&self, has_shadow: bool) {
+        self.window().setHasShadow(has_shadow)
+    }
+
+    #[inline]
+    fn set_tabbing_identifier(&self, identifier: &str) {
+        self.window().setTabbingIdentifier(&NSString::from_str(identifier))
+    }
+
+    #[inline]
+    fn tabbing_identifier(&self) -> String {
+        self.window().tabbingIdentifier().to_string()
+    }
+
+    #[inline]
+    fn select_next_tab(&self) {
+        self.window().selectNextTab(None)
+    }
+
+    #[inline]
+    fn select_previous_tab(&self) {
+        unsafe { self.window().selectPreviousTab(None) }
+    }
+
+    #[inline]
+    fn select_tab_at_index(&self, index: usize) {
+        if let Some(group) = self.window().tabGroup() {
+            if let Some(windows) = unsafe { self.window().tabbedWindows() } {
+                if index < windows.len() {
+                    group.setSelectedWindow(Some(&windows[index]));
+                }
+            }
+        }
+    }
+
+    #[inline]
+    fn num_tabs(&self) -> usize {
+        unsafe { self.window().tabbedWindows() }.map(|windows| windows.len()).unwrap_or(1)
+    }
+
+    fn is_document_edited(&self) -> bool {
+        self.window().isDocumentEdited()
+    }
+
+    fn set_document_edited(&self, edited: bool) {
+        self.window().setDocumentEdited(edited)
+    }
+
+    fn set_option_as_alt(&self, option_as_alt: OptionAsAlt) {
+        self.view().set_option_as_alt(option_as_alt);
+    }
+
+    fn option_as_alt(&self) -> OptionAsAlt {
+        self.view().option_as_alt()
+    }
+
+    fn set_borderless_game(&self, borderless_game: bool) {
+        self.ivars().is_borderless_game.set(borderless_game);
+    }
+
+    fn is_borderless_game(&self) -> bool {
+        self.ivars().is_borderless_game.get()
+    }
+}
+
+const DEFAULT_STANDARD_FRAME: NSRect =
+    NSRect::new(NSPoint::new(50.0, 50.0), NSSize::new(800.0, 600.0));
+
+fn dark_appearance_name() -> &'static NSString {
+    // Don't use the static `NSAppearanceNameDarkAqua` to allow linking on macOS < 10.14
+    ns_string!("NSAppearanceNameDarkAqua")
+}
+
+pub fn appearance_to_theme(appearance: &NSAppearance) -> Theme {
+    let best_match = appearance.bestMatchFromAppearancesWithNames(&NSArray::from_id_slice(&[
+        unsafe { NSAppearanceNameAqua.copy() },
+        dark_appearance_name().copy(),
+    ]));
+    if let Some(best_match) = best_match {
+        if *best_match == *dark_appearance_name() {
+            Theme::Dark
+        } else {
+            Theme::Light
+        }
+    } else {
+        warn!(?appearance, "failed to determine the theme of the appearance");
+        // Default to light in this case
+        Theme::Light
+    }
+}
+
+fn theme_to_appearance(theme: Option<Theme>) -> Option<Retained<NSAppearance>> {
+    let appearance = match theme? {
+        Theme::Light => unsafe { NSAppearance::appearanceNamed(NSAppearanceNameAqua) },
+        Theme::Dark => NSAppearance::appearanceNamed(dark_appearance_name()),
+    };
+    if let Some(appearance) = appearance {
+        Some(appearance)
+    } else {
+        warn!(?theme, "could not find appearance for theme");
+        // Assume system appearance in this case
+        None
+    }
+}
diff --git a/vendor/winit/src/platform_impl/mod.rs b/vendor/winit/src/platform_impl/mod.rs
new file mode 100644
index 00000000..3bfce688
--- /dev/null
+++ b/vendor/winit/src/platform_impl/mod.rs
@@ -0,0 +1,78 @@
+use crate::monitor::{MonitorHandle as RootMonitorHandle, VideoModeHandle as RootVideoModeHandle};
+use crate::window::Fullscreen as RootFullscreen;
+
+#[cfg(android_platform)]
+mod android;
+#[cfg(ios_platform)]
+mod ios;
+#[cfg(any(x11_platform, wayland_platform))]
+mod linux;
+#[cfg(macos_platform)]
+mod macos;
+#[cfg(orbital_platform)]
+mod orbital;
+#[cfg(web_platform)]
+mod web;
+#[cfg(windows_platform)]
+mod windows;
+
+#[cfg(android_platform)]
+use android as platform;
+#[cfg(ios_platform)]
+use ios as platform;
+#[cfg(any(x11_platform, wayland_platform))]
+use linux as platform;
+#[cfg(macos_platform)]
+use macos as platform;
+#[cfg(orbital_platform)]
+use orbital as platform;
+#[cfg(web_platform)]
+use web as platform;
+#[cfg(windows_platform)]
+use windows as platform;
+
+pub use self::platform::*;
+
+/// Helper for converting between platform-specific and generic
+/// [`VideoModeHandle`]/[`MonitorHandle`]
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum Fullscreen {
+    Exclusive(VideoModeHandle),
+    Borderless(Option<MonitorHandle>),
+}
+
+impl From<RootFullscreen> for Fullscreen {
+    fn from(f: RootFullscreen) -> Self {
+        match f {
+            RootFullscreen::Exclusive(mode) => Self::Exclusive(mode.video_mode),
+            RootFullscreen::Borderless(Some(handle)) => Self::Borderless(Some(handle.inner)),
+            RootFullscreen::Borderless(None) => Self::Borderless(None),
+        }
+    }
+}
+
+impl From<Fullscreen> for RootFullscreen {
+    fn from(f: Fullscreen) -> Self {
+        match f {
+            Fullscreen::Exclusive(video_mode) => {
+                Self::Exclusive(RootVideoModeHandle { video_mode })
+            },
+            Fullscreen::Borderless(Some(inner)) => {
+                Self::Borderless(Some(RootMonitorHandle { inner }))
+            },
+            Fullscreen::Borderless(None) => Self::Borderless(None),
+        }
+    }
+}
+
+#[cfg(all(
+    not(ios_platform),
+    not(windows_platform),
+    not(macos_platform),
+    not(android_platform),
+    not(x11_platform),
+    not(wayland_platform),
+    not(web_platform),
+    not(orbital_platform),
+))]
+compile_error!("The platform you're compiling for is not supported by winit");
diff --git a/vendor/winit/src/platform_impl/orbital/event_loop.rs b/vendor/winit/src/platform_impl/orbital/event_loop.rs
new file mode 100644
index 00000000..91f76e75
--- /dev/null
+++ b/vendor/winit/src/platform_impl/orbital/event_loop.rs
@@ -0,0 +1,829 @@
+use std::cell::Cell;
+use std::collections::VecDeque;
+use std::marker::PhantomData;
+use std::sync::{mpsc, Arc, Mutex};
+use std::time::Instant;
+use std::{mem, slice};
+
+use bitflags::bitflags;
+use orbclient::{
+    ButtonEvent, EventOption, FocusEvent, HoverEvent, KeyEvent, MouseEvent, MouseRelativeEvent,
+    MoveEvent, QuitEvent, ResizeEvent, ScrollEvent, TextInputEvent,
+};
+use smol_str::SmolStr;
+
+use crate::error::EventLoopError;
+use crate::event::{self, Ime, Modifiers, StartCause};
+use crate::event_loop::{self, ControlFlow, DeviceEvents};
+use crate::keyboard::{
+    Key, KeyCode, KeyLocation, ModifiersKeys, ModifiersState, NamedKey, NativeKey, NativeKeyCode,
+    PhysicalKey,
+};
+use crate::window::{
+    CustomCursor as RootCustomCursor, CustomCursorSource, Theme, WindowId as RootWindowId,
+};
+
+use super::{
+    DeviceId, KeyEventExtra, MonitorHandle, OsError, PlatformSpecificEventLoopAttributes,
+    RedoxSocket, TimeSocket, WindowId, WindowProperties,
+};
+
+fn convert_scancode(scancode: u8) -> (PhysicalKey, Option<NamedKey>) {
+    // Key constants from https://docs.rs/orbclient/latest/orbclient/event/index.html
+    let (key_code, named_key_opt) = match scancode {
+        orbclient::K_A => (KeyCode::KeyA, None),
+        orbclient::K_B => (KeyCode::KeyB, None),
+        orbclient::K_C => (KeyCode::KeyC, None),
+        orbclient::K_D => (KeyCode::KeyD, None),
+        orbclient::K_E => (KeyCode::KeyE, None),
+        orbclient::K_F => (KeyCode::KeyF, None),
+        orbclient::K_G => (KeyCode::KeyG, None),
+        orbclient::K_H => (KeyCode::KeyH, None),
+        orbclient::K_I => (KeyCode::KeyI, None),
+        orbclient::K_J => (KeyCode::KeyJ, None),
+        orbclient::K_K => (KeyCode::KeyK, None),
+        orbclient::K_L => (KeyCode::KeyL, None),
+        orbclient::K_M => (KeyCode::KeyM, None),
+        orbclient::K_N => (KeyCode::KeyN, None),
+        orbclient::K_O => (KeyCode::KeyO, None),
+        orbclient::K_P => (KeyCode::KeyP, None),
+        orbclient::K_Q => (KeyCode::KeyQ, None),
+        orbclient::K_R => (KeyCode::KeyR, None),
+        orbclient::K_S => (KeyCode::KeyS, None),
+        orbclient::K_T => (KeyCode::KeyT, None),
+        orbclient::K_U => (KeyCode::KeyU, None),
+        orbclient::K_V => (KeyCode::KeyV, None),
+        orbclient::K_W => (KeyCode::KeyW, None),
+        orbclient::K_X => (KeyCode::KeyX, None),
+        orbclient::K_Y => (KeyCode::KeyY, None),
+        orbclient::K_Z => (KeyCode::KeyZ, None),
+        orbclient::K_0 => (KeyCode::Digit0, None),
+        orbclient::K_1 => (KeyCode::Digit1, None),
+        orbclient::K_2 => (KeyCode::Digit2, None),
+        orbclient::K_3 => (KeyCode::Digit3, None),
+        orbclient::K_4 => (KeyCode::Digit4, None),
+        orbclient::K_5 => (KeyCode::Digit5, None),
+        orbclient::K_6 => (KeyCode::Digit6, None),
+        orbclient::K_7 => (KeyCode::Digit7, None),
+        orbclient::K_8 => (KeyCode::Digit8, None),
+        orbclient::K_9 => (KeyCode::Digit9, None),
+
+        orbclient::K_ALT => (KeyCode::AltLeft, Some(NamedKey::Alt)),
+        orbclient::K_ALT_GR => (KeyCode::AltRight, Some(NamedKey::AltGraph)),
+        orbclient::K_BACKSLASH => (KeyCode::Backslash, None),
+        orbclient::K_BKSP => (KeyCode::Backspace, Some(NamedKey::Backspace)),
+        orbclient::K_BRACE_CLOSE => (KeyCode::BracketRight, None),
+        orbclient::K_BRACE_OPEN => (KeyCode::BracketLeft, None),
+        orbclient::K_CAPS => (KeyCode::CapsLock, Some(NamedKey::CapsLock)),
+        orbclient::K_COMMA => (KeyCode::Comma, None),
+        orbclient::K_CTRL => (KeyCode::ControlLeft, Some(NamedKey::Control)),
+        orbclient::K_DEL => (KeyCode::Delete, Some(NamedKey::Delete)),
+        orbclient::K_DOWN => (KeyCode::ArrowDown, Some(NamedKey::ArrowDown)),
+        orbclient::K_END => (KeyCode::End, Some(NamedKey::End)),
+        orbclient::K_ENTER => (KeyCode::Enter, Some(NamedKey::Enter)),
+        orbclient::K_EQUALS => (KeyCode::Equal, None),
+        orbclient::K_ESC => (KeyCode::Escape, Some(NamedKey::Escape)),
+        orbclient::K_F1 => (KeyCode::F1, Some(NamedKey::F1)),
+        orbclient::K_F2 => (KeyCode::F2, Some(NamedKey::F2)),
+        orbclient::K_F3 => (KeyCode::F3, Some(NamedKey::F3)),
+        orbclient::K_F4 => (KeyCode::F4, Some(NamedKey::F4)),
+        orbclient::K_F5 => (KeyCode::F5, Some(NamedKey::F5)),
+        orbclient::K_F6 => (KeyCode::F6, Some(NamedKey::F6)),
+        orbclient::K_F7 => (KeyCode::F7, Some(NamedKey::F7)),
+        orbclient::K_F8 => (KeyCode::F8, Some(NamedKey::F8)),
+        orbclient::K_F9 => (KeyCode::F9, Some(NamedKey::F9)),
+        orbclient::K_F10 => (KeyCode::F10, Some(NamedKey::F10)),
+        orbclient::K_F11 => (KeyCode::F11, Some(NamedKey::F11)),
+        orbclient::K_F12 => (KeyCode::F12, Some(NamedKey::F12)),
+        orbclient::K_HOME => (KeyCode::Home, Some(NamedKey::Home)),
+        orbclient::K_LEFT => (KeyCode::ArrowLeft, Some(NamedKey::ArrowLeft)),
+        orbclient::K_LEFT_SHIFT => (KeyCode::ShiftLeft, Some(NamedKey::Shift)),
+        orbclient::K_MINUS => (KeyCode::Minus, None),
+        orbclient::K_NUM_0 => (KeyCode::Numpad0, None),
+        orbclient::K_NUM_1 => (KeyCode::Numpad1, None),
+        orbclient::K_NUM_2 => (KeyCode::Numpad2, None),
+        orbclient::K_NUM_3 => (KeyCode::Numpad3, None),
+        orbclient::K_NUM_4 => (KeyCode::Numpad4, None),
+        orbclient::K_NUM_5 => (KeyCode::Numpad5, None),
+        orbclient::K_NUM_6 => (KeyCode::Numpad6, None),
+        orbclient::K_NUM_7 => (KeyCode::Numpad7, None),
+        orbclient::K_NUM_8 => (KeyCode::Numpad8, None),
+        orbclient::K_NUM_9 => (KeyCode::Numpad9, None),
+        orbclient::K_PERIOD => (KeyCode::Period, None),
+        orbclient::K_PGDN => (KeyCode::PageDown, Some(NamedKey::PageDown)),
+        orbclient::K_PGUP => (KeyCode::PageUp, Some(NamedKey::PageUp)),
+        orbclient::K_QUOTE => (KeyCode::Quote, None),
+        orbclient::K_RIGHT => (KeyCode::ArrowRight, Some(NamedKey::ArrowRight)),
+        orbclient::K_RIGHT_SHIFT => (KeyCode::ShiftRight, Some(NamedKey::Shift)),
+        orbclient::K_SEMICOLON => (KeyCode::Semicolon, None),
+        orbclient::K_SLASH => (KeyCode::Slash, None),
+        orbclient::K_SPACE => (KeyCode::Space, Some(NamedKey::Space)),
+        orbclient::K_SUPER => (KeyCode::SuperLeft, Some(NamedKey::Super)),
+        orbclient::K_TAB => (KeyCode::Tab, Some(NamedKey::Tab)),
+        orbclient::K_TICK => (KeyCode::Backquote, None),
+        orbclient::K_UP => (KeyCode::ArrowUp, Some(NamedKey::ArrowUp)),
+        orbclient::K_VOLUME_DOWN => (KeyCode::AudioVolumeDown, Some(NamedKey::AudioVolumeDown)),
+        orbclient::K_VOLUME_TOGGLE => (KeyCode::AudioVolumeMute, Some(NamedKey::AudioVolumeMute)),
+        orbclient::K_VOLUME_UP => (KeyCode::AudioVolumeUp, Some(NamedKey::AudioVolumeUp)),
+
+        _ => return (PhysicalKey::Unidentified(NativeKeyCode::Unidentified), None),
+    };
+    (PhysicalKey::Code(key_code), named_key_opt)
+}
+
+fn element_state(pressed: bool) -> event::ElementState {
+    if pressed {
+        event::ElementState::Pressed
+    } else {
+        event::ElementState::Released
+    }
+}
+
+bitflags! {
+    #[derive(Default, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    struct KeyboardModifierState: u8 {
+        const LSHIFT = 1 << 0;
+        const RSHIFT = 1 << 1;
+        const LCTRL = 1 << 2;
+        const RCTRL = 1 << 3;
+        const LALT = 1 << 4;
+        const RALT = 1 << 5;
+        const LSUPER = 1 << 6;
+        const RSUPER = 1 << 7;
+    }
+}
+
+bitflags! {
+    #[derive(Default, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    struct MouseButtonState: u8 {
+        const LEFT = 1 << 0;
+        const MIDDLE = 1 << 1;
+        const RIGHT = 1 << 2;
+    }
+}
+
+#[derive(Default)]
+struct EventState {
+    keyboard: KeyboardModifierState,
+    mouse: MouseButtonState,
+    resize_opt: Option<(u32, u32)>,
+}
+
+impl EventState {
+    fn character_all_modifiers(&self, character: char) -> char {
+        // Modify character if Ctrl is pressed
+        #[allow(clippy::collapsible_if)]
+        if self.keyboard.contains(KeyboardModifierState::LCTRL)
+            || self.keyboard.contains(KeyboardModifierState::RCTRL)
+        {
+            if character.is_ascii_lowercase() {
+                return ((character as u8 - b'a') + 1) as char;
+            }
+            // TODO: more control key variants?
+        }
+
+        // Return character as-is if no special handling required
+        character
+    }
+
+    fn key(&mut self, key: PhysicalKey, pressed: bool) {
+        let code = match key {
+            PhysicalKey::Code(code) => code,
+            _ => return,
+        };
+
+        match code {
+            KeyCode::ShiftLeft => self.keyboard.set(KeyboardModifierState::LSHIFT, pressed),
+            KeyCode::ShiftRight => self.keyboard.set(KeyboardModifierState::RSHIFT, pressed),
+            KeyCode::ControlLeft => self.keyboard.set(KeyboardModifierState::LCTRL, pressed),
+            KeyCode::ControlRight => self.keyboard.set(KeyboardModifierState::RCTRL, pressed),
+            KeyCode::AltLeft => self.keyboard.set(KeyboardModifierState::LALT, pressed),
+            KeyCode::AltRight => self.keyboard.set(KeyboardModifierState::RALT, pressed),
+            KeyCode::SuperLeft => self.keyboard.set(KeyboardModifierState::LSUPER, pressed),
+            KeyCode::SuperRight => self.keyboard.set(KeyboardModifierState::RSUPER, pressed),
+            _ => (),
+        }
+    }
+
+    fn mouse(
+        &mut self,
+        left: bool,
+        middle: bool,
+        right: bool,
+    ) -> Option<(event::MouseButton, event::ElementState)> {
+        if self.mouse.contains(MouseButtonState::LEFT) != left {
+            self.mouse.set(MouseButtonState::LEFT, left);
+            return Some((event::MouseButton::Left, element_state(left)));
+        }
+
+        if self.mouse.contains(MouseButtonState::MIDDLE) != middle {
+            self.mouse.set(MouseButtonState::MIDDLE, middle);
+            return Some((event::MouseButton::Middle, element_state(middle)));
+        }
+
+        if self.mouse.contains(MouseButtonState::RIGHT) != right {
+            self.mouse.set(MouseButtonState::RIGHT, right);
+            return Some((event::MouseButton::Right, element_state(right)));
+        }
+
+        None
+    }
+
+    fn modifiers(&self) -> Modifiers {
+        let mut state = ModifiersState::empty();
+        let mut pressed_mods = ModifiersKeys::empty();
+
+        if self.keyboard.intersects(KeyboardModifierState::LSHIFT | KeyboardModifierState::RSHIFT) {
+            state |= ModifiersState::SHIFT;
+        }
+
+        pressed_mods
+            .set(ModifiersKeys::LSHIFT, self.keyboard.contains(KeyboardModifierState::LSHIFT));
+        pressed_mods
+            .set(ModifiersKeys::RSHIFT, self.keyboard.contains(KeyboardModifierState::RSHIFT));
+
+        if self.keyboard.intersects(KeyboardModifierState::LCTRL | KeyboardModifierState::RCTRL) {
+            state |= ModifiersState::CONTROL;
+        }
+
+        pressed_mods
+            .set(ModifiersKeys::LCONTROL, self.keyboard.contains(KeyboardModifierState::LCTRL));
+        pressed_mods
+            .set(ModifiersKeys::RCONTROL, self.keyboard.contains(KeyboardModifierState::RCTRL));
+
+        if self.keyboard.intersects(KeyboardModifierState::LALT | KeyboardModifierState::RALT) {
+            state |= ModifiersState::ALT;
+        }
+
+        pressed_mods.set(ModifiersKeys::LALT, self.keyboard.contains(KeyboardModifierState::LALT));
+        pressed_mods.set(ModifiersKeys::RALT, self.keyboard.contains(KeyboardModifierState::RALT));
+
+        if self.keyboard.intersects(KeyboardModifierState::LSUPER | KeyboardModifierState::RSUPER) {
+            state |= ModifiersState::SUPER
+        }
+
+        pressed_mods
+            .set(ModifiersKeys::LSUPER, self.keyboard.contains(KeyboardModifierState::LSUPER));
+        pressed_mods
+            .set(ModifiersKeys::RSUPER, self.keyboard.contains(KeyboardModifierState::RSUPER));
+
+        Modifiers { state, pressed_mods }
+    }
+}
+
+pub struct EventLoop<T> {
+    windows: Vec<(Arc<RedoxSocket>, EventState)>,
+    window_target: event_loop::ActiveEventLoop,
+    user_events_sender: mpsc::Sender<T>,
+    user_events_receiver: mpsc::Receiver<T>,
+}
+
+impl<T: 'static> EventLoop<T> {
+    pub(crate) fn new(_: &PlatformSpecificEventLoopAttributes) -> Result<Self, EventLoopError> {
+        let (user_events_sender, user_events_receiver) = mpsc::channel();
+
+        let event_socket = Arc::new(
+            RedoxSocket::event()
+                .map_err(OsError::new)
+                .map_err(|error| EventLoopError::Os(os_error!(error)))?,
+        );
+
+        let wake_socket = Arc::new(
+            TimeSocket::open()
+                .map_err(OsError::new)
+                .map_err(|error| EventLoopError::Os(os_error!(error)))?,
+        );
+
+        event_socket
+            .write(&syscall::Event {
+                id: wake_socket.0.fd,
+                flags: syscall::EventFlags::EVENT_READ,
+                data: wake_socket.0.fd,
+            })
+            .map_err(OsError::new)
+            .map_err(|error| EventLoopError::Os(os_error!(error)))?;
+
+        Ok(Self {
+            windows: Vec::new(),
+            window_target: event_loop::ActiveEventLoop {
+                p: ActiveEventLoop {
+                    control_flow: Cell::new(ControlFlow::default()),
+                    exit: Cell::new(false),
+                    creates: Mutex::new(VecDeque::new()),
+                    redraws: Arc::new(Mutex::new(VecDeque::new())),
+                    destroys: Arc::new(Mutex::new(VecDeque::new())),
+                    event_socket,
+                    wake_socket,
+                },
+                _marker: PhantomData,
+            },
+            user_events_sender,
+            user_events_receiver,
+        })
+    }
+
+    fn process_event<F>(
+        window_id: WindowId,
+        event_option: EventOption,
+        event_state: &mut EventState,
+        mut event_handler: F,
+    ) where
+        F: FnMut(event::Event<T>),
+    {
+        match event_option {
+            EventOption::Key(KeyEvent { character, scancode, pressed }) => {
+                // Convert scancode
+                let (physical_key, named_key_opt) = convert_scancode(scancode);
+
+                // Get previous modifiers and update modifiers based on physical key
+                let modifiers_before = event_state.keyboard;
+                event_state.key(physical_key, pressed);
+
+                // Default to unidentified key with no text
+                let mut logical_key = Key::Unidentified(NativeKey::Unidentified);
+                let mut key_without_modifiers = logical_key.clone();
+                let mut text = None;
+                let mut text_with_all_modifiers = None;
+
+                // Set key and text based on character
+                if character != '\0' {
+                    let mut tmp = [0u8; 4];
+                    let character_str = character.encode_utf8(&mut tmp);
+                    // The key with Shift and Caps Lock applied (but not Ctrl)
+                    logical_key = Key::Character(character_str.into());
+                    // The key without Shift or Caps Lock applied
+                    key_without_modifiers =
+                        Key::Character(SmolStr::from_iter(character.to_lowercase()));
+                    if pressed {
+                        // The key with Shift and Caps Lock applied (but not Ctrl)
+                        text = Some(character_str.into());
+                        // The key with Shift, Caps Lock, and Ctrl applied
+                        let character_all_modifiers =
+                            event_state.character_all_modifiers(character);
+                        text_with_all_modifiers =
+                            Some(character_all_modifiers.encode_utf8(&mut tmp).into())
+                    }
+                };
+
+                // Override key if a named key was found (this is to allow Enter to replace '\n')
+                if let Some(named_key) = named_key_opt {
+                    logical_key = Key::Named(named_key);
+                    key_without_modifiers = logical_key.clone();
+                }
+
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::KeyboardInput {
+                        device_id: event::DeviceId(DeviceId),
+                        event: event::KeyEvent {
+                            logical_key,
+                            physical_key,
+                            location: KeyLocation::Standard,
+                            state: element_state(pressed),
+                            repeat: false,
+                            text,
+                            platform_specific: KeyEventExtra {
+                                key_without_modifiers,
+                                text_with_all_modifiers,
+                            },
+                        },
+                        is_synthetic: false,
+                    },
+                });
+
+                // If the state of the modifiers has changed, send the event.
+                if modifiers_before != event_state.keyboard {
+                    event_handler(event::Event::WindowEvent {
+                        window_id: RootWindowId(window_id),
+                        event: event::WindowEvent::ModifiersChanged(event_state.modifiers()),
+                    })
+                }
+            },
+            EventOption::TextInput(TextInputEvent { character }) => {
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::Ime(Ime::Preedit("".into(), None)),
+                });
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::Ime(Ime::Commit(character.into())),
+                });
+            },
+            EventOption::Mouse(MouseEvent { x, y }) => {
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::CursorMoved {
+                        device_id: event::DeviceId(DeviceId),
+                        position: (x, y).into(),
+                    },
+                });
+            },
+            EventOption::MouseRelative(MouseRelativeEvent { dx, dy }) => {
+                event_handler(event::Event::DeviceEvent {
+                    device_id: event::DeviceId(DeviceId),
+                    event: event::DeviceEvent::MouseMotion { delta: (dx as f64, dy as f64) },
+                });
+            },
+            EventOption::Button(ButtonEvent { left, middle, right }) => {
+                while let Some((button, state)) = event_state.mouse(left, middle, right) {
+                    event_handler(event::Event::WindowEvent {
+                        window_id: RootWindowId(window_id),
+                        event: event::WindowEvent::MouseInput {
+                            device_id: event::DeviceId(DeviceId),
+                            state,
+                            button,
+                        },
+                    });
+                }
+            },
+            EventOption::Scroll(ScrollEvent { x, y }) => {
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::MouseWheel {
+                        device_id: event::DeviceId(DeviceId),
+                        delta: event::MouseScrollDelta::LineDelta(x as f32, y as f32),
+                        phase: event::TouchPhase::Moved,
+                    },
+                });
+            },
+            EventOption::Quit(QuitEvent {}) => {
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::CloseRequested,
+                });
+            },
+            EventOption::Focus(FocusEvent { focused }) => {
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::Focused(focused),
+                });
+            },
+            EventOption::Move(MoveEvent { x, y }) => {
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::Moved((x, y).into()),
+                });
+            },
+            EventOption::Resize(ResizeEvent { width, height }) => {
+                event_handler(event::Event::WindowEvent {
+                    window_id: RootWindowId(window_id),
+                    event: event::WindowEvent::Resized((width, height).into()),
+                });
+
+                // Acknowledge resize after event loop.
+                event_state.resize_opt = Some((width, height));
+            },
+            // TODO: Screen, Clipboard, Drop
+            EventOption::Hover(HoverEvent { entered }) => {
+                if entered {
+                    event_handler(event::Event::WindowEvent {
+                        window_id: RootWindowId(window_id),
+                        event: event::WindowEvent::CursorEntered {
+                            device_id: event::DeviceId(DeviceId),
+                        },
+                    });
+                } else {
+                    event_handler(event::Event::WindowEvent {
+                        window_id: RootWindowId(window_id),
+                        event: event::WindowEvent::CursorLeft {
+                            device_id: event::DeviceId(DeviceId),
+                        },
+                    });
+                }
+            },
+            other => {
+                tracing::warn!("unhandled event: {:?}", other);
+            },
+        }
+    }
+
+    pub fn run<F>(mut self, mut event_handler_inner: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(event::Event<T>, &event_loop::ActiveEventLoop),
+    {
+        let mut event_handler =
+            move |event: event::Event<T>, window_target: &event_loop::ActiveEventLoop| {
+                event_handler_inner(event, window_target);
+            };
+
+        let mut start_cause = StartCause::Init;
+
+        loop {
+            event_handler(event::Event::NewEvents(start_cause), &self.window_target);
+
+            if start_cause == StartCause::Init {
+                event_handler(event::Event::Resumed, &self.window_target);
+            }
+
+            // Handle window creates.
+            while let Some(window) = {
+                let mut creates = self.window_target.p.creates.lock().unwrap();
+                creates.pop_front()
+            } {
+                let window_id = WindowId { fd: window.fd as u64 };
+
+                let mut buf: [u8; 4096] = [0; 4096];
+                let path = window.fpath(&mut buf).expect("failed to read properties");
+                let properties = WindowProperties::new(path);
+
+                self.windows.push((window, EventState::default()));
+
+                // Send resize event on create to indicate first size.
+                event_handler(
+                    event::Event::WindowEvent {
+                        window_id: RootWindowId(window_id),
+                        event: event::WindowEvent::Resized((properties.w, properties.h).into()),
+                    },
+                    &self.window_target,
+                );
+
+                // Send resize event on create to indicate first position.
+                event_handler(
+                    event::Event::WindowEvent {
+                        window_id: RootWindowId(window_id),
+                        event: event::WindowEvent::Moved((properties.x, properties.y).into()),
+                    },
+                    &self.window_target,
+                );
+            }
+
+            // Handle window destroys.
+            while let Some(destroy_id) = {
+                let mut destroys = self.window_target.p.destroys.lock().unwrap();
+                destroys.pop_front()
+            } {
+                event_handler(
+                    event::Event::WindowEvent {
+                        window_id: RootWindowId(destroy_id),
+                        event: event::WindowEvent::Destroyed,
+                    },
+                    &self.window_target,
+                );
+
+                self.windows.retain(|(window, _event_state)| window.fd as u64 != destroy_id.fd);
+            }
+
+            // Handle window events.
+            let mut i = 0;
+            // While loop is used here because the same window may be processed more than once.
+            while let Some((window, event_state)) = self.windows.get_mut(i) {
+                let window_id = WindowId { fd: window.fd as u64 };
+
+                let mut event_buf = [0u8; 16 * mem::size_of::<orbclient::Event>()];
+                let count =
+                    syscall::read(window.fd, &mut event_buf).expect("failed to read window events");
+                // Safety: orbclient::Event is a packed struct designed to be transferred over a
+                // socket.
+                let events = unsafe {
+                    slice::from_raw_parts(
+                        event_buf.as_ptr() as *const orbclient::Event,
+                        count / mem::size_of::<orbclient::Event>(),
+                    )
+                };
+
+                for orbital_event in events {
+                    Self::process_event(
+                        window_id,
+                        orbital_event.to_option(),
+                        event_state,
+                        |event| event_handler(event, &self.window_target),
+                    );
+                }
+
+                if count == event_buf.len() {
+                    // If event buf was full, process same window again to ensure all events are
+                    // drained.
+                    continue;
+                }
+
+                // Acknowledge the latest resize event.
+                if let Some((w, h)) = event_state.resize_opt.take() {
+                    window
+                        .write(format!("S,{w},{h}").as_bytes())
+                        .expect("failed to acknowledge resize");
+
+                    // Require redraw after resize.
+                    let mut redraws = self.window_target.p.redraws.lock().unwrap();
+                    if !redraws.contains(&window_id) {
+                        redraws.push_back(window_id);
+                    }
+                }
+
+                // Move to next window.
+                i += 1;
+            }
+
+            while let Ok(event) = self.user_events_receiver.try_recv() {
+                event_handler(event::Event::UserEvent(event), &self.window_target);
+            }
+
+            // To avoid deadlocks the redraws lock is not held during event processing.
+            while let Some(window_id) = {
+                let mut redraws = self.window_target.p.redraws.lock().unwrap();
+                redraws.pop_front()
+            } {
+                event_handler(
+                    event::Event::WindowEvent {
+                        window_id: RootWindowId(window_id),
+                        event: event::WindowEvent::RedrawRequested,
+                    },
+                    &self.window_target,
+                );
+            }
+
+            event_handler(event::Event::AboutToWait, &self.window_target);
+
+            if self.window_target.p.exiting() {
+                break;
+            }
+
+            let requested_resume = match self.window_target.p.control_flow() {
+                ControlFlow::Poll => {
+                    start_cause = StartCause::Poll;
+                    continue;
+                },
+                ControlFlow::Wait => None,
+                ControlFlow::WaitUntil(instant) => Some(instant),
+            };
+
+            // Re-using wake socket caused extra wake events before because there were leftover
+            // timeouts, and then new timeouts were added each time a spurious timeout expired.
+            let timeout_socket = TimeSocket::open().unwrap();
+
+            self.window_target
+                .p
+                .event_socket
+                .write(&syscall::Event {
+                    id: timeout_socket.0.fd,
+                    flags: syscall::EventFlags::EVENT_READ,
+                    data: 0,
+                })
+                .unwrap();
+
+            let start = Instant::now();
+            if let Some(instant) = requested_resume {
+                let mut time = timeout_socket.current_time().unwrap();
+
+                if let Some(duration) = instant.checked_duration_since(start) {
+                    time.tv_sec += duration.as_secs() as i64;
+                    time.tv_nsec += duration.subsec_nanos() as i32;
+                    // Normalize timespec so tv_nsec is not greater than one second.
+                    while time.tv_nsec >= 1_000_000_000 {
+                        time.tv_sec += 1;
+                        time.tv_nsec -= 1_000_000_000;
+                    }
+                }
+
+                timeout_socket.timeout(&time).unwrap();
+            }
+
+            // Wait for event if needed.
+            let mut event = syscall::Event::default();
+            self.window_target.p.event_socket.read(&mut event).unwrap();
+
+            // TODO: handle spurious wakeups (redraw caused wakeup but redraw already handled)
+            match requested_resume {
+                Some(requested_resume) if event.id == timeout_socket.0.fd => {
+                    // If the event is from the special timeout socket, report that resume
+                    // time was reached.
+                    start_cause = StartCause::ResumeTimeReached { start, requested_resume };
+                },
+                _ => {
+                    // Normal window event or spurious timeout.
+                    start_cause = StartCause::WaitCancelled { start, requested_resume };
+                },
+            }
+        }
+
+        event_handler(event::Event::LoopExiting, &self.window_target);
+
+        Ok(())
+    }
+
+    pub fn window_target(&self) -> &event_loop::ActiveEventLoop {
+        &self.window_target
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy {
+            user_events_sender: self.user_events_sender.clone(),
+            wake_socket: self.window_target.p.wake_socket.clone(),
+        }
+    }
+}
+
+pub struct EventLoopProxy<T: 'static> {
+    user_events_sender: mpsc::Sender<T>,
+    wake_socket: Arc<TimeSocket>,
+}
+
+impl<T> EventLoopProxy<T> {
+    pub fn send_event(&self, event: T) -> Result<(), event_loop::EventLoopClosed<T>> {
+        self.user_events_sender
+            .send(event)
+            .map_err(|mpsc::SendError(x)| event_loop::EventLoopClosed(x))?;
+
+        self.wake_socket.wake().unwrap();
+
+        Ok(())
+    }
+}
+
+impl<T> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        Self {
+            user_events_sender: self.user_events_sender.clone(),
+            wake_socket: self.wake_socket.clone(),
+        }
+    }
+}
+
+impl<T> Unpin for EventLoopProxy<T> {}
+
+pub struct ActiveEventLoop {
+    control_flow: Cell<ControlFlow>,
+    exit: Cell<bool>,
+    pub(super) creates: Mutex<VecDeque<Arc<RedoxSocket>>>,
+    pub(super) redraws: Arc<Mutex<VecDeque<WindowId>>>,
+    pub(super) destroys: Arc<Mutex<VecDeque<WindowId>>>,
+    pub(super) event_socket: Arc<RedoxSocket>,
+    pub(super) wake_socket: Arc<TimeSocket>,
+}
+
+impl ActiveEventLoop {
+    pub fn create_custom_cursor(&self, source: CustomCursorSource) -> RootCustomCursor {
+        let _ = source.inner;
+        RootCustomCursor { inner: super::PlatformCustomCursor }
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        Some(MonitorHandle)
+    }
+
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        let mut v = VecDeque::with_capacity(1);
+        v.push_back(MonitorHandle);
+        v
+    }
+
+    #[inline]
+    pub fn listen_device_events(&self, _allowed: DeviceEvents) {}
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Orbital(rwh_05::OrbitalDisplayHandle::empty())
+    }
+
+    #[inline]
+    pub fn system_theme(&self) -> Option<Theme> {
+        None
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Orbital(rwh_06::OrbitalDisplayHandle::new()))
+    }
+
+    pub fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.control_flow.set(control_flow)
+    }
+
+    pub fn control_flow(&self) -> ControlFlow {
+        self.control_flow.get()
+    }
+
+    pub(crate) fn exit(&self) {
+        self.exit.set(true);
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.exit.get()
+    }
+
+    pub(crate) fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct OwnedDisplayHandle;
+
+impl OwnedDisplayHandle {
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::OrbitalDisplayHandle::empty().into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::OrbitalDisplayHandle::new().into())
+    }
+}
diff --git a/vendor/winit/src/platform_impl/orbital/mod.rs b/vendor/winit/src/platform_impl/orbital/mod.rs
new file mode 100644
index 00000000..2d152513
--- /dev/null
+++ b/vendor/winit/src/platform_impl/orbital/mod.rs
@@ -0,0 +1,255 @@
+#![cfg(target_os = "redox")]
+
+use std::fmt::{self, Display, Formatter};
+use std::str;
+use std::sync::Arc;
+
+use smol_str::SmolStr;
+
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::keyboard::Key;
+
+pub(crate) use self::event_loop::{ActiveEventLoop, EventLoop, EventLoopProxy, OwnedDisplayHandle};
+mod event_loop;
+
+pub use self::window::Window;
+mod window;
+
+struct RedoxSocket {
+    fd: usize,
+}
+
+impl RedoxSocket {
+    fn event() -> syscall::Result<Self> {
+        Self::open_raw("event:")
+    }
+
+    fn orbital(properties: &WindowProperties<'_>) -> syscall::Result<Self> {
+        Self::open_raw(&format!("{properties}"))
+    }
+
+    // Paths should be checked to ensure they are actually sockets and not normal files. If a
+    // non-socket path is used, it could cause read and write to not function as expected. For
+    // example, the seek would change in a potentially unpredictable way if either read or write
+    // were called at the same time by multiple threads.
+    fn open_raw(path: &str) -> syscall::Result<Self> {
+        let fd = syscall::open(path, syscall::O_RDWR | syscall::O_CLOEXEC)?;
+        Ok(Self { fd })
+    }
+
+    fn read(&self, buf: &mut [u8]) -> syscall::Result<()> {
+        let count = syscall::read(self.fd, buf)?;
+        if count == buf.len() {
+            Ok(())
+        } else {
+            Err(syscall::Error::new(syscall::EINVAL))
+        }
+    }
+
+    fn write(&self, buf: &[u8]) -> syscall::Result<()> {
+        let count = syscall::write(self.fd, buf)?;
+        if count == buf.len() {
+            Ok(())
+        } else {
+            Err(syscall::Error::new(syscall::EINVAL))
+        }
+    }
+
+    fn fpath<'a>(&self, buf: &'a mut [u8]) -> syscall::Result<&'a str> {
+        let count = syscall::fpath(self.fd, buf)?;
+        str::from_utf8(&buf[..count]).map_err(|_err| syscall::Error::new(syscall::EINVAL))
+    }
+}
+
+impl Drop for RedoxSocket {
+    fn drop(&mut self) {
+        let _ = syscall::close(self.fd);
+    }
+}
+
+pub struct TimeSocket(RedoxSocket);
+
+impl TimeSocket {
+    fn open() -> syscall::Result<Self> {
+        RedoxSocket::open_raw("time:4").map(Self)
+    }
+
+    // Read current time.
+    fn current_time(&self) -> syscall::Result<syscall::TimeSpec> {
+        let mut timespec = syscall::TimeSpec::default();
+        self.0.read(&mut timespec)?;
+        Ok(timespec)
+    }
+
+    // Write a timeout.
+    fn timeout(&self, timespec: &syscall::TimeSpec) -> syscall::Result<()> {
+        self.0.write(timespec)
+    }
+
+    // Wake immediately.
+    fn wake(&self) -> syscall::Result<()> {
+        // Writing a default TimeSpec will always trigger a time event.
+        self.timeout(&syscall::TimeSpec::default())
+    }
+}
+
+#[derive(Default, Debug, Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) struct PlatformSpecificEventLoopAttributes {}
+
+#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct WindowId {
+    fd: u64,
+}
+
+impl WindowId {
+    pub const fn dummy() -> Self {
+        WindowId { fd: u64::MAX }
+    }
+}
+
+impl From<WindowId> for u64 {
+    fn from(id: WindowId) -> Self {
+        id.fd
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(fd: u64) -> Self {
+        Self { fd }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct DeviceId;
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        DeviceId
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct PlatformSpecificWindowAttributes;
+
+struct WindowProperties<'a> {
+    flags: &'a str,
+    x: i32,
+    y: i32,
+    w: u32,
+    h: u32,
+    title: &'a str,
+}
+
+impl<'a> WindowProperties<'a> {
+    fn new(path: &'a str) -> Self {
+        // orbital:flags/x/y/w/h/t
+        let mut parts = path.splitn(6, '/');
+        let flags = parts.next().unwrap_or("");
+        let x = parts.next().map_or(0, |part| part.parse::<i32>().unwrap_or(0));
+        let y = parts.next().map_or(0, |part| part.parse::<i32>().unwrap_or(0));
+        let w = parts.next().map_or(0, |part| part.parse::<u32>().unwrap_or(0));
+        let h = parts.next().map_or(0, |part| part.parse::<u32>().unwrap_or(0));
+        let title = parts.next().unwrap_or("");
+        Self { flags, x, y, w, h, title }
+    }
+}
+
+impl fmt::Display for WindowProperties<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "orbital:{}/{}/{}/{}/{}/{}",
+            self.flags, self.x, self.y, self.w, self.h, self.title
+        )
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct OsError(Arc<syscall::Error>);
+
+impl OsError {
+    fn new(error: syscall::Error) -> Self {
+        Self(Arc::new(error))
+    }
+}
+
+impl Display for OsError {
+    fn fmt(&self, fmt: &mut Formatter<'_>) -> Result<(), fmt::Error> {
+        self.0.fmt(fmt)
+    }
+}
+
+pub(crate) use crate::cursor::{
+    NoCustomCursor as PlatformCustomCursor, NoCustomCursor as PlatformCustomCursorSource,
+};
+pub(crate) use crate::icon::NoIcon as PlatformIcon;
+
+#[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct MonitorHandle;
+
+impl MonitorHandle {
+    pub fn name(&self) -> Option<String> {
+        Some("Redox Device".to_owned())
+    }
+
+    pub fn size(&self) -> PhysicalSize<u32> {
+        PhysicalSize::new(0, 0) // TODO
+    }
+
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        (0, 0).into()
+    }
+
+    pub fn scale_factor(&self) -> f64 {
+        1.0 // TODO
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        // FIXME no way to get real refresh rate for now.
+        None
+    }
+
+    pub fn video_modes(&self) -> impl Iterator<Item = VideoModeHandle> {
+        let size = self.size().into();
+        // FIXME this is not the real refresh rate
+        // (it is guaranteed to support 32 bit color though)
+        std::iter::once(VideoModeHandle {
+            size,
+            bit_depth: 32,
+            refresh_rate_millihertz: 60000,
+            monitor: self.clone(),
+        })
+    }
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+pub struct VideoModeHandle {
+    size: (u32, u32),
+    bit_depth: u16,
+    refresh_rate_millihertz: u32,
+    monitor: MonitorHandle,
+}
+
+impl VideoModeHandle {
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.size.into()
+    }
+
+    pub fn bit_depth(&self) -> u16 {
+        self.bit_depth
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.refresh_rate_millihertz
+    }
+
+    pub fn monitor(&self) -> MonitorHandle {
+        self.monitor.clone()
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub struct KeyEventExtra {
+    pub key_without_modifiers: Key,
+    pub text_with_all_modifiers: Option<SmolStr>,
+}
diff --git a/vendor/winit/src/platform_impl/orbital/window.rs b/vendor/winit/src/platform_impl/orbital/window.rs
new file mode 100644
index 00000000..3e676c36
--- /dev/null
+++ b/vendor/winit/src/platform_impl/orbital/window.rs
@@ -0,0 +1,509 @@
+use std::collections::VecDeque;
+use std::sync::{Arc, Mutex};
+
+use crate::cursor::Cursor;
+use crate::dpi::{PhysicalPosition, PhysicalSize, Position, Size};
+use crate::platform_impl::Fullscreen;
+use crate::window::ImePurpose;
+use crate::{error, window};
+
+use super::{
+    ActiveEventLoop, MonitorHandle, OsError, RedoxSocket, TimeSocket, WindowId, WindowProperties,
+};
+
+// These values match the values uses in the `window_new` function in orbital:
+// https://gitlab.redox-os.org/redox-os/orbital/-/blob/master/src/scheme.rs
+const ORBITAL_FLAG_ASYNC: char = 'a';
+const ORBITAL_FLAG_BACK: char = 'b';
+const ORBITAL_FLAG_FRONT: char = 'f';
+const ORBITAL_FLAG_HIDDEN: char = 'h';
+const ORBITAL_FLAG_BORDERLESS: char = 'l';
+const ORBITAL_FLAG_MAXIMIZED: char = 'm';
+const ORBITAL_FLAG_RESIZABLE: char = 'r';
+const ORBITAL_FLAG_TRANSPARENT: char = 't';
+
+pub struct Window {
+    window_socket: Arc<RedoxSocket>,
+    redraws: Arc<Mutex<VecDeque<WindowId>>>,
+    destroys: Arc<Mutex<VecDeque<WindowId>>>,
+    wake_socket: Arc<TimeSocket>,
+}
+
+impl Window {
+    pub(crate) fn new(
+        el: &ActiveEventLoop,
+        attrs: window::WindowAttributes,
+    ) -> Result<Self, error::OsError> {
+        let scale = MonitorHandle.scale_factor();
+
+        let (x, y) = if let Some(pos) = attrs.position {
+            pos.to_physical::<i32>(scale).into()
+        } else {
+            // These coordinates are a special value to center the window.
+            (-1, -1)
+        };
+
+        let (w, h): (u32, u32) = if let Some(size) = attrs.inner_size {
+            size.to_physical::<u32>(scale).into()
+        } else {
+            (1024, 768)
+        };
+
+        // TODO: min/max inner_size
+
+        // Async by default.
+        let mut flag_str = ORBITAL_FLAG_ASYNC.to_string();
+
+        if attrs.maximized {
+            flag_str.push(ORBITAL_FLAG_MAXIMIZED);
+        }
+
+        if attrs.resizable {
+            flag_str.push(ORBITAL_FLAG_RESIZABLE);
+        }
+
+        // TODO: fullscreen
+
+        if attrs.transparent {
+            flag_str.push(ORBITAL_FLAG_TRANSPARENT);
+        }
+
+        if !attrs.decorations {
+            flag_str.push(ORBITAL_FLAG_BORDERLESS);
+        }
+
+        if !attrs.visible {
+            flag_str.push(ORBITAL_FLAG_HIDDEN);
+        }
+
+        match attrs.window_level {
+            window::WindowLevel::AlwaysOnBottom => {
+                flag_str.push(ORBITAL_FLAG_BACK);
+            },
+            window::WindowLevel::Normal => {},
+            window::WindowLevel::AlwaysOnTop => {
+                flag_str.push(ORBITAL_FLAG_FRONT);
+            },
+        }
+
+        // TODO: window_icon
+
+        // Open window.
+        let window = RedoxSocket::orbital(&WindowProperties {
+            flags: &flag_str,
+            x,
+            y,
+            w,
+            h,
+            title: &attrs.title,
+        })
+        .expect("failed to open window");
+
+        // Add to event socket.
+        el.event_socket
+            .write(&syscall::Event {
+                id: window.fd,
+                flags: syscall::EventFlags::EVENT_READ,
+                data: window.fd,
+            })
+            .unwrap();
+
+        let window_socket = Arc::new(window);
+
+        // Notify event thread that this window was created, it will send some default events.
+        {
+            let mut creates = el.creates.lock().unwrap();
+            creates.push_back(window_socket.clone());
+        }
+
+        el.wake_socket.wake().unwrap();
+
+        Ok(Self {
+            window_socket,
+            redraws: el.redraws.clone(),
+            destroys: el.destroys.clone(),
+            wake_socket: el.wake_socket.clone(),
+        })
+    }
+
+    pub(crate) fn maybe_queue_on_main(&self, f: impl FnOnce(&Self) + Send + 'static) {
+        f(self)
+    }
+
+    pub(crate) fn maybe_wait_on_main<R: Send>(&self, f: impl FnOnce(&Self) -> R + Send) -> R {
+        f(self)
+    }
+
+    fn get_flag(&self, flag: char) -> Result<bool, error::ExternalError> {
+        let mut buf: [u8; 4096] = [0; 4096];
+        let path = self
+            .window_socket
+            .fpath(&mut buf)
+            .map_err(|err| error::ExternalError::Os(os_error!(OsError::new(err))))?;
+        let properties = WindowProperties::new(path);
+        Ok(properties.flags.contains(flag))
+    }
+
+    fn set_flag(&self, flag: char, value: bool) -> Result<(), error::ExternalError> {
+        self.window_socket
+            .write(format!("F,{flag},{}", if value { 1 } else { 0 }).as_bytes())
+            .map_err(|err| error::ExternalError::Os(os_error!(OsError::new(err))))?;
+        Ok(())
+    }
+
+    #[inline]
+    pub fn id(&self) -> WindowId {
+        WindowId { fd: self.window_socket.fd as u64 }
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        Some(MonitorHandle)
+    }
+
+    #[inline]
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        let mut v = VecDeque::with_capacity(1);
+        v.push_back(MonitorHandle);
+        v
+    }
+
+    #[inline]
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        Some(MonitorHandle)
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        MonitorHandle.scale_factor()
+    }
+
+    #[inline]
+    pub fn request_redraw(&self) {
+        let window_id = self.id();
+        let mut redraws = self.redraws.lock().unwrap();
+        if !redraws.contains(&window_id) {
+            redraws.push_back(window_id);
+
+            self.wake_socket.wake().unwrap();
+        }
+    }
+
+    #[inline]
+    pub fn pre_present_notify(&self) {}
+
+    #[inline]
+    pub fn reset_dead_keys(&self) {
+        // TODO?
+    }
+
+    #[inline]
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, error::NotSupportedError> {
+        let mut buf: [u8; 4096] = [0; 4096];
+        let path = self.window_socket.fpath(&mut buf).expect("failed to read properties");
+        let properties = WindowProperties::new(path);
+        Ok((properties.x, properties.y).into())
+    }
+
+    #[inline]
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, error::NotSupportedError> {
+        // TODO: adjust for window decorations
+        self.inner_position()
+    }
+
+    #[inline]
+    pub fn set_outer_position(&self, position: Position) {
+        // TODO: adjust for window decorations
+        let (x, y): (i32, i32) = position.to_physical::<i32>(self.scale_factor()).into();
+        self.window_socket.write(format!("P,{x},{y}").as_bytes()).expect("failed to set position");
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        let mut buf: [u8; 4096] = [0; 4096];
+        let path = self.window_socket.fpath(&mut buf).expect("failed to read properties");
+        let properties = WindowProperties::new(path);
+        (properties.w, properties.h).into()
+    }
+
+    #[inline]
+    pub fn request_inner_size(&self, size: Size) -> Option<PhysicalSize<u32>> {
+        let (w, h): (u32, u32) = size.to_physical::<u32>(self.scale_factor()).into();
+        self.window_socket.write(format!("S,{w},{h}").as_bytes()).expect("failed to set size");
+        None
+    }
+
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        // TODO: adjust for window decorations
+        self.inner_size()
+    }
+
+    #[inline]
+    pub fn set_min_inner_size(&self, _: Option<Size>) {}
+
+    #[inline]
+    pub fn set_max_inner_size(&self, _: Option<Size>) {}
+
+    #[inline]
+    pub fn title(&self) -> String {
+        let mut buf: [u8; 4096] = [0; 4096];
+        let path = self.window_socket.fpath(&mut buf).expect("failed to read properties");
+        let properties = WindowProperties::new(path);
+        properties.title.to_string()
+    }
+
+    #[inline]
+    pub fn set_title(&self, title: &str) {
+        self.window_socket.write(format!("T,{title}").as_bytes()).expect("failed to set title");
+    }
+
+    #[inline]
+    pub fn set_transparent(&self, transparent: bool) {
+        let _ = self.set_flag(ORBITAL_FLAG_TRANSPARENT, transparent);
+    }
+
+    #[inline]
+    pub fn set_blur(&self, _blur: bool) {}
+
+    #[inline]
+    pub fn set_visible(&self, visible: bool) {
+        let _ = self.set_flag(ORBITAL_FLAG_HIDDEN, !visible);
+    }
+
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        Some(!self.get_flag(ORBITAL_FLAG_HIDDEN).unwrap_or(false))
+    }
+
+    #[inline]
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        None
+    }
+
+    #[inline]
+    pub fn set_resize_increments(&self, _increments: Option<Size>) {}
+
+    #[inline]
+    pub fn set_resizable(&self, resizeable: bool) {
+        let _ = self.set_flag(ORBITAL_FLAG_RESIZABLE, resizeable);
+    }
+
+    #[inline]
+    pub fn is_resizable(&self) -> bool {
+        self.get_flag(ORBITAL_FLAG_RESIZABLE).unwrap_or(false)
+    }
+
+    #[inline]
+    pub fn set_minimized(&self, _minimized: bool) {}
+
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        None
+    }
+
+    #[inline]
+    pub fn set_maximized(&self, maximized: bool) {
+        let _ = self.set_flag(ORBITAL_FLAG_MAXIMIZED, maximized);
+    }
+
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        self.get_flag(ORBITAL_FLAG_MAXIMIZED).unwrap_or(false)
+    }
+
+    #[inline]
+    pub(crate) fn set_fullscreen(&self, _monitor: Option<Fullscreen>) {}
+
+    #[inline]
+    pub(crate) fn fullscreen(&self) -> Option<Fullscreen> {
+        None
+    }
+
+    #[inline]
+    pub fn set_decorations(&self, decorations: bool) {
+        let _ = self.set_flag(ORBITAL_FLAG_BORDERLESS, !decorations);
+    }
+
+    #[inline]
+    pub fn is_decorated(&self) -> bool {
+        !self.get_flag(ORBITAL_FLAG_BORDERLESS).unwrap_or(false)
+    }
+
+    #[inline]
+    pub fn set_window_level(&self, level: window::WindowLevel) {
+        match level {
+            window::WindowLevel::AlwaysOnBottom => {
+                let _ = self.set_flag(ORBITAL_FLAG_BACK, true);
+            },
+            window::WindowLevel::Normal => {
+                let _ = self.set_flag(ORBITAL_FLAG_BACK, false);
+                let _ = self.set_flag(ORBITAL_FLAG_FRONT, false);
+            },
+            window::WindowLevel::AlwaysOnTop => {
+                let _ = self.set_flag(ORBITAL_FLAG_FRONT, true);
+            },
+        }
+    }
+
+    #[inline]
+    pub fn set_window_icon(&self, _window_icon: Option<crate::icon::Icon>) {}
+
+    #[inline]
+    pub fn set_ime_cursor_area(&self, _position: Position, _size: Size) {}
+
+    #[inline]
+    pub fn set_ime_allowed(&self, _allowed: bool) {}
+
+    #[inline]
+    pub fn set_ime_purpose(&self, _purpose: ImePurpose) {}
+
+    #[inline]
+    pub fn focus_window(&self) {}
+
+    #[inline]
+    pub fn request_user_attention(&self, _request_type: Option<window::UserAttentionType>) {}
+
+    #[inline]
+    pub fn set_cursor(&self, _: Cursor) {}
+
+    #[inline]
+    pub fn set_cursor_position(&self, _: Position) -> Result<(), error::ExternalError> {
+        Err(error::ExternalError::NotSupported(error::NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn set_cursor_grab(
+        &self,
+        mode: window::CursorGrabMode,
+    ) -> Result<(), error::ExternalError> {
+        let (grab, relative) = match mode {
+            window::CursorGrabMode::None => (false, false),
+            window::CursorGrabMode::Confined => (true, false),
+            window::CursorGrabMode::Locked => (true, true),
+        };
+        self.window_socket
+            .write(format!("M,G,{}", if grab { 1 } else { 0 }).as_bytes())
+            .map_err(|err| error::ExternalError::Os(os_error!(OsError::new(err))))?;
+        self.window_socket
+            .write(format!("M,R,{}", if relative { 1 } else { 0 }).as_bytes())
+            .map_err(|err| error::ExternalError::Os(os_error!(OsError::new(err))))?;
+        Ok(())
+    }
+
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        let _ = self.window_socket.write(format!("M,C,{}", if visible { 1 } else { 0 }).as_bytes());
+    }
+
+    #[inline]
+    pub fn drag_window(&self) -> Result<(), error::ExternalError> {
+        self.window_socket
+            .write(b"D")
+            .map_err(|err| error::ExternalError::Os(os_error!(OsError::new(err))))?;
+        Ok(())
+    }
+
+    #[inline]
+    pub fn drag_resize_window(
+        &self,
+        direction: window::ResizeDirection,
+    ) -> Result<(), error::ExternalError> {
+        let arg = match direction {
+            window::ResizeDirection::East => "R",
+            window::ResizeDirection::North => "T",
+            window::ResizeDirection::NorthEast => "T,R",
+            window::ResizeDirection::NorthWest => "T,L",
+            window::ResizeDirection::South => "B",
+            window::ResizeDirection::SouthEast => "B,R",
+            window::ResizeDirection::SouthWest => "B,L",
+            window::ResizeDirection::West => "L",
+        };
+        self.window_socket
+            .write(format!("D,{arg}").as_bytes())
+            .map_err(|err| error::ExternalError::Os(os_error!(OsError::new(err))))?;
+        Ok(())
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, _position: Position) {}
+
+    #[inline]
+    pub fn set_cursor_hittest(&self, _hittest: bool) -> Result<(), error::ExternalError> {
+        Err(error::ExternalError::NotSupported(error::NotSupportedError::new()))
+    }
+
+    #[cfg(feature = "rwh_04")]
+    #[inline]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        let mut handle = rwh_04::OrbitalHandle::empty();
+        handle.window = self.window_socket.fd as *mut _;
+        rwh_04::RawWindowHandle::Orbital(handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        let mut handle = rwh_05::OrbitalWindowHandle::empty();
+        handle.window = self.window_socket.fd as *mut _;
+        rwh_05::RawWindowHandle::Orbital(handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Orbital(rwh_05::OrbitalDisplayHandle::empty())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_window_handle_rwh_06(&self) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        let handle = rwh_06::OrbitalWindowHandle::new({
+            let window = self.window_socket.fd as *mut _;
+            std::ptr::NonNull::new(window).expect("orbital fd should never be null")
+        });
+        Ok(rwh_06::RawWindowHandle::Orbital(handle))
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Orbital(rwh_06::OrbitalDisplayHandle::new()))
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, _buttons: window::WindowButtons) {}
+
+    #[inline]
+    pub fn enabled_buttons(&self) -> window::WindowButtons {
+        window::WindowButtons::all()
+    }
+
+    #[inline]
+    pub fn theme(&self) -> Option<window::Theme> {
+        None
+    }
+
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        false
+    }
+
+    #[inline]
+    pub fn set_theme(&self, _theme: Option<window::Theme>) {}
+
+    pub fn set_content_protected(&self, _protected: bool) {}
+}
+
+impl Drop for Window {
+    fn drop(&mut self) {
+        {
+            let mut destroys = self.destroys.lock().unwrap();
+            destroys.push_back(self.id());
+        }
+
+        self.wake_socket.wake().unwrap();
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/async/abortable.rs b/vendor/winit/src/platform_impl/web/async/abortable.rs
new file mode 100644
index 00000000..671ae879
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/abortable.rs
@@ -0,0 +1,96 @@
+use std::error::Error;
+use std::fmt::{self, Display, Formatter};
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::task::{Context, Poll};
+
+use pin_project::pin_project;
+
+use super::AtomicWaker;
+
+#[pin_project]
+pub struct Abortable<F: Future> {
+    #[pin]
+    future: F,
+    shared: Arc<Shared>,
+}
+
+impl<F: Future> Abortable<F> {
+    pub fn new(handle: AbortHandle, future: F) -> Self {
+        Self { future, shared: handle.0 }
+    }
+}
+
+impl<F: Future> Future for Abortable<F> {
+    type Output = Result<F::Output, Aborted>;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        if self.shared.aborted.load(Ordering::Relaxed) {
+            return Poll::Ready(Err(Aborted));
+        }
+
+        if let Poll::Ready(value) = self.as_mut().project().future.poll(cx) {
+            return Poll::Ready(Ok(value));
+        }
+
+        self.shared.waker.register(cx.waker());
+
+        if self.shared.aborted.load(Ordering::Relaxed) {
+            return Poll::Ready(Err(Aborted));
+        }
+
+        Poll::Pending
+    }
+}
+
+#[derive(Debug)]
+struct Shared {
+    waker: AtomicWaker,
+    aborted: AtomicBool,
+}
+
+#[derive(Clone, Debug)]
+pub struct AbortHandle(Arc<Shared>);
+
+impl AbortHandle {
+    pub fn new() -> Self {
+        Self(Arc::new(Shared { waker: AtomicWaker::new(), aborted: AtomicBool::new(false) }))
+    }
+
+    pub fn abort(&self) {
+        self.0.aborted.store(true, Ordering::Relaxed);
+        self.0.waker.wake()
+    }
+}
+
+#[derive(Debug)]
+pub struct DropAbortHandle(AbortHandle);
+
+impl DropAbortHandle {
+    pub fn new(handle: AbortHandle) -> Self {
+        Self(handle)
+    }
+
+    pub fn handle(&self) -> AbortHandle {
+        self.0.clone()
+    }
+}
+
+impl Drop for DropAbortHandle {
+    fn drop(&mut self) {
+        self.0.abort()
+    }
+}
+
+#[derive(Copy, Clone, Debug, Eq, Hash, PartialEq)]
+pub struct Aborted;
+
+impl Display for Aborted {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(f, "`Abortable` future has been aborted")
+    }
+}
+
+impl Error for Aborted {}
diff --git a/vendor/winit/src/platform_impl/web/async/atomic_waker.rs b/vendor/winit/src/platform_impl/web/async/atomic_waker.rs
new file mode 100644
index 00000000..87b83612
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/atomic_waker.rs
@@ -0,0 +1,35 @@
+use std::cell::RefCell;
+use std::ops::Deref;
+use std::task::Waker;
+
+#[derive(Debug)]
+pub struct AtomicWaker(RefCell<Option<Waker>>);
+
+impl AtomicWaker {
+    pub const fn new() -> Self {
+        Self(RefCell::new(None))
+    }
+
+    pub fn register(&self, waker: &Waker) {
+        let mut this = self.0.borrow_mut();
+
+        if let Some(old_waker) = this.deref() {
+            if old_waker.will_wake(waker) {
+                return;
+            }
+        }
+
+        *this = Some(waker.clone());
+    }
+
+    pub fn wake(&self) {
+        if let Some(waker) = self.0.borrow_mut().take() {
+            waker.wake();
+        }
+    }
+}
+
+// SAFETY: Wasm without the `atomics` target feature is single-threaded.
+unsafe impl Send for AtomicWaker {}
+// SAFETY: Wasm without the `atomics` target feature is single-threaded.
+unsafe impl Sync for AtomicWaker {}
diff --git a/vendor/winit/src/platform_impl/web/async/channel.rs b/vendor/winit/src/platform_impl/web/async/channel.rs
new file mode 100644
index 00000000..11a7a479
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/channel.rs
@@ -0,0 +1,113 @@
+use std::future;
+use std::rc::Rc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{self, RecvError, SendError, TryRecvError};
+use std::sync::{Arc, Mutex};
+use std::task::Poll;
+
+use super::AtomicWaker;
+
+pub fn channel<T>() -> (Sender<T>, Receiver<T>) {
+    let (sender, receiver) = mpsc::channel();
+    let shared = Arc::new(Shared { closed: AtomicBool::new(false), waker: AtomicWaker::new() });
+
+    let sender =
+        Sender(Arc::new(SenderInner { sender: Mutex::new(sender), shared: Arc::clone(&shared) }));
+    let receiver = Receiver { receiver: Rc::new(receiver), shared };
+
+    (sender, receiver)
+}
+
+pub struct Sender<T>(Arc<SenderInner<T>>);
+
+struct SenderInner<T> {
+    // We need to wrap it into a `Mutex` to make it `Sync`. So the sender can't
+    // be accessed on the main thread, as it could block. Additionally we need
+    // to wrap `Sender` in an `Arc` to make it cloneable on the main thread without
+    // having to block.
+    sender: Mutex<mpsc::Sender<T>>,
+    shared: Arc<Shared>,
+}
+
+impl<T> Sender<T> {
+    pub fn send(&self, event: T) -> Result<(), SendError<T>> {
+        self.0.sender.lock().unwrap().send(event)?;
+        self.0.shared.waker.wake();
+
+        Ok(())
+    }
+}
+
+impl<T> SenderInner<T> {
+    fn close(&self) {
+        self.shared.closed.store(true, Ordering::Relaxed);
+        self.shared.waker.wake();
+    }
+}
+
+impl<T> Clone for Sender<T> {
+    fn clone(&self) -> Self {
+        Self(Arc::clone(&self.0))
+    }
+}
+
+impl<T> Drop for SenderInner<T> {
+    fn drop(&mut self) {
+        self.close();
+    }
+}
+
+pub struct Receiver<T> {
+    receiver: Rc<mpsc::Receiver<T>>,
+    shared: Arc<Shared>,
+}
+
+impl<T> Receiver<T> {
+    pub async fn next(&self) -> Result<T, RecvError> {
+        future::poll_fn(|cx| match self.receiver.try_recv() {
+            Ok(event) => Poll::Ready(Ok(event)),
+            Err(TryRecvError::Empty) => {
+                self.shared.waker.register(cx.waker());
+
+                match self.receiver.try_recv() {
+                    Ok(event) => Poll::Ready(Ok(event)),
+                    Err(TryRecvError::Empty) => {
+                        if self.shared.closed.load(Ordering::Relaxed) {
+                            Poll::Ready(Err(RecvError))
+                        } else {
+                            Poll::Pending
+                        }
+                    },
+                    Err(TryRecvError::Disconnected) => Poll::Ready(Err(RecvError)),
+                }
+            },
+            Err(TryRecvError::Disconnected) => Poll::Ready(Err(RecvError)),
+        })
+        .await
+    }
+
+    pub fn try_recv(&self) -> Result<Option<T>, RecvError> {
+        match self.receiver.try_recv() {
+            Ok(value) => Ok(Some(value)),
+            Err(TryRecvError::Empty) => Ok(None),
+            Err(TryRecvError::Disconnected) => Err(RecvError),
+        }
+    }
+}
+
+impl<T> Clone for Receiver<T> {
+    fn clone(&self) -> Self {
+        Self { receiver: Rc::clone(&self.receiver), shared: Arc::clone(&self.shared) }
+    }
+}
+
+impl<T> Drop for Receiver<T> {
+    fn drop(&mut self) {
+        self.shared.closed.store(true, Ordering::Relaxed);
+    }
+}
+
+struct Shared {
+    closed: AtomicBool,
+    waker: AtomicWaker,
+}
diff --git a/vendor/winit/src/platform_impl/web/async/concurrent_queue.rs b/vendor/winit/src/platform_impl/web/async/concurrent_queue.rs
new file mode 100644
index 00000000..70afb3dd
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/concurrent_queue.rs
@@ -0,0 +1,52 @@
+use std::cell::{Cell, RefCell};
+
+#[derive(Debug)]
+pub struct ConcurrentQueue<T> {
+    queue: RefCell<Vec<T>>,
+    closed: Cell<bool>,
+}
+
+pub enum PushError<T> {
+    #[allow(dead_code)]
+    Full(T),
+    Closed(T),
+}
+
+pub enum PopError {
+    Empty,
+    Closed,
+}
+
+impl<T> ConcurrentQueue<T> {
+    pub fn unbounded() -> Self {
+        Self { queue: RefCell::new(Vec::new()), closed: Cell::new(false) }
+    }
+
+    pub fn push(&self, value: T) -> Result<(), PushError<T>> {
+        if self.closed.get() {
+            return Err(PushError::Closed(value));
+        }
+
+        self.queue.borrow_mut().push(value);
+        Ok(())
+    }
+
+    pub fn pop(&self) -> Result<T, PopError> {
+        self.queue.borrow_mut().pop().ok_or_else(|| {
+            if self.closed.get() {
+                PopError::Closed
+            } else {
+                PopError::Empty
+            }
+        })
+    }
+
+    pub fn close(&self) -> bool {
+        !self.closed.replace(true)
+    }
+}
+
+// SAFETY: Wasm without the `atomics` target feature is single-threaded.
+unsafe impl<T> Send for ConcurrentQueue<T> {}
+// SAFETY: Wasm without the `atomics` target feature is single-threaded.
+unsafe impl<T> Sync for ConcurrentQueue<T> {}
diff --git a/vendor/winit/src/platform_impl/web/async/dispatcher.rs b/vendor/winit/src/platform_impl/web/async/dispatcher.rs
new file mode 100644
index 00000000..10ab345e
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/dispatcher.rs
@@ -0,0 +1,106 @@
+use super::super::main_thread::MainThreadMarker;
+use super::{channel, Receiver, Sender, Wrapper};
+use std::cell::Ref;
+use std::sync::{Arc, Condvar, Mutex};
+
+pub struct Dispatcher<T: 'static>(Wrapper<T, Sender<Closure<T>>, Closure<T>>);
+
+struct Closure<T>(Box<dyn FnOnce(&T) + Send>);
+
+impl<T> Dispatcher<T> {
+    #[track_caller]
+    pub fn new(main_thread: MainThreadMarker, value: T) -> Option<(Self, DispatchRunner<T>)> {
+        let (sender, receiver) = channel::<Closure<T>>();
+
+        Wrapper::new(
+            main_thread,
+            value,
+            |value, Closure(closure)| {
+                // SAFETY: The given `Closure` here isn't really `'static`, so we shouldn't do
+                // anything funny with it here. See `Self::queue()`.
+                closure(value.borrow().as_ref().unwrap())
+            },
+            {
+                let receiver = receiver.clone();
+                move |value| async move {
+                    while let Ok(Closure(closure)) = receiver.next().await {
+                        // SAFETY: The given `Closure` here isn't really `'static`, so we shouldn't
+                        // do anything funny with it here. See
+                        // `Self::queue()`.
+                        closure(value.borrow().as_ref().unwrap())
+                    }
+                }
+            },
+            sender,
+            |sender, closure| {
+                // SAFETY: The given `Closure` here isn't really `'static`, so we shouldn't do
+                // anything funny with it here. See `Self::queue()`.
+                sender.send(closure).unwrap()
+            },
+        )
+        .map(|wrapper| (Self(wrapper.clone()), DispatchRunner { wrapper, receiver }))
+    }
+
+    pub fn value(&self) -> Option<Ref<'_, T>> {
+        self.0.value()
+    }
+
+    pub fn dispatch(&self, f: impl 'static + FnOnce(&T) + Send) {
+        if let Some(value) = self.0.value() {
+            f(&value)
+        } else {
+            self.0.send(Closure(Box::new(f)))
+        }
+    }
+
+    pub fn queue<R: Send>(&self, f: impl FnOnce(&T) -> R + Send) -> R {
+        if let Some(value) = self.0.value() {
+            f(&value)
+        } else {
+            let pair = Arc::new((Mutex::new(None), Condvar::new()));
+            let closure = Box::new({
+                let pair = pair.clone();
+                move |value: &T| {
+                    *pair.0.lock().unwrap() = Some(f(value));
+                    pair.1.notify_one();
+                }
+            }) as Box<dyn FnOnce(&T) + Send>;
+            // SAFETY: The `transmute` is necessary because `Closure` requires `'static`. This is
+            // safe because this function won't return until `f` has finished executing. See
+            // `Self::new()`.
+            let closure = Closure(unsafe {
+                std::mem::transmute::<
+                    Box<dyn FnOnce(&T) + Send>,
+                    Box<dyn FnOnce(&T) + Send + 'static>,
+                >(closure)
+            });
+
+            self.0.send(closure);
+
+            let mut started = pair.0.lock().unwrap();
+
+            while started.is_none() {
+                started = pair.1.wait(started).unwrap();
+            }
+
+            started.take().unwrap()
+        }
+    }
+}
+
+pub struct DispatchRunner<T: 'static> {
+    wrapper: Wrapper<T, Sender<Closure<T>>, Closure<T>>,
+    receiver: Receiver<Closure<T>>,
+}
+
+impl<T> DispatchRunner<T> {
+    pub fn run(&self) {
+        while let Some(Closure(closure)) =
+            self.receiver.try_recv().expect("should only be closed when `Dispatcher` is dropped")
+        {
+            // SAFETY: The given `Closure` here isn't really `'static`, so we shouldn't do anything
+            // funny with it here. See `Self::queue()`.
+            closure(&self.wrapper.value().expect("don't call this outside the main thread"))
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/async/mod.rs b/vendor/winit/src/platform_impl/web/async/mod.rs
new file mode 100644
index 00000000..4681cf92
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/mod.rs
@@ -0,0 +1,19 @@
+mod abortable;
+#[cfg(not(target_feature = "atomics"))]
+mod atomic_waker;
+mod channel;
+#[cfg(not(target_feature = "atomics"))]
+mod concurrent_queue;
+mod dispatcher;
+mod notifier;
+mod waker;
+mod wrapper;
+
+pub use self::abortable::{AbortHandle, Abortable, DropAbortHandle};
+pub use self::channel::{channel, Receiver, Sender};
+pub use self::dispatcher::{DispatchRunner, Dispatcher};
+pub use self::notifier::{Notified, Notifier};
+pub use self::waker::{Waker, WakerSpawner};
+use self::wrapper::Wrapper;
+use atomic_waker::AtomicWaker;
+use concurrent_queue::{ConcurrentQueue, PushError};
diff --git a/vendor/winit/src/platform_impl/web/async/notifier.rs b/vendor/winit/src/platform_impl/web/async/notifier.rs
new file mode 100644
index 00000000..81655d18
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/notifier.rs
@@ -0,0 +1,72 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::{Arc, OnceLock};
+use std::task::{Context, Poll, Waker};
+
+use super::{ConcurrentQueue, PushError};
+
+#[derive(Debug)]
+pub struct Notifier<T: Clone>(Arc<Inner<T>>);
+
+impl<T: Clone> Notifier<T> {
+    pub fn new() -> Self {
+        Self(Arc::new(Inner { queue: ConcurrentQueue::unbounded(), value: OnceLock::new() }))
+    }
+
+    pub fn notify(self, value: T) {
+        if self.0.value.set(value).is_err() {
+            unreachable!("value set before")
+        }
+
+        self.0.queue.close();
+
+        while let Ok(waker) = self.0.queue.pop() {
+            waker.wake()
+        }
+    }
+
+    pub fn notified(&self) -> Notified<T> {
+        Notified(Some(Arc::clone(&self.0)))
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct Notified<T: Clone>(Option<Arc<Inner<T>>>);
+
+impl<T: Clone> Future for Notified<T> {
+    type Output = T;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        let this = self.0.take().expect("`Receiver` polled after completion");
+
+        if this.value.get().is_none() {
+            match this.queue.push(cx.waker().clone()) {
+                Ok(()) => {
+                    if this.value.get().is_none() {
+                        self.0 = Some(this);
+                        return Poll::Pending;
+                    }
+                },
+                Err(PushError::Closed(_)) => (),
+                Err(PushError::Full(_)) => {
+                    unreachable!("found full queue despite using unbounded queue")
+                },
+            }
+        }
+
+        let (Ok(Some(value)) | Err(Some(value))) = Arc::try_unwrap(this)
+            .map(|mut inner| inner.value.take())
+            .map_err(|this| this.value.get().cloned())
+        else {
+            unreachable!("found no value despite being ready")
+        };
+
+        Poll::Ready(value)
+    }
+}
+
+#[derive(Debug)]
+struct Inner<T> {
+    queue: ConcurrentQueue<Waker>,
+    value: OnceLock<T>,
+}
diff --git a/vendor/winit/src/platform_impl/web/async/waker.rs b/vendor/winit/src/platform_impl/web/async/waker.rs
new file mode 100644
index 00000000..40b316dc
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/waker.rs
@@ -0,0 +1,131 @@
+use std::future;
+use std::num::NonZeroUsize;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::Arc;
+use std::task::Poll;
+
+use super::super::main_thread::MainThreadMarker;
+use super::{AtomicWaker, Wrapper};
+
+pub struct WakerSpawner<T: 'static>(Wrapper<Handler<T>, Sender, NonZeroUsize>);
+
+pub struct Waker<T: 'static>(Wrapper<Handler<T>, Sender, NonZeroUsize>);
+
+struct Handler<T> {
+    value: T,
+    handler: fn(&T, NonZeroUsize, bool),
+}
+
+#[derive(Clone)]
+struct Sender(Arc<Inner>);
+
+impl<T> WakerSpawner<T> {
+    #[track_caller]
+    pub fn new(
+        main_thread: MainThreadMarker,
+        value: T,
+        handler: fn(&T, NonZeroUsize, bool),
+    ) -> Option<Self> {
+        let inner = Arc::new(Inner {
+            counter: AtomicUsize::new(0),
+            waker: AtomicWaker::new(),
+            closed: AtomicBool::new(false),
+        });
+
+        let handler = Handler { value, handler };
+
+        let sender = Sender(Arc::clone(&inner));
+
+        let wrapper = Wrapper::new(
+            main_thread,
+            handler,
+            |handler, count| {
+                let handler = handler.borrow();
+                let handler = handler.as_ref().unwrap();
+                (handler.handler)(&handler.value, count, true);
+            },
+            {
+                let inner = Arc::clone(&inner);
+
+                move |handler| async move {
+                    while let Some(count) = future::poll_fn(|cx| {
+                        let count = inner.counter.swap(0, Ordering::Relaxed);
+
+                        match NonZeroUsize::new(count) {
+                            Some(count) => Poll::Ready(Some(count)),
+                            None => {
+                                inner.waker.register(cx.waker());
+
+                                let count = inner.counter.swap(0, Ordering::Relaxed);
+
+                                match NonZeroUsize::new(count) {
+                                    Some(count) => Poll::Ready(Some(count)),
+                                    None => {
+                                        if inner.closed.load(Ordering::Relaxed) {
+                                            return Poll::Ready(None);
+                                        }
+
+                                        Poll::Pending
+                                    },
+                                }
+                            },
+                        }
+                    })
+                    .await
+                    {
+                        let handler = handler.borrow();
+                        let handler = handler.as_ref().unwrap();
+                        (handler.handler)(&handler.value, count, false);
+                    }
+                }
+            },
+            sender,
+            |inner, _| {
+                inner.0.counter.fetch_add(1, Ordering::Relaxed);
+                inner.0.waker.wake();
+            },
+        )?;
+
+        Some(Self(wrapper))
+    }
+
+    pub fn waker(&self) -> Waker<T> {
+        Waker(self.0.clone())
+    }
+
+    pub fn fetch(&self) -> usize {
+        debug_assert!(
+            MainThreadMarker::new().is_some(),
+            "this should only be called from the main thread"
+        );
+
+        self.0.with_sender_data(|inner| inner.0.counter.swap(0, Ordering::Relaxed))
+    }
+}
+
+impl<T> Drop for WakerSpawner<T> {
+    fn drop(&mut self) {
+        self.0.with_sender_data(|inner| {
+            inner.0.closed.store(true, Ordering::Relaxed);
+            inner.0.waker.wake();
+        });
+    }
+}
+
+impl<T> Waker<T> {
+    pub fn wake(&self) {
+        self.0.send(NonZeroUsize::MIN)
+    }
+}
+
+impl<T> Clone for Waker<T> {
+    fn clone(&self) -> Self {
+        Self(self.0.clone())
+    }
+}
+
+struct Inner {
+    counter: AtomicUsize,
+    waker: AtomicWaker,
+    closed: AtomicBool,
+}
diff --git a/vendor/winit/src/platform_impl/web/async/wrapper.rs b/vendor/winit/src/platform_impl/web/async/wrapper.rs
new file mode 100644
index 00000000..2c7f6940
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/async/wrapper.rs
@@ -0,0 +1,89 @@
+use super::super::main_thread::MainThreadMarker;
+use std::cell::{Ref, RefCell};
+use std::future::Future;
+use std::marker::PhantomData;
+use std::sync::Arc;
+
+// Unsafe wrapper type that allows us to use `T` when it's not `Send` from other threads.
+// `value` **must** only be accessed on the main thread.
+pub struct Wrapper<V: 'static, S: Clone + Send, E> {
+    value: Value<V>,
+    handler: fn(&RefCell<Option<V>>, E),
+    sender_data: S,
+    sender_handler: fn(&S, E),
+}
+
+struct Value<V> {
+    // SAFETY:
+    // This value must not be accessed if not on the main thread.
+    //
+    // - We wrap this in an `Arc` to allow it to be safely cloned without accessing the value.
+    // - The `RefCell` lets us mutably access in the main thread but is safe to drop in any thread
+    //   because it has no `Drop` behavior.
+    // - The `Option` lets us safely drop `T` only in the main thread.
+    value: Arc<RefCell<Option<V>>>,
+    // Prevent's `Send` or `Sync` to be automatically implemented.
+    local: PhantomData<*const ()>,
+}
+
+// SAFETY: See `Self::value`.
+unsafe impl<V> Send for Value<V> {}
+// SAFETY: See `Self::value`.
+unsafe impl<V> Sync for Value<V> {}
+
+impl<V, S: Clone + Send, E> Wrapper<V, S, E> {
+    #[track_caller]
+    pub fn new<R: Future<Output = ()>>(
+        _: MainThreadMarker,
+        value: V,
+        handler: fn(&RefCell<Option<V>>, E),
+        receiver: impl 'static + FnOnce(Arc<RefCell<Option<V>>>) -> R,
+        sender_data: S,
+        sender_handler: fn(&S, E),
+    ) -> Option<Self> {
+        let value = Arc::new(RefCell::new(Some(value)));
+
+        wasm_bindgen_futures::spawn_local({
+            let value = Arc::clone(&value);
+            async move {
+                receiver(Arc::clone(&value)).await;
+                drop(value.borrow_mut().take().unwrap());
+            }
+        });
+
+        Some(Self {
+            value: Value { value, local: PhantomData },
+            handler,
+            sender_data,
+            sender_handler,
+        })
+    }
+
+    pub fn send(&self, event: E) {
+        if MainThreadMarker::new().is_some() {
+            (self.handler)(&self.value.value, event)
+        } else {
+            (self.sender_handler)(&self.sender_data, event)
+        }
+    }
+
+    pub fn value(&self) -> Option<Ref<'_, V>> {
+        MainThreadMarker::new()
+            .map(|_| Ref::map(self.value.value.borrow(), |value| value.as_ref().unwrap()))
+    }
+
+    pub fn with_sender_data<T>(&self, f: impl FnOnce(&S) -> T) -> T {
+        f(&self.sender_data)
+    }
+}
+
+impl<V, S: Clone + Send, E> Clone for Wrapper<V, S, E> {
+    fn clone(&self) -> Self {
+        Self {
+            value: Value { value: self.value.value.clone(), local: PhantomData },
+            handler: self.handler,
+            sender_data: self.sender_data.clone(),
+            sender_handler: self.sender_handler,
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/cursor.rs b/vendor/winit/src/platform_impl/web/cursor.rs
new file mode 100644
index 00000000..214ff45a
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/cursor.rs
@@ -0,0 +1,730 @@
+use std::cell::RefCell;
+use std::future::{self, Future};
+use std::hash::{Hash, Hasher};
+use std::mem;
+use std::ops::{Deref, DerefMut};
+use std::pin::Pin;
+use std::rc::Rc;
+use std::sync::Arc;
+use std::task::{ready, Context, Poll, Waker};
+use std::time::Duration;
+
+use cursor_icon::CursorIcon;
+use js_sys::{Array, Object};
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen::JsCast;
+use wasm_bindgen_futures::JsFuture;
+use web_sys::{
+    Blob, Document, DomException, HtmlCanvasElement, HtmlImageElement, ImageBitmap,
+    ImageBitmapOptions, ImageBitmapRenderingContext, ImageData, PremultiplyAlpha, Url, Window,
+};
+
+use super::backend::Style;
+use super::main_thread::{MainThreadMarker, MainThreadSafe};
+use super::r#async::{AbortHandle, Abortable, DropAbortHandle, Notified, Notifier};
+use super::ActiveEventLoop;
+use crate::cursor::{BadImage, Cursor, CursorImage, CustomCursor as RootCustomCursor};
+use crate::platform::web::CustomCursorError;
+
+#[derive(Debug)]
+pub(crate) enum CustomCursorSource {
+    Image(CursorImage),
+    Url { url: String, hotspot_x: u16, hotspot_y: u16 },
+    Animation { duration: Duration, cursors: Vec<RootCustomCursor> },
+}
+
+impl CustomCursorSource {
+    pub fn from_rgba(
+        rgba: Vec<u8>,
+        width: u16,
+        height: u16,
+        hotspot_x: u16,
+        hotspot_y: u16,
+    ) -> Result<CustomCursorSource, BadImage> {
+        Ok(CustomCursorSource::Image(CursorImage::from_rgba(
+            rgba, width, height, hotspot_x, hotspot_y,
+        )?))
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct CustomCursor {
+    pub(crate) animation: bool,
+    state: Arc<MainThreadSafe<RefCell<ImageState>>>,
+}
+
+impl Hash for CustomCursor {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        Arc::as_ptr(&self.state).hash(state);
+    }
+}
+
+impl PartialEq for CustomCursor {
+    fn eq(&self, other: &Self) -> bool {
+        Arc::ptr_eq(&self.state, &other.state)
+    }
+}
+
+impl Eq for CustomCursor {}
+
+impl CustomCursor {
+    pub(crate) fn new(event_loop: &ActiveEventLoop, source: CustomCursorSource) -> Self {
+        match source {
+            CustomCursorSource::Image(image) => Self::build_spawn(
+                event_loop,
+                from_rgba(event_loop.runner.window(), event_loop.runner.document().clone(), &image),
+                false,
+            ),
+            CustomCursorSource::Url { url, hotspot_x, hotspot_y } => Self::build_spawn(
+                event_loop,
+                from_url(UrlType::Plain(url), hotspot_x, hotspot_y),
+                false,
+            ),
+            CustomCursorSource::Animation { duration, cursors } => Self::build_spawn(
+                event_loop,
+                from_animation(
+                    event_loop.runner.main_thread(),
+                    duration,
+                    cursors.into_iter().map(|cursor| cursor.inner),
+                ),
+                true,
+            ),
+        }
+    }
+
+    fn build_spawn<F, S>(window_target: &ActiveEventLoop, task: F, animation: bool) -> CustomCursor
+    where
+        F: 'static + Future<Output = Result<S, CustomCursorError>>,
+        S: Into<ImageState>,
+    {
+        let handle = AbortHandle::new();
+        let this = CustomCursor {
+            animation,
+            state: Arc::new(MainThreadSafe::new(
+                window_target.runner.main_thread(),
+                RefCell::new(ImageState::Loading {
+                    notifier: Notifier::new(),
+                    _handle: DropAbortHandle::new(handle.clone()),
+                }),
+            )),
+        };
+        let weak = Arc::downgrade(&this.state);
+        let main_thread = window_target.runner.main_thread();
+
+        let task = Abortable::new(handle, {
+            async move {
+                let result = task.await;
+
+                let this = weak.upgrade().expect("`CursorHandler` invalidated without aborting");
+                let mut this = this.get(main_thread).borrow_mut();
+
+                match result {
+                    Ok(new_state) => {
+                        let ImageState::Loading { notifier, .. } =
+                            mem::replace(this.deref_mut(), new_state.into())
+                        else {
+                            unreachable!("found invalid state");
+                        };
+                        notifier.notify(Ok(()));
+                    },
+                    Err(error) => {
+                        let ImageState::Loading { notifier, .. } =
+                            mem::replace(this.deref_mut(), ImageState::Failed(error.clone()))
+                        else {
+                            unreachable!("found invalid state");
+                        };
+                        notifier.notify(Err(error));
+                    },
+                }
+            }
+        });
+
+        wasm_bindgen_futures::spawn_local(async move {
+            let _ = task.await;
+        });
+
+        this
+    }
+
+    pub(crate) fn new_async(
+        event_loop: &ActiveEventLoop,
+        source: CustomCursorSource,
+    ) -> CustomCursorFuture {
+        let CustomCursor { animation, state } = Self::new(event_loop, source);
+        let binding = state.get(event_loop.runner.main_thread()).borrow();
+        let ImageState::Loading { notifier, .. } = binding.deref() else {
+            unreachable!("found invalid state")
+        };
+        let notified = notifier.notified();
+        drop(binding);
+
+        CustomCursorFuture { notified, animation, state: Some(state) }
+    }
+}
+
+#[derive(Debug)]
+pub struct CustomCursorFuture {
+    notified: Notified<Result<(), CustomCursorError>>,
+    animation: bool,
+    state: Option<Arc<MainThreadSafe<RefCell<ImageState>>>>,
+}
+
+impl Future for CustomCursorFuture {
+    type Output = Result<CustomCursor, CustomCursorError>;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        if self.state.is_none() {
+            panic!("`CustomCursorFuture` polled after completion")
+        }
+
+        let result = ready!(Pin::new(&mut self.notified).poll(cx));
+        let state = self.state.take().expect("`CustomCursorFuture` polled after completion");
+
+        Poll::Ready(result.map(|_| CustomCursor { animation: self.animation, state }))
+    }
+}
+
+#[derive(Debug)]
+pub struct CursorHandler(Rc<RefCell<Inner>>);
+
+#[derive(Debug)]
+struct Inner {
+    main_thread: MainThreadMarker,
+    canvas: HtmlCanvasElement,
+    style: Style,
+    visible: bool,
+    cursor: SelectedCursor,
+}
+
+impl CursorHandler {
+    pub(crate) fn new(
+        main_thread: MainThreadMarker,
+        canvas: HtmlCanvasElement,
+        style: Style,
+    ) -> Self {
+        Self(Rc::new(RefCell::new(Inner {
+            main_thread,
+            canvas,
+            style,
+            visible: true,
+            cursor: SelectedCursor::default(),
+        })))
+    }
+
+    pub fn set_cursor(&self, cursor: Cursor) {
+        let mut this = self.0.borrow_mut();
+
+        match cursor {
+            Cursor::Icon(icon) => {
+                if let SelectedCursor::Icon(old_icon)
+                | SelectedCursor::Loading { previous: Previous::Icon(old_icon), .. } =
+                    &this.cursor
+                {
+                    if *old_icon == icon {
+                        return;
+                    }
+                }
+
+                this.cursor = SelectedCursor::Icon(icon);
+                this.set_style();
+            },
+            Cursor::Custom(cursor) => {
+                let cursor = cursor.inner;
+
+                if let SelectedCursor::Loading { cursor: old_cursor, .. }
+                | SelectedCursor::Image(old_cursor)
+                | SelectedCursor::Animation { cursor: old_cursor, .. } = &this.cursor
+                {
+                    if *old_cursor == cursor {
+                        return;
+                    }
+                }
+
+                let state = cursor.state.get(this.main_thread).borrow();
+
+                match state.deref() {
+                    ImageState::Loading { notifier, .. } => {
+                        let notified = notifier.notified();
+                        let handle = DropAbortHandle::new(AbortHandle::new());
+                        let task = Abortable::new(handle.handle(), {
+                            let weak = Rc::downgrade(&self.0);
+                            async move {
+                                let _ = notified.await;
+                                let handler = weak
+                                    .upgrade()
+                                    .expect("`CursorHandler` invalidated without aborting");
+                                handler.borrow_mut().notify();
+                            }
+                        });
+                        wasm_bindgen_futures::spawn_local(async move {
+                            let _ = task.await;
+                        });
+
+                        drop(state);
+                        this.cursor = SelectedCursor::Loading {
+                            cursor,
+                            previous: mem::take(&mut this.cursor).into(),
+                            _handle: handle,
+                        };
+                    },
+                    ImageState::Failed(error) => {
+                        tracing::error!(
+                            "trying to load custom cursor that has failed to load: {error}"
+                        )
+                    },
+                    ImageState::Image(_) => {
+                        drop(state);
+                        this.cursor = SelectedCursor::Image(cursor);
+                        this.set_style();
+                    },
+                    ImageState::Animation(animation) => {
+                        let canvas: &CanvasAnimateExt = this.canvas.unchecked_ref();
+                        let animation = canvas.animate_with_keyframe_animation_options(
+                            Some(&animation.keyframes),
+                            &animation.options,
+                        );
+                        drop(state);
+
+                        if !this.visible {
+                            animation.cancel();
+                        }
+
+                        this.cursor = SelectedCursor::Animation {
+                            animation: AnimationDropper(animation),
+                            cursor,
+                        };
+                        this.set_style();
+                    },
+                };
+            },
+        }
+    }
+
+    pub fn set_cursor_visible(&self, visible: bool) {
+        let mut this = self.0.borrow_mut();
+
+        if !visible && this.visible {
+            this.visible = false;
+            this.style.set("cursor", "none");
+
+            if let SelectedCursor::Animation { animation, .. } = &this.cursor {
+                animation.0.cancel();
+            }
+        } else if visible && !this.visible {
+            this.visible = true;
+            this.set_style();
+        }
+    }
+}
+
+impl Inner {
+    fn set_style(&self) {
+        if self.visible {
+            match &self.cursor {
+                SelectedCursor::Icon(icon)
+                | SelectedCursor::Loading { previous: Previous::Icon(icon), .. } => {
+                    if let CursorIcon::Default = icon {
+                        self.style.remove("cursor")
+                    } else {
+                        self.style.set("cursor", icon.name())
+                    }
+                },
+                SelectedCursor::Loading { previous: Previous::Image(cursor), .. }
+                | SelectedCursor::Image(cursor) => {
+                    match cursor.state.get(self.main_thread).borrow().deref() {
+                        ImageState::Image(Image { style, .. }) => self.style.set("cursor", style),
+                        _ => unreachable!("found invalid saved state"),
+                    }
+                },
+                SelectedCursor::Loading {
+                    previous: Previous::Animation { animation, .. }, ..
+                }
+                | SelectedCursor::Animation { animation, .. } => {
+                    self.style.remove("cursor");
+                    animation.0.play()
+                },
+            }
+        }
+    }
+
+    fn notify(&mut self) {
+        let SelectedCursor::Loading { cursor, previous, .. } = mem::take(&mut self.cursor) else {
+            unreachable!("found wrong state")
+        };
+
+        let state = cursor.state.get(self.main_thread).borrow();
+        match state.deref() {
+            ImageState::Image(_) => {
+                drop(state);
+                self.cursor = SelectedCursor::Image(cursor);
+                self.set_style();
+            },
+            ImageState::Animation(animation) => {
+                let canvas: &CanvasAnimateExt = self.canvas.unchecked_ref();
+                let animation = canvas.animate_with_keyframe_animation_options(
+                    Some(&animation.keyframes),
+                    &animation.options,
+                );
+                drop(state);
+
+                if !self.visible {
+                    animation.cancel();
+                }
+
+                self.cursor =
+                    SelectedCursor::Animation { animation: AnimationDropper(animation), cursor };
+                self.set_style();
+            },
+            ImageState::Failed(error) => {
+                tracing::error!("custom cursor failed to load: {error}");
+                self.cursor = previous.into()
+            },
+            ImageState::Loading { .. } => unreachable!("notified without being ready"),
+        }
+    }
+}
+
+#[derive(Debug)]
+enum SelectedCursor {
+    Icon(CursorIcon),
+    Loading { cursor: CustomCursor, previous: Previous, _handle: DropAbortHandle },
+    Image(CustomCursor),
+    Animation { cursor: CustomCursor, animation: AnimationDropper },
+}
+
+impl Default for SelectedCursor {
+    fn default() -> Self {
+        Self::Icon(Default::default())
+    }
+}
+
+impl From<Previous> for SelectedCursor {
+    fn from(previous: Previous) -> Self {
+        match previous {
+            Previous::Icon(icon) => Self::Icon(icon),
+            Previous::Image(cursor) => Self::Image(cursor),
+            Previous::Animation { cursor, animation } => Self::Animation { cursor, animation },
+        }
+    }
+}
+
+#[derive(Debug)]
+enum Previous {
+    Icon(CursorIcon),
+    Image(CustomCursor),
+    Animation { cursor: CustomCursor, animation: AnimationDropper },
+}
+
+impl From<SelectedCursor> for Previous {
+    fn from(value: SelectedCursor) -> Self {
+        match value {
+            SelectedCursor::Icon(icon) => Self::Icon(icon),
+            SelectedCursor::Loading { previous, .. } => previous,
+            SelectedCursor::Image(image) => Self::Image(image),
+            SelectedCursor::Animation { cursor, animation } => {
+                Self::Animation { cursor, animation }
+            },
+        }
+    }
+}
+
+#[derive(Debug)]
+enum ImageState {
+    Loading { notifier: Notifier<Result<(), CustomCursorError>>, _handle: DropAbortHandle },
+    Failed(CustomCursorError),
+    Image(Image),
+    Animation(Animation),
+}
+
+#[derive(Debug)]
+struct Image {
+    style: String,
+    _object_url: Option<ObjectUrl>,
+    _image: HtmlImageElement,
+}
+
+impl From<Image> for ImageState {
+    fn from(image: Image) -> Self {
+        Self::Image(image)
+    }
+}
+
+#[derive(Debug)]
+struct Animation {
+    keyframes: Array,
+    options: KeyframeAnimationOptions,
+    _images: Vec<CustomCursor>,
+}
+
+impl From<Animation> for ImageState {
+    fn from(animation: Animation) -> Self {
+        Self::Animation(animation)
+    }
+}
+
+#[derive(Debug)]
+enum UrlType {
+    Plain(String),
+    Object(ObjectUrl),
+}
+
+impl UrlType {
+    fn url(&self) -> &str {
+        match &self {
+            UrlType::Plain(url) => url,
+            UrlType::Object(object_url) => &object_url.0,
+        }
+    }
+}
+
+#[derive(Debug)]
+struct ObjectUrl(String);
+
+impl Drop for ObjectUrl {
+    fn drop(&mut self) {
+        Url::revoke_object_url(&self.0).expect("unexpected exception in `URL.revokeObjectURL()`");
+    }
+}
+
+#[derive(Debug)]
+struct AnimationDropper(WebAnimation);
+
+impl Drop for AnimationDropper {
+    fn drop(&mut self) {
+        self.0.cancel()
+    }
+}
+
+fn from_rgba(
+    window: &Window,
+    document: Document,
+    image: &CursorImage,
+) -> impl Future<Output = Result<Image, CustomCursorError>> {
+    // 1. Create an `ImageData` from the RGBA data.
+    // 2. Create an `ImageBitmap` from the `ImageData`.
+    // 3. Draw `ImageBitmap` on an `HTMLCanvasElement`.
+    // 4. Create a `Blob` from the `HTMLCanvasElement`.
+    // 5. Create an object URL from the `Blob`.
+    // 6. Decode the image on an `HTMLImageElement` from the URL.
+
+    // 1. Create an `ImageData` from the RGBA data.
+    // Adapted from https://github.com/rust-windowing/softbuffer/blob/ab7688e2ed2e2eca51b3c4e1863a5bd7fe85800e/src/web.rs#L196-L223
+    #[cfg(target_feature = "atomics")]
+    // Can't share `SharedArrayBuffer` with `ImageData`.
+    let result = {
+        use js_sys::{Uint8Array, Uint8ClampedArray};
+        use wasm_bindgen::JsValue;
+
+        #[wasm_bindgen]
+        extern "C" {
+            #[wasm_bindgen(js_namespace = ImageData)]
+            type ImageDataExt;
+            #[wasm_bindgen(catch, constructor, js_class = ImageData)]
+            fn new(array: Uint8ClampedArray, sw: u32) -> Result<ImageDataExt, JsValue>;
+        }
+
+        let array = Uint8Array::new_with_length(image.rgba.len() as u32);
+        array.copy_from(&image.rgba);
+        let array = Uint8ClampedArray::new(&array);
+        ImageDataExt::new(array, image.width as u32)
+            .map(JsValue::from)
+            .map(ImageData::unchecked_from_js)
+    };
+    #[cfg(not(target_feature = "atomics"))]
+    let result = ImageData::new_with_u8_clamped_array(
+        wasm_bindgen::Clamped(&image.rgba),
+        image.width as u32,
+    );
+    let image_data = result.expect("found wrong image size");
+
+    // 2. Create an `ImageBitmap` from the `ImageData`.
+    //
+    // We call `createImageBitmap()` before spawning the future,
+    // to not have to clone the image buffer.
+    let options = ImageBitmapOptions::new();
+    options.set_premultiply_alpha(PremultiplyAlpha::None);
+    let bitmap = JsFuture::from(
+        window
+            .create_image_bitmap_with_image_data_and_image_bitmap_options(&image_data, &options)
+            .expect("unexpected exception in `createImageBitmap()`"),
+    );
+
+    let CursorImage { width, height, hotspot_x, hotspot_y, .. } = *image;
+    async move {
+        let bitmap: ImageBitmap =
+            bitmap.await.expect("found invalid state in `ImageData`").unchecked_into();
+
+        let canvas: HtmlCanvasElement =
+            document.create_element("canvas").expect("invalid tag name").unchecked_into();
+        #[allow(clippy::disallowed_methods)]
+        canvas.set_width(width as u32);
+        #[allow(clippy::disallowed_methods)]
+        canvas.set_height(height as u32);
+
+        // 3. Draw `ImageBitmap` on an `HTMLCanvasElement`.
+        let context: ImageBitmapRenderingContext = canvas
+            .get_context("bitmaprenderer")
+            .expect("unexpected exception in `HTMLCanvasElement.getContext()`")
+            .expect("`bitmaprenderer` context unsupported")
+            .unchecked_into();
+        context.transfer_from_image_bitmap(&bitmap);
+        drop(bitmap);
+        drop(context);
+
+        // 4. Create a `Blob` from the `HTMLCanvasElement`.
+        //
+        // To keep the `Closure` alive until `HTMLCanvasElement.toBlob()` is done,
+        // we do the whole `Waker` strategy. Commonly on `Drop` the callback is aborted,
+        // but it would increase complexity and isn't possible in this case.
+        // Keep in mind that `HTMLCanvasElement.toBlob()` can call the callback immediately.
+        let value = Rc::new(RefCell::new(None));
+        let waker = Rc::new(RefCell::<Option<Waker>>::new(None));
+        let callback = Closure::once({
+            let value = value.clone();
+            let waker = waker.clone();
+            move |blob: Option<Blob>| {
+                *value.borrow_mut() = Some(blob);
+                if let Some(waker) = waker.borrow_mut().take() {
+                    waker.wake();
+                }
+            }
+        });
+        canvas
+            .to_blob(callback.as_ref().unchecked_ref())
+            .expect("failed with `SecurityError` despite only source coming from memory");
+        let blob = future::poll_fn(|cx| {
+            if let Some(blob) = value.borrow_mut().take() {
+                Poll::Ready(blob)
+            } else {
+                *waker.borrow_mut() = Some(cx.waker().clone());
+                Poll::Pending
+            }
+        })
+        .await;
+        drop(canvas);
+
+        let Some(blob) = blob else {
+            return Err(CustomCursorError::Blob);
+        };
+
+        // 5. Create an object URL from the `Blob`.
+        let url = Url::create_object_url_with_blob(&blob)
+            .expect("unexpected exception in `URL.createObjectURL()`");
+        let url = UrlType::Object(ObjectUrl(url));
+
+        from_url(url, hotspot_x, hotspot_y).await
+    }
+}
+
+async fn from_url(
+    url: UrlType,
+    hotspot_x: u16,
+    hotspot_y: u16,
+) -> Result<Image, CustomCursorError> {
+    // 6. Decode the image on an `HTMLImageElement` from the URL.
+    let image = HtmlImageElement::new().expect("unexpected exception in `new HtmlImageElement`");
+    image.set_src(url.url());
+    let result = JsFuture::from(image.decode()).await;
+
+    if let Err(error) = result {
+        debug_assert!(error.has_type::<DomException>());
+        let error: DomException = error.unchecked_into();
+        debug_assert_eq!(error.name(), "EncodingError");
+        let error = error.message();
+
+        return Err(CustomCursorError::Decode(error));
+    }
+
+    Ok(Image {
+        style: format!("url({}) {hotspot_x} {hotspot_y}, auto", url.url()),
+        _object_url: match url {
+            UrlType::Plain(_) => None,
+            UrlType::Object(object_url) => Some(object_url),
+        },
+        _image: image,
+    })
+}
+
+#[allow(clippy::await_holding_refcell_ref)] // false-positive
+async fn from_animation(
+    main_thread: MainThreadMarker,
+    duration: Duration,
+    cursors: impl ExactSizeIterator<Item = CustomCursor>,
+) -> Result<Animation, CustomCursorError> {
+    let keyframes = Array::new();
+    let mut images = Vec::with_capacity(cursors.len());
+
+    for cursor in cursors {
+        let state = cursor.state.get(main_thread).borrow();
+
+        match state.deref() {
+            ImageState::Loading { notifier, .. } => {
+                let notified = notifier.notified();
+                drop(state);
+                notified.await?;
+            },
+            ImageState::Failed(error) => return Err(error.clone()),
+            ImageState::Image(_) => drop(state),
+            ImageState::Animation(_) => unreachable!("check in `CustomCursorSource` failed"),
+        }
+
+        let state = cursor.state.get(main_thread).borrow();
+        let style = match state.deref() {
+            ImageState::Image(Image { style, .. }) => style,
+            _ => unreachable!("found invalid state"),
+        };
+
+        let keyframe: Keyframe = Object::new().unchecked_into();
+        keyframe.set_cursor(style);
+        keyframes.push(&keyframe);
+        drop(state);
+
+        images.push(cursor);
+    }
+
+    keyframes.push(&keyframes.get(0));
+
+    let options: KeyframeAnimationOptions = Object::new().unchecked_into();
+    options.set_duration(duration.as_millis() as f64);
+    options.set_iterations(f64::INFINITY);
+
+    Ok(Animation { keyframes, options, _images: images })
+}
+
+#[wasm_bindgen]
+extern "C" {
+    type CanvasAnimateExt;
+
+    #[wasm_bindgen(method, js_name = animate)]
+    fn animate_with_keyframe_animation_options(
+        this: &CanvasAnimateExt,
+        keyframes: Option<&Object>,
+        options: &KeyframeAnimationOptions,
+    ) -> WebAnimation;
+
+    #[derive(Debug)]
+    type WebAnimation;
+
+    #[wasm_bindgen(method)]
+    fn cancel(this: &WebAnimation);
+
+    #[wasm_bindgen(method)]
+    fn play(this: &WebAnimation);
+
+    #[wasm_bindgen(extends = Object)]
+    type Keyframe;
+
+    #[wasm_bindgen(method, setter, js_name = cursor)]
+    fn set_cursor(this: &Keyframe, value: &str);
+
+    #[derive(Debug)]
+    #[wasm_bindgen(extends = Object)]
+    type KeyframeAnimationOptions;
+
+    #[wasm_bindgen(method, setter, js_name = duration)]
+    fn set_duration(this: &KeyframeAnimationOptions, value: f64);
+
+    #[wasm_bindgen(method, setter, js_name = iterations)]
+    fn set_iterations(this: &KeyframeAnimationOptions, value: f64);
+}
diff --git a/vendor/winit/src/platform_impl/web/device.rs b/vendor/winit/src/platform_impl/web/device.rs
new file mode 100644
index 00000000..91d08586
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/device.rs
@@ -0,0 +1,8 @@
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct DeviceId(pub i32);
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        Self(0)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/error.rs b/vendor/winit/src/platform_impl/web/error.rs
new file mode 100644
index 00000000..6995f2bc
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/error.rs
@@ -0,0 +1,10 @@
+use std::fmt;
+
+#[derive(Debug)]
+pub struct OsError(pub String);
+
+impl fmt::Display for OsError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/event_loop/mod.rs b/vendor/winit/src/platform_impl/web/event_loop/mod.rs
new file mode 100644
index 00000000..23fe2e00
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/event_loop/mod.rs
@@ -0,0 +1,119 @@
+use std::marker::PhantomData;
+use std::sync::mpsc::{self, Receiver, Sender};
+
+use crate::error::EventLoopError;
+use crate::event::Event;
+use crate::event_loop::ActiveEventLoop as RootActiveEventLoop;
+use crate::platform::web::{ActiveEventLoopExtWebSys, PollStrategy, WaitUntilStrategy};
+
+use super::{backend, device, window};
+
+mod proxy;
+pub(crate) mod runner;
+mod state;
+mod window_target;
+
+pub(crate) use proxy::EventLoopProxy;
+pub(crate) use window_target::{ActiveEventLoop, OwnedDisplayHandle};
+
+pub struct EventLoop<T: 'static> {
+    elw: RootActiveEventLoop,
+    user_event_sender: Sender<T>,
+    user_event_receiver: Receiver<T>,
+}
+
+#[derive(Default, Debug, Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) struct PlatformSpecificEventLoopAttributes {}
+
+impl<T> EventLoop<T> {
+    pub(crate) fn new(_: &PlatformSpecificEventLoopAttributes) -> Result<Self, EventLoopError> {
+        let (user_event_sender, user_event_receiver) = mpsc::channel();
+        let elw = RootActiveEventLoop { p: ActiveEventLoop::new(), _marker: PhantomData };
+        Ok(EventLoop { elw, user_event_sender, user_event_receiver })
+    }
+
+    pub fn run<F>(self, mut event_handler: F) -> !
+    where
+        F: FnMut(Event<T>, &RootActiveEventLoop),
+    {
+        let target = RootActiveEventLoop { p: self.elw.p.clone(), _marker: PhantomData };
+
+        // SAFETY: Don't use `move` to make sure we leak the `event_handler` and `target`.
+        let handler: Box<dyn FnMut(Event<()>)> = Box::new(|event| {
+            let event = match event.map_nonuser_event() {
+                Ok(event) => event,
+                Err(Event::UserEvent(())) => Event::UserEvent(
+                    self.user_event_receiver
+                        .try_recv()
+                        .expect("handler woken up without user event"),
+                ),
+                Err(_) => unreachable!(),
+            };
+            event_handler(event, &target)
+        });
+        // SAFETY: The `transmute` is necessary because `run()` requires `'static`. This is safe
+        // because this function will never return and all resources not cleaned up by the point we
+        // `throw` will leak, making this actually `'static`.
+        let handler = unsafe {
+            std::mem::transmute::<Box<dyn FnMut(Event<()>)>, Box<dyn FnMut(Event<()>) + 'static>>(
+                handler,
+            )
+        };
+        self.elw.p.run(handler, false);
+
+        // Throw an exception to break out of Rust execution and use unreachable to tell the
+        // compiler this function won't return, giving it a return type of '!'
+        backend::throw(
+            "Using exceptions for control flow, don't mind me. This isn't actually an error!",
+        );
+
+        unreachable!();
+    }
+
+    pub fn spawn<F>(self, mut event_handler: F)
+    where
+        F: 'static + FnMut(Event<T>, &RootActiveEventLoop),
+    {
+        let target = RootActiveEventLoop { p: self.elw.p.clone(), _marker: PhantomData };
+
+        self.elw.p.run(
+            Box::new(move |event| {
+                let event = match event.map_nonuser_event() {
+                    Ok(event) => event,
+                    Err(Event::UserEvent(())) => Event::UserEvent(
+                        self.user_event_receiver
+                            .try_recv()
+                            .expect("handler woken up without user event"),
+                    ),
+                    Err(_) => unreachable!(),
+                };
+                event_handler(event, &target)
+            }),
+            true,
+        );
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy::new(self.elw.p.waker(), self.user_event_sender.clone())
+    }
+
+    pub fn window_target(&self) -> &RootActiveEventLoop {
+        &self.elw
+    }
+
+    pub fn set_poll_strategy(&self, strategy: PollStrategy) {
+        self.elw.set_poll_strategy(strategy);
+    }
+
+    pub fn poll_strategy(&self) -> PollStrategy {
+        self.elw.poll_strategy()
+    }
+
+    pub fn set_wait_until_strategy(&self, strategy: WaitUntilStrategy) {
+        self.elw.set_wait_until_strategy(strategy);
+    }
+
+    pub fn wait_until_strategy(&self) -> WaitUntilStrategy {
+        self.elw.wait_until_strategy()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/event_loop/proxy.rs b/vendor/winit/src/platform_impl/web/event_loop/proxy.rs
new file mode 100644
index 00000000..bd8e7146
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/event_loop/proxy.rs
@@ -0,0 +1,29 @@
+use std::rc::Weak;
+use std::sync::mpsc::{SendError, Sender};
+
+use super::runner::Execution;
+use crate::event_loop::EventLoopClosed;
+use crate::platform_impl::platform::r#async::Waker;
+
+pub struct EventLoopProxy<T: 'static> {
+    runner: Waker<Weak<Execution>>,
+    sender: Sender<T>,
+}
+
+impl<T: 'static> EventLoopProxy<T> {
+    pub fn new(runner: Waker<Weak<Execution>>, sender: Sender<T>) -> Self {
+        Self { runner, sender }
+    }
+
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        self.sender.send(event).map_err(|SendError(event)| EventLoopClosed(event))?;
+        self.runner.wake();
+        Ok(())
+    }
+}
+
+impl<T: 'static> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        Self { runner: self.runner.clone(), sender: self.sender.clone() }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/event_loop/runner.rs b/vendor/winit/src/platform_impl/web/event_loop/runner.rs
new file mode 100644
index 00000000..d9ba3d37
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/event_loop/runner.rs
@@ -0,0 +1,808 @@
+use std::cell::{Cell, RefCell};
+use std::collections::{HashSet, VecDeque};
+use std::iter;
+use std::num::NonZeroUsize;
+use std::ops::Deref;
+use std::rc::{Rc, Weak};
+
+use wasm_bindgen::prelude::Closure;
+use wasm_bindgen::JsCast;
+use web_sys::{Document, KeyboardEvent, PageTransitionEvent, PointerEvent, WheelEvent};
+use web_time::{Duration, Instant};
+
+use super::super::main_thread::MainThreadMarker;
+use super::super::DeviceId;
+use super::backend;
+use super::state::State;
+use crate::dpi::PhysicalSize;
+use crate::event::{
+    DeviceEvent, DeviceId as RootDeviceId, ElementState, Event, RawKeyEvent, StartCause,
+    WindowEvent,
+};
+use crate::event_loop::{ControlFlow, DeviceEvents};
+use crate::platform::web::{PollStrategy, WaitUntilStrategy};
+use crate::platform_impl::platform::backend::EventListenerHandle;
+use crate::platform_impl::platform::r#async::{DispatchRunner, Waker, WakerSpawner};
+use crate::platform_impl::platform::window::Inner;
+use crate::window::WindowId;
+
+pub struct Shared(Rc<Execution>);
+
+pub(super) type EventHandler = dyn FnMut(Event<()>);
+
+impl Clone for Shared {
+    fn clone(&self) -> Self {
+        Shared(self.0.clone())
+    }
+}
+
+type OnEventHandle<T> = RefCell<Option<EventListenerHandle<dyn FnMut(T)>>>;
+
+pub struct Execution {
+    main_thread: MainThreadMarker,
+    proxy_spawner: WakerSpawner<Weak<Self>>,
+    control_flow: Cell<ControlFlow>,
+    poll_strategy: Cell<PollStrategy>,
+    wait_until_strategy: Cell<WaitUntilStrategy>,
+    exit: Cell<bool>,
+    runner: RefCell<RunnerEnum>,
+    suspended: Cell<bool>,
+    event_loop_recreation: Cell<bool>,
+    events: RefCell<VecDeque<EventWrapper>>,
+    id: RefCell<u32>,
+    window: web_sys::Window,
+    document: Document,
+    #[allow(clippy::type_complexity)]
+    all_canvases: RefCell<Vec<(WindowId, Weak<RefCell<backend::Canvas>>, DispatchRunner<Inner>)>>,
+    redraw_pending: RefCell<HashSet<WindowId>>,
+    destroy_pending: RefCell<VecDeque<WindowId>>,
+    page_transition_event_handle: RefCell<Option<backend::PageTransitionEventHandle>>,
+    device_events: Cell<DeviceEvents>,
+    on_mouse_move: OnEventHandle<PointerEvent>,
+    on_wheel: OnEventHandle<WheelEvent>,
+    on_mouse_press: OnEventHandle<PointerEvent>,
+    on_mouse_release: OnEventHandle<PointerEvent>,
+    on_key_press: OnEventHandle<KeyboardEvent>,
+    on_key_release: OnEventHandle<KeyboardEvent>,
+    on_visibility_change: OnEventHandle<web_sys::Event>,
+}
+
+enum RunnerEnum {
+    /// The `EventLoop` is created but not being run.
+    Pending,
+    /// The `EventLoop` is being run.
+    Running(Runner),
+    /// The `EventLoop` is exited after being started with `EventLoop::run_app`. Since
+    /// `EventLoop::run_app` takes ownership of the `EventLoop`, we can be certain
+    /// that this event loop will never be run again.
+    Destroyed,
+}
+
+impl RunnerEnum {
+    fn maybe_runner(&self) -> Option<&Runner> {
+        match self {
+            RunnerEnum::Running(runner) => Some(runner),
+            _ => None,
+        }
+    }
+}
+
+struct Runner {
+    state: State,
+    event_handler: Box<EventHandler>,
+}
+
+impl Runner {
+    pub fn new(event_handler: Box<EventHandler>) -> Self {
+        Runner { state: State::Init, event_handler }
+    }
+
+    /// Returns the corresponding `StartCause` for the current `state`, or `None`
+    /// when in `Exit` state.
+    fn maybe_start_cause(&self) -> Option<StartCause> {
+        Some(match self.state {
+            State::Init => StartCause::Init,
+            State::Poll { .. } => StartCause::Poll,
+            State::Wait { start } => StartCause::WaitCancelled { start, requested_resume: None },
+            State::WaitUntil { start, end, .. } => {
+                StartCause::WaitCancelled { start, requested_resume: Some(end) }
+            },
+            State::Exit => return None,
+        })
+    }
+
+    fn handle_single_event(&mut self, runner: &Shared, event: impl Into<EventWrapper>) {
+        match event.into() {
+            EventWrapper::Event(event) => (self.event_handler)(event),
+            EventWrapper::ScaleChange { canvas, size, scale } => {
+                if let Some(canvas) = canvas.upgrade() {
+                    canvas.borrow().handle_scale_change(
+                        runner,
+                        |event| (self.event_handler)(event),
+                        size,
+                        scale,
+                    )
+                }
+            },
+        }
+    }
+}
+
+impl Shared {
+    pub fn new() -> Self {
+        let main_thread = MainThreadMarker::new().expect("only callable from inside the `Window`");
+        #[allow(clippy::disallowed_methods)]
+        let window = web_sys::window().expect("only callable from inside the `Window`");
+        #[allow(clippy::disallowed_methods)]
+        let document = window.document().expect("Failed to obtain document");
+
+        Shared(Rc::<Execution>::new_cyclic(|weak| {
+            let proxy_spawner =
+                WakerSpawner::new(main_thread, weak.clone(), |runner, count, local| {
+                    if let Some(runner) = runner.upgrade() {
+                        Shared(runner).send_user_events(count, local)
+                    }
+                })
+                .expect("`EventLoop` has to be created in the main thread");
+
+            Execution {
+                main_thread,
+                proxy_spawner,
+                control_flow: Cell::new(ControlFlow::default()),
+                poll_strategy: Cell::new(PollStrategy::default()),
+                wait_until_strategy: Cell::new(WaitUntilStrategy::default()),
+                exit: Cell::new(false),
+                runner: RefCell::new(RunnerEnum::Pending),
+                suspended: Cell::new(false),
+                event_loop_recreation: Cell::new(false),
+                events: RefCell::new(VecDeque::new()),
+                window,
+                document,
+                id: RefCell::new(0),
+                all_canvases: RefCell::new(Vec::new()),
+                redraw_pending: RefCell::new(HashSet::new()),
+                destroy_pending: RefCell::new(VecDeque::new()),
+                page_transition_event_handle: RefCell::new(None),
+                device_events: Cell::default(),
+                on_mouse_move: RefCell::new(None),
+                on_wheel: RefCell::new(None),
+                on_mouse_press: RefCell::new(None),
+                on_mouse_release: RefCell::new(None),
+                on_key_press: RefCell::new(None),
+                on_key_release: RefCell::new(None),
+                on_visibility_change: RefCell::new(None),
+            }
+        }))
+    }
+
+    pub fn main_thread(&self) -> MainThreadMarker {
+        self.0.main_thread
+    }
+
+    pub fn window(&self) -> &web_sys::Window {
+        &self.0.window
+    }
+
+    pub fn document(&self) -> &Document {
+        &self.0.document
+    }
+
+    pub fn add_canvas(
+        &self,
+        id: WindowId,
+        canvas: Weak<RefCell<backend::Canvas>>,
+        runner: DispatchRunner<Inner>,
+    ) {
+        self.0.all_canvases.borrow_mut().push((id, canvas, runner));
+    }
+
+    pub fn notify_destroy_window(&self, id: WindowId) {
+        self.0.destroy_pending.borrow_mut().push_back(id);
+    }
+
+    // Set the event callback to use for the event loop runner
+    // This the event callback is a fairly thin layer over the user-provided callback that closes
+    // over a RootActiveEventLoop reference
+    pub fn set_listener(&self, event_handler: Box<EventHandler>) {
+        {
+            let mut runner = self.0.runner.borrow_mut();
+            assert!(matches!(*runner, RunnerEnum::Pending));
+            *runner = RunnerEnum::Running(Runner::new(event_handler));
+        }
+        self.init();
+
+        *self.0.page_transition_event_handle.borrow_mut() = Some(backend::on_page_transition(
+            self.window().clone(),
+            {
+                let runner = self.clone();
+                move |event: PageTransitionEvent| {
+                    if event.persisted() {
+                        runner.0.suspended.set(false);
+                        runner.send_event(Event::Resumed);
+                    }
+                }
+            },
+            {
+                let runner = self.clone();
+                move |event: PageTransitionEvent| {
+                    runner.0.suspended.set(true);
+                    if event.persisted() {
+                        runner.send_event(Event::Suspended);
+                    } else {
+                        runner.handle_unload();
+                    }
+                }
+            },
+        ));
+
+        let runner = self.clone();
+        let window = self.window().clone();
+        *self.0.on_mouse_move.borrow_mut() = Some(EventListenerHandle::new(
+            self.window().clone(),
+            "pointermove",
+            Closure::new(move |event: PointerEvent| {
+                if !runner.device_events() {
+                    return;
+                }
+
+                // chorded button event
+                let device_id = RootDeviceId(DeviceId(event.pointer_id()));
+
+                if let Some(button) = backend::event::mouse_button(&event) {
+                    let state = if backend::event::mouse_buttons(&event).contains(button.into()) {
+                        ElementState::Pressed
+                    } else {
+                        ElementState::Released
+                    };
+
+                    runner.send_event(Event::DeviceEvent {
+                        device_id,
+                        event: DeviceEvent::Button { button: button.to_id(), state },
+                    });
+
+                    return;
+                }
+
+                // pointer move event
+                let mut delta = backend::event::MouseDelta::init(&window, &event);
+                runner.send_events(backend::event::pointer_move_event(event).flat_map(|event| {
+                    let delta = delta.delta(&event).to_physical(backend::scale_factor(&window));
+
+                    let x_motion = (delta.x != 0.0).then_some(Event::DeviceEvent {
+                        device_id,
+                        event: DeviceEvent::Motion { axis: 0, value: delta.x },
+                    });
+
+                    let y_motion = (delta.y != 0.0).then_some(Event::DeviceEvent {
+                        device_id,
+                        event: DeviceEvent::Motion { axis: 1, value: delta.y },
+                    });
+
+                    x_motion.into_iter().chain(y_motion).chain(iter::once(Event::DeviceEvent {
+                        device_id,
+                        event: DeviceEvent::MouseMotion { delta: (delta.x, delta.y) },
+                    }))
+                }));
+            }),
+        ));
+        let runner = self.clone();
+        let window = self.window().clone();
+        *self.0.on_wheel.borrow_mut() = Some(EventListenerHandle::new(
+            self.window().clone(),
+            "wheel",
+            Closure::new(move |event: WheelEvent| {
+                if !runner.device_events() {
+                    return;
+                }
+
+                if let Some(delta) = backend::event::mouse_scroll_delta(&window, &event) {
+                    runner.send_event(Event::DeviceEvent {
+                        device_id: RootDeviceId(DeviceId(0)),
+                        event: DeviceEvent::MouseWheel { delta },
+                    });
+                }
+            }),
+        ));
+        let runner = self.clone();
+        *self.0.on_mouse_press.borrow_mut() = Some(EventListenerHandle::new(
+            self.window().clone(),
+            "pointerdown",
+            Closure::new(move |event: PointerEvent| {
+                if !runner.device_events() {
+                    return;
+                }
+
+                let button = backend::event::mouse_button(&event).expect("no mouse button pressed");
+                runner.send_event(Event::DeviceEvent {
+                    device_id: RootDeviceId(DeviceId(event.pointer_id())),
+                    event: DeviceEvent::Button {
+                        button: button.to_id(),
+                        state: ElementState::Pressed,
+                    },
+                });
+            }),
+        ));
+        let runner = self.clone();
+        *self.0.on_mouse_release.borrow_mut() = Some(EventListenerHandle::new(
+            self.window().clone(),
+            "pointerup",
+            Closure::new(move |event: PointerEvent| {
+                if !runner.device_events() {
+                    return;
+                }
+
+                let button = backend::event::mouse_button(&event).expect("no mouse button pressed");
+                runner.send_event(Event::DeviceEvent {
+                    device_id: RootDeviceId(DeviceId(event.pointer_id())),
+                    event: DeviceEvent::Button {
+                        button: button.to_id(),
+                        state: ElementState::Released,
+                    },
+                });
+            }),
+        ));
+        let runner = self.clone();
+        *self.0.on_key_press.borrow_mut() = Some(EventListenerHandle::new(
+            self.window().clone(),
+            "keydown",
+            Closure::new(move |event: KeyboardEvent| {
+                if !runner.device_events() {
+                    return;
+                }
+
+                runner.send_event(Event::DeviceEvent {
+                    device_id: RootDeviceId(DeviceId::dummy()),
+                    event: DeviceEvent::Key(RawKeyEvent {
+                        physical_key: backend::event::key_code(&event),
+                        state: ElementState::Pressed,
+                    }),
+                });
+            }),
+        ));
+        let runner = self.clone();
+        *self.0.on_key_release.borrow_mut() = Some(EventListenerHandle::new(
+            self.window().clone(),
+            "keyup",
+            Closure::new(move |event: KeyboardEvent| {
+                if !runner.device_events() {
+                    return;
+                }
+
+                runner.send_event(Event::DeviceEvent {
+                    device_id: RootDeviceId(DeviceId::dummy()),
+                    event: DeviceEvent::Key(RawKeyEvent {
+                        physical_key: backend::event::key_code(&event),
+                        state: ElementState::Released,
+                    }),
+                });
+            }),
+        ));
+        let runner = self.clone();
+        *self.0.on_visibility_change.borrow_mut() = Some(EventListenerHandle::new(
+            // Safari <14 doesn't support the `visibilitychange` event on `Window`.
+            self.document().clone(),
+            "visibilitychange",
+            Closure::new(move |_| {
+                if !runner.0.suspended.get() {
+                    for (id, canvas, _) in &*runner.0.all_canvases.borrow() {
+                        if let Some(canvas) = canvas.upgrade() {
+                            let is_visible = backend::is_visible(runner.document());
+                            // only fire if:
+                            // - not visible and intersects
+                            // - not visible and we don't know if it intersects yet
+                            // - visible and intersects
+                            if let (false, Some(true) | None) | (true, Some(true)) =
+                                (is_visible, canvas.borrow().is_intersecting)
+                            {
+                                runner.send_event(Event::WindowEvent {
+                                    window_id: *id,
+                                    event: WindowEvent::Occluded(!is_visible),
+                                });
+                            }
+                        }
+                    }
+                }
+            }),
+        ));
+    }
+
+    // Generate a strictly increasing ID
+    // This is used to differentiate windows when handling events
+    pub fn generate_id(&self) -> u32 {
+        let mut id = self.0.id.borrow_mut();
+        *id += 1;
+
+        *id
+    }
+
+    pub fn request_redraw(&self, id: WindowId) {
+        self.0.redraw_pending.borrow_mut().insert(id);
+        self.send_events::<EventWrapper>(iter::empty());
+    }
+
+    pub fn init(&self) {
+        // NB: For consistency all platforms must emit a 'resumed' event even though web
+        // applications don't themselves have a formal suspend/resume lifecycle.
+        self.run_until_cleared([Event::NewEvents(StartCause::Init), Event::Resumed].into_iter());
+    }
+
+    // Run the polling logic for the Poll ControlFlow, which involves clearing the queue
+    pub fn poll(&self) {
+        let start_cause = Event::NewEvents(StartCause::Poll);
+        self.run_until_cleared(iter::once(start_cause));
+    }
+
+    // Run the logic for waking from a WaitUntil, which involves clearing the queue
+    // Generally there shouldn't be events built up when this is called
+    pub fn resume_time_reached(&self, start: Instant, requested_resume: Instant) {
+        let start_cause =
+            Event::NewEvents(StartCause::ResumeTimeReached { start, requested_resume });
+        self.run_until_cleared(iter::once(start_cause));
+    }
+
+    // Add an event to the event loop runner, from the user or an event handler
+    //
+    // It will determine if the event should be immediately sent to the user or buffered for later
+    pub(crate) fn send_event<E: Into<EventWrapper>>(&self, event: E) {
+        self.send_events(iter::once(event));
+    }
+
+    // Add a series of user events to the event loop runner
+    //
+    // This will schedule the event loop to wake up instead of waking it up immediately if its not
+    // running.
+    pub(crate) fn send_user_events(&self, count: NonZeroUsize, local: bool) {
+        // If the event loop is closed, it should discard any new events
+        if self.is_closed() {
+            return;
+        }
+
+        if local {
+            // If the loop is not running and triggered locally, queue on next microtick.
+            if let Ok(RunnerEnum::Running(_)) =
+                self.0.runner.try_borrow().as_ref().map(Deref::deref)
+            {
+                self.window().queue_microtask(
+                    &Closure::once_into_js({
+                        let this = Rc::downgrade(&self.0);
+                        move || {
+                            if let Some(shared) = this.upgrade() {
+                                Shared(shared).send_events(
+                                    iter::repeat(Event::UserEvent(())).take(count.get()),
+                                )
+                            }
+                        }
+                    })
+                    .unchecked_into(),
+                );
+
+                return;
+            }
+        }
+
+        self.send_events(iter::repeat(Event::UserEvent(())).take(count.get()))
+    }
+
+    // Add a series of events to the event loop runner
+    //
+    // It will determine if the event should be immediately sent to the user or buffered for later
+    pub(crate) fn send_events<E: Into<EventWrapper>>(&self, events: impl IntoIterator<Item = E>) {
+        // If the event loop is closed, it should discard any new events
+        if self.is_closed() {
+            return;
+        }
+        // If we can run the event processing right now, or need to queue this and wait for later
+        let mut process_immediately = true;
+        match self.0.runner.try_borrow().as_ref().map(Deref::deref) {
+            Ok(RunnerEnum::Running(ref runner)) => {
+                // If we're currently polling, queue this and wait for the poll() method to be
+                // called.
+                if let State::Poll { .. } = runner.state {
+                    process_immediately = false;
+                }
+            },
+            Ok(RunnerEnum::Pending) => {
+                // The runner still hasn't been attached: queue this event and wait for it to be
+                process_immediately = false;
+            },
+            // Some other code is mutating the runner, which most likely means
+            // the event loop is running and busy. So we queue this event for
+            // it to be processed later.
+            Err(_) => {
+                process_immediately = false;
+            },
+            // This is unreachable since `self.is_closed() == true`.
+            Ok(RunnerEnum::Destroyed) => unreachable!(),
+        }
+        if !process_immediately {
+            // Queue these events to look at later
+            self.0.events.borrow_mut().extend(events.into_iter().map(Into::into));
+            return;
+        }
+        // At this point, we know this is a fresh set of events
+        // Now we determine why new events are incoming, and handle the events
+        let start_cause = match (self.0.runner.borrow().maybe_runner())
+            .unwrap_or_else(|| {
+                unreachable!("The runner cannot process events when it is not attached")
+            })
+            .maybe_start_cause()
+        {
+            Some(c) => c,
+            // If we're in the exit state, don't do event processing
+            None => return,
+        };
+        // Take the start event, then the events provided to this function, and run an iteration of
+        // the event loop
+        let start_event = Event::NewEvents(start_cause);
+        let events =
+            iter::once(EventWrapper::from(start_event)).chain(events.into_iter().map(Into::into));
+        self.run_until_cleared(events);
+    }
+
+    // Process the destroy-pending windows. This should only be called from
+    // `run_until_cleared`, somewhere between emitting `NewEvents` and `AboutToWait`.
+    fn process_destroy_pending_windows(&self) {
+        while let Some(id) = self.0.destroy_pending.borrow_mut().pop_front() {
+            self.0.all_canvases.borrow_mut().retain(|&(item_id, ..)| item_id != id);
+            self.handle_event(Event::WindowEvent {
+                window_id: id,
+                event: crate::event::WindowEvent::Destroyed,
+            });
+            self.0.redraw_pending.borrow_mut().remove(&id);
+        }
+    }
+
+    // Given the set of new events, run the event loop until the main events and redraw events are
+    // cleared
+    //
+    // This will also process any events that have been queued or that are queued during processing
+    fn run_until_cleared<E: Into<EventWrapper>>(&self, events: impl Iterator<Item = E>) {
+        for event in events {
+            self.handle_event(event.into());
+        }
+        self.process_destroy_pending_windows();
+
+        // Collect all of the redraw events to avoid double-locking the RefCell
+        let redraw_events: Vec<WindowId> = self.0.redraw_pending.borrow_mut().drain().collect();
+        for window_id in redraw_events {
+            self.handle_event(Event::WindowEvent {
+                window_id,
+                event: WindowEvent::RedrawRequested,
+            });
+        }
+
+        self.handle_event(Event::AboutToWait);
+
+        self.apply_control_flow();
+        // If the event loop is closed, it has been closed this iteration and now the closing
+        // event should be emitted
+        if self.is_closed() {
+            self.handle_loop_destroyed();
+        }
+    }
+
+    fn handle_unload(&self) {
+        self.exit();
+        self.apply_control_flow();
+        // We don't call `handle_loop_destroyed` here because we don't need to
+        // perform cleanup when the web browser is going to destroy the page.
+        self.handle_event(Event::LoopExiting);
+    }
+
+    // handle_event takes in events and either queues them or applies a callback
+    //
+    // It should only ever be called from `run_until_cleared`.
+    fn handle_event(&self, event: impl Into<EventWrapper>) {
+        if self.is_closed() {
+            self.exit();
+        }
+        match *self.0.runner.borrow_mut() {
+            RunnerEnum::Running(ref mut runner) => {
+                runner.handle_single_event(self, event);
+            },
+            // If an event is being handled without a runner somehow, add it to the event queue so
+            // it will eventually be processed
+            RunnerEnum::Pending => self.0.events.borrow_mut().push_back(event.into()),
+            // If the Runner has been destroyed, there is nothing to do.
+            RunnerEnum::Destroyed => return,
+        }
+
+        let is_closed = self.exiting();
+
+        // Don't take events out of the queue if the loop is closed or the runner doesn't exist
+        // If the runner doesn't exist and this method recurses, it will recurse infinitely
+        if !is_closed && self.0.runner.borrow().maybe_runner().is_some() {
+            // Pre-fetch window commands to avoid having to wait until the next event loop cycle
+            // and potentially block other threads in the meantime.
+            for (_, window, runner) in self.0.all_canvases.borrow().iter() {
+                if let Some(window) = window.upgrade() {
+                    runner.run();
+                    drop(window)
+                }
+            }
+
+            // Take an event out of the queue and handle it
+            // Make sure not to let the borrow_mut live during the next handle_event
+            let event = {
+                let mut events = self.0.events.borrow_mut();
+
+                // Pre-fetch `UserEvent`s to avoid having to wait until the next event loop cycle.
+                events.extend(
+                    iter::repeat(Event::UserEvent(()))
+                        .take(self.0.proxy_spawner.fetch())
+                        .map(EventWrapper::from),
+                );
+
+                events.pop_front()
+            };
+            if let Some(event) = event {
+                self.handle_event(event);
+            }
+        }
+    }
+
+    // Apply the new ControlFlow that has been selected by the user
+    // Start any necessary timeouts etc
+    fn apply_control_flow(&self) {
+        let new_state = if self.exiting() {
+            State::Exit
+        } else {
+            match self.control_flow() {
+                ControlFlow::Poll => {
+                    let cloned = self.clone();
+                    State::Poll {
+                        _request: backend::Schedule::new(
+                            self.poll_strategy(),
+                            self.window(),
+                            move || cloned.poll(),
+                        ),
+                    }
+                },
+                ControlFlow::Wait => State::Wait { start: Instant::now() },
+                ControlFlow::WaitUntil(end) => {
+                    let start = Instant::now();
+
+                    let delay = if end <= start { Duration::from_millis(0) } else { end - start };
+
+                    let cloned = self.clone();
+
+                    State::WaitUntil {
+                        start,
+                        end,
+                        _timeout: backend::Schedule::new_with_duration(
+                            self.wait_until_strategy(),
+                            self.window(),
+                            move || cloned.resume_time_reached(start, end),
+                            delay,
+                        ),
+                    }
+                },
+            }
+        };
+
+        if let RunnerEnum::Running(ref mut runner) = *self.0.runner.borrow_mut() {
+            runner.state = new_state;
+        }
+    }
+
+    fn handle_loop_destroyed(&self) {
+        self.handle_event(Event::LoopExiting);
+        let all_canvases = std::mem::take(&mut *self.0.all_canvases.borrow_mut());
+        *self.0.page_transition_event_handle.borrow_mut() = None;
+        *self.0.on_mouse_move.borrow_mut() = None;
+        *self.0.on_wheel.borrow_mut() = None;
+        *self.0.on_mouse_press.borrow_mut() = None;
+        *self.0.on_mouse_release.borrow_mut() = None;
+        *self.0.on_key_press.borrow_mut() = None;
+        *self.0.on_key_release.borrow_mut() = None;
+        *self.0.on_visibility_change.borrow_mut() = None;
+        // Dropping the `Runner` drops the event handler closure, which will in
+        // turn drop all `Window`s moved into the closure.
+        *self.0.runner.borrow_mut() = RunnerEnum::Destroyed;
+        for (_, canvas, _) in all_canvases {
+            // In case any remaining `Window`s are still not dropped, we will need
+            // to explicitly remove the event handlers associated with their canvases.
+            if let Some(canvas) = canvas.upgrade() {
+                let mut canvas = canvas.borrow_mut();
+                canvas.remove_listeners();
+            }
+        }
+        // At this point, the `self.0` `Rc` should only be strongly referenced
+        // by the following:
+        // * `self`, i.e. the item which triggered this event loop wakeup, which is usually a
+        //   `wasm-bindgen` `Closure`, which will be dropped after returning to the JS glue code.
+        // * The `ActiveEventLoop` leaked inside `EventLoop::run_app` due to the JS exception thrown
+        //   at the end.
+        // * For each undropped `Window`:
+        //     * The `register_redraw_request` closure.
+        //     * The `destroy_fn` closure.
+        if self.0.event_loop_recreation.get() {
+            crate::event_loop::EventLoopBuilder::<()>::allow_event_loop_recreation();
+        }
+    }
+
+    // Check if the event loop is currently closed
+    fn is_closed(&self) -> bool {
+        match self.0.runner.try_borrow().as_ref().map(Deref::deref) {
+            Ok(RunnerEnum::Running(runner)) => runner.state.exiting(),
+            // The event loop is not closed since it is not initialized.
+            Ok(RunnerEnum::Pending) => false,
+            // The event loop is closed since it has been destroyed.
+            Ok(RunnerEnum::Destroyed) => true,
+            // Some other code is mutating the runner, which most likely means
+            // the event loop is running and busy.
+            Err(_) => false,
+        }
+    }
+
+    pub fn listen_device_events(&self, allowed: DeviceEvents) {
+        self.0.device_events.set(allowed)
+    }
+
+    fn device_events(&self) -> bool {
+        match self.0.device_events.get() {
+            DeviceEvents::Always => true,
+            DeviceEvents::WhenFocused => {
+                self.0.all_canvases.borrow().iter().any(|(_, canvas, _)| {
+                    if let Some(canvas) = canvas.upgrade() {
+                        canvas.borrow().has_focus.get()
+                    } else {
+                        false
+                    }
+                })
+            },
+            DeviceEvents::Never => false,
+        }
+    }
+
+    pub fn event_loop_recreation(&self, allow: bool) {
+        self.0.event_loop_recreation.set(allow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.0.control_flow.get()
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.0.control_flow.set(control_flow)
+    }
+
+    pub(crate) fn exit(&self) {
+        self.0.exit.set(true)
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.0.exit.get()
+    }
+
+    pub(crate) fn set_poll_strategy(&self, strategy: PollStrategy) {
+        self.0.poll_strategy.set(strategy)
+    }
+
+    pub(crate) fn poll_strategy(&self) -> PollStrategy {
+        self.0.poll_strategy.get()
+    }
+
+    pub(crate) fn set_wait_until_strategy(&self, strategy: WaitUntilStrategy) {
+        self.0.wait_until_strategy.set(strategy)
+    }
+
+    pub(crate) fn wait_until_strategy(&self) -> WaitUntilStrategy {
+        self.0.wait_until_strategy.get()
+    }
+
+    pub(crate) fn waker(&self) -> Waker<Weak<Execution>> {
+        self.0.proxy_spawner.waker()
+    }
+}
+
+pub(crate) enum EventWrapper {
+    Event(Event<()>),
+    ScaleChange { canvas: Weak<RefCell<backend::Canvas>>, size: PhysicalSize<u32>, scale: f64 },
+}
+
+impl From<Event<()>> for EventWrapper {
+    fn from(value: Event<()>) -> Self {
+        Self::Event(value)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/event_loop/state.rs b/vendor/winit/src/platform_impl/web/event_loop/state.rs
new file mode 100644
index 00000000..d06e30ed
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/event_loop/state.rs
@@ -0,0 +1,18 @@
+use super::backend;
+
+use web_time::Instant;
+
+#[derive(Debug)]
+pub enum State {
+    Init,
+    WaitUntil { _timeout: backend::Schedule, start: Instant, end: Instant },
+    Wait { start: Instant },
+    Poll { _request: backend::Schedule },
+    Exit,
+}
+
+impl State {
+    pub fn exiting(&self) -> bool {
+        matches!(self, State::Exit)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/event_loop/window_target.rs b/vendor/winit/src/platform_impl/web/event_loop/window_target.rs
new file mode 100644
index 00000000..d741f098
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/event_loop/window_target.rs
@@ -0,0 +1,685 @@
+use std::cell::{Cell, RefCell};
+use std::clone::Clone;
+use std::collections::vec_deque::IntoIter as VecDequeIter;
+use std::collections::VecDeque;
+use std::iter;
+use std::rc::{Rc, Weak};
+
+use web_sys::Element;
+
+use super::super::monitor::MonitorHandle;
+use super::super::KeyEventExtra;
+use super::device::DeviceId;
+use super::runner::{EventWrapper, Execution};
+use super::window::WindowId;
+use super::{backend, runner};
+use crate::event::{
+    DeviceId as RootDeviceId, ElementState, Event, KeyEvent, Touch, TouchPhase, WindowEvent,
+};
+use crate::event_loop::{ControlFlow, DeviceEvents};
+use crate::keyboard::ModifiersState;
+use crate::platform::web::{CustomCursorFuture, PollStrategy, WaitUntilStrategy};
+use crate::platform_impl::platform::cursor::CustomCursor;
+use crate::platform_impl::platform::r#async::Waker;
+use crate::window::{
+    CustomCursor as RootCustomCursor, CustomCursorSource, Theme, WindowId as RootWindowId,
+};
+
+#[derive(Default)]
+struct ModifiersShared(Rc<Cell<ModifiersState>>);
+
+impl ModifiersShared {
+    fn set(&self, new: ModifiersState) {
+        self.0.set(new)
+    }
+
+    fn get(&self) -> ModifiersState {
+        self.0.get()
+    }
+}
+
+impl Clone for ModifiersShared {
+    fn clone(&self) -> Self {
+        Self(Rc::clone(&self.0))
+    }
+}
+
+#[derive(Clone)]
+pub struct ActiveEventLoop {
+    pub(crate) runner: runner::Shared,
+    modifiers: ModifiersShared,
+}
+
+impl ActiveEventLoop {
+    pub fn new() -> Self {
+        Self { runner: runner::Shared::new(), modifiers: ModifiersShared::default() }
+    }
+
+    pub fn run(&self, event_handler: Box<runner::EventHandler>, event_loop_recreation: bool) {
+        self.runner.event_loop_recreation(event_loop_recreation);
+        self.runner.set_listener(event_handler);
+    }
+
+    pub fn generate_id(&self) -> WindowId {
+        WindowId(self.runner.generate_id())
+    }
+
+    pub fn create_custom_cursor(&self, source: CustomCursorSource) -> RootCustomCursor {
+        RootCustomCursor { inner: CustomCursor::new(self, source.inner) }
+    }
+
+    pub fn create_custom_cursor_async(&self, source: CustomCursorSource) -> CustomCursorFuture {
+        CustomCursorFuture(CustomCursor::new_async(self, source.inner))
+    }
+
+    pub fn register(&self, canvas: &Rc<RefCell<backend::Canvas>>, id: WindowId) {
+        let canvas_clone = canvas.clone();
+        let mut canvas = canvas.borrow_mut();
+        #[cfg(any(feature = "rwh_04", feature = "rwh_05"))]
+        canvas.set_attribute("data-raw-handle", &id.0.to_string());
+
+        canvas.on_touch_start();
+
+        let runner = self.runner.clone();
+        let has_focus = canvas.has_focus.clone();
+        let modifiers = self.modifiers.clone();
+        canvas.on_blur(move || {
+            has_focus.set(false);
+
+            let clear_modifiers = (!modifiers.get().is_empty()).then(|| {
+                modifiers.set(ModifiersState::empty());
+                Event::WindowEvent {
+                    window_id: RootWindowId(id),
+                    event: WindowEvent::ModifiersChanged(ModifiersState::empty().into()),
+                }
+            });
+
+            runner.send_events(clear_modifiers.into_iter().chain(iter::once(Event::WindowEvent {
+                window_id: RootWindowId(id),
+                event: WindowEvent::Focused(false),
+            })));
+        });
+
+        let runner = self.runner.clone();
+        let has_focus = canvas.has_focus.clone();
+        canvas.on_focus(move || {
+            if !has_focus.replace(true) {
+                runner.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(id),
+                    event: WindowEvent::Focused(true),
+                });
+            }
+        });
+
+        // It is possible that at this point the canvas has
+        // been focused before the callback can be called.
+        let focused = canvas
+            .document()
+            .active_element()
+            .filter(|element| {
+                let canvas: &Element = canvas.raw();
+                element == canvas
+            })
+            .is_some();
+
+        if focused {
+            canvas.has_focus.set(true);
+            self.runner.send_event(Event::WindowEvent {
+                window_id: RootWindowId(id),
+                event: WindowEvent::Focused(true),
+            })
+        }
+
+        let runner = self.runner.clone();
+        let modifiers = self.modifiers.clone();
+        canvas.on_keyboard_press(
+            move |physical_key, logical_key, text, location, repeat, active_modifiers| {
+                let modifiers_changed = (modifiers.get() != active_modifiers).then(|| {
+                    modifiers.set(active_modifiers);
+                    Event::WindowEvent {
+                        window_id: RootWindowId(id),
+                        event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                    }
+                });
+
+                let device_id = RootDeviceId(DeviceId::dummy());
+
+                runner.send_events(
+                    iter::once(Event::WindowEvent {
+                        window_id: RootWindowId(id),
+                        event: WindowEvent::KeyboardInput {
+                            device_id,
+                            event: KeyEvent {
+                                physical_key,
+                                logical_key,
+                                text,
+                                location,
+                                state: ElementState::Pressed,
+                                repeat,
+                                platform_specific: KeyEventExtra,
+                            },
+                            is_synthetic: false,
+                        },
+                    })
+                    .chain(modifiers_changed),
+                );
+            },
+        );
+
+        let runner = self.runner.clone();
+        let modifiers = self.modifiers.clone();
+        canvas.on_keyboard_release(
+            move |physical_key, logical_key, text, location, repeat, active_modifiers| {
+                let modifiers_changed = (modifiers.get() != active_modifiers).then(|| {
+                    modifiers.set(active_modifiers);
+                    Event::WindowEvent {
+                        window_id: RootWindowId(id),
+                        event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                    }
+                });
+
+                let device_id = RootDeviceId(DeviceId::dummy());
+
+                runner.send_events(
+                    iter::once(Event::WindowEvent {
+                        window_id: RootWindowId(id),
+                        event: WindowEvent::KeyboardInput {
+                            device_id,
+                            event: KeyEvent {
+                                physical_key,
+                                logical_key,
+                                text,
+                                location,
+                                state: ElementState::Released,
+                                repeat,
+                                platform_specific: KeyEventExtra,
+                            },
+                            is_synthetic: false,
+                        },
+                    })
+                    .chain(modifiers_changed),
+                )
+            },
+        );
+
+        let has_focus = canvas.has_focus.clone();
+        canvas.on_cursor_leave({
+            let runner = self.runner.clone();
+            let has_focus = has_focus.clone();
+            let modifiers = self.modifiers.clone();
+
+            move |active_modifiers, pointer_id| {
+                let focus = (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                    modifiers.set(active_modifiers);
+                    Event::WindowEvent {
+                        window_id: RootWindowId(id),
+                        event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                    }
+                });
+
+                let pointer = pointer_id.map(|pointer_id| Event::WindowEvent {
+                    window_id: RootWindowId(id),
+                    event: WindowEvent::CursorLeft {
+                        device_id: RootDeviceId(DeviceId(pointer_id)),
+                    },
+                });
+
+                if focus.is_some() || pointer.is_some() {
+                    runner.send_events(focus.into_iter().chain(pointer))
+                }
+            }
+        });
+
+        canvas.on_cursor_enter({
+            let runner = self.runner.clone();
+            let has_focus = has_focus.clone();
+            let modifiers = self.modifiers.clone();
+
+            move |active_modifiers, pointer_id| {
+                let focus = (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                    modifiers.set(active_modifiers);
+                    Event::WindowEvent {
+                        window_id: RootWindowId(id),
+                        event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                    }
+                });
+
+                let pointer = pointer_id.map(|pointer_id| Event::WindowEvent {
+                    window_id: RootWindowId(id),
+                    event: WindowEvent::CursorEntered {
+                        device_id: RootDeviceId(DeviceId(pointer_id)),
+                    },
+                });
+
+                if focus.is_some() || pointer.is_some() {
+                    runner.send_events(focus.into_iter().chain(pointer))
+                }
+            }
+        });
+
+        canvas.on_cursor_move(
+            {
+                let runner = self.runner.clone();
+                let has_focus = has_focus.clone();
+                let modifiers = self.modifiers.clone();
+
+                move |active_modifiers, pointer_id, events| {
+                    let modifiers =
+                        (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                            modifiers.set(active_modifiers);
+                            Event::WindowEvent {
+                                window_id: RootWindowId(id),
+                                event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                            }
+                        });
+
+                    runner.send_events(modifiers.into_iter().chain(events.flat_map(|position| {
+                        let device_id = RootDeviceId(DeviceId(pointer_id));
+
+                        iter::once(Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::CursorMoved { device_id, position },
+                        })
+                    })));
+                }
+            },
+            {
+                let runner = self.runner.clone();
+                let has_focus = has_focus.clone();
+                let modifiers = self.modifiers.clone();
+
+                move |active_modifiers, device_id, events| {
+                    let modifiers =
+                        (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                            modifiers.set(active_modifiers);
+                            Event::WindowEvent {
+                                window_id: RootWindowId(id),
+                                event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                            }
+                        });
+
+                    runner.send_events(modifiers.into_iter().chain(events.map(
+                        |(location, force)| Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::Touch(Touch {
+                                id: device_id as u64,
+                                device_id: RootDeviceId(DeviceId(device_id)),
+                                phase: TouchPhase::Moved,
+                                force: Some(force),
+                                location,
+                            }),
+                        },
+                    )));
+                }
+            },
+            {
+                let runner = self.runner.clone();
+                let has_focus = has_focus.clone();
+                let modifiers = self.modifiers.clone();
+
+                move |active_modifiers,
+                      pointer_id,
+                      position: crate::dpi::PhysicalPosition<f64>,
+                      buttons,
+                      button| {
+                    let modifiers =
+                        (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                            modifiers.set(active_modifiers);
+                            Event::WindowEvent {
+                                window_id: RootWindowId(id),
+                                event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                            }
+                        });
+
+                    let device_id = RootDeviceId(DeviceId(pointer_id));
+
+                    let state = if buttons.contains(button.into()) {
+                        ElementState::Pressed
+                    } else {
+                        ElementState::Released
+                    };
+
+                    // A chorded button event may come in without any prior CursorMoved events,
+                    // therefore we should send a CursorMoved event to make sure that the
+                    // user code has the correct cursor position.
+                    runner.send_events(modifiers.into_iter().chain([
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::CursorMoved { device_id, position },
+                        },
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::MouseInput { device_id, state, button },
+                        },
+                    ]));
+                }
+            },
+        );
+
+        canvas.on_mouse_press(
+            {
+                let runner = self.runner.clone();
+                let modifiers = self.modifiers.clone();
+
+                move |active_modifiers, pointer_id, position, button| {
+                    let modifiers = (modifiers.get() != active_modifiers).then(|| {
+                        modifiers.set(active_modifiers);
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                        }
+                    });
+
+                    let device_id: RootDeviceId = RootDeviceId(DeviceId(pointer_id));
+
+                    // A mouse down event may come in without any prior CursorMoved events,
+                    // therefore we should send a CursorMoved event to make sure that the
+                    // user code has the correct cursor position.
+                    runner.send_events(modifiers.into_iter().chain([
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::CursorMoved { device_id, position },
+                        },
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::MouseInput {
+                                device_id,
+                                state: ElementState::Pressed,
+                                button,
+                            },
+                        },
+                    ]));
+                }
+            },
+            {
+                let runner = self.runner.clone();
+                let modifiers = self.modifiers.clone();
+
+                move |active_modifiers, device_id, location, force| {
+                    let modifiers = (modifiers.get() != active_modifiers).then(|| {
+                        modifiers.set(active_modifiers);
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                        }
+                    });
+
+                    runner.send_events(modifiers.into_iter().chain(iter::once(
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::Touch(Touch {
+                                id: device_id as u64,
+                                device_id: RootDeviceId(DeviceId(device_id)),
+                                phase: TouchPhase::Started,
+                                force: Some(force),
+                                location,
+                            }),
+                        },
+                    )))
+                }
+            },
+        );
+
+        canvas.on_mouse_release(
+            {
+                let runner = self.runner.clone();
+                let has_focus = has_focus.clone();
+                let modifiers = self.modifiers.clone();
+
+                move |active_modifiers, pointer_id, position, button| {
+                    let modifiers =
+                        (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                            modifiers.set(active_modifiers);
+                            Event::WindowEvent {
+                                window_id: RootWindowId(id),
+                                event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                            }
+                        });
+
+                    let device_id: RootDeviceId = RootDeviceId(DeviceId(pointer_id));
+
+                    // A mouse up event may come in without any prior CursorMoved events,
+                    // therefore we should send a CursorMoved event to make sure that the
+                    // user code has the correct cursor position.
+                    runner.send_events(modifiers.into_iter().chain([
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::CursorMoved { device_id, position },
+                        },
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::MouseInput {
+                                device_id,
+                                state: ElementState::Released,
+                                button,
+                            },
+                        },
+                    ]));
+                }
+            },
+            {
+                let runner_touch = self.runner.clone();
+                let has_focus = has_focus.clone();
+                let modifiers = self.modifiers.clone();
+
+                move |active_modifiers, device_id, location, force| {
+                    let modifiers =
+                        (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                            modifiers.set(active_modifiers);
+                            Event::WindowEvent {
+                                window_id: RootWindowId(id),
+                                event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                            }
+                        });
+
+                    runner_touch.send_events(modifiers.into_iter().chain(iter::once(
+                        Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::Touch(Touch {
+                                id: device_id as u64,
+                                device_id: RootDeviceId(DeviceId(device_id)),
+                                phase: TouchPhase::Ended,
+                                force: Some(force),
+                                location,
+                            }),
+                        },
+                    )));
+                }
+            },
+        );
+
+        let runner = self.runner.clone();
+        let modifiers = self.modifiers.clone();
+        canvas.on_mouse_wheel(move |pointer_id, delta, active_modifiers| {
+            let modifiers_changed =
+                (has_focus.get() && modifiers.get() != active_modifiers).then(|| {
+                    modifiers.set(active_modifiers);
+                    Event::WindowEvent {
+                        window_id: RootWindowId(id),
+                        event: WindowEvent::ModifiersChanged(active_modifiers.into()),
+                    }
+                });
+
+            runner.send_events(modifiers_changed.into_iter().chain(iter::once(
+                Event::WindowEvent {
+                    window_id: RootWindowId(id),
+                    event: WindowEvent::MouseWheel {
+                        device_id: RootDeviceId(DeviceId(pointer_id)),
+                        delta,
+                        phase: TouchPhase::Moved,
+                    },
+                },
+            )));
+        });
+
+        let runner = self.runner.clone();
+        canvas.on_touch_cancel(move |device_id, location, force| {
+            runner.send_event(Event::WindowEvent {
+                window_id: RootWindowId(id),
+                event: WindowEvent::Touch(Touch {
+                    id: device_id as u64,
+                    device_id: RootDeviceId(DeviceId(device_id)),
+                    phase: TouchPhase::Cancelled,
+                    force: Some(force),
+                    location,
+                }),
+            });
+        });
+
+        let runner = self.runner.clone();
+        canvas.on_dark_mode(move |is_dark_mode| {
+            let theme = if is_dark_mode { Theme::Dark } else { Theme::Light };
+            runner.send_event(Event::WindowEvent {
+                window_id: RootWindowId(id),
+                event: WindowEvent::ThemeChanged(theme),
+            });
+        });
+
+        canvas.on_resize_scale(
+            {
+                let runner = self.runner.clone();
+                let canvas = canvas_clone.clone();
+
+                move |size, scale| {
+                    runner.send_event(EventWrapper::ScaleChange {
+                        canvas: Rc::downgrade(&canvas),
+                        size,
+                        scale,
+                    })
+                }
+            },
+            {
+                let runner = self.runner.clone();
+                let canvas = canvas_clone.clone();
+
+                move |new_size| {
+                    let canvas = canvas.borrow();
+                    canvas.set_current_size(new_size);
+                    if canvas.old_size() != new_size {
+                        canvas.set_old_size(new_size);
+                        runner.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(id),
+                            event: WindowEvent::Resized(new_size),
+                        });
+                        canvas.request_animation_frame();
+                    }
+                }
+            },
+        );
+
+        let runner = self.runner.clone();
+        canvas.on_intersection(move |is_intersecting| {
+            // only fire if visible while skipping the first event if it's intersecting
+            if backend::is_visible(runner.document())
+                && !(is_intersecting && canvas_clone.borrow().is_intersecting.is_none())
+            {
+                runner.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(id),
+                    event: WindowEvent::Occluded(!is_intersecting),
+                });
+            }
+
+            canvas_clone.borrow_mut().is_intersecting = Some(is_intersecting);
+        });
+
+        let runner = self.runner.clone();
+        canvas.on_animation_frame(move || runner.request_redraw(RootWindowId(id)));
+
+        canvas.on_context_menu();
+    }
+
+    pub fn available_monitors(&self) -> VecDequeIter<MonitorHandle> {
+        VecDeque::new().into_iter()
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        None
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Web(rwh_05::WebDisplayHandle::empty())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Web(rwh_06::WebDisplayHandle::new()))
+    }
+
+    pub fn listen_device_events(&self, allowed: DeviceEvents) {
+        self.runner.listen_device_events(allowed)
+    }
+
+    pub fn system_theme(&self) -> Option<Theme> {
+        backend::is_dark_mode(self.runner.window()).map(|is_dark_mode| {
+            if is_dark_mode {
+                Theme::Dark
+            } else {
+                Theme::Light
+            }
+        })
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.runner.set_control_flow(control_flow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.runner.control_flow()
+    }
+
+    pub(crate) fn exit(&self) {
+        self.runner.exit()
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.runner.exiting()
+    }
+
+    pub(crate) fn set_poll_strategy(&self, strategy: PollStrategy) {
+        self.runner.set_poll_strategy(strategy)
+    }
+
+    pub(crate) fn poll_strategy(&self) -> PollStrategy {
+        self.runner.poll_strategy()
+    }
+
+    pub(crate) fn set_wait_until_strategy(&self, strategy: WaitUntilStrategy) {
+        self.runner.set_wait_until_strategy(strategy)
+    }
+
+    pub(crate) fn wait_until_strategy(&self) -> WaitUntilStrategy {
+        self.runner.wait_until_strategy()
+    }
+
+    pub(crate) fn waker(&self) -> Waker<Weak<Execution>> {
+        self.runner.waker()
+    }
+
+    pub(crate) fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct OwnedDisplayHandle;
+
+impl OwnedDisplayHandle {
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::WebDisplayHandle::empty().into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::WebDisplayHandle::new().into())
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/keyboard.rs b/vendor/winit/src/platform_impl/web/keyboard.rs
new file mode 100644
index 00000000..6f8d69c7
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/keyboard.rs
@@ -0,0 +1,522 @@
+use smol_str::SmolStr;
+
+use crate::keyboard::{Key, KeyCode, NamedKey, NativeKey, NativeKeyCode, PhysicalKey};
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub(crate) struct KeyEventExtra;
+
+impl Key {
+    pub(crate) fn from_key_attribute_value(kav: &str) -> Self {
+        Key::Named(match kav {
+            "Unidentified" => return Key::Unidentified(NativeKey::Web(SmolStr::new(kav))),
+            "Dead" => return Key::Dead(None),
+            "Alt" => NamedKey::Alt,
+            "AltGraph" => NamedKey::AltGraph,
+            "CapsLock" => NamedKey::CapsLock,
+            "Control" => NamedKey::Control,
+            "Fn" => NamedKey::Fn,
+            "FnLock" => NamedKey::FnLock,
+            "NumLock" => NamedKey::NumLock,
+            "ScrollLock" => NamedKey::ScrollLock,
+            "Shift" => NamedKey::Shift,
+            "Symbol" => NamedKey::Symbol,
+            "SymbolLock" => NamedKey::SymbolLock,
+            "Hyper" => NamedKey::Hyper,
+            "Meta" => NamedKey::Super,
+            "Enter" => NamedKey::Enter,
+            "Tab" => NamedKey::Tab,
+            " " => NamedKey::Space,
+            "ArrowDown" => NamedKey::ArrowDown,
+            "ArrowLeft" => NamedKey::ArrowLeft,
+            "ArrowRight" => NamedKey::ArrowRight,
+            "ArrowUp" => NamedKey::ArrowUp,
+            "End" => NamedKey::End,
+            "Home" => NamedKey::Home,
+            "PageDown" => NamedKey::PageDown,
+            "PageUp" => NamedKey::PageUp,
+            "Backspace" => NamedKey::Backspace,
+            "Clear" => NamedKey::Clear,
+            "Copy" => NamedKey::Copy,
+            "CrSel" => NamedKey::CrSel,
+            "Cut" => NamedKey::Cut,
+            "Delete" => NamedKey::Delete,
+            "EraseEof" => NamedKey::EraseEof,
+            "ExSel" => NamedKey::ExSel,
+            "Insert" => NamedKey::Insert,
+            "Paste" => NamedKey::Paste,
+            "Redo" => NamedKey::Redo,
+            "Undo" => NamedKey::Undo,
+            "Accept" => NamedKey::Accept,
+            "Again" => NamedKey::Again,
+            "Attn" => NamedKey::Attn,
+            "Cancel" => NamedKey::Cancel,
+            "ContextMenu" => NamedKey::ContextMenu,
+            "Escape" => NamedKey::Escape,
+            "Execute" => NamedKey::Execute,
+            "Find" => NamedKey::Find,
+            "Help" => NamedKey::Help,
+            "Pause" => NamedKey::Pause,
+            "Play" => NamedKey::Play,
+            "Props" => NamedKey::Props,
+            "Select" => NamedKey::Select,
+            "ZoomIn" => NamedKey::ZoomIn,
+            "ZoomOut" => NamedKey::ZoomOut,
+            "BrightnessDown" => NamedKey::BrightnessDown,
+            "BrightnessUp" => NamedKey::BrightnessUp,
+            "Eject" => NamedKey::Eject,
+            "LogOff" => NamedKey::LogOff,
+            "Power" => NamedKey::Power,
+            "PowerOff" => NamedKey::PowerOff,
+            "PrintScreen" => NamedKey::PrintScreen,
+            "Hibernate" => NamedKey::Hibernate,
+            "Standby" => NamedKey::Standby,
+            "WakeUp" => NamedKey::WakeUp,
+            "AllCandidates" => NamedKey::AllCandidates,
+            "Alphanumeric" => NamedKey::Alphanumeric,
+            "CodeInput" => NamedKey::CodeInput,
+            "Compose" => NamedKey::Compose,
+            "Convert" => NamedKey::Convert,
+            "FinalMode" => NamedKey::FinalMode,
+            "GroupFirst" => NamedKey::GroupFirst,
+            "GroupLast" => NamedKey::GroupLast,
+            "GroupNext" => NamedKey::GroupNext,
+            "GroupPrevious" => NamedKey::GroupPrevious,
+            "ModeChange" => NamedKey::ModeChange,
+            "NextCandidate" => NamedKey::NextCandidate,
+            "NonConvert" => NamedKey::NonConvert,
+            "PreviousCandidate" => NamedKey::PreviousCandidate,
+            "Process" => NamedKey::Process,
+            "SingleCandidate" => NamedKey::SingleCandidate,
+            "HangulMode" => NamedKey::HangulMode,
+            "HanjaMode" => NamedKey::HanjaMode,
+            "JunjaMode" => NamedKey::JunjaMode,
+            "Eisu" => NamedKey::Eisu,
+            "Hankaku" => NamedKey::Hankaku,
+            "Hiragana" => NamedKey::Hiragana,
+            "HiraganaKatakana" => NamedKey::HiraganaKatakana,
+            "KanaMode" => NamedKey::KanaMode,
+            "KanjiMode" => NamedKey::KanjiMode,
+            "Katakana" => NamedKey::Katakana,
+            "Romaji" => NamedKey::Romaji,
+            "Zenkaku" => NamedKey::Zenkaku,
+            "ZenkakuHankaku" => NamedKey::ZenkakuHankaku,
+            "Soft1" => NamedKey::Soft1,
+            "Soft2" => NamedKey::Soft2,
+            "Soft3" => NamedKey::Soft3,
+            "Soft4" => NamedKey::Soft4,
+            "ChannelDown" => NamedKey::ChannelDown,
+            "ChannelUp" => NamedKey::ChannelUp,
+            "Close" => NamedKey::Close,
+            "MailForward" => NamedKey::MailForward,
+            "MailReply" => NamedKey::MailReply,
+            "MailSend" => NamedKey::MailSend,
+            "MediaClose" => NamedKey::MediaClose,
+            "MediaFastForward" => NamedKey::MediaFastForward,
+            "MediaPause" => NamedKey::MediaPause,
+            "MediaPlay" => NamedKey::MediaPlay,
+            "MediaPlayPause" => NamedKey::MediaPlayPause,
+            "MediaRecord" => NamedKey::MediaRecord,
+            "MediaRewind" => NamedKey::MediaRewind,
+            "MediaStop" => NamedKey::MediaStop,
+            "MediaTrackNext" => NamedKey::MediaTrackNext,
+            "MediaTrackPrevious" => NamedKey::MediaTrackPrevious,
+            "New" => NamedKey::New,
+            "Open" => NamedKey::Open,
+            "Print" => NamedKey::Print,
+            "Save" => NamedKey::Save,
+            "SpellCheck" => NamedKey::SpellCheck,
+            "Key11" => NamedKey::Key11,
+            "Key12" => NamedKey::Key12,
+            "AudioBalanceLeft" => NamedKey::AudioBalanceLeft,
+            "AudioBalanceRight" => NamedKey::AudioBalanceRight,
+            "AudioBassBoostDown" => NamedKey::AudioBassBoostDown,
+            "AudioBassBoostToggle" => NamedKey::AudioBassBoostToggle,
+            "AudioBassBoostUp" => NamedKey::AudioBassBoostUp,
+            "AudioFaderFront" => NamedKey::AudioFaderFront,
+            "AudioFaderRear" => NamedKey::AudioFaderRear,
+            "AudioSurroundModeNext" => NamedKey::AudioSurroundModeNext,
+            "AudioTrebleDown" => NamedKey::AudioTrebleDown,
+            "AudioTrebleUp" => NamedKey::AudioTrebleUp,
+            "AudioVolumeDown" => NamedKey::AudioVolumeDown,
+            "AudioVolumeUp" => NamedKey::AudioVolumeUp,
+            "AudioVolumeMute" => NamedKey::AudioVolumeMute,
+            "MicrophoneToggle" => NamedKey::MicrophoneToggle,
+            "MicrophoneVolumeDown" => NamedKey::MicrophoneVolumeDown,
+            "MicrophoneVolumeUp" => NamedKey::MicrophoneVolumeUp,
+            "MicrophoneVolumeMute" => NamedKey::MicrophoneVolumeMute,
+            "SpeechCorrectionList" => NamedKey::SpeechCorrectionList,
+            "SpeechInputToggle" => NamedKey::SpeechInputToggle,
+            "LaunchApplication1" => NamedKey::LaunchApplication1,
+            "LaunchApplication2" => NamedKey::LaunchApplication2,
+            "LaunchCalendar" => NamedKey::LaunchCalendar,
+            "LaunchContacts" => NamedKey::LaunchContacts,
+            "LaunchMail" => NamedKey::LaunchMail,
+            "LaunchMediaPlayer" => NamedKey::LaunchMediaPlayer,
+            "LaunchMusicPlayer" => NamedKey::LaunchMusicPlayer,
+            "LaunchPhone" => NamedKey::LaunchPhone,
+            "LaunchScreenSaver" => NamedKey::LaunchScreenSaver,
+            "LaunchSpreadsheet" => NamedKey::LaunchSpreadsheet,
+            "LaunchWebBrowser" => NamedKey::LaunchWebBrowser,
+            "LaunchWebCam" => NamedKey::LaunchWebCam,
+            "LaunchWordProcessor" => NamedKey::LaunchWordProcessor,
+            "BrowserBack" => NamedKey::BrowserBack,
+            "BrowserFavorites" => NamedKey::BrowserFavorites,
+            "BrowserForward" => NamedKey::BrowserForward,
+            "BrowserHome" => NamedKey::BrowserHome,
+            "BrowserRefresh" => NamedKey::BrowserRefresh,
+            "BrowserSearch" => NamedKey::BrowserSearch,
+            "BrowserStop" => NamedKey::BrowserStop,
+            "AppSwitch" => NamedKey::AppSwitch,
+            "Call" => NamedKey::Call,
+            "Camera" => NamedKey::Camera,
+            "CameraFocus" => NamedKey::CameraFocus,
+            "EndCall" => NamedKey::EndCall,
+            "GoBack" => NamedKey::GoBack,
+            "GoHome" => NamedKey::GoHome,
+            "HeadsetHook" => NamedKey::HeadsetHook,
+            "LastNumberRedial" => NamedKey::LastNumberRedial,
+            "Notification" => NamedKey::Notification,
+            "MannerMode" => NamedKey::MannerMode,
+            "VoiceDial" => NamedKey::VoiceDial,
+            "TV" => NamedKey::TV,
+            "TV3DMode" => NamedKey::TV3DMode,
+            "TVAntennaCable" => NamedKey::TVAntennaCable,
+            "TVAudioDescription" => NamedKey::TVAudioDescription,
+            "TVAudioDescriptionMixDown" => NamedKey::TVAudioDescriptionMixDown,
+            "TVAudioDescriptionMixUp" => NamedKey::TVAudioDescriptionMixUp,
+            "TVContentsMenu" => NamedKey::TVContentsMenu,
+            "TVDataService" => NamedKey::TVDataService,
+            "TVInput" => NamedKey::TVInput,
+            "TVInputComponent1" => NamedKey::TVInputComponent1,
+            "TVInputComponent2" => NamedKey::TVInputComponent2,
+            "TVInputComposite1" => NamedKey::TVInputComposite1,
+            "TVInputComposite2" => NamedKey::TVInputComposite2,
+            "TVInputHDMI1" => NamedKey::TVInputHDMI1,
+            "TVInputHDMI2" => NamedKey::TVInputHDMI2,
+            "TVInputHDMI3" => NamedKey::TVInputHDMI3,
+            "TVInputHDMI4" => NamedKey::TVInputHDMI4,
+            "TVInputVGA1" => NamedKey::TVInputVGA1,
+            "TVMediaContext" => NamedKey::TVMediaContext,
+            "TVNetwork" => NamedKey::TVNetwork,
+            "TVNumberEntry" => NamedKey::TVNumberEntry,
+            "TVPower" => NamedKey::TVPower,
+            "TVRadioService" => NamedKey::TVRadioService,
+            "TVSatellite" => NamedKey::TVSatellite,
+            "TVSatelliteBS" => NamedKey::TVSatelliteBS,
+            "TVSatelliteCS" => NamedKey::TVSatelliteCS,
+            "TVSatelliteToggle" => NamedKey::TVSatelliteToggle,
+            "TVTerrestrialAnalog" => NamedKey::TVTerrestrialAnalog,
+            "TVTerrestrialDigital" => NamedKey::TVTerrestrialDigital,
+            "TVTimer" => NamedKey::TVTimer,
+            "AVRInput" => NamedKey::AVRInput,
+            "AVRPower" => NamedKey::AVRPower,
+            "ColorF0Red" => NamedKey::ColorF0Red,
+            "ColorF1Green" => NamedKey::ColorF1Green,
+            "ColorF2Yellow" => NamedKey::ColorF2Yellow,
+            "ColorF3Blue" => NamedKey::ColorF3Blue,
+            "ColorF4Grey" => NamedKey::ColorF4Grey,
+            "ColorF5Brown" => NamedKey::ColorF5Brown,
+            "ClosedCaptionToggle" => NamedKey::ClosedCaptionToggle,
+            "Dimmer" => NamedKey::Dimmer,
+            "DisplaySwap" => NamedKey::DisplaySwap,
+            "DVR" => NamedKey::DVR,
+            "Exit" => NamedKey::Exit,
+            "FavoriteClear0" => NamedKey::FavoriteClear0,
+            "FavoriteClear1" => NamedKey::FavoriteClear1,
+            "FavoriteClear2" => NamedKey::FavoriteClear2,
+            "FavoriteClear3" => NamedKey::FavoriteClear3,
+            "FavoriteRecall0" => NamedKey::FavoriteRecall0,
+            "FavoriteRecall1" => NamedKey::FavoriteRecall1,
+            "FavoriteRecall2" => NamedKey::FavoriteRecall2,
+            "FavoriteRecall3" => NamedKey::FavoriteRecall3,
+            "FavoriteStore0" => NamedKey::FavoriteStore0,
+            "FavoriteStore1" => NamedKey::FavoriteStore1,
+            "FavoriteStore2" => NamedKey::FavoriteStore2,
+            "FavoriteStore3" => NamedKey::FavoriteStore3,
+            "Guide" => NamedKey::Guide,
+            "GuideNextDay" => NamedKey::GuideNextDay,
+            "GuidePreviousDay" => NamedKey::GuidePreviousDay,
+            "Info" => NamedKey::Info,
+            "InstantReplay" => NamedKey::InstantReplay,
+            "Link" => NamedKey::Link,
+            "ListProgram" => NamedKey::ListProgram,
+            "LiveContent" => NamedKey::LiveContent,
+            "Lock" => NamedKey::Lock,
+            "MediaApps" => NamedKey::MediaApps,
+            "MediaAudioTrack" => NamedKey::MediaAudioTrack,
+            "MediaLast" => NamedKey::MediaLast,
+            "MediaSkipBackward" => NamedKey::MediaSkipBackward,
+            "MediaSkipForward" => NamedKey::MediaSkipForward,
+            "MediaStepBackward" => NamedKey::MediaStepBackward,
+            "MediaStepForward" => NamedKey::MediaStepForward,
+            "MediaTopMenu" => NamedKey::MediaTopMenu,
+            "NavigateIn" => NamedKey::NavigateIn,
+            "NavigateNext" => NamedKey::NavigateNext,
+            "NavigateOut" => NamedKey::NavigateOut,
+            "NavigatePrevious" => NamedKey::NavigatePrevious,
+            "NextFavoriteChannel" => NamedKey::NextFavoriteChannel,
+            "NextUserProfile" => NamedKey::NextUserProfile,
+            "OnDemand" => NamedKey::OnDemand,
+            "Pairing" => NamedKey::Pairing,
+            "PinPDown" => NamedKey::PinPDown,
+            "PinPMove" => NamedKey::PinPMove,
+            "PinPToggle" => NamedKey::PinPToggle,
+            "PinPUp" => NamedKey::PinPUp,
+            "PlaySpeedDown" => NamedKey::PlaySpeedDown,
+            "PlaySpeedReset" => NamedKey::PlaySpeedReset,
+            "PlaySpeedUp" => NamedKey::PlaySpeedUp,
+            "RandomToggle" => NamedKey::RandomToggle,
+            "RcLowBattery" => NamedKey::RcLowBattery,
+            "RecordSpeedNext" => NamedKey::RecordSpeedNext,
+            "RfBypass" => NamedKey::RfBypass,
+            "ScanChannelsToggle" => NamedKey::ScanChannelsToggle,
+            "ScreenModeNext" => NamedKey::ScreenModeNext,
+            "Settings" => NamedKey::Settings,
+            "SplitScreenToggle" => NamedKey::SplitScreenToggle,
+            "STBInput" => NamedKey::STBInput,
+            "STBPower" => NamedKey::STBPower,
+            "Subtitle" => NamedKey::Subtitle,
+            "Teletext" => NamedKey::Teletext,
+            "VideoModeNext" => NamedKey::VideoModeNext,
+            "Wink" => NamedKey::Wink,
+            "ZoomToggle" => NamedKey::ZoomToggle,
+            "F1" => NamedKey::F1,
+            "F2" => NamedKey::F2,
+            "F3" => NamedKey::F3,
+            "F4" => NamedKey::F4,
+            "F5" => NamedKey::F5,
+            "F6" => NamedKey::F6,
+            "F7" => NamedKey::F7,
+            "F8" => NamedKey::F8,
+            "F9" => NamedKey::F9,
+            "F10" => NamedKey::F10,
+            "F11" => NamedKey::F11,
+            "F12" => NamedKey::F12,
+            "F13" => NamedKey::F13,
+            "F14" => NamedKey::F14,
+            "F15" => NamedKey::F15,
+            "F16" => NamedKey::F16,
+            "F17" => NamedKey::F17,
+            "F18" => NamedKey::F18,
+            "F19" => NamedKey::F19,
+            "F20" => NamedKey::F20,
+            "F21" => NamedKey::F21,
+            "F22" => NamedKey::F22,
+            "F23" => NamedKey::F23,
+            "F24" => NamedKey::F24,
+            "F25" => NamedKey::F25,
+            "F26" => NamedKey::F26,
+            "F27" => NamedKey::F27,
+            "F28" => NamedKey::F28,
+            "F29" => NamedKey::F29,
+            "F30" => NamedKey::F30,
+            "F31" => NamedKey::F31,
+            "F32" => NamedKey::F32,
+            "F33" => NamedKey::F33,
+            "F34" => NamedKey::F34,
+            "F35" => NamedKey::F35,
+            string => return Key::Character(SmolStr::new(string)),
+        })
+    }
+}
+
+impl PhysicalKey {
+    pub fn from_key_code_attribute_value(kcav: &str) -> Self {
+        PhysicalKey::Code(match kcav {
+            "Backquote" => KeyCode::Backquote,
+            "Backslash" => KeyCode::Backslash,
+            "BracketLeft" => KeyCode::BracketLeft,
+            "BracketRight" => KeyCode::BracketRight,
+            "Comma" => KeyCode::Comma,
+            "Digit0" => KeyCode::Digit0,
+            "Digit1" => KeyCode::Digit1,
+            "Digit2" => KeyCode::Digit2,
+            "Digit3" => KeyCode::Digit3,
+            "Digit4" => KeyCode::Digit4,
+            "Digit5" => KeyCode::Digit5,
+            "Digit6" => KeyCode::Digit6,
+            "Digit7" => KeyCode::Digit7,
+            "Digit8" => KeyCode::Digit8,
+            "Digit9" => KeyCode::Digit9,
+            "Equal" => KeyCode::Equal,
+            "IntlBackslash" => KeyCode::IntlBackslash,
+            "IntlRo" => KeyCode::IntlRo,
+            "IntlYen" => KeyCode::IntlYen,
+            "KeyA" => KeyCode::KeyA,
+            "KeyB" => KeyCode::KeyB,
+            "KeyC" => KeyCode::KeyC,
+            "KeyD" => KeyCode::KeyD,
+            "KeyE" => KeyCode::KeyE,
+            "KeyF" => KeyCode::KeyF,
+            "KeyG" => KeyCode::KeyG,
+            "KeyH" => KeyCode::KeyH,
+            "KeyI" => KeyCode::KeyI,
+            "KeyJ" => KeyCode::KeyJ,
+            "KeyK" => KeyCode::KeyK,
+            "KeyL" => KeyCode::KeyL,
+            "KeyM" => KeyCode::KeyM,
+            "KeyN" => KeyCode::KeyN,
+            "KeyO" => KeyCode::KeyO,
+            "KeyP" => KeyCode::KeyP,
+            "KeyQ" => KeyCode::KeyQ,
+            "KeyR" => KeyCode::KeyR,
+            "KeyS" => KeyCode::KeyS,
+            "KeyT" => KeyCode::KeyT,
+            "KeyU" => KeyCode::KeyU,
+            "KeyV" => KeyCode::KeyV,
+            "KeyW" => KeyCode::KeyW,
+            "KeyX" => KeyCode::KeyX,
+            "KeyY" => KeyCode::KeyY,
+            "KeyZ" => KeyCode::KeyZ,
+            "Minus" => KeyCode::Minus,
+            "Period" => KeyCode::Period,
+            "Quote" => KeyCode::Quote,
+            "Semicolon" => KeyCode::Semicolon,
+            "Slash" => KeyCode::Slash,
+            "AltLeft" => KeyCode::AltLeft,
+            "AltRight" => KeyCode::AltRight,
+            "Backspace" => KeyCode::Backspace,
+            "CapsLock" => KeyCode::CapsLock,
+            "ContextMenu" => KeyCode::ContextMenu,
+            "ControlLeft" => KeyCode::ControlLeft,
+            "ControlRight" => KeyCode::ControlRight,
+            "Enter" => KeyCode::Enter,
+            "MetaLeft" => KeyCode::SuperLeft,
+            "MetaRight" => KeyCode::SuperRight,
+            "ShiftLeft" => KeyCode::ShiftLeft,
+            "ShiftRight" => KeyCode::ShiftRight,
+            "Space" => KeyCode::Space,
+            "Tab" => KeyCode::Tab,
+            "Convert" => KeyCode::Convert,
+            "KanaMode" => KeyCode::KanaMode,
+            "Lang1" => KeyCode::Lang1,
+            "Lang2" => KeyCode::Lang2,
+            "Lang3" => KeyCode::Lang3,
+            "Lang4" => KeyCode::Lang4,
+            "Lang5" => KeyCode::Lang5,
+            "NonConvert" => KeyCode::NonConvert,
+            "Delete" => KeyCode::Delete,
+            "End" => KeyCode::End,
+            "Help" => KeyCode::Help,
+            "Home" => KeyCode::Home,
+            "Insert" => KeyCode::Insert,
+            "PageDown" => KeyCode::PageDown,
+            "PageUp" => KeyCode::PageUp,
+            "ArrowDown" => KeyCode::ArrowDown,
+            "ArrowLeft" => KeyCode::ArrowLeft,
+            "ArrowRight" => KeyCode::ArrowRight,
+            "ArrowUp" => KeyCode::ArrowUp,
+            "NumLock" => KeyCode::NumLock,
+            "Numpad0" => KeyCode::Numpad0,
+            "Numpad1" => KeyCode::Numpad1,
+            "Numpad2" => KeyCode::Numpad2,
+            "Numpad3" => KeyCode::Numpad3,
+            "Numpad4" => KeyCode::Numpad4,
+            "Numpad5" => KeyCode::Numpad5,
+            "Numpad6" => KeyCode::Numpad6,
+            "Numpad7" => KeyCode::Numpad7,
+            "Numpad8" => KeyCode::Numpad8,
+            "Numpad9" => KeyCode::Numpad9,
+            "NumpadAdd" => KeyCode::NumpadAdd,
+            "NumpadBackspace" => KeyCode::NumpadBackspace,
+            "NumpadClear" => KeyCode::NumpadClear,
+            "NumpadClearEntry" => KeyCode::NumpadClearEntry,
+            "NumpadComma" => KeyCode::NumpadComma,
+            "NumpadDecimal" => KeyCode::NumpadDecimal,
+            "NumpadDivide" => KeyCode::NumpadDivide,
+            "NumpadEnter" => KeyCode::NumpadEnter,
+            "NumpadEqual" => KeyCode::NumpadEqual,
+            "NumpadHash" => KeyCode::NumpadHash,
+            "NumpadMemoryAdd" => KeyCode::NumpadMemoryAdd,
+            "NumpadMemoryClear" => KeyCode::NumpadMemoryClear,
+            "NumpadMemoryRecall" => KeyCode::NumpadMemoryRecall,
+            "NumpadMemoryStore" => KeyCode::NumpadMemoryStore,
+            "NumpadMemorySubtract" => KeyCode::NumpadMemorySubtract,
+            "NumpadMultiply" => KeyCode::NumpadMultiply,
+            "NumpadParenLeft" => KeyCode::NumpadParenLeft,
+            "NumpadParenRight" => KeyCode::NumpadParenRight,
+            "NumpadStar" => KeyCode::NumpadStar,
+            "NumpadSubtract" => KeyCode::NumpadSubtract,
+            "Escape" => KeyCode::Escape,
+            "Fn" => KeyCode::Fn,
+            "FnLock" => KeyCode::FnLock,
+            "PrintScreen" => KeyCode::PrintScreen,
+            "ScrollLock" => KeyCode::ScrollLock,
+            "Pause" => KeyCode::Pause,
+            "BrowserBack" => KeyCode::BrowserBack,
+            "BrowserFavorites" => KeyCode::BrowserFavorites,
+            "BrowserForward" => KeyCode::BrowserForward,
+            "BrowserHome" => KeyCode::BrowserHome,
+            "BrowserRefresh" => KeyCode::BrowserRefresh,
+            "BrowserSearch" => KeyCode::BrowserSearch,
+            "BrowserStop" => KeyCode::BrowserStop,
+            "Eject" => KeyCode::Eject,
+            "LaunchApp1" => KeyCode::LaunchApp1,
+            "LaunchApp2" => KeyCode::LaunchApp2,
+            "LaunchMail" => KeyCode::LaunchMail,
+            "MediaPlayPause" => KeyCode::MediaPlayPause,
+            "MediaSelect" => KeyCode::MediaSelect,
+            "MediaStop" => KeyCode::MediaStop,
+            "MediaTrackNext" => KeyCode::MediaTrackNext,
+            "MediaTrackPrevious" => KeyCode::MediaTrackPrevious,
+            "Power" => KeyCode::Power,
+            "Sleep" => KeyCode::Sleep,
+            "AudioVolumeDown" => KeyCode::AudioVolumeDown,
+            "AudioVolumeMute" => KeyCode::AudioVolumeMute,
+            "AudioVolumeUp" => KeyCode::AudioVolumeUp,
+            "WakeUp" => KeyCode::WakeUp,
+            "Hyper" => KeyCode::Hyper,
+            "Turbo" => KeyCode::Turbo,
+            "Abort" => KeyCode::Abort,
+            "Resume" => KeyCode::Resume,
+            "Suspend" => KeyCode::Suspend,
+            "Again" => KeyCode::Again,
+            "Copy" => KeyCode::Copy,
+            "Cut" => KeyCode::Cut,
+            "Find" => KeyCode::Find,
+            "Open" => KeyCode::Open,
+            "Paste" => KeyCode::Paste,
+            "Props" => KeyCode::Props,
+            "Select" => KeyCode::Select,
+            "Undo" => KeyCode::Undo,
+            "Hiragana" => KeyCode::Hiragana,
+            "Katakana" => KeyCode::Katakana,
+            "F1" => KeyCode::F1,
+            "F2" => KeyCode::F2,
+            "F3" => KeyCode::F3,
+            "F4" => KeyCode::F4,
+            "F5" => KeyCode::F5,
+            "F6" => KeyCode::F6,
+            "F7" => KeyCode::F7,
+            "F8" => KeyCode::F8,
+            "F9" => KeyCode::F9,
+            "F10" => KeyCode::F10,
+            "F11" => KeyCode::F11,
+            "F12" => KeyCode::F12,
+            "F13" => KeyCode::F13,
+            "F14" => KeyCode::F14,
+            "F15" => KeyCode::F15,
+            "F16" => KeyCode::F16,
+            "F17" => KeyCode::F17,
+            "F18" => KeyCode::F18,
+            "F19" => KeyCode::F19,
+            "F20" => KeyCode::F20,
+            "F21" => KeyCode::F21,
+            "F22" => KeyCode::F22,
+            "F23" => KeyCode::F23,
+            "F24" => KeyCode::F24,
+            "F25" => KeyCode::F25,
+            "F26" => KeyCode::F26,
+            "F27" => KeyCode::F27,
+            "F28" => KeyCode::F28,
+            "F29" => KeyCode::F29,
+            "F30" => KeyCode::F30,
+            "F31" => KeyCode::F31,
+            "F32" => KeyCode::F32,
+            "F33" => KeyCode::F33,
+            "F34" => KeyCode::F34,
+            "F35" => KeyCode::F35,
+            _ => return PhysicalKey::Unidentified(NativeKeyCode::Unidentified),
+        })
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/main_thread.rs b/vendor/winit/src/platform_impl/web/main_thread.rs
new file mode 100644
index 00000000..59a2ac59
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/main_thread.rs
@@ -0,0 +1,96 @@
+use std::fmt::{self, Debug, Formatter};
+use std::marker::PhantomData;
+use std::mem;
+use std::sync::OnceLock;
+
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen::{JsCast, JsValue};
+
+use super::r#async::{self, Sender};
+
+thread_local! {
+    static MAIN_THREAD: bool = {
+        #[wasm_bindgen]
+        extern "C" {
+            #[derive(Clone)]
+            type Global;
+
+            #[wasm_bindgen(method, getter, js_name = Window)]
+            fn window(this: &Global) -> JsValue;
+        }
+
+        let global: Global = js_sys::global().unchecked_into();
+        !global.window().is_undefined()
+    };
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct MainThreadMarker(PhantomData<*const ()>);
+
+impl MainThreadMarker {
+    pub fn new() -> Option<Self> {
+        MAIN_THREAD.with(|is| is.then_some(Self(PhantomData)))
+    }
+}
+
+pub struct MainThreadSafe<T: 'static>(Option<T>);
+
+impl<T> MainThreadSafe<T> {
+    pub fn new(_: MainThreadMarker, value: T) -> Self {
+        DROP_HANDLER.get_or_init(|| {
+            let (sender, receiver) = r#async::channel();
+            wasm_bindgen_futures::spawn_local(
+                async move { while receiver.next().await.is_ok() {} },
+            );
+
+            sender
+        });
+
+        Self(Some(value))
+    }
+
+    pub fn into_inner(mut self, _: MainThreadMarker) -> T {
+        self.0.take().expect("already taken or dropped")
+    }
+
+    pub fn get(&self, _: MainThreadMarker) -> &T {
+        self.0.as_ref().expect("already taken or dropped")
+    }
+}
+
+impl<T: Debug> Debug for MainThreadSafe<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        if MainThreadMarker::new().is_some() {
+            f.debug_tuple("MainThreadSafe").field(&self.0).finish()
+        } else {
+            f.debug_struct("MainThreadSafe").finish_non_exhaustive()
+        }
+    }
+}
+
+impl<T> Drop for MainThreadSafe<T> {
+    fn drop(&mut self) {
+        if let Some(value) = self.0.take() {
+            if mem::needs_drop::<T>() && MainThreadMarker::new().is_none() {
+                DROP_HANDLER
+                    .get()
+                    .expect("drop handler not initialized when setting canvas")
+                    .send(DropBox(Box::new(value)))
+                    .expect("sender dropped in main thread")
+            }
+        }
+    }
+}
+
+unsafe impl<T> Send for MainThreadSafe<T> {}
+unsafe impl<T> Sync for MainThreadSafe<T> {}
+
+static DROP_HANDLER: OnceLock<Sender<DropBox>> = OnceLock::new();
+
+struct DropBox(#[allow(dead_code)] Box<dyn Any>);
+
+unsafe impl Send for DropBox {}
+unsafe impl Sync for DropBox {}
+
+trait Any {}
+impl<T> Any for T {}
diff --git a/vendor/winit/src/platform_impl/web/mod.rs b/vendor/winit/src/platform_impl/web/mod.rs
new file mode 100644
index 00000000..969d8bb1
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/mod.rs
@@ -0,0 +1,50 @@
+// Brief introduction to the internals of the web backend:
+// The web backend used to support both wasm-bindgen and stdweb as methods of binding to the
+// environment. Because they are both supporting the same underlying APIs, the actual web bindings
+// are cordoned off into backend abstractions, which present the thinnest unifying layer possible.
+//
+// When adding support for new events or interactions with the browser, first consult trusted
+// documentation (such as MDN) to ensure it is well-standardised and supported across many browsers.
+// Once you have decided on the relevant web APIs, add support to both backends.
+//
+// The backend is used by the rest of the module to implement Winit's business logic, which forms
+// the rest of the code. 'device', 'error', 'monitor', and 'window' define web-specific structures
+// for winit's cross-platform structures. They are all relatively simple translations.
+//
+// The event_loop module handles listening for and processing events. 'Proxy' implements
+// EventLoopProxy and 'WindowTarget' implements ActiveEventLoop. WindowTarget also handles
+// registering the event handlers. The 'Execution' struct in the 'runner' module handles taking
+// incoming events (from the registered handlers) and ensuring they are passed to the user in a
+// compliant way.
+
+// TODO: FP, remove when <https://github.com/rust-lang/rust-clippy/issues/12377> is fixed.
+#![allow(clippy::empty_docs)]
+
+mod r#async;
+mod cursor;
+mod device;
+mod error;
+mod event_loop;
+mod keyboard;
+mod main_thread;
+mod monitor;
+mod web_sys;
+mod window;
+
+pub use self::device::DeviceId;
+pub use self::error::OsError;
+pub(crate) use self::event_loop::{
+    ActiveEventLoop, EventLoop, EventLoopProxy, OwnedDisplayHandle,
+    PlatformSpecificEventLoopAttributes,
+};
+pub use self::monitor::{MonitorHandle, VideoModeHandle};
+pub use self::window::{PlatformSpecificWindowAttributes, Window, WindowId};
+
+pub(crate) use self::keyboard::KeyEventExtra;
+use self::web_sys as backend;
+pub(crate) use crate::icon::NoIcon as PlatformIcon;
+pub(crate) use crate::platform_impl::Fullscreen;
+pub(crate) use cursor::{
+    CustomCursor as PlatformCustomCursor, CustomCursorFuture,
+    CustomCursorSource as PlatformCustomCursorSource,
+};
diff --git a/vendor/winit/src/platform_impl/web/monitor.rs b/vendor/winit/src/platform_impl/web/monitor.rs
new file mode 100644
index 00000000..1870284a
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/monitor.rs
@@ -0,0 +1,53 @@
+use std::iter::Empty;
+
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct MonitorHandle;
+
+impl MonitorHandle {
+    pub fn scale_factor(&self) -> f64 {
+        unreachable!()
+    }
+
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        unreachable!()
+    }
+
+    pub fn name(&self) -> Option<String> {
+        unreachable!()
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        unreachable!()
+    }
+
+    pub fn size(&self) -> PhysicalSize<u32> {
+        unreachable!()
+    }
+
+    pub fn video_modes(&self) -> Empty<VideoModeHandle> {
+        unreachable!()
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct VideoModeHandle;
+
+impl VideoModeHandle {
+    pub fn size(&self) -> PhysicalSize<u32> {
+        unreachable!();
+    }
+
+    pub fn bit_depth(&self) -> u16 {
+        unreachable!();
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        unreachable!();
+    }
+
+    pub fn monitor(&self) -> MonitorHandle {
+        unreachable!();
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/animation_frame.rs b/vendor/winit/src/platform_impl/web/web_sys/animation_frame.rs
new file mode 100644
index 00000000..17aa8f68
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/animation_frame.rs
@@ -0,0 +1,60 @@
+use std::cell::Cell;
+use std::rc::Rc;
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen::JsCast;
+
+pub struct AnimationFrameHandler {
+    window: web_sys::Window,
+    closure: Closure<dyn FnMut()>,
+    handle: Rc<Cell<Option<i32>>>,
+}
+
+impl AnimationFrameHandler {
+    pub fn new(window: web_sys::Window) -> Self {
+        let handle = Rc::new(Cell::new(None));
+        let closure = Closure::new({
+            let handle = handle.clone();
+            move || handle.set(None)
+        });
+
+        Self { window, closure, handle }
+    }
+
+    pub fn on_animation_frame<F>(&mut self, mut f: F)
+    where
+        F: 'static + FnMut(),
+    {
+        let handle = self.handle.clone();
+        self.closure = Closure::new(move || {
+            handle.set(None);
+            f();
+        })
+    }
+
+    pub fn request(&self) {
+        if let Some(handle) = self.handle.take() {
+            self.window.cancel_animation_frame(handle).expect("Failed to cancel animation frame");
+        }
+
+        let handle = self
+            .window
+            .request_animation_frame(self.closure.as_ref().unchecked_ref())
+            .expect("Failed to request animation frame");
+
+        self.handle.set(Some(handle));
+    }
+
+    pub fn cancel(&mut self) {
+        if let Some(handle) = self.handle.take() {
+            self.window.cancel_animation_frame(handle).expect("Failed to cancel animation frame");
+        }
+    }
+}
+
+impl Drop for AnimationFrameHandler {
+    fn drop(&mut self) {
+        if let Some(handle) = self.handle.take() {
+            self.window.cancel_animation_frame(handle).expect("Failed to cancel animation frame");
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/canvas.rs b/vendor/winit/src/platform_impl/web/web_sys/canvas.rs
new file mode 100644
index 00000000..84dde9f7
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/canvas.rs
@@ -0,0 +1,565 @@
+use std::cell::Cell;
+use std::ops::Deref;
+use std::rc::Rc;
+use std::sync::{Arc, Mutex};
+
+use smol_str::SmolStr;
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen::JsCast;
+use web_sys::{
+    CssStyleDeclaration, Document, Event, FocusEvent, HtmlCanvasElement, KeyboardEvent,
+    PointerEvent, WheelEvent,
+};
+
+use crate::dpi::{LogicalPosition, PhysicalPosition, PhysicalSize};
+use crate::error::OsError as RootOE;
+use crate::event::{Force, InnerSizeWriter, MouseButton, MouseScrollDelta};
+use crate::keyboard::{Key, KeyLocation, ModifiersState, PhysicalKey};
+use crate::platform_impl::OsError;
+use crate::window::{WindowAttributes, WindowId as RootWindowId};
+
+use super::super::cursor::CursorHandler;
+use super::super::main_thread::MainThreadMarker;
+use super::super::WindowId;
+use super::animation_frame::AnimationFrameHandler;
+use super::event_handle::EventListenerHandle;
+use super::intersection_handle::IntersectionObserverHandle;
+use super::media_query_handle::MediaQueryListHandle;
+use super::pointer::PointerHandler;
+use super::{event, fullscreen, ButtonsState, ResizeScaleHandle};
+
+#[allow(dead_code)]
+pub struct Canvas {
+    common: Common,
+    id: WindowId,
+    pub has_focus: Rc<Cell<bool>>,
+    pub prevent_default: Rc<Cell<bool>>,
+    pub is_intersecting: Option<bool>,
+    on_touch_start: Option<EventListenerHandle<dyn FnMut(Event)>>,
+    on_focus: Option<EventListenerHandle<dyn FnMut(FocusEvent)>>,
+    on_blur: Option<EventListenerHandle<dyn FnMut(FocusEvent)>>,
+    on_keyboard_release: Option<EventListenerHandle<dyn FnMut(KeyboardEvent)>>,
+    on_keyboard_press: Option<EventListenerHandle<dyn FnMut(KeyboardEvent)>>,
+    on_mouse_wheel: Option<EventListenerHandle<dyn FnMut(WheelEvent)>>,
+    on_dark_mode: Option<MediaQueryListHandle>,
+    pointer_handler: PointerHandler,
+    on_resize_scale: Option<ResizeScaleHandle>,
+    on_intersect: Option<IntersectionObserverHandle>,
+    animation_frame_handler: AnimationFrameHandler,
+    on_touch_end: Option<EventListenerHandle<dyn FnMut(Event)>>,
+    on_context_menu: Option<EventListenerHandle<dyn FnMut(PointerEvent)>>,
+    pub cursor: CursorHandler,
+}
+
+pub struct Common {
+    pub window: web_sys::Window,
+    pub document: Document,
+    /// Note: resizing the HTMLCanvasElement should go through `backend::set_canvas_size` to ensure
+    /// the DPI factor is maintained. Note: this is read-only because we use a pointer to this
+    /// for [`WindowHandle`][rwh_06::WindowHandle].
+    raw: Rc<HtmlCanvasElement>,
+    style: Style,
+    old_size: Rc<Cell<PhysicalSize<u32>>>,
+    current_size: Rc<Cell<PhysicalSize<u32>>>,
+}
+
+#[derive(Clone, Debug)]
+pub struct Style {
+    read: CssStyleDeclaration,
+    write: CssStyleDeclaration,
+}
+
+impl Canvas {
+    pub(crate) fn create(
+        main_thread: MainThreadMarker,
+        id: WindowId,
+        window: web_sys::Window,
+        document: Document,
+        attr: &mut WindowAttributes,
+    ) -> Result<Self, RootOE> {
+        let canvas = match attr.platform_specific.canvas.take().map(|canvas| {
+            Arc::try_unwrap(canvas)
+                .map(|canvas| canvas.into_inner(main_thread))
+                .unwrap_or_else(|canvas| canvas.get(main_thread).clone())
+        }) {
+            Some(canvas) => canvas,
+            None => document
+                .create_element("canvas")
+                .map_err(|_| os_error!(OsError("Failed to create canvas element".to_owned())))?
+                .unchecked_into(),
+        };
+
+        if attr.platform_specific.append && !document.contains(Some(&canvas)) {
+            document
+                .body()
+                .expect("Failed to get body from document")
+                .append_child(&canvas)
+                .expect("Failed to append canvas to body");
+        }
+
+        // A tabindex is needed in order to capture local keyboard events.
+        // A "0" value means that the element should be focusable in
+        // sequential keyboard navigation, but its order is defined by the
+        // document's source order.
+        // https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/tabindex
+        if attr.platform_specific.focusable {
+            canvas
+                .set_attribute("tabindex", "0")
+                .map_err(|_| os_error!(OsError("Failed to set a tabindex".to_owned())))?;
+        }
+
+        let style = Style::new(&window, &canvas);
+
+        let cursor = CursorHandler::new(main_thread, canvas.clone(), style.clone());
+
+        let common = Common {
+            window: window.clone(),
+            document: document.clone(),
+            raw: Rc::new(canvas.clone()),
+            style,
+            old_size: Rc::default(),
+            current_size: Rc::default(),
+        };
+
+        if let Some(size) = attr.inner_size {
+            let size = size.to_logical(super::scale_factor(&common.window));
+            super::set_canvas_size(&common.document, &common.raw, &common.style, size);
+        }
+
+        if let Some(size) = attr.min_inner_size {
+            let size = size.to_logical(super::scale_factor(&common.window));
+            super::set_canvas_min_size(&common.document, &common.raw, &common.style, Some(size));
+        }
+
+        if let Some(size) = attr.max_inner_size {
+            let size = size.to_logical(super::scale_factor(&common.window));
+            super::set_canvas_max_size(&common.document, &common.raw, &common.style, Some(size));
+        }
+
+        if let Some(position) = attr.position {
+            let position = position.to_logical(super::scale_factor(&common.window));
+            super::set_canvas_position(&common.document, &common.raw, &common.style, position);
+        }
+
+        if attr.fullscreen.is_some() {
+            fullscreen::request_fullscreen(&document, &canvas);
+        }
+
+        if attr.active {
+            let _ = common.raw.focus();
+        }
+
+        Ok(Canvas {
+            common,
+            id,
+            has_focus: Rc::new(Cell::new(false)),
+            prevent_default: Rc::new(Cell::new(attr.platform_specific.prevent_default)),
+            is_intersecting: None,
+            on_touch_start: None,
+            on_blur: None,
+            on_focus: None,
+            on_keyboard_release: None,
+            on_keyboard_press: None,
+            on_mouse_wheel: None,
+            on_dark_mode: None,
+            pointer_handler: PointerHandler::new(),
+            on_resize_scale: None,
+            on_intersect: None,
+            animation_frame_handler: AnimationFrameHandler::new(window),
+            on_touch_end: None,
+            on_context_menu: None,
+            cursor,
+        })
+    }
+
+    pub fn set_cursor_lock(&self, lock: bool) -> Result<(), RootOE> {
+        if lock {
+            self.raw().request_pointer_lock();
+        } else {
+            self.common.document.exit_pointer_lock();
+        }
+        Ok(())
+    }
+
+    pub fn set_attribute(&self, attribute: &str, value: &str) {
+        self.common
+            .raw
+            .set_attribute(attribute, value)
+            .unwrap_or_else(|err| panic!("error: {err:?}\nSet attribute: {attribute}"))
+    }
+
+    pub fn position(&self) -> LogicalPosition<f64> {
+        let bounds = self.common.raw.get_bounding_client_rect();
+        let mut position = LogicalPosition { x: bounds.x(), y: bounds.y() };
+
+        if self.document().contains(Some(self.raw())) && self.style().get("display") != "none" {
+            position.x += super::style_size_property(self.style(), "border-left-width")
+                + super::style_size_property(self.style(), "padding-left");
+            position.y += super::style_size_property(self.style(), "border-top-width")
+                + super::style_size_property(self.style(), "padding-top");
+        }
+
+        position
+    }
+
+    #[inline]
+    pub fn old_size(&self) -> PhysicalSize<u32> {
+        self.common.old_size.get()
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        self.common.current_size.get()
+    }
+
+    #[inline]
+    pub fn set_old_size(&self, size: PhysicalSize<u32>) {
+        self.common.old_size.set(size)
+    }
+
+    #[inline]
+    pub fn set_current_size(&self, size: PhysicalSize<u32>) {
+        self.common.current_size.set(size)
+    }
+
+    #[inline]
+    pub fn window(&self) -> &web_sys::Window {
+        &self.common.window
+    }
+
+    #[inline]
+    pub fn document(&self) -> &Document {
+        &self.common.document
+    }
+
+    #[inline]
+    pub fn raw(&self) -> &HtmlCanvasElement {
+        &self.common.raw
+    }
+
+    #[inline]
+    pub fn style(&self) -> &Style {
+        &self.common.style
+    }
+
+    pub fn on_touch_start(&mut self) {
+        let prevent_default = Rc::clone(&self.prevent_default);
+        self.on_touch_start = Some(self.common.add_event("touchstart", move |event: Event| {
+            if prevent_default.get() {
+                event.prevent_default();
+            }
+        }));
+    }
+
+    pub fn on_blur<F>(&mut self, mut handler: F)
+    where
+        F: 'static + FnMut(),
+    {
+        self.on_blur = Some(self.common.add_event("blur", move |_: FocusEvent| {
+            handler();
+        }));
+    }
+
+    pub fn on_focus<F>(&mut self, mut handler: F)
+    where
+        F: 'static + FnMut(),
+    {
+        self.on_focus = Some(self.common.add_event("focus", move |_: FocusEvent| {
+            handler();
+        }));
+    }
+
+    pub fn on_keyboard_release<F>(&mut self, mut handler: F)
+    where
+        F: 'static + FnMut(PhysicalKey, Key, Option<SmolStr>, KeyLocation, bool, ModifiersState),
+    {
+        let prevent_default = Rc::clone(&self.prevent_default);
+        self.on_keyboard_release =
+            Some(self.common.add_event("keyup", move |event: KeyboardEvent| {
+                if prevent_default.get() {
+                    event.prevent_default();
+                }
+                let key = event::key(&event);
+                let modifiers = event::keyboard_modifiers(&event);
+                handler(
+                    event::key_code(&event),
+                    key,
+                    event::key_text(&event),
+                    event::key_location(&event),
+                    event.repeat(),
+                    modifiers,
+                );
+            }));
+    }
+
+    pub fn on_keyboard_press<F>(&mut self, mut handler: F)
+    where
+        F: 'static + FnMut(PhysicalKey, Key, Option<SmolStr>, KeyLocation, bool, ModifiersState),
+    {
+        let prevent_default = Rc::clone(&self.prevent_default);
+        self.on_keyboard_press =
+            Some(self.common.add_event("keydown", move |event: KeyboardEvent| {
+                if prevent_default.get() {
+                    event.prevent_default();
+                }
+                let key = event::key(&event);
+                let modifiers = event::keyboard_modifiers(&event);
+                handler(
+                    event::key_code(&event),
+                    key,
+                    event::key_text(&event),
+                    event::key_location(&event),
+                    event.repeat(),
+                    modifiers,
+                );
+            }));
+    }
+
+    pub fn on_cursor_leave<F>(&mut self, handler: F)
+    where
+        F: 'static + FnMut(ModifiersState, Option<i32>),
+    {
+        self.pointer_handler.on_cursor_leave(&self.common, handler)
+    }
+
+    pub fn on_cursor_enter<F>(&mut self, handler: F)
+    where
+        F: 'static + FnMut(ModifiersState, Option<i32>),
+    {
+        self.pointer_handler.on_cursor_enter(&self.common, handler)
+    }
+
+    pub fn on_mouse_release<M, T>(&mut self, mouse_handler: M, touch_handler: T)
+    where
+        M: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, MouseButton),
+        T: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, Force),
+    {
+        self.pointer_handler.on_mouse_release(&self.common, mouse_handler, touch_handler)
+    }
+
+    pub fn on_mouse_press<M, T>(&mut self, mouse_handler: M, touch_handler: T)
+    where
+        M: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, MouseButton),
+        T: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, Force),
+    {
+        self.pointer_handler.on_mouse_press(
+            &self.common,
+            mouse_handler,
+            touch_handler,
+            Rc::clone(&self.prevent_default),
+        )
+    }
+
+    pub fn on_cursor_move<M, T, B>(&mut self, mouse_handler: M, touch_handler: T, button_handler: B)
+    where
+        M: 'static + FnMut(ModifiersState, i32, &mut dyn Iterator<Item = PhysicalPosition<f64>>),
+        T: 'static
+            + FnMut(ModifiersState, i32, &mut dyn Iterator<Item = (PhysicalPosition<f64>, Force)>),
+        B: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, ButtonsState, MouseButton),
+    {
+        self.pointer_handler.on_cursor_move(
+            &self.common,
+            mouse_handler,
+            touch_handler,
+            button_handler,
+            Rc::clone(&self.prevent_default),
+        )
+    }
+
+    pub fn on_touch_cancel<F>(&mut self, handler: F)
+    where
+        F: 'static + FnMut(i32, PhysicalPosition<f64>, Force),
+    {
+        self.pointer_handler.on_touch_cancel(&self.common, handler)
+    }
+
+    pub fn on_mouse_wheel<F>(&mut self, mut handler: F)
+    where
+        F: 'static + FnMut(i32, MouseScrollDelta, ModifiersState),
+    {
+        let window = self.common.window.clone();
+        let prevent_default = Rc::clone(&self.prevent_default);
+        self.on_mouse_wheel = Some(self.common.add_event("wheel", move |event: WheelEvent| {
+            if prevent_default.get() {
+                event.prevent_default();
+            }
+
+            if let Some(delta) = event::mouse_scroll_delta(&window, &event) {
+                let modifiers = event::mouse_modifiers(&event);
+                handler(0, delta, modifiers);
+            }
+        }));
+    }
+
+    pub fn on_dark_mode<F>(&mut self, mut handler: F)
+    where
+        F: 'static + FnMut(bool),
+    {
+        self.on_dark_mode = Some(MediaQueryListHandle::new(
+            &self.common.window,
+            "(prefers-color-scheme: dark)",
+            move |mql| handler(mql.matches()),
+        ));
+    }
+
+    pub(crate) fn on_resize_scale<S, R>(&mut self, scale_handler: S, size_handler: R)
+    where
+        S: 'static + Fn(PhysicalSize<u32>, f64),
+        R: 'static + Fn(PhysicalSize<u32>),
+    {
+        self.on_resize_scale = Some(ResizeScaleHandle::new(
+            self.window().clone(),
+            self.document().clone(),
+            self.raw().clone(),
+            self.style().clone(),
+            scale_handler,
+            size_handler,
+        ));
+    }
+
+    pub(crate) fn on_intersection<F>(&mut self, handler: F)
+    where
+        F: 'static + FnMut(bool),
+    {
+        self.on_intersect = Some(IntersectionObserverHandle::new(self.raw(), handler));
+    }
+
+    pub(crate) fn on_animation_frame<F>(&mut self, f: F)
+    where
+        F: 'static + FnMut(),
+    {
+        self.animation_frame_handler.on_animation_frame(f)
+    }
+
+    pub(crate) fn on_context_menu(&mut self) {
+        let prevent_default = Rc::clone(&self.prevent_default);
+        self.on_context_menu =
+            Some(self.common.add_event("contextmenu", move |event: PointerEvent| {
+                if prevent_default.get() {
+                    event.prevent_default();
+                }
+            }));
+    }
+
+    pub fn request_fullscreen(&self) {
+        fullscreen::request_fullscreen(self.document(), self.raw());
+    }
+
+    pub fn exit_fullscreen(&self) {
+        fullscreen::exit_fullscreen(self.document(), self.raw());
+    }
+
+    pub fn is_fullscreen(&self) -> bool {
+        fullscreen::is_fullscreen(self.document(), self.raw())
+    }
+
+    pub fn request_animation_frame(&self) {
+        self.animation_frame_handler.request();
+    }
+
+    pub(crate) fn handle_scale_change(
+        &self,
+        runner: &super::super::event_loop::runner::Shared,
+        event_handler: impl FnOnce(crate::event::Event<()>),
+        current_size: PhysicalSize<u32>,
+        scale: f64,
+    ) {
+        // First, we send the `ScaleFactorChanged` event:
+        self.set_current_size(current_size);
+        let new_size = {
+            let new_size = Arc::new(Mutex::new(current_size));
+            event_handler(crate::event::Event::WindowEvent {
+                window_id: RootWindowId(self.id),
+                event: crate::event::WindowEvent::ScaleFactorChanged {
+                    scale_factor: scale,
+                    inner_size_writer: InnerSizeWriter::new(Arc::downgrade(&new_size)),
+                },
+            });
+
+            let new_size = *new_size.lock().unwrap();
+            new_size
+        };
+
+        if current_size != new_size {
+            // Then we resize the canvas to the new size, a new
+            // `Resized` event will be sent by the `ResizeObserver`:
+            let new_size = new_size.to_logical(scale);
+            super::set_canvas_size(self.document(), self.raw(), self.style(), new_size);
+
+            // Set the size might not trigger the event because the calculation is inaccurate.
+            self.on_resize_scale
+                .as_ref()
+                .expect("expected Window to still be active")
+                .notify_resize();
+        } else if self.old_size() != new_size {
+            // Then we at least send a resized event.
+            self.set_old_size(new_size);
+            runner.send_event(crate::event::Event::WindowEvent {
+                window_id: RootWindowId(self.id),
+                event: crate::event::WindowEvent::Resized(new_size),
+            })
+        }
+    }
+
+    pub fn remove_listeners(&mut self) {
+        self.on_touch_start = None;
+        self.on_focus = None;
+        self.on_blur = None;
+        self.on_keyboard_release = None;
+        self.on_keyboard_press = None;
+        self.on_mouse_wheel = None;
+        self.on_dark_mode = None;
+        self.pointer_handler.remove_listeners();
+        self.on_resize_scale = None;
+        self.on_intersect = None;
+        self.animation_frame_handler.cancel();
+        self.on_touch_end = None;
+        self.on_context_menu = None;
+    }
+}
+
+impl Common {
+    pub fn add_event<E, F>(
+        &self,
+        event_name: &'static str,
+        handler: F,
+    ) -> EventListenerHandle<dyn FnMut(E)>
+    where
+        E: 'static + AsRef<web_sys::Event> + wasm_bindgen::convert::FromWasmAbi,
+        F: 'static + FnMut(E),
+    {
+        EventListenerHandle::new(self.raw.deref().clone(), event_name, Closure::new(handler))
+    }
+
+    pub fn raw(&self) -> &HtmlCanvasElement {
+        &self.raw
+    }
+}
+
+impl Style {
+    fn new(window: &web_sys::Window, canvas: &HtmlCanvasElement) -> Self {
+        #[allow(clippy::disallowed_methods)]
+        let read = window
+            .get_computed_style(canvas)
+            .expect("Failed to obtain computed style")
+            // this can't fail: we aren't using a pseudo-element
+            .expect("Invalid pseudo-element");
+
+        #[allow(clippy::disallowed_methods)]
+        let write = canvas.style();
+
+        Self { read, write }
+    }
+
+    pub(crate) fn get(&self, property: &str) -> String {
+        self.read.get_property_value(property).expect("Invalid property")
+    }
+
+    pub(crate) fn remove(&self, property: &str) {
+        self.write.remove_property(property).expect("Property is read only");
+    }
+
+    pub(crate) fn set(&self, property: &str, value: &str) {
+        self.write.set_property(property, value).expect("Property is read only");
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/event.rs b/vendor/winit/src/platform_impl/web/web_sys/event.rs
new file mode 100644
index 00000000..ddd12576
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/event.rs
@@ -0,0 +1,270 @@
+use crate::event::{MouseButton, MouseScrollDelta};
+use crate::keyboard::{Key, KeyLocation, ModifiersState, NamedKey, PhysicalKey};
+
+use dpi::{LogicalPosition, PhysicalPosition, Position};
+use smol_str::SmolStr;
+use std::cell::OnceCell;
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen::{JsCast, JsValue};
+use web_sys::{KeyboardEvent, MouseEvent, PointerEvent, WheelEvent};
+
+use super::Engine;
+
+bitflags::bitflags! {
+    // https://www.w3.org/TR/pointerevents3/#the-buttons-property
+    #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+    pub struct ButtonsState: u16 {
+        const LEFT    = 0b00001;
+        const RIGHT   = 0b00010;
+        const MIDDLE  = 0b00100;
+        const BACK    = 0b01000;
+        const FORWARD = 0b10000;
+    }
+}
+
+impl From<ButtonsState> for MouseButton {
+    fn from(value: ButtonsState) -> Self {
+        match value {
+            ButtonsState::LEFT => MouseButton::Left,
+            ButtonsState::RIGHT => MouseButton::Right,
+            ButtonsState::MIDDLE => MouseButton::Middle,
+            ButtonsState::BACK => MouseButton::Back,
+            ButtonsState::FORWARD => MouseButton::Forward,
+            _ => MouseButton::Other(value.bits()),
+        }
+    }
+}
+
+impl From<MouseButton> for ButtonsState {
+    fn from(value: MouseButton) -> Self {
+        match value {
+            MouseButton::Left => ButtonsState::LEFT,
+            MouseButton::Right => ButtonsState::RIGHT,
+            MouseButton::Middle => ButtonsState::MIDDLE,
+            MouseButton::Back => ButtonsState::BACK,
+            MouseButton::Forward => ButtonsState::FORWARD,
+            MouseButton::Other(value) => ButtonsState::from_bits_retain(value),
+        }
+    }
+}
+
+pub fn mouse_buttons(event: &MouseEvent) -> ButtonsState {
+    ButtonsState::from_bits_retain(event.buttons())
+}
+
+pub fn mouse_button(event: &MouseEvent) -> Option<MouseButton> {
+    // https://www.w3.org/TR/pointerevents3/#the-button-property
+    match event.button() {
+        -1 => None,
+        0 => Some(MouseButton::Left),
+        1 => Some(MouseButton::Middle),
+        2 => Some(MouseButton::Right),
+        3 => Some(MouseButton::Back),
+        4 => Some(MouseButton::Forward),
+        i => {
+            Some(MouseButton::Other(i.try_into().expect("unexpected negative mouse button value")))
+        },
+    }
+}
+
+impl MouseButton {
+    pub fn to_id(self) -> u32 {
+        match self {
+            MouseButton::Left => 0,
+            MouseButton::Right => 1,
+            MouseButton::Middle => 2,
+            MouseButton::Back => 3,
+            MouseButton::Forward => 4,
+            MouseButton::Other(value) => value.into(),
+        }
+    }
+}
+
+pub fn mouse_position(event: &MouseEvent) -> LogicalPosition<f64> {
+    #[wasm_bindgen]
+    extern "C" {
+        type MouseEventExt;
+
+        #[wasm_bindgen(method, getter, js_name = offsetX)]
+        fn offset_x(this: &MouseEventExt) -> f64;
+
+        #[wasm_bindgen(method, getter, js_name = offsetY)]
+        fn offset_y(this: &MouseEventExt) -> f64;
+    }
+
+    let event: &MouseEventExt = event.unchecked_ref();
+
+    LogicalPosition { x: event.offset_x(), y: event.offset_y() }
+}
+
+// TODO: Remove this when Firefox supports correct movement values in coalesced events and browsers
+// have agreed on what coordinate space `movementX/Y` is using.
+// See <https://bugzilla.mozilla.org/show_bug.cgi?id=1753724>.
+// See <https://github.com/w3c/pointerlock/issues/42>.
+pub enum MouseDelta {
+    Chromium,
+    Gecko { old_position: LogicalPosition<f64>, old_delta: LogicalPosition<f64> },
+    Other,
+}
+
+impl MouseDelta {
+    pub fn init(window: &web_sys::Window, event: &PointerEvent) -> Self {
+        match super::engine(window) {
+            Some(Engine::Chromium) => Self::Chromium,
+            // Firefox has wrong movement values in coalesced events.
+            Some(Engine::Gecko) if has_coalesced_events_support(event) => Self::Gecko {
+                old_position: mouse_position(event),
+                old_delta: LogicalPosition::new(
+                    event.movement_x() as f64,
+                    event.movement_y() as f64,
+                ),
+            },
+            _ => Self::Other,
+        }
+    }
+
+    pub fn delta(&mut self, event: &MouseEvent) -> Position {
+        match self {
+            MouseDelta::Chromium => {
+                PhysicalPosition::new(event.movement_x(), event.movement_y()).into()
+            },
+            MouseDelta::Gecko { old_position, old_delta } => {
+                let new_position = mouse_position(event);
+                let x = new_position.x - old_position.x + old_delta.x;
+                let y = new_position.y - old_position.y + old_delta.y;
+                *old_position = new_position;
+                *old_delta = LogicalPosition::new(0., 0.);
+                LogicalPosition::new(x, y).into()
+            },
+            MouseDelta::Other => {
+                LogicalPosition::new(event.movement_x(), event.movement_y()).into()
+            },
+        }
+    }
+}
+
+pub fn mouse_scroll_delta(
+    window: &web_sys::Window,
+    event: &WheelEvent,
+) -> Option<MouseScrollDelta> {
+    let x = -event.delta_x();
+    let y = -event.delta_y();
+
+    match event.delta_mode() {
+        WheelEvent::DOM_DELTA_LINE => Some(MouseScrollDelta::LineDelta(x as f32, y as f32)),
+        WheelEvent::DOM_DELTA_PIXEL => {
+            let delta = LogicalPosition::new(x, y).to_physical(super::scale_factor(window));
+            Some(MouseScrollDelta::PixelDelta(delta))
+        },
+        _ => None,
+    }
+}
+
+pub fn key_code(event: &KeyboardEvent) -> PhysicalKey {
+    let code = event.code();
+    PhysicalKey::from_key_code_attribute_value(&code)
+}
+
+pub fn key(event: &KeyboardEvent) -> Key {
+    Key::from_key_attribute_value(&event.key())
+}
+
+pub fn key_text(event: &KeyboardEvent) -> Option<SmolStr> {
+    let key = event.key();
+    let key = Key::from_key_attribute_value(&key);
+    match &key {
+        Key::Character(text) => Some(text.clone()),
+        Key::Named(NamedKey::Tab) => Some(SmolStr::new("\t")),
+        Key::Named(NamedKey::Enter) => Some(SmolStr::new("\r")),
+        Key::Named(NamedKey::Space) => Some(SmolStr::new(" ")),
+        _ => None,
+    }
+    .map(SmolStr::new)
+}
+
+pub fn key_location(event: &KeyboardEvent) -> KeyLocation {
+    match event.location() {
+        KeyboardEvent::DOM_KEY_LOCATION_LEFT => KeyLocation::Left,
+        KeyboardEvent::DOM_KEY_LOCATION_RIGHT => KeyLocation::Right,
+        KeyboardEvent::DOM_KEY_LOCATION_NUMPAD => KeyLocation::Numpad,
+        KeyboardEvent::DOM_KEY_LOCATION_STANDARD => KeyLocation::Standard,
+        location => {
+            tracing::warn!("Unexpected key location: {location}");
+            KeyLocation::Standard
+        },
+    }
+}
+
+pub fn keyboard_modifiers(event: &KeyboardEvent) -> ModifiersState {
+    let mut state = ModifiersState::empty();
+
+    if event.shift_key() {
+        state |= ModifiersState::SHIFT;
+    }
+    if event.ctrl_key() {
+        state |= ModifiersState::CONTROL;
+    }
+    if event.alt_key() {
+        state |= ModifiersState::ALT;
+    }
+    if event.meta_key() {
+        state |= ModifiersState::SUPER;
+    }
+
+    state
+}
+
+pub fn mouse_modifiers(event: &MouseEvent) -> ModifiersState {
+    let mut state = ModifiersState::empty();
+
+    if event.shift_key() {
+        state |= ModifiersState::SHIFT;
+    }
+    if event.ctrl_key() {
+        state |= ModifiersState::CONTROL;
+    }
+    if event.alt_key() {
+        state |= ModifiersState::ALT;
+    }
+    if event.meta_key() {
+        state |= ModifiersState::SUPER;
+    }
+
+    state
+}
+
+pub fn pointer_move_event(event: PointerEvent) -> impl Iterator<Item = PointerEvent> {
+    // make a single iterator depending on the availability of coalesced events
+    if has_coalesced_events_support(&event) {
+        None.into_iter().chain(
+            Some(event.get_coalesced_events().into_iter().map(PointerEvent::unchecked_from_js))
+                .into_iter()
+                .flatten(),
+        )
+    } else {
+        Some(event).into_iter().chain(None.into_iter().flatten())
+    }
+}
+
+// TODO: Remove when Safari supports `getCoalescedEvents`.
+// See <https://bugs.webkit.org/show_bug.cgi?id=210454>.
+pub fn has_coalesced_events_support(event: &PointerEvent) -> bool {
+    thread_local! {
+        static COALESCED_EVENTS_SUPPORT: OnceCell<bool> = const { OnceCell::new() };
+    }
+
+    COALESCED_EVENTS_SUPPORT.with(|support| {
+        *support.get_or_init(|| {
+            #[wasm_bindgen]
+            extern "C" {
+                type PointerCoalescedEventsSupport;
+
+                #[wasm_bindgen(method, getter, js_name = getCoalescedEvents)]
+                fn has_get_coalesced_events(this: &PointerCoalescedEventsSupport) -> JsValue;
+            }
+
+            let support: &PointerCoalescedEventsSupport = event.unchecked_ref();
+            !support.has_get_coalesced_events().is_undefined()
+        })
+    })
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/event_handle.rs b/vendor/winit/src/platform_impl/web/web_sys/event_handle.rs
new file mode 100644
index 00000000..4474af3c
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/event_handle.rs
@@ -0,0 +1,38 @@
+use wasm_bindgen::prelude::Closure;
+use wasm_bindgen::JsCast;
+use web_sys::EventTarget;
+
+pub struct EventListenerHandle<T: ?Sized> {
+    target: EventTarget,
+    event_type: &'static str,
+    listener: Closure<T>,
+}
+
+impl<T: ?Sized> EventListenerHandle<T> {
+    pub fn new<U>(target: U, event_type: &'static str, listener: Closure<T>) -> Self
+    where
+        U: Into<EventTarget>,
+    {
+        let target = target.into();
+        target
+            .add_event_listener_with_callback(event_type, listener.as_ref().unchecked_ref())
+            .expect("Failed to add event listener");
+        EventListenerHandle { target, event_type, listener }
+    }
+}
+
+impl<T: ?Sized> Drop for EventListenerHandle<T> {
+    fn drop(&mut self) {
+        self.target
+            .remove_event_listener_with_callback(
+                self.event_type,
+                self.listener.as_ref().unchecked_ref(),
+            )
+            .unwrap_or_else(|e| {
+                web_sys::console::error_2(
+                    &format!("Error removing event listener {}", self.event_type).into(),
+                    &e,
+                )
+            });
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/fullscreen.rs b/vendor/winit/src/platform_impl/web/web_sys/fullscreen.rs
new file mode 100644
index 00000000..867d34a6
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/fullscreen.rs
@@ -0,0 +1,103 @@
+use std::cell::OnceCell;
+
+use js_sys::Promise;
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen::{JsCast, JsValue};
+use web_sys::{Document, Element, HtmlCanvasElement};
+
+pub fn request_fullscreen(document: &Document, canvas: &HtmlCanvasElement) {
+    if is_fullscreen(document, canvas) {
+        return;
+    }
+
+    #[wasm_bindgen]
+    extern "C" {
+        #[wasm_bindgen(extends = HtmlCanvasElement)]
+        type RequestFullscreen;
+
+        #[wasm_bindgen(method, js_name = requestFullscreen)]
+        fn request_fullscreen(this: &RequestFullscreen) -> Promise;
+
+        #[wasm_bindgen(method, js_name = webkitRequestFullscreen)]
+        fn webkit_request_fullscreen(this: &RequestFullscreen);
+    }
+
+    let canvas: &RequestFullscreen = canvas.unchecked_ref();
+
+    if has_fullscreen_api_support(canvas) {
+        thread_local! {
+            static REJECT_HANDLER: Closure<dyn FnMut(JsValue)> = Closure::new(|_| ());
+        }
+        REJECT_HANDLER.with(|handler| {
+            let _ = canvas.request_fullscreen().catch(handler);
+        });
+    } else {
+        canvas.webkit_request_fullscreen();
+    }
+}
+
+pub fn is_fullscreen(document: &Document, canvas: &HtmlCanvasElement) -> bool {
+    #[wasm_bindgen]
+    extern "C" {
+        type FullscreenElement;
+
+        #[wasm_bindgen(method, getter, js_name = webkitFullscreenElement)]
+        fn webkit_fullscreen_element(this: &FullscreenElement) -> Option<Element>;
+    }
+
+    let element = if has_fullscreen_api_support(canvas) {
+        #[allow(clippy::disallowed_methods)]
+        document.fullscreen_element()
+    } else {
+        let document: &FullscreenElement = document.unchecked_ref();
+        document.webkit_fullscreen_element()
+    };
+
+    match element {
+        Some(element) => {
+            let canvas: &Element = canvas;
+            canvas == &element
+        },
+        None => false,
+    }
+}
+
+pub fn exit_fullscreen(document: &Document, canvas: &HtmlCanvasElement) {
+    #[wasm_bindgen]
+    extern "C" {
+        type ExitFullscreen;
+
+        #[wasm_bindgen(method, js_name = webkitExitFullscreen)]
+        fn webkit_exit_fullscreen(this: &ExitFullscreen);
+    }
+
+    if has_fullscreen_api_support(canvas) {
+        #[allow(clippy::disallowed_methods)]
+        document.exit_fullscreen()
+    } else {
+        let document: &ExitFullscreen = document.unchecked_ref();
+        document.webkit_exit_fullscreen()
+    }
+}
+
+fn has_fullscreen_api_support(canvas: &HtmlCanvasElement) -> bool {
+    thread_local! {
+        static FULLSCREEN_API_SUPPORT: OnceCell<bool> = const { OnceCell::new() };
+    }
+
+    FULLSCREEN_API_SUPPORT.with(|support| {
+        *support.get_or_init(|| {
+            #[wasm_bindgen]
+            extern "C" {
+                type CanvasFullScreenApiSupport;
+
+                #[wasm_bindgen(method, getter, js_name = requestFullscreen)]
+                fn has_request_fullscreen(this: &CanvasFullScreenApiSupport) -> JsValue;
+            }
+
+            let support: &CanvasFullScreenApiSupport = canvas.unchecked_ref();
+            !support.has_request_fullscreen().is_undefined()
+        })
+    })
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/intersection_handle.rs b/vendor/winit/src/platform_impl/web/web_sys/intersection_handle.rs
new file mode 100644
index 00000000..9f63e84c
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/intersection_handle.rs
@@ -0,0 +1,33 @@
+use js_sys::Array;
+use wasm_bindgen::prelude::Closure;
+use wasm_bindgen::JsCast;
+use web_sys::{Element, IntersectionObserver, IntersectionObserverEntry};
+
+pub(super) struct IntersectionObserverHandle {
+    observer: IntersectionObserver,
+    _closure: Closure<dyn FnMut(Array)>,
+}
+
+impl IntersectionObserverHandle {
+    pub fn new<F>(element: &Element, mut callback: F) -> Self
+    where
+        F: 'static + FnMut(bool),
+    {
+        let closure = Closure::new(move |entries: Array| {
+            let entry: IntersectionObserverEntry = entries.get(0).unchecked_into();
+            callback(entry.is_intersecting());
+        });
+        let observer = IntersectionObserver::new(closure.as_ref().unchecked_ref())
+            // we don't provide any `options`
+            .expect("Invalid `options`");
+        observer.observe(element);
+
+        Self { observer, _closure: closure }
+    }
+}
+
+impl Drop for IntersectionObserverHandle {
+    fn drop(&mut self) {
+        self.observer.disconnect()
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/media_query_handle.rs b/vendor/winit/src/platform_impl/web/web_sys/media_query_handle.rs
new file mode 100644
index 00000000..766157a6
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/media_query_handle.rs
@@ -0,0 +1,48 @@
+use wasm_bindgen::prelude::Closure;
+use wasm_bindgen::JsCast;
+use web_sys::MediaQueryList;
+
+pub(super) struct MediaQueryListHandle {
+    mql: MediaQueryList,
+    closure: Closure<dyn FnMut()>,
+}
+
+impl MediaQueryListHandle {
+    pub fn new<F>(window: &web_sys::Window, media_query: &str, mut listener: F) -> Self
+    where
+        F: 'static + FnMut(&MediaQueryList),
+    {
+        let mql = window
+            .match_media(media_query)
+            .expect("Failed to parse media query")
+            .expect("Found empty media query");
+
+        let closure = Closure::new({
+            let mql = mql.clone();
+            move || listener(&mql)
+        });
+        // TODO: Replace obsolete `addListener()` with `addEventListener()` and use
+        // `MediaQueryListEvent` instead of cloning the `MediaQueryList`.
+        // Requires Safari v14.
+        mql.add_listener_with_opt_callback(Some(closure.as_ref().unchecked_ref()))
+            .expect("Invalid listener");
+
+        Self { mql, closure }
+    }
+
+    pub fn mql(&self) -> &MediaQueryList {
+        &self.mql
+    }
+}
+
+impl Drop for MediaQueryListHandle {
+    fn drop(&mut self) {
+        remove_listener(&self.mql, &self.closure);
+    }
+}
+
+fn remove_listener(mql: &MediaQueryList, listener: &Closure<dyn FnMut()>) {
+    mql.remove_listener_with_opt_callback(Some(listener.as_ref().unchecked_ref())).unwrap_or_else(
+        |e| web_sys::console::error_2(&"Error removing media query listener".into(), &e),
+    );
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/mod.rs b/vendor/winit/src/platform_impl/web/web_sys/mod.rs
new file mode 100644
index 00000000..08962b49
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/mod.rs
@@ -0,0 +1,233 @@
+mod animation_frame;
+mod canvas;
+pub mod event;
+mod event_handle;
+mod fullscreen;
+mod intersection_handle;
+mod media_query_handle;
+mod pointer;
+mod resize_scaling;
+mod schedule;
+
+use std::sync::OnceLock;
+
+pub use self::canvas::{Canvas, Style};
+pub use self::event::ButtonsState;
+pub use self::event_handle::EventListenerHandle;
+pub use self::resize_scaling::ResizeScaleHandle;
+pub use self::schedule::Schedule;
+
+use crate::dpi::{LogicalPosition, LogicalSize};
+use js_sys::Array;
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen::JsCast;
+use web_sys::{
+    Document, HtmlCanvasElement, Navigator, PageTransitionEvent, VisibilityState, Window,
+};
+
+pub fn throw(msg: &str) {
+    wasm_bindgen::throw_str(msg);
+}
+
+pub struct PageTransitionEventHandle {
+    _show_listener: event_handle::EventListenerHandle<dyn FnMut(PageTransitionEvent)>,
+    _hide_listener: event_handle::EventListenerHandle<dyn FnMut(PageTransitionEvent)>,
+}
+
+pub fn on_page_transition(
+    window: web_sys::Window,
+    show_handler: impl FnMut(PageTransitionEvent) + 'static,
+    hide_handler: impl FnMut(PageTransitionEvent) + 'static,
+) -> PageTransitionEventHandle {
+    let show_closure = Closure::new(show_handler);
+    let hide_closure = Closure::new(hide_handler);
+
+    let show_listener =
+        event_handle::EventListenerHandle::new(window.clone(), "pageshow", show_closure);
+    let hide_listener = event_handle::EventListenerHandle::new(window, "pagehide", hide_closure);
+    PageTransitionEventHandle { _show_listener: show_listener, _hide_listener: hide_listener }
+}
+
+pub fn scale_factor(window: &web_sys::Window) -> f64 {
+    window.device_pixel_ratio()
+}
+
+fn fix_canvas_size(style: &Style, mut size: LogicalSize<f64>) -> LogicalSize<f64> {
+    if style.get("box-sizing") == "border-box" {
+        size.width += style_size_property(style, "border-left-width")
+            + style_size_property(style, "border-right-width")
+            + style_size_property(style, "padding-left")
+            + style_size_property(style, "padding-right");
+        size.height += style_size_property(style, "border-top-width")
+            + style_size_property(style, "border-bottom-width")
+            + style_size_property(style, "padding-top")
+            + style_size_property(style, "padding-bottom");
+    }
+
+    size
+}
+
+pub fn set_canvas_size(
+    document: &Document,
+    raw: &HtmlCanvasElement,
+    style: &Style,
+    new_size: LogicalSize<f64>,
+) {
+    if !document.contains(Some(raw)) || style.get("display") == "none" {
+        return;
+    }
+
+    let new_size = fix_canvas_size(style, new_size);
+
+    style.set("width", &format!("{}px", new_size.width));
+    style.set("height", &format!("{}px", new_size.height));
+}
+
+pub fn set_canvas_min_size(
+    document: &Document,
+    raw: &HtmlCanvasElement,
+    style: &Style,
+    dimensions: Option<LogicalSize<f64>>,
+) {
+    if let Some(dimensions) = dimensions {
+        if !document.contains(Some(raw)) || style.get("display") == "none" {
+            return;
+        }
+
+        let new_size = fix_canvas_size(style, dimensions);
+
+        style.set("min-width", &format!("{}px", new_size.width));
+        style.set("min-height", &format!("{}px", new_size.height));
+    } else {
+        style.remove("min-width");
+        style.remove("min-height");
+    }
+}
+
+pub fn set_canvas_max_size(
+    document: &Document,
+    raw: &HtmlCanvasElement,
+    style: &Style,
+    dimensions: Option<LogicalSize<f64>>,
+) {
+    if let Some(dimensions) = dimensions {
+        if !document.contains(Some(raw)) || style.get("display") == "none" {
+            return;
+        }
+
+        let new_size = fix_canvas_size(style, dimensions);
+
+        style.set("max-width", &format!("{}px", new_size.width));
+        style.set("max-height", &format!("{}px", new_size.height));
+    } else {
+        style.remove("max-width");
+        style.remove("max-height");
+    }
+}
+
+pub fn set_canvas_position(
+    document: &Document,
+    raw: &HtmlCanvasElement,
+    style: &Style,
+    mut position: LogicalPosition<f64>,
+) {
+    if document.contains(Some(raw)) && style.get("display") != "none" {
+        position.x -= style_size_property(style, "margin-left")
+            + style_size_property(style, "border-left-width")
+            + style_size_property(style, "padding-left");
+        position.y -= style_size_property(style, "margin-top")
+            + style_size_property(style, "border-top-width")
+            + style_size_property(style, "padding-top");
+    }
+
+    style.set("position", "fixed");
+    style.set("left", &format!("{}px", position.x));
+    style.set("top", &format!("{}px", position.y));
+}
+
+/// This function will panic if the element is not inserted in the DOM
+/// or is not a CSS property that represents a size in pixel.
+pub fn style_size_property(style: &Style, property: &str) -> f64 {
+    let prop = style.get(property);
+    prop.strip_suffix("px")
+        .expect("Element was not inserted into the DOM or is not a size in pixel")
+        .parse()
+        .expect("CSS property is not a size in pixel")
+}
+
+pub fn is_dark_mode(window: &web_sys::Window) -> Option<bool> {
+    window.match_media("(prefers-color-scheme: dark)").ok().flatten().map(|media| media.matches())
+}
+
+pub fn is_visible(document: &Document) -> bool {
+    document.visibility_state() == VisibilityState::Visible
+}
+
+pub type RawCanvasType = HtmlCanvasElement;
+
+#[derive(Clone, Copy)]
+pub enum Engine {
+    Chromium,
+    Gecko,
+    WebKit,
+}
+
+pub fn engine(window: &Window) -> Option<Engine> {
+    static ENGINE: OnceLock<Option<Engine>> = OnceLock::new();
+
+    #[wasm_bindgen]
+    extern "C" {
+        #[wasm_bindgen(extends = Navigator)]
+        type NavigatorExt;
+
+        #[wasm_bindgen(method, getter, js_name = userAgentData)]
+        fn user_agent_data(this: &NavigatorExt) -> Option<NavigatorUaData>;
+
+        type NavigatorUaData;
+
+        #[wasm_bindgen(method, getter)]
+        fn brands(this: &NavigatorUaData) -> Array;
+
+        type NavigatorUaBrandVersion;
+
+        #[wasm_bindgen(method, getter)]
+        fn brand(this: &NavigatorUaBrandVersion) -> String;
+    }
+
+    *ENGINE.get_or_init(|| {
+        let navigator: NavigatorExt = window.navigator().unchecked_into();
+
+        if let Some(data) = navigator.user_agent_data() {
+            for brand in data
+                .brands()
+                .iter()
+                .map(NavigatorUaBrandVersion::unchecked_from_js)
+                .map(|brand| brand.brand())
+            {
+                match brand.as_str() {
+                    "Chromium" => return Some(Engine::Chromium),
+                    // TODO: verify when Firefox actually implements it.
+                    "Gecko" => return Some(Engine::Gecko),
+                    // TODO: verify when Safari actually implements it.
+                    "WebKit" => return Some(Engine::WebKit),
+                    _ => (),
+                }
+            }
+
+            None
+        } else {
+            let data = navigator.user_agent().ok()?;
+
+            if data.contains("Chrome/") {
+                Some(Engine::Chromium)
+            } else if data.contains("Gecko/") {
+                Some(Engine::Gecko)
+            } else if data.contains("AppleWebKit/") {
+                Some(Engine::WebKit)
+            } else {
+                None
+            }
+        }
+    })
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/pointer.rs b/vendor/winit/src/platform_impl/web/web_sys/pointer.rs
new file mode 100644
index 00000000..3ee168bb
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/pointer.rs
@@ -0,0 +1,244 @@
+use std::cell::Cell;
+use std::rc::Rc;
+
+use super::canvas::Common;
+use super::event;
+use super::event_handle::EventListenerHandle;
+use crate::dpi::PhysicalPosition;
+use crate::event::{Force, MouseButton};
+use crate::keyboard::ModifiersState;
+
+use event::ButtonsState;
+use web_sys::PointerEvent;
+
+#[allow(dead_code)]
+pub(super) struct PointerHandler {
+    on_cursor_leave: Option<EventListenerHandle<dyn FnMut(PointerEvent)>>,
+    on_cursor_enter: Option<EventListenerHandle<dyn FnMut(PointerEvent)>>,
+    on_cursor_move: Option<EventListenerHandle<dyn FnMut(PointerEvent)>>,
+    on_pointer_press: Option<EventListenerHandle<dyn FnMut(PointerEvent)>>,
+    on_pointer_release: Option<EventListenerHandle<dyn FnMut(PointerEvent)>>,
+    on_touch_cancel: Option<EventListenerHandle<dyn FnMut(PointerEvent)>>,
+}
+
+impl PointerHandler {
+    pub fn new() -> Self {
+        Self {
+            on_cursor_leave: None,
+            on_cursor_enter: None,
+            on_cursor_move: None,
+            on_pointer_press: None,
+            on_pointer_release: None,
+            on_touch_cancel: None,
+        }
+    }
+
+    pub fn on_cursor_leave<F>(&mut self, canvas_common: &Common, mut handler: F)
+    where
+        F: 'static + FnMut(ModifiersState, Option<i32>),
+    {
+        self.on_cursor_leave =
+            Some(canvas_common.add_event("pointerout", move |event: PointerEvent| {
+                let modifiers = event::mouse_modifiers(&event);
+
+                // touch events are handled separately
+                // handling them here would produce duplicate mouse events, inconsistent with
+                // other platforms.
+                let pointer_id = (event.pointer_type() != "touch").then(|| event.pointer_id());
+
+                handler(modifiers, pointer_id);
+            }));
+    }
+
+    pub fn on_cursor_enter<F>(&mut self, canvas_common: &Common, mut handler: F)
+    where
+        F: 'static + FnMut(ModifiersState, Option<i32>),
+    {
+        self.on_cursor_enter =
+            Some(canvas_common.add_event("pointerover", move |event: PointerEvent| {
+                let modifiers = event::mouse_modifiers(&event);
+
+                // touch events are handled separately
+                // handling them here would produce duplicate mouse events, inconsistent with
+                // other platforms.
+                let pointer_id = (event.pointer_type() != "touch").then(|| event.pointer_id());
+
+                handler(modifiers, pointer_id);
+            }));
+    }
+
+    pub fn on_mouse_release<M, T>(
+        &mut self,
+        canvas_common: &Common,
+        mut mouse_handler: M,
+        mut touch_handler: T,
+    ) where
+        M: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, MouseButton),
+        T: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, Force),
+    {
+        let window = canvas_common.window.clone();
+        self.on_pointer_release =
+            Some(canvas_common.add_event("pointerup", move |event: PointerEvent| {
+                let modifiers = event::mouse_modifiers(&event);
+
+                match event.pointer_type().as_str() {
+                    "touch" => touch_handler(
+                        modifiers,
+                        event.pointer_id(),
+                        event::mouse_position(&event).to_physical(super::scale_factor(&window)),
+                        Force::Normalized(event.pressure() as f64),
+                    ),
+                    _ => mouse_handler(
+                        modifiers,
+                        event.pointer_id(),
+                        event::mouse_position(&event).to_physical(super::scale_factor(&window)),
+                        event::mouse_button(&event).expect("no mouse button released"),
+                    ),
+                }
+            }));
+    }
+
+    pub fn on_mouse_press<M, T>(
+        &mut self,
+        canvas_common: &Common,
+        mut mouse_handler: M,
+        mut touch_handler: T,
+        prevent_default: Rc<Cell<bool>>,
+    ) where
+        M: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, MouseButton),
+        T: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, Force),
+    {
+        let window = canvas_common.window.clone();
+        let canvas = canvas_common.raw().clone();
+        self.on_pointer_press =
+            Some(canvas_common.add_event("pointerdown", move |event: PointerEvent| {
+                if prevent_default.get() {
+                    // prevent text selection
+                    event.prevent_default();
+                    // but still focus element
+                    let _ = canvas.focus();
+                }
+
+                let modifiers = event::mouse_modifiers(&event);
+                let pointer_type = &event.pointer_type();
+
+                match pointer_type.as_str() {
+                    "touch" => {
+                        touch_handler(
+                            modifiers,
+                            event.pointer_id(),
+                            event::mouse_position(&event).to_physical(super::scale_factor(&window)),
+                            Force::Normalized(event.pressure() as f64),
+                        );
+                    },
+                    _ => {
+                        mouse_handler(
+                            modifiers,
+                            event.pointer_id(),
+                            event::mouse_position(&event).to_physical(super::scale_factor(&window)),
+                            event::mouse_button(&event).expect("no mouse button pressed"),
+                        );
+
+                        if pointer_type == "mouse" {
+                            // Error is swallowed here since the error would occur every time the
+                            // mouse is clicked when the cursor is
+                            // grabbed, and there is probably not a
+                            // situation where this could fail, that we
+                            // care if it fails.
+                            let _e = canvas.set_pointer_capture(event.pointer_id());
+                        }
+                    },
+                }
+            }));
+    }
+
+    pub fn on_cursor_move<M, T, B>(
+        &mut self,
+        canvas_common: &Common,
+        mut mouse_handler: M,
+        mut touch_handler: T,
+        mut button_handler: B,
+        prevent_default: Rc<Cell<bool>>,
+    ) where
+        M: 'static + FnMut(ModifiersState, i32, &mut dyn Iterator<Item = PhysicalPosition<f64>>),
+        T: 'static
+            + FnMut(ModifiersState, i32, &mut dyn Iterator<Item = (PhysicalPosition<f64>, Force)>),
+        B: 'static + FnMut(ModifiersState, i32, PhysicalPosition<f64>, ButtonsState, MouseButton),
+    {
+        let window = canvas_common.window.clone();
+        let canvas = canvas_common.raw().clone();
+        self.on_cursor_move =
+            Some(canvas_common.add_event("pointermove", move |event: PointerEvent| {
+                let modifiers = event::mouse_modifiers(&event);
+
+                let id = event.pointer_id();
+
+                // chorded button event
+                if let Some(button) = event::mouse_button(&event) {
+                    if prevent_default.get() {
+                        // prevent text selection
+                        event.prevent_default();
+                        // but still focus element
+                        let _ = canvas.focus();
+                    }
+
+                    button_handler(
+                        modifiers,
+                        id,
+                        event::mouse_position(&event).to_physical(super::scale_factor(&window)),
+                        event::mouse_buttons(&event),
+                        button,
+                    );
+
+                    return;
+                }
+
+                // pointer move event
+                let scale = super::scale_factor(&window);
+                match event.pointer_type().as_str() {
+                    "touch" => touch_handler(
+                        modifiers,
+                        id,
+                        &mut event::pointer_move_event(event).map(|event| {
+                            (
+                                event::mouse_position(&event).to_physical(scale),
+                                Force::Normalized(event.pressure() as f64),
+                            )
+                        }),
+                    ),
+                    _ => mouse_handler(
+                        modifiers,
+                        id,
+                        &mut event::pointer_move_event(event)
+                            .map(|event| event::mouse_position(&event).to_physical(scale)),
+                    ),
+                };
+            }));
+    }
+
+    pub fn on_touch_cancel<F>(&mut self, canvas_common: &Common, mut handler: F)
+    where
+        F: 'static + FnMut(i32, PhysicalPosition<f64>, Force),
+    {
+        let window = canvas_common.window.clone();
+        self.on_touch_cancel =
+            Some(canvas_common.add_event("pointercancel", move |event: PointerEvent| {
+                if event.pointer_type() == "touch" {
+                    handler(
+                        event.pointer_id(),
+                        event::mouse_position(&event).to_physical(super::scale_factor(&window)),
+                        Force::Normalized(event.pressure() as f64),
+                    );
+                }
+            }));
+    }
+
+    pub fn remove_listeners(&mut self) {
+        self.on_cursor_leave = None;
+        self.on_cursor_enter = None;
+        self.on_cursor_move = None;
+        self.on_pointer_press = None;
+        self.on_pointer_release = None;
+        self.on_touch_cancel = None;
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/resize_scaling.rs b/vendor/winit/src/platform_impl/web/web_sys/resize_scaling.rs
new file mode 100644
index 00000000..4d10b3ac
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/resize_scaling.rs
@@ -0,0 +1,302 @@
+use js_sys::{Array, Object};
+use tracing::warn;
+use wasm_bindgen::prelude::{wasm_bindgen, Closure};
+use wasm_bindgen::{JsCast, JsValue};
+use web_sys::{
+    Document, HtmlCanvasElement, MediaQueryList, ResizeObserver, ResizeObserverBoxOptions,
+    ResizeObserverEntry, ResizeObserverOptions, ResizeObserverSize, Window,
+};
+
+use crate::dpi::{LogicalSize, PhysicalSize};
+
+use super::super::backend;
+use super::canvas::Style;
+use super::media_query_handle::MediaQueryListHandle;
+
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+pub struct ResizeScaleHandle(Rc<ResizeScaleInternal>);
+
+impl ResizeScaleHandle {
+    pub(crate) fn new<S, R>(
+        window: Window,
+        document: Document,
+        canvas: HtmlCanvasElement,
+        style: Style,
+        scale_handler: S,
+        resize_handler: R,
+    ) -> Self
+    where
+        S: 'static + Fn(PhysicalSize<u32>, f64),
+        R: 'static + Fn(PhysicalSize<u32>),
+    {
+        Self(ResizeScaleInternal::new(
+            window,
+            document,
+            canvas,
+            style,
+            scale_handler,
+            resize_handler,
+        ))
+    }
+
+    pub(crate) fn notify_resize(&self) {
+        self.0.notify()
+    }
+}
+
+/// This is a helper type to help manage the `MediaQueryList` used for detecting
+/// changes of the `devicePixelRatio`.
+struct ResizeScaleInternal {
+    window: Window,
+    document: Document,
+    canvas: HtmlCanvasElement,
+    style: Style,
+    mql: RefCell<MediaQueryListHandle>,
+    observer: ResizeObserver,
+    _observer_closure: Closure<dyn FnMut(Array, ResizeObserver)>,
+    scale_handler: Box<dyn Fn(PhysicalSize<u32>, f64)>,
+    resize_handler: Box<dyn Fn(PhysicalSize<u32>)>,
+    notify_scale: Cell<bool>,
+}
+
+impl ResizeScaleInternal {
+    fn new<S, R>(
+        window: Window,
+        document: Document,
+        canvas: HtmlCanvasElement,
+        style: Style,
+        scale_handler: S,
+        resize_handler: R,
+    ) -> Rc<Self>
+    where
+        S: 'static + Fn(PhysicalSize<u32>, f64),
+        R: 'static + Fn(PhysicalSize<u32>),
+    {
+        Rc::<ResizeScaleInternal>::new_cyclic(|weak_self| {
+            let mql = Self::create_mql(&window, {
+                let weak_self = weak_self.clone();
+                move |mql| {
+                    if let Some(rc_self) = weak_self.upgrade() {
+                        Self::handle_scale(rc_self, mql);
+                    }
+                }
+            });
+
+            let weak_self = weak_self.clone();
+            let observer_closure = Closure::new(move |entries: Array, _| {
+                if let Some(this) = weak_self.upgrade() {
+                    let size = this.process_entry(entries);
+
+                    if this.notify_scale.replace(false) {
+                        let scale = backend::scale_factor(&this.window);
+                        (this.scale_handler)(size, scale)
+                    } else {
+                        (this.resize_handler)(size)
+                    }
+                }
+            });
+            let observer = Self::create_observer(&canvas, observer_closure.as_ref());
+
+            Self {
+                window,
+                document,
+                canvas,
+                style,
+                mql: RefCell::new(mql),
+                observer,
+                _observer_closure: observer_closure,
+                scale_handler: Box::new(scale_handler),
+                resize_handler: Box::new(resize_handler),
+                notify_scale: Cell::new(false),
+            }
+        })
+    }
+
+    fn create_mql<F>(window: &Window, closure: F) -> MediaQueryListHandle
+    where
+        F: 'static + FnMut(&MediaQueryList),
+    {
+        let current_scale = super::scale_factor(window);
+        // TODO: Remove `-webkit-device-pixel-ratio`. Requires Safari v16.
+        let media_query = format!(
+            "(resolution: {current_scale}dppx),
+             (-webkit-device-pixel-ratio: {current_scale})",
+        );
+        let mql = MediaQueryListHandle::new(window, &media_query, closure);
+        debug_assert!(
+            mql.mql().matches(),
+            "created media query doesn't match, {current_scale} != {}",
+            super::scale_factor(window)
+        );
+        mql
+    }
+
+    fn create_observer(canvas: &HtmlCanvasElement, closure: &JsValue) -> ResizeObserver {
+        let observer = ResizeObserver::new(closure.as_ref().unchecked_ref())
+            .expect("Failed to create `ResizeObserver`");
+
+        // Safari doesn't support `devicePixelContentBoxSize`
+        if has_device_pixel_support() {
+            let options = ResizeObserverOptions::new();
+            options.set_box(ResizeObserverBoxOptions::DevicePixelContentBox);
+            observer.observe_with_options(canvas, &options);
+        } else {
+            observer.observe(canvas);
+        }
+
+        observer
+    }
+
+    fn notify(&self) {
+        if !self.document.contains(Some(&self.canvas)) || self.style.get("display") == "none" {
+            let size = PhysicalSize::new(0, 0);
+
+            if self.notify_scale.replace(false) {
+                let scale = backend::scale_factor(&self.window);
+                (self.scale_handler)(size, scale)
+            } else {
+                (self.resize_handler)(size)
+            }
+
+            return;
+        }
+
+        // Safari doesn't support `devicePixelContentBoxSize`
+        if has_device_pixel_support() {
+            self.observer.unobserve(&self.canvas);
+            self.observer.observe(&self.canvas);
+
+            return;
+        }
+
+        let mut size = LogicalSize::new(
+            backend::style_size_property(&self.style, "width"),
+            backend::style_size_property(&self.style, "height"),
+        );
+
+        if self.style.get("box-sizing") == "border-box" {
+            size.width -= backend::style_size_property(&self.style, "border-left-width")
+                + backend::style_size_property(&self.style, "border-right-width")
+                + backend::style_size_property(&self.style, "padding-left")
+                + backend::style_size_property(&self.style, "padding-right");
+            size.height -= backend::style_size_property(&self.style, "border-top-width")
+                + backend::style_size_property(&self.style, "border-bottom-width")
+                + backend::style_size_property(&self.style, "padding-top")
+                + backend::style_size_property(&self.style, "padding-bottom");
+        }
+
+        let size = size.to_physical(backend::scale_factor(&self.window));
+
+        if self.notify_scale.replace(false) {
+            let scale = backend::scale_factor(&self.window);
+            (self.scale_handler)(size, scale)
+        } else {
+            (self.resize_handler)(size)
+        }
+    }
+
+    fn handle_scale(self: Rc<Self>, mql: &MediaQueryList) {
+        let weak_self = Rc::downgrade(&self);
+        let scale = super::scale_factor(&self.window);
+
+        // TODO: confirm/reproduce this problem, see:
+        // <https://github.com/rust-windowing/winit/issues/2597>.
+        // This should never happen, but if it does then apparently the scale factor didn't change.
+        if mql.matches() {
+            warn!(
+                "media query tracking scale factor was triggered without a change:\nMedia Query: \
+                 {}\nCurrent Scale: {scale}",
+                mql.media(),
+            );
+            return;
+        }
+
+        let new_mql = Self::create_mql(&self.window, move |mql| {
+            if let Some(rc_self) = weak_self.upgrade() {
+                Self::handle_scale(rc_self, mql);
+            }
+        });
+        self.mql.replace(new_mql);
+
+        self.notify_scale.set(true);
+        self.notify();
+    }
+
+    fn process_entry(&self, entries: Array) -> PhysicalSize<u32> {
+        let entry: ResizeObserverEntry = entries.get(0).unchecked_into();
+
+        // Safari doesn't support `devicePixelContentBoxSize`
+        if !has_device_pixel_support() {
+            let rect = entry.content_rect();
+
+            return LogicalSize::new(rect.width(), rect.height())
+                .to_physical(backend::scale_factor(&self.window));
+        }
+
+        let entry: ResizeObserverSize =
+            entry.device_pixel_content_box_size().get(0).unchecked_into();
+
+        let writing_mode = self.style.get("writing-mode");
+
+        // means the canvas is not inserted into the DOM
+        if writing_mode.is_empty() {
+            debug_assert_eq!(entry.inline_size(), 0.);
+            debug_assert_eq!(entry.block_size(), 0.);
+
+            return PhysicalSize::new(0, 0);
+        }
+
+        let horizontal = match writing_mode.as_str() {
+            _ if writing_mode.starts_with("horizontal") => true,
+            _ if writing_mode.starts_with("vertical") | writing_mode.starts_with("sideways") => {
+                false
+            },
+            // deprecated values
+            "lr" | "lr-tb" | "rl" => true,
+            "tb" | "tb-lr" | "tb-rl" => false,
+            _ => {
+                warn!("unrecognized `writing-mode`, assuming horizontal");
+                true
+            },
+        };
+
+        if horizontal {
+            PhysicalSize::new(entry.inline_size() as u32, entry.block_size() as u32)
+        } else {
+            PhysicalSize::new(entry.block_size() as u32, entry.inline_size() as u32)
+        }
+    }
+}
+
+impl Drop for ResizeScaleInternal {
+    fn drop(&mut self) {
+        self.observer.disconnect();
+    }
+}
+
+// TODO: Remove when Safari supports `devicePixelContentBoxSize`.
+// See <https://bugs.webkit.org/show_bug.cgi?id=219005>.
+pub fn has_device_pixel_support() -> bool {
+    thread_local! {
+        static DEVICE_PIXEL_SUPPORT: bool = {
+            #[wasm_bindgen]
+            extern "C" {
+                type ResizeObserverEntryExt;
+
+                #[wasm_bindgen(js_class = ResizeObserverEntry, static_method_of = ResizeObserverEntryExt, getter)]
+                fn prototype() -> Object;
+            }
+
+            let prototype = ResizeObserverEntryExt::prototype();
+            let descriptor = Object::get_own_property_descriptor(
+                &prototype,
+                &JsValue::from_str("devicePixelContentBoxSize"),
+            );
+            !descriptor.is_undefined()
+        };
+    }
+
+    DEVICE_PIXEL_SUPPORT.with(|support| *support)
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/schedule.rs b/vendor/winit/src/platform_impl/web/web_sys/schedule.rs
new file mode 100644
index 00000000..eb970684
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/schedule.rs
@@ -0,0 +1,342 @@
+use js_sys::{Array, Function, Object, Promise, Reflect};
+use std::cell::OnceCell;
+use std::time::Duration;
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen::{JsCast, JsValue};
+use web_sys::{
+    AbortController, AbortSignal, Blob, BlobPropertyBag, MessageChannel, MessagePort, Url, Worker,
+};
+
+use crate::platform::web::{PollStrategy, WaitUntilStrategy};
+
+#[derive(Debug)]
+pub struct Schedule {
+    _closure: Closure<dyn FnMut()>,
+    inner: Inner,
+}
+
+#[derive(Debug)]
+enum Inner {
+    Scheduler {
+        controller: AbortController,
+    },
+    IdleCallback {
+        window: web_sys::Window,
+        handle: u32,
+    },
+    Timeout {
+        window: web_sys::Window,
+        handle: i32,
+        port: MessagePort,
+        _timeout_closure: Closure<dyn FnMut()>,
+    },
+    Worker(MessagePort),
+}
+
+impl Schedule {
+    pub fn new<F>(strategy: PollStrategy, window: &web_sys::Window, f: F) -> Schedule
+    where
+        F: 'static + FnMut(),
+    {
+        if strategy == PollStrategy::Scheduler && has_scheduler_support(window) {
+            Self::new_scheduler(window, f, None)
+        } else if strategy == PollStrategy::IdleCallback && has_idle_callback_support(window) {
+            Self::new_idle_callback(window.clone(), f)
+        } else {
+            Self::new_timeout(window.clone(), f, None)
+        }
+    }
+
+    pub fn new_with_duration<F>(
+        strategy: WaitUntilStrategy,
+        window: &web_sys::Window,
+        f: F,
+        duration: Duration,
+    ) -> Schedule
+    where
+        F: 'static + FnMut(),
+    {
+        match strategy {
+            WaitUntilStrategy::Scheduler => {
+                if has_scheduler_support(window) {
+                    Self::new_scheduler(window, f, Some(duration))
+                } else {
+                    Self::new_timeout(window.clone(), f, Some(duration))
+                }
+            },
+            WaitUntilStrategy::Worker => Self::new_worker(f, duration),
+        }
+    }
+
+    fn new_scheduler<F>(window: &web_sys::Window, f: F, duration: Option<Duration>) -> Schedule
+    where
+        F: 'static + FnMut(),
+    {
+        let window: &WindowSupportExt = window.unchecked_ref();
+        let scheduler = window.scheduler();
+
+        let closure = Closure::new(f);
+        let mut options = SchedulerPostTaskOptions::new();
+        let controller = AbortController::new().expect("Failed to create `AbortController`");
+        options.signal(&controller.signal());
+
+        if let Some(duration) = duration {
+            // `Duration::as_millis()` always rounds down (because of truncation), we want to round
+            // up instead. This makes sure that the we never wake up **before** the given time.
+            let duration = duration
+                .as_secs()
+                .checked_mul(1000)
+                .and_then(|secs| secs.checked_add(duration_millis_ceil(duration).into()))
+                .unwrap_or(u64::MAX);
+
+            options.delay(duration as f64);
+        }
+
+        thread_local! {
+            static REJECT_HANDLER: Closure<dyn FnMut(JsValue)> = Closure::new(|_| ());
+        }
+        REJECT_HANDLER.with(|handler| {
+            let _ = scheduler
+                .post_task_with_options(closure.as_ref().unchecked_ref(), &options)
+                .catch(handler);
+        });
+
+        Schedule { _closure: closure, inner: Inner::Scheduler { controller } }
+    }
+
+    fn new_idle_callback<F>(window: web_sys::Window, f: F) -> Schedule
+    where
+        F: 'static + FnMut(),
+    {
+        let closure = Closure::new(f);
+        let handle = window
+            .request_idle_callback(closure.as_ref().unchecked_ref())
+            .expect("Failed to request idle callback");
+
+        Schedule { _closure: closure, inner: Inner::IdleCallback { window, handle } }
+    }
+
+    fn new_timeout<F>(window: web_sys::Window, f: F, duration: Option<Duration>) -> Schedule
+    where
+        F: 'static + FnMut(),
+    {
+        let channel = MessageChannel::new().unwrap();
+        let closure = Closure::new(f);
+        let port_1 = channel.port1();
+        port_1.set_onmessage(Some(closure.as_ref().unchecked_ref()));
+        port_1.start();
+
+        let port_2 = channel.port2();
+        let timeout_closure = Closure::new(move || {
+            port_2.post_message(&JsValue::UNDEFINED).expect("Failed to send message")
+        });
+        let handle = if let Some(duration) = duration {
+            // `Duration::as_millis()` always rounds down (because of truncation), we want to round
+            // up instead. This makes sure that the we never wake up **before** the given time.
+            let duration = duration
+                .as_secs()
+                .try_into()
+                .ok()
+                .and_then(|secs: i32| secs.checked_mul(1000))
+                .and_then(|secs: i32| {
+                    let millis: i32 = duration_millis_ceil(duration)
+                        .try_into()
+                        .expect("millis are somehow bigger then 1K");
+                    secs.checked_add(millis)
+                })
+                .unwrap_or(i32::MAX);
+
+            window.set_timeout_with_callback_and_timeout_and_arguments_0(
+                timeout_closure.as_ref().unchecked_ref(),
+                duration,
+            )
+        } else {
+            window.set_timeout_with_callback(timeout_closure.as_ref().unchecked_ref())
+        }
+        .expect("Failed to set timeout");
+
+        Schedule {
+            _closure: closure,
+            inner: Inner::Timeout {
+                window,
+                handle,
+                port: port_1,
+                _timeout_closure: timeout_closure,
+            },
+        }
+    }
+
+    fn new_worker<F>(f: F, duration: Duration) -> Schedule
+    where
+        F: 'static + FnMut(),
+    {
+        thread_local! {
+            static URL: ScriptUrl = ScriptUrl::new(include_str!("worker.min.js"));
+            static WORKER: Worker = URL.with(|url| Worker::new(&url.0)).expect("`new Worker()` is not expected to fail with a local script");
+        }
+
+        let channel = MessageChannel::new().unwrap();
+        let closure = Closure::new(f);
+        let port_1 = channel.port1();
+        port_1.set_onmessage(Some(closure.as_ref().unchecked_ref()));
+        port_1.start();
+
+        // `Duration::as_millis()` always rounds down (because of truncation), we want to round
+        // up instead. This makes sure that the we never wake up **before** the given time.
+        let duration = duration
+            .as_secs()
+            .try_into()
+            .ok()
+            .and_then(|secs: u32| secs.checked_mul(1000))
+            .and_then(|secs| secs.checked_add(duration_millis_ceil(duration)))
+            .unwrap_or(u32::MAX);
+
+        WORKER
+            .with(|worker| {
+                let port_2 = channel.port2();
+                worker.post_message_with_transfer(
+                    &Array::of2(&port_2, &duration.into()),
+                    &Array::of1(&port_2).into(),
+                )
+            })
+            .expect("`Worker.postMessage()` is not expected to fail");
+
+        Schedule { _closure: closure, inner: Inner::Worker(port_1) }
+    }
+}
+
+impl Drop for Schedule {
+    fn drop(&mut self) {
+        match &self.inner {
+            Inner::Scheduler { controller, .. } => controller.abort(),
+            Inner::IdleCallback { window, handle, .. } => window.cancel_idle_callback(*handle),
+            Inner::Timeout { window, handle, port, .. } => {
+                window.clear_timeout_with_handle(*handle);
+                port.close();
+                port.set_onmessage(None);
+            },
+            Inner::Worker(port) => {
+                port.close();
+                port.set_onmessage(None);
+            },
+        }
+    }
+}
+
+// TODO: Replace with `u32::div_ceil()` when we hit Rust v1.73.
+fn duration_millis_ceil(duration: Duration) -> u32 {
+    let micros = duration.subsec_micros();
+
+    // From <https://doc.rust-lang.org/1.73.0/src/core/num/uint_macros.rs.html#2086-2094>.
+    let d = micros / 1000;
+    let r = micros % 1000;
+    if r > 0 && 1000 > 0 {
+        d + 1
+    } else {
+        d
+    }
+}
+
+fn has_scheduler_support(window: &web_sys::Window) -> bool {
+    thread_local! {
+        static SCHEDULER_SUPPORT: OnceCell<bool> = const { OnceCell::new() };
+    }
+
+    SCHEDULER_SUPPORT.with(|support| {
+        *support.get_or_init(|| {
+            #[wasm_bindgen]
+            extern "C" {
+                type SchedulerSupport;
+
+                #[wasm_bindgen(method, getter, js_name = scheduler)]
+                fn has_scheduler(this: &SchedulerSupport) -> JsValue;
+            }
+
+            let support: &SchedulerSupport = window.unchecked_ref();
+
+            !support.has_scheduler().is_undefined()
+        })
+    })
+}
+
+fn has_idle_callback_support(window: &web_sys::Window) -> bool {
+    thread_local! {
+        static IDLE_CALLBACK_SUPPORT: OnceCell<bool> = const { OnceCell::new() };
+    }
+
+    IDLE_CALLBACK_SUPPORT.with(|support| {
+        *support.get_or_init(|| {
+            #[wasm_bindgen]
+            extern "C" {
+                type IdleCallbackSupport;
+
+                #[wasm_bindgen(method, getter, js_name = requestIdleCallback)]
+                fn has_request_idle_callback(this: &IdleCallbackSupport) -> JsValue;
+            }
+
+            let support: &IdleCallbackSupport = window.unchecked_ref();
+            !support.has_request_idle_callback().is_undefined()
+        })
+    })
+}
+
+struct ScriptUrl(String);
+
+impl ScriptUrl {
+    fn new(script: &str) -> Self {
+        let sequence = Array::of1(&script.into());
+        let property = BlobPropertyBag::new();
+        property.set_type("text/javascript");
+        let blob = Blob::new_with_str_sequence_and_options(&sequence, &property)
+            .expect("`new Blob()` should never throw");
+
+        let url = Url::create_object_url_with_blob(&blob)
+            .expect("`URL.createObjectURL()` should never throw");
+
+        Self(url)
+    }
+}
+
+impl Drop for ScriptUrl {
+    fn drop(&mut self) {
+        Url::revoke_object_url(&self.0).expect("`URL.revokeObjectURL()` should never throw");
+    }
+}
+
+#[wasm_bindgen]
+extern "C" {
+    type WindowSupportExt;
+
+    #[wasm_bindgen(method, getter)]
+    fn scheduler(this: &WindowSupportExt) -> Scheduler;
+
+    type Scheduler;
+
+    #[wasm_bindgen(method, js_name = postTask)]
+    fn post_task_with_options(
+        this: &Scheduler,
+        callback: &Function,
+        options: &SchedulerPostTaskOptions,
+    ) -> Promise;
+
+    type SchedulerPostTaskOptions;
+}
+
+impl SchedulerPostTaskOptions {
+    fn new() -> Self {
+        Object::new().unchecked_into()
+    }
+
+    fn delay(&mut self, val: f64) -> &mut Self {
+        let r = Reflect::set(self, &JsValue::from("delay"), &val.into());
+        debug_assert!(r.is_ok(), "Failed to set `delay` property");
+        self
+    }
+
+    fn signal(&mut self, val: &AbortSignal) -> &mut Self {
+        let r = Reflect::set(self, &JsValue::from("signal"), &val.into());
+        debug_assert!(r.is_ok(), "Failed to set `signal` property");
+        self
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/worker.js b/vendor/winit/src/platform_impl/web/web_sys/worker.js
new file mode 100644
index 00000000..5a8411ef
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/worker.js
@@ -0,0 +1,10 @@
+onmessage = event => {
+    const [port, timeout] = event.data
+    const f = () => port.postMessage(undefined)
+
+    if ('scheduler' in this) {
+        scheduler.postTask(f, { delay: timeout })
+    } else {
+        setTimeout(f, timeout)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/web/web_sys/worker.min.js b/vendor/winit/src/platform_impl/web/web_sys/worker.min.js
new file mode 100644
index 00000000..fd394a73
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/web_sys/worker.min.js
@@ -0,0 +1 @@
+onmessage=e=>{let[s,t]=e.data,a=()=>s.postMessage(void 0);"scheduler"in this?scheduler.postTask(a,{delay:t}):setTimeout(a,t)};
diff --git a/vendor/winit/src/platform_impl/web/window.rs b/vendor/winit/src/platform_impl/web/window.rs
new file mode 100644
index 00000000..29ca7302
--- /dev/null
+++ b/vendor/winit/src/platform_impl/web/window.rs
@@ -0,0 +1,477 @@
+use crate::dpi::{PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{ExternalError, NotSupportedError, OsError as RootOE};
+use crate::icon::Icon;
+use crate::window::{
+    Cursor, CursorGrabMode, ImePurpose, ResizeDirection, Theme, UserAttentionType,
+    WindowAttributes, WindowButtons, WindowId as RootWI, WindowLevel,
+};
+
+use super::main_thread::{MainThreadMarker, MainThreadSafe};
+use super::monitor::MonitorHandle;
+use super::r#async::Dispatcher;
+use super::{backend, ActiveEventLoop, Fullscreen};
+use web_sys::HtmlCanvasElement;
+
+use std::cell::RefCell;
+use std::collections::VecDeque;
+use std::rc::Rc;
+use std::sync::Arc;
+
+pub struct Window {
+    inner: Dispatcher<Inner>,
+}
+
+pub struct Inner {
+    id: WindowId,
+    pub window: web_sys::Window,
+    canvas: Rc<RefCell<backend::Canvas>>,
+    destroy_fn: Option<Box<dyn FnOnce()>>,
+}
+
+impl Window {
+    pub(crate) fn new(
+        target: &ActiveEventLoop,
+        mut attr: WindowAttributes,
+    ) -> Result<Self, RootOE> {
+        let id = target.generate_id();
+
+        let window = target.runner.window();
+        let document = target.runner.document();
+        let canvas = backend::Canvas::create(
+            target.runner.main_thread(),
+            id,
+            window.clone(),
+            document.clone(),
+            &mut attr,
+        )?;
+        let canvas = Rc::new(RefCell::new(canvas));
+
+        target.register(&canvas, id);
+
+        let runner = target.runner.clone();
+        let destroy_fn = Box::new(move || runner.notify_destroy_window(RootWI(id)));
+
+        let inner = Inner { id, window: window.clone(), canvas, destroy_fn: Some(destroy_fn) };
+
+        inner.set_title(&attr.title);
+        inner.set_maximized(attr.maximized);
+        inner.set_visible(attr.visible);
+        inner.set_window_icon(attr.window_icon);
+        inner.set_cursor(attr.cursor);
+
+        let canvas = Rc::downgrade(&inner.canvas);
+        let (dispatcher, runner) = Dispatcher::new(target.runner.main_thread(), inner).unwrap();
+        target.runner.add_canvas(RootWI(id), canvas, runner);
+
+        Ok(Window { inner: dispatcher })
+    }
+
+    pub(crate) fn maybe_queue_on_main(&self, f: impl FnOnce(&Inner) + Send + 'static) {
+        self.inner.dispatch(f)
+    }
+
+    pub(crate) fn maybe_wait_on_main<R: Send>(&self, f: impl FnOnce(&Inner) -> R + Send) -> R {
+        self.inner.queue(f)
+    }
+
+    pub fn canvas(&self) -> Option<HtmlCanvasElement> {
+        self.inner.value().map(|inner| inner.canvas.borrow().raw().clone())
+    }
+
+    pub(crate) fn prevent_default(&self) -> bool {
+        self.inner.queue(|inner| inner.canvas.borrow().prevent_default.get())
+    }
+
+    pub(crate) fn set_prevent_default(&self, prevent_default: bool) {
+        self.inner.dispatch(move |inner| inner.canvas.borrow().prevent_default.set(prevent_default))
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_window_handle_rwh_06(&self) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        self.inner
+            .value()
+            .map(|inner| {
+                let canvas = inner.canvas.borrow();
+                // SAFETY: This will only work if the reference to `HtmlCanvasElement` stays valid.
+                let canvas: &wasm_bindgen::JsValue = canvas.raw();
+                let window_handle =
+                    rwh_06::WebCanvasWindowHandle::new(std::ptr::NonNull::from(canvas).cast());
+                rwh_06::RawWindowHandle::WebCanvas(window_handle)
+            })
+            .ok_or(rwh_06::HandleError::Unavailable)
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub(crate) fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Web(rwh_06::WebDisplayHandle::new()))
+    }
+}
+
+impl Inner {
+    pub fn set_title(&self, title: &str) {
+        self.canvas.borrow().set_attribute("alt", title)
+    }
+
+    pub fn set_transparent(&self, _transparent: bool) {}
+
+    pub fn set_blur(&self, _blur: bool) {}
+
+    pub fn set_visible(&self, _visible: bool) {
+        // Intentionally a no-op
+    }
+
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        None
+    }
+
+    pub fn request_redraw(&self) {
+        self.canvas.borrow().request_animation_frame();
+    }
+
+    pub fn pre_present_notify(&self) {}
+
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        Ok(self.canvas.borrow().position().to_physical(self.scale_factor()))
+    }
+
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        // Note: the canvas element has no window decorations, so this is equal to `outer_position`.
+        self.outer_position()
+    }
+
+    pub fn set_outer_position(&self, position: Position) {
+        let canvas = self.canvas.borrow();
+        let position = position.to_logical::<f64>(self.scale_factor());
+
+        backend::set_canvas_position(canvas.document(), canvas.raw(), canvas.style(), position)
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        self.canvas.borrow().inner_size()
+    }
+
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        // Note: the canvas element has no window decorations, so this is equal to `inner_size`.
+        self.inner_size()
+    }
+
+    #[inline]
+    pub fn request_inner_size(&self, size: Size) -> Option<PhysicalSize<u32>> {
+        let size = size.to_logical(self.scale_factor());
+        let canvas = self.canvas.borrow();
+        backend::set_canvas_size(canvas.document(), canvas.raw(), canvas.style(), size);
+        None
+    }
+
+    #[inline]
+    pub fn set_min_inner_size(&self, dimensions: Option<Size>) {
+        let dimensions = dimensions.map(|dimensions| dimensions.to_logical(self.scale_factor()));
+        let canvas = self.canvas.borrow();
+        backend::set_canvas_min_size(canvas.document(), canvas.raw(), canvas.style(), dimensions)
+    }
+
+    #[inline]
+    pub fn set_max_inner_size(&self, dimensions: Option<Size>) {
+        let dimensions = dimensions.map(|dimensions| dimensions.to_logical(self.scale_factor()));
+        let canvas = self.canvas.borrow();
+        backend::set_canvas_max_size(canvas.document(), canvas.raw(), canvas.style(), dimensions)
+    }
+
+    #[inline]
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        None
+    }
+
+    #[inline]
+    pub fn set_resize_increments(&self, _increments: Option<Size>) {
+        // Intentionally a no-op: users can't resize canvas elements
+    }
+
+    #[inline]
+    pub fn set_resizable(&self, _resizable: bool) {
+        // Intentionally a no-op: users can't resize canvas elements
+    }
+
+    pub fn is_resizable(&self) -> bool {
+        true
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, _buttons: WindowButtons) {}
+
+    #[inline]
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        WindowButtons::all()
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        super::backend::scale_factor(&self.window)
+    }
+
+    #[inline]
+    pub fn set_cursor(&self, cursor: Cursor) {
+        self.canvas.borrow_mut().cursor.set_cursor(cursor)
+    }
+
+    #[inline]
+    pub fn set_cursor_position(&self, _position: Position) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn set_cursor_grab(&self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        let lock = match mode {
+            CursorGrabMode::None => false,
+            CursorGrabMode::Locked => true,
+            CursorGrabMode::Confined => {
+                return Err(ExternalError::NotSupported(NotSupportedError::new()))
+            },
+        };
+
+        self.canvas.borrow().set_cursor_lock(lock).map_err(ExternalError::Os)
+    }
+
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        self.canvas.borrow_mut().cursor.set_cursor_visible(visible)
+    }
+
+    #[inline]
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn drag_resize_window(&self, _direction: ResizeDirection) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, _position: Position) {}
+
+    #[inline]
+    pub fn set_cursor_hittest(&self, _hittest: bool) -> Result<(), ExternalError> {
+        Err(ExternalError::NotSupported(NotSupportedError::new()))
+    }
+
+    #[inline]
+    pub fn set_minimized(&self, _minimized: bool) {
+        // Intentionally a no-op, as canvases cannot be 'minimized'
+    }
+
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        // Canvas cannot be 'minimized'
+        Some(false)
+    }
+
+    #[inline]
+    pub fn set_maximized(&self, _maximized: bool) {
+        // Intentionally a no-op, as canvases cannot be 'maximized'
+    }
+
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        // Canvas cannot be 'maximized'
+        false
+    }
+
+    #[inline]
+    pub(crate) fn fullscreen(&self) -> Option<Fullscreen> {
+        if self.canvas.borrow().is_fullscreen() {
+            Some(Fullscreen::Borderless(None))
+        } else {
+            None
+        }
+    }
+
+    #[inline]
+    pub(crate) fn set_fullscreen(&self, fullscreen: Option<Fullscreen>) {
+        let canvas = &self.canvas.borrow();
+
+        if fullscreen.is_some() {
+            canvas.request_fullscreen();
+        } else {
+            canvas.exit_fullscreen()
+        }
+    }
+
+    #[inline]
+    pub fn set_decorations(&self, _decorations: bool) {
+        // Intentionally a no-op, no canvas decorations
+    }
+
+    pub fn is_decorated(&self) -> bool {
+        true
+    }
+
+    #[inline]
+    pub fn set_window_level(&self, _level: WindowLevel) {
+        // Intentionally a no-op, no window ordering
+    }
+
+    #[inline]
+    pub fn set_window_icon(&self, _window_icon: Option<Icon>) {
+        // Currently an intentional no-op
+    }
+
+    #[inline]
+    pub fn set_ime_cursor_area(&self, _position: Position, _size: Size) {
+        // Currently a no-op as it does not seem there is good support for this on web
+    }
+
+    #[inline]
+    pub fn set_ime_allowed(&self, _allowed: bool) {
+        // Currently not implemented
+    }
+
+    #[inline]
+    pub fn set_ime_purpose(&self, _purpose: ImePurpose) {
+        // Currently not implemented
+    }
+
+    #[inline]
+    pub fn focus_window(&self) {
+        let _ = self.canvas.borrow().raw().focus();
+    }
+
+    #[inline]
+    pub fn request_user_attention(&self, _request_type: Option<UserAttentionType>) {
+        // Currently an intentional no-op
+    }
+
+    #[inline]
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        None
+    }
+
+    #[inline]
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        VecDeque::new()
+    }
+
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        None
+    }
+
+    #[inline]
+    pub fn id(&self) -> WindowId {
+        self.id
+    }
+
+    #[cfg(feature = "rwh_04")]
+    #[inline]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        let mut window_handle = rwh_04::WebHandle::empty();
+        window_handle.id = self.id.0;
+        rwh_04::RawWindowHandle::Web(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        let mut window_handle = rwh_05::WebWindowHandle::empty();
+        window_handle.id = self.id.0;
+        rwh_05::RawWindowHandle::Web(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Web(rwh_05::WebDisplayHandle::empty())
+    }
+
+    #[inline]
+    pub fn set_theme(&self, _theme: Option<Theme>) {}
+
+    #[inline]
+    pub fn theme(&self) -> Option<Theme> {
+        backend::is_dark_mode(&self.window).map(|is_dark_mode| {
+            if is_dark_mode {
+                Theme::Dark
+            } else {
+                Theme::Light
+            }
+        })
+    }
+
+    pub fn set_content_protected(&self, _protected: bool) {}
+
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        self.canvas.borrow().has_focus.get()
+    }
+
+    pub fn title(&self) -> String {
+        String::new()
+    }
+
+    pub fn reset_dead_keys(&self) {
+        // Not supported
+    }
+}
+
+impl Drop for Inner {
+    fn drop(&mut self) {
+        if let Some(destroy_fn) = self.destroy_fn.take() {
+            destroy_fn();
+        }
+    }
+}
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct WindowId(pub(crate) u32);
+
+impl WindowId {
+    pub const fn dummy() -> Self {
+        Self(0)
+    }
+}
+
+impl From<WindowId> for u64 {
+    fn from(window_id: WindowId) -> Self {
+        window_id.0 as u64
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(raw_id: u64) -> Self {
+        Self(raw_id as u32)
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct PlatformSpecificWindowAttributes {
+    pub(crate) canvas: Option<Arc<MainThreadSafe<backend::RawCanvasType>>>,
+    pub(crate) prevent_default: bool,
+    pub(crate) focusable: bool,
+    pub(crate) append: bool,
+}
+
+impl PlatformSpecificWindowAttributes {
+    pub(crate) fn set_canvas(&mut self, canvas: Option<backend::RawCanvasType>) {
+        let Some(canvas) = canvas else {
+            self.canvas = None;
+            return;
+        };
+
+        let main_thread = MainThreadMarker::new()
+            .expect("received a `HtmlCanvasElement` outside the window context");
+
+        self.canvas = Some(Arc::new(MainThreadSafe::new(main_thread, canvas)));
+    }
+}
+
+impl Default for PlatformSpecificWindowAttributes {
+    fn default() -> Self {
+        Self { canvas: None, prevent_default: true, focusable: true, append: false }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/dark_mode.rs b/vendor/winit/src/platform_impl/windows/dark_mode.rs
new file mode 100644
index 00000000..1c0ffedc
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/dark_mode.rs
@@ -0,0 +1,171 @@
+/// This is a simple implementation of support for Windows Dark Mode,
+/// which is inspired by the solution in https://github.com/ysc3839/win32-darkmode
+use std::{ffi::c_void, ptr};
+
+use crate::utils::Lazy;
+use windows_sys::core::PCSTR;
+use windows_sys::Win32::Foundation::{BOOL, HWND, NTSTATUS, S_OK};
+use windows_sys::Win32::System::LibraryLoader::{GetProcAddress, LoadLibraryA};
+use windows_sys::Win32::System::SystemInformation::OSVERSIONINFOW;
+use windows_sys::Win32::UI::Accessibility::{HCF_HIGHCONTRASTON, HIGHCONTRASTA};
+use windows_sys::Win32::UI::Controls::SetWindowTheme;
+use windows_sys::Win32::UI::WindowsAndMessaging::{SystemParametersInfoA, SPI_GETHIGHCONTRAST};
+
+use crate::window::Theme;
+
+use super::util;
+
+// PdfCraft patch: `pub(crate)`, for the Windows 11 check in `WM_DPICHANGED` (event_loop.rs).
+pub(crate) static WIN10_BUILD_VERSION: Lazy<Option<u32>> = Lazy::new(|| {
+    type RtlGetVersion = unsafe extern "system" fn(*mut OSVERSIONINFOW) -> NTSTATUS;
+    let handle = get_function!("ntdll.dll", RtlGetVersion);
+
+    if let Some(rtl_get_version) = handle {
+        unsafe {
+            let mut vi = OSVERSIONINFOW {
+                dwOSVersionInfoSize: 0,
+                dwMajorVersion: 0,
+                dwMinorVersion: 0,
+                dwBuildNumber: 0,
+                dwPlatformId: 0,
+                szCSDVersion: [0; 128],
+            };
+
+            let status = (rtl_get_version)(&mut vi);
+
+            if status >= 0 && vi.dwMajorVersion == 10 && vi.dwMinorVersion == 0 {
+                Some(vi.dwBuildNumber)
+            } else {
+                None
+            }
+        }
+    } else {
+        None
+    }
+});
+
+static DARK_MODE_SUPPORTED: Lazy<bool> = Lazy::new(|| {
+    // We won't try to do anything for windows versions < 17763
+    // (Windows 10 October 2018 update)
+    match *WIN10_BUILD_VERSION {
+        Some(v) => v >= 17763,
+        None => false,
+    }
+});
+
+static DARK_THEME_NAME: Lazy<Vec<u16>> = Lazy::new(|| util::encode_wide("DarkMode_Explorer"));
+static LIGHT_THEME_NAME: Lazy<Vec<u16>> = Lazy::new(|| util::encode_wide(""));
+
+/// Attempt to set a theme on a window, if necessary.
+/// Returns the theme that was picked
+pub fn try_theme(hwnd: HWND, preferred_theme: Option<Theme>) -> Theme {
+    if *DARK_MODE_SUPPORTED {
+        let is_dark_mode = match preferred_theme {
+            Some(theme) => theme == Theme::Dark,
+            None => should_use_dark_mode(),
+        };
+
+        let theme = if is_dark_mode { Theme::Dark } else { Theme::Light };
+        let theme_name = match theme {
+            Theme::Dark => DARK_THEME_NAME.as_ptr(),
+            Theme::Light => LIGHT_THEME_NAME.as_ptr(),
+        };
+
+        let status = unsafe { SetWindowTheme(hwnd, theme_name, ptr::null()) };
+
+        if status == S_OK && set_dark_mode_for_window(hwnd, is_dark_mode) {
+            return theme;
+        }
+    }
+
+    Theme::Light
+}
+
+fn set_dark_mode_for_window(hwnd: HWND, is_dark_mode: bool) -> bool {
+    // Uses Windows undocumented API SetWindowCompositionAttribute,
+    // as seen in win32-darkmode example linked at top of file.
+
+    type SetWindowCompositionAttribute =
+        unsafe extern "system" fn(HWND, *mut WINDOWCOMPOSITIONATTRIBDATA) -> BOOL;
+
+    #[allow(clippy::upper_case_acronyms)]
+    type WINDOWCOMPOSITIONATTRIB = u32;
+    const WCA_USEDARKMODECOLORS: WINDOWCOMPOSITIONATTRIB = 26;
+
+    #[allow(non_snake_case)]
+    #[allow(clippy::upper_case_acronyms)]
+    #[repr(C)]
+    struct WINDOWCOMPOSITIONATTRIBDATA {
+        Attrib: WINDOWCOMPOSITIONATTRIB,
+        pvData: *mut c_void,
+        cbData: usize,
+    }
+
+    static SET_WINDOW_COMPOSITION_ATTRIBUTE: Lazy<Option<SetWindowCompositionAttribute>> =
+        Lazy::new(|| get_function!("user32.dll", SetWindowCompositionAttribute));
+
+    if let Some(set_window_composition_attribute) = *SET_WINDOW_COMPOSITION_ATTRIBUTE {
+        unsafe {
+            // SetWindowCompositionAttribute needs a bigbool (i32), not bool.
+            let mut is_dark_mode_bigbool = BOOL::from(is_dark_mode);
+
+            let mut data = WINDOWCOMPOSITIONATTRIBDATA {
+                Attrib: WCA_USEDARKMODECOLORS,
+                pvData: &mut is_dark_mode_bigbool as *mut _ as _,
+                cbData: std::mem::size_of_val(&is_dark_mode_bigbool) as _,
+            };
+
+            let status = set_window_composition_attribute(hwnd, &mut data);
+
+            status != false.into()
+        }
+    } else {
+        false
+    }
+}
+
+pub fn should_use_dark_mode() -> bool {
+    should_apps_use_dark_mode() && !is_high_contrast()
+}
+
+fn should_apps_use_dark_mode() -> bool {
+    type ShouldAppsUseDarkMode = unsafe extern "system" fn() -> bool;
+    static SHOULD_APPS_USE_DARK_MODE: Lazy<Option<ShouldAppsUseDarkMode>> = Lazy::new(|| unsafe {
+        const UXTHEME_SHOULDAPPSUSEDARKMODE_ORDINAL: PCSTR = 132 as PCSTR;
+
+        // We won't try to do anything for windows versions < 17763
+        // (Windows 10 October 2018 update)
+        if !*DARK_MODE_SUPPORTED {
+            return None;
+        }
+
+        let module = LoadLibraryA("uxtheme.dll\0".as_ptr().cast());
+
+        if module == 0 {
+            return None;
+        }
+
+        let handle = GetProcAddress(module, UXTHEME_SHOULDAPPSUSEDARKMODE_ORDINAL);
+
+        handle.map(|handle| std::mem::transmute(handle))
+    });
+
+    SHOULD_APPS_USE_DARK_MODE
+        .map(|should_apps_use_dark_mode| unsafe { (should_apps_use_dark_mode)() })
+        .unwrap_or(false)
+}
+
+fn is_high_contrast() -> bool {
+    let mut hc = HIGHCONTRASTA { cbSize: 0, dwFlags: 0, lpszDefaultScheme: ptr::null_mut() };
+
+    let ok = unsafe {
+        SystemParametersInfoA(
+            SPI_GETHIGHCONTRAST,
+            std::mem::size_of_val(&hc) as _,
+            &mut hc as *mut _ as _,
+            0,
+        )
+    };
+
+    ok != false.into() && util::has_flag(hc.dwFlags, HCF_HIGHCONTRASTON)
+}
diff --git a/vendor/winit/src/platform_impl/windows/definitions.rs b/vendor/winit/src/platform_impl/windows/definitions.rs
new file mode 100644
index 00000000..c015ffc4
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/definitions.rs
@@ -0,0 +1,148 @@
+#![allow(non_snake_case)]
+#![allow(non_upper_case_globals)]
+
+use std::ffi::c_void;
+
+use windows_sys::core::{IUnknown, GUID, HRESULT};
+use windows_sys::Win32::Foundation::{BOOL, HWND, POINTL};
+use windows_sys::Win32::System::Com::{
+    IAdviseSink, IDataObject, IEnumFORMATETC, IEnumSTATDATA, FORMATETC, STGMEDIUM,
+};
+
+#[repr(C)]
+pub struct IUnknownVtbl {
+    pub QueryInterface: unsafe extern "system" fn(
+        This: *mut IUnknown,
+        riid: *const GUID,
+        ppvObject: *mut *mut c_void,
+    ) -> HRESULT,
+    pub AddRef: unsafe extern "system" fn(This: *mut IUnknown) -> u32,
+    pub Release: unsafe extern "system" fn(This: *mut IUnknown) -> u32,
+}
+
+#[repr(C)]
+pub struct IDataObjectVtbl {
+    pub parent: IUnknownVtbl,
+    pub GetData: unsafe extern "system" fn(
+        This: *mut IDataObject,
+        pformatetcIn: *const FORMATETC,
+        pmedium: *mut STGMEDIUM,
+    ) -> HRESULT,
+    pub GetDataHere: unsafe extern "system" fn(
+        This: *mut IDataObject,
+        pformatetc: *const FORMATETC,
+        pmedium: *mut STGMEDIUM,
+    ) -> HRESULT,
+    QueryGetData:
+        unsafe extern "system" fn(This: *mut IDataObject, pformatetc: *const FORMATETC) -> HRESULT,
+    pub GetCanonicalFormatEtc: unsafe extern "system" fn(
+        This: *mut IDataObject,
+        pformatetcIn: *const FORMATETC,
+        pformatetcOut: *mut FORMATETC,
+    ) -> HRESULT,
+    pub SetData: unsafe extern "system" fn(
+        This: *mut IDataObject,
+        pformatetc: *const FORMATETC,
+        pformatetcOut: *const FORMATETC,
+        fRelease: BOOL,
+    ) -> HRESULT,
+    pub EnumFormatEtc: unsafe extern "system" fn(
+        This: *mut IDataObject,
+        dwDirection: u32,
+        ppenumFormatEtc: *mut *mut IEnumFORMATETC,
+    ) -> HRESULT,
+    pub DAdvise: unsafe extern "system" fn(
+        This: *mut IDataObject,
+        pformatetc: *const FORMATETC,
+        advf: u32,
+        pAdvSInk: *const IAdviseSink,
+        pdwConnection: *mut u32,
+    ) -> HRESULT,
+    pub DUnadvise: unsafe extern "system" fn(This: *mut IDataObject, dwConnection: u32) -> HRESULT,
+    pub EnumDAdvise: unsafe extern "system" fn(
+        This: *mut IDataObject,
+        ppenumAdvise: *const *const IEnumSTATDATA,
+    ) -> HRESULT,
+}
+
+#[repr(C)]
+pub struct IDropTargetVtbl {
+    pub parent: IUnknownVtbl,
+    pub DragEnter: unsafe extern "system" fn(
+        This: *mut IDropTarget,
+        pDataObj: *const IDataObject,
+        grfKeyState: u32,
+        pt: *const POINTL,
+        pdwEffect: *mut u32,
+    ) -> HRESULT,
+    pub DragOver: unsafe extern "system" fn(
+        This: *mut IDropTarget,
+        grfKeyState: u32,
+        pt: *const POINTL,
+        pdwEffect: *mut u32,
+    ) -> HRESULT,
+    pub DragLeave: unsafe extern "system" fn(This: *mut IDropTarget) -> HRESULT,
+    pub Drop: unsafe extern "system" fn(
+        This: *mut IDropTarget,
+        pDataObj: *const IDataObject,
+        grfKeyState: u32,
+        pt: *const POINTL,
+        pdwEffect: *mut u32,
+    ) -> HRESULT,
+}
+
+#[repr(C)]
+pub struct IDropTarget {
+    pub lpVtbl: *const IDropTargetVtbl,
+}
+
+#[repr(C)]
+pub struct ITaskbarListVtbl {
+    pub parent: IUnknownVtbl,
+    pub HrInit: unsafe extern "system" fn(This: *mut ITaskbarList) -> HRESULT,
+    pub AddTab: unsafe extern "system" fn(This: *mut ITaskbarList, hwnd: HWND) -> HRESULT,
+    pub DeleteTab: unsafe extern "system" fn(This: *mut ITaskbarList, hwnd: HWND) -> HRESULT,
+    pub ActivateTab: unsafe extern "system" fn(This: *mut ITaskbarList, hwnd: HWND) -> HRESULT,
+    pub SetActiveAlt: unsafe extern "system" fn(This: *mut ITaskbarList, hwnd: HWND) -> HRESULT,
+}
+
+#[repr(C)]
+pub struct ITaskbarList {
+    pub lpVtbl: *const ITaskbarListVtbl,
+}
+
+#[repr(C)]
+pub struct ITaskbarList2Vtbl {
+    pub parent: ITaskbarListVtbl,
+    pub MarkFullscreenWindow: unsafe extern "system" fn(
+        This: *mut ITaskbarList2,
+        hwnd: HWND,
+        fFullscreen: BOOL,
+    ) -> HRESULT,
+}
+
+#[repr(C)]
+pub struct ITaskbarList2 {
+    pub lpVtbl: *const ITaskbarList2Vtbl,
+}
+
+pub const CLSID_TaskbarList: GUID = GUID {
+    data1: 0x56fdf344,
+    data2: 0xfd6d,
+    data3: 0x11d0,
+    data4: [0x95, 0x8a, 0x00, 0x60, 0x97, 0xc9, 0xa0, 0x90],
+};
+
+pub const IID_ITaskbarList: GUID = GUID {
+    data1: 0x56fdf342,
+    data2: 0xfd6d,
+    data3: 0x11d0,
+    data4: [0x95, 0x8a, 0x00, 0x60, 0x97, 0xc9, 0xa0, 0x90],
+};
+
+pub const IID_ITaskbarList2: GUID = GUID {
+    data1: 0x602d4995,
+    data2: 0xb13a,
+    data3: 0x429b,
+    data4: [0xa6, 0x6e, 0x19, 0x35, 0xe4, 0x4f, 0x43, 0x17],
+};
diff --git a/vendor/winit/src/platform_impl/windows/dpi.rs b/vendor/winit/src/platform_impl/windows/dpi.rs
new file mode 100644
index 00000000..5880069c
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/dpi.rs
@@ -0,0 +1,112 @@
+#![allow(non_snake_case, unused_unsafe)]
+
+use std::sync::Once;
+
+use windows_sys::Win32::Foundation::{HWND, S_OK};
+use windows_sys::Win32::Graphics::Gdi::{
+    GetDC, GetDeviceCaps, MonitorFromWindow, HMONITOR, LOGPIXELSX, MONITOR_DEFAULTTONEAREST,
+};
+use windows_sys::Win32::UI::HiDpi::{
+    DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE, DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2,
+    MDT_EFFECTIVE_DPI, PROCESS_PER_MONITOR_DPI_AWARE,
+};
+use windows_sys::Win32::UI::WindowsAndMessaging::IsProcessDPIAware;
+
+use crate::platform_impl::platform::util::{
+    ENABLE_NON_CLIENT_DPI_SCALING, GET_DPI_FOR_MONITOR, GET_DPI_FOR_WINDOW, SET_PROCESS_DPI_AWARE,
+    SET_PROCESS_DPI_AWARENESS, SET_PROCESS_DPI_AWARENESS_CONTEXT,
+};
+
+pub fn become_dpi_aware() {
+    static ENABLE_DPI_AWARENESS: Once = Once::new();
+    ENABLE_DPI_AWARENESS.call_once(|| {
+        unsafe {
+            if let Some(SetProcessDpiAwarenessContext) = *SET_PROCESS_DPI_AWARENESS_CONTEXT {
+                // We are on Windows 10 Anniversary Update (1607) or later.
+                if SetProcessDpiAwarenessContext(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2)
+                    == false.into()
+                {
+                    // V2 only works with Windows 10 Creators Update (1703). Try using the older
+                    // V1 if we can't set V2.
+                    SetProcessDpiAwarenessContext(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE);
+                }
+            } else if let Some(SetProcessDpiAwareness) = *SET_PROCESS_DPI_AWARENESS {
+                // We are on Windows 8.1 or later.
+                SetProcessDpiAwareness(PROCESS_PER_MONITOR_DPI_AWARE);
+            } else if let Some(SetProcessDPIAware) = *SET_PROCESS_DPI_AWARE {
+                // We are on Vista or later.
+                SetProcessDPIAware();
+            }
+        }
+    });
+}
+
+pub fn enable_non_client_dpi_scaling(hwnd: HWND) {
+    unsafe {
+        if let Some(EnableNonClientDpiScaling) = *ENABLE_NON_CLIENT_DPI_SCALING {
+            EnableNonClientDpiScaling(hwnd);
+        }
+    }
+}
+
+pub fn get_monitor_dpi(hmonitor: HMONITOR) -> Option<u32> {
+    unsafe {
+        if let Some(GetDpiForMonitor) = *GET_DPI_FOR_MONITOR {
+            // We are on Windows 8.1 or later.
+            let mut dpi_x = 0;
+            let mut dpi_y = 0;
+            if GetDpiForMonitor(hmonitor, MDT_EFFECTIVE_DPI, &mut dpi_x, &mut dpi_y) == S_OK {
+                // MSDN says that "the values of *dpiX and *dpiY are identical. You only need to
+                // record one of the values to determine the DPI and respond appropriately".
+                // https://msdn.microsoft.com/en-us/library/windows/desktop/dn280510(v=vs.85).aspx
+                return Some(dpi_x);
+            }
+        }
+    }
+    None
+}
+
+pub const BASE_DPI: u32 = 96;
+pub fn dpi_to_scale_factor(dpi: u32) -> f64 {
+    dpi as f64 / BASE_DPI as f64
+}
+
+pub unsafe fn hwnd_dpi(hwnd: HWND) -> u32 {
+    let hdc = unsafe { GetDC(hwnd) };
+    if hdc == 0 {
+        panic!("[winit] `GetDC` returned null!");
+    }
+    if let Some(GetDpiForWindow) = *GET_DPI_FOR_WINDOW {
+        // We are on Windows 10 Anniversary Update (1607) or later.
+        match unsafe { GetDpiForWindow(hwnd) } {
+            0 => BASE_DPI, // 0 is returned if hwnd is invalid
+            dpi => dpi,
+        }
+    } else if let Some(GetDpiForMonitor) = *GET_DPI_FOR_MONITOR {
+        // We are on Windows 8.1 or later.
+        let monitor = unsafe { MonitorFromWindow(hwnd, MONITOR_DEFAULTTONEAREST) };
+        if monitor == 0 {
+            return BASE_DPI;
+        }
+
+        let mut dpi_x = 0;
+        let mut dpi_y = 0;
+        if unsafe { GetDpiForMonitor(monitor, MDT_EFFECTIVE_DPI, &mut dpi_x, &mut dpi_y) } == S_OK {
+            dpi_x
+        } else {
+            BASE_DPI
+        }
+    } else {
+        // We are on Vista or later.
+        if unsafe { IsProcessDPIAware() } != false.into() {
+            // If the process is DPI aware, then scaling must be handled by the application using
+            // this DPI value.
+            unsafe { GetDeviceCaps(hdc, LOGPIXELSX as i32) as u32 }
+        } else {
+            // If the process is DPI unaware, then scaling is performed by the OS; we thus return
+            // 96 (scale factor 1.0) to prevent the window from being re-scaled by both the
+            // application and the WM.
+            BASE_DPI
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/drop_handler.rs b/vendor/winit/src/platform_impl/windows/drop_handler.rs
new file mode 100644
index 00000000..38cb5c54
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/drop_handler.rs
@@ -0,0 +1,237 @@
+use std::ffi::{c_void, OsString};
+use std::os::windows::ffi::OsStringExt;
+use std::path::PathBuf;
+use std::ptr;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use windows_sys::core::{IUnknown, GUID, HRESULT};
+use windows_sys::Win32::Foundation::{DV_E_FORMATETC, HWND, POINTL, S_OK};
+use windows_sys::Win32::System::Com::{IDataObject, DVASPECT_CONTENT, FORMATETC, TYMED_HGLOBAL};
+use windows_sys::Win32::System::Ole::{CF_HDROP, DROPEFFECT_COPY, DROPEFFECT_NONE};
+use windows_sys::Win32::UI::Shell::{DragFinish, DragQueryFileW, HDROP};
+
+use tracing::debug;
+
+use crate::platform_impl::platform::definitions::{
+    IDataObjectVtbl, IDropTarget, IDropTargetVtbl, IUnknownVtbl,
+};
+use crate::platform_impl::platform::WindowId;
+
+use crate::event::Event;
+use crate::window::WindowId as RootWindowId;
+
+#[repr(C)]
+pub struct FileDropHandlerData {
+    pub interface: IDropTarget,
+    refcount: AtomicUsize,
+    window: HWND,
+    send_event: Box<dyn Fn(Event<()>)>,
+    cursor_effect: u32,
+    hovered_is_valid: bool, /* If the currently hovered item is not valid there must not be any
+                             * `HoveredFileCancelled` emitted */
+}
+
+pub struct FileDropHandler {
+    pub data: *mut FileDropHandlerData,
+}
+
+#[allow(non_snake_case)]
+impl FileDropHandler {
+    pub fn new(window: HWND, send_event: Box<dyn Fn(Event<()>)>) -> FileDropHandler {
+        let data = Box::new(FileDropHandlerData {
+            interface: IDropTarget { lpVtbl: &DROP_TARGET_VTBL as *const IDropTargetVtbl },
+            refcount: AtomicUsize::new(1),
+            window,
+            send_event,
+            cursor_effect: DROPEFFECT_NONE,
+            hovered_is_valid: false,
+        });
+        FileDropHandler { data: Box::into_raw(data) }
+    }
+
+    // Implement IUnknown
+    pub unsafe extern "system" fn QueryInterface(
+        _this: *mut IUnknown,
+        _riid: *const GUID,
+        _ppvObject: *mut *mut c_void,
+    ) -> HRESULT {
+        // This function doesn't appear to be required for an `IDropTarget`.
+        // An implementation would be nice however.
+        unimplemented!();
+    }
+
+    pub unsafe extern "system" fn AddRef(this: *mut IUnknown) -> u32 {
+        let drop_handler_data = unsafe { Self::from_interface(this) };
+        let count = drop_handler_data.refcount.fetch_add(1, Ordering::Release) + 1;
+        count as u32
+    }
+
+    pub unsafe extern "system" fn Release(this: *mut IUnknown) -> u32 {
+        let drop_handler = unsafe { Self::from_interface(this) };
+        let count = drop_handler.refcount.fetch_sub(1, Ordering::Release) - 1;
+        if count == 0 {
+            // Destroy the underlying data
+            drop(unsafe { Box::from_raw(drop_handler as *mut FileDropHandlerData) });
+        }
+        count as u32
+    }
+
+    pub unsafe extern "system" fn DragEnter(
+        this: *mut IDropTarget,
+        pDataObj: *const IDataObject,
+        _grfKeyState: u32,
+        _pt: *const POINTL,
+        pdwEffect: *mut u32,
+    ) -> HRESULT {
+        use crate::event::WindowEvent::HoveredFile;
+        let drop_handler = unsafe { Self::from_interface(this) };
+        let hdrop = unsafe {
+            Self::iterate_filenames(pDataObj, |filename| {
+                drop_handler.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(WindowId(drop_handler.window)),
+                    event: HoveredFile(filename),
+                });
+            })
+        };
+        drop_handler.hovered_is_valid = hdrop.is_some();
+        drop_handler.cursor_effect =
+            if drop_handler.hovered_is_valid { DROPEFFECT_COPY } else { DROPEFFECT_NONE };
+        unsafe {
+            *pdwEffect = drop_handler.cursor_effect;
+        }
+
+        S_OK
+    }
+
+    pub unsafe extern "system" fn DragOver(
+        this: *mut IDropTarget,
+        _grfKeyState: u32,
+        _pt: *const POINTL,
+        pdwEffect: *mut u32,
+    ) -> HRESULT {
+        let drop_handler = unsafe { Self::from_interface(this) };
+        unsafe {
+            *pdwEffect = drop_handler.cursor_effect;
+        }
+
+        S_OK
+    }
+
+    pub unsafe extern "system" fn DragLeave(this: *mut IDropTarget) -> HRESULT {
+        use crate::event::WindowEvent::HoveredFileCancelled;
+        let drop_handler = unsafe { Self::from_interface(this) };
+        if drop_handler.hovered_is_valid {
+            drop_handler.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(drop_handler.window)),
+                event: HoveredFileCancelled,
+            });
+        }
+
+        S_OK
+    }
+
+    pub unsafe extern "system" fn Drop(
+        this: *mut IDropTarget,
+        pDataObj: *const IDataObject,
+        _grfKeyState: u32,
+        _pt: *const POINTL,
+        _pdwEffect: *mut u32,
+    ) -> HRESULT {
+        use crate::event::WindowEvent::DroppedFile;
+        let drop_handler = unsafe { Self::from_interface(this) };
+        let hdrop = unsafe {
+            Self::iterate_filenames(pDataObj, |filename| {
+                drop_handler.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(WindowId(drop_handler.window)),
+                    event: DroppedFile(filename),
+                });
+            })
+        };
+        if let Some(hdrop) = hdrop {
+            unsafe { DragFinish(hdrop) };
+        }
+
+        S_OK
+    }
+
+    unsafe fn from_interface<'a, InterfaceT>(this: *mut InterfaceT) -> &'a mut FileDropHandlerData {
+        unsafe { &mut *(this as *mut _) }
+    }
+
+    unsafe fn iterate_filenames<F>(data_obj: *const IDataObject, callback: F) -> Option<HDROP>
+    where
+        F: Fn(PathBuf),
+    {
+        let drop_format = FORMATETC {
+            cfFormat: CF_HDROP,
+            ptd: ptr::null_mut(),
+            dwAspect: DVASPECT_CONTENT,
+            lindex: -1,
+            tymed: TYMED_HGLOBAL as u32,
+        };
+
+        let mut medium = unsafe { std::mem::zeroed() };
+        let get_data_fn = unsafe { (*(*data_obj).cast::<IDataObjectVtbl>()).GetData };
+        let get_data_result = unsafe { get_data_fn(data_obj as *mut _, &drop_format, &mut medium) };
+        if get_data_result >= 0 {
+            let hdrop = unsafe { medium.u.hGlobal as HDROP };
+
+            // The second parameter (0xFFFFFFFF) instructs the function to return the item count
+            let item_count = unsafe { DragQueryFileW(hdrop, 0xffffffff, ptr::null_mut(), 0) };
+
+            for i in 0..item_count {
+                // Get the length of the path string NOT including the terminating null character.
+                // Previously, this was using a fixed size array of MAX_PATH length, but the
+                // Windows API allows longer paths under certain circumstances.
+                let character_count =
+                    unsafe { DragQueryFileW(hdrop, i, ptr::null_mut(), 0) as usize };
+                let str_len = character_count + 1;
+
+                // Fill path_buf with the null-terminated file name
+                let mut path_buf = Vec::with_capacity(str_len);
+                unsafe {
+                    DragQueryFileW(hdrop, i, path_buf.as_mut_ptr(), str_len as u32);
+                    path_buf.set_len(str_len);
+                }
+
+                callback(OsString::from_wide(&path_buf[0..character_count]).into());
+            }
+
+            Some(hdrop)
+        } else if get_data_result == DV_E_FORMATETC {
+            // If the dropped item is not a file this error will occur.
+            // In this case it is OK to return without taking further action.
+            debug!("Error occurred while processing dropped/hovered item: item is not a file.");
+            None
+        } else {
+            debug!("Unexpected error occurred while processing dropped/hovered item.");
+            None
+        }
+    }
+}
+
+impl FileDropHandlerData {
+    fn send_event(&self, event: Event<()>) {
+        (self.send_event)(event);
+    }
+}
+
+impl Drop for FileDropHandler {
+    fn drop(&mut self) {
+        unsafe {
+            FileDropHandler::Release(self.data as *mut IUnknown);
+        }
+    }
+}
+
+static DROP_TARGET_VTBL: IDropTargetVtbl = IDropTargetVtbl {
+    parent: IUnknownVtbl {
+        QueryInterface: FileDropHandler::QueryInterface,
+        AddRef: FileDropHandler::AddRef,
+        Release: FileDropHandler::Release,
+    },
+    DragEnter: FileDropHandler::DragEnter,
+    DragOver: FileDropHandler::DragOver,
+    DragLeave: FileDropHandler::DragLeave,
+    Drop: FileDropHandler::Drop,
+};
diff --git a/vendor/winit/src/platform_impl/windows/event_loop.rs b/vendor/winit/src/platform_impl/windows/event_loop.rs
new file mode 100644
index 00000000..469658e4
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/event_loop.rs
@@ -0,0 +1,2684 @@
+#![allow(non_snake_case)]
+
+mod runner;
+
+use std::cell::Cell;
+use std::collections::VecDeque;
+use std::ffi::c_void;
+use std::marker::PhantomData;
+use std::os::windows::io::{AsRawHandle as _, FromRawHandle as _, OwnedHandle, RawHandle};
+use std::rc::Rc;
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::mpsc::{self, Receiver, Sender};
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::time::{Duration, Instant};
+use std::{mem, panic, ptr};
+
+use crate::utils::Lazy;
+
+use windows_sys::Win32::Devices::HumanInterfaceDevice::MOUSE_MOVE_RELATIVE;
+use windows_sys::Win32::Foundation::{
+    GetLastError, FALSE, HANDLE, HWND, LPARAM, LRESULT, POINT, RECT, WAIT_FAILED, WPARAM,
+};
+use windows_sys::Win32::Graphics::Gdi::{
+    GetMonitorInfoW, MonitorFromRect, MonitorFromWindow, RedrawWindow, ScreenToClient,
+    ValidateRect, MONITORINFO, MONITOR_DEFAULTTONULL, RDW_INTERNALPAINT, SC_SCREENSAVE,
+};
+use windows_sys::Win32::System::Ole::RevokeDragDrop;
+use windows_sys::Win32::System::Threading::{
+    CreateWaitableTimerExW, GetCurrentThreadId, SetWaitableTimer,
+    CREATE_WAITABLE_TIMER_HIGH_RESOLUTION, INFINITE, TIMER_ALL_ACCESS,
+};
+use windows_sys::Win32::UI::Controls::{HOVER_DEFAULT, WM_MOUSELEAVE};
+use windows_sys::Win32::UI::Input::Ime::{GCS_COMPSTR, GCS_RESULTSTR, ISC_SHOWUICOMPOSITIONWINDOW};
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::{
+    ReleaseCapture, SetCapture, TrackMouseEvent, TME_LEAVE, TRACKMOUSEEVENT,
+};
+use windows_sys::Win32::UI::Input::Pointer::{
+    POINTER_FLAG_DOWN, POINTER_FLAG_UP, POINTER_FLAG_UPDATE,
+};
+use windows_sys::Win32::UI::Input::Touch::{
+    CloseTouchInputHandle, GetTouchInputInfo, TOUCHEVENTF_DOWN, TOUCHEVENTF_MOVE, TOUCHEVENTF_UP,
+    TOUCHINPUT,
+};
+use windows_sys::Win32::UI::Input::{RAWINPUT, RIM_TYPEKEYBOARD, RIM_TYPEMOUSE};
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    CreateWindowExW, DefWindowProcW, DestroyWindow, DispatchMessageW, GetClientRect, GetCursorPos,
+    GetMenu, LoadCursorW, MsgWaitForMultipleObjectsEx, PeekMessageW, PostMessageW,
+    RegisterClassExW, RegisterWindowMessageA, SetCursor, SetWindowPos, TranslateMessage,
+    CREATESTRUCTW, GIDC_ARRIVAL, GIDC_REMOVAL, GWL_STYLE, GWL_USERDATA, HTCAPTION, HTCLIENT,
+    MINMAXINFO, MNC_CLOSE, MSG, MWMO_INPUTAVAILABLE, NCCALCSIZE_PARAMS, PM_REMOVE, PT_PEN,
+    PT_TOUCH, QS_ALLINPUT, RI_MOUSE_HWHEEL, RI_MOUSE_WHEEL, SC_MINIMIZE, SC_RESTORE,
+    SIZE_MAXIMIZED, SWP_NOACTIVATE, SWP_NOMOVE, SWP_NOSIZE, SWP_NOZORDER, WHEEL_DELTA, WINDOWPOS,
+    WMSZ_BOTTOM, WMSZ_BOTTOMLEFT, WMSZ_BOTTOMRIGHT, WMSZ_LEFT, WMSZ_RIGHT, WMSZ_TOP, WMSZ_TOPLEFT,
+    WMSZ_TOPRIGHT, WM_CAPTURECHANGED, WM_CLOSE, WM_CREATE, WM_DESTROY, WM_DPICHANGED,
+    WM_ENTERSIZEMOVE, WM_EXITSIZEMOVE, WM_GETMINMAXINFO, WM_IME_COMPOSITION, WM_IME_ENDCOMPOSITION,
+    WM_IME_SETCONTEXT, WM_IME_STARTCOMPOSITION, WM_INPUT, WM_INPUT_DEVICE_CHANGE, WM_KEYDOWN,
+    WM_KEYUP, WM_KILLFOCUS, WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MBUTTONDOWN, WM_MBUTTONUP,
+    WM_MENUCHAR, WM_MOUSEHWHEEL, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_NCACTIVATE, WM_NCCALCSIZE,
+    WM_NCCREATE, WM_NCDESTROY, WM_NCLBUTTONDOWN, WM_PAINT, WM_POINTERDOWN, WM_POINTERUP,
+    WM_POINTERUPDATE, WM_RBUTTONDOWN, WM_RBUTTONUP, WM_SETCURSOR, WM_SETFOCUS, WM_SETTINGCHANGE,
+    WM_SIZE, WM_SIZING, WM_SYSCOMMAND, WM_SYSKEYDOWN, WM_SYSKEYUP, WM_TOUCH, WM_WINDOWPOSCHANGED,
+    WM_WINDOWPOSCHANGING, WM_XBUTTONDOWN, WM_XBUTTONUP, WNDCLASSEXW, WS_EX_LAYERED,
+    WS_EX_NOACTIVATE, WS_EX_TOOLWINDOW, WS_EX_TRANSPARENT, WS_OVERLAPPED, WS_POPUP, WS_VISIBLE,
+};
+
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::error::EventLoopError;
+use crate::event::{
+    DeviceEvent, Event, Force, Ime, InnerSizeWriter, RawKeyEvent, Touch, TouchPhase, WindowEvent,
+};
+use crate::event_loop::{ActiveEventLoop as RootAEL, ControlFlow, DeviceEvents, EventLoopClosed};
+use crate::keyboard::ModifiersState;
+use crate::platform::pump_events::PumpStatus;
+use crate::platform_impl::platform::dark_mode::{try_theme, WIN10_BUILD_VERSION};
+use crate::platform_impl::platform::dpi::{become_dpi_aware, dpi_to_scale_factor};
+use crate::platform_impl::platform::drop_handler::FileDropHandler;
+use crate::platform_impl::platform::icon::WinCursor;
+use crate::platform_impl::platform::ime::ImeContext;
+use crate::platform_impl::platform::keyboard::KeyEventBuilder;
+use crate::platform_impl::platform::keyboard_layout::LAYOUT_CACHE;
+use crate::platform_impl::platform::monitor::{self, MonitorHandle};
+use crate::platform_impl::platform::window::InitData;
+use crate::platform_impl::platform::window_state::{
+    CursorFlags, ImeState, WindowFlags, WindowState,
+};
+use crate::platform_impl::platform::{
+    raw_input, util, wrap_device_id, Fullscreen, WindowId, DEVICE_ID,
+};
+use crate::window::{
+    CustomCursor as RootCustomCursor, CustomCursorSource, Theme, WindowId as RootWindowId,
+};
+use runner::{EventLoopRunner, EventLoopRunnerShared};
+
+use super::window::set_skip_taskbar;
+use super::SelectedCursor;
+
+/// some backends like macos uses an uninhabited `Never` type,
+/// on windows, `UserEvent`s are also dispatched through the
+/// WNDPROC callback, and due to the re-entrant nature of the
+/// callback, recursively delivered events must be queued in a
+/// buffer, the current implementation put this queue in
+/// `EventLoopRunner`, which is shared between the event pumping
+/// loop and the callback. because it's hard to decide from the
+/// outside whether a event needs to be buffered, I decided not
+/// use `Event<Never>` for the shared runner state, but use unit
+/// as a placeholder so user events can be buffered as usual,
+/// the real `UserEvent` is pulled from the mpsc channel directly
+/// when the placeholder event is delivered to the event handler
+pub(crate) struct UserEventPlaceholder;
+
+// here below, the generic `EventLoopRunnerShared<T>` is replaced with
+// `EventLoopRunnerShared<UserEventPlaceholder>` so we can get rid
+// of the generic parameter T in types which don't depend on T.
+// this is the approach which requires minimum changes to current
+// backend implementation. it should be considered transitional
+// and should be refactored and cleaned up eventually, I hope.
+
+pub(crate) struct WindowData {
+    pub window_state: Arc<Mutex<WindowState>>,
+    pub event_loop_runner: EventLoopRunnerShared<UserEventPlaceholder>,
+    pub key_event_builder: KeyEventBuilder,
+    pub _file_drop_handler: Option<FileDropHandler>,
+    pub userdata_removed: Cell<bool>,
+    pub recurse_depth: Cell<u32>,
+}
+
+impl WindowData {
+    fn send_event(&self, event: Event<UserEventPlaceholder>) {
+        self.event_loop_runner.send_event(event);
+    }
+
+    fn window_state_lock(&self) -> MutexGuard<'_, WindowState> {
+        self.window_state.lock().unwrap()
+    }
+}
+
+struct ThreadMsgTargetData {
+    event_loop_runner: EventLoopRunnerShared<UserEventPlaceholder>,
+}
+
+impl ThreadMsgTargetData {
+    fn send_event(&self, event: Event<UserEventPlaceholder>) {
+        self.event_loop_runner.send_event(event);
+    }
+}
+
+/// The result of a subclass procedure (the message handling callback)
+#[derive(Clone, Copy)]
+pub(crate) enum ProcResult {
+    DefWindowProc(WPARAM),
+    Value(isize),
+}
+
+pub struct EventLoop<T: 'static> {
+    user_event_sender: Sender<T>,
+    user_event_receiver: Receiver<T>,
+    window_target: RootAEL,
+    msg_hook: Option<Box<dyn FnMut(*const c_void) -> bool + 'static>>,
+    // It is a timer used on timed waits.
+    // It is created lazily in case if we have `ControlFlow::WaitUntil`.
+    // Keep it as a field to avoid recreating it on every `ControlFlow::WaitUntil`.
+    high_resolution_timer: Option<OwnedHandle>,
+}
+
+pub(crate) struct PlatformSpecificEventLoopAttributes {
+    pub(crate) any_thread: bool,
+    pub(crate) dpi_aware: bool,
+    pub(crate) msg_hook: Option<Box<dyn FnMut(*const c_void) -> bool + 'static>>,
+}
+
+impl Default for PlatformSpecificEventLoopAttributes {
+    fn default() -> Self {
+        Self { any_thread: false, dpi_aware: true, msg_hook: None }
+    }
+}
+
+pub struct ActiveEventLoop {
+    thread_id: u32,
+    thread_msg_target: HWND,
+    pub(crate) runner_shared: EventLoopRunnerShared<UserEventPlaceholder>,
+}
+
+impl<T: 'static> EventLoop<T> {
+    pub(crate) fn new(
+        attributes: &mut PlatformSpecificEventLoopAttributes,
+    ) -> Result<Self, EventLoopError> {
+        let thread_id = unsafe { GetCurrentThreadId() };
+
+        if !attributes.any_thread && thread_id != main_thread_id() {
+            panic!(
+                "Initializing the event loop outside of the main thread is a significant \
+                 cross-platform compatibility hazard. If you absolutely need to create an \
+                 EventLoop on a different thread, you can use the \
+                 `EventLoopBuilderExtWindows::any_thread` function."
+            );
+        }
+
+        if attributes.dpi_aware {
+            become_dpi_aware();
+        }
+
+        let thread_msg_target = create_event_target_window();
+
+        let runner_shared = Rc::new(EventLoopRunner::new(thread_msg_target));
+
+        let (user_event_sender, user_event_receiver) = mpsc::channel();
+        insert_event_target_window_data(thread_msg_target, runner_shared.clone());
+        raw_input::register_all_mice_and_keyboards_for_raw_input(
+            thread_msg_target,
+            Default::default(),
+        );
+
+        Ok(EventLoop {
+            user_event_sender,
+            user_event_receiver,
+            window_target: RootAEL {
+                p: ActiveEventLoop { thread_id, thread_msg_target, runner_shared },
+                _marker: PhantomData,
+            },
+            msg_hook: attributes.msg_hook.take(),
+            high_resolution_timer: None,
+        })
+    }
+
+    pub fn window_target(&self) -> &RootAEL {
+        &self.window_target
+    }
+
+    pub fn run<F>(mut self, event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        self.run_on_demand(event_handler)
+    }
+
+    pub fn run_on_demand<F>(&mut self, mut event_handler: F) -> Result<(), EventLoopError>
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        {
+            let runner = &self.window_target.p.runner_shared;
+
+            let event_loop_windows_ref = &self.window_target;
+            let user_event_receiver = &self.user_event_receiver;
+            // # Safety
+            // We make sure to call runner.clear_event_handler() before
+            // returning
+            unsafe {
+                runner.set_event_handler(move |event| {
+                    // the shared `EventLoopRunner` is not parameterized
+                    // `EventLoopProxy::send_event()` calls `PostMessage`
+                    // to wakeup and dispatch a placeholder `UserEvent`,
+                    // when we received the placeholder event here, the
+                    // real UserEvent(T) should already be put in the
+                    // mpsc channel and ready to be pulled
+                    let event = match event.map_nonuser_event() {
+                        Ok(non_user_event) => non_user_event,
+                        Err(_user_event_placeholder) => Event::UserEvent(
+                            user_event_receiver
+                                .try_recv()
+                                .expect("user event signaled but not received"),
+                        ),
+                    };
+                    event_handler(event, event_loop_windows_ref)
+                });
+            }
+        }
+
+        let exit_code = loop {
+            self.wait_for_messages(None);
+            // wait_for_messages calls user application before and after waiting
+            // so it may have decided to exit.
+            if let Some(code) = self.exit_code() {
+                break code;
+            }
+
+            self.dispatch_peeked_messages();
+
+            if let Some(code) = self.exit_code() {
+                break code;
+            }
+        };
+
+        let runner = &self.window_target.p.runner_shared;
+        runner.loop_destroyed();
+
+        // # Safety
+        // We assume that this will effectively call `runner.clear_event_handler()`
+        // to meet the safety requirements for calling `runner.set_event_handler()` above.
+        runner.reset_runner();
+
+        if exit_code == 0 {
+            Ok(())
+        } else {
+            Err(EventLoopError::ExitFailure(exit_code))
+        }
+    }
+
+    pub fn pump_events<F>(&mut self, timeout: Option<Duration>, mut event_handler: F) -> PumpStatus
+    where
+        F: FnMut(Event<T>, &RootAEL),
+    {
+        {
+            let runner = &self.window_target.p.runner_shared;
+            let event_loop_windows_ref = &self.window_target;
+            let user_event_receiver = &self.user_event_receiver;
+
+            // # Safety
+            // We make sure to call runner.clear_event_handler() before
+            // returning
+            //
+            // Note: we're currently assuming nothing can panic and unwind
+            // to leave the runner in an unsound state with an associated
+            // event handler.
+            unsafe {
+                runner.set_event_handler(move |event| {
+                    let event = match event.map_nonuser_event() {
+                        Ok(non_user_event) => non_user_event,
+                        Err(_user_event_placeholder) => Event::UserEvent(
+                            user_event_receiver
+                                .recv()
+                                .expect("user event signaled but not received"),
+                        ),
+                    };
+                    event_handler(event, event_loop_windows_ref)
+                });
+                runner.wakeup();
+            }
+        }
+
+        if self.exit_code().is_none() {
+            self.wait_for_messages(timeout);
+        }
+        // wait_for_messages calls user application before and after waiting
+        // so it may have decided to exit.
+        if self.exit_code().is_none() {
+            self.dispatch_peeked_messages();
+        }
+
+        let runner = &self.window_target.p.runner_shared;
+
+        let status = if let Some(code) = runner.exit_code() {
+            runner.loop_destroyed();
+
+            // Immediately reset the internal state for the loop to allow
+            // the loop to be run more than once.
+            runner.reset_runner();
+            PumpStatus::Exit(code)
+        } else {
+            runner.prepare_wait();
+            PumpStatus::Continue
+        };
+
+        // We wait until we've checked for an exit status before clearing the
+        // application callback, in case we need to dispatch a LoopExiting event
+        //
+        // # Safety
+        // This pairs up with our call to `runner.set_event_handler` and ensures
+        // the application's callback can't be held beyond its lifetime.
+        runner.clear_event_handler();
+
+        status
+    }
+
+    /// Waits until new event messages arrive to be peeked.
+    /// Doesn't peek messages itself.
+    ///
+    /// Parameter timeout is optional. This method would wait for the smaller timeout
+    /// between the argument and a timeout from control flow.
+    fn wait_for_messages(&mut self, timeout: Option<Duration>) {
+        let runner = &self.window_target.p.runner_shared;
+
+        // We aim to be consistent with the MacOS backend which has a RunLoop
+        // observer that will dispatch AboutToWait when about to wait for
+        // events, and NewEvents after the RunLoop wakes up.
+        //
+        // We emulate similar behaviour by treating `MsgWaitForMultipleObjectsEx` as our wait
+        // point and wake up point (when it returns) and we drain all other
+        // pending messages via `PeekMessage` until we come back to "wait" via
+        // `MsgWaitForMultipleObjectsEx`.
+        //
+        runner.prepare_wait();
+        wait_for_messages_impl(&mut self.high_resolution_timer, runner.control_flow(), timeout);
+        // Before we potentially exit, make sure to consistently emit an event for the wake up
+        runner.wakeup();
+    }
+
+    /// Dispatch all queued messages via `PeekMessageW`
+    fn dispatch_peeked_messages(&mut self) {
+        let runner = &self.window_target.p.runner_shared;
+
+        // We generally want to continue dispatching all pending messages
+        // but we also allow dispatching to be interrupted as a means to
+        // ensure the `pump_events` won't indefinitely block an external
+        // event loop if there are too many pending events. This interrupt
+        // flag will be set after dispatching `RedrawRequested` events.
+        runner.interrupt_msg_dispatch.set(false);
+
+        // # Safety
+        // The Windows API has no documented requirement for bitwise
+        // initializing a `MSG` struct (it can be uninitialized memory for the C
+        // API) and there's no API to construct or initialize a `MSG`. This
+        // is the simplest way avoid uninitialized memory in Rust
+        let mut msg: MSG = unsafe { mem::zeroed() };
+
+        loop {
+            unsafe {
+                if PeekMessageW(&mut msg, 0, 0, 0, PM_REMOVE) == false.into() {
+                    break;
+                }
+
+                let handled = if let Some(callback) = self.msg_hook.as_deref_mut() {
+                    callback(&mut msg as *mut _ as *mut _)
+                } else {
+                    false
+                };
+                if !handled {
+                    TranslateMessage(&msg);
+                    DispatchMessageW(&msg);
+                }
+            }
+
+            if let Err(payload) = runner.take_panic_error() {
+                runner.reset_runner();
+                panic::resume_unwind(payload);
+            }
+
+            if let Some(_code) = runner.exit_code() {
+                break;
+            }
+
+            if runner.interrupt_msg_dispatch.get() {
+                break;
+            }
+        }
+    }
+
+    pub fn create_proxy(&self) -> EventLoopProxy<T> {
+        EventLoopProxy {
+            target_window: self.window_target.p.thread_msg_target,
+            event_send: self.user_event_sender.clone(),
+        }
+    }
+
+    fn exit_code(&self) -> Option<i32> {
+        self.window_target.p.exit_code()
+    }
+}
+
+impl ActiveEventLoop {
+    #[inline(always)]
+    pub(crate) fn create_thread_executor(&self) -> EventLoopThreadExecutor {
+        EventLoopThreadExecutor { thread_id: self.thread_id, target_window: self.thread_msg_target }
+    }
+
+    pub fn create_custom_cursor(&self, source: CustomCursorSource) -> RootCustomCursor {
+        let inner = match WinCursor::new(&source.inner.0) {
+            Ok(cursor) => cursor,
+            Err(err) => {
+                tracing::warn!("Failed to create custom cursor: {err}");
+                WinCursor::Failed
+            },
+        };
+
+        RootCustomCursor { inner }
+    }
+
+    // TODO: Investigate opportunities for caching
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        monitor::available_monitors()
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        let monitor = monitor::primary_monitor();
+        Some(monitor)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Windows(rwh_05::WindowsDisplayHandle::empty())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Windows(rwh_06::WindowsDisplayHandle::new()))
+    }
+
+    pub fn listen_device_events(&self, allowed: DeviceEvents) {
+        raw_input::register_all_mice_and_keyboards_for_raw_input(self.thread_msg_target, allowed);
+    }
+
+    pub fn system_theme(&self) -> Option<Theme> {
+        Some(if super::dark_mode::should_use_dark_mode() { Theme::Dark } else { Theme::Light })
+    }
+
+    pub(crate) fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.runner_shared.set_control_flow(control_flow)
+    }
+
+    pub(crate) fn control_flow(&self) -> ControlFlow {
+        self.runner_shared.control_flow()
+    }
+
+    pub(crate) fn exit(&self) {
+        self.runner_shared.set_exit_code(0)
+    }
+
+    pub(crate) fn exiting(&self) -> bool {
+        self.runner_shared.exit_code().is_some()
+    }
+
+    pub(crate) fn clear_exit(&self) {
+        self.runner_shared.clear_exit();
+    }
+
+    pub(crate) fn owned_display_handle(&self) -> OwnedDisplayHandle {
+        OwnedDisplayHandle
+    }
+
+    fn exit_code(&self) -> Option<i32> {
+        self.runner_shared.exit_code()
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct OwnedDisplayHandle;
+
+impl OwnedDisplayHandle {
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::WindowsDisplayHandle::empty().into()
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::WindowsDisplayHandle::new().into())
+    }
+}
+
+/// Returns the id of the main thread.
+///
+/// Windows has no real API to check if the current executing thread is the "main thread", unlike
+/// macOS.
+///
+/// Windows will let us look up the current thread's id, but there's no API that lets us check what
+/// the id of the main thread is. We would somehow need to get the main thread's id before a
+/// developer could spin off any other threads inside of the main entrypoint in order to emulate the
+/// capabilities of other platforms.
+///
+/// We can get the id of the main thread by using CRT initialization. CRT initialization can be used
+/// to setup global state within a program. The OS will call a list of function pointers which
+/// assign values to a static variable. To have get a hold of the main thread id, we need to place
+/// our function pointer inside of the `.CRT$XCU` section so it is called before the main
+/// entrypoint.
+///
+/// Full details of CRT initialization can be found here:
+/// <https://docs.microsoft.com/en-us/cpp/c-runtime-library/crt-initialization?view=msvc-160>
+fn main_thread_id() -> u32 {
+    static mut MAIN_THREAD_ID: u32 = 0;
+
+    // Function pointer used in CRT initialization section to set the above static field's value.
+
+    // Mark as used so this is not removable.
+    #[used]
+    #[allow(non_upper_case_globals)]
+    // Place the function pointer inside of CRT initialization section so it is loaded before
+    // main entrypoint.
+    //
+    // See: https://doc.rust-lang.org/stable/reference/abi.html#the-link_section-attribute
+    #[link_section = ".CRT$XCU"]
+    static INIT_MAIN_THREAD_ID: unsafe extern "C" fn() = {
+        unsafe extern "C" fn initer() {
+            unsafe {
+                MAIN_THREAD_ID = GetCurrentThreadId();
+            }
+        }
+        initer
+    };
+
+    unsafe { MAIN_THREAD_ID }
+}
+
+/// Returns the minimum `Option<Duration>`, taking into account that `None`
+/// equates to an infinite timeout, not a zero timeout (so can't just use
+/// `Option::min`)
+fn min_timeout(a: Option<Duration>, b: Option<Duration>) -> Option<Duration> {
+    a.map_or(b, |a_timeout| b.map_or(Some(a_timeout), |b_timeout| Some(a_timeout.min(b_timeout))))
+}
+
+// Implementation taken from https://github.com/rust-lang/rust/blob/db5476571d9b27c862b95c1e64764b0ac8980e23/src/libstd/sys/windows/mod.rs
+fn dur2timeout(dur: Duration) -> u32 {
+    // Note that a duration is a (u64, u32) (seconds, nanoseconds) pair, and the
+    // timeouts in windows APIs are typically u32 milliseconds. To translate, we
+    // have two pieces to take care of:
+    //
+    // * Nanosecond precision is rounded up
+    // * Greater than u32::MAX milliseconds (50 days) is rounded up to INFINITE (never time out).
+    dur.as_secs()
+        .checked_mul(1000)
+        .and_then(|ms| ms.checked_add((dur.subsec_nanos() as u64) / 1_000_000))
+        .and_then(
+            |ms| {
+                if dur.subsec_nanos() % 1_000_000 > 0 {
+                    ms.checked_add(1)
+                } else {
+                    Some(ms)
+                }
+            },
+        )
+        .map(|ms| if ms > u32::MAX as u64 { INFINITE } else { ms as u32 })
+        .unwrap_or(INFINITE)
+}
+
+impl<T> Drop for EventLoop<T> {
+    fn drop(&mut self) {
+        unsafe {
+            DestroyWindow(self.window_target.p.thread_msg_target);
+        }
+    }
+}
+
+/// Set upper limit for waiting time to avoid overflows.
+/// I chose 50 days as a limit because it is used in dur2timeout.
+const FIFTY_DAYS: Duration = Duration::from_secs(50_u64 * 24 * 60 * 60);
+/// Waitable timers use 100 ns intervals to indicate due time.
+/// <https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-setwaitabletimer#parameters>
+/// And there is no point waiting using other ways for such small timings
+/// because they are even less precise (can overshoot by few ms).
+const MIN_WAIT: Duration = Duration::from_nanos(100);
+
+fn create_high_resolution_timer() -> Option<OwnedHandle> {
+    unsafe {
+        let handle: HANDLE = CreateWaitableTimerExW(
+            ptr::null(),
+            ptr::null(),
+            CREATE_WAITABLE_TIMER_HIGH_RESOLUTION,
+            TIMER_ALL_ACCESS,
+        );
+        // CREATE_WAITABLE_TIMER_HIGH_RESOLUTION is supported only after
+        // Win10 1803 but it is already default option for rustc
+        // (std uses it to implement `std::thread::sleep`).
+        if handle == 0 {
+            None
+        } else {
+            Some(OwnedHandle::from_raw_handle(handle as *mut c_void))
+        }
+    }
+}
+
+/// This function should not return error if parameters are valid
+/// but there is no guarantee about that at MSDN docs
+/// so we return result of GetLastError if fail.
+///
+/// ## Safety
+///
+/// timer must be a valid timer handle created by [create_high_resolution_timer].
+/// timeout divided by 100 nanoseconds must be more than 0 and less than i64::MAX.
+unsafe fn set_high_resolution_timer(timer: RawHandle, timeout: Duration) -> Result<(), u32> {
+    const INTERVAL_NS: u32 = MIN_WAIT.subsec_nanos();
+    const INTERVALS_IN_SEC: u64 = (Duration::from_secs(1).as_nanos() / INTERVAL_NS as u128) as u64;
+    let intervals_to_wait: u64 =
+        timeout.as_secs() * INTERVALS_IN_SEC + u64::from(timeout.subsec_nanos() / INTERVAL_NS);
+    debug_assert!(intervals_to_wait < i64::MAX as u64, "Must be called with smaller duration",);
+    // Use negative time to indicate relative time.
+    let due_time: i64 = -(intervals_to_wait as i64);
+    unsafe {
+        let set_result = SetWaitableTimer(timer as HANDLE, &due_time, 0, None, ptr::null(), FALSE);
+        if set_result != FALSE {
+            Ok(())
+        } else {
+            Err(GetLastError())
+        }
+    }
+}
+
+/// Implementation detail of [EventLoop::wait_for_messages].
+///
+/// Does actual system-level waiting and doesn't process any messages itself,
+/// including winits internal notifications about waiting and new messages arrival.
+fn wait_for_messages_impl(
+    high_resolution_timer: &mut Option<OwnedHandle>,
+    control_flow: ControlFlow,
+    timeout: Option<Duration>,
+) {
+    let timeout = {
+        let control_flow_timeout = match control_flow {
+            ControlFlow::Wait => None,
+            ControlFlow::Poll => Some(Duration::ZERO),
+            ControlFlow::WaitUntil(wait_deadline) => {
+                let start = Instant::now();
+                Some(wait_deadline.saturating_duration_since(start))
+            },
+        };
+        let timeout = min_timeout(timeout, control_flow_timeout);
+        if timeout == Some(Duration::ZERO) {
+            // Do not wait if we don't have time.
+            return;
+        }
+        // Now we decided to wait so need to do some clamping
+        // to avoid problems with overflow and calling WinAPI with invalid parameters.
+        timeout
+            .map(|t| t.min(FIFTY_DAYS))
+            // If timeout is less than minimally supported by Windows,
+            // increase it to that minimum. Who want less than microsecond delays anyway?
+            .map(|t| t.max(MIN_WAIT))
+    };
+
+    if timeout.is_some() && high_resolution_timer.is_none() {
+        *high_resolution_timer = create_high_resolution_timer();
+    }
+
+    let high_resolution_timer: Option<RawHandle> =
+        high_resolution_timer.as_ref().map(OwnedHandle::as_raw_handle);
+
+    let use_timer: bool;
+    if let (Some(handle), Some(timeout)) = (high_resolution_timer, timeout) {
+        let res = unsafe {
+            // Safety: handle can be Some only if we succeeded in creating high resolution
+            // timer. We properly clamped timeout so it can be used as argument
+            // to timer.
+            set_high_resolution_timer(handle, timeout)
+        };
+        if let Err(error_code) = res {
+            // We successfully got timer but failed to set it?
+            // Should be some bug in our code.
+            tracing::trace!("Failed to set high resolution timer: last error {}", error_code);
+            use_timer = false;
+        } else {
+            use_timer = true;
+        }
+    } else {
+        use_timer = false;
+    }
+
+    unsafe {
+        // Either:
+        //  1. User wants to wait indefinitely if timeout is not set.
+        //  2. We failed to get and set high resolution timer and we need something instead of it.
+        let wait_duration_ms = timeout.map(dur2timeout).unwrap_or(INFINITE);
+
+        let (num_handles, raw_handles) =
+            if use_timer { (1, [high_resolution_timer.unwrap()]) } else { (0, [ptr::null_mut()]) };
+
+        // We must use `QS_ALLINPUT` to wake on accessibility messages.
+        let result = MsgWaitForMultipleObjectsEx(
+            num_handles,
+            raw_handles.as_ptr() as *const _,
+            wait_duration_ms,
+            QS_ALLINPUT,
+            MWMO_INPUTAVAILABLE,
+        );
+        if result == WAIT_FAILED {
+            // Well, nothing smart to do in such case.
+            // Treat it as spurious wake up.
+            tracing::warn!("Failed to MsgWaitForMultipleObjectsEx: error code {}", GetLastError(),);
+        }
+    }
+}
+
+pub(crate) struct EventLoopThreadExecutor {
+    thread_id: u32,
+    target_window: HWND,
+}
+
+unsafe impl Send for EventLoopThreadExecutor {}
+unsafe impl Sync for EventLoopThreadExecutor {}
+
+impl EventLoopThreadExecutor {
+    /// Check to see if we're in the parent event loop's thread.
+    pub(super) fn in_event_loop_thread(&self) -> bool {
+        let cur_thread_id = unsafe { GetCurrentThreadId() };
+        self.thread_id == cur_thread_id
+    }
+
+    /// Executes a function in the event loop thread. If we're already in the event loop thread,
+    /// we just call the function directly.
+    ///
+    /// The `Inserted` can be used to inject a `WindowState` for the callback to use. The state is
+    /// removed automatically if the callback receives a `WM_CLOSE` message for the window.
+    ///
+    /// Note that if you are using this to change some property of a window and updating
+    /// `WindowState` then you should call this within the lock of `WindowState`. Otherwise the
+    /// events may be sent to the other thread in different order to the one in which you set
+    /// `WindowState`, leaving them out of sync.
+    ///
+    /// Note that we use a FnMut instead of a FnOnce because we're too lazy to create an equivalent
+    /// to the unstable FnBox.
+    pub(super) fn execute_in_thread<F>(&self, mut function: F)
+    where
+        F: FnMut() + Send + 'static,
+    {
+        unsafe {
+            if self.in_event_loop_thread() {
+                function();
+            } else {
+                // We double-box because the first box is a fat pointer.
+                let boxed2: ThreadExecFn = Box::new(Box::new(function));
+
+                let raw = Box::into_raw(boxed2);
+
+                let res = PostMessageW(self.target_window, EXEC_MSG_ID.get(), raw as usize, 0);
+                assert!(res != false.into(), "PostMessage failed; is the messages queue full?");
+            }
+        }
+    }
+}
+
+type ThreadExecFn = Box<Box<dyn FnMut()>>;
+
+pub struct EventLoopProxy<T: 'static> {
+    target_window: HWND,
+    event_send: Sender<T>,
+}
+unsafe impl<T: Send + 'static> Send for EventLoopProxy<T> {}
+
+impl<T: 'static> Clone for EventLoopProxy<T> {
+    fn clone(&self) -> Self {
+        Self { target_window: self.target_window, event_send: self.event_send.clone() }
+    }
+}
+
+impl<T: 'static> EventLoopProxy<T> {
+    pub fn send_event(&self, event: T) -> Result<(), EventLoopClosed<T>> {
+        self.event_send
+            .send(event)
+            .map(|result| {
+                unsafe { PostMessageW(self.target_window, USER_EVENT_MSG_ID.get(), 0, 0) };
+                result
+            })
+            .map_err(|e| EventLoopClosed(e.0))
+    }
+}
+
+/// A lazily-initialized window message ID.
+pub struct LazyMessageId {
+    /// The ID.
+    id: AtomicU32,
+
+    /// The name of the message.
+    name: &'static str,
+}
+
+/// An invalid custom window ID.
+const INVALID_ID: u32 = 0x0;
+
+impl LazyMessageId {
+    /// Create a new `LazyId`.
+    const fn new(name: &'static str) -> Self {
+        Self { id: AtomicU32::new(INVALID_ID), name }
+    }
+
+    /// Get the message ID.
+    pub fn get(&self) -> u32 {
+        // Load the ID.
+        let id = self.id.load(Ordering::Relaxed);
+
+        if id != INVALID_ID {
+            return id;
+        }
+
+        // Register the message.
+        // SAFETY: We are sure that the pointer is a valid C string ending with '\0'.
+        assert!(self.name.ends_with('\0'));
+        let new_id = unsafe { RegisterWindowMessageA(self.name.as_ptr()) };
+
+        assert_ne!(
+            new_id,
+            0,
+            "RegisterWindowMessageA returned zero for '{}': {}",
+            self.name,
+            std::io::Error::last_os_error()
+        );
+
+        // Store the new ID. Since `RegisterWindowMessageA` returns the same value for any given
+        // string, the target value will always either be a). `INVALID_ID` or b). the
+        // correct ID. Therefore a compare-and-swap operation here (or really any
+        // consideration) is never necessary.
+        self.id.store(new_id, Ordering::Relaxed);
+
+        new_id
+    }
+}
+
+// Message sent by the `EventLoopProxy` when we want to wake up the thread.
+// WPARAM and LPARAM are unused.
+static USER_EVENT_MSG_ID: LazyMessageId = LazyMessageId::new("Winit::WakeupMsg\0");
+// Message sent when we want to execute a closure in the thread.
+// WPARAM contains a Box<Box<dyn FnMut()>> that must be retrieved with `Box::from_raw`,
+// and LPARAM is unused.
+static EXEC_MSG_ID: LazyMessageId = LazyMessageId::new("Winit::ExecMsg\0");
+// Message sent by a `Window` when it wants to be destroyed by the main thread.
+// WPARAM and LPARAM are unused.
+pub(crate) static DESTROY_MSG_ID: LazyMessageId = LazyMessageId::new("Winit::DestroyMsg\0");
+// WPARAM is a bool specifying the `WindowFlags::MARKER_RETAIN_STATE_ON_SIZE` flag. See the
+// documentation in the `window_state` module for more information.
+pub(crate) static SET_RETAIN_STATE_ON_SIZE_MSG_ID: LazyMessageId =
+    LazyMessageId::new("Winit::SetRetainMaximized\0");
+static THREAD_EVENT_TARGET_WINDOW_CLASS: Lazy<Vec<u16>> =
+    Lazy::new(|| util::encode_wide("Winit Thread Event Target"));
+/// When the taskbar is created, it registers a message with the "TaskbarCreated" string and then
+/// broadcasts this message to all top-level windows <https://docs.microsoft.com/en-us/windows/win32/shell/taskbar#taskbar-creation-notification>
+pub(crate) static TASKBAR_CREATED: LazyMessageId = LazyMessageId::new("TaskbarCreated\0");
+
+fn create_event_target_window() -> HWND {
+    use windows_sys::Win32::UI::WindowsAndMessaging::{CS_HREDRAW, CS_VREDRAW};
+    unsafe {
+        let class = WNDCLASSEXW {
+            cbSize: mem::size_of::<WNDCLASSEXW>() as u32,
+            style: CS_HREDRAW | CS_VREDRAW,
+            lpfnWndProc: Some(thread_event_target_callback),
+            cbClsExtra: 0,
+            cbWndExtra: 0,
+            hInstance: util::get_instance_handle(),
+            hIcon: 0,
+            hCursor: 0, // must be null in order for cursor state to work properly
+            hbrBackground: 0,
+            lpszMenuName: ptr::null(),
+            lpszClassName: THREAD_EVENT_TARGET_WINDOW_CLASS.as_ptr(),
+            hIconSm: 0,
+        };
+
+        RegisterClassExW(&class);
+    }
+
+    unsafe {
+        // WS_EX_TOOLWINDOW prevents this window from ever showing up in the taskbar, which
+        // we want to avoid. If you remove this style, this window won't show up in the
+        // taskbar *initially*, but it can show up at some later point. This can sometimes
+        // happen on its own after several hours have passed, although this has proven
+        // difficult to reproduce. Alternatively, it can be manually triggered by killing
+        // `explorer.exe` and then starting the process back up.
+        // It is unclear why the bug is triggered by waiting for several hours.
+        let window = CreateWindowExW(
+            WS_EX_NOACTIVATE | WS_EX_TRANSPARENT | WS_EX_LAYERED | WS_EX_TOOLWINDOW,
+            THREAD_EVENT_TARGET_WINDOW_CLASS.as_ptr(),
+            ptr::null(),
+            WS_OVERLAPPED,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            util::get_instance_handle(),
+            ptr::null(),
+        );
+
+        super::set_window_long(
+            window,
+            GWL_STYLE,
+            // The window technically has to be visible to receive WM_PAINT messages (which are
+            // used for delivering events during resizes), but it isn't displayed to
+            // the user because of the LAYERED style.
+            (WS_VISIBLE | WS_POPUP) as isize,
+        );
+        window
+    }
+}
+
+fn insert_event_target_window_data(
+    thread_msg_target: HWND,
+    event_loop_runner: EventLoopRunnerShared<UserEventPlaceholder>,
+) {
+    let userdata = ThreadMsgTargetData { event_loop_runner };
+    let input_ptr = Box::into_raw(Box::new(userdata));
+
+    unsafe { super::set_window_long(thread_msg_target, GWL_USERDATA, input_ptr as isize) };
+}
+
+/// Capture mouse input, allowing `window` to receive mouse events when the cursor is outside of
+/// the window.
+unsafe fn capture_mouse(window: HWND, window_state: &mut WindowState) {
+    window_state.mouse.capture_count += 1;
+    unsafe { SetCapture(window) };
+}
+
+/// Release mouse input, stopping windows on this thread from receiving mouse input when the cursor
+/// is outside the window.
+unsafe fn release_mouse(mut window_state: MutexGuard<'_, WindowState>) {
+    window_state.mouse.capture_count = window_state.mouse.capture_count.saturating_sub(1);
+    if window_state.mouse.capture_count == 0 {
+        // ReleaseCapture() causes a WM_CAPTURECHANGED where we lock the window_state.
+        drop(window_state);
+        unsafe { ReleaseCapture() };
+    }
+}
+
+fn normalize_pointer_pressure(pressure: u32) -> Option<Force> {
+    match pressure {
+        1..=1024 => Some(Force::Normalized(pressure as f64 / 1024.0)),
+        _ => None,
+    }
+}
+
+/// Emit a `ModifiersChanged` event whenever modifiers have changed.
+/// Returns the current modifier state
+fn update_modifiers(window: HWND, userdata: &WindowData) {
+    use crate::event::WindowEvent::ModifiersChanged;
+
+    let modifiers = {
+        let mut layouts = LAYOUT_CACHE.lock().unwrap();
+        layouts.get_agnostic_mods()
+    };
+
+    let mut window_state = userdata.window_state.lock().unwrap();
+    if window_state.modifiers_state != modifiers {
+        window_state.modifiers_state = modifiers;
+
+        // Drop lock
+        drop(window_state);
+
+        userdata.send_event(Event::WindowEvent {
+            window_id: RootWindowId(WindowId(window)),
+            event: ModifiersChanged(modifiers.into()),
+        });
+    }
+}
+
+unsafe fn gain_active_focus(window: HWND, userdata: &WindowData) {
+    use crate::event::WindowEvent::Focused;
+
+    update_modifiers(window, userdata);
+
+    userdata.send_event(Event::WindowEvent {
+        window_id: RootWindowId(WindowId(window)),
+        event: Focused(true),
+    });
+}
+
+unsafe fn lose_active_focus(window: HWND, userdata: &WindowData) {
+    use crate::event::WindowEvent::{Focused, ModifiersChanged};
+
+    userdata.window_state_lock().modifiers_state = ModifiersState::empty();
+    userdata.send_event(Event::WindowEvent {
+        window_id: RootWindowId(WindowId(window)),
+        event: ModifiersChanged(ModifiersState::empty().into()),
+    });
+
+    userdata.send_event(Event::WindowEvent {
+        window_id: RootWindowId(WindowId(window)),
+        event: Focused(false),
+    });
+}
+
+/// Any window whose callback is configured to this function will have its events propagated
+/// through the events loop of the thread the window was created in.
+// This is the callback that is called by `DispatchMessage` in the events loop.
+//
+// Returning 0 tells the Win32 API that the message has been processed.
+// FIXME: detect WM_DWMCOMPOSITIONCHANGED and call DwmEnableBlurBehindWindow if necessary
+pub(super) unsafe extern "system" fn public_window_callback(
+    window: HWND,
+    msg: u32,
+    wparam: WPARAM,
+    lparam: LPARAM,
+) -> LRESULT {
+    let userdata = unsafe { super::get_window_long(window, GWL_USERDATA) };
+
+    let userdata_ptr = match (userdata, msg) {
+        (0, WM_NCCREATE) => {
+            let createstruct = unsafe { &mut *(lparam as *mut CREATESTRUCTW) };
+            let initdata = unsafe { &mut *(createstruct.lpCreateParams as *mut InitData<'_>) };
+
+            let result = match unsafe { initdata.on_nccreate(window) } {
+                Some(userdata) => unsafe {
+                    super::set_window_long(window, GWL_USERDATA, userdata as _);
+                    DefWindowProcW(window, msg, wparam, lparam)
+                },
+                None => -1, // failed to create the window
+            };
+
+            return result;
+        },
+        // Getting here should quite frankly be impossible,
+        // but we'll make window creation fail here just in case.
+        (0, WM_CREATE) => return -1,
+        (_, WM_CREATE) => unsafe {
+            let createstruct = &mut *(lparam as *mut CREATESTRUCTW);
+            let initdata = createstruct.lpCreateParams;
+            let initdata = &mut *(initdata as *mut InitData<'_>);
+
+            initdata.on_create();
+            return DefWindowProcW(window, msg, wparam, lparam);
+        },
+        (0, _) => return unsafe { DefWindowProcW(window, msg, wparam, lparam) },
+        _ => userdata as *mut WindowData,
+    };
+
+    let (result, userdata_removed, recurse_depth) = {
+        let userdata = unsafe { &*(userdata_ptr) };
+
+        userdata.recurse_depth.set(userdata.recurse_depth.get() + 1);
+
+        let result = unsafe { public_window_callback_inner(window, msg, wparam, lparam, userdata) };
+
+        let userdata_removed = userdata.userdata_removed.get();
+        let recurse_depth = userdata.recurse_depth.get() - 1;
+        userdata.recurse_depth.set(recurse_depth);
+
+        (result, userdata_removed, recurse_depth)
+    };
+
+    if userdata_removed && recurse_depth == 0 {
+        drop(unsafe { Box::from_raw(userdata_ptr) });
+    }
+
+    result
+}
+
+unsafe fn public_window_callback_inner(
+    window: HWND,
+    msg: u32,
+    wparam: WPARAM,
+    lparam: LPARAM,
+    userdata: &WindowData,
+) -> LRESULT {
+    let mut result = ProcResult::DefWindowProc(wparam);
+
+    // Send new modifiers before sending key events.
+    let mods_changed_callback = || match msg {
+        WM_KEYDOWN | WM_SYSKEYDOWN | WM_KEYUP | WM_SYSKEYUP => {
+            update_modifiers(window, userdata);
+            result = ProcResult::Value(0);
+        },
+        _ => (),
+    };
+    userdata
+        .event_loop_runner
+        .catch_unwind(mods_changed_callback)
+        .unwrap_or_else(|| result = ProcResult::Value(-1));
+
+    let keyboard_callback = || {
+        use crate::event::WindowEvent::KeyboardInput;
+        let events =
+            userdata.key_event_builder.process_message(window, msg, wparam, lparam, &mut result);
+        for event in events {
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: KeyboardInput {
+                    device_id: DEVICE_ID,
+                    event: event.event,
+                    is_synthetic: event.is_synthetic,
+                },
+            });
+        }
+    };
+    userdata
+        .event_loop_runner
+        .catch_unwind(keyboard_callback)
+        .unwrap_or_else(|| result = ProcResult::Value(-1));
+
+    // I decided to bind the closure to `callback` and pass it to catch_unwind rather than passing
+    // the closure to catch_unwind directly so that the match body indentation wouldn't change and
+    // the git blame and history would be preserved.
+    let callback = || match msg {
+        WM_NCCALCSIZE => {
+            let window_flags = userdata.window_state_lock().window_flags;
+            if wparam == 0 || window_flags.contains(WindowFlags::MARKER_DECORATIONS) {
+                result = ProcResult::DefWindowProc(wparam);
+                return;
+            }
+
+            let params = unsafe { &mut *(lparam as *mut NCCALCSIZE_PARAMS) };
+
+            if util::is_maximized(window) {
+                // Limit the window size when maximized to the current monitor.
+                // Otherwise it would include the non-existent decorations.
+                //
+                // Use `MonitorFromRect` instead of `MonitorFromWindow` to select
+                // the correct monitor here.
+                // See https://github.com/MicrosoftEdge/WebView2Feedback/issues/2549
+                let monitor = unsafe { MonitorFromRect(&params.rgrc[0], MONITOR_DEFAULTTONULL) };
+                if let Ok(monitor_info) = monitor::get_monitor_info(monitor) {
+                    params.rgrc[0] = monitor_info.monitorInfo.rcWork;
+                }
+            } else if window_flags.contains(WindowFlags::MARKER_UNDECORATED_SHADOW) {
+                // Extend the client area to cover the whole non-client area.
+                // https://docs.microsoft.com/en-us/windows/win32/winmsg/wm-nccalcsize#remarks
+                //
+                // HACK(msiglreith): To add the drop shadow we slightly tweak the non-client area.
+                // This leads to a small black 1px border on the top. Adding a margin manually
+                // on all 4 borders would result in the caption getting drawn by the DWM.
+                //
+                // Another option would be to allow the DWM to paint inside the client area.
+                // Unfortunately this results in janky resize behavior, where the compositor is
+                // ahead of the window surface. Currently, there seems no option to achieve this
+                // with the Windows API.
+                params.rgrc[0].top += 1;
+                params.rgrc[0].bottom += 1;
+            }
+
+            result = ProcResult::Value(0);
+        },
+
+        WM_ENTERSIZEMOVE => {
+            userdata
+                .window_state_lock()
+                .set_window_flags_in_place(|f| f.insert(WindowFlags::MARKER_IN_SIZE_MOVE));
+            result = ProcResult::Value(0);
+        },
+
+        WM_EXITSIZEMOVE => {
+            let mut state = userdata.window_state_lock();
+            if state.dragging {
+                state.dragging = false;
+                unsafe { PostMessageW(window, WM_LBUTTONUP, 0, lparam) };
+            }
+
+            state.set_window_flags_in_place(|f| f.remove(WindowFlags::MARKER_IN_SIZE_MOVE));
+            result = ProcResult::Value(0);
+        },
+
+        WM_NCLBUTTONDOWN => {
+            if wparam == HTCAPTION as _ {
+                // Prevent the user event loop from pausing when left clicking the title bar.
+                //
+                // When the user interacts with the title bar, Windows enters the modal event
+                // loop. Currently, a left click causes a pause for about 500ms. Sending a dummy
+                // mouse-move event seems to cancel the modal loop early, preventing the pause.
+                // The application will never see this dummy event.
+                //
+                // The mouse coordinates are encoded into the lparam value, however the WM_MOUSEMOVE
+                // event is not using the same coordinate system of the WM_NCLBUTTONDOWN event.
+                // One uses client-area coordinates and the other is screen-coordinates. In any
+                // case, passing the lparam as-is with the dummy event does not seem the cancel
+                // the modal loop.
+                //
+                // However, passing in a value of 0 has been observed to always cancel the pause.
+                //
+                // Other notes:
+                //
+                // For some unknown reason, the cursor will blink when clicking the title bar.
+                // Cancelling the modal loop early causes the blink to happen *immediately*.
+                // Otherwise, the blank happens *after* the pause.
+                //
+                // When right-click the title bar, the system window menu is presented to the user,
+                // and the modal event loop begins. This dummy event does *not* prevent the freeze
+                // in the main event loop caused by that popup menu.
+                let lparam = 0;
+                unsafe { PostMessageW(window, WM_MOUSEMOVE, 0, lparam) };
+            }
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        WM_CLOSE => {
+            use crate::event::WindowEvent::CloseRequested;
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: CloseRequested,
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_DESTROY => {
+            use crate::event::WindowEvent::Destroyed;
+            unsafe { RevokeDragDrop(window) };
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: Destroyed,
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_NCDESTROY => {
+            unsafe { super::set_window_long(window, GWL_USERDATA, 0) };
+            userdata.userdata_removed.set(true);
+            result = ProcResult::Value(0);
+        },
+
+        WM_PAINT => {
+            userdata.window_state_lock().redraw_requested =
+                userdata.event_loop_runner.should_buffer();
+
+            // We'll buffer only in response to `UpdateWindow`, if win32 decides to redraw the
+            // window outside the normal flow of the event loop. This way mark event as handled
+            // and request a normal redraw with `RedrawWindow`.
+            if !userdata.event_loop_runner.should_buffer() {
+                userdata.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(WindowId(window)),
+                    event: WindowEvent::RedrawRequested,
+                });
+            }
+
+            // NOTE: calling `RedrawWindow` during `WM_PAINT` does nothing, since to mark
+            // `WM_PAINT` as handled we should call the `DefWindowProcW`. Call it and check whether
+            // user asked for redraw during `RedrawRequested` event handling and request it again
+            // after marking `WM_PAINT` as handled.
+            result = ProcResult::Value(unsafe { DefWindowProcW(window, msg, wparam, lparam) });
+            if std::mem::take(&mut userdata.window_state_lock().redraw_requested) {
+                unsafe { RedrawWindow(window, ptr::null(), 0, RDW_INTERNALPAINT) };
+            }
+        },
+        WM_WINDOWPOSCHANGING => {
+            let mut window_state = userdata.window_state_lock();
+            if let Some(ref mut fullscreen) = window_state.fullscreen {
+                let window_pos = unsafe { &mut *(lparam as *mut WINDOWPOS) };
+                let new_rect = RECT {
+                    left: window_pos.x,
+                    top: window_pos.y,
+                    right: window_pos.x + window_pos.cx,
+                    bottom: window_pos.y + window_pos.cy,
+                };
+
+                const NOMOVE_OR_NOSIZE: u32 = SWP_NOMOVE | SWP_NOSIZE;
+
+                let new_rect = if window_pos.flags & NOMOVE_OR_NOSIZE != 0 {
+                    let cur_rect = util::WindowArea::Outer.get_rect(window).expect(
+                        "Unexpected GetWindowRect failure; please report this error to \
+                         rust-windowing/winit",
+                    );
+
+                    match window_pos.flags & NOMOVE_OR_NOSIZE {
+                        NOMOVE_OR_NOSIZE => None,
+
+                        SWP_NOMOVE => Some(RECT {
+                            left: cur_rect.left,
+                            top: cur_rect.top,
+                            right: cur_rect.left + window_pos.cx,
+                            bottom: cur_rect.top + window_pos.cy,
+                        }),
+
+                        SWP_NOSIZE => Some(RECT {
+                            left: window_pos.x,
+                            top: window_pos.y,
+                            right: window_pos.x - cur_rect.left + cur_rect.right,
+                            bottom: window_pos.y - cur_rect.top + cur_rect.bottom,
+                        }),
+
+                        _ => unreachable!(),
+                    }
+                } else {
+                    Some(new_rect)
+                };
+
+                if let Some(new_rect) = new_rect {
+                    let new_monitor = unsafe { MonitorFromRect(&new_rect, MONITOR_DEFAULTTONULL) };
+                    match fullscreen {
+                        Fullscreen::Borderless(ref mut fullscreen_monitor) => {
+                            if new_monitor != 0
+                                && fullscreen_monitor
+                                    .as_ref()
+                                    .map(|monitor| new_monitor != monitor.hmonitor())
+                                    .unwrap_or(true)
+                            {
+                                if let Ok(new_monitor_info) = monitor::get_monitor_info(new_monitor)
+                                {
+                                    let new_monitor_rect = new_monitor_info.monitorInfo.rcMonitor;
+                                    window_pos.x = new_monitor_rect.left;
+                                    window_pos.y = new_monitor_rect.top;
+                                    window_pos.cx = new_monitor_rect.right - new_monitor_rect.left;
+                                    window_pos.cy = new_monitor_rect.bottom - new_monitor_rect.top;
+                                }
+                                *fullscreen_monitor = Some(MonitorHandle::new(new_monitor));
+                            }
+                        },
+                        Fullscreen::Exclusive(ref video_mode) => {
+                            let old_monitor = video_mode.monitor.hmonitor();
+                            if let Ok(old_monitor_info) = monitor::get_monitor_info(old_monitor) {
+                                let old_monitor_rect = old_monitor_info.monitorInfo.rcMonitor;
+                                window_pos.x = old_monitor_rect.left;
+                                window_pos.y = old_monitor_rect.top;
+                                window_pos.cx = old_monitor_rect.right - old_monitor_rect.left;
+                                window_pos.cy = old_monitor_rect.bottom - old_monitor_rect.top;
+                            }
+                        },
+                    }
+                }
+            }
+
+            result = ProcResult::Value(0);
+        },
+
+        // WM_MOVE supplies client area positions, so we send Moved here instead.
+        WM_WINDOWPOSCHANGED => {
+            use crate::event::WindowEvent::Moved;
+
+            let windowpos = lparam as *const WINDOWPOS;
+            if unsafe { (*windowpos).flags & SWP_NOMOVE != SWP_NOMOVE } {
+                let physical_position =
+                    unsafe { PhysicalPosition::new((*windowpos).x, (*windowpos).y) };
+                userdata.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(WindowId(window)),
+                    event: Moved(physical_position),
+                });
+            }
+
+            // This is necessary for us to still get sent WM_SIZE.
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        WM_SIZE => {
+            use crate::event::WindowEvent::Resized;
+            let w = super::loword(lparam as u32) as u32;
+            let h = super::hiword(lparam as u32) as u32;
+
+            let physical_size = PhysicalSize::new(w, h);
+            let event = Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: Resized(physical_size),
+            };
+
+            {
+                let mut w = userdata.window_state_lock();
+                // See WindowFlags::MARKER_RETAIN_STATE_ON_SIZE docs for info on why this `if` check
+                // exists.
+                if !w.window_flags().contains(WindowFlags::MARKER_RETAIN_STATE_ON_SIZE) {
+                    let maximized = wparam == SIZE_MAXIMIZED as usize;
+                    w.set_window_flags_in_place(|f| f.set(WindowFlags::MAXIMIZED, maximized));
+                }
+            }
+            userdata.send_event(event);
+            result = ProcResult::Value(0);
+        },
+
+        WM_SIZING => {
+            /// Calculate the amount to add to round `value` to the nearest multiple of `increment`.
+            fn snap_to_nearest_increment_delta(value: i32, increment: i32) -> i32 {
+                let half_one = increment / 2;
+                let half_two = increment - half_one;
+                half_one - (value - half_two) % increment
+            }
+
+            let scale_factor = userdata.window_state_lock().scale_factor;
+            let Some(inc) = userdata
+                .window_state_lock()
+                .resize_increments
+                .map(|inc| inc.to_physical(scale_factor))
+                .filter(|inc| inc.width > 0 && inc.height > 0)
+            else {
+                result = ProcResult::Value(0);
+                return;
+            };
+
+            let side = wparam as u32;
+            // The desired new size of the window, decorations included.
+            let rect = unsafe { &mut *(lparam as *mut RECT) };
+
+            // We need to calculate the dimensions of the window decorations to get the true
+            // size of the window's contents
+            let adj_rect = userdata
+                .window_state_lock()
+                .window_flags
+                .adjust_rect(window, *rect)
+                .unwrap_or(*rect);
+            let deco_width = rect.left - adj_rect.left + adj_rect.right - rect.right;
+            let deco_height = rect.top - adj_rect.top + adj_rect.bottom - rect.bottom;
+
+            let width = rect.right - rect.left - deco_width;
+            let height = rect.bottom - rect.top - deco_height;
+
+            let mut width_delta = snap_to_nearest_increment_delta(width, inc.width);
+            let mut height_delta = snap_to_nearest_increment_delta(height, inc.height);
+
+            // Windows won't bound check the value of `rect` after we're done here, so we
+            // have to check manually. If the width/height we snap to would go out of bounds, just
+            // set it equal to the min/max bound.
+            let min_size =
+                userdata.window_state_lock().min_size.map(|size| size.to_physical(scale_factor));
+            let max_size =
+                userdata.window_state_lock().max_size.map(|size| size.to_physical(scale_factor));
+            let final_width = width + width_delta;
+            let final_height = height + height_delta;
+            if let Some(min_size) = min_size {
+                if final_width < min_size.width {
+                    width_delta += min_size.width - final_width;
+                }
+                if final_height < min_size.height {
+                    height_delta += min_size.height - final_height;
+                }
+            }
+            if let Some(max_size) = max_size {
+                if final_width > max_size.width {
+                    width_delta -= final_width - max_size.width;
+                }
+                if final_height > max_size.height {
+                    height_delta -= final_height - max_size.height;
+                }
+            }
+
+            match side {
+                WMSZ_LEFT | WMSZ_BOTTOMLEFT | WMSZ_TOPLEFT => {
+                    rect.left -= width_delta;
+                },
+                WMSZ_RIGHT | WMSZ_BOTTOMRIGHT | WMSZ_TOPRIGHT => {
+                    rect.right += width_delta;
+                },
+                _ => {},
+            }
+
+            match side {
+                WMSZ_TOP | WMSZ_TOPLEFT | WMSZ_TOPRIGHT => {
+                    rect.top -= height_delta;
+                },
+                WMSZ_BOTTOM | WMSZ_BOTTOMLEFT | WMSZ_BOTTOMRIGHT => {
+                    rect.bottom += height_delta;
+                },
+                _ => {},
+            }
+
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        WM_MENUCHAR => {
+            result = ProcResult::Value((MNC_CLOSE << 16) as isize);
+        },
+
+        WM_IME_STARTCOMPOSITION => {
+            let ime_allowed = userdata.window_state_lock().ime_allowed;
+            if ime_allowed {
+                userdata.window_state_lock().ime_state = ImeState::Enabled;
+
+                userdata.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(WindowId(window)),
+                    event: WindowEvent::Ime(Ime::Enabled),
+                });
+            }
+
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        WM_IME_COMPOSITION => {
+            let ime_allowed_and_composing = {
+                let w = userdata.window_state_lock();
+                w.ime_allowed && w.ime_state != ImeState::Disabled
+            };
+            // Windows Hangul IME sends WM_IME_COMPOSITION after WM_IME_ENDCOMPOSITION, so
+            // check whether composing.
+            if ime_allowed_and_composing {
+                let ime_context = unsafe { ImeContext::current(window) };
+
+                if lparam == 0 {
+                    userdata.send_event(Event::WindowEvent {
+                        window_id: RootWindowId(WindowId(window)),
+                        event: WindowEvent::Ime(Ime::Preedit(String::new(), None)),
+                    });
+                }
+
+                // Google Japanese Input and ATOK have both flags, so
+                // first, receive composing result if exist.
+                if (lparam as u32 & GCS_RESULTSTR) != 0 {
+                    if let Some(text) = unsafe { ime_context.get_composed_text() } {
+                        userdata.window_state_lock().ime_state = ImeState::Enabled;
+
+                        userdata.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(WindowId(window)),
+                            event: WindowEvent::Ime(Ime::Preedit(String::new(), None)),
+                        });
+                        userdata.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(WindowId(window)),
+                            event: WindowEvent::Ime(Ime::Commit(text)),
+                        });
+                    }
+                }
+
+                // Next, receive preedit range for next composing if exist.
+                if (lparam as u32 & GCS_COMPSTR) != 0 {
+                    if let Some((text, first, last)) =
+                        unsafe { ime_context.get_composing_text_and_cursor() }
+                    {
+                        userdata.window_state_lock().ime_state = ImeState::Preedit;
+                        let cursor_range = first.map(|f| (f, last.unwrap_or(f)));
+
+                        userdata.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(WindowId(window)),
+                            event: WindowEvent::Ime(Ime::Preedit(text, cursor_range)),
+                        });
+                    }
+                }
+            }
+
+            // Not calling DefWindowProc to hide composing text drawn by IME.
+            result = ProcResult::Value(0);
+        },
+
+        WM_IME_ENDCOMPOSITION => {
+            let ime_allowed_or_composing = {
+                let w = userdata.window_state_lock();
+                w.ime_allowed || w.ime_state != ImeState::Disabled
+            };
+            if ime_allowed_or_composing {
+                if userdata.window_state_lock().ime_state == ImeState::Preedit {
+                    // Windows Hangul IME sends WM_IME_COMPOSITION after WM_IME_ENDCOMPOSITION, so
+                    // trying receiving composing result and commit if exists.
+                    let ime_context = unsafe { ImeContext::current(window) };
+                    if let Some(text) = unsafe { ime_context.get_composed_text() } {
+                        userdata.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(WindowId(window)),
+                            event: WindowEvent::Ime(Ime::Preedit(String::new(), None)),
+                        });
+                        userdata.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(WindowId(window)),
+                            event: WindowEvent::Ime(Ime::Commit(text)),
+                        });
+                    }
+                }
+
+                userdata.window_state_lock().ime_state = ImeState::Disabled;
+
+                userdata.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(WindowId(window)),
+                    event: WindowEvent::Ime(Ime::Disabled),
+                });
+            }
+
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        WM_IME_SETCONTEXT => {
+            // IME UI visibility flags are in lparam.
+            let lparam = lparam & !(ISC_SHOWUICOMPOSITIONWINDOW as isize);
+            result = ProcResult::Value(unsafe { DefWindowProcW(window, msg, wparam, lparam) });
+        },
+
+        // this is necessary for us to maintain minimize/restore state
+        WM_SYSCOMMAND => {
+            if wparam == SC_RESTORE as usize {
+                let mut w = userdata.window_state_lock();
+                w.set_window_flags_in_place(|f| f.set(WindowFlags::MINIMIZED, false));
+            }
+            if wparam == SC_MINIMIZE as usize {
+                let mut w = userdata.window_state_lock();
+                w.set_window_flags_in_place(|f| f.set(WindowFlags::MINIMIZED, true));
+            }
+            // Send `WindowEvent::Minimized` here if we decide to implement one
+
+            if wparam == SC_SCREENSAVE as usize {
+                let window_state = userdata.window_state_lock();
+                if window_state.fullscreen.is_some() {
+                    result = ProcResult::Value(0);
+                    return;
+                }
+            }
+
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        WM_MOUSEMOVE => {
+            use crate::event::WindowEvent::{CursorEntered, CursorLeft, CursorMoved};
+
+            let x = super::get_x_lparam(lparam as u32) as i32;
+            let y = super::get_y_lparam(lparam as u32) as i32;
+            let position = PhysicalPosition::new(x as f64, y as f64);
+
+            let cursor_moved;
+            {
+                let mut w = userdata.window_state_lock();
+                let mouse_was_inside_window =
+                    w.mouse.cursor_flags().contains(CursorFlags::IN_WINDOW);
+
+                match get_pointer_move_kind(window, mouse_was_inside_window, x, y) {
+                    PointerMoveKind::Enter => {
+                        w.mouse
+                            .set_cursor_flags(window, |f| f.set(CursorFlags::IN_WINDOW, true))
+                            .ok();
+
+                        drop(w);
+                        userdata.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(WindowId(window)),
+                            event: CursorEntered { device_id: DEVICE_ID },
+                        });
+
+                        // Calling TrackMouseEvent in order to receive mouse leave events.
+                        unsafe {
+                            TrackMouseEvent(&mut TRACKMOUSEEVENT {
+                                cbSize: mem::size_of::<TRACKMOUSEEVENT>() as u32,
+                                dwFlags: TME_LEAVE,
+                                hwndTrack: window,
+                                dwHoverTime: HOVER_DEFAULT,
+                            })
+                        };
+                    },
+                    PointerMoveKind::Leave => {
+                        w.mouse
+                            .set_cursor_flags(window, |f| f.set(CursorFlags::IN_WINDOW, false))
+                            .ok();
+
+                        drop(w);
+                        userdata.send_event(Event::WindowEvent {
+                            window_id: RootWindowId(WindowId(window)),
+                            event: CursorLeft { device_id: DEVICE_ID },
+                        });
+                    },
+                    PointerMoveKind::None => drop(w),
+                }
+
+                // handle spurious WM_MOUSEMOVE messages
+                // see https://devblogs.microsoft.com/oldnewthing/20031001-00/?p=42343
+                // and http://debugandconquer.blogspot.com/2015/08/the-cause-of-spurious-mouse-move.html
+                let mut w = userdata.window_state_lock();
+                cursor_moved = w.mouse.last_position != Some(position);
+                w.mouse.last_position = Some(position);
+            }
+
+            if cursor_moved {
+                update_modifiers(window, userdata);
+
+                userdata.send_event(Event::WindowEvent {
+                    window_id: RootWindowId(WindowId(window)),
+                    event: CursorMoved { device_id: DEVICE_ID, position },
+                });
+            }
+
+            result = ProcResult::Value(0);
+        },
+
+        WM_MOUSELEAVE => {
+            use crate::event::WindowEvent::CursorLeft;
+            {
+                let mut w = userdata.window_state_lock();
+                w.mouse.set_cursor_flags(window, |f| f.set(CursorFlags::IN_WINDOW, false)).ok();
+            }
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: CursorLeft { device_id: DEVICE_ID },
+            });
+
+            result = ProcResult::Value(0);
+        },
+
+        WM_MOUSEWHEEL => {
+            use crate::event::MouseScrollDelta::LineDelta;
+
+            let value = (wparam >> 16) as i16;
+            let value = value as f32 / WHEEL_DELTA as f32;
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: WindowEvent::MouseWheel {
+                    device_id: DEVICE_ID,
+                    delta: LineDelta(0.0, value),
+                    phase: TouchPhase::Moved,
+                },
+            });
+
+            result = ProcResult::Value(0);
+        },
+
+        WM_MOUSEHWHEEL => {
+            use crate::event::MouseScrollDelta::LineDelta;
+
+            let value = (wparam >> 16) as i16;
+            let value = -value as f32 / WHEEL_DELTA as f32; // NOTE: inverted! See https://github.com/rust-windowing/winit/pull/2105/
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: WindowEvent::MouseWheel {
+                    device_id: DEVICE_ID,
+                    delta: LineDelta(value, 0.0),
+                    phase: TouchPhase::Moved,
+                },
+            });
+
+            result = ProcResult::Value(0);
+        },
+
+        WM_KEYDOWN | WM_SYSKEYDOWN => {
+            if msg == WM_SYSKEYDOWN {
+                result = ProcResult::DefWindowProc(wparam);
+            }
+        },
+
+        WM_KEYUP | WM_SYSKEYUP => {
+            if msg == WM_SYSKEYUP && unsafe { GetMenu(window) != 0 } {
+                // let Windows handle event if the window has a native menu, a modal event loop
+                // is started here on Alt key up.
+                result = ProcResult::DefWindowProc(wparam);
+            }
+        },
+
+        WM_LBUTTONDOWN => {
+            use crate::event::ElementState::Pressed;
+            use crate::event::MouseButton::Left;
+            use crate::event::WindowEvent::MouseInput;
+
+            unsafe { capture_mouse(window, &mut userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput { device_id: DEVICE_ID, state: Pressed, button: Left },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_LBUTTONUP => {
+            use crate::event::ElementState::Released;
+            use crate::event::MouseButton::Left;
+            use crate::event::WindowEvent::MouseInput;
+
+            unsafe { release_mouse(userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput { device_id: DEVICE_ID, state: Released, button: Left },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_RBUTTONDOWN => {
+            use crate::event::ElementState::Pressed;
+            use crate::event::MouseButton::Right;
+            use crate::event::WindowEvent::MouseInput;
+
+            unsafe { capture_mouse(window, &mut userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput { device_id: DEVICE_ID, state: Pressed, button: Right },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_RBUTTONUP => {
+            use crate::event::ElementState::Released;
+            use crate::event::MouseButton::Right;
+            use crate::event::WindowEvent::MouseInput;
+
+            unsafe { release_mouse(userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput { device_id: DEVICE_ID, state: Released, button: Right },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_MBUTTONDOWN => {
+            use crate::event::ElementState::Pressed;
+            use crate::event::MouseButton::Middle;
+            use crate::event::WindowEvent::MouseInput;
+
+            unsafe { capture_mouse(window, &mut userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput { device_id: DEVICE_ID, state: Pressed, button: Middle },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_MBUTTONUP => {
+            use crate::event::ElementState::Released;
+            use crate::event::MouseButton::Middle;
+            use crate::event::WindowEvent::MouseInput;
+
+            unsafe { release_mouse(userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput { device_id: DEVICE_ID, state: Released, button: Middle },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_XBUTTONDOWN => {
+            use crate::event::ElementState::Pressed;
+            use crate::event::MouseButton::{Back, Forward, Other};
+            use crate::event::WindowEvent::MouseInput;
+            let xbutton = super::get_xbutton_wparam(wparam as u32);
+
+            unsafe { capture_mouse(window, &mut userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput {
+                    device_id: DEVICE_ID,
+                    state: Pressed,
+                    button: match xbutton {
+                        1 => Back,
+                        2 => Forward,
+                        _ => Other(xbutton),
+                    },
+                },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_XBUTTONUP => {
+            use crate::event::ElementState::Released;
+            use crate::event::MouseButton::{Back, Forward, Other};
+            use crate::event::WindowEvent::MouseInput;
+            let xbutton = super::get_xbutton_wparam(wparam as u32);
+
+            unsafe { release_mouse(userdata.window_state_lock()) };
+
+            update_modifiers(window, userdata);
+
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: MouseInput {
+                    device_id: DEVICE_ID,
+                    state: Released,
+                    button: match xbutton {
+                        1 => Back,
+                        2 => Forward,
+                        _ => Other(xbutton),
+                    },
+                },
+            });
+            result = ProcResult::Value(0);
+        },
+
+        WM_CAPTURECHANGED => {
+            // lparam here is a handle to the window which is gaining mouse capture.
+            // If it is the same as our window, then we're essentially retaining the capture. This
+            // can happen if `SetCapture` is called on our window when it already has the mouse
+            // capture.
+            if lparam != window {
+                userdata.window_state_lock().mouse.capture_count = 0;
+            }
+            result = ProcResult::Value(0);
+        },
+
+        WM_TOUCH => {
+            let pcount = super::loword(wparam as u32) as usize;
+            let mut inputs = Vec::with_capacity(pcount);
+            let htouch = lparam;
+            if unsafe {
+                GetTouchInputInfo(
+                    htouch,
+                    pcount as u32,
+                    inputs.as_mut_ptr(),
+                    mem::size_of::<TOUCHINPUT>() as i32,
+                ) > 0
+            } {
+                unsafe { inputs.set_len(pcount) };
+                for input in &inputs {
+                    let mut location = POINT { x: input.x / 100, y: input.y / 100 };
+
+                    if unsafe { ScreenToClient(window, &mut location) } == false.into() {
+                        continue;
+                    }
+
+                    let x = location.x as f64 + (input.x % 100) as f64 / 100f64;
+                    let y = location.y as f64 + (input.y % 100) as f64 / 100f64;
+                    let location = PhysicalPosition::new(x, y);
+                    userdata.send_event(Event::WindowEvent {
+                        window_id: RootWindowId(WindowId(window)),
+                        event: WindowEvent::Touch(Touch {
+                            phase: if util::has_flag(input.dwFlags, TOUCHEVENTF_DOWN) {
+                                TouchPhase::Started
+                            } else if util::has_flag(input.dwFlags, TOUCHEVENTF_UP) {
+                                TouchPhase::Ended
+                            } else if util::has_flag(input.dwFlags, TOUCHEVENTF_MOVE) {
+                                TouchPhase::Moved
+                            } else {
+                                continue;
+                            },
+                            location,
+                            force: None, // WM_TOUCH doesn't support pressure information
+                            id: input.dwID as u64,
+                            device_id: DEVICE_ID,
+                        }),
+                    });
+                }
+            }
+            unsafe { CloseTouchInputHandle(htouch) };
+            result = ProcResult::Value(0);
+        },
+
+        WM_POINTERDOWN | WM_POINTERUPDATE | WM_POINTERUP => {
+            if let (
+                Some(GetPointerFrameInfoHistory),
+                Some(SkipPointerFrameMessages),
+                Some(GetPointerDeviceRects),
+            ) = (
+                *util::GET_POINTER_FRAME_INFO_HISTORY,
+                *util::SKIP_POINTER_FRAME_MESSAGES,
+                *util::GET_POINTER_DEVICE_RECTS,
+            ) {
+                let pointer_id = super::loword(wparam as u32) as u32;
+                let mut entries_count = 0u32;
+                let mut pointers_count = 0u32;
+                if unsafe {
+                    GetPointerFrameInfoHistory(
+                        pointer_id,
+                        &mut entries_count,
+                        &mut pointers_count,
+                        ptr::null_mut(),
+                    )
+                } == false.into()
+                {
+                    result = ProcResult::Value(0);
+                    return;
+                }
+
+                let pointer_info_count = (entries_count * pointers_count) as usize;
+                let mut pointer_infos = Vec::with_capacity(pointer_info_count);
+                if unsafe {
+                    GetPointerFrameInfoHistory(
+                        pointer_id,
+                        &mut entries_count,
+                        &mut pointers_count,
+                        pointer_infos.as_mut_ptr(),
+                    )
+                } == false.into()
+                {
+                    result = ProcResult::Value(0);
+                    return;
+                }
+                unsafe { pointer_infos.set_len(pointer_info_count) };
+
+                // https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-getpointerframeinfohistory
+                // The information retrieved appears in reverse chronological order, with the most
+                // recent entry in the first row of the returned array
+                for pointer_info in pointer_infos.iter().rev() {
+                    let mut device_rect = mem::MaybeUninit::uninit();
+                    let mut display_rect = mem::MaybeUninit::uninit();
+
+                    if unsafe {
+                        GetPointerDeviceRects(
+                            pointer_info.sourceDevice,
+                            device_rect.as_mut_ptr(),
+                            display_rect.as_mut_ptr(),
+                        )
+                    } == false.into()
+                    {
+                        continue;
+                    }
+
+                    let device_rect = unsafe { device_rect.assume_init() };
+                    let display_rect = unsafe { display_rect.assume_init() };
+
+                    // For the most precise himetric to pixel conversion we calculate the ratio
+                    // between the resolution of the display device (pixel) and
+                    // the touch device (himetric).
+                    let himetric_to_pixel_ratio_x = (display_rect.right - display_rect.left) as f64
+                        / (device_rect.right - device_rect.left) as f64;
+                    let himetric_to_pixel_ratio_y = (display_rect.bottom - display_rect.top) as f64
+                        / (device_rect.bottom - device_rect.top) as f64;
+
+                    // ptHimetricLocation's origin is 0,0 even on multi-monitor setups.
+                    // On multi-monitor setups we need to translate the himetric location to the
+                    // rect of the display device it's attached to.
+                    let x = display_rect.left as f64
+                        + pointer_info.ptHimetricLocation.x as f64 * himetric_to_pixel_ratio_x;
+                    let y = display_rect.top as f64
+                        + pointer_info.ptHimetricLocation.y as f64 * himetric_to_pixel_ratio_y;
+
+                    let mut location = POINT { x: x.floor() as i32, y: y.floor() as i32 };
+
+                    if unsafe { ScreenToClient(window, &mut location) } == false.into() {
+                        continue;
+                    }
+
+                    let force = match pointer_info.pointerType {
+                        PT_TOUCH => {
+                            let mut touch_info = mem::MaybeUninit::uninit();
+                            util::GET_POINTER_TOUCH_INFO.and_then(|GetPointerTouchInfo| {
+                                match unsafe {
+                                    GetPointerTouchInfo(
+                                        pointer_info.pointerId,
+                                        touch_info.as_mut_ptr(),
+                                    )
+                                } {
+                                    0 => None,
+                                    _ => normalize_pointer_pressure(unsafe {
+                                        touch_info.assume_init().pressure
+                                    }),
+                                }
+                            })
+                        },
+                        PT_PEN => {
+                            let mut pen_info = mem::MaybeUninit::uninit();
+                            util::GET_POINTER_PEN_INFO.and_then(|GetPointerPenInfo| {
+                                match unsafe {
+                                    GetPointerPenInfo(pointer_info.pointerId, pen_info.as_mut_ptr())
+                                } {
+                                    0 => None,
+                                    _ => normalize_pointer_pressure(unsafe {
+                                        pen_info.assume_init().pressure
+                                    }),
+                                }
+                            })
+                        },
+                        _ => None,
+                    };
+
+                    let x = location.x as f64 + x.fract();
+                    let y = location.y as f64 + y.fract();
+                    let location = PhysicalPosition::new(x, y);
+                    userdata.send_event(Event::WindowEvent {
+                        window_id: RootWindowId(WindowId(window)),
+                        event: WindowEvent::Touch(Touch {
+                            phase: if util::has_flag(pointer_info.pointerFlags, POINTER_FLAG_DOWN) {
+                                TouchPhase::Started
+                            } else if util::has_flag(pointer_info.pointerFlags, POINTER_FLAG_UP) {
+                                TouchPhase::Ended
+                            } else if util::has_flag(pointer_info.pointerFlags, POINTER_FLAG_UPDATE)
+                            {
+                                TouchPhase::Moved
+                            } else {
+                                continue;
+                            },
+                            location,
+                            force,
+                            id: pointer_info.pointerId as u64,
+                            device_id: DEVICE_ID,
+                        }),
+                    });
+                }
+
+                unsafe { SkipPointerFrameMessages(pointer_id) };
+            }
+            result = ProcResult::Value(0);
+        },
+
+        WM_NCACTIVATE => {
+            let is_active = wparam != false.into();
+            let active_focus_changed = userdata.window_state_lock().set_active(is_active);
+            if active_focus_changed {
+                if is_active {
+                    unsafe { gain_active_focus(window, userdata) };
+                } else {
+                    unsafe { lose_active_focus(window, userdata) };
+                }
+            }
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        WM_SETFOCUS => {
+            let active_focus_changed = userdata.window_state_lock().set_focused(true);
+            if active_focus_changed {
+                unsafe { gain_active_focus(window, userdata) };
+            }
+            result = ProcResult::Value(0);
+        },
+
+        WM_KILLFOCUS => {
+            let active_focus_changed = userdata.window_state_lock().set_focused(false);
+            if active_focus_changed {
+                unsafe { lose_active_focus(window, userdata) };
+            }
+            result = ProcResult::Value(0);
+        },
+
+        WM_SETCURSOR => {
+            let set_cursor_to = {
+                let window_state = userdata.window_state_lock();
+                // The return value for the preceding `WM_NCHITTEST` message is conveniently
+                // provided through the low-order word of lParam. We use that here since
+                // `WM_MOUSEMOVE` seems to come after `WM_SETCURSOR` for a given cursor movement.
+                let in_client_area = super::loword(lparam as u32) as u32 == HTCLIENT;
+                if in_client_area {
+                    Some(window_state.mouse.selected_cursor.clone())
+                } else {
+                    None
+                }
+            };
+
+            match set_cursor_to {
+                Some(selected_cursor) => {
+                    let hcursor = match selected_cursor {
+                        SelectedCursor::Named(cursor_icon) => unsafe {
+                            LoadCursorW(0, util::to_windows_cursor(cursor_icon))
+                        },
+                        SelectedCursor::Custom(cursor) => cursor.as_raw_handle(),
+                    };
+                    unsafe { SetCursor(hcursor) };
+                    result = ProcResult::Value(0);
+                },
+                None => result = ProcResult::DefWindowProc(wparam),
+            }
+        },
+
+        WM_GETMINMAXINFO => {
+            let mmi = lparam as *mut MINMAXINFO;
+
+            let window_state = userdata.window_state_lock();
+            let window_flags = window_state.window_flags;
+
+            if window_state.min_size.is_some() || window_state.max_size.is_some() {
+                if let Some(min_size) = window_state.min_size {
+                    let min_size = min_size.to_physical(window_state.scale_factor);
+                    let (width, height): (u32, u32) =
+                        window_flags.adjust_size(window, min_size).into();
+                    unsafe { (*mmi).ptMinTrackSize = POINT { x: width as i32, y: height as i32 } };
+                }
+                if let Some(max_size) = window_state.max_size {
+                    let max_size = max_size.to_physical(window_state.scale_factor);
+                    let (width, height): (u32, u32) =
+                        window_flags.adjust_size(window, max_size).into();
+                    unsafe { (*mmi).ptMaxTrackSize = POINT { x: width as i32, y: height as i32 } };
+                }
+            }
+
+            result = ProcResult::Value(0);
+        },
+
+        // Only sent on Windows 8.1 or newer. On Windows 7 and older user has to log out to change
+        // DPI, therefore all applications are closed while DPI is changing.
+        WM_DPICHANGED => {
+            use crate::event::WindowEvent::ScaleFactorChanged;
+
+            // This message actually provides two DPI values - x and y. However MSDN says that
+            // "you only need to use either the X-axis or the Y-axis value when scaling your
+            // application since they are the same".
+            // https://msdn.microsoft.com/en-us/library/windows/desktop/dn312083(v=vs.85).aspx
+            let new_dpi_x = super::loword(wparam as u32) as u32;
+            let new_scale_factor = dpi_to_scale_factor(new_dpi_x);
+            let old_scale_factor: f64;
+
+            let (allow_resize, window_flags) = {
+                let mut window_state = userdata.window_state_lock();
+                old_scale_factor = window_state.scale_factor;
+                window_state.scale_factor = new_scale_factor;
+
+                if new_scale_factor == old_scale_factor {
+                    result = ProcResult::Value(0);
+                    return;
+                }
+
+                let allow_resize = window_state.fullscreen.is_none()
+                    && !window_state.window_flags().contains(WindowFlags::MAXIMIZED);
+
+                (allow_resize, window_state.window_flags)
+            };
+
+            // New size as suggested by Windows.
+            let suggested_rect = unsafe { *(lparam as *const RECT) };
+
+            // The window rect provided is the window's outer size, not it's inner size. However,
+            // win32 doesn't provide an `UnadjustWindowRectEx` function to get the client rect from
+            // the outer rect, so we instead adjust the window rect to get the decoration margins
+            // and remove them from the outer size.
+            let margin_left: i32;
+            let margin_top: i32;
+            // let margin_right: i32;
+            // let margin_bottom: i32;
+            {
+                let adjusted_rect =
+                    window_flags.adjust_rect(window, suggested_rect).unwrap_or(suggested_rect);
+                margin_left = suggested_rect.left - adjusted_rect.left;
+                margin_top = suggested_rect.top - adjusted_rect.top;
+                // margin_right = adjusted_rect.right - suggested_rect.right;
+                // margin_bottom = adjusted_rect.bottom - suggested_rect.bottom;
+            }
+
+            let old_physical_inner_rect = util::WindowArea::Inner
+                .get_rect(window)
+                .expect("failed to query (old) inner window area");
+            let old_physical_inner_size = PhysicalSize::new(
+                (old_physical_inner_rect.right - old_physical_inner_rect.left) as u32,
+                (old_physical_inner_rect.bottom - old_physical_inner_rect.top) as u32,
+            );
+
+            // `allow_resize` prevents us from re-applying DPI adjustment to the restored size after
+            // exiting fullscreen (the restored size is already DPI adjusted).
+            let new_physical_inner_size = match allow_resize {
+                // We calculate our own size because the default suggested rect doesn't do a great
+                // job of preserving the window's logical size.
+                true => old_physical_inner_size
+                    .to_logical::<f64>(old_scale_factor)
+                    .to_physical::<u32>(new_scale_factor),
+                false => old_physical_inner_size,
+            };
+
+            let new_inner_size = Arc::new(Mutex::new(new_physical_inner_size));
+            userdata.send_event(Event::WindowEvent {
+                window_id: RootWindowId(WindowId(window)),
+                event: ScaleFactorChanged {
+                    scale_factor: new_scale_factor,
+                    inner_size_writer: InnerSizeWriter::new(Arc::downgrade(&new_inner_size)),
+                },
+            });
+
+            let new_physical_inner_size = *new_inner_size.lock().unwrap();
+            drop(new_inner_size);
+
+            let dragging_window: bool;
+
+            {
+                let window_state = userdata.window_state_lock();
+                dragging_window =
+                    window_state.window_flags().contains(WindowFlags::MARKER_IN_SIZE_MOVE);
+                // Unset maximized if we're changing the window's size.
+                if new_physical_inner_size != old_physical_inner_size {
+                    WindowState::set_window_flags(window_state, window, |f| {
+                        f.set(WindowFlags::MAXIMIZED, false)
+                    });
+                }
+            }
+
+            let new_outer_rect: RECT;
+            // PdfCraft patch: from Windows 11 (build 22000) on, apply the rect Windows suggests, as
+            // winit master does since 488c036a (rust-windowing/winit#4341). The adjustment below
+            // asks `MonitorFromWindow`, which during a drag still answers with the monitor being
+            // left: it nudges the window back onto that monitor, which sends another WM_DPICHANGED,
+            // and the window grows and stays on the wrong monitor at the wrong scale
+            // (rust-windowing/winit#4041, #4600; storytold/pdfcraft#324).
+            if !WIN10_BUILD_VERSION.is_some_and(|build| build < 22000) {
+                new_outer_rect = suggested_rect;
+            } else {
+                let suggested_ul =
+                    (suggested_rect.left + margin_left, suggested_rect.top + margin_top);
+
+                let mut conservative_rect = RECT {
+                    left: suggested_ul.0,
+                    top: suggested_ul.1,
+                    right: suggested_ul.0 + new_physical_inner_size.width as i32,
+                    bottom: suggested_ul.1 + new_physical_inner_size.height as i32,
+                };
+
+                conservative_rect = window_flags
+                    .adjust_rect(window, conservative_rect)
+                    .unwrap_or(conservative_rect);
+
+                // If we're dragging the window, offset the window so that the cursor's
+                // relative horizontal position in the title bar is preserved.
+                if dragging_window {
+                    let bias = {
+                        let cursor_pos = {
+                            let mut pos = unsafe { mem::zeroed() };
+                            unsafe { GetCursorPos(&mut pos) };
+                            pos
+                        };
+                        let suggested_cursor_horizontal_ratio = (cursor_pos.x - suggested_rect.left)
+                            as f64
+                            / (suggested_rect.right - suggested_rect.left) as f64;
+
+                        (cursor_pos.x
+                            - (suggested_cursor_horizontal_ratio
+                                * (conservative_rect.right - conservative_rect.left) as f64)
+                                as i32)
+                            - conservative_rect.left
+                    };
+                    conservative_rect.left += bias;
+                    conservative_rect.right += bias;
+                }
+
+                // Check to see if the new window rect is on the monitor with the new DPI factor.
+                // If it isn't, offset the window so that it is.
+                let new_dpi_monitor = unsafe { MonitorFromWindow(window, MONITOR_DEFAULTTONULL) };
+                let conservative_rect_monitor =
+                    unsafe { MonitorFromRect(&conservative_rect, MONITOR_DEFAULTTONULL) };
+                new_outer_rect = if conservative_rect_monitor == new_dpi_monitor {
+                    conservative_rect
+                } else {
+                    let get_monitor_rect = |monitor| {
+                        let mut monitor_info = MONITORINFO {
+                            cbSize: mem::size_of::<MONITORINFO>() as _,
+                            ..unsafe { mem::zeroed() }
+                        };
+                        unsafe { GetMonitorInfoW(monitor, &mut monitor_info) };
+                        monitor_info.rcMonitor
+                    };
+                    let wrong_monitor = conservative_rect_monitor;
+                    let wrong_monitor_rect = get_monitor_rect(wrong_monitor);
+                    let new_monitor_rect = get_monitor_rect(new_dpi_monitor);
+
+                    // The direction to nudge the window in to get the window onto the monitor with
+                    // the new DPI factor. We calculate this by seeing which monitor edges are
+                    // shared and nudging away from the wrong monitor based on those.
+                    #[allow(clippy::bool_to_int_with_if)]
+                    let delta_nudge_to_dpi_monitor = (
+                        if wrong_monitor_rect.left == new_monitor_rect.right {
+                            -1
+                        } else if wrong_monitor_rect.right == new_monitor_rect.left {
+                            1
+                        } else {
+                            0
+                        },
+                        if wrong_monitor_rect.bottom == new_monitor_rect.top {
+                            1
+                        } else if wrong_monitor_rect.top == new_monitor_rect.bottom {
+                            -1
+                        } else {
+                            0
+                        },
+                    );
+
+                    let abort_after_iterations = new_monitor_rect.right - new_monitor_rect.left
+                        + new_monitor_rect.bottom
+                        - new_monitor_rect.top;
+                    for _ in 0..abort_after_iterations {
+                        conservative_rect.left += delta_nudge_to_dpi_monitor.0;
+                        conservative_rect.right += delta_nudge_to_dpi_monitor.0;
+                        conservative_rect.top += delta_nudge_to_dpi_monitor.1;
+                        conservative_rect.bottom += delta_nudge_to_dpi_monitor.1;
+
+                        if unsafe { MonitorFromRect(&conservative_rect, MONITOR_DEFAULTTONULL) }
+                            == new_dpi_monitor
+                        {
+                            break;
+                        }
+                    }
+
+                    conservative_rect
+                };
+            }
+
+            unsafe {
+                SetWindowPos(
+                    window,
+                    0,
+                    new_outer_rect.left,
+                    new_outer_rect.top,
+                    new_outer_rect.right - new_outer_rect.left,
+                    new_outer_rect.bottom - new_outer_rect.top,
+                    SWP_NOZORDER | SWP_NOACTIVATE,
+                )
+            };
+
+            result = ProcResult::Value(0);
+        },
+
+        WM_SETTINGCHANGE => {
+            use crate::event::WindowEvent::ThemeChanged;
+
+            let preferred_theme = userdata.window_state_lock().preferred_theme;
+
+            if preferred_theme.is_none() {
+                let new_theme = try_theme(window, preferred_theme);
+                let mut window_state = userdata.window_state_lock();
+
+                if window_state.current_theme != new_theme {
+                    window_state.current_theme = new_theme;
+                    drop(window_state);
+                    userdata.send_event(Event::WindowEvent {
+                        window_id: RootWindowId(WindowId(window)),
+                        event: ThemeChanged(new_theme),
+                    });
+                }
+            }
+            result = ProcResult::DefWindowProc(wparam);
+        },
+
+        _ => {
+            if msg == DESTROY_MSG_ID.get() {
+                unsafe { DestroyWindow(window) };
+                result = ProcResult::Value(0);
+            } else if msg == SET_RETAIN_STATE_ON_SIZE_MSG_ID.get() {
+                let mut window_state = userdata.window_state_lock();
+                window_state.set_window_flags_in_place(|f| {
+                    f.set(WindowFlags::MARKER_RETAIN_STATE_ON_SIZE, wparam != 0)
+                });
+                result = ProcResult::Value(0);
+            } else if msg == TASKBAR_CREATED.get() {
+                let window_state = userdata.window_state_lock();
+                unsafe { set_skip_taskbar(window, window_state.skip_taskbar) };
+                result = ProcResult::DefWindowProc(wparam);
+            } else {
+                result = ProcResult::DefWindowProc(wparam);
+            }
+        },
+    };
+
+    userdata
+        .event_loop_runner
+        .catch_unwind(callback)
+        .unwrap_or_else(|| result = ProcResult::Value(-1));
+
+    match result {
+        ProcResult::DefWindowProc(wparam) => unsafe { DefWindowProcW(window, msg, wparam, lparam) },
+        ProcResult::Value(val) => val,
+    }
+}
+
+unsafe extern "system" fn thread_event_target_callback(
+    window: HWND,
+    msg: u32,
+    wparam: WPARAM,
+    lparam: LPARAM,
+) -> LRESULT {
+    let userdata_ptr =
+        unsafe { super::get_window_long(window, GWL_USERDATA) } as *mut ThreadMsgTargetData;
+    if userdata_ptr.is_null() {
+        // `userdata_ptr` will always be null for the first `WM_GETMINMAXINFO`, as well as
+        // `WM_NCCREATE` and `WM_CREATE`.
+        return unsafe { DefWindowProcW(window, msg, wparam, lparam) };
+    }
+    let userdata = unsafe { Box::from_raw(userdata_ptr) };
+
+    if msg != WM_PAINT {
+        unsafe { RedrawWindow(window, ptr::null(), 0, RDW_INTERNALPAINT) };
+    }
+
+    let mut userdata_removed = false;
+
+    // I decided to bind the closure to `callback` and pass it to catch_unwind rather than passing
+    // the closure to catch_unwind directly so that the match body indentation wouldn't change and
+    // the git blame and history would be preserved.
+    let callback = || match msg {
+        WM_NCDESTROY => {
+            unsafe { super::set_window_long(window, GWL_USERDATA, 0) };
+            userdata_removed = true;
+            0
+        },
+        WM_PAINT => unsafe {
+            ValidateRect(window, ptr::null());
+            // Default WM_PAINT behaviour. This makes sure modals and popups are shown immediately
+            // when opening them.
+            DefWindowProcW(window, msg, wparam, lparam)
+        },
+
+        WM_INPUT_DEVICE_CHANGE => {
+            let event = match wparam as u32 {
+                GIDC_ARRIVAL => DeviceEvent::Added,
+                GIDC_REMOVAL => DeviceEvent::Removed,
+                _ => unreachable!(),
+            };
+
+            userdata
+                .send_event(Event::DeviceEvent { device_id: wrap_device_id(lparam as u32), event });
+
+            0
+        },
+
+        WM_INPUT => {
+            if let Some(data) = raw_input::get_raw_input_data(lparam as _) {
+                unsafe { handle_raw_input(&userdata, data) };
+            }
+
+            unsafe { DefWindowProcW(window, msg, wparam, lparam) }
+        },
+
+        _ if msg == USER_EVENT_MSG_ID.get() => {
+            // synthesis a placeholder UserEvent, so that if the callback is
+            // re-entered it can be buffered for later delivery. the real
+            // user event is still in the mpsc channel and will be pulled
+            // once the placeholder event is delivered to the wrapper
+            // `event_handler`
+            userdata.send_event(Event::UserEvent(UserEventPlaceholder));
+            0
+        },
+        _ if msg == EXEC_MSG_ID.get() => {
+            let mut function: ThreadExecFn = unsafe { Box::from_raw(wparam as *mut _) };
+            function();
+            0
+        },
+        _ => unsafe { DefWindowProcW(window, msg, wparam, lparam) },
+    };
+
+    let result = userdata.event_loop_runner.catch_unwind(callback).unwrap_or(-1);
+    if userdata_removed {
+        drop(userdata);
+    } else {
+        Box::leak(userdata);
+    }
+    result
+}
+
+unsafe fn handle_raw_input(userdata: &ThreadMsgTargetData, data: RAWINPUT) {
+    use crate::event::DeviceEvent::{Button, Key, Motion, MouseMotion, MouseWheel};
+    use crate::event::ElementState::{Pressed, Released};
+    use crate::event::MouseScrollDelta::LineDelta;
+
+    let device_id = wrap_device_id(data.header.hDevice as _);
+
+    if data.header.dwType == RIM_TYPEMOUSE {
+        let mouse = unsafe { data.data.mouse };
+
+        if util::has_flag(mouse.usFlags as u32, MOUSE_MOVE_RELATIVE) {
+            let x = mouse.lLastX as f64;
+            let y = mouse.lLastY as f64;
+
+            if x != 0.0 {
+                userdata.send_event(Event::DeviceEvent {
+                    device_id,
+                    event: Motion { axis: 0, value: x },
+                });
+            }
+
+            if y != 0.0 {
+                userdata.send_event(Event::DeviceEvent {
+                    device_id,
+                    event: Motion { axis: 1, value: y },
+                });
+            }
+
+            if x != 0.0 || y != 0.0 {
+                userdata.send_event(Event::DeviceEvent {
+                    device_id,
+                    event: MouseMotion { delta: (x, y) },
+                });
+            }
+        }
+
+        let button_flags = unsafe { mouse.Anonymous.Anonymous.usButtonFlags };
+        if util::has_flag(button_flags as u32, RI_MOUSE_WHEEL) {
+            let button_data = unsafe { mouse.Anonymous.Anonymous.usButtonData } as i16;
+            let delta = button_data as f32 / WHEEL_DELTA as f32;
+            userdata.send_event(Event::DeviceEvent {
+                device_id,
+                event: MouseWheel { delta: LineDelta(0.0, delta) },
+            });
+        }
+        if util::has_flag(button_flags as u32, RI_MOUSE_HWHEEL) {
+            let button_data = unsafe { mouse.Anonymous.Anonymous.usButtonData } as i16;
+            let delta = -button_data as f32 / WHEEL_DELTA as f32;
+            userdata.send_event(Event::DeviceEvent {
+                device_id,
+                event: MouseWheel { delta: LineDelta(delta, 0.0) },
+            });
+        }
+
+        let button_state = raw_input::get_raw_mouse_button_state(button_flags as u32);
+        for (button, state) in button_state.iter().enumerate() {
+            if let Some(state) = *state {
+                userdata.send_event(Event::DeviceEvent {
+                    device_id,
+                    event: Button { button: button as _, state },
+                });
+            }
+        }
+    } else if data.header.dwType == RIM_TYPEKEYBOARD {
+        let keyboard = unsafe { data.data.keyboard };
+
+        let pressed = keyboard.Message == WM_KEYDOWN || keyboard.Message == WM_SYSKEYDOWN;
+        let released = keyboard.Message == WM_KEYUP || keyboard.Message == WM_SYSKEYUP;
+
+        if !pressed && !released {
+            return;
+        }
+
+        if let Some(physical_key) = raw_input::get_keyboard_physical_key(keyboard) {
+            let state = if pressed { Pressed } else { Released };
+
+            userdata.send_event(Event::DeviceEvent {
+                device_id,
+                event: Key(RawKeyEvent { physical_key, state }),
+            });
+        }
+    }
+}
+
+enum PointerMoveKind {
+    /// Pointer entered to the window.
+    Enter,
+    /// Pointer leaved the window client area.
+    Leave,
+    /// Pointer is inside the window or `GetClientRect` failed.
+    None,
+}
+
+fn get_pointer_move_kind(
+    window: HWND,
+    mouse_was_inside_window: bool,
+    x: i32,
+    y: i32,
+) -> PointerMoveKind {
+    let rect: RECT = unsafe {
+        let mut rect: RECT = mem::zeroed();
+        if GetClientRect(window, &mut rect) == false.into() {
+            return PointerMoveKind::None; // exit early if GetClientRect failed
+        }
+        rect
+    };
+
+    let x = (rect.left..rect.right).contains(&x);
+    let y = (rect.top..rect.bottom).contains(&y);
+
+    if !mouse_was_inside_window && x && y {
+        PointerMoveKind::Enter
+    } else if mouse_was_inside_window && !(x && y) {
+        PointerMoveKind::Leave
+    } else {
+        PointerMoveKind::None
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/event_loop/runner.rs b/vendor/winit/src/platform_impl/windows/event_loop/runner.rs
new file mode 100644
index 00000000..3243ec47
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/event_loop/runner.rs
@@ -0,0 +1,406 @@
+use std::any::Any;
+use std::cell::{Cell, RefCell};
+use std::collections::VecDeque;
+use std::rc::Rc;
+use std::sync::{Arc, Mutex};
+use std::time::Instant;
+use std::{mem, panic};
+
+use windows_sys::Win32::Foundation::HWND;
+
+use crate::dpi::PhysicalSize;
+use crate::event::{Event, InnerSizeWriter, StartCause, WindowEvent};
+use crate::platform_impl::platform::event_loop::{WindowData, GWL_USERDATA};
+use crate::platform_impl::platform::get_window_long;
+use crate::window::WindowId;
+
+use super::ControlFlow;
+
+pub(crate) type EventLoopRunnerShared<T> = Rc<EventLoopRunner<T>>;
+
+type EventHandler<T> = Cell<Option<Box<dyn FnMut(Event<T>)>>>;
+
+pub(crate) struct EventLoopRunner<T: 'static> {
+    // The event loop's win32 handles
+    pub(super) thread_msg_target: HWND,
+
+    // Setting this will ensure pump_events will return to the external
+    // loop asap. E.g. set after each RedrawRequested to ensure pump_events
+    // can't stall an external loop beyond a frame
+    pub(super) interrupt_msg_dispatch: Cell<bool>,
+
+    control_flow: Cell<ControlFlow>,
+    exit: Cell<Option<i32>>,
+    runner_state: Cell<RunnerState>,
+    last_events_cleared: Cell<Instant>,
+    event_handler: EventHandler<T>,
+    event_buffer: RefCell<VecDeque<BufferedEvent<T>>>,
+
+    panic_error: Cell<Option<PanicError>>,
+}
+
+pub type PanicError = Box<dyn Any + Send + 'static>;
+
+/// See `move_state_to` function for details on how the state loop works.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) enum RunnerState {
+    /// The event loop has just been created, and an `Init` event must be sent.
+    Uninitialized,
+    /// The event loop is idling.
+    Idle,
+    /// The event loop is handling the OS's events and sending them to the user's callback.
+    /// `NewEvents` has been sent, and `AboutToWait` hasn't.
+    HandlingMainEvents,
+    /// The event loop has been destroyed. No other events will be emitted.
+    Destroyed,
+}
+
+enum BufferedEvent<T: 'static> {
+    Event(Event<T>),
+    ScaleFactorChanged(WindowId, f64, PhysicalSize<u32>),
+}
+
+impl<T> EventLoopRunner<T> {
+    pub(crate) fn new(thread_msg_target: HWND) -> EventLoopRunner<T> {
+        EventLoopRunner {
+            thread_msg_target,
+            interrupt_msg_dispatch: Cell::new(false),
+            runner_state: Cell::new(RunnerState::Uninitialized),
+            control_flow: Cell::new(ControlFlow::default()),
+            exit: Cell::new(None),
+            panic_error: Cell::new(None),
+            last_events_cleared: Cell::new(Instant::now()),
+            event_handler: Cell::new(None),
+            event_buffer: RefCell::new(VecDeque::new()),
+        }
+    }
+
+    /// Associate the application's event handler with the runner
+    ///
+    /// # Safety
+    /// This is ignoring the lifetime of the application handler (which may not
+    /// outlive the EventLoopRunner) and can lead to undefined behaviour if
+    /// the handler is not cleared before the end of real lifetime.
+    ///
+    /// All public APIs that take an event handler (`run`, `run_on_demand`,
+    /// `pump_events`) _must_ pair a call to `set_event_handler` with
+    /// a call to `clear_event_handler` before returning to avoid
+    /// undefined behaviour.
+    pub(crate) unsafe fn set_event_handler<F>(&self, f: F)
+    where
+        F: FnMut(Event<T>),
+    {
+        // Erase closure lifetime.
+        // SAFETY: Caller upholds that the lifetime of the closure is upheld.
+        let f = unsafe {
+            mem::transmute::<Box<dyn FnMut(Event<T>)>, Box<dyn FnMut(Event<T>)>>(Box::new(f))
+        };
+        let old_event_handler = self.event_handler.replace(Some(f));
+        assert!(old_event_handler.is_none());
+    }
+
+    pub(crate) fn clear_event_handler(&self) {
+        self.event_handler.set(None);
+    }
+
+    pub(crate) fn reset_runner(&self) {
+        let EventLoopRunner {
+            thread_msg_target: _,
+            interrupt_msg_dispatch,
+            runner_state,
+            panic_error,
+            control_flow: _,
+            exit,
+            last_events_cleared: _,
+            event_handler,
+            event_buffer: _,
+        } = self;
+        interrupt_msg_dispatch.set(false);
+        runner_state.set(RunnerState::Uninitialized);
+        panic_error.set(None);
+        exit.set(None);
+        event_handler.set(None);
+    }
+}
+
+/// State retrieval functions.
+impl<T> EventLoopRunner<T> {
+    #[allow(unused)]
+    pub fn thread_msg_target(&self) -> HWND {
+        self.thread_msg_target
+    }
+
+    pub fn take_panic_error(&self) -> Result<(), PanicError> {
+        match self.panic_error.take() {
+            Some(err) => Err(err),
+            None => Ok(()),
+        }
+    }
+
+    pub fn set_control_flow(&self, control_flow: ControlFlow) {
+        self.control_flow.set(control_flow)
+    }
+
+    pub fn control_flow(&self) -> ControlFlow {
+        self.control_flow.get()
+    }
+
+    pub fn set_exit_code(&self, code: i32) {
+        self.exit.set(Some(code))
+    }
+
+    pub fn exit_code(&self) -> Option<i32> {
+        self.exit.get()
+    }
+
+    pub fn clear_exit(&self) {
+        self.exit.set(None);
+    }
+
+    pub fn should_buffer(&self) -> bool {
+        let handler = self.event_handler.take();
+        let should_buffer = handler.is_none();
+        self.event_handler.set(handler);
+        should_buffer
+    }
+}
+
+/// Misc. functions
+impl<T> EventLoopRunner<T> {
+    pub fn catch_unwind<R>(&self, f: impl FnOnce() -> R) -> Option<R> {
+        let panic_error = self.panic_error.take();
+        if panic_error.is_none() {
+            let result = panic::catch_unwind(panic::AssertUnwindSafe(f));
+
+            // Check to see if the panic error was set in a re-entrant call to catch_unwind inside
+            // of `f`. If it was, that error takes priority. If it wasn't, check if our call to
+            // catch_unwind caught any panics and set panic_error appropriately.
+            match self.panic_error.take() {
+                None => match result {
+                    Ok(r) => Some(r),
+                    Err(e) => {
+                        self.panic_error.set(Some(e));
+                        None
+                    },
+                },
+                Some(e) => {
+                    self.panic_error.set(Some(e));
+                    None
+                },
+            }
+        } else {
+            self.panic_error.set(panic_error);
+            None
+        }
+    }
+}
+
+/// Event dispatch functions.
+impl<T> EventLoopRunner<T> {
+    pub(crate) fn prepare_wait(&self) {
+        self.move_state_to(RunnerState::Idle);
+    }
+
+    pub(crate) fn wakeup(&self) {
+        self.move_state_to(RunnerState::HandlingMainEvents);
+    }
+
+    pub(crate) fn send_event(&self, event: Event<T>) {
+        if let Event::WindowEvent { event: WindowEvent::RedrawRequested, .. } = event {
+            self.call_event_handler(event);
+            // As a rule, to ensure that `pump_events` can't block an external event loop
+            // for too long, we always guarantee that `pump_events` will return control to
+            // the external loop asap after a `RedrawRequested` event is dispatched.
+            self.interrupt_msg_dispatch.set(true);
+        } else if self.should_buffer() {
+            // If the runner is already borrowed, we're in the middle of an event loop invocation.
+            // Add the event to a buffer to be processed later.
+            self.event_buffer.borrow_mut().push_back(BufferedEvent::from_event(event))
+        } else {
+            self.call_event_handler(event);
+            self.dispatch_buffered_events();
+        }
+    }
+
+    pub(crate) fn loop_destroyed(&self) {
+        self.move_state_to(RunnerState::Destroyed);
+    }
+
+    fn call_event_handler(&self, event: Event<T>) {
+        self.catch_unwind(|| {
+            let mut event_handler = self.event_handler.take().expect(
+                "either event handler is re-entrant (likely), or no event handler is registered \
+                 (very unlikely)",
+            );
+
+            event_handler(event);
+
+            assert!(self.event_handler.replace(Some(event_handler)).is_none());
+        });
+    }
+
+    fn dispatch_buffered_events(&self) {
+        loop {
+            // We do this instead of using a `while let` loop because if we use a `while let`
+            // loop the reference returned `borrow_mut()` doesn't get dropped until the end
+            // of the loop's body and attempts to add events to the event buffer while in
+            // `process_event` will fail.
+            let buffered_event_opt = self.event_buffer.borrow_mut().pop_front();
+            match buffered_event_opt {
+                Some(e) => e.dispatch_event(|e| self.call_event_handler(e)),
+                None => break,
+            }
+        }
+    }
+
+    /// Dispatch control flow events (`NewEvents`, `AboutToWait`, and
+    /// `LoopExiting`) as necessary to bring the internal `RunnerState` to the
+    /// new runner state.
+    ///
+    /// The state transitions are defined as follows:
+    ///
+    /// ```text
+    ///    Uninitialized
+    ///          |
+    ///          V
+    ///        Idle
+    ///       ^    |
+    ///       |    V
+    /// HandlingMainEvents
+    ///         |
+    ///         V
+    ///     Destroyed
+    /// ```
+    ///
+    /// Attempting to transition back to `Uninitialized` will result in a panic. Attempting to
+    /// transition *from* `Destroyed` will also result in a panic. Transitioning to the current
+    /// state is a no-op. Even if the `new_runner_state` isn't the immediate next state in the
+    /// runner state machine (e.g. `self.runner_state == HandlingMainEvents` and
+    /// `new_runner_state == Idle`), the intermediate state transitions will still be executed.
+    fn move_state_to(&self, new_runner_state: RunnerState) {
+        use RunnerState::{Destroyed, HandlingMainEvents, Idle, Uninitialized};
+
+        match (self.runner_state.replace(new_runner_state), new_runner_state) {
+            (Uninitialized, Uninitialized)
+            | (Idle, Idle)
+            | (HandlingMainEvents, HandlingMainEvents)
+            | (Destroyed, Destroyed) => (),
+
+            // State transitions that initialize the event loop.
+            (Uninitialized, HandlingMainEvents) => {
+                self.call_new_events(true);
+            },
+            (Uninitialized, Idle) => {
+                self.call_new_events(true);
+                self.call_event_handler(Event::AboutToWait);
+                self.last_events_cleared.set(Instant::now());
+            },
+            (Uninitialized, Destroyed) => {
+                self.call_new_events(true);
+                self.call_event_handler(Event::AboutToWait);
+                self.last_events_cleared.set(Instant::now());
+                self.call_event_handler(Event::LoopExiting);
+            },
+            (_, Uninitialized) => panic!("cannot move state to Uninitialized"),
+
+            // State transitions that start the event handling process.
+            (Idle, HandlingMainEvents) => {
+                self.call_new_events(false);
+            },
+            (Idle, Destroyed) => {
+                self.call_event_handler(Event::LoopExiting);
+            },
+
+            (HandlingMainEvents, Idle) => {
+                // This is always the last event we dispatch before waiting for new events
+                self.call_event_handler(Event::AboutToWait);
+                self.last_events_cleared.set(Instant::now());
+            },
+            (HandlingMainEvents, Destroyed) => {
+                self.call_event_handler(Event::AboutToWait);
+                self.last_events_cleared.set(Instant::now());
+                self.call_event_handler(Event::LoopExiting);
+            },
+
+            (Destroyed, _) => panic!("cannot move state from Destroyed"),
+        }
+    }
+
+    fn call_new_events(&self, init: bool) {
+        let start_cause = match (init, self.control_flow(), self.exit.get()) {
+            (true, ..) => StartCause::Init,
+            (false, ControlFlow::Poll, None) => StartCause::Poll,
+            (false, _, Some(_)) | (false, ControlFlow::Wait, None) => StartCause::WaitCancelled {
+                requested_resume: None,
+                start: self.last_events_cleared.get(),
+            },
+            (false, ControlFlow::WaitUntil(requested_resume), None) => {
+                if Instant::now() < requested_resume {
+                    StartCause::WaitCancelled {
+                        requested_resume: Some(requested_resume),
+                        start: self.last_events_cleared.get(),
+                    }
+                } else {
+                    StartCause::ResumeTimeReached {
+                        requested_resume,
+                        start: self.last_events_cleared.get(),
+                    }
+                }
+            },
+        };
+        self.call_event_handler(Event::NewEvents(start_cause));
+        // NB: For consistency all platforms must emit a 'resumed' event even though Windows
+        // applications don't themselves have a formal suspend/resume lifecycle.
+        if init {
+            self.call_event_handler(Event::Resumed);
+        }
+        self.dispatch_buffered_events();
+    }
+}
+
+impl<T> BufferedEvent<T> {
+    pub fn from_event(event: Event<T>) -> BufferedEvent<T> {
+        match event {
+            Event::WindowEvent {
+                event: WindowEvent::ScaleFactorChanged { scale_factor, inner_size_writer },
+                window_id,
+            } => BufferedEvent::ScaleFactorChanged(
+                window_id,
+                scale_factor,
+                *inner_size_writer.new_inner_size.upgrade().unwrap().lock().unwrap(),
+            ),
+            event => BufferedEvent::Event(event),
+        }
+    }
+
+    pub fn dispatch_event(self, dispatch: impl FnOnce(Event<T>)) {
+        match self {
+            Self::Event(event) => dispatch(event),
+            Self::ScaleFactorChanged(window_id, scale_factor, new_inner_size) => {
+                let user_new_inner_size = Arc::new(Mutex::new(new_inner_size));
+                dispatch(Event::WindowEvent {
+                    window_id,
+                    event: WindowEvent::ScaleFactorChanged {
+                        scale_factor,
+                        inner_size_writer: InnerSizeWriter::new(Arc::downgrade(
+                            &user_new_inner_size,
+                        )),
+                    },
+                });
+                let inner_size = *user_new_inner_size.lock().unwrap();
+
+                drop(user_new_inner_size);
+
+                if inner_size != new_inner_size {
+                    let window_flags = unsafe {
+                        let userdata =
+                            get_window_long(window_id.0.into(), GWL_USERDATA) as *mut WindowData;
+                        (*userdata).window_state_lock().window_flags
+                    };
+
+                    window_flags.set_size((window_id.0).0, inner_size);
+                }
+            },
+        }
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/icon.rs b/vendor/winit/src/platform_impl/windows/icon.rs
new file mode 100644
index 00000000..4e5fe69e
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/icon.rs
@@ -0,0 +1,265 @@
+use std::ffi::c_void;
+use std::path::Path;
+use std::sync::Arc;
+use std::{fmt, io, mem};
+
+use cursor_icon::CursorIcon;
+use windows_sys::core::PCWSTR;
+use windows_sys::Win32::Foundation::HWND;
+use windows_sys::Win32::Graphics::Gdi::{
+    CreateBitmap, CreateCompatibleBitmap, DeleteObject, GetDC, ReleaseDC, SetBitmapBits,
+};
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    CreateIcon, CreateIconIndirect, DestroyCursor, DestroyIcon, LoadImageW, SendMessageW, HCURSOR,
+    HICON, ICONINFO, ICON_BIG, ICON_SMALL, IMAGE_ICON, LR_DEFAULTSIZE, LR_LOADFROMFILE, WM_SETICON,
+};
+
+use crate::cursor::CursorImage;
+use crate::dpi::PhysicalSize;
+use crate::icon::*;
+
+use super::util;
+
+impl Pixel {
+    fn convert_to_bgra(&mut self) {
+        mem::swap(&mut self.r, &mut self.b);
+    }
+}
+
+impl RgbaIcon {
+    fn into_windows_icon(self) -> Result<WinIcon, BadIcon> {
+        let rgba = self.rgba;
+        let pixel_count = rgba.len() / PIXEL_SIZE;
+        let mut and_mask = Vec::with_capacity(pixel_count);
+        let pixels =
+            unsafe { std::slice::from_raw_parts_mut(rgba.as_ptr() as *mut Pixel, pixel_count) };
+        for pixel in pixels {
+            and_mask.push(pixel.a.wrapping_sub(u8::MAX)); // invert alpha channel
+            pixel.convert_to_bgra();
+        }
+        assert_eq!(and_mask.len(), pixel_count);
+        let handle = unsafe {
+            CreateIcon(
+                0,
+                self.width as i32,
+                self.height as i32,
+                1,
+                (PIXEL_SIZE * 8) as u8,
+                and_mask.as_ptr(),
+                rgba.as_ptr(),
+            )
+        };
+        if handle != 0 {
+            Ok(WinIcon::from_handle(handle))
+        } else {
+            Err(BadIcon::OsError(io::Error::last_os_error()))
+        }
+    }
+}
+
+#[derive(Debug)]
+pub enum IconType {
+    Small = ICON_SMALL as isize,
+    Big = ICON_BIG as isize,
+}
+
+#[derive(Debug)]
+struct RaiiIcon {
+    handle: HICON,
+}
+
+#[derive(Clone)]
+pub struct WinIcon {
+    inner: Arc<RaiiIcon>,
+}
+
+unsafe impl Send for WinIcon {}
+
+impl WinIcon {
+    pub fn as_raw_handle(&self) -> HICON {
+        self.inner.handle
+    }
+
+    pub fn from_path<P: AsRef<Path>>(
+        path: P,
+        size: Option<PhysicalSize<u32>>,
+    ) -> Result<Self, BadIcon> {
+        // width / height of 0 along with LR_DEFAULTSIZE tells windows to load the default icon size
+        let (width, height) = size.map(Into::into).unwrap_or((0, 0));
+
+        let wide_path = util::encode_wide(path.as_ref());
+
+        let handle = unsafe {
+            LoadImageW(
+                0,
+                wide_path.as_ptr(),
+                IMAGE_ICON,
+                width,
+                height,
+                LR_DEFAULTSIZE | LR_LOADFROMFILE,
+            )
+        };
+        if handle != 0 {
+            Ok(WinIcon::from_handle(handle as HICON))
+        } else {
+            Err(BadIcon::OsError(io::Error::last_os_error()))
+        }
+    }
+
+    pub fn from_resource(
+        resource_id: u16,
+        size: Option<PhysicalSize<u32>>,
+    ) -> Result<Self, BadIcon> {
+        Self::from_resource_ptr(resource_id as PCWSTR, size)
+    }
+
+    pub fn from_resource_name(
+        resource_name: &str,
+        size: Option<PhysicalSize<u32>>,
+    ) -> Result<Self, BadIcon> {
+        let wide_name = util::encode_wide(resource_name);
+        Self::from_resource_ptr(wide_name.as_ptr(), size)
+    }
+
+    fn from_resource_ptr(
+        resource: PCWSTR,
+        size: Option<PhysicalSize<u32>>,
+    ) -> Result<Self, BadIcon> {
+        // width / height of 0 along with LR_DEFAULTSIZE tells windows to load the default icon size
+        let (width, height) = size.map(Into::into).unwrap_or((0, 0));
+        let handle = unsafe {
+            LoadImageW(
+                util::get_instance_handle(),
+                resource,
+                IMAGE_ICON,
+                width,
+                height,
+                LR_DEFAULTSIZE,
+            )
+        };
+        if handle != 0 {
+            Ok(WinIcon::from_handle(handle as HICON))
+        } else {
+            Err(BadIcon::OsError(io::Error::last_os_error()))
+        }
+    }
+
+    pub fn from_rgba(rgba: Vec<u8>, width: u32, height: u32) -> Result<Self, BadIcon> {
+        let rgba_icon = RgbaIcon::from_rgba(rgba, width, height)?;
+        rgba_icon.into_windows_icon()
+    }
+
+    pub fn set_for_window(&self, hwnd: HWND, icon_type: IconType) {
+        unsafe {
+            SendMessageW(hwnd, WM_SETICON, icon_type as usize, self.as_raw_handle());
+        }
+    }
+
+    fn from_handle(handle: HICON) -> Self {
+        Self { inner: Arc::new(RaiiIcon { handle }) }
+    }
+}
+
+impl Drop for RaiiIcon {
+    fn drop(&mut self) {
+        unsafe { DestroyIcon(self.handle) };
+    }
+}
+
+impl fmt::Debug for WinIcon {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        (*self.inner).fmt(formatter)
+    }
+}
+
+pub fn unset_for_window(hwnd: HWND, icon_type: IconType) {
+    unsafe {
+        SendMessageW(hwnd, WM_SETICON, icon_type as usize, 0);
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum SelectedCursor {
+    Named(CursorIcon),
+    Custom(Arc<RaiiCursor>),
+}
+
+impl Default for SelectedCursor {
+    fn default() -> Self {
+        Self::Named(Default::default())
+    }
+}
+
+#[derive(Clone, Debug, Hash, Eq, PartialEq)]
+pub enum WinCursor {
+    Cursor(Arc<RaiiCursor>),
+    Failed,
+}
+
+impl WinCursor {
+    pub(crate) fn new(image: &CursorImage) -> Result<Self, io::Error> {
+        let mut bgra = image.rgba.clone();
+        bgra.chunks_exact_mut(4).for_each(|chunk| chunk.swap(0, 2));
+
+        let w = image.width as i32;
+        let h = image.height as i32;
+
+        unsafe {
+            let hdc_screen = GetDC(0);
+            if hdc_screen == 0 {
+                return Err(io::Error::last_os_error());
+            }
+            let hbm_color = CreateCompatibleBitmap(hdc_screen, w, h);
+            ReleaseDC(0, hdc_screen);
+            if hbm_color == 0 {
+                return Err(io::Error::last_os_error());
+            }
+            if SetBitmapBits(hbm_color, bgra.len() as u32, bgra.as_ptr() as *const c_void) == 0 {
+                DeleteObject(hbm_color);
+                return Err(io::Error::last_os_error());
+            };
+
+            // Mask created according to https://learn.microsoft.com/en-us/windows/win32/api/wingdi/nf-wingdi-createbitmap#parameters
+            let mask_bits: Vec<u8> = vec![0xff; ((((w + 15) >> 4) << 1) * h) as usize];
+            let hbm_mask = CreateBitmap(w, h, 1, 1, mask_bits.as_ptr() as *const _);
+            if hbm_mask == 0 {
+                DeleteObject(hbm_color);
+                return Err(io::Error::last_os_error());
+            }
+
+            let icon_info = ICONINFO {
+                fIcon: 0,
+                xHotspot: image.hotspot_x as u32,
+                yHotspot: image.hotspot_y as u32,
+                hbmMask: hbm_mask,
+                hbmColor: hbm_color,
+            };
+
+            let handle = CreateIconIndirect(&icon_info as *const _);
+            DeleteObject(hbm_color);
+            DeleteObject(hbm_mask);
+            if handle == 0 {
+                return Err(io::Error::last_os_error());
+            }
+
+            Ok(Self::Cursor(Arc::new(RaiiCursor { handle })))
+        }
+    }
+}
+
+#[derive(Debug, Hash, Eq, PartialEq)]
+pub struct RaiiCursor {
+    handle: HCURSOR,
+}
+
+impl Drop for RaiiCursor {
+    fn drop(&mut self) {
+        unsafe { DestroyCursor(self.handle) };
+    }
+}
+
+impl RaiiCursor {
+    pub fn as_raw_handle(&self) -> HICON {
+        self.handle
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/ime.rs b/vendor/winit/src/platform_impl/windows/ime.rs
new file mode 100644
index 00000000..eb65abf3
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/ime.rs
@@ -0,0 +1,162 @@
+use std::ffi::{c_void, OsString};
+use std::os::windows::prelude::OsStringExt;
+use std::ptr::null_mut;
+
+use windows_sys::Win32::Foundation::{POINT, RECT};
+use windows_sys::Win32::Globalization::HIMC;
+use windows_sys::Win32::UI::Input::Ime::{
+    ImmAssociateContextEx, ImmGetCompositionStringW, ImmGetContext, ImmReleaseContext,
+    ImmSetCandidateWindow, ImmSetCompositionWindow, ATTR_TARGET_CONVERTED,
+    ATTR_TARGET_NOTCONVERTED, CANDIDATEFORM, CFS_EXCLUDE, CFS_POINT, COMPOSITIONFORM, GCS_COMPATTR,
+    GCS_COMPSTR, GCS_CURSORPOS, GCS_RESULTSTR, IACE_CHILDREN, IACE_DEFAULT,
+};
+use windows_sys::Win32::UI::WindowsAndMessaging::{GetSystemMetrics, SM_IMMENABLED};
+
+use crate::dpi::{Position, Size};
+use crate::platform::windows::HWND;
+
+pub struct ImeContext {
+    hwnd: HWND,
+    himc: HIMC,
+}
+
+impl ImeContext {
+    pub unsafe fn current(hwnd: HWND) -> Self {
+        let himc = unsafe { ImmGetContext(hwnd) };
+        ImeContext { hwnd, himc }
+    }
+
+    pub unsafe fn get_composing_text_and_cursor(
+        &self,
+    ) -> Option<(String, Option<usize>, Option<usize>)> {
+        let text = unsafe { self.get_composition_string(GCS_COMPSTR) }?;
+        let attrs = unsafe { self.get_composition_data(GCS_COMPATTR) }.unwrap_or_default();
+
+        let mut first = None;
+        let mut last = None;
+        let mut boundary_before_char = 0;
+        let mut attr_idx = 0;
+
+        for chr in text.chars() {
+            let Some(attr) = attrs.get(attr_idx).copied() else {
+                break;
+            };
+
+            let char_is_targeted =
+                attr as u32 == ATTR_TARGET_CONVERTED || attr as u32 == ATTR_TARGET_NOTCONVERTED;
+
+            if first.is_none() && char_is_targeted {
+                first = Some(boundary_before_char);
+            } else if first.is_some() && last.is_none() && !char_is_targeted {
+                last = Some(boundary_before_char);
+            }
+
+            boundary_before_char += chr.len_utf8();
+            attr_idx += chr.len_utf16();
+        }
+
+        if first.is_some() && last.is_none() {
+            last = Some(text.len());
+        } else if first.is_none() {
+            // IME haven't split words and select any clause yet, so trying to retrieve normal
+            // cursor.
+            let cursor = unsafe { self.get_composition_cursor(&text) };
+            first = cursor;
+            last = cursor;
+        }
+
+        Some((text, first, last))
+    }
+
+    pub unsafe fn get_composed_text(&self) -> Option<String> {
+        unsafe { self.get_composition_string(GCS_RESULTSTR) }
+    }
+
+    unsafe fn get_composition_cursor(&self, text: &str) -> Option<usize> {
+        let cursor = unsafe { ImmGetCompositionStringW(self.himc, GCS_CURSORPOS, null_mut(), 0) };
+        (cursor >= 0).then(|| text.chars().take(cursor as _).map(|c| c.len_utf8()).sum())
+    }
+
+    unsafe fn get_composition_string(&self, gcs_mode: u32) -> Option<String> {
+        let data = unsafe { self.get_composition_data(gcs_mode) }?;
+        let (prefix, shorts, suffix) = unsafe { data.align_to::<u16>() };
+        if prefix.is_empty() && suffix.is_empty() {
+            OsString::from_wide(shorts).into_string().ok()
+        } else {
+            None
+        }
+    }
+
+    unsafe fn get_composition_data(&self, gcs_mode: u32) -> Option<Vec<u8>> {
+        let size = match unsafe { ImmGetCompositionStringW(self.himc, gcs_mode, null_mut(), 0) } {
+            0 => return Some(Vec::new()),
+            size if size < 0 => return None,
+            size => size,
+        };
+
+        let mut buf = Vec::<u8>::with_capacity(size as _);
+        let size = unsafe {
+            ImmGetCompositionStringW(
+                self.himc,
+                gcs_mode,
+                buf.as_mut_ptr() as *mut c_void,
+                size as _,
+            )
+        };
+
+        if size < 0 {
+            None
+        } else {
+            unsafe { buf.set_len(size as _) };
+            Some(buf)
+        }
+    }
+
+    pub unsafe fn set_ime_cursor_area(&self, spot: Position, size: Size, scale_factor: f64) {
+        if !unsafe { ImeContext::system_has_ime() } {
+            return;
+        }
+
+        let (x, y) = spot.to_physical::<i32>(scale_factor).into();
+        let (width, height): (i32, i32) = size.to_physical::<i32>(scale_factor).into();
+        let rc_area = RECT { left: x, top: y, right: x + width, bottom: y + height };
+        let candidate_form = CANDIDATEFORM {
+            dwIndex: 0,
+            dwStyle: CFS_EXCLUDE,
+            ptCurrentPos: POINT { x, y },
+            rcArea: rc_area,
+        };
+        let composition_form = COMPOSITIONFORM {
+            dwStyle: CFS_POINT,
+            ptCurrentPos: POINT { x, y: y + height },
+            rcArea: rc_area,
+        };
+
+        unsafe {
+            ImmSetCompositionWindow(self.himc, &composition_form);
+            ImmSetCandidateWindow(self.himc, &candidate_form);
+        }
+    }
+
+    pub unsafe fn set_ime_allowed(hwnd: HWND, allowed: bool) {
+        if !unsafe { ImeContext::system_has_ime() } {
+            return;
+        }
+
+        if allowed {
+            unsafe { ImmAssociateContextEx(hwnd, 0, IACE_DEFAULT) };
+        } else {
+            unsafe { ImmAssociateContextEx(hwnd, 0, IACE_CHILDREN) };
+        }
+    }
+
+    unsafe fn system_has_ime() -> bool {
+        unsafe { GetSystemMetrics(SM_IMMENABLED) != 0 }
+    }
+}
+
+impl Drop for ImeContext {
+    fn drop(&mut self) {
+        unsafe { ImmReleaseContext(self.hwnd, self.himc) };
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/keyboard.rs b/vendor/winit/src/platform_impl/windows/keyboard.rs
new file mode 100644
index 00000000..9c109490
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/keyboard.rs
@@ -0,0 +1,1243 @@
+use std::char;
+use std::ffi::OsString;
+use std::mem::MaybeUninit;
+use std::os::windows::ffi::OsStringExt;
+use std::sync::atomic::AtomicU32;
+use std::sync::atomic::Ordering::Relaxed;
+use std::sync::{Mutex, MutexGuard};
+
+use windows_sys::Win32::Foundation::{HWND, LPARAM, WPARAM};
+use windows_sys::Win32::System::SystemServices::LANG_KOREAN;
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::{
+    GetAsyncKeyState, GetKeyState, GetKeyboardLayout, GetKeyboardState, MapVirtualKeyExW,
+    MAPVK_VK_TO_VSC_EX, MAPVK_VSC_TO_VK_EX, VIRTUAL_KEY, VK_ABNT_C2, VK_ADD, VK_CAPITAL, VK_CLEAR,
+    VK_CONTROL, VK_DECIMAL, VK_DELETE, VK_DIVIDE, VK_DOWN, VK_END, VK_F4, VK_HOME, VK_INSERT,
+    VK_LCONTROL, VK_LEFT, VK_LMENU, VK_LSHIFT, VK_LWIN, VK_MENU, VK_MULTIPLY, VK_NEXT, VK_NUMLOCK,
+    VK_NUMPAD0, VK_NUMPAD1, VK_NUMPAD2, VK_NUMPAD3, VK_NUMPAD4, VK_NUMPAD5, VK_NUMPAD6, VK_NUMPAD7,
+    VK_NUMPAD8, VK_NUMPAD9, VK_PRIOR, VK_RCONTROL, VK_RETURN, VK_RIGHT, VK_RMENU, VK_RSHIFT,
+    VK_RWIN, VK_SCROLL, VK_SHIFT, VK_SUBTRACT, VK_UP,
+};
+use windows_sys::Win32::UI::TextServices::HKL;
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    PeekMessageW, MSG, PM_NOREMOVE, WM_CHAR, WM_DEADCHAR, WM_KEYDOWN, WM_KEYFIRST, WM_KEYLAST,
+    WM_KEYUP, WM_KILLFOCUS, WM_SETFOCUS, WM_SYSCHAR, WM_SYSDEADCHAR, WM_SYSKEYDOWN, WM_SYSKEYUP,
+};
+
+use smol_str::SmolStr;
+use tracing::{trace, warn};
+use unicode_segmentation::UnicodeSegmentation;
+
+use crate::event::{ElementState, KeyEvent};
+use crate::keyboard::{Key, KeyCode, KeyLocation, NamedKey, NativeKey, NativeKeyCode, PhysicalKey};
+use crate::platform_impl::platform::event_loop::ProcResult;
+use crate::platform_impl::platform::keyboard_layout::{
+    Layout, LayoutCache, WindowsModifiers, LAYOUT_CACHE,
+};
+use crate::platform_impl::platform::{loword, primarylangid, KeyEventExtra};
+
+pub type ExScancode = u16;
+
+pub struct MessageAsKeyEvent {
+    pub event: KeyEvent,
+    pub is_synthetic: bool,
+}
+
+/// Stores information required to make `KeyEvent`s.
+///
+/// A single Winit `KeyEvent` contains information which the Windows API passes to the application
+/// in multiple window messages. In other words: a Winit `KeyEvent` cannot be built from a single
+/// window message. Therefore, this type keeps track of certain information from previous events so
+/// that a `KeyEvent` can be constructed when the last event related to a keypress is received.
+///
+/// `PeekMessage` is sometimes used to determine whether the next window message still belongs to
+/// the current keypress. If it doesn't and the current state represents a key event waiting to be
+/// dispatched, then said event is considered complete and is dispatched.
+///
+/// The sequence of window messages for a key press event is the following:
+/// - Exactly one WM_KEYDOWN / WM_SYSKEYDOWN
+/// - Zero or one WM_DEADCHAR / WM_SYSDEADCHAR
+/// - Zero or more WM_CHAR / WM_SYSCHAR. These messages each come with a UTF-16 code unit which when
+///   put together in the sequence they arrived in, forms the text which is the result of pressing
+///   the key.
+///
+/// Key release messages are a bit different due to the fact that they don't contribute to
+/// text input. The "sequence" only consists of one WM_KEYUP / WM_SYSKEYUP event.
+pub struct KeyEventBuilder {
+    event_info: Mutex<Option<PartialKeyEventInfo>>,
+    pending: PendingEventQueue<MessageAsKeyEvent>,
+}
+impl Default for KeyEventBuilder {
+    fn default() -> Self {
+        KeyEventBuilder { event_info: Mutex::new(None), pending: Default::default() }
+    }
+}
+impl KeyEventBuilder {
+    /// Call this function for every window message.
+    /// Returns Some() if this window message completes a KeyEvent.
+    /// Returns None otherwise.
+    pub(crate) fn process_message(
+        &self,
+        hwnd: HWND,
+        msg_kind: u32,
+        wparam: WPARAM,
+        lparam: LPARAM,
+        result: &mut ProcResult,
+    ) -> Vec<MessageAsKeyEvent> {
+        enum MatchResult {
+            Nothing,
+            TokenToRemove(PendingMessageToken),
+            MessagesToDispatch(Vec<MessageAsKeyEvent>),
+        }
+
+        let mut matcher = || -> MatchResult {
+            match msg_kind {
+                WM_SETFOCUS => {
+                    // synthesize keydown events
+                    let kbd_state = get_async_kbd_state();
+                    let key_events = Self::synthesize_kbd_state(ElementState::Pressed, &kbd_state);
+                    MatchResult::MessagesToDispatch(self.pending.complete_multi(key_events))
+                },
+                WM_KILLFOCUS => {
+                    // synthesize keyup events
+                    let kbd_state = get_kbd_state();
+                    let key_events = Self::synthesize_kbd_state(ElementState::Released, &kbd_state);
+                    MatchResult::MessagesToDispatch(self.pending.complete_multi(key_events))
+                },
+                WM_KEYDOWN | WM_SYSKEYDOWN => {
+                    if msg_kind == WM_SYSKEYDOWN && wparam as VIRTUAL_KEY == VK_F4 {
+                        // Don't dispatch Alt+F4 to the application.
+                        // This is handled in `event_loop.rs`
+                        return MatchResult::Nothing;
+                    }
+                    let pending_token = self.pending.add_pending();
+                    *result = ProcResult::Value(0);
+
+                    let next_msg = next_kbd_msg(hwnd);
+
+                    let mut layouts = LAYOUT_CACHE.lock().unwrap();
+                    let mut finished_event_info = Some(PartialKeyEventInfo::from_message(
+                        wparam,
+                        lparam,
+                        ElementState::Pressed,
+                        &mut layouts,
+                    ));
+                    let mut event_info = self.event_info.lock().unwrap();
+                    *event_info = None;
+                    if let Some(next_msg) = next_msg {
+                        let next_msg_kind = next_msg.message;
+                        let next_belongs_to_this = !matches!(
+                            next_msg_kind,
+                            WM_KEYDOWN | WM_SYSKEYDOWN | WM_KEYUP | WM_SYSKEYUP
+                        );
+                        if next_belongs_to_this {
+                            // The next OS event belongs to this Winit event, so let's just
+                            // store the partial information, and add to it in the upcoming events
+                            *event_info = finished_event_info.take();
+                        } else {
+                            let (_, layout) = layouts.get_current_layout();
+                            let is_fake = {
+                                let curr_event = finished_event_info.as_ref().unwrap();
+                                is_current_fake(curr_event, next_msg, layout)
+                            };
+                            if is_fake {
+                                finished_event_info = None;
+                            }
+                        }
+                    }
+                    if let Some(event_info) = finished_event_info {
+                        let ev = event_info.finalize();
+                        return MatchResult::MessagesToDispatch(self.pending.complete_pending(
+                            pending_token,
+                            MessageAsKeyEvent { event: ev, is_synthetic: false },
+                        ));
+                    }
+                    MatchResult::TokenToRemove(pending_token)
+                },
+                WM_DEADCHAR | WM_SYSDEADCHAR => {
+                    let pending_token = self.pending.add_pending();
+                    *result = ProcResult::Value(0);
+                    // At this point, we know that there isn't going to be any more events related
+                    // to this key press
+                    let event_info = self.event_info.lock().unwrap().take().unwrap();
+                    let ev = event_info.finalize();
+                    MatchResult::MessagesToDispatch(self.pending.complete_pending(
+                        pending_token,
+                        MessageAsKeyEvent { event: ev, is_synthetic: false },
+                    ))
+                },
+                WM_CHAR | WM_SYSCHAR => {
+                    let mut event_info = self.event_info.lock().unwrap();
+                    if event_info.is_none() {
+                        trace!(
+                            "Received a CHAR message but no `event_info` was available. The \
+                             message is probably IME, returning."
+                        );
+                        return MatchResult::Nothing;
+                    }
+                    let pending_token = self.pending.add_pending();
+                    *result = ProcResult::Value(0);
+                    let is_high_surrogate = (0xd800..=0xdbff).contains(&wparam);
+                    let is_low_surrogate = (0xdc00..=0xdfff).contains(&wparam);
+
+                    let is_utf16 = is_high_surrogate || is_low_surrogate;
+
+                    if is_utf16 {
+                        if let Some(ev_info) = event_info.as_mut() {
+                            ev_info.utf16parts.push(wparam as u16);
+                        }
+                    } else {
+                        // In this case, wparam holds a UTF-32 character.
+                        // Let's encode it as UTF-16 and append it to the end of `utf16parts`
+                        let utf16parts = match event_info.as_mut() {
+                            Some(ev_info) => &mut ev_info.utf16parts,
+                            None => {
+                                warn!("The event_info was None when it was expected to be some");
+                                return MatchResult::TokenToRemove(pending_token);
+                            },
+                        };
+                        let start_offset = utf16parts.len();
+                        let new_size = utf16parts.len() + 2;
+                        utf16parts.resize(new_size, 0);
+                        if let Some(ch) = char::from_u32(wparam as u32) {
+                            let encode_len = ch.encode_utf16(&mut utf16parts[start_offset..]).len();
+                            let new_size = start_offset + encode_len;
+                            utf16parts.resize(new_size, 0);
+                        }
+                    }
+                    // It's important that we unlock the mutex, and create the pending event token
+                    // before calling `next_msg`
+                    std::mem::drop(event_info);
+                    let next_msg = next_kbd_msg(hwnd);
+                    let more_char_coming = next_msg
+                        .map(|m| matches!(m.message, WM_CHAR | WM_SYSCHAR))
+                        .unwrap_or(false);
+                    if more_char_coming {
+                        // No need to produce an event just yet, because there are still more
+                        // characters that need to be appended to this keyboard event
+                        MatchResult::TokenToRemove(pending_token)
+                    } else {
+                        let mut event_info = self.event_info.lock().unwrap();
+                        let mut event_info = match event_info.take() {
+                            Some(ev_info) => ev_info,
+                            None => {
+                                warn!("The event_info was None when it was expected to be some");
+                                return MatchResult::TokenToRemove(pending_token);
+                            },
+                        };
+                        let mut layouts = LAYOUT_CACHE.lock().unwrap();
+                        // It's okay to call `ToUnicode` here, because at this point the dead key
+                        // is already consumed by the character.
+                        let kbd_state = get_kbd_state();
+                        let mod_state = WindowsModifiers::active_modifiers(&kbd_state);
+
+                        let (_, layout) = layouts.get_current_layout();
+                        let ctrl_on = if layout.has_alt_graph {
+                            let alt_on = mod_state.contains(WindowsModifiers::ALT);
+                            !alt_on && mod_state.contains(WindowsModifiers::CONTROL)
+                        } else {
+                            mod_state.contains(WindowsModifiers::CONTROL)
+                        };
+
+                        // If Ctrl is not pressed, just use the text with all
+                        // modifiers because that already consumed the dead key. Otherwise,
+                        // we would interpret the character incorrectly, missing the dead key.
+                        if !ctrl_on {
+                            event_info.text = PartialText::System(event_info.utf16parts.clone());
+                        } else {
+                            let mod_no_ctrl = mod_state.remove_only_ctrl();
+                            let num_lock_on = kbd_state[VK_NUMLOCK as usize] & 1 != 0;
+                            let vkey = event_info.vkey;
+                            let physical_key = &event_info.physical_key;
+                            let key = layout.get_key(mod_no_ctrl, num_lock_on, vkey, physical_key);
+                            event_info.text = PartialText::Text(key.to_text().map(SmolStr::new));
+                        }
+                        let ev = event_info.finalize();
+                        MatchResult::MessagesToDispatch(self.pending.complete_pending(
+                            pending_token,
+                            MessageAsKeyEvent { event: ev, is_synthetic: false },
+                        ))
+                    }
+                },
+                WM_KEYUP | WM_SYSKEYUP => {
+                    let pending_token = self.pending.add_pending();
+                    *result = ProcResult::Value(0);
+
+                    let mut layouts = LAYOUT_CACHE.lock().unwrap();
+                    let event_info = PartialKeyEventInfo::from_message(
+                        wparam,
+                        lparam,
+                        ElementState::Released,
+                        &mut layouts,
+                    );
+                    // We MUST release the layout lock before calling `next_kbd_msg`, otherwise it
+                    // may deadlock
+                    drop(layouts);
+                    // It's important that we create the pending token before reading the next
+                    // message.
+                    let next_msg = next_kbd_msg(hwnd);
+                    let mut valid_event_info = Some(event_info);
+                    if let Some(next_msg) = next_msg {
+                        let mut layouts = LAYOUT_CACHE.lock().unwrap();
+                        let (_, layout) = layouts.get_current_layout();
+                        let is_fake = {
+                            let event_info = valid_event_info.as_ref().unwrap();
+                            is_current_fake(event_info, next_msg, layout)
+                        };
+                        if is_fake {
+                            valid_event_info = None;
+                        }
+                    }
+                    if let Some(event_info) = valid_event_info {
+                        let event = event_info.finalize();
+                        return MatchResult::MessagesToDispatch(self.pending.complete_pending(
+                            pending_token,
+                            MessageAsKeyEvent { event, is_synthetic: false },
+                        ));
+                    }
+                    MatchResult::TokenToRemove(pending_token)
+                },
+                _ => MatchResult::Nothing,
+            }
+        };
+        let matcher_result = matcher();
+        match matcher_result {
+            MatchResult::TokenToRemove(t) => self.pending.remove_pending(t),
+            MatchResult::MessagesToDispatch(m) => m,
+            MatchResult::Nothing => Vec::new(),
+        }
+    }
+
+    // Allowing nominimal_bool lint because the `is_key_pressed` macro triggers this warning
+    // and I don't know of another way to resolve it and also keeping the macro
+    #[allow(clippy::nonminimal_bool)]
+    fn synthesize_kbd_state(
+        key_state: ElementState,
+        kbd_state: &[u8; 256],
+    ) -> Vec<MessageAsKeyEvent> {
+        let mut key_events = Vec::new();
+
+        let mut layouts = LAYOUT_CACHE.lock().unwrap();
+        let (locale_id, _) = layouts.get_current_layout();
+
+        macro_rules! is_key_pressed {
+            ($vk:expr) => {
+                kbd_state[$vk as usize] & 0x80 != 0
+            };
+        }
+
+        // Is caps-lock active? Note that this is different from caps-lock
+        // being held down.
+        let caps_lock_on = kbd_state[VK_CAPITAL as usize] & 1 != 0;
+        let num_lock_on = kbd_state[VK_NUMLOCK as usize] & 1 != 0;
+
+        // We are synthesizing the press event for caps-lock first for the following reasons:
+        // 1. If caps-lock is *not* held down but *is* active, then we have to synthesize all
+        //    printable keys, respecting the caps-lock state.
+        // 2. If caps-lock is held down, we could choose to synthesize its keypress after every
+        //    other key, in which case all other keys *must* be synthesized as if the caps-lock
+        //    state was be the opposite of what it currently is.
+        // --
+        // For the sake of simplicity we are choosing to always synthesize
+        // caps-lock first, and always use the current caps-lock state
+        // to determine the produced text
+        if is_key_pressed!(VK_CAPITAL) {
+            let event = Self::create_synthetic(
+                VK_CAPITAL,
+                key_state,
+                caps_lock_on,
+                num_lock_on,
+                locale_id as HKL,
+                &mut layouts,
+            );
+            if let Some(event) = event {
+                key_events.push(event);
+            }
+        }
+        let do_non_modifier = |key_events: &mut Vec<_>, layouts: &mut _| {
+            for vk in 0..256 {
+                match vk {
+                    VK_CONTROL | VK_LCONTROL | VK_RCONTROL | VK_SHIFT | VK_LSHIFT | VK_RSHIFT
+                    | VK_MENU | VK_LMENU | VK_RMENU | VK_CAPITAL => continue,
+                    _ => (),
+                }
+                if !is_key_pressed!(vk) {
+                    continue;
+                }
+                let event = Self::create_synthetic(
+                    vk,
+                    key_state,
+                    caps_lock_on,
+                    num_lock_on,
+                    locale_id as HKL,
+                    layouts,
+                );
+                if let Some(event) = event {
+                    key_events.push(event);
+                }
+            }
+        };
+        let do_modifier = |key_events: &mut Vec<_>, layouts: &mut _| {
+            const CLEAR_MODIFIER_VKS: [VIRTUAL_KEY; 6] =
+                [VK_LCONTROL, VK_LSHIFT, VK_LMENU, VK_RCONTROL, VK_RSHIFT, VK_RMENU];
+            for vk in CLEAR_MODIFIER_VKS.iter() {
+                if is_key_pressed!(*vk) {
+                    let event = Self::create_synthetic(
+                        *vk,
+                        key_state,
+                        caps_lock_on,
+                        num_lock_on,
+                        locale_id as HKL,
+                        layouts,
+                    );
+                    if let Some(event) = event {
+                        key_events.push(event);
+                    }
+                }
+            }
+        };
+
+        // Be cheeky and sequence modifier and non-modifier
+        // key events such that non-modifier keys are not affected
+        // by modifiers (except for caps-lock)
+        match key_state {
+            ElementState::Pressed => {
+                do_non_modifier(&mut key_events, &mut layouts);
+                do_modifier(&mut key_events, &mut layouts);
+            },
+            ElementState::Released => {
+                do_modifier(&mut key_events, &mut layouts);
+                do_non_modifier(&mut key_events, &mut layouts);
+            },
+        }
+
+        key_events
+    }
+
+    fn create_synthetic(
+        vk: VIRTUAL_KEY,
+        key_state: ElementState,
+        caps_lock_on: bool,
+        num_lock_on: bool,
+        locale_id: HKL,
+        layouts: &mut MutexGuard<'_, LayoutCache>,
+    ) -> Option<MessageAsKeyEvent> {
+        let scancode = unsafe { MapVirtualKeyExW(vk as u32, MAPVK_VK_TO_VSC_EX, locale_id) };
+        if scancode == 0 {
+            return None;
+        }
+        let scancode = scancode as ExScancode;
+        let physical_key = scancode_to_physicalkey(scancode as u32);
+        let mods =
+            if caps_lock_on { WindowsModifiers::CAPS_LOCK } else { WindowsModifiers::empty() };
+        let layout = layouts.layouts.get(&(locale_id as u64)).unwrap();
+        let logical_key = layout.get_key(mods, num_lock_on, vk, &physical_key);
+        let key_without_modifiers =
+            layout.get_key(WindowsModifiers::empty(), false, vk, &physical_key);
+        let text = if key_state == ElementState::Pressed {
+            logical_key.to_text().map(SmolStr::new)
+        } else {
+            None
+        };
+        let event_info = PartialKeyEventInfo {
+            vkey: vk,
+            logical_key: PartialLogicalKey::This(logical_key.clone()),
+            key_without_modifiers,
+            key_state,
+            is_repeat: false,
+            physical_key,
+            location: get_location(scancode, locale_id),
+            utf16parts: Vec::with_capacity(8),
+            text: PartialText::Text(text.clone()),
+        };
+
+        let mut event = event_info.finalize();
+        event.logical_key = logical_key;
+        event.platform_specific.text_with_all_modifiers = text;
+        Some(MessageAsKeyEvent { event, is_synthetic: true })
+    }
+}
+
+enum PartialText {
+    // Unicode
+    System(Vec<u16>),
+    Text(Option<SmolStr>),
+}
+
+enum PartialLogicalKey {
+    /// Use the text provided by the WM_CHAR messages and report that as a `Character` variant. If
+    /// the text consists of multiple grapheme clusters (user-perceived characters) that means that
+    /// dead key could not be combined with the second input, and in that case we should fall back
+    /// to using what would have without a dead-key input.
+    TextOr(Key),
+
+    /// Use the value directly provided by this variant
+    This(Key),
+}
+
+struct PartialKeyEventInfo {
+    vkey: VIRTUAL_KEY,
+    key_state: ElementState,
+    is_repeat: bool,
+    physical_key: PhysicalKey,
+    location: KeyLocation,
+    logical_key: PartialLogicalKey,
+
+    key_without_modifiers: Key,
+
+    /// The UTF-16 code units of the text that was produced by the keypress event.
+    /// This take all modifiers into account. Including CTRL
+    utf16parts: Vec<u16>,
+
+    text: PartialText,
+}
+
+impl PartialKeyEventInfo {
+    fn from_message(
+        wparam: WPARAM,
+        lparam: LPARAM,
+        state: ElementState,
+        layouts: &mut MutexGuard<'_, LayoutCache>,
+    ) -> Self {
+        const NO_MODS: WindowsModifiers = WindowsModifiers::empty();
+
+        let (_, layout) = layouts.get_current_layout();
+        let lparam_struct = destructure_key_lparam(lparam);
+        let vkey = wparam as VIRTUAL_KEY;
+        let scancode = if lparam_struct.scancode == 0 {
+            // In some cases (often with media keys) the device reports a scancode of 0 but a
+            // valid virtual key. In these cases we obtain the scancode from the virtual key.
+            unsafe { MapVirtualKeyExW(vkey as u32, MAPVK_VK_TO_VSC_EX, layout.hkl as HKL) as u16 }
+        } else {
+            new_ex_scancode(lparam_struct.scancode, lparam_struct.extended)
+        };
+        let physical_key = scancode_to_physicalkey(scancode as u32);
+        let location = get_location(scancode, layout.hkl as HKL);
+
+        let kbd_state = get_kbd_state();
+        let mods = WindowsModifiers::active_modifiers(&kbd_state);
+        let mods_without_ctrl = mods.remove_only_ctrl();
+        let num_lock_on = kbd_state[VK_NUMLOCK as usize] & 1 != 0;
+
+        // On Windows Ctrl+NumLock = Pause (and apparently Ctrl+Pause -> NumLock). In these cases
+        // the KeyCode still stores the real key, so in the name of consistency across platforms, we
+        // circumvent this mapping and force the key values to match the keycode.
+        // For more on this, read the article by Raymond Chen, titled:
+        // "Why does Ctrl+ScrollLock cancel dialogs?"
+        // https://devblogs.microsoft.com/oldnewthing/20080211-00/?p=23503
+        let code_as_key = if mods.contains(WindowsModifiers::CONTROL) {
+            match physical_key {
+                PhysicalKey::Code(KeyCode::NumLock) => Some(Key::Named(NamedKey::NumLock)),
+                PhysicalKey::Code(KeyCode::Pause) => Some(Key::Named(NamedKey::Pause)),
+                _ => None,
+            }
+        } else {
+            None
+        };
+
+        let preliminary_logical_key =
+            layout.get_key(mods_without_ctrl, num_lock_on, vkey, &physical_key);
+        let key_is_char = matches!(preliminary_logical_key, Key::Character(_));
+        let is_pressed = state == ElementState::Pressed;
+
+        let logical_key = if let Some(key) = code_as_key.clone() {
+            PartialLogicalKey::This(key)
+        } else if is_pressed && key_is_char && !mods.contains(WindowsModifiers::CONTROL) {
+            // In some cases we want to use the UNICHAR text for logical_key in order to allow
+            // dead keys to have an effect on the character reported by `logical_key`.
+            PartialLogicalKey::TextOr(preliminary_logical_key)
+        } else {
+            PartialLogicalKey::This(preliminary_logical_key)
+        };
+        let key_without_modifiers = if let Some(key) = code_as_key {
+            key
+        } else {
+            match layout.get_key(NO_MODS, false, vkey, &physical_key) {
+                // We convert dead keys into their character.
+                // The reason for this is that `key_without_modifiers` is designed for key-bindings,
+                // but the US International layout treats `'` (apostrophe) as a dead key and the
+                // regular US layout treats it a character. In order for a single binding
+                // configuration to work with both layouts, we forward each dead key as a character.
+                Key::Dead(k) => {
+                    if let Some(ch) = k {
+                        // I'm avoiding the heap allocation. I don't want to talk about it :(
+                        let mut utf8 = [0; 4];
+                        let s = ch.encode_utf8(&mut utf8);
+                        Key::Character(SmolStr::new(s))
+                    } else {
+                        Key::Unidentified(NativeKey::Unidentified)
+                    }
+                },
+                key => key,
+            }
+        };
+
+        PartialKeyEventInfo {
+            vkey,
+            key_state: state,
+            logical_key,
+            key_without_modifiers,
+            is_repeat: lparam_struct.is_repeat,
+            physical_key,
+            location,
+            utf16parts: Vec::with_capacity(8),
+            text: PartialText::System(Vec::new()),
+        }
+    }
+
+    fn finalize(self) -> KeyEvent {
+        let mut char_with_all_modifiers = None;
+        if !self.utf16parts.is_empty() {
+            let os_string = OsString::from_wide(&self.utf16parts);
+            if let Ok(string) = os_string.into_string() {
+                char_with_all_modifiers = Some(SmolStr::new(string));
+            }
+        }
+
+        // The text without Ctrl
+        let mut text = None;
+        match self.text {
+            PartialText::System(wide) => {
+                if !wide.is_empty() {
+                    let os_string = OsString::from_wide(&wide);
+                    if let Ok(string) = os_string.into_string() {
+                        text = Some(SmolStr::new(string));
+                    }
+                }
+            },
+            PartialText::Text(s) => {
+                text = s.map(SmolStr::new);
+            },
+        }
+
+        let logical_key = match self.logical_key {
+            PartialLogicalKey::TextOr(fallback) => match text.as_ref() {
+                Some(s) => {
+                    if s.grapheme_indices(true).count() > 1 {
+                        fallback
+                    } else {
+                        Key::Character(s.clone())
+                    }
+                },
+                None => Key::Unidentified(NativeKey::Windows(self.vkey)),
+            },
+            PartialLogicalKey::This(v) => v,
+        };
+
+        KeyEvent {
+            physical_key: self.physical_key,
+            logical_key,
+            text,
+            location: self.location,
+            state: self.key_state,
+            repeat: self.is_repeat,
+            platform_specific: KeyEventExtra {
+                text_with_all_modifiers: char_with_all_modifiers,
+                key_without_modifiers: self.key_without_modifiers,
+            },
+        }
+    }
+}
+
+#[derive(Debug, Copy, Clone)]
+struct KeyLParam {
+    pub scancode: u8,
+    pub extended: bool,
+
+    /// This is `previous_state XOR transition_state`. See the lParam for WM_KEYDOWN and WM_KEYUP
+    /// for further details.
+    pub is_repeat: bool,
+}
+
+fn destructure_key_lparam(lparam: LPARAM) -> KeyLParam {
+    let previous_state = (lparam >> 30) & 0x01;
+    let transition_state = (lparam >> 31) & 0x01;
+    KeyLParam {
+        scancode: ((lparam >> 16) & 0xff) as u8,
+        extended: ((lparam >> 24) & 0x01) != 0,
+        is_repeat: (previous_state ^ transition_state) != 0,
+    }
+}
+
+#[inline]
+fn new_ex_scancode(scancode: u8, extended: bool) -> ExScancode {
+    (scancode as u16) | (if extended { 0xe000 } else { 0 })
+}
+
+#[inline]
+fn ex_scancode_from_lparam(lparam: LPARAM) -> ExScancode {
+    let lparam = destructure_key_lparam(lparam);
+    new_ex_scancode(lparam.scancode, lparam.extended)
+}
+
+/// Gets the keyboard state as reported by messages that have been removed from the event queue.
+/// See also: get_async_kbd_state
+fn get_kbd_state() -> [u8; 256] {
+    unsafe {
+        let mut kbd_state: MaybeUninit<[u8; 256]> = MaybeUninit::uninit();
+        GetKeyboardState(kbd_state.as_mut_ptr() as *mut u8);
+        kbd_state.assume_init()
+    }
+}
+
+/// Gets the current keyboard state regardless of whether the corresponding keyboard events have
+/// been removed from the event queue. See also: get_kbd_state
+#[allow(clippy::uninit_assumed_init)]
+fn get_async_kbd_state() -> [u8; 256] {
+    unsafe {
+        let mut kbd_state: [u8; 256] = [0; 256];
+        for (vk, state) in kbd_state.iter_mut().enumerate() {
+            let vk = vk as VIRTUAL_KEY;
+            let async_state = GetAsyncKeyState(vk as i32);
+            let is_down = (async_state & (1 << 15)) != 0;
+            *state = if is_down { 0x80 } else { 0 };
+
+            if matches!(vk, VK_CAPITAL | VK_NUMLOCK | VK_SCROLL) {
+                // Toggle states aren't reported by `GetAsyncKeyState`
+                let toggle_state = GetKeyState(vk as i32);
+                let is_active = (toggle_state & 1) != 0;
+                *state |= u8::from(is_active);
+            }
+        }
+        kbd_state
+    }
+}
+
+/// On windows, AltGr == Ctrl + Alt
+///
+/// Due to this equivalence, the system generates a fake Ctrl key-press (and key-release) preceding
+/// every AltGr key-press (and key-release). We check if the current event is a Ctrl event and if
+/// the next event is a right Alt (AltGr) event. If this is the case, the current event must be the
+/// fake Ctrl event.
+fn is_current_fake(curr_info: &PartialKeyEventInfo, next_msg: MSG, layout: &Layout) -> bool {
+    let curr_is_ctrl =
+        matches!(curr_info.logical_key, PartialLogicalKey::This(Key::Named(NamedKey::Control)));
+    if layout.has_alt_graph {
+        let next_code = ex_scancode_from_lparam(next_msg.lParam);
+        let next_is_altgr = next_code == 0xe038; // 0xE038 is right alt
+        if curr_is_ctrl && next_is_altgr {
+            return true;
+        }
+    }
+    false
+}
+
+enum PendingMessage<T> {
+    Incomplete,
+    Complete(T),
+}
+struct IdentifiedPendingMessage<T> {
+    token: PendingMessageToken,
+    msg: PendingMessage<T>,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct PendingMessageToken(u32);
+
+/// While processing keyboard events, we sometimes need
+/// to call `PeekMessageW` (`next_msg`). But `PeekMessageW`
+/// can also call the event handler, which means that the new event
+/// gets processed before finishing to process the one that came before.
+///
+/// This would mean that the application receives events in the wrong order.
+/// To avoid this, we keep track whether we are in the middle of processing
+/// an event. Such an event is an "incomplete pending event". A
+/// "complete pending event" is one that has already finished processing, but
+/// hasn't been dispatched to the application because there still are incomplete
+/// pending events that came before it.
+///
+/// When we finish processing an event, we call `complete_pending`,
+/// which returns an empty array if there are incomplete pending events, but
+/// if all pending events are complete, then it returns all pending events in
+/// the order they were encountered. These can then be dispatched to the application
+pub struct PendingEventQueue<T> {
+    pending: Mutex<Vec<IdentifiedPendingMessage<T>>>,
+    next_id: AtomicU32,
+}
+impl<T> PendingEventQueue<T> {
+    /// Add a new pending event to the "pending queue"
+    pub fn add_pending(&self) -> PendingMessageToken {
+        let token = self.next_token();
+        let mut pending = self.pending.lock().unwrap();
+        pending.push(IdentifiedPendingMessage { token, msg: PendingMessage::Incomplete });
+        token
+    }
+
+    /// Returns all finished pending events
+    ///
+    /// If the return value is non empty, it's guaranteed to contain `msg`
+    ///
+    /// See also: `add_pending`
+    pub fn complete_pending(&self, token: PendingMessageToken, msg: T) -> Vec<T> {
+        let mut pending = self.pending.lock().unwrap();
+        let mut target_is_first = false;
+        for (i, pending_msg) in pending.iter_mut().enumerate() {
+            if pending_msg.token == token {
+                pending_msg.msg = PendingMessage::Complete(msg);
+                if i == 0 {
+                    target_is_first = true;
+                }
+                break;
+            }
+        }
+        if target_is_first {
+            // If the message that we just finished was the first one in the pending queue,
+            // then we can empty the queue, and dispatch all of the messages.
+            Self::drain_pending(&mut *pending)
+        } else {
+            Vec::new()
+        }
+    }
+
+    pub fn complete_multi(&self, msgs: Vec<T>) -> Vec<T> {
+        let mut pending = self.pending.lock().unwrap();
+        if pending.is_empty() {
+            return msgs;
+        }
+        pending.reserve(msgs.len());
+        for msg in msgs {
+            pending.push(IdentifiedPendingMessage {
+                token: self.next_token(),
+                msg: PendingMessage::Complete(msg),
+            });
+        }
+        Vec::new()
+    }
+
+    /// Returns all finished pending events
+    ///
+    /// It's safe to call this even if the element isn't in the list anymore
+    ///
+    /// See also: `add_pending`
+    pub fn remove_pending(&self, token: PendingMessageToken) -> Vec<T> {
+        let mut pending = self.pending.lock().unwrap();
+        let mut was_first = false;
+        if let Some(m) = pending.first() {
+            if m.token == token {
+                was_first = true;
+            }
+        }
+        pending.retain(|m| m.token != token);
+        if was_first {
+            Self::drain_pending(&mut *pending)
+        } else {
+            Vec::new()
+        }
+    }
+
+    fn drain_pending(pending: &mut Vec<IdentifiedPendingMessage<T>>) -> Vec<T> {
+        pending
+            .drain(..)
+            .map(|m| match m.msg {
+                PendingMessage::Complete(msg) => msg,
+                PendingMessage::Incomplete => {
+                    panic!(
+                        "Found an incomplete pending message when collecting messages. This \
+                         indicates a bug in winit."
+                    )
+                },
+            })
+            .collect()
+    }
+
+    fn next_token(&self) -> PendingMessageToken {
+        // It's okay for the u32 to overflow here. Yes, that could mean
+        // that two different messages have the same token,
+        // but that would only happen after having about 4 billion
+        // messages sitting in the pending queue.
+        //
+        // In that case, having two identical tokens is the least of your concerns.
+        let id = self.next_id.fetch_add(1, Relaxed);
+        PendingMessageToken(id)
+    }
+}
+impl<T> Default for PendingEventQueue<T> {
+    fn default() -> Self {
+        PendingEventQueue { pending: Mutex::new(Vec::new()), next_id: AtomicU32::new(0) }
+    }
+}
+
+/// WARNING: Due to using PeekMessage, the event handler
+/// function may get called during this function.
+/// (Re-entrance to the event handler)
+///
+/// This can cause a deadlock if calling this function
+/// while having a mutex locked.
+///
+/// It can also cause code to get executed in a surprising order.
+pub fn next_kbd_msg(hwnd: HWND) -> Option<MSG> {
+    unsafe {
+        let mut next_msg = MaybeUninit::uninit();
+        let peek_retval =
+            PeekMessageW(next_msg.as_mut_ptr(), hwnd, WM_KEYFIRST, WM_KEYLAST, PM_NOREMOVE);
+        (peek_retval != 0).then(|| next_msg.assume_init())
+    }
+}
+
+fn get_location(scancode: ExScancode, hkl: HKL) -> KeyLocation {
+    const ABNT_C2: VIRTUAL_KEY = VK_ABNT_C2 as VIRTUAL_KEY;
+
+    let extension = 0xe000;
+    let extended = (scancode & extension) == extension;
+    let vkey = unsafe { MapVirtualKeyExW(scancode as u32, MAPVK_VSC_TO_VK_EX, hkl) as VIRTUAL_KEY };
+
+    // Use the native VKEY and the extended flag to cover most cases
+    // This is taken from the `druid` GUI library, specifically
+    // druid-shell/src/platform/windows/keyboard.rs
+    match vkey {
+        VK_LSHIFT | VK_LCONTROL | VK_LMENU | VK_LWIN => KeyLocation::Left,
+        VK_RSHIFT | VK_RCONTROL | VK_RMENU | VK_RWIN => KeyLocation::Right,
+        VK_RETURN if extended => KeyLocation::Numpad,
+        VK_INSERT | VK_DELETE | VK_END | VK_DOWN | VK_NEXT | VK_LEFT | VK_CLEAR | VK_RIGHT
+        | VK_HOME | VK_UP | VK_PRIOR => {
+            if extended {
+                KeyLocation::Standard
+            } else {
+                KeyLocation::Numpad
+            }
+        },
+        VK_NUMPAD0 | VK_NUMPAD1 | VK_NUMPAD2 | VK_NUMPAD3 | VK_NUMPAD4 | VK_NUMPAD5
+        | VK_NUMPAD6 | VK_NUMPAD7 | VK_NUMPAD8 | VK_NUMPAD9 | VK_DECIMAL | VK_DIVIDE
+        | VK_MULTIPLY | VK_SUBTRACT | VK_ADD | ABNT_C2 => KeyLocation::Numpad,
+        _ => KeyLocation::Standard,
+    }
+}
+
+pub(crate) fn physicalkey_to_scancode(physical_key: PhysicalKey) -> Option<u32> {
+    // See `scancode_to_physicalkey` for more info
+
+    let hkl = unsafe { GetKeyboardLayout(0) };
+
+    let primary_lang_id = primarylangid(loword(hkl as u32));
+    let is_korean = primary_lang_id as u32 == LANG_KOREAN;
+
+    let code = match physical_key {
+        PhysicalKey::Code(code) => code,
+        PhysicalKey::Unidentified(code) => {
+            return match code {
+                NativeKeyCode::Windows(scancode) => Some(scancode as u32),
+                _ => None,
+            };
+        },
+    };
+
+    match code {
+        KeyCode::Backquote => Some(0x0029),
+        KeyCode::Backslash => Some(0x002b),
+        KeyCode::Backspace => Some(0x000e),
+        KeyCode::BracketLeft => Some(0x001a),
+        KeyCode::BracketRight => Some(0x001b),
+        KeyCode::Comma => Some(0x0033),
+        KeyCode::Digit0 => Some(0x000b),
+        KeyCode::Digit1 => Some(0x0002),
+        KeyCode::Digit2 => Some(0x0003),
+        KeyCode::Digit3 => Some(0x0004),
+        KeyCode::Digit4 => Some(0x0005),
+        KeyCode::Digit5 => Some(0x0006),
+        KeyCode::Digit6 => Some(0x0007),
+        KeyCode::Digit7 => Some(0x0008),
+        KeyCode::Digit8 => Some(0x0009),
+        KeyCode::Digit9 => Some(0x000a),
+        KeyCode::Equal => Some(0x000d),
+        KeyCode::IntlBackslash => Some(0x0056),
+        KeyCode::IntlRo => Some(0x0073),
+        KeyCode::IntlYen => Some(0x007d),
+        KeyCode::KeyA => Some(0x001e),
+        KeyCode::KeyB => Some(0x0030),
+        KeyCode::KeyC => Some(0x002e),
+        KeyCode::KeyD => Some(0x0020),
+        KeyCode::KeyE => Some(0x0012),
+        KeyCode::KeyF => Some(0x0021),
+        KeyCode::KeyG => Some(0x0022),
+        KeyCode::KeyH => Some(0x0023),
+        KeyCode::KeyI => Some(0x0017),
+        KeyCode::KeyJ => Some(0x0024),
+        KeyCode::KeyK => Some(0x0025),
+        KeyCode::KeyL => Some(0x0026),
+        KeyCode::KeyM => Some(0x0032),
+        KeyCode::KeyN => Some(0x0031),
+        KeyCode::KeyO => Some(0x0018),
+        KeyCode::KeyP => Some(0x0019),
+        KeyCode::KeyQ => Some(0x0010),
+        KeyCode::KeyR => Some(0x0013),
+        KeyCode::KeyS => Some(0x001f),
+        KeyCode::KeyT => Some(0x0014),
+        KeyCode::KeyU => Some(0x0016),
+        KeyCode::KeyV => Some(0x002f),
+        KeyCode::KeyW => Some(0x0011),
+        KeyCode::KeyX => Some(0x002d),
+        KeyCode::KeyY => Some(0x0015),
+        KeyCode::KeyZ => Some(0x002c),
+        KeyCode::Minus => Some(0x000c),
+        KeyCode::Period => Some(0x0034),
+        KeyCode::Quote => Some(0x0028),
+        KeyCode::Semicolon => Some(0x0027),
+        KeyCode::Slash => Some(0x0035),
+        KeyCode::AltLeft => Some(0x0038),
+        KeyCode::AltRight => Some(0xe038),
+        KeyCode::CapsLock => Some(0x003a),
+        KeyCode::ContextMenu => Some(0xe05d),
+        KeyCode::ControlLeft => Some(0x001d),
+        KeyCode::ControlRight => Some(0xe01d),
+        KeyCode::Enter => Some(0x001c),
+        KeyCode::SuperLeft => Some(0xe05b),
+        KeyCode::SuperRight => Some(0xe05c),
+        KeyCode::ShiftLeft => Some(0x002a),
+        KeyCode::ShiftRight => Some(0x0036),
+        KeyCode::Space => Some(0x0039),
+        KeyCode::Tab => Some(0x000f),
+        KeyCode::Convert => Some(0x0079),
+        KeyCode::Lang1 => {
+            if is_korean {
+                Some(0xe0f2)
+            } else {
+                Some(0x0072)
+            }
+        },
+        KeyCode::Lang2 => {
+            if is_korean {
+                Some(0xe0f1)
+            } else {
+                Some(0x0071)
+            }
+        },
+        KeyCode::KanaMode => Some(0x0070),
+        KeyCode::NonConvert => Some(0x007b),
+        KeyCode::Delete => Some(0xe053),
+        KeyCode::End => Some(0xe04f),
+        KeyCode::Home => Some(0xe047),
+        KeyCode::Insert => Some(0xe052),
+        KeyCode::PageDown => Some(0xe051),
+        KeyCode::PageUp => Some(0xe049),
+        KeyCode::ArrowDown => Some(0xe050),
+        KeyCode::ArrowLeft => Some(0xe04b),
+        KeyCode::ArrowRight => Some(0xe04d),
+        KeyCode::ArrowUp => Some(0xe048),
+        KeyCode::NumLock => Some(0xe045),
+        KeyCode::Numpad0 => Some(0x0052),
+        KeyCode::Numpad1 => Some(0x004f),
+        KeyCode::Numpad2 => Some(0x0050),
+        KeyCode::Numpad3 => Some(0x0051),
+        KeyCode::Numpad4 => Some(0x004b),
+        KeyCode::Numpad5 => Some(0x004c),
+        KeyCode::Numpad6 => Some(0x004d),
+        KeyCode::Numpad7 => Some(0x0047),
+        KeyCode::Numpad8 => Some(0x0048),
+        KeyCode::Numpad9 => Some(0x0049),
+        KeyCode::NumpadAdd => Some(0x004e),
+        KeyCode::NumpadComma => Some(0x007e),
+        KeyCode::NumpadDecimal => Some(0x0053),
+        KeyCode::NumpadDivide => Some(0xe035),
+        KeyCode::NumpadEnter => Some(0xe01c),
+        KeyCode::NumpadEqual => Some(0x0059),
+        KeyCode::NumpadMultiply => Some(0x0037),
+        KeyCode::NumpadSubtract => Some(0x004a),
+        KeyCode::Escape => Some(0x0001),
+        KeyCode::F1 => Some(0x003b),
+        KeyCode::F2 => Some(0x003c),
+        KeyCode::F3 => Some(0x003d),
+        KeyCode::F4 => Some(0x003e),
+        KeyCode::F5 => Some(0x003f),
+        KeyCode::F6 => Some(0x0040),
+        KeyCode::F7 => Some(0x0041),
+        KeyCode::F8 => Some(0x0042),
+        KeyCode::F9 => Some(0x0043),
+        KeyCode::F10 => Some(0x0044),
+        KeyCode::F11 => Some(0x0057),
+        KeyCode::F12 => Some(0x0058),
+        KeyCode::F13 => Some(0x0064),
+        KeyCode::F14 => Some(0x0065),
+        KeyCode::F15 => Some(0x0066),
+        KeyCode::F16 => Some(0x0067),
+        KeyCode::F17 => Some(0x0068),
+        KeyCode::F18 => Some(0x0069),
+        KeyCode::F19 => Some(0x006a),
+        KeyCode::F20 => Some(0x006b),
+        KeyCode::F21 => Some(0x006c),
+        KeyCode::F22 => Some(0x006d),
+        KeyCode::F23 => Some(0x006e),
+        KeyCode::F24 => Some(0x0076),
+        KeyCode::PrintScreen => Some(0xe037),
+        // KeyCode::PrintScreen => Some(0x0054), // Alt + PrintScreen
+        KeyCode::ScrollLock => Some(0x0046),
+        KeyCode::Pause => Some(0x0045),
+        // KeyCode::Pause => Some(0xE046), // Ctrl + Pause
+        KeyCode::BrowserBack => Some(0xe06a),
+        KeyCode::BrowserFavorites => Some(0xe066),
+        KeyCode::BrowserForward => Some(0xe069),
+        KeyCode::BrowserHome => Some(0xe032),
+        KeyCode::BrowserRefresh => Some(0xe067),
+        KeyCode::BrowserSearch => Some(0xe065),
+        KeyCode::BrowserStop => Some(0xe068),
+        KeyCode::LaunchApp1 => Some(0xe06b),
+        KeyCode::LaunchApp2 => Some(0xe021),
+        KeyCode::LaunchMail => Some(0xe06c),
+        KeyCode::MediaPlayPause => Some(0xe022),
+        KeyCode::MediaSelect => Some(0xe06d),
+        KeyCode::MediaStop => Some(0xe024),
+        KeyCode::MediaTrackNext => Some(0xe019),
+        KeyCode::MediaTrackPrevious => Some(0xe010),
+        KeyCode::Power => Some(0xe05e),
+        KeyCode::AudioVolumeDown => Some(0xe02e),
+        KeyCode::AudioVolumeMute => Some(0xe020),
+        KeyCode::AudioVolumeUp => Some(0xe030),
+        _ => None,
+    }
+}
+
+pub(crate) fn scancode_to_physicalkey(scancode: u32) -> PhysicalKey {
+    // See: https://www.win.tue.nl/~aeb/linux/kbd/scancodes-1.html
+    // and: https://www.w3.org/TR/uievents-code/
+    // and: The widget/NativeKeyToDOMCodeName.h file in the firefox source
+
+    PhysicalKey::Code(match scancode {
+        0x0029 => KeyCode::Backquote,
+        0x002b => KeyCode::Backslash,
+        0x000e => KeyCode::Backspace,
+        0x001a => KeyCode::BracketLeft,
+        0x001b => KeyCode::BracketRight,
+        0x0033 => KeyCode::Comma,
+        0x000b => KeyCode::Digit0,
+        0x0002 => KeyCode::Digit1,
+        0x0003 => KeyCode::Digit2,
+        0x0004 => KeyCode::Digit3,
+        0x0005 => KeyCode::Digit4,
+        0x0006 => KeyCode::Digit5,
+        0x0007 => KeyCode::Digit6,
+        0x0008 => KeyCode::Digit7,
+        0x0009 => KeyCode::Digit8,
+        0x000a => KeyCode::Digit9,
+        0x000d => KeyCode::Equal,
+        0x0056 => KeyCode::IntlBackslash,
+        0x0073 => KeyCode::IntlRo,
+        0x007d => KeyCode::IntlYen,
+        0x001e => KeyCode::KeyA,
+        0x0030 => KeyCode::KeyB,
+        0x002e => KeyCode::KeyC,
+        0x0020 => KeyCode::KeyD,
+        0x0012 => KeyCode::KeyE,
+        0x0021 => KeyCode::KeyF,
+        0x0022 => KeyCode::KeyG,
+        0x0023 => KeyCode::KeyH,
+        0x0017 => KeyCode::KeyI,
+        0x0024 => KeyCode::KeyJ,
+        0x0025 => KeyCode::KeyK,
+        0x0026 => KeyCode::KeyL,
+        0x0032 => KeyCode::KeyM,
+        0x0031 => KeyCode::KeyN,
+        0x0018 => KeyCode::KeyO,
+        0x0019 => KeyCode::KeyP,
+        0x0010 => KeyCode::KeyQ,
+        0x0013 => KeyCode::KeyR,
+        0x001f => KeyCode::KeyS,
+        0x0014 => KeyCode::KeyT,
+        0x0016 => KeyCode::KeyU,
+        0x002f => KeyCode::KeyV,
+        0x0011 => KeyCode::KeyW,
+        0x002d => KeyCode::KeyX,
+        0x0015 => KeyCode::KeyY,
+        0x002c => KeyCode::KeyZ,
+        0x000c => KeyCode::Minus,
+        0x0034 => KeyCode::Period,
+        0x0028 => KeyCode::Quote,
+        0x0027 => KeyCode::Semicolon,
+        0x0035 => KeyCode::Slash,
+        0x0038 => KeyCode::AltLeft,
+        0xe038 => KeyCode::AltRight,
+        0x003a => KeyCode::CapsLock,
+        0xe05d => KeyCode::ContextMenu,
+        0x001d => KeyCode::ControlLeft,
+        0xe01d => KeyCode::ControlRight,
+        0x001c => KeyCode::Enter,
+        0xe05b => KeyCode::SuperLeft,
+        0xe05c => KeyCode::SuperRight,
+        0x002a => KeyCode::ShiftLeft,
+        0x0036 => KeyCode::ShiftRight,
+        0x0039 => KeyCode::Space,
+        0x000f => KeyCode::Tab,
+        0x0079 => KeyCode::Convert,
+        0x0072 => KeyCode::Lang1, // for non-Korean layout
+        0xe0f2 => KeyCode::Lang1, // for Korean layout
+        0x0071 => KeyCode::Lang2, // for non-Korean layout
+        0xe0f1 => KeyCode::Lang2, // for Korean layout
+        0x0070 => KeyCode::KanaMode,
+        0x007b => KeyCode::NonConvert,
+        0xe053 => KeyCode::Delete,
+        0xe04f => KeyCode::End,
+        0xe047 => KeyCode::Home,
+        0xe052 => KeyCode::Insert,
+        0xe051 => KeyCode::PageDown,
+        0xe049 => KeyCode::PageUp,
+        0xe050 => KeyCode::ArrowDown,
+        0xe04b => KeyCode::ArrowLeft,
+        0xe04d => KeyCode::ArrowRight,
+        0xe048 => KeyCode::ArrowUp,
+        0xe045 => KeyCode::NumLock,
+        0x0052 => KeyCode::Numpad0,
+        0x004f => KeyCode::Numpad1,
+        0x0050 => KeyCode::Numpad2,
+        0x0051 => KeyCode::Numpad3,
+        0x004b => KeyCode::Numpad4,
+        0x004c => KeyCode::Numpad5,
+        0x004d => KeyCode::Numpad6,
+        0x0047 => KeyCode::Numpad7,
+        0x0048 => KeyCode::Numpad8,
+        0x0049 => KeyCode::Numpad9,
+        0x004e => KeyCode::NumpadAdd,
+        0x007e => KeyCode::NumpadComma,
+        0x0053 => KeyCode::NumpadDecimal,
+        0xe035 => KeyCode::NumpadDivide,
+        0xe01c => KeyCode::NumpadEnter,
+        0x0059 => KeyCode::NumpadEqual,
+        0x0037 => KeyCode::NumpadMultiply,
+        0x004a => KeyCode::NumpadSubtract,
+        0x0001 => KeyCode::Escape,
+        0x003b => KeyCode::F1,
+        0x003c => KeyCode::F2,
+        0x003d => KeyCode::F3,
+        0x003e => KeyCode::F4,
+        0x003f => KeyCode::F5,
+        0x0040 => KeyCode::F6,
+        0x0041 => KeyCode::F7,
+        0x0042 => KeyCode::F8,
+        0x0043 => KeyCode::F9,
+        0x0044 => KeyCode::F10,
+        0x0057 => KeyCode::F11,
+        0x0058 => KeyCode::F12,
+        0x0064 => KeyCode::F13,
+        0x0065 => KeyCode::F14,
+        0x0066 => KeyCode::F15,
+        0x0067 => KeyCode::F16,
+        0x0068 => KeyCode::F17,
+        0x0069 => KeyCode::F18,
+        0x006a => KeyCode::F19,
+        0x006b => KeyCode::F20,
+        0x006c => KeyCode::F21,
+        0x006d => KeyCode::F22,
+        0x006e => KeyCode::F23,
+        0x0076 => KeyCode::F24,
+        0xe037 => KeyCode::PrintScreen,
+        0x0054 => KeyCode::PrintScreen, // Alt + PrintScreen
+        0x0046 => KeyCode::ScrollLock,
+        0x0045 => KeyCode::Pause,
+        0xe046 => KeyCode::Pause, // Ctrl + Pause
+        0xe06a => KeyCode::BrowserBack,
+        0xe066 => KeyCode::BrowserFavorites,
+        0xe069 => KeyCode::BrowserForward,
+        0xe032 => KeyCode::BrowserHome,
+        0xe067 => KeyCode::BrowserRefresh,
+        0xe065 => KeyCode::BrowserSearch,
+        0xe068 => KeyCode::BrowserStop,
+        0xe06b => KeyCode::LaunchApp1,
+        0xe021 => KeyCode::LaunchApp2,
+        0xe06c => KeyCode::LaunchMail,
+        0xe022 => KeyCode::MediaPlayPause,
+        0xe06d => KeyCode::MediaSelect,
+        0xe024 => KeyCode::MediaStop,
+        0xe019 => KeyCode::MediaTrackNext,
+        0xe010 => KeyCode::MediaTrackPrevious,
+        0xe05e => KeyCode::Power,
+        0xe02e => KeyCode::AudioVolumeDown,
+        0xe020 => KeyCode::AudioVolumeMute,
+        0xe030 => KeyCode::AudioVolumeUp,
+        _ => return PhysicalKey::Unidentified(NativeKeyCode::Windows(scancode as u16)),
+    })
+}
diff --git a/vendor/winit/src/platform_impl/windows/keyboard_layout.rs b/vendor/winit/src/platform_impl/windows/keyboard_layout.rs
new file mode 100644
index 00000000..5340e43d
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/keyboard_layout.rs
@@ -0,0 +1,986 @@
+use std::collections::hash_map::Entry;
+use std::collections::{HashMap, HashSet};
+use std::ffi::OsString;
+use std::os::windows::ffi::OsStringExt;
+use std::sync::Mutex;
+
+use crate::utils::Lazy;
+use smol_str::SmolStr;
+use windows_sys::Win32::System::SystemServices::{LANG_JAPANESE, LANG_KOREAN};
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::{
+    GetKeyState, GetKeyboardLayout, MapVirtualKeyExW, ToUnicodeEx, MAPVK_VK_TO_VSC_EX, VIRTUAL_KEY,
+    VK_ACCEPT, VK_ADD, VK_APPS, VK_ATTN, VK_BACK, VK_BROWSER_BACK, VK_BROWSER_FAVORITES,
+    VK_BROWSER_FORWARD, VK_BROWSER_HOME, VK_BROWSER_REFRESH, VK_BROWSER_SEARCH, VK_BROWSER_STOP,
+    VK_CANCEL, VK_CAPITAL, VK_CLEAR, VK_CONTROL, VK_CONVERT, VK_CRSEL, VK_DECIMAL, VK_DELETE,
+    VK_DIVIDE, VK_DOWN, VK_END, VK_EREOF, VK_ESCAPE, VK_EXECUTE, VK_EXSEL, VK_F1, VK_F10, VK_F11,
+    VK_F12, VK_F13, VK_F14, VK_F15, VK_F16, VK_F17, VK_F18, VK_F19, VK_F2, VK_F20, VK_F21, VK_F22,
+    VK_F23, VK_F24, VK_F3, VK_F4, VK_F5, VK_F6, VK_F7, VK_F8, VK_F9, VK_FINAL, VK_GAMEPAD_A,
+    VK_GAMEPAD_B, VK_GAMEPAD_DPAD_DOWN, VK_GAMEPAD_DPAD_LEFT, VK_GAMEPAD_DPAD_RIGHT,
+    VK_GAMEPAD_DPAD_UP, VK_GAMEPAD_LEFT_SHOULDER, VK_GAMEPAD_LEFT_THUMBSTICK_BUTTON,
+    VK_GAMEPAD_LEFT_THUMBSTICK_DOWN, VK_GAMEPAD_LEFT_THUMBSTICK_LEFT,
+    VK_GAMEPAD_LEFT_THUMBSTICK_RIGHT, VK_GAMEPAD_LEFT_THUMBSTICK_UP, VK_GAMEPAD_LEFT_TRIGGER,
+    VK_GAMEPAD_MENU, VK_GAMEPAD_RIGHT_SHOULDER, VK_GAMEPAD_RIGHT_THUMBSTICK_BUTTON,
+    VK_GAMEPAD_RIGHT_THUMBSTICK_DOWN, VK_GAMEPAD_RIGHT_THUMBSTICK_LEFT,
+    VK_GAMEPAD_RIGHT_THUMBSTICK_RIGHT, VK_GAMEPAD_RIGHT_THUMBSTICK_UP, VK_GAMEPAD_RIGHT_TRIGGER,
+    VK_GAMEPAD_VIEW, VK_GAMEPAD_X, VK_GAMEPAD_Y, VK_HANGUL, VK_HANJA, VK_HELP, VK_HOME, VK_ICO_00,
+    VK_ICO_CLEAR, VK_ICO_HELP, VK_INSERT, VK_JUNJA, VK_KANA, VK_KANJI, VK_LAUNCH_APP1,
+    VK_LAUNCH_APP2, VK_LAUNCH_MAIL, VK_LAUNCH_MEDIA_SELECT, VK_LBUTTON, VK_LCONTROL, VK_LEFT,
+    VK_LMENU, VK_LSHIFT, VK_LWIN, VK_MBUTTON, VK_MEDIA_NEXT_TRACK, VK_MEDIA_PLAY_PAUSE,
+    VK_MEDIA_PREV_TRACK, VK_MEDIA_STOP, VK_MENU, VK_MODECHANGE, VK_MULTIPLY, VK_NAVIGATION_ACCEPT,
+    VK_NAVIGATION_CANCEL, VK_NAVIGATION_DOWN, VK_NAVIGATION_LEFT, VK_NAVIGATION_MENU,
+    VK_NAVIGATION_RIGHT, VK_NAVIGATION_UP, VK_NAVIGATION_VIEW, VK_NEXT, VK_NONAME, VK_NONCONVERT,
+    VK_NUMLOCK, VK_NUMPAD0, VK_NUMPAD1, VK_NUMPAD2, VK_NUMPAD3, VK_NUMPAD4, VK_NUMPAD5, VK_NUMPAD6,
+    VK_NUMPAD7, VK_NUMPAD8, VK_NUMPAD9, VK_OEM_1, VK_OEM_102, VK_OEM_2, VK_OEM_3, VK_OEM_4,
+    VK_OEM_5, VK_OEM_6, VK_OEM_7, VK_OEM_8, VK_OEM_ATTN, VK_OEM_AUTO, VK_OEM_AX, VK_OEM_BACKTAB,
+    VK_OEM_CLEAR, VK_OEM_COMMA, VK_OEM_COPY, VK_OEM_CUSEL, VK_OEM_ENLW, VK_OEM_FINISH,
+    VK_OEM_FJ_LOYA, VK_OEM_FJ_MASSHOU, VK_OEM_FJ_ROYA, VK_OEM_FJ_TOUROKU, VK_OEM_JUMP,
+    VK_OEM_MINUS, VK_OEM_NEC_EQUAL, VK_OEM_PA1, VK_OEM_PA2, VK_OEM_PA3, VK_OEM_PERIOD, VK_OEM_PLUS,
+    VK_OEM_RESET, VK_OEM_WSCTRL, VK_PA1, VK_PACKET, VK_PAUSE, VK_PLAY, VK_PRINT, VK_PRIOR,
+    VK_PROCESSKEY, VK_RBUTTON, VK_RCONTROL, VK_RETURN, VK_RIGHT, VK_RMENU, VK_RSHIFT, VK_RWIN,
+    VK_SCROLL, VK_SELECT, VK_SEPARATOR, VK_SHIFT, VK_SLEEP, VK_SNAPSHOT, VK_SPACE, VK_SUBTRACT,
+    VK_TAB, VK_UP, VK_VOLUME_DOWN, VK_VOLUME_MUTE, VK_VOLUME_UP, VK_XBUTTON1, VK_XBUTTON2, VK_ZOOM,
+};
+use windows_sys::Win32::UI::TextServices::HKL;
+
+use crate::keyboard::{Key, KeyCode, ModifiersState, NamedKey, NativeKey, PhysicalKey};
+use crate::platform_impl::{loword, primarylangid, scancode_to_physicalkey};
+
+pub(crate) static LAYOUT_CACHE: Lazy<Mutex<LayoutCache>> =
+    Lazy::new(|| Mutex::new(LayoutCache::default()));
+
+fn key_pressed(vkey: VIRTUAL_KEY) -> bool {
+    unsafe { (GetKeyState(vkey as i32) & (1 << 15)) == (1 << 15) }
+}
+
+const NUMPAD_VKEYS: [VIRTUAL_KEY; 16] = [
+    VK_NUMPAD0,
+    VK_NUMPAD1,
+    VK_NUMPAD2,
+    VK_NUMPAD3,
+    VK_NUMPAD4,
+    VK_NUMPAD5,
+    VK_NUMPAD6,
+    VK_NUMPAD7,
+    VK_NUMPAD8,
+    VK_NUMPAD9,
+    VK_MULTIPLY,
+    VK_ADD,
+    VK_SEPARATOR,
+    VK_SUBTRACT,
+    VK_DECIMAL,
+    VK_DIVIDE,
+];
+
+static NUMPAD_KEYCODES: Lazy<HashSet<KeyCode>> = Lazy::new(|| {
+    let mut keycodes = HashSet::new();
+    keycodes.insert(KeyCode::Numpad0);
+    keycodes.insert(KeyCode::Numpad1);
+    keycodes.insert(KeyCode::Numpad2);
+    keycodes.insert(KeyCode::Numpad3);
+    keycodes.insert(KeyCode::Numpad4);
+    keycodes.insert(KeyCode::Numpad5);
+    keycodes.insert(KeyCode::Numpad6);
+    keycodes.insert(KeyCode::Numpad7);
+    keycodes.insert(KeyCode::Numpad8);
+    keycodes.insert(KeyCode::Numpad9);
+    keycodes.insert(KeyCode::NumpadMultiply);
+    keycodes.insert(KeyCode::NumpadAdd);
+    keycodes.insert(KeyCode::NumpadComma);
+    keycodes.insert(KeyCode::NumpadSubtract);
+    keycodes.insert(KeyCode::NumpadDecimal);
+    keycodes.insert(KeyCode::NumpadDivide);
+    keycodes
+});
+
+bitflags::bitflags! {
+    #[derive(Clone, Copy, PartialEq, Eq, Hash)]
+    pub struct WindowsModifiers : u8 {
+        const SHIFT = 1 << 0;
+        const CONTROL = 1 << 1;
+        const ALT = 1 << 2;
+        const CAPS_LOCK = 1 << 3;
+        const FLAGS_END = 1 << 4;
+    }
+}
+
+impl WindowsModifiers {
+    pub fn active_modifiers(key_state: &[u8; 256]) -> WindowsModifiers {
+        let shift = key_state[VK_SHIFT as usize] & 0x80 != 0;
+        let lshift = key_state[VK_LSHIFT as usize] & 0x80 != 0;
+        let rshift = key_state[VK_RSHIFT as usize] & 0x80 != 0;
+
+        let control = key_state[VK_CONTROL as usize] & 0x80 != 0;
+        let lcontrol = key_state[VK_LCONTROL as usize] & 0x80 != 0;
+        let rcontrol = key_state[VK_RCONTROL as usize] & 0x80 != 0;
+
+        let alt = key_state[VK_MENU as usize] & 0x80 != 0;
+        let lalt = key_state[VK_LMENU as usize] & 0x80 != 0;
+        let ralt = key_state[VK_RMENU as usize] & 0x80 != 0;
+
+        let caps = key_state[VK_CAPITAL as usize] & 0x01 != 0;
+
+        let mut result = WindowsModifiers::empty();
+        if shift || lshift || rshift {
+            result.insert(WindowsModifiers::SHIFT);
+        }
+        if control || lcontrol || rcontrol {
+            result.insert(WindowsModifiers::CONTROL);
+        }
+        if alt || lalt || ralt {
+            result.insert(WindowsModifiers::ALT);
+        }
+        if caps {
+            result.insert(WindowsModifiers::CAPS_LOCK);
+        }
+
+        result
+    }
+
+    pub fn apply_to_kbd_state(self, key_state: &mut [u8; 256]) {
+        if self.intersects(Self::SHIFT) {
+            key_state[VK_SHIFT as usize] |= 0x80;
+        } else {
+            key_state[VK_SHIFT as usize] &= !0x80;
+            key_state[VK_LSHIFT as usize] &= !0x80;
+            key_state[VK_RSHIFT as usize] &= !0x80;
+        }
+        if self.intersects(Self::CONTROL) {
+            key_state[VK_CONTROL as usize] |= 0x80;
+        } else {
+            key_state[VK_CONTROL as usize] &= !0x80;
+            key_state[VK_LCONTROL as usize] &= !0x80;
+            key_state[VK_RCONTROL as usize] &= !0x80;
+        }
+        if self.intersects(Self::ALT) {
+            key_state[VK_MENU as usize] |= 0x80;
+        } else {
+            key_state[VK_MENU as usize] &= !0x80;
+            key_state[VK_LMENU as usize] &= !0x80;
+            key_state[VK_RMENU as usize] &= !0x80;
+        }
+        if self.intersects(Self::CAPS_LOCK) {
+            key_state[VK_CAPITAL as usize] |= 0x01;
+        } else {
+            key_state[VK_CAPITAL as usize] &= !0x01;
+        }
+    }
+
+    /// Removes the control modifier if the alt modifier is not present.
+    /// This is useful because on Windows: (Control + Alt) == AltGr
+    /// but we don't want to interfere with the AltGr state.
+    pub fn remove_only_ctrl(mut self) -> WindowsModifiers {
+        if !self.contains(WindowsModifiers::ALT) {
+            self.remove(WindowsModifiers::CONTROL);
+        }
+        self
+    }
+}
+
+pub(crate) struct Layout {
+    pub hkl: u64,
+
+    /// Maps numpad keys from Windows virtual key to a `Key`.
+    ///
+    /// This is useful because some numpad keys generate different characters based on the locale.
+    /// For example `VK_DECIMAL` is sometimes "." and sometimes ",". Note: numpad-specific virtual
+    /// keys are only produced by Windows when the NumLock is active.
+    ///
+    /// Making this field separate from the `keys` field saves having to add NumLock as a modifier
+    /// to `WindowsModifiers`, which would double the number of items in keys.
+    pub numlock_on_keys: HashMap<VIRTUAL_KEY, Key>,
+    /// Like `numlock_on_keys` but this will map to the key that would be produced if numlock was
+    /// off. The keys of this map are identical to the keys of `numlock_on_keys`.
+    pub numlock_off_keys: HashMap<VIRTUAL_KEY, Key>,
+
+    /// Maps a modifier state to group of key strings
+    /// We're not using `ModifiersState` here because that object cannot express caps lock,
+    /// but we need to handle caps lock too.
+    ///
+    /// This map shouldn't need to exist.
+    /// However currently this seems to be the only good way
+    /// of getting the label for the pressed key. Note that calling `ToUnicode`
+    /// just when the key is pressed/released would be enough if `ToUnicode` wouldn't
+    /// change the keyboard state (it clears the dead key). There is a flag to prevent
+    /// changing the state, but that flag requires Windows 10, version 1607 or newer)
+    pub keys: HashMap<WindowsModifiers, HashMap<KeyCode, Key>>,
+    pub has_alt_graph: bool,
+}
+
+impl Layout {
+    pub fn get_key(
+        &self,
+        mods: WindowsModifiers,
+        num_lock_on: bool,
+        vkey: VIRTUAL_KEY,
+        physical_key: &PhysicalKey,
+    ) -> Key {
+        let native_code = NativeKey::Windows(vkey);
+
+        let unknown_alt = vkey == VK_MENU;
+        if !unknown_alt {
+            // Here we try using the virtual key directly but if the virtual key doesn't distinguish
+            // between left and right alt, we can't report AltGr. Therefore, we only do this if the
+            // key is not the "unknown alt" key.
+            //
+            // The reason for using the virtual key directly is that `MapVirtualKeyExW` (used when
+            // building the keys map) sometimes maps virtual keys to odd scancodes that don't match
+            // the scancode coming from the KEYDOWN message for the same key. For example: `VK_LEFT`
+            // is mapped to `0x004B`, but the scancode for the left arrow is `0xE04B`.
+            let key_from_vkey =
+                vkey_to_non_char_key(vkey, native_code.clone(), self.hkl, self.has_alt_graph);
+
+            if !matches!(key_from_vkey, Key::Unidentified(_)) {
+                return key_from_vkey;
+            }
+        }
+        if num_lock_on {
+            if let Some(key) = self.numlock_on_keys.get(&vkey) {
+                return key.clone();
+            }
+        } else if let Some(key) = self.numlock_off_keys.get(&vkey) {
+            return key.clone();
+        }
+        if let PhysicalKey::Code(code) = physical_key {
+            if let Some(keys) = self.keys.get(&mods) {
+                if let Some(key) = keys.get(code) {
+                    return key.clone();
+                }
+            }
+        }
+        Key::Unidentified(native_code)
+    }
+}
+
+#[derive(Default)]
+pub(crate) struct LayoutCache {
+    /// Maps locale identifiers (HKL) to layouts
+    pub layouts: HashMap<u64, Layout>,
+}
+
+impl LayoutCache {
+    /// Checks whether the current layout is already known and
+    /// prepares the layout if it isn't known.
+    /// The current layout is then returned.
+    pub fn get_current_layout(&mut self) -> (u64, &Layout) {
+        let locale_id = unsafe { GetKeyboardLayout(0) } as u64;
+        match self.layouts.entry(locale_id) {
+            Entry::Occupied(entry) => (locale_id, entry.into_mut()),
+            Entry::Vacant(entry) => {
+                let layout = Self::prepare_layout(locale_id);
+                (locale_id, entry.insert(layout))
+            },
+        }
+    }
+
+    pub fn get_agnostic_mods(&mut self) -> ModifiersState {
+        let (_, layout) = self.get_current_layout();
+        let filter_out_altgr = layout.has_alt_graph && key_pressed(VK_RMENU);
+        let mut mods = ModifiersState::empty();
+        mods.set(ModifiersState::SHIFT, key_pressed(VK_SHIFT));
+        mods.set(ModifiersState::CONTROL, key_pressed(VK_CONTROL) && !filter_out_altgr);
+        mods.set(ModifiersState::ALT, key_pressed(VK_MENU) && !filter_out_altgr);
+        mods.set(ModifiersState::SUPER, key_pressed(VK_LWIN) || key_pressed(VK_RWIN));
+        mods
+    }
+
+    fn prepare_layout(locale_id: u64) -> Layout {
+        let mut layout = Layout {
+            hkl: locale_id,
+            numlock_on_keys: Default::default(),
+            numlock_off_keys: Default::default(),
+            keys: Default::default(),
+            has_alt_graph: false,
+        };
+
+        // We initialize the keyboard state with all zeros to
+        // simulate a scenario when no modifier is active.
+        let mut key_state = [0u8; 256];
+
+        // `MapVirtualKeyExW` maps (non-numpad-specific) virtual keys to scancodes as if numlock
+        // was off. We rely on this behavior to find all virtual keys which are not numpad-specific
+        // but map to the numpad.
+        //
+        // src_vkey: VK  ==>  scancode: u16 (on the numpad)
+        //
+        // Then we convert the source virtual key into a `Key` and the scancode into a virtual key
+        // to get the reverse mapping.
+        //
+        // src_vkey: VK  ==>  scancode: u16 (on the numpad)
+        //    ||                    ||
+        //    \/                    \/
+        // map_value: Key  <-  map_vkey: VK
+        layout.numlock_off_keys.reserve(NUMPAD_KEYCODES.len());
+        for vk in 0..256 {
+            let scancode = unsafe { MapVirtualKeyExW(vk, MAPVK_VK_TO_VSC_EX, locale_id as HKL) };
+            if scancode == 0 {
+                continue;
+            }
+            let keycode = match scancode_to_physicalkey(scancode) {
+                PhysicalKey::Code(code) => code,
+                // TODO: validate that we can skip on unidentified keys (probably never occurs?)
+                _ => continue,
+            };
+            if !is_numpad_specific(vk as VIRTUAL_KEY) && NUMPAD_KEYCODES.contains(&keycode) {
+                let native_code = NativeKey::Windows(vk as VIRTUAL_KEY);
+                let map_vkey = keycode_to_vkey(keycode, locale_id);
+                if map_vkey == 0 {
+                    continue;
+                }
+                let map_value =
+                    vkey_to_non_char_key(vk as VIRTUAL_KEY, native_code, locale_id, false);
+                if matches!(map_value, Key::Unidentified(_)) {
+                    continue;
+                }
+                layout.numlock_off_keys.insert(map_vkey, map_value);
+            }
+        }
+
+        layout.numlock_on_keys.reserve(NUMPAD_VKEYS.len());
+        for vk in NUMPAD_VKEYS.iter() {
+            let vk = (*vk) as u32;
+            let scancode = unsafe { MapVirtualKeyExW(vk, MAPVK_VK_TO_VSC_EX, locale_id as HKL) };
+            let unicode = Self::to_unicode_string(&key_state, vk, scancode, locale_id);
+            if let ToUnicodeResult::Str(s) = unicode {
+                layout.numlock_on_keys.insert(vk as VIRTUAL_KEY, Key::Character(SmolStr::new(s)));
+            }
+        }
+
+        // Iterate through every combination of modifiers
+        let mods_end = WindowsModifiers::FLAGS_END.bits();
+        for mod_state in 0..mods_end {
+            let mut keys_for_this_mod = HashMap::with_capacity(256);
+
+            let mod_state = WindowsModifiers::from_bits_retain(mod_state);
+            mod_state.apply_to_kbd_state(&mut key_state);
+
+            // Virtual key values are in the domain [0, 255].
+            // This is reinforced by the fact that the keyboard state array has 256
+            // elements. This array is allowed to be indexed by virtual key values
+            // giving the key state for the virtual key used for indexing.
+            for vk in 0..256 {
+                let scancode =
+                    unsafe { MapVirtualKeyExW(vk, MAPVK_VK_TO_VSC_EX, locale_id as HKL) };
+                if scancode == 0 {
+                    continue;
+                }
+
+                let native_code = NativeKey::Windows(vk as VIRTUAL_KEY);
+                let key_code = match scancode_to_physicalkey(scancode) {
+                    PhysicalKey::Code(code) => code,
+                    // TODO: validate that we can skip on unidentified keys (probably never occurs?)
+                    _ => continue,
+                };
+                // Let's try to get the key from just the scancode and vk
+                // We don't necessarily know yet if AltGraph is present on this layout so we'll
+                // assume it isn't. Then we'll do a second pass where we set the "AltRight" keys to
+                // "AltGr" in case we find out that there's an AltGraph.
+                let preliminary_key =
+                    vkey_to_non_char_key(vk as VIRTUAL_KEY, native_code, locale_id, false);
+                match preliminary_key {
+                    Key::Unidentified(_) => (),
+                    _ => {
+                        keys_for_this_mod.insert(key_code, preliminary_key);
+                        continue;
+                    },
+                }
+
+                let unicode = Self::to_unicode_string(&key_state, vk, scancode, locale_id);
+                let key = match unicode {
+                    ToUnicodeResult::Str(str) => Key::Character(SmolStr::new(str)),
+                    ToUnicodeResult::Dead(dead_char) => {
+                        // println!("{:?} - {:?} produced dead {:?}", key_code, mod_state,
+                        // dead_char);
+                        Key::Dead(dead_char)
+                    },
+                    ToUnicodeResult::None => {
+                        let has_alt = mod_state.contains(WindowsModifiers::ALT);
+                        let has_ctrl = mod_state.contains(WindowsModifiers::CONTROL);
+                        // HACK: `ToUnicodeEx` seems to fail getting the string for the numpad
+                        // divide key, so we handle that explicitly here
+                        if !has_alt && !has_ctrl && key_code == KeyCode::NumpadDivide {
+                            Key::Character(SmolStr::new("/"))
+                        } else {
+                            // Just use the unidentified key, we got earlier
+                            preliminary_key
+                        }
+                    },
+                };
+
+                // Check for alt graph.
+                // The logic is that if a key pressed with no modifier produces
+                // a different `Character` from when it's pressed with CTRL+ALT then the layout
+                // has AltGr.
+                let ctrl_alt: WindowsModifiers = WindowsModifiers::CONTROL | WindowsModifiers::ALT;
+                let is_in_ctrl_alt = mod_state == ctrl_alt;
+                if !layout.has_alt_graph && is_in_ctrl_alt {
+                    // Unwrapping here because if we are in the ctrl+alt modifier state
+                    // then the alt modifier state must have come before.
+                    let simple_keys = layout.keys.get(&WindowsModifiers::empty()).unwrap();
+                    if let Some(Key::Character(key_no_altgr)) = simple_keys.get(&key_code) {
+                        if let Key::Character(key) = &key {
+                            layout.has_alt_graph = key != key_no_altgr;
+                        }
+                    }
+                }
+
+                keys_for_this_mod.insert(key_code, key);
+            }
+            layout.keys.insert(mod_state, keys_for_this_mod);
+        }
+
+        // Second pass: replace right alt keys with AltGr if the layout has alt graph
+        if layout.has_alt_graph {
+            for mod_state in 0..mods_end {
+                let mod_state = WindowsModifiers::from_bits_retain(mod_state);
+                if let Some(keys) = layout.keys.get_mut(&mod_state) {
+                    if let Some(key) = keys.get_mut(&KeyCode::AltRight) {
+                        *key = Key::Named(NamedKey::AltGraph);
+                    }
+                }
+            }
+        }
+
+        layout
+    }
+
+    fn to_unicode_string(
+        key_state: &[u8; 256],
+        vkey: u32,
+        scancode: u32,
+        locale_id: u64,
+    ) -> ToUnicodeResult {
+        unsafe {
+            let mut label_wide = [0u16; 8];
+            let mut wide_len = ToUnicodeEx(
+                vkey,
+                scancode,
+                (&key_state[0]) as *const _,
+                (&mut label_wide[0]) as *mut _,
+                label_wide.len() as i32,
+                0,
+                locale_id as HKL,
+            );
+            if wide_len < 0 {
+                // If it's dead, we run `ToUnicode` again to consume the dead-key
+                wide_len = ToUnicodeEx(
+                    vkey,
+                    scancode,
+                    (&key_state[0]) as *const _,
+                    (&mut label_wide[0]) as *mut _,
+                    label_wide.len() as i32,
+                    0,
+                    locale_id as HKL,
+                );
+                if wide_len > 0 {
+                    let os_string = OsString::from_wide(&label_wide[0..wide_len as usize]);
+                    if let Ok(label_str) = os_string.into_string() {
+                        if let Some(ch) = label_str.chars().next() {
+                            return ToUnicodeResult::Dead(Some(ch));
+                        }
+                    }
+                }
+                return ToUnicodeResult::Dead(None);
+            }
+            if wide_len > 0 {
+                let os_string = OsString::from_wide(&label_wide[0..wide_len as usize]);
+                if let Ok(label_str) = os_string.into_string() {
+                    return ToUnicodeResult::Str(label_str);
+                }
+            }
+        }
+        ToUnicodeResult::None
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq)]
+enum ToUnicodeResult {
+    Str(String),
+    Dead(Option<char>),
+    None,
+}
+
+fn is_numpad_specific(vk: VIRTUAL_KEY) -> bool {
+    matches!(
+        vk,
+        VK_NUMPAD0
+            | VK_NUMPAD1
+            | VK_NUMPAD2
+            | VK_NUMPAD3
+            | VK_NUMPAD4
+            | VK_NUMPAD5
+            | VK_NUMPAD6
+            | VK_NUMPAD7
+            | VK_NUMPAD8
+            | VK_NUMPAD9
+            | VK_ADD
+            | VK_SUBTRACT
+            | VK_DIVIDE
+            | VK_DECIMAL
+            | VK_SEPARATOR
+    )
+}
+
+fn keycode_to_vkey(keycode: KeyCode, hkl: u64) -> VIRTUAL_KEY {
+    let primary_lang_id = primarylangid(loword(hkl as u32));
+    let is_korean = primary_lang_id as u32 == LANG_KOREAN;
+    let is_japanese = primary_lang_id as u32 == LANG_JAPANESE;
+
+    match keycode {
+        KeyCode::Backquote => 0,
+        KeyCode::Backslash => 0,
+        KeyCode::BracketLeft => 0,
+        KeyCode::BracketRight => 0,
+        KeyCode::Comma => 0,
+        KeyCode::Digit0 => 0,
+        KeyCode::Digit1 => 0,
+        KeyCode::Digit2 => 0,
+        KeyCode::Digit3 => 0,
+        KeyCode::Digit4 => 0,
+        KeyCode::Digit5 => 0,
+        KeyCode::Digit6 => 0,
+        KeyCode::Digit7 => 0,
+        KeyCode::Digit8 => 0,
+        KeyCode::Digit9 => 0,
+        KeyCode::Equal => 0,
+        KeyCode::IntlBackslash => 0,
+        KeyCode::IntlRo => 0,
+        KeyCode::IntlYen => 0,
+        KeyCode::KeyA => 0,
+        KeyCode::KeyB => 0,
+        KeyCode::KeyC => 0,
+        KeyCode::KeyD => 0,
+        KeyCode::KeyE => 0,
+        KeyCode::KeyF => 0,
+        KeyCode::KeyG => 0,
+        KeyCode::KeyH => 0,
+        KeyCode::KeyI => 0,
+        KeyCode::KeyJ => 0,
+        KeyCode::KeyK => 0,
+        KeyCode::KeyL => 0,
+        KeyCode::KeyM => 0,
+        KeyCode::KeyN => 0,
+        KeyCode::KeyO => 0,
+        KeyCode::KeyP => 0,
+        KeyCode::KeyQ => 0,
+        KeyCode::KeyR => 0,
+        KeyCode::KeyS => 0,
+        KeyCode::KeyT => 0,
+        KeyCode::KeyU => 0,
+        KeyCode::KeyV => 0,
+        KeyCode::KeyW => 0,
+        KeyCode::KeyX => 0,
+        KeyCode::KeyY => 0,
+        KeyCode::KeyZ => 0,
+        KeyCode::Minus => 0,
+        KeyCode::Period => 0,
+        KeyCode::Quote => 0,
+        KeyCode::Semicolon => 0,
+        KeyCode::Slash => 0,
+        KeyCode::AltLeft => VK_LMENU,
+        KeyCode::AltRight => VK_RMENU,
+        KeyCode::Backspace => VK_BACK,
+        KeyCode::CapsLock => VK_CAPITAL,
+        KeyCode::ContextMenu => VK_APPS,
+        KeyCode::ControlLeft => VK_LCONTROL,
+        KeyCode::ControlRight => VK_RCONTROL,
+        KeyCode::Enter => VK_RETURN,
+        KeyCode::SuperLeft => VK_LWIN,
+        KeyCode::SuperRight => VK_RWIN,
+        KeyCode::ShiftLeft => VK_RSHIFT,
+        KeyCode::ShiftRight => VK_LSHIFT,
+        KeyCode::Space => VK_SPACE,
+        KeyCode::Tab => VK_TAB,
+        KeyCode::Convert => VK_CONVERT,
+        KeyCode::KanaMode => VK_KANA,
+        KeyCode::Lang1 if is_korean => VK_HANGUL,
+        KeyCode::Lang1 if is_japanese => VK_KANA,
+        KeyCode::Lang2 if is_korean => VK_HANJA,
+        KeyCode::Lang2 if is_japanese => 0,
+        KeyCode::Lang3 if is_japanese => VK_OEM_FINISH,
+        KeyCode::Lang4 if is_japanese => 0,
+        KeyCode::Lang5 if is_japanese => 0,
+        KeyCode::NonConvert => VK_NONCONVERT,
+        KeyCode::Delete => VK_DELETE,
+        KeyCode::End => VK_END,
+        KeyCode::Help => VK_HELP,
+        KeyCode::Home => VK_HOME,
+        KeyCode::Insert => VK_INSERT,
+        KeyCode::PageDown => VK_NEXT,
+        KeyCode::PageUp => VK_PRIOR,
+        KeyCode::ArrowDown => VK_DOWN,
+        KeyCode::ArrowLeft => VK_LEFT,
+        KeyCode::ArrowRight => VK_RIGHT,
+        KeyCode::ArrowUp => VK_UP,
+        KeyCode::NumLock => VK_NUMLOCK,
+        KeyCode::Numpad0 => VK_NUMPAD0,
+        KeyCode::Numpad1 => VK_NUMPAD1,
+        KeyCode::Numpad2 => VK_NUMPAD2,
+        KeyCode::Numpad3 => VK_NUMPAD3,
+        KeyCode::Numpad4 => VK_NUMPAD4,
+        KeyCode::Numpad5 => VK_NUMPAD5,
+        KeyCode::Numpad6 => VK_NUMPAD6,
+        KeyCode::Numpad7 => VK_NUMPAD7,
+        KeyCode::Numpad8 => VK_NUMPAD8,
+        KeyCode::Numpad9 => VK_NUMPAD9,
+        KeyCode::NumpadAdd => VK_ADD,
+        KeyCode::NumpadBackspace => VK_BACK,
+        KeyCode::NumpadClear => VK_CLEAR,
+        KeyCode::NumpadClearEntry => 0,
+        KeyCode::NumpadComma => VK_SEPARATOR,
+        KeyCode::NumpadDecimal => VK_DECIMAL,
+        KeyCode::NumpadDivide => VK_DIVIDE,
+        KeyCode::NumpadEnter => VK_RETURN,
+        KeyCode::NumpadEqual => 0,
+        KeyCode::NumpadHash => 0,
+        KeyCode::NumpadMemoryAdd => 0,
+        KeyCode::NumpadMemoryClear => 0,
+        KeyCode::NumpadMemoryRecall => 0,
+        KeyCode::NumpadMemoryStore => 0,
+        KeyCode::NumpadMemorySubtract => 0,
+        KeyCode::NumpadMultiply => VK_MULTIPLY,
+        KeyCode::NumpadParenLeft => 0,
+        KeyCode::NumpadParenRight => 0,
+        KeyCode::NumpadStar => 0,
+        KeyCode::NumpadSubtract => VK_SUBTRACT,
+        KeyCode::Escape => VK_ESCAPE,
+        KeyCode::Fn => 0,
+        KeyCode::FnLock => 0,
+        KeyCode::PrintScreen => VK_SNAPSHOT,
+        KeyCode::ScrollLock => VK_SCROLL,
+        KeyCode::Pause => VK_PAUSE,
+        KeyCode::BrowserBack => VK_BROWSER_BACK,
+        KeyCode::BrowserFavorites => VK_BROWSER_FAVORITES,
+        KeyCode::BrowserForward => VK_BROWSER_FORWARD,
+        KeyCode::BrowserHome => VK_BROWSER_HOME,
+        KeyCode::BrowserRefresh => VK_BROWSER_REFRESH,
+        KeyCode::BrowserSearch => VK_BROWSER_SEARCH,
+        KeyCode::BrowserStop => VK_BROWSER_STOP,
+        KeyCode::Eject => 0,
+        KeyCode::LaunchApp1 => VK_LAUNCH_APP1,
+        KeyCode::LaunchApp2 => VK_LAUNCH_APP2,
+        KeyCode::LaunchMail => VK_LAUNCH_MAIL,
+        KeyCode::MediaPlayPause => VK_MEDIA_PLAY_PAUSE,
+        KeyCode::MediaSelect => VK_LAUNCH_MEDIA_SELECT,
+        KeyCode::MediaStop => VK_MEDIA_STOP,
+        KeyCode::MediaTrackNext => VK_MEDIA_NEXT_TRACK,
+        KeyCode::MediaTrackPrevious => VK_MEDIA_PREV_TRACK,
+        KeyCode::Power => 0,
+        KeyCode::Sleep => 0,
+        KeyCode::AudioVolumeDown => VK_VOLUME_DOWN,
+        KeyCode::AudioVolumeMute => VK_VOLUME_MUTE,
+        KeyCode::AudioVolumeUp => VK_VOLUME_UP,
+        KeyCode::WakeUp => 0,
+        KeyCode::Hyper => 0,
+        KeyCode::Turbo => 0,
+        KeyCode::Abort => 0,
+        KeyCode::Resume => 0,
+        KeyCode::Suspend => 0,
+        KeyCode::Again => 0,
+        KeyCode::Copy => 0,
+        KeyCode::Cut => 0,
+        KeyCode::Find => 0,
+        KeyCode::Open => 0,
+        KeyCode::Paste => 0,
+        KeyCode::Props => 0,
+        KeyCode::Select => VK_SELECT,
+        KeyCode::Undo => 0,
+        KeyCode::Hiragana => 0,
+        KeyCode::Katakana => 0,
+        KeyCode::F1 => VK_F1,
+        KeyCode::F2 => VK_F2,
+        KeyCode::F3 => VK_F3,
+        KeyCode::F4 => VK_F4,
+        KeyCode::F5 => VK_F5,
+        KeyCode::F6 => VK_F6,
+        KeyCode::F7 => VK_F7,
+        KeyCode::F8 => VK_F8,
+        KeyCode::F9 => VK_F9,
+        KeyCode::F10 => VK_F10,
+        KeyCode::F11 => VK_F11,
+        KeyCode::F12 => VK_F12,
+        KeyCode::F13 => VK_F13,
+        KeyCode::F14 => VK_F14,
+        KeyCode::F15 => VK_F15,
+        KeyCode::F16 => VK_F16,
+        KeyCode::F17 => VK_F17,
+        KeyCode::F18 => VK_F18,
+        KeyCode::F19 => VK_F19,
+        KeyCode::F20 => VK_F20,
+        KeyCode::F21 => VK_F21,
+        KeyCode::F22 => VK_F22,
+        KeyCode::F23 => VK_F23,
+        KeyCode::F24 => VK_F24,
+        KeyCode::F25 => 0,
+        KeyCode::F26 => 0,
+        KeyCode::F27 => 0,
+        KeyCode::F28 => 0,
+        KeyCode::F29 => 0,
+        KeyCode::F30 => 0,
+        KeyCode::F31 => 0,
+        KeyCode::F32 => 0,
+        KeyCode::F33 => 0,
+        KeyCode::F34 => 0,
+        KeyCode::F35 => 0,
+        _ => 0,
+    }
+}
+
+/// This converts virtual keys to `Key`s. Only virtual keys which can be unambiguously converted to
+/// a `Key`, with only the information passed in as arguments, are converted.
+///
+/// In other words: this function does not need to "prepare" the current layout in order to do
+/// the conversion, but as such it cannot convert certain keys, like language-specific character
+/// keys.
+///
+/// The result includes all non-character keys defined within `Key` plus characters from numpad
+/// keys. For example, backspace and tab are included.
+fn vkey_to_non_char_key(
+    vkey: VIRTUAL_KEY,
+    native_code: NativeKey,
+    hkl: u64,
+    has_alt_graph: bool,
+) -> Key {
+    // List of the Web key names and their corresponding platform-native key names:
+    // https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/key/Key_Values
+
+    let primary_lang_id = primarylangid(loword(hkl as u32));
+    let is_korean = primary_lang_id as u32 == LANG_KOREAN;
+    let is_japanese = primary_lang_id as u32 == LANG_JAPANESE;
+
+    match vkey {
+        VK_LBUTTON => Key::Unidentified(NativeKey::Unidentified), // Mouse
+        VK_RBUTTON => Key::Unidentified(NativeKey::Unidentified), // Mouse
+
+        // I don't think this can be represented with a Key
+        VK_CANCEL => Key::Unidentified(native_code),
+
+        VK_MBUTTON => Key::Unidentified(NativeKey::Unidentified), // Mouse
+        VK_XBUTTON1 => Key::Unidentified(NativeKey::Unidentified), // Mouse
+        VK_XBUTTON2 => Key::Unidentified(NativeKey::Unidentified), // Mouse
+        VK_BACK => Key::Named(NamedKey::Backspace),
+        VK_TAB => Key::Named(NamedKey::Tab),
+        VK_CLEAR => Key::Named(NamedKey::Clear),
+        VK_RETURN => Key::Named(NamedKey::Enter),
+        VK_SHIFT => Key::Named(NamedKey::Shift),
+        VK_CONTROL => Key::Named(NamedKey::Control),
+        VK_MENU => Key::Named(NamedKey::Alt),
+        VK_PAUSE => Key::Named(NamedKey::Pause),
+        VK_CAPITAL => Key::Named(NamedKey::CapsLock),
+
+        // VK_HANGEUL => Key::Named(NamedKey::HangulMode), // Deprecated in favour of VK_HANGUL
+
+        // VK_HANGUL and VK_KANA are defined as the same constant, therefore
+        // we use appropriate conditions to differentiate between them
+        VK_HANGUL if is_korean => Key::Named(NamedKey::HangulMode),
+        VK_KANA if is_japanese => Key::Named(NamedKey::KanaMode),
+
+        VK_JUNJA => Key::Named(NamedKey::JunjaMode),
+        VK_FINAL => Key::Named(NamedKey::FinalMode),
+
+        // VK_HANJA and VK_KANJI are defined as the same constant, therefore
+        // we use appropriate conditions to differentiate between them
+        VK_HANJA if is_korean => Key::Named(NamedKey::HanjaMode),
+        VK_KANJI if is_japanese => Key::Named(NamedKey::KanjiMode),
+
+        VK_ESCAPE => Key::Named(NamedKey::Escape),
+        VK_CONVERT => Key::Named(NamedKey::Convert),
+        VK_NONCONVERT => Key::Named(NamedKey::NonConvert),
+        VK_ACCEPT => Key::Named(NamedKey::Accept),
+        VK_MODECHANGE => Key::Named(NamedKey::ModeChange),
+        VK_SPACE => Key::Named(NamedKey::Space),
+        VK_PRIOR => Key::Named(NamedKey::PageUp),
+        VK_NEXT => Key::Named(NamedKey::PageDown),
+        VK_END => Key::Named(NamedKey::End),
+        VK_HOME => Key::Named(NamedKey::Home),
+        VK_LEFT => Key::Named(NamedKey::ArrowLeft),
+        VK_UP => Key::Named(NamedKey::ArrowUp),
+        VK_RIGHT => Key::Named(NamedKey::ArrowRight),
+        VK_DOWN => Key::Named(NamedKey::ArrowDown),
+        VK_SELECT => Key::Named(NamedKey::Select),
+        VK_PRINT => Key::Named(NamedKey::Print),
+        VK_EXECUTE => Key::Named(NamedKey::Execute),
+        VK_SNAPSHOT => Key::Named(NamedKey::PrintScreen),
+        VK_INSERT => Key::Named(NamedKey::Insert),
+        VK_DELETE => Key::Named(NamedKey::Delete),
+        VK_HELP => Key::Named(NamedKey::Help),
+        VK_LWIN => Key::Named(NamedKey::Super),
+        VK_RWIN => Key::Named(NamedKey::Super),
+        VK_APPS => Key::Named(NamedKey::ContextMenu),
+        VK_SLEEP => Key::Named(NamedKey::Standby),
+
+        // Numpad keys produce characters
+        VK_NUMPAD0 => Key::Unidentified(native_code),
+        VK_NUMPAD1 => Key::Unidentified(native_code),
+        VK_NUMPAD2 => Key::Unidentified(native_code),
+        VK_NUMPAD3 => Key::Unidentified(native_code),
+        VK_NUMPAD4 => Key::Unidentified(native_code),
+        VK_NUMPAD5 => Key::Unidentified(native_code),
+        VK_NUMPAD6 => Key::Unidentified(native_code),
+        VK_NUMPAD7 => Key::Unidentified(native_code),
+        VK_NUMPAD8 => Key::Unidentified(native_code),
+        VK_NUMPAD9 => Key::Unidentified(native_code),
+        VK_MULTIPLY => Key::Unidentified(native_code),
+        VK_ADD => Key::Unidentified(native_code),
+        VK_SEPARATOR => Key::Unidentified(native_code),
+        VK_SUBTRACT => Key::Unidentified(native_code),
+        VK_DECIMAL => Key::Unidentified(native_code),
+        VK_DIVIDE => Key::Unidentified(native_code),
+
+        VK_F1 => Key::Named(NamedKey::F1),
+        VK_F2 => Key::Named(NamedKey::F2),
+        VK_F3 => Key::Named(NamedKey::F3),
+        VK_F4 => Key::Named(NamedKey::F4),
+        VK_F5 => Key::Named(NamedKey::F5),
+        VK_F6 => Key::Named(NamedKey::F6),
+        VK_F7 => Key::Named(NamedKey::F7),
+        VK_F8 => Key::Named(NamedKey::F8),
+        VK_F9 => Key::Named(NamedKey::F9),
+        VK_F10 => Key::Named(NamedKey::F10),
+        VK_F11 => Key::Named(NamedKey::F11),
+        VK_F12 => Key::Named(NamedKey::F12),
+        VK_F13 => Key::Named(NamedKey::F13),
+        VK_F14 => Key::Named(NamedKey::F14),
+        VK_F15 => Key::Named(NamedKey::F15),
+        VK_F16 => Key::Named(NamedKey::F16),
+        VK_F17 => Key::Named(NamedKey::F17),
+        VK_F18 => Key::Named(NamedKey::F18),
+        VK_F19 => Key::Named(NamedKey::F19),
+        VK_F20 => Key::Named(NamedKey::F20),
+        VK_F21 => Key::Named(NamedKey::F21),
+        VK_F22 => Key::Named(NamedKey::F22),
+        VK_F23 => Key::Named(NamedKey::F23),
+        VK_F24 => Key::Named(NamedKey::F24),
+        VK_NAVIGATION_VIEW => Key::Unidentified(native_code),
+        VK_NAVIGATION_MENU => Key::Unidentified(native_code),
+        VK_NAVIGATION_UP => Key::Unidentified(native_code),
+        VK_NAVIGATION_DOWN => Key::Unidentified(native_code),
+        VK_NAVIGATION_LEFT => Key::Unidentified(native_code),
+        VK_NAVIGATION_RIGHT => Key::Unidentified(native_code),
+        VK_NAVIGATION_ACCEPT => Key::Unidentified(native_code),
+        VK_NAVIGATION_CANCEL => Key::Unidentified(native_code),
+        VK_NUMLOCK => Key::Named(NamedKey::NumLock),
+        VK_SCROLL => Key::Named(NamedKey::ScrollLock),
+        VK_OEM_NEC_EQUAL => Key::Unidentified(native_code),
+        // VK_OEM_FJ_JISHO => Key::Unidentified(native_code), // Conflicts with `VK_OEM_NEC_EQUAL`
+        VK_OEM_FJ_MASSHOU => Key::Unidentified(native_code),
+        VK_OEM_FJ_TOUROKU => Key::Unidentified(native_code),
+        VK_OEM_FJ_LOYA => Key::Unidentified(native_code),
+        VK_OEM_FJ_ROYA => Key::Unidentified(native_code),
+        VK_LSHIFT => Key::Named(NamedKey::Shift),
+        VK_RSHIFT => Key::Named(NamedKey::Shift),
+        VK_LCONTROL => Key::Named(NamedKey::Control),
+        VK_RCONTROL => Key::Named(NamedKey::Control),
+        VK_LMENU => Key::Named(NamedKey::Alt),
+        VK_RMENU => {
+            if has_alt_graph {
+                Key::Named(NamedKey::AltGraph)
+            } else {
+                Key::Named(NamedKey::Alt)
+            }
+        },
+        VK_BROWSER_BACK => Key::Named(NamedKey::BrowserBack),
+        VK_BROWSER_FORWARD => Key::Named(NamedKey::BrowserForward),
+        VK_BROWSER_REFRESH => Key::Named(NamedKey::BrowserRefresh),
+        VK_BROWSER_STOP => Key::Named(NamedKey::BrowserStop),
+        VK_BROWSER_SEARCH => Key::Named(NamedKey::BrowserSearch),
+        VK_BROWSER_FAVORITES => Key::Named(NamedKey::BrowserFavorites),
+        VK_BROWSER_HOME => Key::Named(NamedKey::BrowserHome),
+        VK_VOLUME_MUTE => Key::Named(NamedKey::AudioVolumeMute),
+        VK_VOLUME_DOWN => Key::Named(NamedKey::AudioVolumeDown),
+        VK_VOLUME_UP => Key::Named(NamedKey::AudioVolumeUp),
+        VK_MEDIA_NEXT_TRACK => Key::Named(NamedKey::MediaTrackNext),
+        VK_MEDIA_PREV_TRACK => Key::Named(NamedKey::MediaTrackPrevious),
+        VK_MEDIA_STOP => Key::Named(NamedKey::MediaStop),
+        VK_MEDIA_PLAY_PAUSE => Key::Named(NamedKey::MediaPlayPause),
+        VK_LAUNCH_MAIL => Key::Named(NamedKey::LaunchMail),
+        VK_LAUNCH_MEDIA_SELECT => Key::Named(NamedKey::LaunchMediaPlayer),
+        VK_LAUNCH_APP1 => Key::Named(NamedKey::LaunchApplication1),
+        VK_LAUNCH_APP2 => Key::Named(NamedKey::LaunchApplication2),
+
+        // This function only converts "non-printable"
+        VK_OEM_1 => Key::Unidentified(native_code),
+        VK_OEM_PLUS => Key::Unidentified(native_code),
+        VK_OEM_COMMA => Key::Unidentified(native_code),
+        VK_OEM_MINUS => Key::Unidentified(native_code),
+        VK_OEM_PERIOD => Key::Unidentified(native_code),
+        VK_OEM_2 => Key::Unidentified(native_code),
+        VK_OEM_3 => Key::Unidentified(native_code),
+
+        VK_GAMEPAD_A => Key::Unidentified(native_code),
+        VK_GAMEPAD_B => Key::Unidentified(native_code),
+        VK_GAMEPAD_X => Key::Unidentified(native_code),
+        VK_GAMEPAD_Y => Key::Unidentified(native_code),
+        VK_GAMEPAD_RIGHT_SHOULDER => Key::Unidentified(native_code),
+        VK_GAMEPAD_LEFT_SHOULDER => Key::Unidentified(native_code),
+        VK_GAMEPAD_LEFT_TRIGGER => Key::Unidentified(native_code),
+        VK_GAMEPAD_RIGHT_TRIGGER => Key::Unidentified(native_code),
+        VK_GAMEPAD_DPAD_UP => Key::Unidentified(native_code),
+        VK_GAMEPAD_DPAD_DOWN => Key::Unidentified(native_code),
+        VK_GAMEPAD_DPAD_LEFT => Key::Unidentified(native_code),
+        VK_GAMEPAD_DPAD_RIGHT => Key::Unidentified(native_code),
+        VK_GAMEPAD_MENU => Key::Unidentified(native_code),
+        VK_GAMEPAD_VIEW => Key::Unidentified(native_code),
+        VK_GAMEPAD_LEFT_THUMBSTICK_BUTTON => Key::Unidentified(native_code),
+        VK_GAMEPAD_RIGHT_THUMBSTICK_BUTTON => Key::Unidentified(native_code),
+        VK_GAMEPAD_LEFT_THUMBSTICK_UP => Key::Unidentified(native_code),
+        VK_GAMEPAD_LEFT_THUMBSTICK_DOWN => Key::Unidentified(native_code),
+        VK_GAMEPAD_LEFT_THUMBSTICK_RIGHT => Key::Unidentified(native_code),
+        VK_GAMEPAD_LEFT_THUMBSTICK_LEFT => Key::Unidentified(native_code),
+        VK_GAMEPAD_RIGHT_THUMBSTICK_UP => Key::Unidentified(native_code),
+        VK_GAMEPAD_RIGHT_THUMBSTICK_DOWN => Key::Unidentified(native_code),
+        VK_GAMEPAD_RIGHT_THUMBSTICK_RIGHT => Key::Unidentified(native_code),
+        VK_GAMEPAD_RIGHT_THUMBSTICK_LEFT => Key::Unidentified(native_code),
+
+        // This function only converts "non-printable"
+        VK_OEM_4 => Key::Unidentified(native_code),
+        VK_OEM_5 => Key::Unidentified(native_code),
+        VK_OEM_6 => Key::Unidentified(native_code),
+        VK_OEM_7 => Key::Unidentified(native_code),
+        VK_OEM_8 => Key::Unidentified(native_code),
+        VK_OEM_AX => Key::Unidentified(native_code),
+        VK_OEM_102 => Key::Unidentified(native_code),
+
+        VK_ICO_HELP => Key::Unidentified(native_code),
+        VK_ICO_00 => Key::Unidentified(native_code),
+
+        VK_PROCESSKEY => Key::Named(NamedKey::Process),
+
+        VK_ICO_CLEAR => Key::Unidentified(native_code),
+        VK_PACKET => Key::Unidentified(native_code),
+        VK_OEM_RESET => Key::Unidentified(native_code),
+        VK_OEM_JUMP => Key::Unidentified(native_code),
+        VK_OEM_PA1 => Key::Unidentified(native_code),
+        VK_OEM_PA2 => Key::Unidentified(native_code),
+        VK_OEM_PA3 => Key::Unidentified(native_code),
+        VK_OEM_WSCTRL => Key::Unidentified(native_code),
+        VK_OEM_CUSEL => Key::Unidentified(native_code),
+
+        VK_OEM_ATTN => Key::Named(NamedKey::Attn),
+        VK_OEM_FINISH => {
+            if is_japanese {
+                Key::Named(NamedKey::Katakana)
+            } else {
+                // This matches IE and Firefox behaviour according to
+                // https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/key/Key_Values
+                // At the time of writing, there is no `NamedKey::Finish` variant as
+                // Finish is not mentioned at https://w3c.github.io/uievents-key/
+                // Also see: https://github.com/pyfisch/keyboard-types/issues/9
+                Key::Unidentified(native_code)
+            }
+        },
+        VK_OEM_COPY => Key::Named(NamedKey::Copy),
+        VK_OEM_AUTO => Key::Named(NamedKey::Hankaku),
+        VK_OEM_ENLW => Key::Named(NamedKey::Zenkaku),
+        VK_OEM_BACKTAB => Key::Named(NamedKey::Romaji),
+        VK_ATTN => Key::Named(NamedKey::KanaMode),
+        VK_CRSEL => Key::Named(NamedKey::CrSel),
+        VK_EXSEL => Key::Named(NamedKey::ExSel),
+        VK_EREOF => Key::Named(NamedKey::EraseEof),
+        VK_PLAY => Key::Named(NamedKey::Play),
+        VK_ZOOM => Key::Named(NamedKey::ZoomToggle),
+        VK_NONAME => Key::Unidentified(native_code),
+        VK_PA1 => Key::Unidentified(native_code),
+        VK_OEM_CLEAR => Key::Named(NamedKey::Clear),
+        _ => Key::Unidentified(native_code),
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/minimal_ime.rs b/vendor/winit/src/platform_impl/windows/minimal_ime.rs
new file mode 100644
index 00000000..71600abb
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/minimal_ime.rs
@@ -0,0 +1,67 @@
+use std::sync::{
+    atomic::{AtomicBool, Ordering::Relaxed},
+    Mutex,
+};
+
+use winapi::{
+    shared::{
+        minwindef::{LPARAM, WPARAM},
+        windef::HWND,
+    },
+    um::winuser,
+};
+
+use crate::platform_impl::platform::{event_loop::ProcResult, keyboard::next_kbd_msg};
+
+pub struct MinimalIme {
+    // True if we're currently receiving messages belonging to a finished IME session.
+    getting_ime_text: AtomicBool,
+
+    utf16parts: Mutex<Vec<u16>>,
+}
+impl Default for MinimalIme {
+    fn default() -> Self {
+        MinimalIme {
+            getting_ime_text: AtomicBool::new(false),
+            utf16parts: Mutex::new(Vec::with_capacity(16)),
+        }
+    }
+}
+impl MinimalIme {
+    pub(crate) fn process_message(
+        &self,
+        hwnd: HWND,
+        msg_kind: u32,
+        wparam: WPARAM,
+        _lparam: LPARAM,
+        result: &mut ProcResult,
+    ) -> Option<String> {
+        match msg_kind {
+            winuser::WM_IME_ENDCOMPOSITION => {
+                self.getting_ime_text.store(true, Relaxed);
+            }
+            winuser::WM_CHAR | winuser::WM_SYSCHAR => {
+                if self.getting_ime_text.load(Relaxed) {
+                    *result = ProcResult::Value(0);
+                    self.utf16parts.lock().unwrap().push(wparam as u16);
+                    // It's important that we push the new character and release the lock
+                    // before getting the next message
+                    let next_msg = next_kbd_msg(hwnd);
+                    let more_char_coming = next_msg
+                        .map(|m| matches!(m.message, winuser::WM_CHAR | winuser::WM_SYSCHAR))
+                        .unwrap_or(false);
+                    if !more_char_coming {
+                        let mut utf16parts = self.utf16parts.lock().unwrap();
+                        let result = String::from_utf16(&utf16parts).ok();
+                        utf16parts.clear();
+                        self.getting_ime_text.store(false, Relaxed);
+                        return result;
+                    }
+                }
+            }
+            _ => (),
+        }
+
+        None
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/mod.rs b/vendor/winit/src/platform_impl/windows/mod.rs
new file mode 100644
index 00000000..9bb02fd4
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/mod.rs
@@ -0,0 +1,196 @@
+use smol_str::SmolStr;
+use windows_sys::Win32::Foundation::{HANDLE, HWND};
+use windows_sys::Win32::UI::WindowsAndMessaging::{HMENU, WINDOW_LONG_PTR_INDEX};
+
+pub(crate) use self::event_loop::{
+    ActiveEventLoop, EventLoop, EventLoopProxy, OwnedDisplayHandle,
+    PlatformSpecificEventLoopAttributes,
+};
+pub(crate) use self::icon::{SelectedCursor, WinIcon};
+pub(crate) use self::keyboard::{physicalkey_to_scancode, scancode_to_physicalkey};
+pub(crate) use self::monitor::{MonitorHandle, VideoModeHandle};
+pub(crate) use self::window::Window;
+
+pub(crate) use self::icon::WinCursor as PlatformCustomCursor;
+pub use self::icon::WinIcon as PlatformIcon;
+pub(crate) use crate::cursor::OnlyCursorImageSource as PlatformCustomCursorSource;
+use crate::platform_impl::Fullscreen;
+
+use crate::event::DeviceId as RootDeviceId;
+use crate::icon::Icon;
+use crate::keyboard::Key;
+use crate::platform::windows::{BackdropType, Color, CornerPreference};
+
+#[derive(Clone, Debug)]
+pub struct PlatformSpecificWindowAttributes {
+    pub owner: Option<HWND>,
+    pub menu: Option<HMENU>,
+    pub taskbar_icon: Option<Icon>,
+    pub no_redirection_bitmap: bool,
+    pub drag_and_drop: bool,
+    pub skip_taskbar: bool,
+    pub class_name: String,
+    pub decoration_shadow: bool,
+    pub backdrop_type: BackdropType,
+    pub clip_children: bool,
+    pub border_color: Option<Color>,
+    pub title_background_color: Option<Color>,
+    pub title_text_color: Option<Color>,
+    pub corner_preference: Option<CornerPreference>,
+}
+
+impl Default for PlatformSpecificWindowAttributes {
+    fn default() -> Self {
+        Self {
+            owner: None,
+            menu: None,
+            taskbar_icon: None,
+            no_redirection_bitmap: false,
+            drag_and_drop: true,
+            skip_taskbar: false,
+            class_name: "Window Class".to_string(),
+            decoration_shadow: false,
+            backdrop_type: BackdropType::default(),
+            clip_children: true,
+            border_color: None,
+            title_background_color: None,
+            title_text_color: None,
+            corner_preference: None,
+        }
+    }
+}
+
+unsafe impl Send for PlatformSpecificWindowAttributes {}
+unsafe impl Sync for PlatformSpecificWindowAttributes {}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct DeviceId(u32);
+
+impl DeviceId {
+    pub const fn dummy() -> Self {
+        DeviceId(0)
+    }
+}
+
+impl DeviceId {
+    pub fn persistent_identifier(&self) -> Option<String> {
+        if self.0 != 0 {
+            raw_input::get_raw_input_device_name(self.0 as HANDLE)
+        } else {
+            None
+        }
+    }
+}
+
+// Constant device ID, to be removed when this backend is updated to report real device IDs.
+const DEVICE_ID: RootDeviceId = RootDeviceId(DeviceId(0));
+
+fn wrap_device_id(id: u32) -> RootDeviceId {
+    RootDeviceId(DeviceId(id))
+}
+
+pub type OsError = std::io::Error;
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub struct KeyEventExtra {
+    pub text_with_all_modifiers: Option<SmolStr>,
+    pub key_without_modifiers: Key,
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct WindowId(HWND);
+unsafe impl Send for WindowId {}
+unsafe impl Sync for WindowId {}
+
+impl WindowId {
+    pub const fn dummy() -> Self {
+        WindowId(0)
+    }
+}
+
+impl From<WindowId> for u64 {
+    fn from(window_id: WindowId) -> Self {
+        window_id.0 as u64
+    }
+}
+
+impl From<WindowId> for HWND {
+    fn from(window_id: WindowId) -> Self {
+        window_id.0
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(raw_id: u64) -> Self {
+        Self(raw_id as HWND)
+    }
+}
+
+#[inline(always)]
+const fn get_xbutton_wparam(x: u32) -> u16 {
+    hiword(x)
+}
+
+#[inline(always)]
+const fn get_x_lparam(x: u32) -> i16 {
+    loword(x) as _
+}
+
+#[inline(always)]
+const fn get_y_lparam(x: u32) -> i16 {
+    hiword(x) as _
+}
+
+#[inline(always)]
+pub(crate) const fn primarylangid(lgid: u16) -> u16 {
+    lgid & 0x3ff
+}
+
+#[inline(always)]
+pub(crate) const fn loword(x: u32) -> u16 {
+    (x & 0xffff) as u16
+}
+
+#[inline(always)]
+const fn hiword(x: u32) -> u16 {
+    ((x >> 16) & 0xffff) as u16
+}
+
+#[inline(always)]
+unsafe fn get_window_long(hwnd: HWND, nindex: WINDOW_LONG_PTR_INDEX) -> isize {
+    #[cfg(target_pointer_width = "64")]
+    return unsafe { windows_sys::Win32::UI::WindowsAndMessaging::GetWindowLongPtrW(hwnd, nindex) };
+    #[cfg(target_pointer_width = "32")]
+    return unsafe {
+        windows_sys::Win32::UI::WindowsAndMessaging::GetWindowLongW(hwnd, nindex) as isize
+    };
+}
+
+#[inline(always)]
+unsafe fn set_window_long(hwnd: HWND, nindex: WINDOW_LONG_PTR_INDEX, dwnewlong: isize) -> isize {
+    #[cfg(target_pointer_width = "64")]
+    return unsafe {
+        windows_sys::Win32::UI::WindowsAndMessaging::SetWindowLongPtrW(hwnd, nindex, dwnewlong)
+    };
+    #[cfg(target_pointer_width = "32")]
+    return unsafe {
+        windows_sys::Win32::UI::WindowsAndMessaging::SetWindowLongW(hwnd, nindex, dwnewlong as i32)
+            as isize
+    };
+}
+
+#[macro_use]
+mod util;
+mod dark_mode;
+mod definitions;
+mod dpi;
+mod drop_handler;
+mod event_loop;
+mod icon;
+mod ime;
+mod keyboard;
+mod keyboard_layout;
+mod monitor;
+mod raw_input;
+mod window;
+mod window_state;
diff --git a/vendor/winit/src/platform_impl/windows/monitor.rs b/vendor/winit/src/platform_impl/windows/monitor.rs
new file mode 100644
index 00000000..9a880db4
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/monitor.rs
@@ -0,0 +1,256 @@
+use std::collections::{BTreeSet, VecDeque};
+use std::hash::Hash;
+use std::{io, mem, ptr};
+
+use windows_sys::Win32::Foundation::{BOOL, HWND, LPARAM, POINT, RECT};
+use windows_sys::Win32::Graphics::Gdi::{
+    EnumDisplayMonitors, EnumDisplaySettingsExW, GetMonitorInfoW, MonitorFromPoint,
+    MonitorFromWindow, DEVMODEW, DM_BITSPERPEL, DM_DISPLAYFREQUENCY, DM_PELSHEIGHT, DM_PELSWIDTH,
+    ENUM_CURRENT_SETTINGS, HDC, HMONITOR, MONITORINFO, MONITORINFOEXW, MONITOR_DEFAULTTONEAREST,
+    MONITOR_DEFAULTTOPRIMARY,
+};
+
+use super::util::decode_wide;
+use crate::dpi::{PhysicalPosition, PhysicalSize};
+use crate::monitor::VideoModeHandle as RootVideoModeHandle;
+use crate::platform_impl::platform::dpi::{dpi_to_scale_factor, get_monitor_dpi};
+use crate::platform_impl::platform::util::has_flag;
+use crate::platform_impl::platform::window::Window;
+
+#[derive(Clone)]
+pub struct VideoModeHandle {
+    pub(crate) size: (u32, u32),
+    pub(crate) bit_depth: u16,
+    pub(crate) refresh_rate_millihertz: u32,
+    pub(crate) monitor: MonitorHandle,
+    // DEVMODEW is huge so we box it to avoid blowing up the size of winit::window::Fullscreen
+    pub(crate) native_video_mode: Box<DEVMODEW>,
+}
+
+impl PartialEq for VideoModeHandle {
+    fn eq(&self, other: &Self) -> bool {
+        self.size == other.size
+            && self.bit_depth == other.bit_depth
+            && self.refresh_rate_millihertz == other.refresh_rate_millihertz
+            && self.monitor == other.monitor
+    }
+}
+
+impl Eq for VideoModeHandle {}
+
+impl std::hash::Hash for VideoModeHandle {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.size.hash(state);
+        self.bit_depth.hash(state);
+        self.refresh_rate_millihertz.hash(state);
+        self.monitor.hash(state);
+    }
+}
+
+impl std::fmt::Debug for VideoModeHandle {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("VideoModeHandle")
+            .field("size", &self.size)
+            .field("bit_depth", &self.bit_depth)
+            .field("refresh_rate_millihertz", &self.refresh_rate_millihertz)
+            .field("monitor", &self.monitor)
+            .finish()
+    }
+}
+
+impl VideoModeHandle {
+    pub fn size(&self) -> PhysicalSize<u32> {
+        self.size.into()
+    }
+
+    pub fn bit_depth(&self) -> u16 {
+        self.bit_depth
+    }
+
+    pub fn refresh_rate_millihertz(&self) -> u32 {
+        self.refresh_rate_millihertz
+    }
+
+    pub fn monitor(&self) -> MonitorHandle {
+        self.monitor.clone()
+    }
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash, PartialOrd, Ord)]
+pub struct MonitorHandle(HMONITOR);
+
+// Send is not implemented for HMONITOR, we have to wrap it and implement it manually.
+// For more info see:
+// https://github.com/retep998/winapi-rs/issues/360
+// https://github.com/retep998/winapi-rs/issues/396
+
+unsafe impl Send for MonitorHandle {}
+
+unsafe extern "system" fn monitor_enum_proc(
+    hmonitor: HMONITOR,
+    _hdc: HDC,
+    _place: *mut RECT,
+    data: LPARAM,
+) -> BOOL {
+    let monitors = data as *mut VecDeque<MonitorHandle>;
+    unsafe { (*monitors).push_back(MonitorHandle::new(hmonitor)) };
+    true.into() // continue enumeration
+}
+
+pub fn available_monitors() -> VecDeque<MonitorHandle> {
+    let mut monitors: VecDeque<MonitorHandle> = VecDeque::new();
+    unsafe {
+        EnumDisplayMonitors(
+            0,
+            ptr::null(),
+            Some(monitor_enum_proc),
+            &mut monitors as *mut _ as LPARAM,
+        );
+    }
+    monitors
+}
+
+pub fn primary_monitor() -> MonitorHandle {
+    const ORIGIN: POINT = POINT { x: 0, y: 0 };
+    let hmonitor = unsafe { MonitorFromPoint(ORIGIN, MONITOR_DEFAULTTOPRIMARY) };
+    MonitorHandle::new(hmonitor)
+}
+
+pub fn current_monitor(hwnd: HWND) -> MonitorHandle {
+    let hmonitor = unsafe { MonitorFromWindow(hwnd, MONITOR_DEFAULTTONEAREST) };
+    MonitorHandle::new(hmonitor)
+}
+
+impl Window {
+    pub fn available_monitors(&self) -> VecDeque<MonitorHandle> {
+        available_monitors()
+    }
+
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        let monitor = primary_monitor();
+        Some(monitor)
+    }
+}
+
+pub(crate) fn get_monitor_info(hmonitor: HMONITOR) -> Result<MONITORINFOEXW, io::Error> {
+    let mut monitor_info: MONITORINFOEXW = unsafe { mem::zeroed() };
+    monitor_info.monitorInfo.cbSize = mem::size_of::<MONITORINFOEXW>() as u32;
+    let status = unsafe {
+        GetMonitorInfoW(hmonitor, &mut monitor_info as *mut MONITORINFOEXW as *mut MONITORINFO)
+    };
+    if status == false.into() {
+        Err(io::Error::last_os_error())
+    } else {
+        Ok(monitor_info)
+    }
+}
+
+impl MonitorHandle {
+    pub(crate) fn new(hmonitor: HMONITOR) -> Self {
+        MonitorHandle(hmonitor)
+    }
+
+    #[inline]
+    pub fn name(&self) -> Option<String> {
+        let monitor_info = get_monitor_info(self.0).unwrap();
+        Some(decode_wide(&monitor_info.szDevice).to_string_lossy().to_string())
+    }
+
+    #[inline]
+    pub fn native_identifier(&self) -> String {
+        self.name().unwrap()
+    }
+
+    #[inline]
+    pub fn hmonitor(&self) -> HMONITOR {
+        self.0
+    }
+
+    #[inline]
+    pub fn size(&self) -> PhysicalSize<u32> {
+        let rc_monitor = get_monitor_info(self.0).unwrap().monitorInfo.rcMonitor;
+        PhysicalSize {
+            width: (rc_monitor.right - rc_monitor.left) as u32,
+            height: (rc_monitor.bottom - rc_monitor.top) as u32,
+        }
+    }
+
+    #[inline]
+    pub fn refresh_rate_millihertz(&self) -> Option<u32> {
+        let monitor_info = get_monitor_info(self.0).ok()?;
+        let device_name = monitor_info.szDevice.as_ptr();
+        unsafe {
+            let mut mode: DEVMODEW = mem::zeroed();
+            mode.dmSize = mem::size_of_val(&mode) as u16;
+            if EnumDisplaySettingsExW(device_name, ENUM_CURRENT_SETTINGS, &mut mode, 0)
+                == false.into()
+            {
+                None
+            } else {
+                Some(mode.dmDisplayFrequency * 1000)
+            }
+        }
+    }
+
+    #[inline]
+    pub fn position(&self) -> PhysicalPosition<i32> {
+        get_monitor_info(self.0)
+            .map(|info| {
+                let rc_monitor = info.monitorInfo.rcMonitor;
+                PhysicalPosition { x: rc_monitor.left, y: rc_monitor.top }
+            })
+            .unwrap_or(PhysicalPosition { x: 0, y: 0 })
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        dpi_to_scale_factor(get_monitor_dpi(self.0).unwrap_or(96))
+    }
+
+    #[inline]
+    pub fn video_modes(&self) -> impl Iterator<Item = VideoModeHandle> {
+        // EnumDisplaySettingsExW can return duplicate values (or some of the
+        // fields are probably changing, but we aren't looking at those fields
+        // anyway), so we're using a BTreeSet deduplicate
+        let mut modes = BTreeSet::<RootVideoModeHandle>::new();
+        let mod_map = |mode: RootVideoModeHandle| mode.video_mode;
+
+        let monitor_info = match get_monitor_info(self.0) {
+            Ok(monitor_info) => monitor_info,
+            Err(error) => {
+                tracing::warn!("Error from get_monitor_info: {error}");
+                return modes.into_iter().map(mod_map);
+            },
+        };
+
+        let device_name = monitor_info.szDevice.as_ptr();
+
+        let mut i = 0;
+        loop {
+            let mut mode: DEVMODEW = unsafe { mem::zeroed() };
+            mode.dmSize = mem::size_of_val(&mode) as u16;
+            if unsafe { EnumDisplaySettingsExW(device_name, i, &mut mode, 0) } == false.into() {
+                break;
+            }
+
+            const REQUIRED_FIELDS: u32 =
+                DM_BITSPERPEL | DM_PELSWIDTH | DM_PELSHEIGHT | DM_DISPLAYFREQUENCY;
+            assert!(has_flag(mode.dmFields, REQUIRED_FIELDS));
+
+            // Use Ord impl of RootVideoModeHandle
+            modes.insert(RootVideoModeHandle {
+                video_mode: VideoModeHandle {
+                    size: (mode.dmPelsWidth, mode.dmPelsHeight),
+                    bit_depth: mode.dmBitsPerPel as u16,
+                    refresh_rate_millihertz: mode.dmDisplayFrequency * 1000,
+                    monitor: self.clone(),
+                    native_video_mode: Box::new(mode),
+                },
+            });
+
+            i += 1;
+        }
+
+        modes.into_iter().map(mod_map)
+    }
+}
diff --git a/vendor/winit/src/platform_impl/windows/raw_input.rs b/vendor/winit/src/platform_impl/windows/raw_input.rs
new file mode 100644
index 00000000..f78a7bb0
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/raw_input.rs
@@ -0,0 +1,301 @@
+use std::mem::{self, size_of};
+use std::ptr;
+
+use windows_sys::Win32::Devices::HumanInterfaceDevice::{
+    HID_USAGE_GENERIC_KEYBOARD, HID_USAGE_GENERIC_MOUSE, HID_USAGE_PAGE_GENERIC,
+};
+use windows_sys::Win32::Foundation::{HANDLE, HWND};
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::{
+    MapVirtualKeyW, MAPVK_VK_TO_VSC_EX, VK_NUMLOCK, VK_SHIFT,
+};
+use windows_sys::Win32::UI::Input::{
+    GetRawInputData, GetRawInputDeviceInfoW, GetRawInputDeviceList, RegisterRawInputDevices,
+    HRAWINPUT, RAWINPUT, RAWINPUTDEVICE, RAWINPUTDEVICELIST, RAWINPUTHEADER, RAWKEYBOARD,
+    RIDEV_DEVNOTIFY, RIDEV_INPUTSINK, RIDEV_REMOVE, RIDI_DEVICEINFO, RIDI_DEVICENAME,
+    RID_DEVICE_INFO, RID_DEVICE_INFO_HID, RID_DEVICE_INFO_KEYBOARD, RID_DEVICE_INFO_MOUSE,
+    RID_INPUT, RIM_TYPEHID, RIM_TYPEKEYBOARD, RIM_TYPEMOUSE,
+};
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    RI_KEY_E0, RI_KEY_E1, RI_MOUSE_BUTTON_1_DOWN, RI_MOUSE_BUTTON_1_UP, RI_MOUSE_BUTTON_2_DOWN,
+    RI_MOUSE_BUTTON_2_UP, RI_MOUSE_BUTTON_3_DOWN, RI_MOUSE_BUTTON_3_UP, RI_MOUSE_BUTTON_4_DOWN,
+    RI_MOUSE_BUTTON_4_UP, RI_MOUSE_BUTTON_5_DOWN, RI_MOUSE_BUTTON_5_UP,
+};
+
+use super::scancode_to_physicalkey;
+use crate::event::ElementState;
+use crate::event_loop::DeviceEvents;
+use crate::keyboard::{KeyCode, PhysicalKey};
+use crate::platform_impl::platform::util;
+
+#[allow(dead_code)]
+pub fn get_raw_input_device_list() -> Option<Vec<RAWINPUTDEVICELIST>> {
+    let list_size = size_of::<RAWINPUTDEVICELIST>() as u32;
+
+    let mut num_devices = 0;
+    let status = unsafe { GetRawInputDeviceList(ptr::null_mut(), &mut num_devices, list_size) };
+
+    if status == u32::MAX {
+        return None;
+    }
+
+    let mut buffer = Vec::with_capacity(num_devices as _);
+
+    let num_stored =
+        unsafe { GetRawInputDeviceList(buffer.as_mut_ptr(), &mut num_devices, list_size) };
+
+    if num_stored == u32::MAX {
+        return None;
+    }
+
+    debug_assert_eq!(num_devices, num_stored);
+
+    unsafe { buffer.set_len(num_devices as _) };
+
+    Some(buffer)
+}
+
+#[allow(dead_code)]
+pub enum RawDeviceInfo {
+    Mouse(RID_DEVICE_INFO_MOUSE),
+    Keyboard(RID_DEVICE_INFO_KEYBOARD),
+    Hid(RID_DEVICE_INFO_HID),
+}
+
+impl From<RID_DEVICE_INFO> for RawDeviceInfo {
+    fn from(info: RID_DEVICE_INFO) -> Self {
+        unsafe {
+            match info.dwType {
+                RIM_TYPEMOUSE => RawDeviceInfo::Mouse(info.Anonymous.mouse),
+                RIM_TYPEKEYBOARD => RawDeviceInfo::Keyboard(info.Anonymous.keyboard),
+                RIM_TYPEHID => RawDeviceInfo::Hid(info.Anonymous.hid),
+                _ => unreachable!(),
+            }
+        }
+    }
+}
+
+#[allow(dead_code)]
+pub fn get_raw_input_device_info(handle: HANDLE) -> Option<RawDeviceInfo> {
+    let mut info: RID_DEVICE_INFO = unsafe { mem::zeroed() };
+    let info_size = size_of::<RID_DEVICE_INFO>() as u32;
+
+    info.cbSize = info_size;
+
+    let mut minimum_size = 0;
+    let status = unsafe {
+        GetRawInputDeviceInfoW(handle, RIDI_DEVICEINFO, &mut info as *mut _ as _, &mut minimum_size)
+    };
+
+    if status == u32::MAX || status == 0 {
+        return None;
+    }
+
+    debug_assert_eq!(info_size, status);
+
+    Some(info.into())
+}
+
+pub fn get_raw_input_device_name(handle: HANDLE) -> Option<String> {
+    let mut minimum_size = 0;
+    let status = unsafe {
+        GetRawInputDeviceInfoW(handle, RIDI_DEVICENAME, ptr::null_mut(), &mut minimum_size)
+    };
+
+    if status != 0 {
+        return None;
+    }
+
+    let mut name: Vec<u16> = Vec::with_capacity(minimum_size as _);
+
+    let status = unsafe {
+        GetRawInputDeviceInfoW(handle, RIDI_DEVICENAME, name.as_ptr() as _, &mut minimum_size)
+    };
+
+    if status == u32::MAX || status == 0 {
+        return None;
+    }
+
+    debug_assert_eq!(minimum_size, status);
+
+    unsafe { name.set_len(minimum_size as _) };
+
+    util::decode_wide(&name).into_string().ok()
+}
+
+pub fn register_raw_input_devices(devices: &[RAWINPUTDEVICE]) -> bool {
+    let device_size = size_of::<RAWINPUTDEVICE>() as u32;
+
+    unsafe {
+        RegisterRawInputDevices(devices.as_ptr(), devices.len() as u32, device_size) == true.into()
+    }
+}
+
+pub fn register_all_mice_and_keyboards_for_raw_input(
+    mut window_handle: HWND,
+    filter: DeviceEvents,
+) -> bool {
+    // RIDEV_DEVNOTIFY: receive hotplug events
+    // RIDEV_INPUTSINK: receive events even if we're not in the foreground
+    // RIDEV_REMOVE: don't receive device events (requires NULL hwndTarget)
+    let flags = match filter {
+        DeviceEvents::Never => {
+            window_handle = 0;
+            RIDEV_REMOVE
+        },
+        DeviceEvents::WhenFocused => RIDEV_DEVNOTIFY,
+        DeviceEvents::Always => RIDEV_DEVNOTIFY | RIDEV_INPUTSINK,
+    };
+
+    let devices: [RAWINPUTDEVICE; 2] = [
+        RAWINPUTDEVICE {
+            usUsagePage: HID_USAGE_PAGE_GENERIC,
+            usUsage: HID_USAGE_GENERIC_MOUSE,
+            dwFlags: flags,
+            hwndTarget: window_handle,
+        },
+        RAWINPUTDEVICE {
+            usUsagePage: HID_USAGE_PAGE_GENERIC,
+            usUsage: HID_USAGE_GENERIC_KEYBOARD,
+            dwFlags: flags,
+            hwndTarget: window_handle,
+        },
+    ];
+
+    register_raw_input_devices(&devices)
+}
+
+pub fn get_raw_input_data(handle: HRAWINPUT) -> Option<RAWINPUT> {
+    let mut data: RAWINPUT = unsafe { mem::zeroed() };
+    let mut data_size = size_of::<RAWINPUT>() as u32;
+    let header_size = size_of::<RAWINPUTHEADER>() as u32;
+
+    let status = unsafe {
+        GetRawInputData(handle, RID_INPUT, &mut data as *mut _ as _, &mut data_size, header_size)
+    };
+
+    if status == u32::MAX || status == 0 {
+        return None;
+    }
+
+    Some(data)
+}
+
+fn button_flags_to_element_state(
+    button_flags: u32,
+    down_flag: u32,
+    up_flag: u32,
+) -> Option<ElementState> {
+    // We assume the same button won't be simultaneously pressed and released.
+    if util::has_flag(button_flags, down_flag) {
+        Some(ElementState::Pressed)
+    } else if util::has_flag(button_flags, up_flag) {
+        Some(ElementState::Released)
+    } else {
+        None
+    }
+}
+
+pub fn get_raw_mouse_button_state(button_flags: u32) -> [Option<ElementState>; 5] {
+    [
+        button_flags_to_element_state(button_flags, RI_MOUSE_BUTTON_1_DOWN, RI_MOUSE_BUTTON_1_UP),
+        button_flags_to_element_state(button_flags, RI_MOUSE_BUTTON_2_DOWN, RI_MOUSE_BUTTON_2_UP),
+        button_flags_to_element_state(button_flags, RI_MOUSE_BUTTON_3_DOWN, RI_MOUSE_BUTTON_3_UP),
+        button_flags_to_element_state(button_flags, RI_MOUSE_BUTTON_4_DOWN, RI_MOUSE_BUTTON_4_UP),
+        button_flags_to_element_state(button_flags, RI_MOUSE_BUTTON_5_DOWN, RI_MOUSE_BUTTON_5_UP),
+    ]
+}
+
+pub fn get_keyboard_physical_key(keyboard: RAWKEYBOARD) -> Option<PhysicalKey> {
+    let extension = {
+        if util::has_flag(keyboard.Flags, RI_KEY_E0 as _) {
+            0xe000
+        } else if util::has_flag(keyboard.Flags, RI_KEY_E1 as _) {
+            0xe100
+        } else {
+            0x0000
+        }
+    };
+    let scancode = if keyboard.MakeCode == 0 {
+        // In some cases (often with media keys) the device reports a scancode of 0 but a
+        // valid virtual key. In these cases we obtain the scancode from the virtual key.
+        unsafe { MapVirtualKeyW(keyboard.VKey as u32, MAPVK_VK_TO_VSC_EX) as u16 }
+    } else {
+        keyboard.MakeCode | extension
+    };
+    if scancode == 0xe11d || scancode == 0xe02a {
+        // At the hardware (or driver?) level, pressing the Pause key is equivalent to pressing
+        // Ctrl+NumLock.
+        // This equivalence means that if the user presses Pause, the keyboard will emit two
+        // subsequent keypresses:
+        // 1, 0xE11D - Which is a left Ctrl (0x1D) with an extension flag (0xE100)
+        // 2, 0x0045 - Which on its own can be interpreted as Pause
+        //
+        // There's another combination which isn't quite an equivalence:
+        // PrtSc used to be Shift+Asterisk. This means that on some keyboards, pressing
+        // PrtSc (print screen) produces the following sequence:
+        // 1, 0xE02A - Which is a left shift (0x2A) with an extension flag (0xE000)
+        // 2, 0xE037 - Which is a numpad multiply (0x37) with an extension flag (0xE000). This on
+        //             its own it can be interpreted as PrtSc
+        //
+        // For this reason, if we encounter the first keypress, we simply ignore it, trusting
+        // that there's going to be another event coming, from which we can extract the
+        // appropriate key.
+        // For more on this, read the article by Raymond Chen, titled:
+        // "Why does Ctrl+ScrollLock cancel dialogs?"
+        // https://devblogs.microsoft.com/oldnewthing/20080211-00/?p=23503
+        return None;
+    }
+    let physical_key = if keyboard.VKey == VK_NUMLOCK {
+        // Historically, the NumLock and the Pause key were one and the same physical key.
+        // The user could trigger Pause by pressing Ctrl+NumLock.
+        // Now these are often physically separate and the two keys can be differentiated by
+        // checking the extension flag of the scancode. NumLock is 0xE045, Pause is 0x0045.
+        //
+        // However in this event, both keys are reported as 0x0045 even on modern hardware.
+        // Therefore we use the virtual key instead to determine whether it's a NumLock and
+        // set the KeyCode accordingly.
+        //
+        // For more on this, read the article by Raymond Chen, titled:
+        // "Why does Ctrl+ScrollLock cancel dialogs?"
+        // https://devblogs.microsoft.com/oldnewthing/20080211-00/?p=23503
+        PhysicalKey::Code(KeyCode::NumLock)
+    } else {
+        scancode_to_physicalkey(scancode as u32)
+    };
+    if keyboard.VKey == VK_SHIFT {
+        if let PhysicalKey::Code(
+            KeyCode::NumpadDecimal
+            | KeyCode::Numpad0
+            | KeyCode::Numpad1
+            | KeyCode::Numpad2
+            | KeyCode::Numpad3
+            | KeyCode::Numpad4
+            | KeyCode::Numpad5
+            | KeyCode::Numpad6
+            | KeyCode::Numpad7
+            | KeyCode::Numpad8
+            | KeyCode::Numpad9,
+        ) = physical_key
+        {
+            // On Windows, holding the Shift key makes numpad keys behave as if NumLock
+            // wasn't active. The way this is exposed to applications by the system is that
+            // the application receives a fake key release event for the shift key at the
+            // moment when the numpad key is pressed, just before receiving the numpad key
+            // as well.
+            //
+            // The issue is that in the raw device event (here), the fake shift release
+            // event reports the numpad key as the scancode. Unfortunately, the event
+            // doesn't have any information to tell whether it's the
+            // left shift or the right shift that needs to get the fake
+            // release (or press) event so we don't forward this
+            // event to the application at all.
+            //
+            // For more on this, read the article by Raymond Chen, titled:
+            // "The shift key overrides NumLock"
+            // https://devblogs.microsoft.com/oldnewthing/20040906-00/?p=37953
+            return None;
+        }
+    }
+
+    Some(physical_key)
+}
diff --git a/vendor/winit/src/platform_impl/windows/util.rs b/vendor/winit/src/platform_impl/windows/util.rs
new file mode 100644
index 00000000..a3a7705d
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/util.rs
@@ -0,0 +1,280 @@
+use std::ffi::{c_void, OsStr, OsString};
+use std::iter::once;
+use std::ops::BitAnd;
+use std::os::windows::prelude::{OsStrExt, OsStringExt};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::{io, mem, ptr};
+
+use crate::utils::Lazy;
+use windows_sys::core::{HRESULT, PCWSTR};
+use windows_sys::Win32::Foundation::{BOOL, HANDLE, HMODULE, HWND, POINT, RECT};
+use windows_sys::Win32::Graphics::Gdi::{ClientToScreen, HMONITOR};
+use windows_sys::Win32::System::LibraryLoader::{GetProcAddress, LoadLibraryA};
+use windows_sys::Win32::System::SystemServices::IMAGE_DOS_HEADER;
+use windows_sys::Win32::UI::HiDpi::{
+    DPI_AWARENESS_CONTEXT, MONITOR_DPI_TYPE, PROCESS_DPI_AWARENESS,
+};
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::GetActiveWindow;
+use windows_sys::Win32::UI::Input::Pointer::{POINTER_INFO, POINTER_PEN_INFO, POINTER_TOUCH_INFO};
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    ClipCursor, GetClientRect, GetClipCursor, GetCursorPos, GetSystemMetrics, GetWindowPlacement,
+    GetWindowRect, IsIconic, ShowCursor, IDC_APPSTARTING, IDC_ARROW, IDC_CROSS, IDC_HAND, IDC_HELP,
+    IDC_IBEAM, IDC_NO, IDC_SIZEALL, IDC_SIZENESW, IDC_SIZENS, IDC_SIZENWSE, IDC_SIZEWE, IDC_WAIT,
+    SM_CXVIRTUALSCREEN, SM_CYVIRTUALSCREEN, SM_XVIRTUALSCREEN, SM_YVIRTUALSCREEN, SW_MAXIMIZE,
+    WINDOWPLACEMENT,
+};
+
+use crate::window::CursorIcon;
+
+pub fn encode_wide(string: impl AsRef<OsStr>) -> Vec<u16> {
+    string.as_ref().encode_wide().chain(once(0)).collect()
+}
+
+pub fn decode_wide(mut wide_c_string: &[u16]) -> OsString {
+    if let Some(null_pos) = wide_c_string.iter().position(|c| *c == 0) {
+        wide_c_string = &wide_c_string[..null_pos];
+    }
+
+    OsString::from_wide(wide_c_string)
+}
+
+pub fn has_flag<T>(bitset: T, flag: T) -> bool
+where
+    T: Copy + PartialEq + BitAnd<T, Output = T>,
+{
+    bitset & flag == flag
+}
+
+pub(crate) fn win_to_err(result: BOOL) -> Result<(), io::Error> {
+    if result != false.into() {
+        Ok(())
+    } else {
+        Err(io::Error::last_os_error())
+    }
+}
+
+pub enum WindowArea {
+    Outer,
+    Inner,
+}
+
+impl WindowArea {
+    pub fn get_rect(self, hwnd: HWND) -> Result<RECT, io::Error> {
+        let mut rect = unsafe { mem::zeroed() };
+
+        match self {
+            WindowArea::Outer => {
+                win_to_err(unsafe { GetWindowRect(hwnd, &mut rect) })?;
+            },
+            WindowArea::Inner => unsafe {
+                let mut top_left = mem::zeroed();
+
+                win_to_err(ClientToScreen(hwnd, &mut top_left))?;
+                win_to_err(GetClientRect(hwnd, &mut rect))?;
+                rect.left += top_left.x;
+                rect.top += top_left.y;
+                rect.right += top_left.x;
+                rect.bottom += top_left.y;
+            },
+        }
+
+        Ok(rect)
+    }
+}
+
+pub fn is_maximized(window: HWND) -> bool {
+    unsafe {
+        let mut placement: WINDOWPLACEMENT = mem::zeroed();
+        placement.length = mem::size_of::<WINDOWPLACEMENT>() as u32;
+        GetWindowPlacement(window, &mut placement);
+        placement.showCmd == SW_MAXIMIZE as u32
+    }
+}
+
+pub fn set_cursor_hidden(hidden: bool) {
+    static HIDDEN: AtomicBool = AtomicBool::new(false);
+    let changed = HIDDEN.swap(hidden, Ordering::SeqCst) ^ hidden;
+    if changed {
+        unsafe { ShowCursor(BOOL::from(!hidden)) };
+    }
+}
+
+pub fn get_cursor_position() -> Result<POINT, io::Error> {
+    unsafe {
+        let mut point: POINT = mem::zeroed();
+        win_to_err(GetCursorPos(&mut point)).map(|_| point)
+    }
+}
+
+pub fn get_cursor_clip() -> Result<RECT, io::Error> {
+    unsafe {
+        let mut rect: RECT = mem::zeroed();
+        win_to_err(GetClipCursor(&mut rect)).map(|_| rect)
+    }
+}
+
+/// Sets the cursor's clip rect.
+///
+/// Note that calling this will automatically dispatch a `WM_MOUSEMOVE` event.
+pub fn set_cursor_clip(rect: Option<RECT>) -> Result<(), io::Error> {
+    unsafe {
+        let rect_ptr = rect.as_ref().map(|r| r as *const RECT).unwrap_or(ptr::null());
+        win_to_err(ClipCursor(rect_ptr))
+    }
+}
+
+pub fn get_desktop_rect() -> RECT {
+    unsafe {
+        let left = GetSystemMetrics(SM_XVIRTUALSCREEN);
+        let top = GetSystemMetrics(SM_YVIRTUALSCREEN);
+        RECT {
+            left,
+            top,
+            right: left + GetSystemMetrics(SM_CXVIRTUALSCREEN),
+            bottom: top + GetSystemMetrics(SM_CYVIRTUALSCREEN),
+        }
+    }
+}
+
+pub fn is_focused(window: HWND) -> bool {
+    window == unsafe { GetActiveWindow() }
+}
+
+pub fn is_minimized(window: HWND) -> bool {
+    unsafe { IsIconic(window) != false.into() }
+}
+
+pub fn get_instance_handle() -> HMODULE {
+    // Gets the instance handle by taking the address of the
+    // pseudo-variable created by the microsoft linker:
+    // https://devblogs.microsoft.com/oldnewthing/20041025-00/?p=37483
+
+    // This is preferred over GetModuleHandle(NULL) because it also works in DLLs:
+    // https://stackoverflow.com/questions/21718027/getmodulehandlenull-vs-hinstance
+
+    extern "C" {
+        static __ImageBase: IMAGE_DOS_HEADER;
+    }
+
+    unsafe { &__ImageBase as *const _ as _ }
+}
+
+pub(crate) fn to_windows_cursor(cursor: CursorIcon) -> PCWSTR {
+    match cursor {
+        CursorIcon::Default => IDC_ARROW,
+        CursorIcon::Pointer => IDC_HAND,
+        CursorIcon::Crosshair => IDC_CROSS,
+        CursorIcon::Text | CursorIcon::VerticalText => IDC_IBEAM,
+        CursorIcon::NotAllowed | CursorIcon::NoDrop => IDC_NO,
+        CursorIcon::Grab | CursorIcon::Grabbing | CursorIcon::Move | CursorIcon::AllScroll => {
+            IDC_SIZEALL
+        },
+        CursorIcon::EResize
+        | CursorIcon::WResize
+        | CursorIcon::EwResize
+        | CursorIcon::ColResize => IDC_SIZEWE,
+        CursorIcon::NResize
+        | CursorIcon::SResize
+        | CursorIcon::NsResize
+        | CursorIcon::RowResize => IDC_SIZENS,
+        CursorIcon::NeResize | CursorIcon::SwResize | CursorIcon::NeswResize => IDC_SIZENESW,
+        CursorIcon::NwResize | CursorIcon::SeResize | CursorIcon::NwseResize => IDC_SIZENWSE,
+        CursorIcon::Wait => IDC_WAIT,
+        CursorIcon::Progress => IDC_APPSTARTING,
+        CursorIcon::Help => IDC_HELP,
+        _ => IDC_ARROW, // use arrow for the missing cases.
+    }
+}
+
+// Helper function to dynamically load function pointer as some functions
+// may not be available on all Windows platforms supported by winit.
+//
+// `library` and `function` must be zero-terminated.
+pub(super) fn get_function_impl(library: &str, function: &str) -> Option<*const c_void> {
+    assert_eq!(library.chars().last(), Some('\0'));
+    assert_eq!(function.chars().last(), Some('\0'));
+
+    // Library names we will use are ASCII so we can use the A version to avoid string conversion.
+    let module = unsafe { LoadLibraryA(library.as_ptr()) };
+    if module == 0 {
+        return None;
+    }
+
+    unsafe { GetProcAddress(module, function.as_ptr()) }.map(|function_ptr| function_ptr as _)
+}
+
+macro_rules! get_function {
+    ($lib:expr, $func:ident) => {
+        crate::platform_impl::platform::util::get_function_impl(
+            concat!($lib, '\0'),
+            concat!(stringify!($func), '\0'),
+        )
+        .map(|f| unsafe { std::mem::transmute::<*const _, $func>(f) })
+    };
+}
+
+pub type SetProcessDPIAware = unsafe extern "system" fn() -> BOOL;
+pub type SetProcessDpiAwareness =
+    unsafe extern "system" fn(value: PROCESS_DPI_AWARENESS) -> HRESULT;
+pub type SetProcessDpiAwarenessContext =
+    unsafe extern "system" fn(value: DPI_AWARENESS_CONTEXT) -> BOOL;
+pub type GetDpiForWindow = unsafe extern "system" fn(hwnd: HWND) -> u32;
+pub type GetDpiForMonitor = unsafe extern "system" fn(
+    hmonitor: HMONITOR,
+    dpi_type: MONITOR_DPI_TYPE,
+    dpi_x: *mut u32,
+    dpi_y: *mut u32,
+) -> HRESULT;
+pub type EnableNonClientDpiScaling = unsafe extern "system" fn(hwnd: HWND) -> BOOL;
+pub type AdjustWindowRectExForDpi = unsafe extern "system" fn(
+    rect: *mut RECT,
+    dw_style: u32,
+    b_menu: BOOL,
+    dw_ex_style: u32,
+    dpi: u32,
+) -> BOOL;
+
+pub type GetPointerFrameInfoHistory = unsafe extern "system" fn(
+    pointer_id: u32,
+    entries_count: *mut u32,
+    pointer_count: *mut u32,
+    pointer_info: *mut POINTER_INFO,
+) -> BOOL;
+
+pub type SkipPointerFrameMessages = unsafe extern "system" fn(pointer_id: u32) -> BOOL;
+pub type GetPointerDeviceRects = unsafe extern "system" fn(
+    device: HANDLE,
+    pointer_device_rect: *mut RECT,
+    display_rect: *mut RECT,
+) -> BOOL;
+
+pub type GetPointerTouchInfo =
+    unsafe extern "system" fn(pointer_id: u32, touch_info: *mut POINTER_TOUCH_INFO) -> BOOL;
+
+pub type GetPointerPenInfo =
+    unsafe extern "system" fn(point_id: u32, pen_info: *mut POINTER_PEN_INFO) -> BOOL;
+
+pub(crate) static GET_DPI_FOR_WINDOW: Lazy<Option<GetDpiForWindow>> =
+    Lazy::new(|| get_function!("user32.dll", GetDpiForWindow));
+pub(crate) static ADJUST_WINDOW_RECT_EX_FOR_DPI: Lazy<Option<AdjustWindowRectExForDpi>> =
+    Lazy::new(|| get_function!("user32.dll", AdjustWindowRectExForDpi));
+pub(crate) static GET_DPI_FOR_MONITOR: Lazy<Option<GetDpiForMonitor>> =
+    Lazy::new(|| get_function!("shcore.dll", GetDpiForMonitor));
+pub(crate) static ENABLE_NON_CLIENT_DPI_SCALING: Lazy<Option<EnableNonClientDpiScaling>> =
+    Lazy::new(|| get_function!("user32.dll", EnableNonClientDpiScaling));
+pub(crate) static SET_PROCESS_DPI_AWARENESS_CONTEXT: Lazy<Option<SetProcessDpiAwarenessContext>> =
+    Lazy::new(|| get_function!("user32.dll", SetProcessDpiAwarenessContext));
+pub(crate) static SET_PROCESS_DPI_AWARENESS: Lazy<Option<SetProcessDpiAwareness>> =
+    Lazy::new(|| get_function!("shcore.dll", SetProcessDpiAwareness));
+pub(crate) static SET_PROCESS_DPI_AWARE: Lazy<Option<SetProcessDPIAware>> =
+    Lazy::new(|| get_function!("user32.dll", SetProcessDPIAware));
+pub(crate) static GET_POINTER_FRAME_INFO_HISTORY: Lazy<Option<GetPointerFrameInfoHistory>> =
+    Lazy::new(|| get_function!("user32.dll", GetPointerFrameInfoHistory));
+pub(crate) static SKIP_POINTER_FRAME_MESSAGES: Lazy<Option<SkipPointerFrameMessages>> =
+    Lazy::new(|| get_function!("user32.dll", SkipPointerFrameMessages));
+pub(crate) static GET_POINTER_DEVICE_RECTS: Lazy<Option<GetPointerDeviceRects>> =
+    Lazy::new(|| get_function!("user32.dll", GetPointerDeviceRects));
+pub(crate) static GET_POINTER_TOUCH_INFO: Lazy<Option<GetPointerTouchInfo>> =
+    Lazy::new(|| get_function!("user32.dll", GetPointerTouchInfo));
+pub(crate) static GET_POINTER_PEN_INFO: Lazy<Option<GetPointerPenInfo>> =
+    Lazy::new(|| get_function!("user32.dll", GetPointerPenInfo));
diff --git a/vendor/winit/src/platform_impl/windows/window.rs b/vendor/winit/src/platform_impl/windows/window.rs
new file mode 100644
index 00000000..228c6f03
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/window.rs
@@ -0,0 +1,1575 @@
+#![cfg(windows_platform)]
+
+use std::cell::Cell;
+use std::ffi::c_void;
+use std::mem::{self, MaybeUninit};
+use std::sync::mpsc::channel;
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::{io, panic, ptr};
+
+use windows_sys::Win32::Foundation::{
+    HWND, LPARAM, OLE_E_WRONGCOMPOBJ, POINT, POINTS, RECT, RPC_E_CHANGED_MODE, S_OK, WPARAM,
+};
+use windows_sys::Win32::Graphics::Dwm::{
+    DwmEnableBlurBehindWindow, DwmSetWindowAttribute, DWMWA_BORDER_COLOR, DWMWA_CAPTION_COLOR,
+    DWMWA_SYSTEMBACKDROP_TYPE, DWMWA_TEXT_COLOR, DWMWA_WINDOW_CORNER_PREFERENCE, DWM_BB_BLURREGION,
+    DWM_BB_ENABLE, DWM_BLURBEHIND, DWM_SYSTEMBACKDROP_TYPE, DWM_WINDOW_CORNER_PREFERENCE,
+};
+use windows_sys::Win32::Graphics::Gdi::{
+    ChangeDisplaySettingsExW, ClientToScreen, CreateRectRgn, DeleteObject, InvalidateRgn,
+    RedrawWindow, CDS_FULLSCREEN, DISP_CHANGE_BADFLAGS, DISP_CHANGE_BADMODE, DISP_CHANGE_BADPARAM,
+    DISP_CHANGE_FAILED, DISP_CHANGE_SUCCESSFUL, RDW_INTERNALPAINT,
+};
+use windows_sys::Win32::System::Com::{
+    CoCreateInstance, CoInitializeEx, CoUninitialize, CLSCTX_ALL, COINIT_APARTMENTTHREADED,
+};
+use windows_sys::Win32::System::Ole::{OleInitialize, RegisterDragDrop};
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::{
+    EnableWindow, GetActiveWindow, MapVirtualKeyW, ReleaseCapture, SendInput, ToUnicode, INPUT,
+    INPUT_0, INPUT_KEYBOARD, KEYBDINPUT, KEYEVENTF_EXTENDEDKEY, KEYEVENTF_KEYUP, MAPVK_VK_TO_VSC,
+    VIRTUAL_KEY, VK_LMENU, VK_MENU, VK_SPACE,
+};
+use windows_sys::Win32::UI::Input::Touch::{RegisterTouchWindow, TWF_WANTPALM};
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    CreateWindowExW, EnableMenuItem, FlashWindowEx, GetClientRect, GetCursorPos,
+    GetForegroundWindow, GetSystemMenu, GetSystemMetrics, GetWindowPlacement, GetWindowTextLengthW,
+    GetWindowTextW, IsWindowVisible, LoadCursorW, PeekMessageW, PostMessageW, RegisterClassExW,
+    SetCursor, SetCursorPos, SetForegroundWindow, SetMenuDefaultItem, SetWindowDisplayAffinity,
+    SetWindowPlacement, SetWindowPos, SetWindowTextW, TrackPopupMenu, CS_HREDRAW, CS_VREDRAW,
+    CW_USEDEFAULT, FLASHWINFO, FLASHW_ALL, FLASHW_STOP, FLASHW_TIMERNOFG, FLASHW_TRAY,
+    GWLP_HINSTANCE, HTBOTTOM, HTBOTTOMLEFT, HTBOTTOMRIGHT, HTCAPTION, HTLEFT, HTRIGHT, HTTOP,
+    HTTOPLEFT, HTTOPRIGHT, MENU_ITEM_STATE, MFS_DISABLED, MFS_ENABLED, MF_BYCOMMAND, NID_READY,
+    PM_NOREMOVE, SC_CLOSE, SC_MAXIMIZE, SC_MINIMIZE, SC_MOVE, SC_RESTORE, SC_SIZE, SM_DIGITIZER,
+    SWP_ASYNCWINDOWPOS, SWP_NOACTIVATE, SWP_NOSIZE, SWP_NOZORDER, TPM_LEFTALIGN, TPM_RETURNCMD,
+    WDA_EXCLUDEFROMCAPTURE, WDA_NONE, WM_NCLBUTTONDOWN, WM_SYSCOMMAND, WNDCLASSEXW,
+};
+
+use tracing::warn;
+
+use crate::cursor::Cursor;
+use crate::dpi::{PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{ExternalError, NotSupportedError, OsError as RootOsError};
+use crate::icon::Icon;
+use crate::platform::windows::{BackdropType, Color, CornerPreference};
+use crate::platform_impl::platform::dark_mode::try_theme;
+use crate::platform_impl::platform::definitions::{
+    CLSID_TaskbarList, IID_ITaskbarList, IID_ITaskbarList2, ITaskbarList, ITaskbarList2,
+};
+use crate::platform_impl::platform::dpi::{
+    dpi_to_scale_factor, enable_non_client_dpi_scaling, hwnd_dpi,
+};
+use crate::platform_impl::platform::drop_handler::FileDropHandler;
+use crate::platform_impl::platform::event_loop::{self, ActiveEventLoop, DESTROY_MSG_ID};
+use crate::platform_impl::platform::icon::{self, IconType, WinCursor};
+use crate::platform_impl::platform::ime::ImeContext;
+use crate::platform_impl::platform::keyboard::KeyEventBuilder;
+use crate::platform_impl::platform::monitor::{self, MonitorHandle};
+use crate::platform_impl::platform::window_state::{
+    CursorFlags, SavedWindow, WindowFlags, WindowState,
+};
+use crate::platform_impl::platform::{util, Fullscreen, SelectedCursor, WindowId};
+use crate::window::{
+    CursorGrabMode, ImePurpose, ResizeDirection, Theme, UserAttentionType, WindowAttributes,
+    WindowButtons, WindowLevel,
+};
+
+/// The Win32 implementation of the main `Window` object.
+pub(crate) struct Window {
+    /// Main handle for the window.
+    window: HWND,
+
+    /// The current window state.
+    window_state: Arc<Mutex<WindowState>>,
+
+    // The events loop proxy.
+    thread_executor: event_loop::EventLoopThreadExecutor,
+}
+
+impl Window {
+    pub(crate) fn new(
+        event_loop: &ActiveEventLoop,
+        w_attr: WindowAttributes,
+    ) -> Result<Window, RootOsError> {
+        // We dispatch an `init` function because of code style.
+        // First person to remove the need for cloning here gets a cookie!
+        //
+        // done. you owe me -- ossi
+        unsafe { init(w_attr, event_loop) }
+    }
+
+    pub(crate) fn maybe_queue_on_main(&self, f: impl FnOnce(&Self) + Send + 'static) {
+        // TODO: Use `thread_executor` here
+        f(self)
+    }
+
+    pub(crate) fn maybe_wait_on_main<R: Send>(&self, f: impl FnOnce(&Self) -> R + Send) -> R {
+        // TODO: Use `thread_executor` here
+        f(self)
+    }
+
+    fn window_state_lock(&self) -> MutexGuard<'_, WindowState> {
+        self.window_state.lock().unwrap()
+    }
+
+    pub fn set_title(&self, text: &str) {
+        let wide_text = util::encode_wide(text);
+        unsafe {
+            SetWindowTextW(self.hwnd(), wide_text.as_ptr());
+        }
+    }
+
+    pub fn set_transparent(&self, transparent: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::TRANSPARENT, transparent)
+            });
+        });
+    }
+
+    pub fn set_blur(&self, _blur: bool) {}
+
+    #[inline]
+    pub fn set_visible(&self, visible: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::VISIBLE, visible)
+            });
+        });
+    }
+
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        Some(unsafe { IsWindowVisible(self.window) == 1 })
+    }
+
+    #[inline]
+    pub fn request_redraw(&self) {
+        // NOTE: mark that we requested a redraw to handle requests during `WM_PAINT` handling.
+        self.window_state.lock().unwrap().redraw_requested = true;
+        unsafe {
+            RedrawWindow(self.hwnd(), ptr::null(), 0, RDW_INTERNALPAINT);
+        }
+    }
+
+    #[inline]
+    pub fn pre_present_notify(&self) {}
+
+    #[inline]
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        util::WindowArea::Outer
+            .get_rect(self.hwnd())
+            .map(|rect| Ok(PhysicalPosition::new(rect.left, rect.top)))
+            .expect(
+                "Unexpected GetWindowRect failure; please report this error to \
+                 rust-windowing/winit",
+            )
+    }
+
+    #[inline]
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let mut position: POINT = unsafe { mem::zeroed() };
+        if unsafe { ClientToScreen(self.hwnd(), &mut position) } == false.into() {
+            panic!(
+                "Unexpected ClientToScreen failure: please report this error to \
+                 rust-windowing/winit"
+            )
+        }
+        Ok(PhysicalPosition::new(position.x, position.y))
+    }
+
+    #[inline]
+    pub fn set_outer_position(&self, position: Position) {
+        let (x, y): (i32, i32) = position.to_physical::<i32>(self.scale_factor()).into();
+
+        let window_state = Arc::clone(&self.window_state);
+        let window = self.window;
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::MAXIMIZED, false)
+            });
+        });
+
+        unsafe {
+            SetWindowPos(
+                self.hwnd(),
+                0,
+                x,
+                y,
+                0,
+                0,
+                SWP_ASYNCWINDOWPOS | SWP_NOZORDER | SWP_NOSIZE | SWP_NOACTIVATE,
+            );
+            InvalidateRgn(self.hwnd(), 0, false.into());
+        }
+    }
+
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        let mut rect: RECT = unsafe { mem::zeroed() };
+        if unsafe { GetClientRect(self.hwnd(), &mut rect) } == false.into() {
+            panic!(
+                "Unexpected GetClientRect failure: please report this error to \
+                 rust-windowing/winit"
+            )
+        }
+        PhysicalSize::new((rect.right - rect.left) as u32, (rect.bottom - rect.top) as u32)
+    }
+
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        util::WindowArea::Outer
+            .get_rect(self.hwnd())
+            .map(|rect| {
+                PhysicalSize::new((rect.right - rect.left) as u32, (rect.bottom - rect.top) as u32)
+            })
+            .unwrap()
+    }
+
+    #[inline]
+    pub fn request_inner_size(&self, size: Size) -> Option<PhysicalSize<u32>> {
+        let scale_factor = self.scale_factor();
+        let physical_size = size.to_physical::<u32>(scale_factor);
+
+        let window_flags = self.window_state_lock().window_flags;
+        window_flags.set_size(self.hwnd(), physical_size);
+
+        if physical_size != self.inner_size() {
+            let window_state = Arc::clone(&self.window_state);
+            let window = self.window;
+            self.thread_executor.execute_in_thread(move || {
+                let _ = &window;
+                WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                    f.set(WindowFlags::MAXIMIZED, false)
+                });
+            });
+        }
+
+        None
+    }
+
+    #[inline]
+    pub fn set_min_inner_size(&self, size: Option<Size>) {
+        self.window_state_lock().min_size = size;
+        // Make windows re-check the window size bounds.
+        let size = self.inner_size();
+        self.request_inner_size(size.into());
+    }
+
+    #[inline]
+    pub fn set_max_inner_size(&self, size: Option<Size>) {
+        self.window_state_lock().max_size = size;
+        // Make windows re-check the window size bounds.
+        let size = self.inner_size();
+        self.request_inner_size(size.into());
+    }
+
+    #[inline]
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        let w = self.window_state_lock();
+        let scale_factor = w.scale_factor;
+        w.resize_increments.map(|size| size.to_physical(scale_factor))
+    }
+
+    #[inline]
+    pub fn set_resize_increments(&self, increments: Option<Size>) {
+        self.window_state_lock().resize_increments = increments;
+    }
+
+    #[inline]
+    pub fn set_resizable(&self, resizable: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::RESIZABLE, resizable)
+            });
+        });
+    }
+
+    #[inline]
+    pub fn is_resizable(&self) -> bool {
+        let window_state = self.window_state_lock();
+        window_state.window_flags.contains(WindowFlags::RESIZABLE)
+    }
+
+    #[inline]
+    pub fn set_enabled_buttons(&self, buttons: WindowButtons) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::MINIMIZABLE, buttons.contains(WindowButtons::MINIMIZE));
+                f.set(WindowFlags::MAXIMIZABLE, buttons.contains(WindowButtons::MAXIMIZE));
+                f.set(WindowFlags::CLOSABLE, buttons.contains(WindowButtons::CLOSE))
+            });
+        });
+    }
+
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        let mut buttons = WindowButtons::empty();
+        let window_state = self.window_state_lock();
+        if window_state.window_flags.contains(WindowFlags::MINIMIZABLE) {
+            buttons |= WindowButtons::MINIMIZE;
+        }
+        if window_state.window_flags.contains(WindowFlags::MAXIMIZABLE) {
+            buttons |= WindowButtons::MAXIMIZE;
+        }
+        if window_state.window_flags.contains(WindowFlags::CLOSABLE) {
+            buttons |= WindowButtons::CLOSE;
+        }
+        buttons
+    }
+
+    /// Returns the `hwnd` of this window.
+    #[inline]
+    pub fn hwnd(&self) -> HWND {
+        self.window
+    }
+
+    #[cfg(feature = "rwh_04")]
+    #[inline]
+    pub fn raw_window_handle_rwh_04(&self) -> rwh_04::RawWindowHandle {
+        let mut window_handle = rwh_04::Win32Handle::empty();
+        window_handle.hwnd = self.window as *mut _;
+        let hinstance = unsafe { super::get_window_long(self.hwnd(), GWLP_HINSTANCE) };
+        window_handle.hinstance = hinstance as *mut _;
+        rwh_04::RawWindowHandle::Win32(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_window_handle_rwh_05(&self) -> rwh_05::RawWindowHandle {
+        let mut window_handle = rwh_05::Win32WindowHandle::empty();
+        window_handle.hwnd = self.window as *mut _;
+        let hinstance = unsafe { super::get_window_long(self.hwnd(), GWLP_HINSTANCE) };
+        window_handle.hinstance = hinstance as *mut _;
+        rwh_05::RawWindowHandle::Win32(window_handle)
+    }
+
+    #[cfg(feature = "rwh_05")]
+    #[inline]
+    pub fn raw_display_handle_rwh_05(&self) -> rwh_05::RawDisplayHandle {
+        rwh_05::RawDisplayHandle::Windows(rwh_05::WindowsDisplayHandle::empty())
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub unsafe fn rwh_06_no_thread_check(
+        &self,
+    ) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        let mut window_handle = rwh_06::Win32WindowHandle::new(unsafe {
+            // SAFETY: Handle will never be zero.
+            std::num::NonZeroIsize::new_unchecked(self.window)
+        });
+        let hinstance = unsafe { super::get_window_long(self.hwnd(), GWLP_HINSTANCE) };
+        window_handle.hinstance = std::num::NonZeroIsize::new(hinstance);
+        Ok(rwh_06::RawWindowHandle::Win32(window_handle))
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_window_handle_rwh_06(&self) -> Result<rwh_06::RawWindowHandle, rwh_06::HandleError> {
+        // TODO: Write a test once integration framework is ready to ensure that it holds.
+        // If we aren't in the GUI thread, we can't return the window.
+        if !self.thread_executor.in_event_loop_thread() {
+            tracing::error!("tried to access window handle outside of the main thread");
+            return Err(rwh_06::HandleError::Unavailable);
+        }
+
+        // SAFETY: We are on the correct thread.
+        unsafe { self.rwh_06_no_thread_check() }
+    }
+
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub fn raw_display_handle_rwh_06(
+        &self,
+    ) -> Result<rwh_06::RawDisplayHandle, rwh_06::HandleError> {
+        Ok(rwh_06::RawDisplayHandle::Windows(rwh_06::WindowsDisplayHandle::new()))
+    }
+
+    #[inline]
+    pub fn set_cursor(&self, cursor: Cursor) {
+        match cursor {
+            Cursor::Icon(icon) => {
+                self.window_state_lock().mouse.selected_cursor = SelectedCursor::Named(icon);
+                self.thread_executor.execute_in_thread(move || unsafe {
+                    let cursor = LoadCursorW(0, util::to_windows_cursor(icon));
+                    SetCursor(cursor);
+                });
+            },
+            Cursor::Custom(cursor) => {
+                let new_cursor = match cursor.inner {
+                    WinCursor::Cursor(cursor) => cursor,
+                    WinCursor::Failed => {
+                        warn!("Requested to apply failed cursor");
+                        return;
+                    },
+                };
+                self.window_state_lock().mouse.selected_cursor =
+                    SelectedCursor::Custom(new_cursor.clone());
+                self.thread_executor.execute_in_thread(move || unsafe {
+                    SetCursor(new_cursor.as_raw_handle());
+                });
+            },
+        }
+    }
+
+    #[inline]
+    pub fn set_cursor_grab(&self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+        let (tx, rx) = channel();
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            let result = window_state
+                .lock()
+                .unwrap()
+                .mouse
+                .set_cursor_flags(window, |f| {
+                    f.set(CursorFlags::GRABBED, mode != CursorGrabMode::None);
+                    f.set(CursorFlags::LOCKED, mode == CursorGrabMode::Locked);
+                })
+                .map_err(|e| ExternalError::Os(os_error!(e)));
+            let _ = tx.send(result);
+        });
+        rx.recv().unwrap()
+    }
+
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+        let (tx, rx) = channel();
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            let result = window_state
+                .lock()
+                .unwrap()
+                .mouse
+                .set_cursor_flags(window, |f| f.set(CursorFlags::HIDDEN, !visible))
+                .map_err(|e| e.to_string());
+            let _ = tx.send(result);
+        });
+        rx.recv().unwrap().ok();
+    }
+
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        self.window_state_lock().scale_factor
+    }
+
+    #[inline]
+    pub fn set_cursor_position(&self, position: Position) -> Result<(), ExternalError> {
+        let scale_factor = self.scale_factor();
+        let (x, y) = position.to_physical::<i32>(scale_factor).into();
+
+        let mut point = POINT { x, y };
+        unsafe {
+            if ClientToScreen(self.hwnd(), &mut point) == false.into() {
+                return Err(ExternalError::Os(os_error!(io::Error::last_os_error())));
+            }
+            if SetCursorPos(point.x, point.y) == false.into() {
+                return Err(ExternalError::Os(os_error!(io::Error::last_os_error())));
+            }
+        }
+        Ok(())
+    }
+
+    unsafe fn handle_os_dragging(&self, wparam: WPARAM) {
+        let window = self.window;
+        let window_state = self.window_state.clone();
+
+        self.thread_executor.execute_in_thread(move || {
+            {
+                let mut guard = window_state.lock().unwrap();
+                if !guard.dragging {
+                    guard.dragging = true;
+                } else {
+                    return;
+                }
+            }
+
+            let points = {
+                let mut pos = unsafe { mem::zeroed() };
+                unsafe { GetCursorPos(&mut pos) };
+                pos
+            };
+            let points = POINTS { x: points.x as i16, y: points.y as i16 };
+
+            // ReleaseCapture needs to execute on the main thread
+            unsafe { ReleaseCapture() };
+
+            unsafe {
+                PostMessageW(window, WM_NCLBUTTONDOWN, wparam, &points as *const _ as LPARAM)
+            };
+        });
+    }
+
+    #[inline]
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        unsafe {
+            self.handle_os_dragging(HTCAPTION as WPARAM);
+        }
+
+        Ok(())
+    }
+
+    #[inline]
+    pub fn drag_resize_window(&self, direction: ResizeDirection) -> Result<(), ExternalError> {
+        unsafe {
+            self.handle_os_dragging(match direction {
+                ResizeDirection::East => HTRIGHT,
+                ResizeDirection::North => HTTOP,
+                ResizeDirection::NorthEast => HTTOPRIGHT,
+                ResizeDirection::NorthWest => HTTOPLEFT,
+                ResizeDirection::South => HTBOTTOM,
+                ResizeDirection::SouthEast => HTBOTTOMRIGHT,
+                ResizeDirection::SouthWest => HTBOTTOMLEFT,
+                ResizeDirection::West => HTLEFT,
+            } as WPARAM);
+        }
+
+        Ok(())
+    }
+
+    unsafe fn handle_showing_window_menu(&self, position: Position) {
+        unsafe {
+            let point = {
+                let mut point = POINT { x: 0, y: 0 };
+                let scale_factor = self.scale_factor();
+                let (x, y) = position.to_physical::<i32>(scale_factor).into();
+                point.x = x;
+                point.y = y;
+                if ClientToScreen(self.hwnd(), &mut point) == false.into() {
+                    warn!(
+                        "Can't convert client-area coordinates to screen coordinates when showing \
+                         window menu."
+                    );
+                    return;
+                }
+                point
+            };
+
+            // get the current system menu
+            let h_menu = GetSystemMenu(self.hwnd(), 0);
+            if h_menu == 0 {
+                warn!("The corresponding window doesn't have a system menu");
+                // This situation should not be treated as an error so just return without showing
+                // menu.
+                return;
+            }
+
+            fn enable(b: bool) -> MENU_ITEM_STATE {
+                if b {
+                    MFS_ENABLED
+                } else {
+                    MFS_DISABLED
+                }
+            }
+
+            // Change the menu items according to the current window status.
+
+            let restore_btn = enable(self.is_maximized() && self.is_resizable());
+            let size_btn = enable(!self.is_maximized() && self.is_resizable());
+            let maximize_btn = enable(!self.is_maximized() && self.is_resizable());
+
+            EnableMenuItem(h_menu, SC_RESTORE, MF_BYCOMMAND | restore_btn);
+            EnableMenuItem(h_menu, SC_MOVE, MF_BYCOMMAND | enable(!self.is_maximized()));
+            EnableMenuItem(h_menu, SC_SIZE, MF_BYCOMMAND | size_btn);
+            EnableMenuItem(h_menu, SC_MINIMIZE, MF_BYCOMMAND | MFS_ENABLED);
+            EnableMenuItem(h_menu, SC_MAXIMIZE, MF_BYCOMMAND | maximize_btn);
+            EnableMenuItem(h_menu, SC_CLOSE, MF_BYCOMMAND | MFS_ENABLED);
+
+            // Set the default menu item.
+            SetMenuDefaultItem(h_menu, SC_CLOSE, 0);
+
+            // Popup the system menu at the position.
+            let result = TrackPopupMenu(
+                h_menu,
+                TPM_RETURNCMD | TPM_LEFTALIGN, /* for now im using LTR, but we have to use user
+                                                * layout direction */
+                point.x,
+                point.y,
+                0,
+                self.hwnd(),
+                std::ptr::null_mut(),
+            );
+
+            if result == 0 {
+                // User canceled the menu, no need to continue.
+                return;
+            }
+
+            // Send the command that the user select to the corresponding window.
+            if PostMessageW(self.hwnd(), WM_SYSCOMMAND, result as _, 0) == 0 {
+                warn!("Can't post the system menu message to the window.");
+            }
+        }
+    }
+
+    #[inline]
+    pub fn show_window_menu(&self, position: Position) {
+        unsafe {
+            self.handle_showing_window_menu(position);
+        }
+    }
+
+    #[inline]
+    pub fn set_cursor_hittest(&self, hittest: bool) -> Result<(), ExternalError> {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+        self.thread_executor.execute_in_thread(move || {
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::IGNORE_CURSOR_EVENT, !hittest)
+            });
+        });
+
+        Ok(())
+    }
+
+    #[inline]
+    pub fn id(&self) -> WindowId {
+        WindowId(self.hwnd())
+    }
+
+    #[inline]
+    pub fn set_minimized(&self, minimized: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        let is_minimized = util::is_minimized(self.hwnd());
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags_in_place(&mut window_state.lock().unwrap(), |f| {
+                f.set(WindowFlags::MINIMIZED, is_minimized)
+            });
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::MINIMIZED, minimized)
+            });
+        });
+    }
+
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        Some(util::is_minimized(self.hwnd()))
+    }
+
+    #[inline]
+    pub fn set_maximized(&self, maximized: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::MAXIMIZED, maximized)
+            });
+        });
+    }
+
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        let window_state = self.window_state_lock();
+        window_state.window_flags.contains(WindowFlags::MAXIMIZED)
+    }
+
+    #[inline]
+    pub fn fullscreen(&self) -> Option<Fullscreen> {
+        let window_state = self.window_state_lock();
+        window_state.fullscreen.clone()
+    }
+
+    #[inline]
+    pub fn set_fullscreen(&self, fullscreen: Option<Fullscreen>) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        let mut window_state_lock = window_state.lock().unwrap();
+        let old_fullscreen = window_state_lock.fullscreen.clone();
+
+        match (&old_fullscreen, &fullscreen) {
+            // Return if we already are in the same fullscreen mode
+            _ if old_fullscreen == fullscreen => return,
+            // Return if saved Borderless(monitor) is the same as current monitor when requested
+            // fullscreen is Borderless(None)
+            (Some(Fullscreen::Borderless(Some(monitor))), Some(Fullscreen::Borderless(None)))
+                if *monitor == monitor::current_monitor(window) =>
+            {
+                return
+            },
+            _ => {},
+        }
+
+        window_state_lock.fullscreen.clone_from(&fullscreen);
+        drop(window_state_lock);
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            // Change video mode if we're transitioning to or from exclusive
+            // fullscreen
+            match (&old_fullscreen, &fullscreen) {
+                (_, Some(Fullscreen::Exclusive(video_mode))) => {
+                    let monitor = video_mode.monitor();
+                    let monitor_info = monitor::get_monitor_info(monitor.hmonitor()).unwrap();
+
+                    let res = unsafe {
+                        ChangeDisplaySettingsExW(
+                            monitor_info.szDevice.as_ptr(),
+                            &*video_mode.native_video_mode,
+                            0,
+                            CDS_FULLSCREEN,
+                            ptr::null(),
+                        )
+                    };
+
+                    debug_assert!(res != DISP_CHANGE_BADFLAGS);
+                    debug_assert!(res != DISP_CHANGE_BADMODE);
+                    debug_assert!(res != DISP_CHANGE_BADPARAM);
+                    debug_assert!(res != DISP_CHANGE_FAILED);
+                    assert_eq!(res, DISP_CHANGE_SUCCESSFUL);
+                },
+                (Some(Fullscreen::Exclusive(_)), _) => {
+                    let res = unsafe {
+                        ChangeDisplaySettingsExW(
+                            ptr::null(),
+                            ptr::null(),
+                            0,
+                            CDS_FULLSCREEN,
+                            ptr::null(),
+                        )
+                    };
+
+                    debug_assert!(res != DISP_CHANGE_BADFLAGS);
+                    debug_assert!(res != DISP_CHANGE_BADMODE);
+                    debug_assert!(res != DISP_CHANGE_BADPARAM);
+                    debug_assert!(res != DISP_CHANGE_FAILED);
+                    assert_eq!(res, DISP_CHANGE_SUCCESSFUL);
+                },
+                _ => (),
+            }
+
+            unsafe {
+                // There are some scenarios where calling `ChangeDisplaySettingsExW` takes long
+                // enough to execute that the DWM thinks our program has frozen and takes over
+                // our program's window. When that happens, the `SetWindowPos` call below gets
+                // eaten and the window doesn't get set to the proper fullscreen position.
+                //
+                // Calling `PeekMessageW` here notifies Windows that our process is still running
+                // fine, taking control back from the DWM and ensuring that the `SetWindowPos` call
+                // below goes through.
+                let mut msg = mem::zeroed();
+                PeekMessageW(&mut msg, 0, 0, 0, PM_NOREMOVE);
+            }
+
+            // Update window style
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(
+                    WindowFlags::MARKER_EXCLUSIVE_FULLSCREEN,
+                    matches!(fullscreen, Some(Fullscreen::Exclusive(_))),
+                );
+                f.set(
+                    WindowFlags::MARKER_BORDERLESS_FULLSCREEN,
+                    matches!(fullscreen, Some(Fullscreen::Borderless(_))),
+                );
+            });
+
+            // Mark as fullscreen window wrt to z-order
+            //
+            // this needs to be called before the below fullscreen SetWindowPos as this itself
+            // will generate WM_SIZE messages of the old window size that can race with what we set
+            // below
+            unsafe {
+                taskbar_mark_fullscreen(window, fullscreen.is_some());
+            }
+
+            // Update window bounds
+            match &fullscreen {
+                Some(fullscreen) => {
+                    // Save window bounds before entering fullscreen
+                    let placement = unsafe {
+                        let mut placement = mem::zeroed();
+                        GetWindowPlacement(window, &mut placement);
+                        placement
+                    };
+
+                    window_state.lock().unwrap().saved_window = Some(SavedWindow { placement });
+
+                    let monitor = match &fullscreen {
+                        Fullscreen::Exclusive(video_mode) => video_mode.monitor(),
+                        Fullscreen::Borderless(Some(monitor)) => monitor.clone(),
+                        Fullscreen::Borderless(None) => monitor::current_monitor(window),
+                    };
+
+                    let position: (i32, i32) = monitor.position().into();
+                    let size: (u32, u32) = monitor.size().into();
+
+                    unsafe {
+                        SetWindowPos(
+                            window,
+                            0,
+                            position.0,
+                            position.1,
+                            size.0 as i32,
+                            size.1 as i32,
+                            SWP_ASYNCWINDOWPOS | SWP_NOZORDER,
+                        );
+                        InvalidateRgn(window, 0, false.into());
+                    }
+                },
+                None => {
+                    let mut window_state_lock = window_state.lock().unwrap();
+                    if let Some(SavedWindow { placement }) = window_state_lock.saved_window.take() {
+                        drop(window_state_lock);
+                        unsafe {
+                            SetWindowPlacement(window, &placement);
+                            InvalidateRgn(window, 0, false.into());
+                        }
+                    }
+                },
+            }
+        });
+    }
+
+    #[inline]
+    pub fn set_decorations(&self, decorations: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::MARKER_DECORATIONS, decorations)
+            });
+        });
+    }
+
+    #[inline]
+    pub fn is_decorated(&self) -> bool {
+        let window_state = self.window_state_lock();
+        window_state.window_flags.contains(WindowFlags::MARKER_DECORATIONS)
+    }
+
+    #[inline]
+    pub fn set_window_level(&self, level: WindowLevel) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::ALWAYS_ON_TOP, level == WindowLevel::AlwaysOnTop);
+                f.set(WindowFlags::ALWAYS_ON_BOTTOM, level == WindowLevel::AlwaysOnBottom);
+            });
+        });
+    }
+
+    #[inline]
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        Some(monitor::current_monitor(self.hwnd()))
+    }
+
+    #[inline]
+    pub fn set_window_icon(&self, window_icon: Option<Icon>) {
+        if let Some(ref window_icon) = window_icon {
+            window_icon.inner.set_for_window(self.hwnd(), IconType::Small);
+        } else {
+            icon::unset_for_window(self.hwnd(), IconType::Small);
+        }
+        self.window_state_lock().window_icon = window_icon;
+    }
+
+    #[inline]
+    pub fn set_enable(&self, enabled: bool) {
+        unsafe { EnableWindow(self.hwnd(), enabled.into()) };
+    }
+
+    #[inline]
+    pub fn set_taskbar_icon(&self, taskbar_icon: Option<Icon>) {
+        if let Some(ref taskbar_icon) = taskbar_icon {
+            taskbar_icon.inner.set_for_window(self.hwnd(), IconType::Big);
+        } else {
+            icon::unset_for_window(self.hwnd(), IconType::Big);
+        }
+        self.window_state_lock().taskbar_icon = taskbar_icon;
+    }
+
+    #[inline]
+    pub fn set_ime_cursor_area(&self, spot: Position, size: Size) {
+        let window = self.window;
+        let state = self.window_state.clone();
+        self.thread_executor.execute_in_thread(move || unsafe {
+            let scale_factor = state.lock().unwrap().scale_factor;
+            ImeContext::current(window).set_ime_cursor_area(spot, size, scale_factor);
+        });
+    }
+
+    #[inline]
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        let window = self.window;
+        let state = self.window_state.clone();
+        self.thread_executor.execute_in_thread(move || unsafe {
+            state.lock().unwrap().ime_allowed = allowed;
+            ImeContext::set_ime_allowed(window, allowed);
+        })
+    }
+
+    #[inline]
+    pub fn set_ime_purpose(&self, _purpose: ImePurpose) {}
+
+    #[inline]
+    pub fn request_user_attention(&self, request_type: Option<UserAttentionType>) {
+        let window = self.window;
+        let active_window_handle = unsafe { GetActiveWindow() };
+        if window == active_window_handle {
+            return;
+        }
+
+        self.thread_executor.execute_in_thread(move || unsafe {
+            let (flags, count) = request_type
+                .map(|ty| match ty {
+                    UserAttentionType::Critical => (FLASHW_ALL | FLASHW_TIMERNOFG, u32::MAX),
+                    UserAttentionType::Informational => (FLASHW_TRAY | FLASHW_TIMERNOFG, 0),
+                })
+                .unwrap_or((FLASHW_STOP, 0));
+
+            let flash_info = FLASHWINFO {
+                cbSize: mem::size_of::<FLASHWINFO>() as u32,
+                hwnd: window,
+                dwFlags: flags,
+                uCount: count,
+                dwTimeout: 0,
+            };
+            FlashWindowEx(&flash_info);
+        });
+    }
+
+    #[inline]
+    pub fn set_theme(&self, theme: Option<Theme>) {
+        try_theme(self.window, theme);
+    }
+
+    #[inline]
+    pub fn theme(&self) -> Option<Theme> {
+        Some(self.window_state_lock().current_theme)
+    }
+
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        let window_state = self.window_state.lock().unwrap();
+        window_state.has_active_focus()
+    }
+
+    pub fn title(&self) -> String {
+        let len = unsafe { GetWindowTextLengthW(self.window) } + 1;
+        let mut buf = vec![0; len as usize];
+        unsafe { GetWindowTextW(self.window, buf.as_mut_ptr(), len) };
+        util::decode_wide(&buf).to_string_lossy().to_string()
+    }
+
+    #[inline]
+    pub fn set_skip_taskbar(&self, skip: bool) {
+        self.window_state_lock().skip_taskbar = skip;
+        unsafe { set_skip_taskbar(self.hwnd(), skip) };
+    }
+
+    #[inline]
+    pub fn set_undecorated_shadow(&self, shadow: bool) {
+        let window = self.window;
+        let window_state = Arc::clone(&self.window_state);
+
+        self.thread_executor.execute_in_thread(move || {
+            let _ = &window;
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                f.set(WindowFlags::MARKER_UNDECORATED_SHADOW, shadow)
+            });
+        });
+    }
+
+    #[inline]
+    pub fn set_system_backdrop(&self, backdrop_type: BackdropType) {
+        unsafe {
+            DwmSetWindowAttribute(
+                self.hwnd(),
+                DWMWA_SYSTEMBACKDROP_TYPE as u32,
+                &(backdrop_type as i32) as *const _ as _,
+                mem::size_of::<DWM_SYSTEMBACKDROP_TYPE>() as _,
+            );
+        }
+    }
+
+    #[inline]
+    pub fn focus_window(&self) {
+        let window_flags = self.window_state_lock().window_flags();
+
+        let is_visible = window_flags.contains(WindowFlags::VISIBLE);
+        let is_minimized = util::is_minimized(self.hwnd());
+        let is_foreground = self.window == unsafe { GetForegroundWindow() };
+
+        if is_visible && !is_minimized && !is_foreground {
+            unsafe { force_window_active(self.window) };
+        }
+    }
+
+    #[inline]
+    pub fn set_content_protected(&self, protected: bool) {
+        unsafe {
+            SetWindowDisplayAffinity(
+                self.hwnd(),
+                if protected { WDA_EXCLUDEFROMCAPTURE } else { WDA_NONE },
+            )
+        };
+    }
+
+    #[inline]
+    pub fn reset_dead_keys(&self) {
+        // `ToUnicode` consumes the dead-key by default, so we are constructing a fake (but valid)
+        // key input which we can call `ToUnicode` with.
+        unsafe {
+            let vk = VK_SPACE as VIRTUAL_KEY;
+            let scancode = MapVirtualKeyW(vk as u32, MAPVK_VK_TO_VSC);
+            let kbd_state = [0; 256];
+            let mut char_buff = [MaybeUninit::uninit(); 8];
+            ToUnicode(
+                vk as u32,
+                scancode,
+                kbd_state.as_ptr(),
+                char_buff[0].as_mut_ptr(),
+                char_buff.len() as i32,
+                0,
+            );
+        }
+    }
+
+    #[inline]
+    pub fn set_border_color(&self, color: Color) {
+        unsafe {
+            DwmSetWindowAttribute(
+                self.hwnd(),
+                DWMWA_BORDER_COLOR as u32,
+                &color as *const _ as _,
+                mem::size_of::<Color>() as _,
+            );
+        }
+    }
+
+    #[inline]
+    pub fn set_title_background_color(&self, color: Color) {
+        unsafe {
+            DwmSetWindowAttribute(
+                self.hwnd(),
+                DWMWA_CAPTION_COLOR as u32,
+                &color as *const _ as _,
+                mem::size_of::<Color>() as _,
+            );
+        }
+    }
+
+    #[inline]
+    pub fn set_title_text_color(&self, color: Color) {
+        unsafe {
+            DwmSetWindowAttribute(
+                self.hwnd(),
+                DWMWA_TEXT_COLOR as u32,
+                &color as *const _ as _,
+                mem::size_of::<Color>() as _,
+            );
+        }
+    }
+
+    #[inline]
+    pub fn set_corner_preference(&self, preference: CornerPreference) {
+        unsafe {
+            DwmSetWindowAttribute(
+                self.hwnd(),
+                DWMWA_WINDOW_CORNER_PREFERENCE as u32,
+                &(preference as DWM_WINDOW_CORNER_PREFERENCE) as *const _ as _,
+                mem::size_of::<DWM_WINDOW_CORNER_PREFERENCE>() as _,
+            );
+        }
+    }
+}
+
+impl Drop for Window {
+    #[inline]
+    fn drop(&mut self) {
+        unsafe {
+            // The window must be destroyed from the same thread that created it, so we send a
+            // custom message to be handled by our callback to do the actual work.
+            PostMessageW(self.hwnd(), DESTROY_MSG_ID.get(), 0, 0);
+        }
+    }
+}
+
+pub(super) struct InitData<'a> {
+    // inputs
+    pub event_loop: &'a ActiveEventLoop,
+    pub attributes: WindowAttributes,
+    pub window_flags: WindowFlags,
+    // outputs
+    pub window: Option<Window>,
+}
+
+impl InitData<'_> {
+    unsafe fn create_window(&self, window: HWND) -> Window {
+        // Register for touch events if applicable
+        {
+            let digitizer = unsafe { GetSystemMetrics(SM_DIGITIZER) as u32 };
+            if digitizer & NID_READY != 0 {
+                unsafe { RegisterTouchWindow(window, TWF_WANTPALM) };
+            }
+        }
+
+        let dpi = unsafe { hwnd_dpi(window) };
+        let scale_factor = dpi_to_scale_factor(dpi);
+
+        // If the system theme is dark, we need to set the window theme now
+        // before we update the window flags (and possibly show the
+        // window for the first time).
+        let current_theme = try_theme(window, self.attributes.preferred_theme);
+
+        let window_state = {
+            let window_state = WindowState::new(
+                &self.attributes,
+                scale_factor,
+                current_theme,
+                self.attributes.preferred_theme,
+            );
+            let window_state = Arc::new(Mutex::new(window_state));
+            WindowState::set_window_flags(window_state.lock().unwrap(), window, |f| {
+                *f = self.window_flags
+            });
+            window_state
+        };
+
+        enable_non_client_dpi_scaling(window);
+
+        unsafe { ImeContext::set_ime_allowed(window, false) };
+
+        Window { window, window_state, thread_executor: self.event_loop.create_thread_executor() }
+    }
+
+    unsafe fn create_window_data(&self, win: &Window) -> event_loop::WindowData {
+        let file_drop_handler = if self.attributes.platform_specific.drag_and_drop {
+            let ole_init_result = unsafe { OleInitialize(ptr::null_mut()) };
+            // It is ok if the initialize result is `S_FALSE` because it might happen that
+            // multiple windows are created on the same thread.
+            if ole_init_result == OLE_E_WRONGCOMPOBJ {
+                panic!("OleInitialize failed! Result was: `OLE_E_WRONGCOMPOBJ`");
+            } else if ole_init_result == RPC_E_CHANGED_MODE {
+                panic!(
+                    "OleInitialize failed! Result was: `RPC_E_CHANGED_MODE`. Make sure other \
+                     crates are not using multithreaded COM library on the same thread or disable \
+                     drag and drop support."
+                );
+            }
+
+            let file_drop_runner = self.event_loop.runner_shared.clone();
+            let file_drop_handler = FileDropHandler::new(
+                win.window,
+                Box::new(move |event| {
+                    if let Ok(e) = event.map_nonuser_event() {
+                        file_drop_runner.send_event(e)
+                    }
+                }),
+            );
+
+            let handler_interface_ptr =
+                unsafe { &mut (*file_drop_handler.data).interface as *mut _ as *mut c_void };
+
+            assert_eq!(unsafe { RegisterDragDrop(win.window, handler_interface_ptr) }, S_OK);
+            Some(file_drop_handler)
+        } else {
+            None
+        };
+
+        event_loop::WindowData {
+            window_state: win.window_state.clone(),
+            event_loop_runner: self.event_loop.runner_shared.clone(),
+            key_event_builder: KeyEventBuilder::default(),
+            _file_drop_handler: file_drop_handler,
+            userdata_removed: Cell::new(false),
+            recurse_depth: Cell::new(0),
+        }
+    }
+
+    // Returns a pointer to window user data on success.
+    // The user data will be registered for the window and can be accessed within the window event
+    // callback.
+    pub unsafe fn on_nccreate(&mut self, window: HWND) -> Option<isize> {
+        let runner = self.event_loop.runner_shared.clone();
+        let result = runner.catch_unwind(|| {
+            let window = unsafe { self.create_window(window) };
+            let window_data = unsafe { self.create_window_data(&window) };
+            (window, window_data)
+        });
+
+        result.map(|(win, userdata)| {
+            self.window = Some(win);
+            let userdata = Box::into_raw(Box::new(userdata));
+            userdata as _
+        })
+    }
+
+    pub unsafe fn on_create(&mut self) {
+        let win = self.window.as_mut().expect("failed window creation");
+
+        // making the window transparent
+        if self.attributes.transparent && !self.attributes.platform_specific.no_redirection_bitmap {
+            // Empty region for the blur effect, so the window is fully transparent
+            let region = unsafe { CreateRectRgn(0, 0, -1, -1) };
+
+            let bb = DWM_BLURBEHIND {
+                dwFlags: DWM_BB_ENABLE | DWM_BB_BLURREGION,
+                fEnable: true.into(),
+                hRgnBlur: region,
+                fTransitionOnMaximized: false.into(),
+            };
+            let hr = unsafe { DwmEnableBlurBehindWindow(win.hwnd(), &bb) };
+            if hr < 0 {
+                warn!("Setting transparent window is failed. HRESULT Code: 0x{:X}", hr);
+            }
+            unsafe { DeleteObject(region) };
+        }
+
+        win.set_skip_taskbar(self.attributes.platform_specific.skip_taskbar);
+        win.set_window_icon(self.attributes.window_icon.clone());
+        win.set_taskbar_icon(self.attributes.platform_specific.taskbar_icon.clone());
+
+        let attributes = self.attributes.clone();
+
+        if attributes.content_protected {
+            win.set_content_protected(true);
+        }
+
+        win.set_cursor(attributes.cursor);
+
+        // Set visible before setting the size to ensure the
+        // attribute is correctly applied.
+        win.set_visible(attributes.visible);
+
+        win.set_enabled_buttons(attributes.enabled_buttons);
+
+        let size = attributes.inner_size.unwrap_or_else(|| PhysicalSize::new(800, 600).into());
+        let max_size = attributes
+            .max_inner_size
+            .unwrap_or_else(|| PhysicalSize::new(f64::MAX, f64::MAX).into());
+        let min_size = attributes.min_inner_size.unwrap_or_else(|| PhysicalSize::new(0, 0).into());
+        let clamped_size = Size::clamp(size, min_size, max_size, win.scale_factor());
+        win.request_inner_size(clamped_size);
+
+        // let margins = MARGINS {
+        //     cxLeftWidth: 1,
+        //     cxRightWidth: 1,
+        //     cyTopHeight: 1,
+        //     cyBottomHeight: 1,
+        // };
+        // dbg!(DwmExtendFrameIntoClientArea(win.hwnd(), &margins as *const _));
+
+        if let Some(position) = attributes.position {
+            win.set_outer_position(position);
+        }
+
+        win.set_system_backdrop(self.attributes.platform_specific.backdrop_type);
+
+        if let Some(color) = self.attributes.platform_specific.border_color {
+            win.set_border_color(color);
+        }
+        if let Some(color) = self.attributes.platform_specific.title_background_color {
+            win.set_title_background_color(color);
+        }
+        if let Some(color) = self.attributes.platform_specific.title_text_color {
+            win.set_title_text_color(color);
+        }
+        if let Some(corner) = self.attributes.platform_specific.corner_preference {
+            win.set_corner_preference(corner);
+        }
+    }
+}
+unsafe fn init(
+    attributes: WindowAttributes,
+    event_loop: &ActiveEventLoop,
+) -> Result<Window, RootOsError> {
+    let title = util::encode_wide(&attributes.title);
+
+    let class_name = util::encode_wide(&attributes.platform_specific.class_name);
+    unsafe { register_window_class(&class_name) };
+
+    let mut window_flags = WindowFlags::empty();
+    window_flags.set(WindowFlags::MARKER_DECORATIONS, attributes.decorations);
+    window_flags.set(
+        WindowFlags::MARKER_UNDECORATED_SHADOW,
+        attributes.platform_specific.decoration_shadow,
+    );
+    window_flags
+        .set(WindowFlags::ALWAYS_ON_TOP, attributes.window_level == WindowLevel::AlwaysOnTop);
+    window_flags
+        .set(WindowFlags::ALWAYS_ON_BOTTOM, attributes.window_level == WindowLevel::AlwaysOnBottom);
+    window_flags
+        .set(WindowFlags::NO_BACK_BUFFER, attributes.platform_specific.no_redirection_bitmap);
+    window_flags.set(WindowFlags::MARKER_ACTIVATE, attributes.active);
+    window_flags.set(WindowFlags::TRANSPARENT, attributes.transparent);
+    // WindowFlags::VISIBLE and MAXIMIZED are set down below after the window has been configured.
+    window_flags.set(WindowFlags::RESIZABLE, attributes.resizable);
+    // Will be changed later using `window.set_enabled_buttons` but we need to set a default here
+    // so the diffing later can work.
+    window_flags.set(WindowFlags::CLOSABLE, true);
+    window_flags.set(WindowFlags::CLIP_CHILDREN, attributes.platform_specific.clip_children);
+
+    let mut fallback_parent = || match attributes.platform_specific.owner {
+        Some(parent) => {
+            window_flags.set(WindowFlags::POPUP, true);
+            Some(parent)
+        },
+        None => {
+            window_flags.set(WindowFlags::ON_TASKBAR, true);
+            None
+        },
+    };
+
+    #[cfg(feature = "rwh_06")]
+    let parent = match attributes.parent_window.as_ref().map(|handle| handle.0) {
+        Some(rwh_06::RawWindowHandle::Win32(handle)) => {
+            window_flags.set(WindowFlags::CHILD, true);
+            if attributes.platform_specific.menu.is_some() {
+                warn!("Setting a menu on a child window is unsupported");
+            }
+            Some(handle.hwnd.get() as HWND)
+        },
+        Some(raw) => unreachable!("Invalid raw window handle {raw:?} on Windows"),
+        None => fallback_parent(),
+    };
+
+    #[cfg(not(feature = "rwh_06"))]
+    let parent = fallback_parent();
+
+    let menu = attributes.platform_specific.menu;
+    let fullscreen = attributes.fullscreen.clone();
+    let maximized = attributes.maximized;
+    let mut initdata = InitData { event_loop, attributes, window_flags, window: None };
+
+    let (style, ex_style) = window_flags.to_window_styles();
+    let handle = unsafe {
+        CreateWindowExW(
+            ex_style,
+            class_name.as_ptr(),
+            title.as_ptr(),
+            style,
+            CW_USEDEFAULT,
+            CW_USEDEFAULT,
+            CW_USEDEFAULT,
+            CW_USEDEFAULT,
+            parent.unwrap_or(0),
+            menu.unwrap_or(0),
+            util::get_instance_handle(),
+            &mut initdata as *mut _ as *mut _,
+        )
+    };
+
+    // If the window creation in `InitData` panicked, then should resume panicking here
+    if let Err(panic_error) = event_loop.runner_shared.take_panic_error() {
+        panic::resume_unwind(panic_error)
+    }
+
+    if handle == 0 {
+        return Err(os_error!(io::Error::last_os_error()));
+    }
+
+    // If the handle is non-null, then window creation must have succeeded, which means
+    // that we *must* have populated the `InitData.window` field.
+    let win = initdata.window.unwrap();
+
+    // Need to set FULLSCREEN or MAXIMIZED after CreateWindowEx
+    // This is because if the size is changed in WM_CREATE, the restored size will be stored in that
+    // size.
+    if fullscreen.is_some() {
+        win.set_fullscreen(fullscreen.map(Into::into));
+        unsafe { force_window_active(win.window) };
+    } else if maximized {
+        win.set_maximized(true);
+    }
+
+    Ok(win)
+}
+
+unsafe fn register_window_class(class_name: &[u16]) {
+    let class = WNDCLASSEXW {
+        cbSize: mem::size_of::<WNDCLASSEXW>() as u32,
+        style: CS_HREDRAW | CS_VREDRAW,
+        lpfnWndProc: Some(super::event_loop::public_window_callback),
+        cbClsExtra: 0,
+        cbWndExtra: 0,
+        hInstance: util::get_instance_handle(),
+        hIcon: 0,
+        hCursor: 0, // must be null in order for cursor state to work properly
+        hbrBackground: 0,
+        lpszMenuName: ptr::null(),
+        lpszClassName: class_name.as_ptr(),
+        hIconSm: 0,
+    };
+
+    // We ignore errors because registering the same window class twice would trigger
+    //  an error, and because errors here are detected during CreateWindowEx anyway.
+    // Also since there is no weird element in the struct, there is no reason for this
+    //  call to fail.
+    unsafe { RegisterClassExW(&class) };
+}
+
+struct ComInitialized(#[allow(dead_code)] *mut ());
+impl Drop for ComInitialized {
+    fn drop(&mut self) {
+        unsafe { CoUninitialize() };
+    }
+}
+
+thread_local! {
+    static COM_INITIALIZED: ComInitialized = {
+        unsafe {
+            CoInitializeEx(ptr::null(), COINIT_APARTMENTTHREADED as u32);
+            ComInitialized(ptr::null_mut())
+        }
+    };
+
+    static TASKBAR_LIST: Cell<*mut ITaskbarList> = const { Cell::new(ptr::null_mut()) };
+    static TASKBAR_LIST2: Cell<*mut ITaskbarList2> = const { Cell::new(ptr::null_mut()) };
+}
+
+pub fn com_initialized() {
+    COM_INITIALIZED.with(|_| {});
+}
+
+// Reference Implementation:
+// https://github.com/chromium/chromium/blob/f18e79d901f56154f80eea1e2218544285e62623/ui/views/win/fullscreen_handler.cc
+//
+// As per MSDN marking the window as fullscreen should ensure that the
+// taskbar is moved to the bottom of the Z-order when the fullscreen window
+// is activated. If the window is not fullscreen, the Shell falls back to
+// heuristics to determine how the window should be treated, which means
+// that it could still consider the window as fullscreen. :(
+unsafe fn taskbar_mark_fullscreen(handle: HWND, fullscreen: bool) {
+    com_initialized();
+
+    TASKBAR_LIST2.with(|task_bar_list2_ptr| {
+        let mut task_bar_list2 = task_bar_list2_ptr.get();
+
+        if task_bar_list2.is_null() {
+            let hr = unsafe {
+                CoCreateInstance(
+                    &CLSID_TaskbarList,
+                    ptr::null_mut(),
+                    CLSCTX_ALL,
+                    &IID_ITaskbarList2,
+                    &mut task_bar_list2 as *mut _ as *mut _,
+                )
+            };
+            if hr != S_OK {
+                // In visual studio retrieving the taskbar list fails
+                return;
+            }
+
+            let hr_init = unsafe { (*(*task_bar_list2).lpVtbl).parent.HrInit };
+            if unsafe { hr_init(task_bar_list2.cast()) } != S_OK {
+                // In some old windows, the taskbar object could not be created, we just ignore it
+                return;
+            }
+            task_bar_list2_ptr.set(task_bar_list2)
+        }
+
+        task_bar_list2 = task_bar_list2_ptr.get();
+        let mark_fullscreen_window = unsafe { (*(*task_bar_list2).lpVtbl).MarkFullscreenWindow };
+        unsafe { mark_fullscreen_window(task_bar_list2, handle, fullscreen.into()) };
+    })
+}
+
+pub(crate) unsafe fn set_skip_taskbar(hwnd: HWND, skip: bool) {
+    com_initialized();
+    TASKBAR_LIST.with(|task_bar_list_ptr| {
+        let mut task_bar_list = task_bar_list_ptr.get();
+
+        if task_bar_list.is_null() {
+            let hr = unsafe {
+                CoCreateInstance(
+                    &CLSID_TaskbarList,
+                    ptr::null_mut(),
+                    CLSCTX_ALL,
+                    &IID_ITaskbarList,
+                    &mut task_bar_list as *mut _ as *mut _,
+                )
+            };
+            if hr != S_OK {
+                // In visual studio retrieving the taskbar list fails
+                return;
+            }
+
+            let hr_init = unsafe { (*(*task_bar_list).lpVtbl).HrInit };
+            if unsafe { hr_init(task_bar_list.cast()) } != S_OK {
+                // In some old windows, the taskbar object could not be created, we just ignore it
+                return;
+            }
+            task_bar_list_ptr.set(task_bar_list)
+        }
+
+        task_bar_list = task_bar_list_ptr.get();
+        if skip {
+            let delete_tab = unsafe { (*(*task_bar_list).lpVtbl).DeleteTab };
+            unsafe { delete_tab(task_bar_list, hwnd) };
+        } else {
+            let add_tab = unsafe { (*(*task_bar_list).lpVtbl).AddTab };
+            unsafe { add_tab(task_bar_list, hwnd) };
+        }
+    });
+}
+
+unsafe fn force_window_active(handle: HWND) {
+    // In some situation, calling SetForegroundWindow could not bring up the window,
+    // This is a little hack which can "steal" the foreground window permission
+    // We only call this function in the window creation, so it should be fine.
+    // See : https://stackoverflow.com/questions/10740346/setforegroundwindow-only-working-while-visual-studio-is-open
+    let alt_sc = unsafe { MapVirtualKeyW(VK_MENU as u32, MAPVK_VK_TO_VSC) };
+
+    let inputs = [
+        INPUT {
+            r#type: INPUT_KEYBOARD,
+            Anonymous: INPUT_0 {
+                ki: KEYBDINPUT {
+                    wVk: VK_LMENU,
+                    wScan: alt_sc as u16,
+                    dwFlags: KEYEVENTF_EXTENDEDKEY,
+                    dwExtraInfo: 0,
+                    time: 0,
+                },
+            },
+        },
+        INPUT {
+            r#type: INPUT_KEYBOARD,
+            Anonymous: INPUT_0 {
+                ki: KEYBDINPUT {
+                    wVk: VK_LMENU,
+                    wScan: alt_sc as u16,
+                    dwFlags: KEYEVENTF_EXTENDEDKEY | KEYEVENTF_KEYUP,
+                    dwExtraInfo: 0,
+                    time: 0,
+                },
+            },
+        },
+    ];
+
+    // Simulate a key press and release
+    unsafe { SendInput(inputs.len() as u32, inputs.as_ptr(), mem::size_of::<INPUT>() as i32) };
+
+    unsafe { SetForegroundWindow(handle) };
+}
diff --git a/vendor/winit/src/platform_impl/windows/window_state.rs b/vendor/winit/src/platform_impl/windows/window_state.rs
new file mode 100644
index 00000000..8e24a4f2
--- /dev/null
+++ b/vendor/winit/src/platform_impl/windows/window_state.rs
@@ -0,0 +1,545 @@
+use crate::dpi::{PhysicalPosition, PhysicalSize, Size};
+use crate::icon::Icon;
+use crate::keyboard::ModifiersState;
+use crate::platform_impl::platform::{event_loop, util, Fullscreen, SelectedCursor};
+use crate::window::{Theme, WindowAttributes};
+use bitflags::bitflags;
+use std::io;
+use std::sync::MutexGuard;
+use windows_sys::Win32::Foundation::{HWND, RECT};
+use windows_sys::Win32::Graphics::Gdi::InvalidateRgn;
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    AdjustWindowRectEx, EnableMenuItem, GetMenu, GetSystemMenu, GetWindowLongW, SendMessageW,
+    SetWindowLongW, SetWindowPos, ShowWindow, GWL_EXSTYLE, GWL_STYLE, HWND_BOTTOM, HWND_NOTOPMOST,
+    HWND_TOPMOST, MF_BYCOMMAND, MF_DISABLED, MF_ENABLED, SC_CLOSE, SWP_ASYNCWINDOWPOS,
+    SWP_FRAMECHANGED, SWP_NOACTIVATE, SWP_NOMOVE, SWP_NOREPOSITION, SWP_NOSIZE, SWP_NOZORDER,
+    SW_HIDE, SW_MAXIMIZE, SW_MINIMIZE, SW_RESTORE, SW_SHOW, SW_SHOWNOACTIVATE, WINDOWPLACEMENT,
+    WINDOW_EX_STYLE, WINDOW_STYLE, WS_BORDER, WS_CAPTION, WS_CHILD, WS_CLIPCHILDREN,
+    WS_CLIPSIBLINGS, WS_EX_ACCEPTFILES, WS_EX_APPWINDOW, WS_EX_LAYERED, WS_EX_NOREDIRECTIONBITMAP,
+    WS_EX_TOPMOST, WS_EX_TRANSPARENT, WS_EX_WINDOWEDGE, WS_MAXIMIZE, WS_MAXIMIZEBOX, WS_MINIMIZE,
+    WS_MINIMIZEBOX, WS_OVERLAPPEDWINDOW, WS_POPUP, WS_SIZEBOX, WS_SYSMENU, WS_VISIBLE,
+};
+
+/// Contains information about states and the window that the callback is going to use.
+pub(crate) struct WindowState {
+    pub mouse: MouseProperties,
+
+    /// Used by `WM_GETMINMAXINFO`.
+    pub min_size: Option<Size>,
+    pub max_size: Option<Size>,
+
+    pub resize_increments: Option<Size>,
+
+    pub window_icon: Option<Icon>,
+    pub taskbar_icon: Option<Icon>,
+
+    pub saved_window: Option<SavedWindow>,
+    pub scale_factor: f64,
+
+    pub modifiers_state: ModifiersState,
+    pub fullscreen: Option<Fullscreen>,
+    pub current_theme: Theme,
+    pub preferred_theme: Option<Theme>,
+
+    pub window_flags: WindowFlags,
+
+    pub ime_state: ImeState,
+    pub ime_allowed: bool,
+
+    // Used by WM_NCACTIVATE, WM_SETFOCUS and WM_KILLFOCUS
+    pub is_active: bool,
+    pub is_focused: bool,
+
+    // Flag whether redraw was requested.
+    pub redraw_requested: bool,
+
+    pub dragging: bool,
+
+    pub skip_taskbar: bool,
+}
+
+#[derive(Clone)]
+pub struct SavedWindow {
+    pub placement: WINDOWPLACEMENT,
+}
+
+#[derive(Clone)]
+pub struct MouseProperties {
+    pub(crate) selected_cursor: SelectedCursor,
+    pub capture_count: u32,
+    cursor_flags: CursorFlags,
+    pub last_position: Option<PhysicalPosition<f64>>,
+}
+
+bitflags! {
+    #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    pub struct CursorFlags: u8 {
+        const GRABBED   = 1 << 0;
+        const HIDDEN    = 1 << 1;
+        const IN_WINDOW = 1 << 2;
+        const LOCKED    = 1 << 3;
+    }
+}
+bitflags! {
+    #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    pub struct WindowFlags: u32 {
+        const RESIZABLE         = 1 << 0;
+        const MINIMIZABLE       = 1 << 1;
+        const MAXIMIZABLE       = 1 << 2;
+        const CLOSABLE          = 1 << 3;
+        const VISIBLE           = 1 << 4;
+        const ON_TASKBAR        = 1 << 5;
+        const ALWAYS_ON_TOP     = 1 << 6;
+        const ALWAYS_ON_BOTTOM  = 1 << 7;
+        const NO_BACK_BUFFER    = 1 << 8;
+        const TRANSPARENT       = 1 << 9;
+        const CHILD             = 1 << 10;
+        const MAXIMIZED         = 1 << 11;
+        const POPUP             = 1 << 12;
+
+        /// Marker flag for fullscreen. Should always match `WindowState::fullscreen`, but is
+        /// included here to make masking easier.
+        const MARKER_EXCLUSIVE_FULLSCREEN = 1 << 13;
+        const MARKER_BORDERLESS_FULLSCREEN = 1 << 14;
+
+        /// The `WM_SIZE` event contains some parameters that can effect the state of `WindowFlags`.
+        /// In most cases, it's okay to let those parameters change the state. However, when we're
+        /// running the `WindowFlags::apply_diff` function, we *don't* want those parameters to
+        /// effect our stored state, because the purpose of `apply_diff` is to update the actual
+        /// window's state to match our stored state. This controls whether to accept those changes.
+        const MARKER_RETAIN_STATE_ON_SIZE = 1 << 15;
+
+        const MARKER_IN_SIZE_MOVE = 1 << 16;
+
+        const MINIMIZED = 1 << 17;
+
+        const IGNORE_CURSOR_EVENT = 1 << 18;
+
+        /// Fully decorated window (incl. caption, border and drop shadow).
+        const MARKER_DECORATIONS = 1 << 19;
+        /// Drop shadow for undecorated windows.
+        const MARKER_UNDECORATED_SHADOW = 1 << 20;
+
+        const MARKER_ACTIVATE = 1 << 21;
+
+        const CLIP_CHILDREN = 1 << 22;
+
+        const EXCLUSIVE_FULLSCREEN_OR_MASK = WindowFlags::ALWAYS_ON_TOP.bits();
+    }
+}
+
+#[derive(Eq, PartialEq)]
+pub enum ImeState {
+    Disabled,
+    Enabled,
+    Preedit,
+}
+
+impl WindowState {
+    pub(crate) fn new(
+        attributes: &WindowAttributes,
+        scale_factor: f64,
+        current_theme: Theme,
+        preferred_theme: Option<Theme>,
+    ) -> WindowState {
+        WindowState {
+            mouse: MouseProperties {
+                selected_cursor: SelectedCursor::default(),
+                capture_count: 0,
+                cursor_flags: CursorFlags::empty(),
+                last_position: None,
+            },
+
+            min_size: attributes.min_inner_size,
+            max_size: attributes.max_inner_size,
+
+            resize_increments: attributes.resize_increments,
+
+            window_icon: attributes.window_icon.clone(),
+            taskbar_icon: None,
+
+            saved_window: None,
+            scale_factor,
+
+            modifiers_state: ModifiersState::default(),
+            fullscreen: None,
+            current_theme,
+            preferred_theme,
+            window_flags: WindowFlags::empty(),
+
+            ime_state: ImeState::Disabled,
+            ime_allowed: false,
+
+            is_active: false,
+            is_focused: false,
+            redraw_requested: false,
+
+            dragging: false,
+
+            skip_taskbar: false,
+        }
+    }
+
+    pub fn window_flags(&self) -> WindowFlags {
+        self.window_flags
+    }
+
+    pub fn set_window_flags<F>(mut this: MutexGuard<'_, Self>, window: HWND, f: F)
+    where
+        F: FnOnce(&mut WindowFlags),
+    {
+        let old_flags = this.window_flags;
+        f(&mut this.window_flags);
+        let new_flags = this.window_flags;
+
+        drop(this);
+        old_flags.apply_diff(window, new_flags);
+    }
+
+    pub fn set_window_flags_in_place<F>(&mut self, f: F)
+    where
+        F: FnOnce(&mut WindowFlags),
+    {
+        f(&mut self.window_flags);
+    }
+
+    pub fn has_active_focus(&self) -> bool {
+        self.is_active && self.is_focused
+    }
+
+    // Updates is_active and returns whether active-focus state has changed
+    pub fn set_active(&mut self, is_active: bool) -> bool {
+        let old = self.has_active_focus();
+        self.is_active = is_active;
+        old != self.has_active_focus()
+    }
+
+    // Updates is_focused and returns whether active-focus state has changed
+    pub fn set_focused(&mut self, is_focused: bool) -> bool {
+        let old = self.has_active_focus();
+        self.is_focused = is_focused;
+        old != self.has_active_focus()
+    }
+}
+
+impl MouseProperties {
+    pub fn cursor_flags(&self) -> CursorFlags {
+        self.cursor_flags
+    }
+
+    pub fn set_cursor_flags<F>(&mut self, window: HWND, f: F) -> Result<(), io::Error>
+    where
+        F: FnOnce(&mut CursorFlags),
+    {
+        let old_flags = self.cursor_flags;
+        f(&mut self.cursor_flags);
+        match self.cursor_flags.refresh_os_cursor(window) {
+            Ok(()) => (),
+            Err(e) => {
+                self.cursor_flags = old_flags;
+                return Err(e);
+            },
+        }
+
+        Ok(())
+    }
+}
+
+impl WindowFlags {
+    fn mask(mut self) -> WindowFlags {
+        if self.contains(WindowFlags::MARKER_EXCLUSIVE_FULLSCREEN) {
+            self |= WindowFlags::EXCLUSIVE_FULLSCREEN_OR_MASK;
+        }
+        self
+    }
+
+    pub fn to_window_styles(self) -> (WINDOW_STYLE, WINDOW_EX_STYLE) {
+        // Required styles to properly support common window functionality like aero snap.
+        let mut style = WS_CAPTION | WS_BORDER | WS_CLIPSIBLINGS | WS_SYSMENU;
+        let mut style_ex = WS_EX_WINDOWEDGE | WS_EX_ACCEPTFILES;
+
+        if self.contains(WindowFlags::RESIZABLE) {
+            style |= WS_SIZEBOX;
+        }
+        if self.contains(WindowFlags::MAXIMIZABLE) {
+            style |= WS_MAXIMIZEBOX;
+        }
+        if self.contains(WindowFlags::MINIMIZABLE) {
+            style |= WS_MINIMIZEBOX;
+        }
+        if self.contains(WindowFlags::VISIBLE) {
+            style |= WS_VISIBLE;
+        }
+        if self.contains(WindowFlags::ON_TASKBAR) {
+            style_ex |= WS_EX_APPWINDOW;
+        }
+        if self.contains(WindowFlags::ALWAYS_ON_TOP) {
+            style_ex |= WS_EX_TOPMOST;
+        }
+        if self.contains(WindowFlags::NO_BACK_BUFFER) {
+            style_ex |= WS_EX_NOREDIRECTIONBITMAP;
+        }
+        if self.contains(WindowFlags::CHILD) {
+            style |= WS_CHILD; // This is incompatible with WS_POPUP if that gets added eventually.
+
+            // Remove decorations window styles for child
+            if !self.contains(WindowFlags::MARKER_DECORATIONS) {
+                style &= !(WS_CAPTION | WS_BORDER);
+                style_ex &= !WS_EX_WINDOWEDGE;
+            }
+        }
+        if self.contains(WindowFlags::POPUP) {
+            style |= WS_POPUP;
+        }
+        if self.contains(WindowFlags::MINIMIZED) {
+            style |= WS_MINIMIZE;
+        }
+        if self.contains(WindowFlags::MAXIMIZED) {
+            style |= WS_MAXIMIZE;
+        }
+        if self.contains(WindowFlags::IGNORE_CURSOR_EVENT) {
+            style_ex |= WS_EX_TRANSPARENT | WS_EX_LAYERED;
+        }
+        if self.contains(WindowFlags::CLIP_CHILDREN) {
+            style |= WS_CLIPCHILDREN;
+        }
+
+        if self.intersects(
+            WindowFlags::MARKER_EXCLUSIVE_FULLSCREEN | WindowFlags::MARKER_BORDERLESS_FULLSCREEN,
+        ) {
+            style &= !WS_OVERLAPPEDWINDOW;
+        }
+
+        (style, style_ex)
+    }
+
+    /// Adjust the window client rectangle to the return value, if present.
+    fn apply_diff(mut self, window: HWND, mut new: WindowFlags) {
+        self = self.mask();
+        new = new.mask();
+
+        let mut diff = self ^ new;
+
+        if diff == WindowFlags::empty() {
+            return;
+        }
+
+        if new.contains(WindowFlags::VISIBLE) {
+            let flag = if !self.contains(WindowFlags::MARKER_ACTIVATE) {
+                self.set(WindowFlags::MARKER_ACTIVATE, true);
+                SW_SHOWNOACTIVATE
+            } else {
+                SW_SHOW
+            };
+            unsafe {
+                ShowWindow(window, flag);
+            }
+        }
+
+        if diff.intersects(WindowFlags::ALWAYS_ON_TOP | WindowFlags::ALWAYS_ON_BOTTOM) {
+            unsafe {
+                SetWindowPos(
+                    window,
+                    match (
+                        new.contains(WindowFlags::ALWAYS_ON_TOP),
+                        new.contains(WindowFlags::ALWAYS_ON_BOTTOM),
+                    ) {
+                        (true, false) => HWND_TOPMOST,
+                        (false, false) => HWND_NOTOPMOST,
+                        (false, true) => HWND_BOTTOM,
+                        (true, true) => unreachable!(),
+                    },
+                    0,
+                    0,
+                    0,
+                    0,
+                    SWP_ASYNCWINDOWPOS | SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE,
+                );
+                InvalidateRgn(window, 0, false.into());
+            }
+        }
+
+        if diff.contains(WindowFlags::MAXIMIZED) || new.contains(WindowFlags::MAXIMIZED) {
+            unsafe {
+                ShowWindow(window, match new.contains(WindowFlags::MAXIMIZED) {
+                    true => SW_MAXIMIZE,
+                    false => SW_RESTORE,
+                });
+            }
+        }
+
+        // Minimize operations should execute after maximize for proper window animations
+        if diff.contains(WindowFlags::MINIMIZED) {
+            unsafe {
+                ShowWindow(window, match new.contains(WindowFlags::MINIMIZED) {
+                    true => SW_MINIMIZE,
+                    false => SW_RESTORE,
+                });
+            }
+
+            diff.remove(WindowFlags::MINIMIZED);
+        }
+
+        if diff.contains(WindowFlags::CLOSABLE) || new.contains(WindowFlags::CLOSABLE) {
+            let flags = MF_BYCOMMAND
+                | if new.contains(WindowFlags::CLOSABLE) { MF_ENABLED } else { MF_DISABLED };
+
+            unsafe {
+                EnableMenuItem(GetSystemMenu(window, 0), SC_CLOSE, flags);
+            }
+        }
+
+        if !new.contains(WindowFlags::VISIBLE) {
+            unsafe {
+                ShowWindow(window, SW_HIDE);
+            }
+        }
+
+        if diff != WindowFlags::empty() {
+            let (style, style_ex) = new.to_window_styles();
+
+            unsafe {
+                SendMessageW(window, event_loop::SET_RETAIN_STATE_ON_SIZE_MSG_ID.get(), 1, 0);
+
+                // This condition is necessary to avoid having an unrestorable window
+                if !new.contains(WindowFlags::MINIMIZED) {
+                    SetWindowLongW(window, GWL_STYLE, style as i32);
+                    SetWindowLongW(window, GWL_EXSTYLE, style_ex as i32);
+                }
+
+                let mut flags = SWP_NOZORDER | SWP_NOMOVE | SWP_NOSIZE | SWP_FRAMECHANGED;
+
+                // We generally don't want style changes here to affect window
+                // focus, but for fullscreen windows they must be activated
+                // (i.e. focused) so that they appear on top of the taskbar
+                if !new.contains(WindowFlags::MARKER_EXCLUSIVE_FULLSCREEN)
+                    && !new.contains(WindowFlags::MARKER_BORDERLESS_FULLSCREEN)
+                {
+                    flags |= SWP_NOACTIVATE;
+                }
+
+                // Refresh the window frame
+                SetWindowPos(window, 0, 0, 0, 0, 0, flags);
+                SendMessageW(window, event_loop::SET_RETAIN_STATE_ON_SIZE_MSG_ID.get(), 0, 0);
+            }
+        }
+    }
+
+    pub fn adjust_rect(self, hwnd: HWND, mut rect: RECT) -> Result<RECT, io::Error> {
+        unsafe {
+            let mut style = GetWindowLongW(hwnd, GWL_STYLE) as u32;
+            let style_ex = GetWindowLongW(hwnd, GWL_EXSTYLE) as u32;
+
+            // Frameless style implemented by manually overriding the non-client area in
+            // `WM_NCCALCSIZE`.
+            if !self.contains(WindowFlags::MARKER_DECORATIONS) {
+                style &= !(WS_CAPTION | WS_SIZEBOX);
+            }
+
+            util::win_to_err({
+                let b_menu = GetMenu(hwnd) != 0;
+                if let (Some(get_dpi_for_window), Some(adjust_window_rect_ex_for_dpi)) =
+                    (*util::GET_DPI_FOR_WINDOW, *util::ADJUST_WINDOW_RECT_EX_FOR_DPI)
+                {
+                    let dpi = get_dpi_for_window(hwnd);
+                    adjust_window_rect_ex_for_dpi(&mut rect, style, b_menu.into(), style_ex, dpi)
+                } else {
+                    AdjustWindowRectEx(&mut rect, style, b_menu.into(), style_ex)
+                }
+            })?;
+            Ok(rect)
+        }
+    }
+
+    pub fn adjust_size(self, hwnd: HWND, size: PhysicalSize<u32>) -> PhysicalSize<u32> {
+        let (width, height): (u32, u32) = size.into();
+        let rect = RECT { left: 0, right: width as i32, top: 0, bottom: height as i32 };
+        let rect = self.adjust_rect(hwnd, rect).unwrap_or(rect);
+
+        let outer_x = (rect.right - rect.left).abs();
+        let outer_y = (rect.top - rect.bottom).abs();
+
+        PhysicalSize::new(outer_x as _, outer_y as _)
+    }
+
+    pub fn set_size(self, hwnd: HWND, size: PhysicalSize<u32>) {
+        unsafe {
+            let (width, height): (u32, u32) = self.adjust_size(hwnd, size).into();
+            SetWindowPos(
+                hwnd,
+                0,
+                0,
+                0,
+                width as _,
+                height as _,
+                SWP_ASYNCWINDOWPOS | SWP_NOZORDER | SWP_NOREPOSITION | SWP_NOMOVE | SWP_NOACTIVATE,
+            );
+            InvalidateRgn(hwnd, 0, false.into());
+        }
+    }
+}
+
+impl CursorFlags {
+    fn refresh_os_cursor(self, window: HWND) -> Result<(), io::Error> {
+        let client_rect = util::WindowArea::Inner.get_rect(window)?;
+
+        if util::is_focused(window) {
+            let cursor_clip = match self.contains(CursorFlags::GRABBED) {
+                true => {
+                    if self.contains(CursorFlags::LOCKED) {
+                        if let Ok(pos) = util::get_cursor_position() {
+                            Some(RECT {
+                                left: pos.x,
+                                right: pos.x + 1,
+                                top: pos.y,
+                                bottom: pos.y + 1,
+                            })
+                        } else {
+                            // If lock is applied while the cursor is not available, lock it to the
+                            // middle of the window.
+                            let cx = (client_rect.left + client_rect.right) / 2;
+                            let cy = (client_rect.top + client_rect.bottom) / 2;
+                            Some(RECT { left: cx, right: cx + 1, top: cy, bottom: cy + 1 })
+                        }
+                    } else if self.contains(CursorFlags::HIDDEN) {
+                        // Confine the cursor to the center of the window if the cursor is hidden.
+                        // This avoids problems with the cursor activating
+                        // the taskbar if the window borders or overlaps that.
+                        let cx = (client_rect.left + client_rect.right) / 2;
+                        let cy = (client_rect.top + client_rect.bottom) / 2;
+                        Some(RECT { left: cx, right: cx + 1, top: cy, bottom: cy + 1 })
+                    } else {
+                        Some(client_rect)
+                    }
+                },
+                false => None,
+            };
+
+            let rect_to_tuple = |rect: RECT| (rect.left, rect.top, rect.right, rect.bottom);
+            let active_cursor_clip = rect_to_tuple(util::get_cursor_clip()?);
+            let desktop_rect = rect_to_tuple(util::get_desktop_rect());
+
+            let active_cursor_clip = match desktop_rect == active_cursor_clip {
+                true => None,
+                false => Some(active_cursor_clip),
+            };
+
+            // We do this check because calling `set_cursor_clip` incessantly will flood the event
+            // loop with `WM_MOUSEMOVE` events, and `refresh_os_cursor` is called by
+            // `set_cursor_flags` which at times gets called once every iteration of the
+            // eventloop.
+            if active_cursor_clip != cursor_clip.map(rect_to_tuple) {
+                util::set_cursor_clip(cursor_clip)?;
+            }
+        }
+
+        let cursor_in_client = self.contains(CursorFlags::IN_WINDOW);
+        if cursor_in_client {
+            util::set_cursor_hidden(self.contains(CursorFlags::HIDDEN));
+        } else {
+            util::set_cursor_hidden(false);
+        }
+
+        Ok(())
+    }
+}
diff --git a/vendor/winit/src/utils.rs b/vendor/winit/src/utils.rs
new file mode 100644
index 00000000..d9631edb
--- /dev/null
+++ b/vendor/winit/src/utils.rs
@@ -0,0 +1,28 @@
+// A poly-fill for `lazy_cell`
+// Replace with std::sync::LazyLock when https://github.com/rust-lang/rust/issues/109736 is stabilized.
+
+// This isn't used on every platform, which can come up as dead code warnings.
+#![allow(dead_code)]
+
+use std::ops::Deref;
+use std::sync::OnceLock;
+
+pub(crate) struct Lazy<T> {
+    cell: OnceLock<T>,
+    init: fn() -> T,
+}
+
+impl<T> Lazy<T> {
+    pub const fn new(f: fn() -> T) -> Self {
+        Self { cell: OnceLock::new(), init: f }
+    }
+}
+
+impl<T> Deref for Lazy<T> {
+    type Target = T;
+
+    #[inline]
+    fn deref(&self) -> &'_ T {
+        self.cell.get_or_init(self.init)
+    }
+}
diff --git a/vendor/winit/src/window.rs b/vendor/winit/src/window.rs
new file mode 100644
index 00000000..e0158eff
--- /dev/null
+++ b/vendor/winit/src/window.rs
@@ -0,0 +1,1876 @@
+//! The [`Window`] struct and associated types.
+use std::fmt;
+
+use crate::dpi::{PhysicalPosition, PhysicalSize, Position, Size};
+use crate::error::{ExternalError, NotSupportedError};
+use crate::monitor::{MonitorHandle, VideoModeHandle};
+use crate::platform_impl::{self, PlatformSpecificWindowAttributes};
+
+pub use crate::cursor::{BadImage, Cursor, CustomCursor, CustomCursorSource, MAX_CURSOR_SIZE};
+pub use crate::icon::{BadIcon, Icon};
+
+#[doc(inline)]
+pub use cursor_icon::{CursorIcon, ParseError as CursorIconParseError};
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+
+/// Represents a window.
+///
+/// The window is closed when dropped.
+///
+/// ## Threading
+///
+/// This is `Send + Sync`, meaning that it can be freely used from other
+/// threads.
+///
+/// However, some platforms (macOS, Web and iOS) only allow user interface
+/// interactions on the main thread, so on those platforms, if you use the
+/// window from a thread other than the main, the code is scheduled to run on
+/// the main thread, and your thread may be blocked until that completes.
+///
+/// ## Platform-specific
+///
+/// **Web:** The [`Window`], which is represented by a `HTMLElementCanvas`, can
+/// not be closed by dropping the [`Window`].
+pub struct Window {
+    pub(crate) window: platform_impl::Window,
+}
+
+impl fmt::Debug for Window {
+    fn fmt(&self, fmtr: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmtr.pad("Window { .. }")
+    }
+}
+
+impl Drop for Window {
+    /// This will close the [`Window`].
+    ///
+    /// See [`Window`] for more details.
+    fn drop(&mut self) {
+        self.window.maybe_wait_on_main(|w| {
+            // If the window is in exclusive fullscreen, we must restore the desktop
+            // video mode (generally this would be done on application exit, but
+            // closing the window doesn't necessarily always mean application exit,
+            // such as when there are multiple windows)
+            if let Some(Fullscreen::Exclusive(_)) = w.fullscreen().map(|f| f.into()) {
+                w.set_fullscreen(None);
+            }
+        })
+    }
+}
+
+/// Identifier of a window. Unique for each window.
+///
+/// Can be obtained with [`window.id()`][`Window::id`].
+///
+/// Whenever you receive an event specific to a window, this event contains a `WindowId` which you
+/// can then compare to the ids of your windows.
+#[derive(Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct WindowId(pub(crate) platform_impl::WindowId);
+
+impl WindowId {
+    /// Returns a dummy id, useful for unit testing.
+    ///
+    /// # Notes
+    ///
+    /// The only guarantee made about the return value of this function is that
+    /// it will always be equal to itself and to future values returned by this function.
+    /// No other guarantees are made. This may be equal to a real [`WindowId`].
+    pub const fn dummy() -> Self {
+        WindowId(platform_impl::WindowId::dummy())
+    }
+}
+
+impl fmt::Debug for WindowId {
+    fn fmt(&self, fmtr: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(fmtr)
+    }
+}
+
+impl From<WindowId> for u64 {
+    fn from(window_id: WindowId) -> Self {
+        window_id.0.into()
+    }
+}
+
+impl From<u64> for WindowId {
+    fn from(raw_id: u64) -> Self {
+        Self(raw_id.into())
+    }
+}
+
+/// Attributes used when creating a window.
+#[derive(Debug, Clone)]
+pub struct WindowAttributes {
+    pub inner_size: Option<Size>,
+    pub min_inner_size: Option<Size>,
+    pub max_inner_size: Option<Size>,
+    pub position: Option<Position>,
+    pub resizable: bool,
+    pub enabled_buttons: WindowButtons,
+    pub title: String,
+    pub maximized: bool,
+    pub visible: bool,
+    pub transparent: bool,
+    pub blur: bool,
+    pub decorations: bool,
+    pub window_icon: Option<Icon>,
+    pub preferred_theme: Option<Theme>,
+    pub resize_increments: Option<Size>,
+    pub content_protected: bool,
+    pub window_level: WindowLevel,
+    pub active: bool,
+    pub cursor: Cursor,
+    #[cfg(feature = "rwh_06")]
+    pub(crate) parent_window: Option<SendSyncRawWindowHandle>,
+    pub fullscreen: Option<Fullscreen>,
+    // Platform-specific configuration.
+    #[allow(dead_code)]
+    pub(crate) platform_specific: PlatformSpecificWindowAttributes,
+}
+
+impl Default for WindowAttributes {
+    #[inline]
+    fn default() -> WindowAttributes {
+        WindowAttributes {
+            inner_size: None,
+            min_inner_size: None,
+            max_inner_size: None,
+            position: None,
+            resizable: true,
+            enabled_buttons: WindowButtons::all(),
+            title: "winit window".to_owned(),
+            maximized: false,
+            fullscreen: None,
+            visible: true,
+            transparent: false,
+            blur: false,
+            decorations: true,
+            window_level: Default::default(),
+            window_icon: None,
+            preferred_theme: None,
+            resize_increments: None,
+            content_protected: false,
+            cursor: Cursor::default(),
+            #[cfg(feature = "rwh_06")]
+            parent_window: None,
+            active: true,
+            platform_specific: Default::default(),
+        }
+    }
+}
+
+/// Wrapper for [`rwh_06::RawWindowHandle`] for [`WindowAttributes::parent_window`].
+///
+/// # Safety
+///
+/// The user has to account for that when using [`WindowAttributes::with_parent_window()`],
+/// which is `unsafe`.
+#[derive(Debug, Clone)]
+#[cfg(feature = "rwh_06")]
+pub(crate) struct SendSyncRawWindowHandle(pub(crate) rwh_06::RawWindowHandle);
+
+#[cfg(feature = "rwh_06")]
+unsafe impl Send for SendSyncRawWindowHandle {}
+#[cfg(feature = "rwh_06")]
+unsafe impl Sync for SendSyncRawWindowHandle {}
+
+impl WindowAttributes {
+    /// Initializes new attributes with default values.
+    #[inline]
+    #[deprecated = "use `Window::default_attributes` instead"]
+    pub fn new() -> Self {
+        Default::default()
+    }
+}
+
+impl WindowAttributes {
+    /// Get the parent window stored on the attributes.
+    #[cfg(feature = "rwh_06")]
+    pub fn parent_window(&self) -> Option<&rwh_06::RawWindowHandle> {
+        self.parent_window.as_ref().map(|handle| &handle.0)
+    }
+
+    /// Requests the window to be of specific dimensions.
+    ///
+    /// If this is not set, some platform-specific dimensions will be used.
+    ///
+    /// See [`Window::request_inner_size`] for details.
+    #[inline]
+    pub fn with_inner_size<S: Into<Size>>(mut self, size: S) -> Self {
+        self.inner_size = Some(size.into());
+        self
+    }
+
+    /// Sets the minimum dimensions a window can have.
+    ///
+    /// If this is not set, the window will have no minimum dimensions (aside
+    /// from reserved).
+    ///
+    /// See [`Window::set_min_inner_size`] for details.
+    #[inline]
+    pub fn with_min_inner_size<S: Into<Size>>(mut self, min_size: S) -> Self {
+        self.min_inner_size = Some(min_size.into());
+        self
+    }
+
+    /// Sets the maximum dimensions a window can have.
+    ///
+    /// If this is not set, the window will have no maximum or will be set to
+    /// the primary monitor's dimensions by the platform.
+    ///
+    /// See [`Window::set_max_inner_size`] for details.
+    #[inline]
+    pub fn with_max_inner_size<S: Into<Size>>(mut self, max_size: S) -> Self {
+        self.max_inner_size = Some(max_size.into());
+        self
+    }
+
+    /// Sets a desired initial position for the window.
+    ///
+    /// If this is not set, some platform-specific position will be chosen.
+    ///
+    /// See [`Window::set_outer_position`] for details.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** The top left corner position of the window content, the window's "inner"
+    ///   position. The window title bar will be placed above it. The window will be positioned such
+    ///   that it fits on screen, maintaining set `inner_size` if any. If you need to precisely
+    ///   position the top left corner of the whole window you have to use
+    ///   [`Window::set_outer_position`] after creating the window.
+    /// - **Windows:** The top left corner position of the window title bar, the window's "outer"
+    ///   position. There may be a small gap between this position and the window due to the
+    ///   specifics of the Window Manager.
+    /// - **X11:** The top left corner of the window, the window's "outer" position.
+    /// - **Others:** Ignored.
+    #[inline]
+    pub fn with_position<P: Into<Position>>(mut self, position: P) -> Self {
+        self.position = Some(position.into());
+        self
+    }
+
+    /// Sets whether the window is resizable or not.
+    ///
+    /// The default is `true`.
+    ///
+    /// See [`Window::set_resizable`] for details.
+    #[inline]
+    pub fn with_resizable(mut self, resizable: bool) -> Self {
+        self.resizable = resizable;
+        self
+    }
+
+    /// Sets the enabled window buttons.
+    ///
+    /// The default is [`WindowButtons::all`]
+    ///
+    /// See [`Window::set_enabled_buttons`] for details.
+    #[inline]
+    pub fn with_enabled_buttons(mut self, buttons: WindowButtons) -> Self {
+        self.enabled_buttons = buttons;
+        self
+    }
+
+    /// Sets the initial title of the window in the title bar.
+    ///
+    /// The default is `"winit window"`.
+    ///
+    /// See [`Window::set_title`] for details.
+    #[inline]
+    pub fn with_title<T: Into<String>>(mut self, title: T) -> Self {
+        self.title = title.into();
+        self
+    }
+
+    /// Sets whether the window should be put into fullscreen upon creation.
+    ///
+    /// The default is `None`.
+    ///
+    /// See [`Window::set_fullscreen`] for details.
+    #[inline]
+    pub fn with_fullscreen(mut self, fullscreen: Option<Fullscreen>) -> Self {
+        self.fullscreen = fullscreen;
+        self
+    }
+
+    /// Request that the window is maximized upon creation.
+    ///
+    /// The default is `false`.
+    ///
+    /// See [`Window::set_maximized`] for details.
+    #[inline]
+    pub fn with_maximized(mut self, maximized: bool) -> Self {
+        self.maximized = maximized;
+        self
+    }
+
+    /// Sets whether the window will be initially visible or hidden.
+    ///
+    /// The default is to show the window.
+    ///
+    /// See [`Window::set_visible`] for details.
+    #[inline]
+    pub fn with_visible(mut self, visible: bool) -> Self {
+        self.visible = visible;
+        self
+    }
+
+    /// Sets whether the background of the window should be transparent.
+    ///
+    /// If this is `true`, writing colors with alpha values different than
+    /// `1.0` will produce a transparent window. On some platforms this
+    /// is more of a hint for the system and you'd still have the alpha
+    /// buffer. To control it see [`Window::set_transparent`].
+    ///
+    /// The default is `false`.
+    #[inline]
+    pub fn with_transparent(mut self, transparent: bool) -> Self {
+        self.transparent = transparent;
+        self
+    }
+
+    /// Sets whether the background of the window should be blurred by the system.
+    ///
+    /// The default is `false`.
+    ///
+    /// See [`Window::set_blur`] for details.
+    #[inline]
+    pub fn with_blur(mut self, blur: bool) -> Self {
+        self.blur = blur;
+        self
+    }
+
+    /// Get whether the window will support transparency.
+    #[inline]
+    pub fn transparent(&self) -> bool {
+        self.transparent
+    }
+
+    /// Sets whether the window should have a border, a title bar, etc.
+    ///
+    /// The default is `true`.
+    ///
+    /// See [`Window::set_decorations`] for details.
+    #[inline]
+    pub fn with_decorations(mut self, decorations: bool) -> Self {
+        self.decorations = decorations;
+        self
+    }
+
+    /// Sets the window level.
+    ///
+    /// This is just a hint to the OS, and the system could ignore it.
+    ///
+    /// The default is [`WindowLevel::Normal`].
+    ///
+    /// See [`WindowLevel`] for details.
+    #[inline]
+    pub fn with_window_level(mut self, level: WindowLevel) -> Self {
+        self.window_level = level;
+        self
+    }
+
+    /// Sets the window icon.
+    ///
+    /// The default is `None`.
+    ///
+    /// See [`Window::set_window_icon`] for details.
+    #[inline]
+    pub fn with_window_icon(mut self, window_icon: Option<Icon>) -> Self {
+        self.window_icon = window_icon;
+        self
+    }
+
+    /// Sets a specific theme for the window.
+    ///
+    /// If `None` is provided, the window will use the system theme.
+    ///
+    /// The default is `None`.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland:** This controls only CSD. When using `None` it'll try to use dbus to get the
+    ///   system preference. When explicit theme is used, this will avoid dbus all together.
+    /// - **x11:** Build window with `_GTK_THEME_VARIANT` hint set to `dark` or `light`.
+    /// - **iOS / Android / Web / x11 / Orbital:** Ignored.
+    #[inline]
+    pub fn with_theme(mut self, theme: Option<Theme>) -> Self {
+        self.preferred_theme = theme;
+        self
+    }
+
+    /// Build window with resize increments hint.
+    ///
+    /// The default is `None`.
+    ///
+    /// See [`Window::set_resize_increments`] for details.
+    #[inline]
+    pub fn with_resize_increments<S: Into<Size>>(mut self, resize_increments: S) -> Self {
+        self.resize_increments = Some(resize_increments.into());
+        self
+    }
+
+    /// Prevents the window contents from being captured by other apps.
+    ///
+    /// The default is `false`.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS**: if `false`, [`NSWindowSharingNone`] is used but doesn't completely prevent all
+    ///   apps from reading the window content, for instance, QuickTime.
+    /// - **iOS / Android / Web / x11 / Orbital:** Ignored.
+    ///
+    /// [`NSWindowSharingNone`]: https://developer.apple.com/documentation/appkit/nswindowsharingtype/nswindowsharingnone
+    #[inline]
+    pub fn with_content_protected(mut self, protected: bool) -> Self {
+        self.content_protected = protected;
+        self
+    }
+
+    /// Whether the window will be initially focused or not.
+    ///
+    /// The window should be assumed as not focused by default
+    /// following by the [`WindowEvent::Focused`].
+    ///
+    /// ## Platform-specific:
+    ///
+    /// **Android / iOS / X11 / Wayland / Orbital:** Unsupported.
+    ///
+    /// [`WindowEvent::Focused`]: crate::event::WindowEvent::Focused.
+    #[inline]
+    pub fn with_active(mut self, active: bool) -> Self {
+        self.active = active;
+        self
+    }
+
+    /// Modifies the cursor icon of the window.
+    ///
+    /// The default is [`CursorIcon::Default`].
+    ///
+    /// See [`Window::set_cursor()`] for more details.
+    #[inline]
+    pub fn with_cursor(mut self, cursor: impl Into<Cursor>) -> Self {
+        self.cursor = cursor.into();
+        self
+    }
+
+    /// Build window with parent window.
+    ///
+    /// The default is `None`.
+    ///
+    /// ## Safety
+    ///
+    /// `parent_window` must be a valid window handle.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Windows** : A child window has the WS_CHILD style and is confined
+    ///   to the client area of its parent window. For more information, see
+    ///   <https://docs.microsoft.com/en-us/windows/win32/winmsg/window-features#child-windows>
+    /// - **X11**: A child window is confined to the client area of its parent window.
+    /// - **Android / iOS / Wayland / Web:** Unsupported.
+    #[cfg(feature = "rwh_06")]
+    #[inline]
+    pub unsafe fn with_parent_window(
+        mut self,
+        parent_window: Option<rwh_06::RawWindowHandle>,
+    ) -> Self {
+        self.parent_window = parent_window.map(SendSyncRawWindowHandle);
+        self
+    }
+}
+
+/// Base Window functions.
+impl Window {
+    /// Create a new [`WindowAttributes`] which allows modifying the window's attributes before
+    /// creation.
+    #[inline]
+    pub fn default_attributes() -> WindowAttributes {
+        WindowAttributes::default()
+    }
+
+    /// Returns an identifier unique to the window.
+    #[inline]
+    pub fn id(&self) -> WindowId {
+        let _span = tracing::debug_span!("winit::Window::id",).entered();
+
+        self.window.maybe_wait_on_main(|w| WindowId(w.id()))
+    }
+
+    /// Returns the scale factor that can be used to map logical pixels to physical pixels, and
+    /// vice versa.
+    ///
+    /// Note that this value can change depending on user action (for example if the window is
+    /// moved to another screen); as such, tracking [`WindowEvent::ScaleFactorChanged`] events is
+    /// the most robust way to track the DPI you need to use to draw.
+    ///
+    /// This value may differ from [`MonitorHandle::scale_factor`].
+    ///
+    /// See the [`dpi`] crate for more information.
+    ///
+    /// ## Platform-specific
+    ///
+    /// The scale factor is calculated differently on different platforms:
+    ///
+    /// - **Windows:** On Windows 8 and 10, per-monitor scaling is readily configured by users from
+    ///   the display settings. While users are free to select any option they want, they're only
+    ///   given a selection of "nice" scale factors, i.e. 1.0, 1.25, 1.5... on Windows 7. The scale
+    ///   factor is global and changing it requires logging out. See [this article][windows_1] for
+    ///   technical details.
+    /// - **macOS:** Recent macOS versions allow the user to change the scaling factor for specific
+    ///   displays. When available, the user may pick a per-monitor scaling factor from a set of
+    ///   pre-defined settings. All "retina displays" have a scaling factor above 1.0 by default,
+    ///   but the specific value varies across devices.
+    /// - **X11:** Many man-hours have been spent trying to figure out how to handle DPI in X11.
+    ///   Winit currently uses a three-pronged approach:
+    ///   + Use the value in the `WINIT_X11_SCALE_FACTOR` environment variable if present.
+    ///   + If not present, use the value set in `Xft.dpi` in Xresources.
+    ///   + Otherwise, calculate the scale factor based on the millimeter monitor dimensions
+    ///     provided by XRandR.
+    ///
+    ///   If `WINIT_X11_SCALE_FACTOR` is set to `randr`, it'll ignore the `Xft.dpi` field and use
+    ///   the   XRandR scaling method. Generally speaking, you should try to configure the
+    ///   standard system   variables to do what you want before resorting to
+    ///   `WINIT_X11_SCALE_FACTOR`.
+    /// - **Wayland:** The scale factor is suggested by the compositor for each window individually
+    ///   by using the wp-fractional-scale protocol if available. Falls back to integer-scale
+    ///   factors otherwise.
+    ///
+    ///   The monitor scale factor may differ from the window scale factor.
+    /// - **iOS:** Scale factors are set by Apple to the value that best suits the device, and range
+    ///   from `1.0` to `3.0`. See [this article][apple_1] and [this article][apple_2] for more
+    ///   information.
+    ///
+    ///   This uses the underlying `UIView`'s [`contentScaleFactor`].
+    /// - **Android:** Scale factors are set by the manufacturer to the value that best suits the
+    ///   device, and range from `1.0` to `4.0`. See [this article][android_1] for more information.
+    ///
+    ///   This is currently unimplemented, and this function always returns 1.0.
+    /// - **Web:** The scale factor is the ratio between CSS pixels and the physical device pixels.
+    ///   In other words, it is the value of [`window.devicePixelRatio`][web_1]. It is affected by
+    ///   both the screen scaling and the browser zoom level and can go below `1.0`.
+    /// - **Orbital:** This is currently unimplemented, and this function always returns 1.0.
+    ///
+    /// [`WindowEvent::ScaleFactorChanged`]: crate::event::WindowEvent::ScaleFactorChanged
+    /// [windows_1]: https://docs.microsoft.com/en-us/windows/win32/hidpi/high-dpi-desktop-application-development-on-windows
+    /// [apple_1]: https://developer.apple.com/library/archive/documentation/DeviceInformation/Reference/iOSDeviceCompatibility/Displays/Displays.html
+    /// [apple_2]: https://developer.apple.com/design/human-interface-guidelines/macos/icons-and-images/image-size-and-resolution/
+    /// [android_1]: https://developer.android.com/training/multiscreen/screendensities
+    /// [web_1]: https://developer.mozilla.org/en-US/docs/Web/API/Window/devicePixelRatio
+    /// [`contentScaleFactor`]: https://developer.apple.com/documentation/uikit/uiview/1622657-contentscalefactor?language=objc
+    #[inline]
+    pub fn scale_factor(&self) -> f64 {
+        let _span = tracing::debug_span!("winit::Window::scale_factor",).entered();
+
+        self.window.maybe_wait_on_main(|w| w.scale_factor())
+    }
+
+    /// Queues a [`WindowEvent::RedrawRequested`] event to be emitted that aligns with the windowing
+    /// system drawing loop.
+    ///
+    /// This is the **strongly encouraged** method of redrawing windows, as it can integrate with
+    /// OS-requested redraws (e.g. when a window gets resized). To improve the event delivery
+    /// consider using [`Window::pre_present_notify`] as described in docs.
+    ///
+    /// Applications should always aim to redraw whenever they receive a `RedrawRequested` event.
+    ///
+    /// There are no strong guarantees about when exactly a `RedrawRequest` event will be emitted
+    /// with respect to other events, since the requirements can vary significantly between
+    /// windowing systems.
+    ///
+    /// However as the event aligns with the windowing system drawing loop, it may not arrive in
+    /// same or even next event loop iteration.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Windows** This API uses `RedrawWindow` to request a `WM_PAINT` message and
+    ///   `RedrawRequested` is emitted in sync with any `WM_PAINT` messages.
+    /// - **iOS:** Can only be called on the main thread.
+    /// - **Wayland:** The events are aligned with the frame callbacks when
+    ///   [`Window::pre_present_notify`] is used.
+    /// - **Web:** [`WindowEvent::RedrawRequested`] will be aligned with the
+    ///   `requestAnimationFrame`.
+    ///
+    /// [`WindowEvent::RedrawRequested`]: crate::event::WindowEvent::RedrawRequested
+    #[inline]
+    pub fn request_redraw(&self) {
+        let _span = tracing::debug_span!("winit::Window::request_redraw",).entered();
+
+        self.window.maybe_queue_on_main(|w| w.request_redraw())
+    }
+
+    /// Notify the windowing system before presenting to the window.
+    ///
+    /// You should call this event after your drawing operations, but before you submit
+    /// the buffer to the display or commit your drawings. Doing so will help winit to properly
+    /// schedule and make assumptions about its internal state. For example, it could properly
+    /// throttle [`WindowEvent::RedrawRequested`].
+    ///
+    /// ## Example
+    ///
+    /// This example illustrates how it looks with OpenGL, but it applies to other graphics
+    /// APIs and software rendering.
+    ///
+    /// ```no_run
+    /// # use winit::window::Window;
+    /// # fn swap_buffers() {}
+    /// # fn scope(window: &Window) {
+    /// // Do the actual drawing with OpenGL.
+    ///
+    /// // Notify winit that we're about to submit buffer to the windowing system.
+    /// window.pre_present_notify();
+    ///
+    /// // Submit buffer to the windowing system.
+    /// swap_buffers();
+    /// # }
+    /// ```
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Android / iOS / X11 / Web / Windows / macOS / Orbital:** Unsupported.
+    /// - **Wayland:** Schedules a frame callback to throttle [`WindowEvent::RedrawRequested`].
+    ///
+    /// [`WindowEvent::RedrawRequested`]: crate::event::WindowEvent::RedrawRequested
+    #[inline]
+    pub fn pre_present_notify(&self) {
+        let _span = tracing::debug_span!("winit::Window::pre_present_notify",).entered();
+
+        self.window.maybe_queue_on_main(|w| w.pre_present_notify());
+    }
+
+    /// Reset the dead key state of the keyboard.
+    ///
+    /// This is useful when a dead key is bound to trigger an action. Then
+    /// this function can be called to reset the dead key state so that
+    /// follow-up text input won't be affected by the dead key.
+    ///
+    /// ## Platform-specific
+    /// - **Web, macOS:** Does nothing
+    // ---------------------------
+    // Developers' Note: If this cannot be implemented on every desktop platform
+    // at least, then this function should be provided through a platform specific
+    // extension trait
+    pub fn reset_dead_keys(&self) {
+        let _span = tracing::debug_span!("winit::Window::reset_dead_keys",).entered();
+
+        self.window.maybe_queue_on_main(|w| w.reset_dead_keys())
+    }
+}
+
+/// Position and size functions.
+impl Window {
+    /// Returns the position of the top-left hand corner of the window's client area relative to the
+    /// top-left hand corner of the desktop.
+    ///
+    /// The same conditions that apply to [`Window::outer_position`] apply to this method.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS:** Can only be called on the main thread. Returns the top left coordinates of the
+    ///   window's [safe area] in the screen space coordinate system.
+    /// - **Web:** Returns the top-left coordinates relative to the viewport. _Note: this returns
+    ///   the same value as [`Window::outer_position`]._
+    /// - **Android / Wayland:** Always returns [`NotSupportedError`].
+    ///
+    /// [safe area]: https://developer.apple.com/documentation/uikit/uiview/2891103-safeareainsets?language=objc
+    #[inline]
+    pub fn inner_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let _span = tracing::debug_span!("winit::Window::inner_position",).entered();
+
+        self.window.maybe_wait_on_main(|w| w.inner_position())
+    }
+
+    /// Returns the position of the top-left hand corner of the window relative to the
+    /// top-left hand corner of the desktop.
+    ///
+    /// Note that the top-left hand corner of the desktop is not necessarily the same as
+    /// the screen. If the user uses a desktop with multiple monitors, the top-left hand corner
+    /// of the desktop is the top-left hand corner of the monitor at the top-left of the desktop.
+    ///
+    /// The coordinates can be negative if the top-left hand corner of the window is outside
+    /// of the visible screen region.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS:** Can only be called on the main thread. Returns the top left coordinates of the
+    ///   window in the screen space coordinate system.
+    /// - **Web:** Returns the top-left coordinates relative to the viewport.
+    /// - **Android / Wayland:** Always returns [`NotSupportedError`].
+    #[inline]
+    pub fn outer_position(&self) -> Result<PhysicalPosition<i32>, NotSupportedError> {
+        let _span = tracing::debug_span!("winit::Window::outer_position",).entered();
+
+        self.window.maybe_wait_on_main(|w| w.outer_position())
+    }
+
+    /// Modifies the position of the window.
+    ///
+    /// See [`Window::outer_position`] for more information about the coordinates.
+    /// This automatically un-maximizes the window if it's maximized.
+    ///
+    /// ```no_run
+    /// # use winit::dpi::{LogicalPosition, PhysicalPosition};
+    /// # use winit::window::Window;
+    /// # fn scope(window: &Window) {
+    /// // Specify the position in logical dimensions like this:
+    /// window.set_outer_position(LogicalPosition::new(400.0, 200.0));
+    ///
+    /// // Or specify the position in physical dimensions like this:
+    /// window.set_outer_position(PhysicalPosition::new(400, 200));
+    /// # }
+    /// ```
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS:** Can only be called on the main thread. Sets the top left coordinates of the
+    ///   window in the screen space coordinate system.
+    /// - **Web:** Sets the top-left coordinates relative to the viewport. Doesn't account for CSS
+    ///   [`transform`].
+    /// - **Android / Wayland:** Unsupported.
+    ///
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    #[inline]
+    pub fn set_outer_position<P: Into<Position>>(&self, position: P) {
+        let position = position.into();
+        let _span = tracing::debug_span!(
+            "winit::Window::set_outer_position",
+            position = ?position
+        )
+        .entered();
+
+        self.window.maybe_queue_on_main(move |w| w.set_outer_position(position))
+    }
+
+    /// Returns the physical size of the window's client area.
+    ///
+    /// The client area is the content of the window, excluding the title bar and borders.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS:** Can only be called on the main thread. Returns the `PhysicalSize` of the window's
+    ///   [safe area] in screen space coordinates.
+    /// - **Web:** Returns the size of the canvas element. Doesn't account for CSS [`transform`].
+    ///
+    /// [safe area]: https://developer.apple.com/documentation/uikit/uiview/2891103-safeareainsets?language=objc
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    #[inline]
+    pub fn inner_size(&self) -> PhysicalSize<u32> {
+        let _span = tracing::debug_span!("winit::Window::inner_size",).entered();
+
+        self.window.maybe_wait_on_main(|w| w.inner_size())
+    }
+
+    /// Request the new size for the window.
+    ///
+    /// On platforms where the size is entirely controlled by the user the
+    /// applied size will be returned immediately, resize event in such case
+    /// may not be generated.
+    ///
+    /// On platforms where resizing is disallowed by the windowing system, the current
+    /// inner size is returned immediately, and the user one is ignored.
+    ///
+    /// When `None` is returned, it means that the request went to the display system,
+    /// and the actual size will be delivered later with the [`WindowEvent::Resized`].
+    ///
+    /// See [`Window::inner_size`] for more information about the values.
+    ///
+    /// The request could automatically un-maximize the window if it's maximized.
+    ///
+    /// ```no_run
+    /// # use winit::dpi::{LogicalSize, PhysicalSize};
+    /// # use winit::window::Window;
+    /// # fn scope(window: &Window) {
+    /// // Specify the size in logical dimensions like this:
+    /// let _ = window.request_inner_size(LogicalSize::new(400.0, 200.0));
+    ///
+    /// // Or specify the size in physical dimensions like this:
+    /// let _ = window.request_inner_size(PhysicalSize::new(400, 200));
+    /// # }
+    /// ```
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Web:** Sets the size of the canvas element. Doesn't account for CSS [`transform`].
+    ///
+    /// [`WindowEvent::Resized`]: crate::event::WindowEvent::Resized
+    /// [`transform`]: https://developer.mozilla.org/en-US/docs/Web/CSS/transform
+    #[inline]
+    #[must_use]
+    pub fn request_inner_size<S: Into<Size>>(&self, size: S) -> Option<PhysicalSize<u32>> {
+        let size = size.into();
+        let _span = tracing::debug_span!(
+            "winit::Window::request_inner_size",
+            size = ?size
+        )
+        .entered();
+        self.window.maybe_wait_on_main(|w| w.request_inner_size(size))
+    }
+
+    /// Returns the physical size of the entire window.
+    ///
+    /// These dimensions include the title bar and borders. If you don't want that (and you usually
+    /// don't), use [`Window::inner_size`] instead.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS:** Can only be called on the main thread. Returns the [`PhysicalSize`] of the window
+    ///   in screen space coordinates.
+    /// - **Web:** Returns the size of the canvas element. _Note: this returns the same value as
+    ///   [`Window::inner_size`]._
+    #[inline]
+    pub fn outer_size(&self) -> PhysicalSize<u32> {
+        let _span = tracing::debug_span!("winit::Window::outer_size",).entered();
+        self.window.maybe_wait_on_main(|w| w.outer_size())
+    }
+
+    /// Sets a minimum dimension size for the window.
+    ///
+    /// ```no_run
+    /// # use winit::dpi::{LogicalSize, PhysicalSize};
+    /// # use winit::window::Window;
+    /// # fn scope(window: &Window) {
+    /// // Specify the size in logical dimensions like this:
+    /// window.set_min_inner_size(Some(LogicalSize::new(400.0, 200.0)));
+    ///
+    /// // Or specify the size in physical dimensions like this:
+    /// window.set_min_inner_size(Some(PhysicalSize::new(400, 200)));
+    /// # }
+    /// ```
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Orbital:** Unsupported.
+    #[inline]
+    pub fn set_min_inner_size<S: Into<Size>>(&self, min_size: Option<S>) {
+        let min_size = min_size.map(|s| s.into());
+        let _span = tracing::debug_span!(
+            "winit::Window::set_min_inner_size",
+            min_size = ?min_size
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_min_inner_size(min_size))
+    }
+
+    /// Sets a maximum dimension size for the window.
+    ///
+    /// ```no_run
+    /// # use winit::dpi::{LogicalSize, PhysicalSize};
+    /// # use winit::window::Window;
+    /// # fn scope(window: &Window) {
+    /// // Specify the size in logical dimensions like this:
+    /// window.set_max_inner_size(Some(LogicalSize::new(400.0, 200.0)));
+    ///
+    /// // Or specify the size in physical dimensions like this:
+    /// window.set_max_inner_size(Some(PhysicalSize::new(400, 200)));
+    /// # }
+    /// ```
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Orbital:** Unsupported.
+    #[inline]
+    pub fn set_max_inner_size<S: Into<Size>>(&self, max_size: Option<S>) {
+        let max_size = max_size.map(|s| s.into());
+        let _span = tracing::debug_span!(
+            "winit::Window::max_size",
+            max_size = ?max_size
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_max_inner_size(max_size))
+    }
+
+    /// Returns window resize increments if any were set.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Orbital:** Always returns [`None`].
+    #[inline]
+    pub fn resize_increments(&self) -> Option<PhysicalSize<u32>> {
+        let _span = tracing::debug_span!("winit::Window::resize_increments",).entered();
+        self.window.maybe_wait_on_main(|w| w.resize_increments())
+    }
+
+    /// Sets window resize increments.
+    ///
+    /// This is a niche constraint hint usually employed by terminal emulators
+    /// and other apps that need "blocky" resizes.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** Increments are converted to logical size and then macOS rounds them to whole
+    ///   numbers.
+    /// - **iOS / Android / Web / Orbital:** Unsupported.
+    #[inline]
+    pub fn set_resize_increments<S: Into<Size>>(&self, increments: Option<S>) {
+        let increments = increments.map(Into::into);
+        let _span = tracing::debug_span!(
+            "winit::Window::set_resize_increments",
+            increments = ?increments
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_resize_increments(increments))
+    }
+}
+
+/// Misc. attribute functions.
+impl Window {
+    /// Modifies the title of the window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android:** Unsupported.
+    #[inline]
+    pub fn set_title(&self, title: &str) {
+        let _span = tracing::debug_span!("winit::Window::set_title", title).entered();
+        self.window.maybe_wait_on_main(|w| w.set_title(title))
+    }
+
+    /// Change the window transparency state.
+    ///
+    /// This is just a hint that may not change anything about
+    /// the window transparency, however doing a mismatch between
+    /// the content of your window and this hint may result in
+    /// visual artifacts.
+    ///
+    /// The default value follows the [`WindowAttributes::with_transparent`].
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** This will reset the window's background color.
+    /// - **Web / iOS / Android:** Unsupported.
+    /// - **X11:** Can only be set while building the window, with
+    ///   [`WindowAttributes::with_transparent`].
+    #[inline]
+    pub fn set_transparent(&self, transparent: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_transparent", transparent).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_transparent(transparent))
+    }
+
+    /// Change the window blur state.
+    ///
+    /// If `true`, this will make the transparent window background blurry.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Android / iOS / X11 / Web / Windows:** Unsupported.
+    /// - **Wayland:** Only works with org_kde_kwin_blur_manager protocol.
+    #[inline]
+    pub fn set_blur(&self, blur: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_blur", blur).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_blur(blur))
+    }
+
+    /// Modifies the window's visibility.
+    ///
+    /// If `false`, this will hide the window. If `true`, this will show the window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Android / Wayland / Web:** Unsupported.
+    /// - **iOS:** Can only be called on the main thread.
+    #[inline]
+    pub fn set_visible(&self, visible: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_visible", visible).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_visible(visible))
+    }
+
+    /// Gets the window's current visibility state.
+    ///
+    /// `None` means it couldn't be determined, so it is not recommended to use this to drive your
+    /// rendering backend.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **X11:** Not implemented.
+    /// - **Wayland / iOS / Android / Web:** Unsupported.
+    #[inline]
+    pub fn is_visible(&self) -> Option<bool> {
+        let _span = tracing::debug_span!("winit::Window::is_visible",).entered();
+        self.window.maybe_wait_on_main(|w| w.is_visible())
+    }
+
+    /// Sets whether the window is resizable or not.
+    ///
+    /// Note that making the window unresizable doesn't exempt you from handling
+    /// [`WindowEvent::Resized`], as that event can still be triggered by DPI scaling, entering
+    /// fullscreen mode, etc. Also, the window could still be resized by calling
+    /// [`Window::request_inner_size`].
+    ///
+    /// ## Platform-specific
+    ///
+    /// This only has an effect on desktop platforms.
+    ///
+    /// - **X11:** Due to a bug in XFCE, this has no effect on Xfwm.
+    /// - **iOS / Android / Web:** Unsupported.
+    ///
+    /// [`WindowEvent::Resized`]: crate::event::WindowEvent::Resized
+    #[inline]
+    pub fn set_resizable(&self, resizable: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_resizable", resizable).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_resizable(resizable))
+    }
+
+    /// Gets the window's current resizable state.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **X11:** Not implemented.
+    /// - **iOS / Android / Web:** Unsupported.
+    #[inline]
+    pub fn is_resizable(&self) -> bool {
+        let _span = tracing::debug_span!("winit::Window::is_resizable",).entered();
+        self.window.maybe_wait_on_main(|w| w.is_resizable())
+    }
+
+    /// Sets the enabled window buttons.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland / X11 / Orbital:** Not implemented.
+    /// - **Web / iOS / Android:** Unsupported.
+    pub fn set_enabled_buttons(&self, buttons: WindowButtons) {
+        let _span = tracing::debug_span!(
+            "winit::Window::set_enabled_buttons",
+            buttons = ?buttons
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_enabled_buttons(buttons))
+    }
+
+    /// Gets the enabled window buttons.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland / X11 / Orbital:** Not implemented. Always returns [`WindowButtons::all`].
+    /// - **Web / iOS / Android:** Unsupported. Always returns [`WindowButtons::all`].
+    pub fn enabled_buttons(&self) -> WindowButtons {
+        let _span = tracing::debug_span!("winit::Window::enabled_buttons",).entered();
+        self.window.maybe_wait_on_main(|w| w.enabled_buttons())
+    }
+
+    /// Sets the window to minimized or back
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Orbital:** Unsupported.
+    /// - **Wayland:** Un-minimize is unsupported.
+    #[inline]
+    pub fn set_minimized(&self, minimized: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_minimized", minimized).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_minimized(minimized))
+    }
+
+    /// Gets the window's current minimized state.
+    ///
+    /// `None` will be returned, if the minimized state couldn't be determined.
+    ///
+    /// ## Note
+    ///
+    /// - You shouldn't stop rendering for minimized windows, however you could lower the fps.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland**: always `None`.
+    /// - **iOS / Android / Web / Orbital:** Unsupported.
+    #[inline]
+    pub fn is_minimized(&self) -> Option<bool> {
+        let _span = tracing::debug_span!("winit::Window::is_minimized",).entered();
+        self.window.maybe_wait_on_main(|w| w.is_minimized())
+    }
+
+    /// Sets the window to maximized or back.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web:** Unsupported.
+    #[inline]
+    pub fn set_maximized(&self, maximized: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_maximized", maximized).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_maximized(maximized))
+    }
+
+    /// Gets the window's current maximized state.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web:** Unsupported.
+    #[inline]
+    pub fn is_maximized(&self) -> bool {
+        let _span = tracing::debug_span!("winit::Window::is_maximized",).entered();
+        self.window.maybe_wait_on_main(|w| w.is_maximized())
+    }
+
+    /// Sets the window to fullscreen or back.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** [`Fullscreen::Exclusive`] provides true exclusive mode with a video mode
+    ///   change. *Caveat!* macOS doesn't provide task switching (or spaces!) while in exclusive
+    ///   fullscreen mode. This mode should be used when a video mode change is desired, but for a
+    ///   better user experience, borderless fullscreen might be preferred.
+    ///
+    ///   [`Fullscreen::Borderless`] provides a borderless fullscreen window on a
+    ///   separate space. This is the idiomatic way for fullscreen games to work
+    ///   on macOS. See `WindowExtMacOs::set_simple_fullscreen` if
+    ///   separate spaces are not preferred.
+    ///
+    ///   The dock and the menu bar are disabled in exclusive fullscreen mode.
+    /// - **iOS:** Can only be called on the main thread.
+    /// - **Wayland:** Does not support exclusive fullscreen mode and will no-op a request.
+    /// - **Windows:** Screen saver is disabled in fullscreen mode.
+    /// - **Android / Orbital:** Unsupported.
+    /// - **Web:** Does nothing without a [transient activation].
+    ///
+    /// [transient activation]: https://developer.mozilla.org/en-US/docs/Glossary/Transient_activation
+    #[inline]
+    pub fn set_fullscreen(&self, fullscreen: Option<Fullscreen>) {
+        let _span = tracing::debug_span!(
+            "winit::Window::set_fullscreen",
+            fullscreen = ?fullscreen
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_fullscreen(fullscreen.map(|f| f.into())))
+    }
+
+    /// Gets the window's current fullscreen state.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS:** Can only be called on the main thread.
+    /// - **Android / Orbital:** Will always return `None`.
+    /// - **Wayland:** Can return `Borderless(None)` when there are no monitors.
+    /// - **Web:** Can only return `None` or `Borderless(None)`.
+    #[inline]
+    pub fn fullscreen(&self) -> Option<Fullscreen> {
+        let _span = tracing::debug_span!("winit::Window::fullscreen",).entered();
+        self.window.maybe_wait_on_main(|w| w.fullscreen().map(|f| f.into()))
+    }
+
+    /// Turn window decorations on or off.
+    ///
+    /// Enable/disable window decorations provided by the server or Winit.
+    /// By default this is enabled. Note that fullscreen windows and windows on
+    /// mobile and web platforms naturally do not have decorations.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web:** No effect.
+    #[inline]
+    pub fn set_decorations(&self, decorations: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_decorations", decorations).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_decorations(decorations))
+    }
+
+    /// Gets the window's current decorations state.
+    ///
+    /// Returns `true` when windows are decorated (server-side or by Winit).
+    /// Also returns `true` when no decorations are required (mobile, web).
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web:** Always returns `true`.
+    #[inline]
+    pub fn is_decorated(&self) -> bool {
+        let _span = tracing::debug_span!("winit::Window::is_decorated",).entered();
+        self.window.maybe_wait_on_main(|w| w.is_decorated())
+    }
+
+    /// Change the window level.
+    ///
+    /// This is just a hint to the OS, and the system could ignore it.
+    ///
+    /// See [`WindowLevel`] for details.
+    pub fn set_window_level(&self, level: WindowLevel) {
+        let _span = tracing::debug_span!(
+            "winit::Window::set_window_level",
+            level = ?level
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_window_level(level))
+    }
+
+    /// Sets the window icon.
+    ///
+    /// On Windows and X11, this is typically the small icon in the top-left
+    /// corner of the titlebar.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Wayland / macOS / Orbital:** Unsupported.
+    ///
+    /// - **Windows:** Sets `ICON_SMALL`. The base size for a window icon is 16x16, but it's
+    ///   recommended to account for screen scaling and pick a multiple of that, i.e. 32x32.
+    ///
+    /// - **X11:** Has no universal guidelines for icon sizes, so you're at the whims of the WM.
+    ///   That said, it's usually in the same ballpark as on Windows.
+    #[inline]
+    pub fn set_window_icon(&self, window_icon: Option<Icon>) {
+        let _span = tracing::debug_span!("winit::Window::set_window_icon",).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_window_icon(window_icon))
+    }
+
+    /// Set the IME cursor editing area, where the `position` is the top left corner of that area
+    /// and `size` is the size of this area starting from the position. An example of such area
+    /// could be a input field in the UI or line in the editor.
+    ///
+    /// The windowing system could place a candidate box close to that area, but try to not obscure
+    /// the specified area, so the user input to it stays visible.
+    ///
+    /// The candidate box is the window / popup / overlay that allows you to select the desired
+    /// characters. The look of this box may differ between input devices, even on the same
+    /// platform.
+    ///
+    /// (Apple's official term is "candidate window", see their [chinese] and [japanese] guides).
+    ///
+    /// ## Example
+    ///
+    /// ```no_run
+    /// # use winit::dpi::{LogicalPosition, PhysicalPosition, LogicalSize, PhysicalSize};
+    /// # use winit::window::Window;
+    /// # fn scope(window: &Window) {
+    /// // Specify the position in logical dimensions like this:
+    /// window.set_ime_cursor_area(LogicalPosition::new(400.0, 200.0), LogicalSize::new(100, 100));
+    ///
+    /// // Or specify the position in physical dimensions like this:
+    /// window.set_ime_cursor_area(PhysicalPosition::new(400, 200), PhysicalSize::new(100, 100));
+    /// # }
+    /// ```
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **X11:** - area is not supported, only position.
+    /// - **iOS / Android / Web / Orbital:** Unsupported.
+    ///
+    /// [chinese]: https://support.apple.com/guide/chinese-input-method/use-the-candidate-window-cim12992/104/mac/12.0
+    /// [japanese]: https://support.apple.com/guide/japanese-input-method/use-the-candidate-window-jpim10262/6.3/mac/12.0
+    #[inline]
+    pub fn set_ime_cursor_area<P: Into<Position>, S: Into<Size>>(&self, position: P, size: S) {
+        let position = position.into();
+        let size = size.into();
+        let _span = tracing::debug_span!(
+            "winit::Window::set_ime_cursor_area",
+            position = ?position,
+            size = ?size,
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_ime_cursor_area(position, size))
+    }
+
+    /// Sets whether the window should get IME events
+    ///
+    /// When IME is allowed, the window will receive [`Ime`] events, and during the
+    /// preedit phase the window will NOT get [`KeyboardInput`] events. The window
+    /// should allow IME while it is expecting text input.
+    ///
+    /// When IME is not allowed, the window won't receive [`Ime`] events, and will
+    /// receive [`KeyboardInput`] events for every keypress instead. Not allowing
+    /// IME is useful for games for example.
+    ///
+    /// IME is **not** allowed by default.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** IME must be enabled to receive text-input where dead-key sequences are
+    ///   combined.
+    /// - **iOS / Android:** This will show / hide the soft keyboard.
+    /// - **Web / Orbital:** Unsupported.
+    /// - **X11**: Enabling IME will disable dead keys reporting during compose.
+    ///
+    /// [`Ime`]: crate::event::WindowEvent::Ime
+    /// [`KeyboardInput`]: crate::event::WindowEvent::KeyboardInput
+    #[inline]
+    pub fn set_ime_allowed(&self, allowed: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_ime_allowed", allowed).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_ime_allowed(allowed))
+    }
+
+    /// Sets the IME purpose for the window using [`ImePurpose`].
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Windows / X11 / macOS / Orbital:** Unsupported.
+    #[inline]
+    pub fn set_ime_purpose(&self, purpose: ImePurpose) {
+        let _span = tracing::debug_span!(
+            "winit::Window::set_ime_purpose",
+            purpose = ?purpose
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_ime_purpose(purpose))
+    }
+
+    /// Brings the window to the front and sets input focus. Has no effect if the window is
+    /// already in focus, minimized, or not visible.
+    ///
+    /// This method steals input focus from other applications. Do not use this method unless
+    /// you are certain that's what the user wants. Focus stealing can cause an extremely disruptive
+    /// user experience.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Wayland / Orbital:** Unsupported.
+    #[inline]
+    pub fn focus_window(&self) {
+        let _span = tracing::debug_span!("winit::Window::focus_window",).entered();
+        self.window.maybe_queue_on_main(|w| w.focus_window())
+    }
+
+    /// Gets whether the window has keyboard focus.
+    ///
+    /// This queries the same state information as [`WindowEvent::Focused`].
+    ///
+    /// [`WindowEvent::Focused`]: crate::event::WindowEvent::Focused
+    #[inline]
+    pub fn has_focus(&self) -> bool {
+        let _span = tracing::debug_span!("winit::Window::has_focus",).entered();
+        self.window.maybe_wait_on_main(|w| w.has_focus())
+    }
+
+    /// Requests user attention to the window, this has no effect if the application
+    /// is already focused. How requesting for user attention manifests is platform dependent,
+    /// see [`UserAttentionType`] for details.
+    ///
+    /// Providing `None` will unset the request for user attention. Unsetting the request for
+    /// user attention might not be done automatically by the WM when the window receives input.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Orbital:** Unsupported.
+    /// - **macOS:** `None` has no effect.
+    /// - **X11:** Requests for user attention must be manually cleared.
+    /// - **Wayland:** Requires `xdg_activation_v1` protocol, `None` has no effect.
+    #[inline]
+    pub fn request_user_attention(&self, request_type: Option<UserAttentionType>) {
+        let _span = tracing::debug_span!(
+            "winit::Window::request_user_attention",
+            request_type = ?request_type
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.request_user_attention(request_type))
+    }
+
+    /// Set or override the window theme.
+    ///
+    /// Specify `None` to reset the theme to the system default.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland:** Sets the theme for the client side decorations. Using `None` will use dbus to
+    ///   get the system preference.
+    /// - **X11:** Sets `_GTK_THEME_VARIANT` hint to `dark` or `light` and if `None` is used, it
+    ///   will default to  [`Theme::Dark`].
+    /// - **iOS / Android / Web / Orbital:** Unsupported.
+    #[inline]
+    pub fn set_theme(&self, theme: Option<Theme>) {
+        let _span = tracing::debug_span!(
+            "winit::Window::set_theme",
+            theme = ?theme
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.set_theme(theme))
+    }
+
+    /// Returns the current window theme.
+    ///
+    /// Returns `None` if it cannot be determined on the current platform.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / x11 / Orbital:** Unsupported.
+    /// - **Wayland:** Only returns theme overrides.
+    #[inline]
+    pub fn theme(&self) -> Option<Theme> {
+        let _span = tracing::debug_span!("winit::Window::theme",).entered();
+        self.window.maybe_wait_on_main(|w| w.theme())
+    }
+
+    /// Prevents the window contents from being captured by other apps.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS**: if `false`, [`NSWindowSharingNone`] is used but doesn't completely prevent all
+    ///   apps from reading the window content, for instance, QuickTime.
+    /// - **iOS / Android / x11 / Wayland / Web / Orbital:** Unsupported.
+    ///
+    /// [`NSWindowSharingNone`]: https://developer.apple.com/documentation/appkit/nswindowsharingtype/nswindowsharingnone
+    pub fn set_content_protected(&self, protected: bool) {
+        let _span =
+            tracing::debug_span!("winit::Window::set_content_protected", protected).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_content_protected(protected))
+    }
+
+    /// Gets the current title of the window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / x11 / Wayland / Web:** Unsupported. Always returns an empty string.
+    #[inline]
+    pub fn title(&self) -> String {
+        let _span = tracing::debug_span!("winit::Window::title",).entered();
+        self.window.maybe_wait_on_main(|w| w.title())
+    }
+}
+
+/// Cursor functions.
+impl Window {
+    /// Modifies the cursor icon of the window.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Orbital:** Unsupported.
+    /// - **Web:** Custom cursors have to be loaded and decoded first, until then the previous
+    ///   cursor is shown.
+    #[inline]
+    pub fn set_cursor(&self, cursor: impl Into<Cursor>) {
+        let cursor = cursor.into();
+        let _span = tracing::debug_span!("winit::Window::set_cursor",).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_cursor(cursor))
+    }
+
+    /// Deprecated! Use [`Window::set_cursor()`] instead.
+    #[deprecated = "Renamed to `set_cursor`"]
+    #[inline]
+    pub fn set_cursor_icon(&self, icon: CursorIcon) {
+        self.set_cursor(icon)
+    }
+
+    /// Changes the position of the cursor in window coordinates.
+    ///
+    /// ```no_run
+    /// # use winit::dpi::{LogicalPosition, PhysicalPosition};
+    /// # use winit::window::Window;
+    /// # fn scope(window: &Window) {
+    /// // Specify the position in logical dimensions like this:
+    /// window.set_cursor_position(LogicalPosition::new(400.0, 200.0));
+    ///
+    /// // Or specify the position in physical dimensions like this:
+    /// window.set_cursor_position(PhysicalPosition::new(400, 200));
+    /// # }
+    /// ```
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Wayland**: Cursor must be in [`CursorGrabMode::Locked`].
+    /// - **iOS / Android / Web / Orbital:** Always returns an [`ExternalError::NotSupported`].
+    #[inline]
+    pub fn set_cursor_position<P: Into<Position>>(&self, position: P) -> Result<(), ExternalError> {
+        let position = position.into();
+        let _span = tracing::debug_span!(
+            "winit::Window::set_cursor_position",
+            position = ?position
+        )
+        .entered();
+        self.window.maybe_wait_on_main(|w| w.set_cursor_position(position))
+    }
+
+    /// Set grabbing [mode][CursorGrabMode] on the cursor preventing it from leaving the window.
+    ///
+    /// # Example
+    ///
+    /// First try confining the cursor, and if that fails, try locking it instead.
+    ///
+    /// ```no_run
+    /// # use winit::window::{CursorGrabMode, Window};
+    /// # fn scope(window: &Window) {
+    /// window
+    ///     .set_cursor_grab(CursorGrabMode::Confined)
+    ///     .or_else(|_e| window.set_cursor_grab(CursorGrabMode::Locked))
+    ///     .unwrap();
+    /// # }
+    /// ```
+    #[inline]
+    pub fn set_cursor_grab(&self, mode: CursorGrabMode) -> Result<(), ExternalError> {
+        let _span = tracing::debug_span!(
+            "winit::Window::set_cursor_grab",
+            mode = ?mode
+        )
+        .entered();
+        self.window.maybe_wait_on_main(|w| w.set_cursor_grab(mode))
+    }
+
+    /// Modifies the cursor's visibility.
+    ///
+    /// If `false`, this will hide the cursor. If `true`, this will show the cursor.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **Windows:** The cursor is only hidden within the confines of the window.
+    /// - **X11:** The cursor is only hidden within the confines of the window.
+    /// - **Wayland:** The cursor is only hidden within the confines of the window.
+    /// - **macOS:** The cursor is hidden as long as the window has input focus, even if the cursor
+    ///   is outside of the window.
+    /// - **iOS / Android:** Unsupported.
+    #[inline]
+    pub fn set_cursor_visible(&self, visible: bool) {
+        let _span = tracing::debug_span!("winit::Window::set_cursor_visible", visible).entered();
+        self.window.maybe_queue_on_main(move |w| w.set_cursor_visible(visible))
+    }
+
+    /// Moves the window with the left mouse button until the button is released.
+    ///
+    /// There's no guarantee that this will work unless the left mouse button was pressed
+    /// immediately before this function is called.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **X11:** Un-grabs the cursor.
+    /// - **Wayland:** Requires the cursor to be inside the window to be dragged.
+    /// - **macOS:** May prevent the button release event to be triggered.
+    /// - **iOS / Android / Web:** Always returns an [`ExternalError::NotSupported`].
+    #[inline]
+    pub fn drag_window(&self) -> Result<(), ExternalError> {
+        let _span = tracing::debug_span!("winit::Window::drag_window",).entered();
+        self.window.maybe_wait_on_main(|w| w.drag_window())
+    }
+
+    /// Resizes the window with the left mouse button until the button is released.
+    ///
+    /// There's no guarantee that this will work unless the left mouse button was pressed
+    /// immediately before this function is called.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** Always returns an [`ExternalError::NotSupported`]
+    /// - **iOS / Android / Web:** Always returns an [`ExternalError::NotSupported`].
+    #[inline]
+    pub fn drag_resize_window(&self, direction: ResizeDirection) -> Result<(), ExternalError> {
+        let _span = tracing::debug_span!(
+            "winit::Window::drag_resize_window",
+            direction = ?direction
+        )
+        .entered();
+        self.window.maybe_wait_on_main(|w| w.drag_resize_window(direction))
+    }
+
+    /// Show [window menu] at a specified position .
+    ///
+    /// This is the context menu that is normally shown when interacting with
+    /// the title bar. This is useful when implementing custom decorations.
+    ///
+    /// ## Platform-specific
+    /// **Android / iOS / macOS / Orbital / Wayland / Web / X11:** Unsupported.
+    ///
+    /// [window menu]: https://en.wikipedia.org/wiki/Common_menus_in_Microsoft_Windows#System_menu
+    pub fn show_window_menu(&self, position: impl Into<Position>) {
+        let position = position.into();
+        let _span = tracing::debug_span!(
+            "winit::Window::show_window_menu",
+            position = ?position
+        )
+        .entered();
+        self.window.maybe_queue_on_main(move |w| w.show_window_menu(position))
+    }
+
+    /// Modifies whether the window catches cursor events.
+    ///
+    /// If `true`, the window will catch the cursor events. If `false`, events are passed through
+    /// the window such that any other window behind it receives them. By default hittest is
+    /// enabled.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **iOS / Android / Web / Orbital:** Always returns an [`ExternalError::NotSupported`].
+    #[inline]
+    pub fn set_cursor_hittest(&self, hittest: bool) -> Result<(), ExternalError> {
+        let _span = tracing::debug_span!("winit::Window::set_cursor_hittest", hittest).entered();
+        self.window.maybe_wait_on_main(|w| w.set_cursor_hittest(hittest))
+    }
+}
+
+/// Monitor info functions.
+impl Window {
+    /// Returns the monitor on which the window currently resides.
+    ///
+    /// Returns `None` if current monitor can't be detected.
+    #[inline]
+    pub fn current_monitor(&self) -> Option<MonitorHandle> {
+        let _span = tracing::debug_span!("winit::Window::current_monitor",).entered();
+        self.window.maybe_wait_on_main(|w| w.current_monitor().map(|inner| MonitorHandle { inner }))
+    }
+
+    /// Returns the list of all the monitors available on the system.
+    ///
+    /// This is the same as [`ActiveEventLoop::available_monitors`], and is provided for
+    /// convenience.
+    ///
+    /// [`ActiveEventLoop::available_monitors`]: crate::event_loop::ActiveEventLoop::available_monitors
+    #[inline]
+    pub fn available_monitors(&self) -> impl Iterator<Item = MonitorHandle> {
+        let _span = tracing::debug_span!("winit::Window::available_monitors",).entered();
+        self.window.maybe_wait_on_main(|w| {
+            w.available_monitors().into_iter().map(|inner| MonitorHandle { inner })
+        })
+    }
+
+    /// Returns the primary monitor of the system.
+    ///
+    /// Returns `None` if it can't identify any monitor as a primary one.
+    ///
+    /// This is the same as [`ActiveEventLoop::primary_monitor`], and is provided for convenience.
+    ///
+    /// ## Platform-specific
+    ///
+    /// **Wayland / Web:** Always returns `None`.
+    ///
+    /// [`ActiveEventLoop::primary_monitor`]: crate::event_loop::ActiveEventLoop::primary_monitor
+    #[inline]
+    pub fn primary_monitor(&self) -> Option<MonitorHandle> {
+        let _span = tracing::debug_span!("winit::Window::primary_monitor",).entered();
+        self.window.maybe_wait_on_main(|w| w.primary_monitor().map(|inner| MonitorHandle { inner }))
+    }
+}
+
+#[cfg(feature = "rwh_06")]
+impl rwh_06::HasWindowHandle for Window {
+    fn window_handle(&self) -> Result<rwh_06::WindowHandle<'_>, rwh_06::HandleError> {
+        let raw = self.window.raw_window_handle_rwh_06()?;
+
+        // SAFETY: The window handle will never be deallocated while the window is alive,
+        // and the main thread safety requirements are upheld internally by each platform.
+        Ok(unsafe { rwh_06::WindowHandle::borrow_raw(raw) })
+    }
+}
+
+#[cfg(feature = "rwh_06")]
+impl rwh_06::HasDisplayHandle for Window {
+    fn display_handle(&self) -> Result<rwh_06::DisplayHandle<'_>, rwh_06::HandleError> {
+        let raw = self.window.raw_display_handle_rwh_06()?;
+
+        // SAFETY: The window handle will never be deallocated while the window is alive,
+        // and the main thread safety requirements are upheld internally by each platform.
+        Ok(unsafe { rwh_06::DisplayHandle::borrow_raw(raw) })
+    }
+}
+
+/// Wrapper to make objects `Send`.
+///
+/// # Safety
+///
+/// This is not safe! This is only used for `RawWindowHandle`, which only has unsafe getters.
+#[cfg(any(feature = "rwh_05", feature = "rwh_04"))]
+struct UnsafeSendWrapper<T>(T);
+
+#[cfg(any(feature = "rwh_05", feature = "rwh_04"))]
+unsafe impl<T> Send for UnsafeSendWrapper<T> {}
+
+#[cfg(feature = "rwh_05")]
+unsafe impl rwh_05::HasRawWindowHandle for Window {
+    fn raw_window_handle(&self) -> rwh_05::RawWindowHandle {
+        self.window.maybe_wait_on_main(|w| UnsafeSendWrapper(w.raw_window_handle_rwh_05())).0
+    }
+}
+
+#[cfg(feature = "rwh_05")]
+unsafe impl rwh_05::HasRawDisplayHandle for Window {
+    /// Returns a [`rwh_05::RawDisplayHandle`] used by the [`EventLoop`] that
+    /// created a window.
+    ///
+    /// [`EventLoop`]: crate::event_loop::EventLoop
+    fn raw_display_handle(&self) -> rwh_05::RawDisplayHandle {
+        self.window.maybe_wait_on_main(|w| UnsafeSendWrapper(w.raw_display_handle_rwh_05())).0
+    }
+}
+
+#[cfg(feature = "rwh_04")]
+unsafe impl rwh_04::HasRawWindowHandle for Window {
+    fn raw_window_handle(&self) -> rwh_04::RawWindowHandle {
+        self.window.maybe_wait_on_main(|w| UnsafeSendWrapper(w.raw_window_handle_rwh_04())).0
+    }
+}
+
+/// The behavior of cursor grabbing.
+///
+/// Use this enum with [`Window::set_cursor_grab`] to grab the cursor.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum CursorGrabMode {
+    /// No grabbing of the cursor is performed.
+    None,
+
+    /// The cursor is confined to the window area.
+    ///
+    /// There's no guarantee that the cursor will be hidden. You should hide it by yourself if you
+    /// want to do so.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** Not implemented. Always returns [`ExternalError::NotSupported`] for now.
+    /// - **iOS / Android / Web:** Always returns an [`ExternalError::NotSupported`].
+    Confined,
+
+    /// The cursor is locked inside the window area to the certain position.
+    ///
+    /// There's no guarantee that the cursor will be hidden. You should hide it by yourself if you
+    /// want to do so.
+    ///
+    /// ## Platform-specific
+    ///
+    /// - **X11:** Not implemented. Always returns [`ExternalError::NotSupported`] for now.
+    /// - **iOS / Android:** Always returns an [`ExternalError::NotSupported`].
+    Locked,
+}
+
+/// Defines the orientation that a window resize will be performed.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Hash)]
+pub enum ResizeDirection {
+    East,
+    North,
+    NorthEast,
+    NorthWest,
+    South,
+    SouthEast,
+    SouthWest,
+    West,
+}
+
+impl From<ResizeDirection> for CursorIcon {
+    fn from(direction: ResizeDirection) -> Self {
+        use ResizeDirection::*;
+        match direction {
+            East => CursorIcon::EResize,
+            North => CursorIcon::NResize,
+            NorthEast => CursorIcon::NeResize,
+            NorthWest => CursorIcon::NwResize,
+            South => CursorIcon::SResize,
+            SouthEast => CursorIcon::SeResize,
+            SouthWest => CursorIcon::SwResize,
+            West => CursorIcon::WResize,
+        }
+    }
+}
+
+/// Fullscreen modes.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Fullscreen {
+    Exclusive(VideoModeHandle),
+
+    /// Providing `None` to `Borderless` will fullscreen on the current monitor.
+    Borderless(Option<MonitorHandle>),
+}
+
+/// The theme variant to use.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum Theme {
+    /// Use the light variant.
+    Light,
+
+    /// Use the dark variant.
+    Dark,
+}
+
+/// ## Platform-specific
+///
+/// - **X11:** Sets the WM's `XUrgencyHint`. No distinction between [`Critical`] and
+///   [`Informational`].
+///
+/// [`Critical`]: Self::Critical
+/// [`Informational`]: Self::Informational
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum UserAttentionType {
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** Bounces the dock icon until the application is in focus.
+    /// - **Windows:** Flashes both the window and the taskbar button until the application is in
+    ///   focus.
+    Critical,
+
+    /// ## Platform-specific
+    ///
+    /// - **macOS:** Bounces the dock icon once.
+    /// - **Windows:** Flashes the taskbar button until the application is in focus.
+    #[default]
+    Informational,
+}
+
+bitflags::bitflags! {
+    #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    pub struct WindowButtons: u32 {
+        const CLOSE  = 1 << 0;
+        const MINIMIZE  = 1 << 1;
+        const MAXIMIZE  = 1 << 2;
+    }
+}
+
+/// A window level groups windows with respect to their z-position.
+///
+/// The relative ordering between windows in different window levels is fixed.
+/// The z-order of a window within the same window level may change dynamically on user interaction.
+///
+/// ## Platform-specific
+///
+/// - **iOS / Android / Web / Wayland:** Unsupported.
+#[derive(Debug, Default, PartialEq, Eq, Clone, Copy)]
+pub enum WindowLevel {
+    /// The window will always be below normal windows.
+    ///
+    /// This is useful for a widget-based app.
+    AlwaysOnBottom,
+
+    /// The default.
+    #[default]
+    Normal,
+
+    /// The window will always be on top of normal windows.
+    AlwaysOnTop,
+}
+
+/// Generic IME purposes for use in [`Window::set_ime_purpose`].
+///
+/// The purpose may improve UX by optimizing the IME for the specific use case,
+/// if winit can express the purpose to the platform and the platform reacts accordingly.
+///
+/// ## Platform-specific
+///
+/// - **iOS / Android / Web / Windows / X11 / macOS / Orbital:** Unsupported.
+#[derive(Default, Debug, PartialEq, Eq, Clone, Copy)]
+#[non_exhaustive]
+pub enum ImePurpose {
+    /// No special hints for the IME (default).
+    #[default]
+    Normal,
+    /// The IME is used for password input.
+    Password,
+    /// The IME is used to input into a terminal.
+    ///
+    /// For example, that could alter OSK on Wayland to show extra buttons.
+    Terminal,
+}
+
+/// An opaque token used to activate the [`Window`].
+///
+/// [`Window`]: crate::window::Window
+#[derive(Debug, PartialEq, Eq, Clone)]
+pub struct ActivationToken {
+    pub(crate) token: String,
+}
+
+impl ActivationToken {
+    /// Make an [`ActivationToken`] from a string.
+    ///
+    /// This method should be used to wrap tokens passed by side channels to your application, like
+    /// dbus.
+    ///
+    /// The validity of the token is ensured by the windowing system. Using the invalid token will
+    /// only result in the side effect of the operation involving it being ignored (e.g. window
+    /// won't get focused automatically), but won't yield any errors.
+    ///
+    /// To obtain a valid token, use
+    #[cfg_attr(
+        any(x11_platform, wayland_platform, docsrs),
+        doc = " [`request_activation_token`](crate::platform::startup_notify::WindowExtStartupNotify::request_activation_token)."
+    )]
+    #[cfg_attr(
+        not(any(x11_platform, wayland_platform, docsrs)),
+        doc = " `request_activation_token`."
+    )]
+    pub fn from_raw(token: String) -> Self {
+        Self { token }
+    }
+
+    /// Convert the token to its string representation to later pass via IPC.
+    pub fn into_raw(self) -> String {
+        self.token
+    }
+}
diff --git a/vendor/winit/tests/send_objects.rs b/vendor/winit/tests/send_objects.rs
new file mode 100644
index 00000000..b8a5d3b7
--- /dev/null
+++ b/vendor/winit/tests/send_objects.rs
@@ -0,0 +1,36 @@
+#[allow(dead_code)]
+fn needs_send<T: Send>() {}
+
+#[test]
+fn event_loop_proxy_send() {
+    #[allow(dead_code)]
+    fn is_send<T: 'static + Send>() {
+        // ensures that `winit::EventLoopProxy<T: Send>` implements `Send`
+        needs_send::<winit::event_loop::EventLoopProxy<T>>();
+    }
+}
+
+#[test]
+fn window_send() {
+    // ensures that `winit::Window` implements `Send`
+    needs_send::<winit::window::Window>();
+}
+
+#[test]
+fn window_builder_send() {
+    needs_send::<winit::window::WindowAttributes>();
+}
+
+#[test]
+fn ids_send() {
+    // ensures that the various `..Id` types implement `Send`
+    needs_send::<winit::window::WindowId>();
+    needs_send::<winit::event::DeviceId>();
+    needs_send::<winit::monitor::MonitorHandle>();
+}
+
+#[test]
+fn custom_cursor_send() {
+    needs_send::<winit::window::CustomCursorSource>();
+    needs_send::<winit::window::CustomCursor>();
+}
diff --git a/vendor/winit/tests/serde_objects.rs b/vendor/winit/tests/serde_objects.rs
new file mode 100644
index 00000000..c427373f
--- /dev/null
+++ b/vendor/winit/tests/serde_objects.rs
@@ -0,0 +1,38 @@
+#![cfg(feature = "serde")]
+
+use serde::{Deserialize, Serialize};
+use winit::dpi::{LogicalPosition, LogicalSize, PhysicalPosition, PhysicalSize};
+use winit::event::{ElementState, MouseButton, MouseScrollDelta, TouchPhase};
+use winit::keyboard::{Key, KeyCode, KeyLocation, ModifiersState, NamedKey, PhysicalKey};
+use winit::window::CursorIcon;
+
+#[allow(dead_code)]
+fn needs_serde<S: Serialize + Deserialize<'static>>() {}
+
+#[test]
+fn window_serde() {
+    needs_serde::<CursorIcon>();
+}
+
+#[test]
+fn events_serde() {
+    needs_serde::<TouchPhase>();
+    needs_serde::<ElementState>();
+    needs_serde::<MouseButton>();
+    needs_serde::<MouseScrollDelta>();
+    needs_serde::<Key>();
+    needs_serde::<NamedKey>();
+    needs_serde::<KeyCode>();
+    needs_serde::<PhysicalKey>();
+    needs_serde::<KeyLocation>();
+    needs_serde::<ModifiersState>();
+}
+
+#[test]
+fn dpi_serde() {
+    needs_serde::<LogicalPosition<f64>>();
+    needs_serde::<PhysicalPosition<i32>>();
+    needs_serde::<PhysicalPosition<f64>>();
+    needs_serde::<LogicalSize<f64>>();
+    needs_serde::<PhysicalSize<u32>>();
+}
diff --git a/vendor/winit/tests/sync_object.rs b/vendor/winit/tests/sync_object.rs
new file mode 100644
index 00000000..c7abbeb2
--- /dev/null
+++ b/vendor/winit/tests/sync_object.rs
@@ -0,0 +1,28 @@
+#[allow(dead_code)]
+fn needs_sync<T: Sync>() {}
+
+#[test]
+fn event_loop_proxy_send() {
+    #[allow(dead_code)]
+    fn is_send<T: 'static + Send>() {
+        // ensures that `winit::EventLoopProxy<T: Send>` implements `Sync`
+        needs_sync::<winit::event_loop::EventLoopProxy<T>>();
+    }
+}
+
+#[test]
+fn window_sync() {
+    // ensures that `winit::Window` implements `Sync`
+    needs_sync::<winit::window::Window>();
+}
+
+#[test]
+fn window_builder_sync() {
+    needs_sync::<winit::window::WindowAttributes>();
+}
+
+#[test]
+fn custom_cursor_sync() {
+    needs_sync::<winit::window::CustomCursorSource>();
+    needs_sync::<winit::window::CustomCursor>();
+}

From 9ed70e185c7d5612ad661457a9393a97484507a5 Mon Sep 17 00:00:00 2001
From: martinjohuber <106869689+martinjohuber@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:23:15 +0200
Subject: [PATCH 086/149] de: translate labels that reach tl!() through
 variables; fix name collisions and wrong meanings (#541)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* de: translate labels that reach tl!() through variables; fix name collisions and wrong meanings

- 32 labels the German catalog was missing because they are looked up
  through a variable (Fill & Sign buttons, link prompts, notices, history
  labels, checker and certificate rows): the UI showed mixed text such as
  "Add Unterschrift" or "A link in diesem Dokument ..."
- Keep the trailing spaces of the digital-ID list parts ("Ausgestellt
  von:Example CA, läuft ab:2031-..." ran together)
- Name collisions: Add a text box / Add a text field, Paste pages / Insert pages
- Wrong meanings: Social Security Numbers (US format only), Clear form
  (resets to defaults), radio-button options called "Schaltfläche", the
  Mark as Confidential description, the first measuring point, Mouse Enter/Exit
- Small grammar fixes; du style and "das PDF" unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* de: drop a leftover merge marker

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml               |  2 +-
 crates/ui-egui/src/i18n/de.tsv | 76 ++++++++++++++++++++++++----------
 2 files changed, 56 insertions(+), 22 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 6fcd39e5..3a004414 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4ba9f2bfc1cca7e819dde79d09c3b128b19a289faf7caa32f6925791683e9538"
+sha256 = "f46a3815d45c4ffba9690dd8c30c1f799bca1620dc33f242e2d27e805f9747a6"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index cd242d2c..52a6678a 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -40,7 +40,7 @@
 	Advanced search…	Erweiterte Suche…
 	Copy pages	Seiten kopieren
 	Cut pages	Seiten ausschneiden
-	Paste pages	Seiten einfügen
+	Paste pages	Kopierte Seiten einfügen
 	Fit visible	Sichtbaren Inhalt einpassen
 	Marquee zoom	Auswahlrahmen-Zoom
 	Take a snapshot	Schnappschuss erstellen
@@ -49,7 +49,7 @@
 	Switch light / dark theme	Helles / dunkles Design umschalten
 	Comments panel	Kommentarbereich
 	Form fields panel	Formularfeldbereich
-	Clear form	Formular leeren
+	Clear form	Formular zurücksetzen
 	Find tools and commands…	Werkzeuge und Befehle suchen…
 	Zoom	Zoom
 	Actual size	Originalgröße
@@ -142,7 +142,7 @@
 	Tool	Werkzeug
 	Command	Befehl
 	Add a sticky note	Notiz hinzufügen
-	Add a text box	Textfeld hinzufügen
+	Add a text box	Textbox hinzufügen
 	Highlight text	Text hervorheben
 	Underline text	Text unterstreichen
 	Strikethrough text	Text durchstreichen
@@ -330,7 +330,7 @@
 	Underline	Unterstreichen
 	Strikethrough	Durchstreichen
 	Squiggly underline	Schlangenlinie
-	Text box	Textfeld
+	Text box	Textbox
 	Drawing	Zeichnen
 	Rectangle	Rechteck
 	Oval	Ellipse
@@ -550,7 +550,7 @@
 	Text Field Properties	Textfeld-Eigenschaften
 	Check Box Properties	Kontrollkästchen-Eigenschaften
 	Radio Button Properties	Optionsfeld-Eigenschaften
-	Dropdown Properties	Dropdown-Liste-Eigenschaften
+	Dropdown Properties	Dropdown-Listen-Eigenschaften
 	List Box Properties	Listenfeld-Eigenschaften
 	Button Properties	Schaltflächen-Eigenschaften
 	Digital Signature Properties	Eigenschaften der digitalen Signatur
@@ -589,8 +589,8 @@
 	Comb of	Kammfeld mit
 	Export Value: {on}	Exportwert: {on}
 	Check box is checked by default	Kontrollkästchen ist standardmäßig aktiviert
-	Button is checked by default	Schaltfläche ist standardmäßig aktiviert
-	Buttons with the same name and value are selected in unison	Schaltflächen mit gleichem Namen und Wert werden gemeinsam ausgewählt
+	Button is checked by default	Optionsfeld ist standardmäßig ausgewählt
+	Buttons with the same name and value are selected in unison	Optionsfelder mit gleichem Namen und Wert werden gemeinsam ausgewählt
 	Item:	Eintrag:
 	Item List	Eintragsliste
 	Up	Nach oben
@@ -629,8 +629,8 @@
 	Select Trigger:	Auslöser auswählen:
 	Mouse Up	Maustaste loslassen
 	Mouse Down	Maustaste drücken
-	Mouse Enter	Maus hinein
-	Mouse Exit	Maus heraus
+	Mouse Enter	Mauszeiger ins Feld bewegen
+	Mouse Exit	Mauszeiger aus dem Feld bewegen
 	On Focus	Fokus erhalten
 	On Blur	Fokus verlieren
 	Select Action:	Aktion auswählen:
@@ -755,7 +755,7 @@
 	Preview: page {p} of {n}	Vorschau: Seite {p} von {n}
 	Applies to 1 page	Gilt für 1 Seite
 	Applies to {n} pages	Gilt für {n} Seiten
-	Replaces the existing one on those pages.	Ersetzt das vorhandene auf diesen Seiten.
+	Replaces the existing one on those pages.	Ersetzt das Vorhandene auf diesen Seiten.
 	PDF or image	PDF oder Bild
 	No file chosen	Keine Datei ausgewählt
 	Page number	Seitenzahl
@@ -788,10 +788,10 @@
 	Couldn't open the signed version: {e}	Die signierte Version konnte nicht geöffnet werden: {e}
 	Sign with a Digital ID	Mit digitaler ID signieren
 	Choose the digital ID that you want to use for signing:	Wähle die digitale ID aus, mit der du signieren möchtest:
-	Keychain  ·  	Schlüsselbund  ·
-	Windows store  ·  	Windows-Zertifikatspeicher  ·
-	Issued by: 	Ausgestellt von:
-	, Expires: 	, läuft ab:
+	Keychain  ·  	Schlüsselbund  ·  
+	Windows store  ·  	Windows-Zertifikatspeicher  ·  
+	Issued by: 	Ausgestellt von: 
+	, Expires: 	, läuft ab: 
 	No digital IDs yet.	Noch keine digitalen IDs.
 	Configure New Digital ID	Neue digitale ID einrichten
 	Continue	Weiter
@@ -879,7 +879,7 @@
 	Add Page Numbers	Seitenzahlen hinzufügen
 	Number every page in the footer.	Jede Seite in der Fußzeile nummerieren.
 	Mark as Confidential	Als vertraulich kennzeichnen
-	A diagonal CONFIDENTIAL watermark on every page.	Ein diagonales Wasserzeichen „VERTRAULICH“ auf jeder Seite.
+	A diagonal CONFIDENTIAL watermark on every page.	Ein diagonales Wasserzeichen „CONFIDENTIAL“ auf jeder Seite.
 	Sanitize Documents	Dokumente bereinigen
 	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Ausgeblendete Informationen, Metadaten, Skripte und eingebettete Inhalte entfernen und die Dateien neu schreiben.
 	Type text	Text eingeben
@@ -963,7 +963,7 @@
 	Headings	Überschriften
 	Accessibility permission flag	Berechtigung für Barrierefreiheit
 	Accessibility permission flag is set	Berechtigung für Barrierefreiheit ist gesetzt
-	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Die Sicherheitseinstellungen müssen Hilfstechnologien das Lesen des Inhalts erlauben („Textzugriff für Screenreader aktivieren“). Ändere die Sicherheit des Dokuments, um dies zu erlauben.
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Die Sicherheitseinstellungen müssen Hilfstechnologien das Lesen des Inhalts erlauben („Textzugriff für Screenreader für Sehbehinderte erlauben“). Ändere die Sicherheit des Dokuments, um dies zu erlauben.
 	Image-only PDF	Reines Bild-PDF
 	Document is not image-only PDF	Dokument ist kein reines Bild-PDF
 	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Seiten, die nur aus Bildern von Text bestehen, können weder vorgelesen noch durchsucht werden. Führe Text erkennen (OCR) aus, um eine Textebene hinzuzufügen.
@@ -1059,7 +1059,7 @@
 	Phone Numbers	Telefonnummern
 	Email Addresses	E-Mail-Adressen
 	Credit Cards	Kreditkarten
-	Social Security Numbers	Sozialversicherungsnummern
+	Social Security Numbers	US-Sozialversicherungsnummern
 	Dates	Datumsangaben
 	Text in images isn't found; recognise text (OCR) first.	Text in Bildern wird nicht gefunden; führe zuerst Text erkennen (OCR) aus.
 	No matches.	Keine Treffer.
@@ -1203,7 +1203,7 @@
 	Add a reply	Antwort hinzufügen
 	Post	Senden
 	Page {label}	Seite {label}
-	{kind} — click to show it on the page	{kind} – klicken, um es auf der Seite anzuzeigen
+	{kind} — click to show it on the page	{kind} – zum Anzeigen auf der Seite klicken
 	Set status	Status festlegen
 	Copy text	Text kopieren
 	Properties…	Eigenschaften…
@@ -1736,7 +1736,7 @@
 	Images and text (converted to PDF)	Bilder und Text (in PDF konvertiert)
 	Images and text	Bilder und Text
 	Check Box Style:	Stil des Kontrollkästchens:
-	Button Style:	Stil der Schaltfläche:
+	Button Style:	Stil des Optionsfelds:
 	Check	Häkchen
 	Circle	Kreis
 	Diamond	Raute
@@ -1803,7 +1803,7 @@
 	Add arrow	Pfeil hinzufügen
 	Add line	Linie hinzufügen
 	Add drawing	Zeichnung hinzufügen
-	Add text box	Textfeld hinzufügen
+	Add text box	Textbox hinzufügen
 	Add checkmark	Häkchen hinzufügen
 	Add cross	Kreuz hinzufügen
 	Add dot	Punkt hinzufügen
@@ -1847,7 +1847,7 @@
 	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Klicke Eckpunkte an. Enter oder Doppelklick schließt einen Umfang oder eine Fläche ab. Klicke auf den ersten Punkt, um eine Fläche zu schließen.
 	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift beschränkt auf 45 Grad. Rücktaste entfernt einen Eckpunkt. Escape bricht ab.
 	Angle	Winkel
-	Click the first point to begin.	Klicke auf den ersten Punkt, um zu beginnen.
+	Click the first point to begin.	Klicke, um den ersten Punkt zu setzen.
 	Snap to drawing	An Zeichnung einrasten
 	Endpoints	Endpunkte
 	Midpoints	Mittelpunkte
@@ -2045,6 +2045,40 @@ comment menu	Edit	Bearbeiten
 signature pad	Type	Tippen
 action wizard	Start	Starten
 	Reopen the files that were open when PdfCraft last closed	Beim Start die Dateien wieder öffnen, die beim letzten Beenden von PdfCraft geöffnet waren
+
+# Labels that reach tl!() through a variable (Fill & Sign buttons, link prompts, notices, history labels, checker and certificate rows)
+	Add {what}	{what} hinzufügen
+	Use {what}	{what} verwenden
+	Place saved {what}	Gespeicherte {what} platzieren
+	Remove saved {what}	Gespeicherte {what} entfernen
+	A link	Ein Link
+	A button	Eine Schaltfläche
+	A script	Ein Skript
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	{who} in diesem Dokument wollte eine Adresse öffnen, die PdfCraft nicht öffnet: {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} in diesem Dokument wollte eine Adresse öffnen, die PdfCraft nicht öffnet: {e}. Aus Dokumenten heraus öffnet PdfCraft nur Web-Links (http, https) und E-Mail-Links (mailto).
+	Another file dialog is still open. Finish with it first.	Ein anderer Dateidialog ist noch geöffnet. Schließe ihn zuerst.
+	Couldn't show the file picker. Please try again.	Die Dateiauswahl konnte nicht angezeigt werden. Versuch es noch einmal.
+	The document changed while you were choosing a file, so nothing was changed.	Das Dokument hat sich geändert, während du eine Datei ausgewählt hast; deshalb wurde nichts geändert.
+	The document was closed before it could be saved.	Das Dokument wurde geschlossen, bevor es gespeichert werden konnte.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Die Seiten wurden extrahiert, aber nicht gelöscht, weil sich das Dokument geändert hat, während du einen Ordner ausgewählt hast.
+	That didn't work: an internal error stopped it ({m}).	Das hat nicht geklappt: Ein interner Fehler ist aufgetreten ({m}).
+	The Windows store's digital IDs couldn't be listed: {e}	Die digitalen IDs im Windows-Zertifikatspeicher konnten nicht aufgelistet werden: {e}
+	Align fields	Felder ausrichten
+	Distribute fields	Felder verteilen
+	Match field sizes	Feldgrößen angleichen
+	Mark for redaction	Zum Schwärzen markieren
+	Mark pages for redaction	Seiten zum Schwärzen markieren
+	Change document properties	Dokumenteigenschaften ändern
+	Mark differences	Unterschiede markieren
+	Run form script	Formularskript ausführen
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Skriptgesteuerte Inhalte müssen mit Tastatur und Hilfstechnologien bedienbar sein. Prüfe die Skripte des Dokuments.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Tabellenzeilen gehören direkt in eine Tabelle oder in deren Kopf-, Haupt- oder Fußbereich. Korrigiere die Tags der Tabelle.
+	Basic constraints	Basiseinschränkungen
+	SHA-1 digest	SHA-1-Fingerabdruck
+	SHA-256 digest	SHA-256-Fingerabdruck
+	Squiggly	Schlangenlinie
+	Home / End	Pos1 / Ende
+	H / Space (hold)	H / Leertaste (halten)
 	Clear Recent Files	Liste „Zuletzt geöffnet“ leeren
 	Remove from Recent	Aus „Zuletzt geöffnet“ entfernen
 	Remove {name} from Recent	{name} aus „Zuletzt geöffnet“ entfernen

From 95120862fc0445e0bd56b3f13ca3fce870a7a357 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rk=20Bartalos?= <bartalos86@gmail.com>
Date: Fri, 9 Oct 2026 18:28:06 +0200
Subject: [PATCH 087/149] M14: Hungarian interface catalog (hu) (#545)

* M14: Hungarian interface catalog (hu)

Magyar joins the interface languages as a complete catalog, so Preferences and hu locales show commands, dialogs, panels and notices in Hungarian. Wording uses informal "te" and nouns for commands; the strings were written from the meaning of the English labels.

* Small grammar correction

* hu: restore trailing spaces in run-on labels; add the recent-files labels and labels that reach tl!() through a variable

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.md                 |    3 +-
 ATTRIBUTION.toml               |   11 +
 ROADMAP.md                     |    1 +
 crates/ui-egui/src/i18n/hu.tsv | 2084 ++++++++++++++++++++++++++++++++
 crates/ui-egui/src/i18n/mod.rs |  115 +-
 crates/ui-egui/tests/fonts.rs  |    5 +-
 docs/localization.md           |   10 +-
 parity/acrobat-features.toml   |    4 +-
 8 files changed, 2222 insertions(+), 11 deletions(-)
 create mode 100644 crates/ui-egui/src/i18n/hu.tsv

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 007e0330..da39180e 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (255)
+## In this repository (256)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -17,6 +17,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/de.tsv` | German interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ru.tsv` | Russian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/hu.tsv` | Hungarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/bg.tsv` | Bulgarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ja.tsv` | Japanese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 3a004414..6e8f5cda 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -109,6 +109,17 @@ kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
 sha256 = "1782bfb95566a44e9cc3e22a595ff158965c55b67936d994a8dae9b3e51975a2"
 
+[[asset]]
+path = "crates/ui-egui/src/i18n/hu.tsv"
+title = "Hungarian interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "96fa31e4e77f54680ee2d66ad2a8d6662fd6dea592f8b07126e06f0bcbfc5248"
+
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
 title = "Bulgarian interface translation catalog"
diff --git a/ROADMAP.md b/ROADMAP.md
index a9d1a6ce..a48c118c 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -141,6 +141,7 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (community, M14, Hungarian):** Magyar (`hu`) is a complete interface catalog (2,036 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `hu` and `hu_HU`, and from Preferences. Informal "te"; commands are nouns (Mentés, Megnyitás). After a numeral the noun stays singular, so both plural forms match. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover Hungarian diacritics including ő and ű. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, M14, German):** Deutsch (`de`) is a complete interface catalog (2,035 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `de`, `de_DE`, `de_AT`, `de_CH` and other German locales, and from Preferences. Informal "du", infinitive for commands. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover umlauts, ß and German quotes. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, M7, Arabic added text):** Add text writes Arabic into the PDF instead of `?`. The text is shaped with the craft-fonts `Arab` face through harfrust (already in the tree via egui): joining forms, ligatures and mark positions. Each line is laid out in display order by the Unicode bidirectional algorithm, so Arabic mixed with Latin words, European or Arabic-Indic digits and brackets reads correctly; justified right-to-left paragraphs end at the right edge. Each cluster (a letter with its dots or marks) becomes one glyph of a Type 3 font built from the face's outlines, with a ToUnicode entry, so `text_extract`, copy and search get every letter once and no font file is embedded. Wrapping measures shaped words. Each item has its own fonts under names free on the page (a full save renumbers objects but not resource names); updating or deleting the item removes them. Without the face, adding Arabic text returns a clear error and changes nothing, while an existing item holding Arabic still moves and retypes, drawn as `?` as before. Tests cover shaping, display order, ToUnicode, font names and clean-up on one page, and odd input (empty lines, direction controls, lone marks, 18,000 characters). Not yet: bold/italic Arabic, Hebrew, right-to-left typing in the box (misc.rtl-ui), editing existing Arabic text (edit.rtl-cjk-editing). The craft-fonts revision pinned for releases predates its Arabic face, so release builds report the missing font until the pin moves. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
new file mode 100644
index 00000000..acf390f2
--- /dev/null
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -0,0 +1,2084 @@
+# Hungarian (hu) catalog. Format: see the header of ja.tsv
+# (context <TAB> source <TAB> translation; @id, @plural and other contexts; escapes \n \t \\).
+# Plural forms (see `plural_one_other` in i18n/mod.rs): one (1) | other (0, 2, 3 ...).
+# After a numeral the noun stays singular (1 oldal, 0 oldal, 2 oldal), so both forms match.
+#
+# Clean-room: every entry was written from the plain meaning of the English label using ordinary
+# Hungarian computing vocabulary (informal "te", nouns for commands such as Mentés and Megnyitás).
+# No proprietary localisation resource, string table or product UI (Acrobat's included) was
+# consulted or copied; add entries the same way.
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
+# the trailing "…" of dialog commands is kept.
+	Menu	Menü
+	File	Fájl
+	Edit	Szerkesztés
+	Pages	Oldalak
+	View	Nézet
+	Help	Súgó
+	Preferences	Beállítások
+	Preferences…	Beállítások…
+	Interface language	Felület nyelve
+	Identity	Személyazonosság
+	Name on new comments	Név az új megjegyzéseken
+	Open…	Megnyitás…
+	New blank PDF	Új üres PDF
+	Create PDF from file…	PDF létrehozása fájlból…
+	Create PDF from images…	PDF létrehozása képekből…
+	Create PDF from multiple files…	PDF létrehozása több fájlból…
+	Create PDF from clipboard	PDF létrehozása a vágólapról
+	Combine files…	Fájlok egyesítése…
+	Save	Mentés
+	Save as…	Mentés másként…
+	Close file	Fájl bezárása
+	Close all	Összes bezárása
+	Revert	Visszaállítás
+	Print…	Nyomtatás…
+	Document properties…	Dokumentum tulajdonságai…
+	Undo	Visszavonás
+	Redo	Újra
+	Find…	Keresés…
+	Advanced search…	Részletes keresés…
+	Copy pages	Oldalak másolása
+	Cut pages	Oldalak kivágása
+	Paste pages	Oldalak beillesztése
+	Fit visible	Látható tartalomhoz igazítás
+	Marquee zoom	Kijelölő nagyítás
+	Take a snapshot	Pillanatkép
+	Full screen mode	Teljes képernyő
+	Read mode	Olvasási mód
+	Switch light / dark theme	Világos / sötét téma váltása
+	Comments panel	Megjegyzések panel
+	Form fields panel	Űrlapmezők panel
+	Clear form	Űrlap kiürítése
+	Find tools and commands…	Eszközök és parancsok keresése…
+	Zoom	Nagyítás
+	Actual size	Tényleges méret
+	Zoom to page level	Teljes oldal
+	Fit to width	Szélességhez igazítás
+	Display theme	Megjelenítési téma
+	Side panels	Oldalsó panelek
+	Enable Acrobat JavaScript	Acrobat JavaScript engedélyezése
+	OK	OK
+	Join our Discord	Csatlakozás a Discordhoz
+	Close	Bezárás
+	Next / previous match	Következő / előző találat
+	Copy selected text	Kijelölt szöveg másolása
+	Double-click	Dupla kattintás
+	Select a word	Szó kijelölése
+	Clear selection / close find	Kijelölés törlése / keresés bezárása
+	Zoom in / out (also pinch or ⌘-scroll)	Nagyítás / kicsinyítés (csípéssel vagy ⌘-görgetéssel is)
+	Rotate view	Nézet forgatása
+	First / last page	Első / utolsó oldal
+	Previous / next page	Előző / következő oldal
+	Delete selected pages (Organize)	Kijelölt oldalak törlése (Rendezés)
+	Select all pages (Organize)	Összes oldal kijelölése (Rendezés)
+	Home	Kezdőlap
+	Open	Megnyitás
+	Open a PDF (⌘O)	PDF megnyitása (⌘O)
+	Dark gray theme	Sötétszürke téma
+	Light theme	Világos téma
+	All tools	Minden eszköz
+	Read	Olvasás
+	Convert	Konvertálás
+	E-Sign	E-aláírás
+	Print (⌘P)	Nyomtatás (⌘P)
+	Save (M4)	Mentés (M4)
+	Document properties (⌘D)	Dokumentum tulajdonságai (⌘D)
+	Find tools and commands	Eszközök és parancsok keresése
+	Fit to height	Magassághoz igazítás
+	Zoom in	Nagyítás
+	Zoom out	Kicsinyítés
+	Rotate view clockwise	Nézet forgatása az óramutató járásával megegyezően
+	Rotate view counterclockwise	Nézet forgatása az óramutató járásával ellentétesen
+	Page navigation	Oldalnavigáció
+	Previous view	Előző nézet
+	Next view	Következő nézet
+	Page display	Oldalmegjelenítés
+	Continuous scrolling	Folyamatos görgetés
+	Two-page view	Kétoldalas nézet
+	Single page	Egy oldal
+	Show cover page in two-page view	Borító megjelenítése kétoldalas nézetben
+	Use system setting	Rendszerbeállítás használata
+	Light gray	Világosszürke
+	Dark gray	Sötétszürke
+	Comments	Megjegyzések
+	Bookmarks	Könyvjelzők
+	Fields	Mezők
+	Layers	Rétegek
+	Attachments	Mellékletek
+	Signatures	Aláírások
+	Accessibility Checker	Akadálymentesség ellenőrzése
+	Search	Keresés
+	Compare	Összehasonlítás
+	Page thumbnails	Oldalbélyegképek
+	Form fields	Űrlapmezők
+	Zoom out (⌘−)	Kicsinyítés (⌘−)
+	Zoom in (⌘+)	Nagyítás (⌘+)
+	Rotate view clockwise (⇧⌘+)	Nézet forgatása az óramutató járásával megegyezően (⇧⌘+)
+	Toggle fit page / fit width	Teljes oldal / szélesség váltása
+	Next page	Következő oldal
+	Previous page	Előző oldal
+	Current page — type a page number or label (such as iv) and press Enter	Aktuális oldal — írj be egy oldalszámot vagy címkét (például iv), majd nyomd meg az Entert
+	Welcome to PdfCraft	Üdvözöljük a PdfCraftban
+	An open-source PDF workbench — local, private, and scriptable.	Nyílt forráskódú PDF-munkapad — helyi, privát és parancsfájlokkal vezérelhető.
+	Join the ArtCraft community	Csatlakozz az ArtCraft közösséghez
+	Get help, share feedback and follow development on Discord.	Kérj segítséget, oszd meg a véleményed, és kövesd a fejlesztést a Discordon.
+	Recommended tools	Ajánlott eszközök
+	Use now	Használat most
+	Open file	Fájl megnyitása
+	Recent	Legutóbbiak
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	A PdfCraftban megnyitott fájlok itt jelennek meg. Húzz ide egy PDF-et a megnyitáshoz.
+	Privacy	Adatvédelem
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	A PdfCraft offline működik. Nincs telemetria, nincs fiók, és nincs felhőfeldolgozás, amíg nem adsz hozzá szolgáltatót.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	A szkriptek homokozóban futnak, fájl- és hálózat-hozzáférés nélkül. Kikapcsolt JavaScript mellett az Acrobat szabványos formázó, ellenőrző és számoló függvényei továbbra is működnek.
+	Back to all tools	Vissza az összes eszközhöz
+	Close panel	Panel bezárása
+	View less	Kevesebb megjelenítése
+	View more	Több megjelenítése
+	Available	Elérhető
+	Ready	Kész
+	Search tools and commands…	Eszközök és parancsok keresése…
+	No matching tools	Nincs illeszkedő eszköz
+	Tool	Eszköz
+	Command	Parancs
+	Add a sticky note	Cetli hozzáadása
+	Add a text box	Szövegdoboz hozzáadása
+	Highlight text	Szöveg kiemelése
+	Underline text	Szöveg aláhúzása
+	Strikethrough text	Szöveg áthúzása
+	Squiggly underline text	Szöveg hullámos aláhúzása
+	Draw freehand	Szabadkézi rajz
+	Draw a line	Vonal rajzolása
+	Draw an arrow	Nyíl rajzolása
+	Draw a rectangle	Téglalap rajzolása
+	Draw an oval	Ellipszis rajzolása
+	Draw a polygon	Sokszög rajzolása
+	Draw connected lines	Összekötött vonalak rajzolása
+	Draw a cloud	Felhő rajzolása
+	Add a callout	Szövegbuborék hozzáadása
+	Insert text	Szöveg beszúrása
+	Replace text	Szöveg cseréje
+	Attach a file	Fájl csatolása
+	Erase drawings	Rajzok törlése
+	Flatten comments	Megjegyzések beégetése
+	Import comments…	Megjegyzések importálása…
+	Add a stamp	Bélyegző hozzáadása
+	Export all comments to data file…	Összes megjegyzés exportálása adatfájlba…
+	Hide all comments	Összes megjegyzés elrejtése
+	Summarize comments	Megjegyzések összefoglalása
+	Import form data…	Űrlapadatok importálása…
+	Export form data…	Űrlapadatok exportálása…
+	PDF/A…	PDF/A…
+	Action Wizard…	Műveletvarázsló…
+	Prepare for distribution…	Előkészítés terjesztésre…
+	Optimize scanned documents…	Beolvasott dokumentumok optimalizálása…
+	Compare files…	Fájlok összehasonlítása…
+	Detect form fields	Űrlapmezők felismerése
+	Merge data files into spreadsheet…	Adatfájlok egyesítése táblázatba…
+	Flatten form fields	Űrlapmezők beégetése
+	Prepare a form	Űrlap előkészítése
+	Tab order: by rows	Tab-sorrend: soronként
+	Tab order: by columns	Tab-sorrend: oszloponként
+	Tab order: by document structure	Tab-sorrend: a dokumentum szerkezete szerint
+	Add text	Szöveg hozzáadása
+	Edit text & images	Szöveg és képek szerkesztése
+	Add or edit links	Hivatkozások hozzáadása vagy szerkesztése
+	Create links from URLs	Hivatkozások létrehozása URL-ekből
+	Remove all links	Összes hivatkozás eltávolítása
+	Add Bates numbering…	Bates-számozás hozzáadása…
+	Add image…	Kép hozzáadása…
+	Redact text and images	Szöveg és képek kitakarása
+	Redact pages…	Oldalak kitakarása…
+	Find text and redact…	Szöveg keresése és kitakarása…
+	Redaction properties…	Kitakarás tulajdonságai…
+	Apply redactions…	Kitakarások alkalmazása…
+	Clear redaction marks	Kitakarásjelölések törlése
+	Remove hidden information…	Rejtett adatok eltávolítása…
+	Sanitize document…	Dokumentum megtisztítása…
+	Field properties…	Mező tulajdonságai…
+	Add a text field	Szövegmező hozzáadása
+	Add a checkbox	Jelölőnégyzet hozzáadása
+	Add a radio button	Választógomb hozzáadása
+	Add a drop-down list	Legördülő lista hozzáadása
+	Add a list box	Lista hozzáadása
+	Add a button	Gomb hozzáadása
+	Add an image field	Képmező hozzáadása
+	Add a date field	Dátummező hozzáadása
+	Add a digital signature field	Digitális aláírás mező hozzáadása
+	Digitally sign	Digitális aláírás
+	Certify (visible signature)	Hitelesítés (látható aláírás)
+	Certify (invisible signature)	Hitelesítés (láthatatlan aláírás)
+	Validate all signatures	Összes aláírás ellenőrzése
+	Signatures panel	Aláírások panel
+	Fill & Sign: add text	Kitöltés és aláírás: szöveg hozzáadása
+	Fill & Sign: checkmark	Kitöltés és aláírás: pipa
+	Fill & Sign: cross	Kitöltés és aláírás: kereszt
+	Fill & Sign: dot	Kitöltés és aláírás: pont
+	Fill & Sign: line	Kitöltés és aláírás: vonal
+	Fill & Sign: date	Kitöltés és aláírás: dátum
+	Fill & Sign: sign	Kitöltés és aláírás: aláírás
+	Fill & Sign: initials	Kitöltés és aláírás: monogram
+	Export to image…	Exportálás képként…
+	Reduce file size…	Fájlméret csökkentése…
+	Optimize PDF…	PDF optimalizálása…
+	Export to text…	Exportálás szövegként…
+	Export to Word…	Exportálás Wordbe…
+	Export to HTML…	Exportálás HTML-be…
+	Export to RTF…	Exportálás RTF-be…
+	JavaScript console…	JavaScript-konzol…
+	Document JavaScripts…	Dokumentum JavaScriptjei…
+	Recognize text…	Szövegfelismerés…
+	Recognize text in multiple files…	Szövegfelismerés több fájlban…
+	Check for accessibility…	Akadálymentesség ellenőrzése…
+	Open accessibility report	Akadálymentességi jelentés megnyitása
+	Change reading options…	Olvasási beállítások módosítása…
+	Add alternate text…	Helyettesítő szöveg hozzáadása…
+	Export all images…	Összes kép exportálása…
+	Add header & footer…	Fejléc és lábléc hozzáadása…
+	Update header & footer…	Fejléc és lábléc frissítése…
+	Remove header & footer	Fejléc és lábléc eltávolítása
+	Add watermark…	Vízjel hozzáadása…
+	Update watermark…	Vízjel frissítése…
+	Remove watermark	Vízjel eltávolítása
+	Add background…	Háttér hozzáadása…
+	Update background…	Háttér frissítése…
+	Remove background	Háttér eltávolítása
+	Protect using password…	Jelszavas védelem…
+	Remove security	Védelem eltávolítása
+	Security properties…	Biztonság tulajdonságai…
+	Organize pages	Oldalak rendezése
+	New bookmark	Új könyvjelző
+	Rotate pages clockwise	Oldalak forgatása az óramutató járásával megegyezően
+	Rotate pages counterclockwise	Oldalak forgatása az óramutató járásával ellentétesen
+	Delete pages	Oldalak törlése
+	Insert blank page	Üres oldal beszúrása
+	Rotate pages…	Oldalak forgatása…
+	Duplicate pages	Oldalak megkettőzése
+	Crop pages	Oldalak levágása
+	Set page boxes…	Oldalkeretek beállítása…
+	Insert pages from file…	Oldalak beszúrása fájlból…
+	Replace pages…	Oldalak cseréje…
+	Extract pages…	Oldalak kinyerése…
+	Split document…	Dokumentum felosztása…
+	Number pages…	Oldalak számozása…
+	Keyboard shortcuts	Billentyűparancsok
+	Join the ArtCraft Discord	Csatlakozás az ArtCraft Discordhoz
+	PdfCraft web page	A PdfCraft weblapja
+	PdfCraft on GitHub	PdfCraft a GitHubon
+	ArtCraft website	Az ArtCraft webhelye
+	Check for updates…	Frissítések keresése…
+	About PdfCraft	A PdfCraftról
+	Export a PDF	PDF exportálása
+	Export to	Exportálás ide
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Spreadsheet (.xlsx)	Táblázat (.xlsx)
+	Presentation (.pptx)	Bemutató (.pptx)
+	Image (PNG)	Kép (PNG)
+	Export all images	Összes kép exportálása
+	HTML web page	HTML-weboldal
+	Rich Text Format (.rtf)	Rich Text formátum (.rtf)
+	Text (plain)	Szöveg (formázatlan)
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	Kitöltés és aláírás
+	Fill	Kitöltés
+	Checkmark	Pipa
+	Cross	Kereszt
+	Dot	Pont
+	Line	Vonal
+	Date	Dátum
+	Signature	Aláírás
+	Initials	Monogram
+	Edit a PDF	PDF szerkesztése
+	Modify page	Oldal módosítása
+	Rotate pages	Oldalak forgatása
+	Insert pages	Oldalak beszúrása
+	Extract pages	Oldalak kinyerése
+	Add content	Tartalom hozzáadása
+	Text	Szöveg
+	Image	Kép
+	Header and footer	Fejléc és lábléc
+	Watermark	Vízjel
+	Link	Hivatkozás
+	Bates numbering	Bates-számozás
+	Background	Háttér
+	Attach file	Fájl csatolása
+	Create a PDF	PDF létrehozása
+	Create from	Létrehozás ebből
+	Single file	Egy fájl
+	Multiple files	Több fájl
+	Images	Képek
+	Clipboard	Vágólap
+	Blank page	Üres oldal
+	Combine files	Fájlok egyesítése
+	Combine	Egyesítés
+	Add files to combine	Fájlok hozzáadása az egyesítéshez
+	Page options	Oldalbeállítások
+	Page grid	Oldalrács
+	Rotate	Forgatás
+	Delete	Törlés
+	Extract	Kinyerés
+	Insert	Beszúrás
+	Replace	Csere
+	Split	Felosztás
+	More	Továbbiak
+	Set page boxes	Oldalkeretek beállítása
+	Page labels	Oldalcímkék
+	Page transitions	Oldalváltások
+	Add comments	Megjegyzések hozzáadása
+	Markup	Jelölés
+	Sticky note	Cetli
+	Underline	Aláhúzás
+	Strikethrough	Áthúzás
+	Squiggly underline	Hullámos aláhúzás
+	Text box	Szövegdoboz
+	Drawing	Rajz
+	Rectangle	Téglalap
+	Oval	Ellipszis
+	Arrow	Nyíl
+	Cloud	Felhő
+	Stamp	Bélyegző
+	Review	Átnézés
+	Comment list	Megjegyzéslista
+	Scan & OCR	Beolvasás és OCR
+	Recognize text	Szövegfelismerés
+	In this file	Ebben a fájlban
+	In multiple files	Több fájlban
+	Enhance scanned file	Beolvasott fájl javítása
+	Correct recognized text	Felismert szöveg javítása
+	Protect a PDF	PDF védelme
+	Protect	Védelem
+	Protect with password	Jelszavas védelem
+	Remove hidden information	Rejtett adatok eltávolítása
+	Advanced options	Speciális beállítások
+	Encrypt with certificate	Titkosítás tanúsítvánnyal
+	Security properties	Biztonság tulajdonságai
+	Redact a PDF	PDF kitakarása
+	Redact	Kitakarás
+	Redact pages	Oldalak kitakarása
+	Find text and redact	Szöveg keresése és kitakarása
+	Set properties	Tulajdonságok beállítása
+	Sanitize document	Dokumentum megtisztítása
+	Compress a PDF	PDF tömörítése
+	Optimize	Optimalizálás
+	Reduce file size	Fájlméret csökkentése
+	Advanced optimization	Speciális optimalizálás
+	Audit space usage	Helyfoglalás vizsgálata
+	Field list	Mezőlista
+	Field properties	Mező tulajdonságai
+	Tab order by rows	Tab-sorrend soronként
+	Tab order by columns	Tab-sorrend oszloponként
+	Import data	Adatok importálása
+	Export data	Adatok exportálása
+	Add form components	Űrlapelemek hozzáadása
+	Text field	Szövegmező
+	Checkbox	Jelölőnégyzet
+	Radio button	Választógomb
+	Drop-down list	Legördülő lista
+	List box	Lista
+	Button	Gomb
+	Image field	Képmező
+	Date field	Dátummező
+	Digital signature	Digitális aláírás
+	Stamps	Bélyegzők
+	Stamp palette	Bélyegzőpaletta
+	Use a certificate	Tanúsítvány használata
+	Certificates	Tanúsítványok
+	Timestamp	Időbélyeg
+	Use print production	Nyomdai előkészítés használata
+	Print production	Nyomdai előkészítés
+	Output preview	Kimenet előnézete
+	Preflight	Elővizsgálat
+	Convert colors	Színek konvertálása
+	Add printer marks	Nyomdai jelek hozzáadása
+	Fix hairlines	Hajszálvonalak javítása
+	Measure objects	Objektumok mérése
+	Measure	Mérés
+	Measuring tool	Mérőeszköz
+	Geospatial location	Földrajzi hely
+	Compare files	Fájlok összehasonlítása
+	Select files to compare	Összehasonlítandó fájlok kiválasztása
+	Use guided actions	Irányított műveletek használata
+	Actions list	Műveletlista
+	Action Wizard	Műveletvarázsló
+	Make accessible	Akadálymentesítés
+	Prepare for distribution	Előkészítés terjesztésre
+	Optimize scanned documents	Beolvasott dokumentumok optimalizálása
+	Archive documents	Dokumentumok archiválása
+	Prepare for accessibility	Előkészítés az akadálymentességhez
+	Accessibility	Akadálymentesség
+	Automatically tag PDF	PDF automatikus címkézése
+	Change reading options	Olvasási beállítások módosítása
+	Check for accessibility	Akadálymentesség ellenőrzése
+	Add alternate text	Helyettesítő szöveg hozzáadása
+	Fix reading order	Olvasási sorrend javítása
+	Apply PDF standards	PDF-szabványok alkalmazása
+	Standards	Szabványok
+	Save as PDF/A	Mentés PDF/A-ként
+	Save as PDF/X	Mentés PDF/X-ként
+	Save as PDF/UA	Mentés PDF/UA-ként
+	Add search index	Keresőindex hozzáadása
+	Index	Index
+	Manage embedded index	Beágyazott index kezelése
+	Use JavaScript	JavaScript használata
+	JavaScript	JavaScript
+	Console	Konzol
+	Document JavaScripts	Dokumentum JavaScriptjei
+	Document actions	Dokumentumműveletek
+	AI assistant	MI-asszisztens
+	Bring your own model (off by default)	Saját modell használata (alapból ki van kapcsolva)
+	Summarize	Összefoglalás
+	Ask about this document	Kérdezz erről a dokumentumról
+	Translate	Fordítás
+	pages	oldal
+	Planned	Tervezett
+	Planned for milestone	Erre a mérföldkőre tervezve
+	open to see what it will include	nyisd meg, és meglátod, mi lesz benne
+	Optional: needs an AI provider you configure	Nem kötelező: egy általad beállított MI-szolgáltató kell hozzá
+	Coming in milestone	Ebben a mérföldkőben érkezik
+	Items marked Ready work today.	A Kész jelölésű elemek már működnek.
+	Preview	Előnézet
+	Edit fields	Mezők szerkesztése
+	Try the form as people filling it in will see it	Próbáld ki az űrlapot úgy, ahogy a kitöltők látják
+	Redact all	Összes kitakarása
+	Clear all	Összes törlése
+	Rotate page	Oldal forgatása
+	Delete page	Oldal törlése
+	Move page	Oldal áthelyezése
+	Move pages	Oldalak áthelyezése
+	Duplicate page	Oldal megkettőzése
+	Replace page	Oldal cseréje
+	Replace pages	Oldalak cseréje
+	Crop page	Oldal levágása
+	Cancel	Mégse
+	Don't save	Nincs mentés
+	Apply	Alkalmaz
+	Run	Futtatás
+	Clear	Törlés
+	Sanitize	Megtisztítás
+	Mark all	Összes megjelölése
+	Save changes to “{name}” before closing?	Mented „{name}” módosításait bezárás előtt?
+	Your changes will be lost if you don't save them.	A módosításaid elvesznek, ha nem mented őket.
+	Password required	Jelszó szükséges
+	“{name}” is protected. Enter a password to open it.	„{name}” védett. Add meg a jelszót a megnyitásához.
+	Password	Jelszó
+	Incorrect password. Try again.	Hibás jelszó. Próbáld újra.
+	Recognize Text	Szövegfelismerés
+	Password protection will be applied when you save	A jelszavas védelem mentéskor lép életbe
+	Saved the print-ready PDF to {path}	A nyomdakész PDF mentve ide: {path}
+	Could not save: {e}	A mentés nem sikerült: {e}
+	Earlier in tab order	Előbbre a tab-sorrendben
+	Later in tab order	Hátrébb a tab-sorrendben
+	From:	Ettől:
+	To:	Eddig:
+	High Resolution	Nagy felbontás
+	Print	Nyomtatás
+	Verify to see what the document needs.	Ellenőrizd, mire van szüksége a dokumentumnak.
+	Set Page Boxes	Oldalkeretek beállítása
+	Signature panel	Aláírás panel
+	{month} {day}, {y}	{y}. {month} {day}.
+	The document's security settings don't allow filling in form fields	A dokumentum biztonsági beállításai nem engedik az űrlapmezők kitöltését
+	{name} is read-only	{name} csak olvasható
+	{name} has no action	{name} művelet nélkül
+	Previous month	Előző hónap
+	Next month	Következő hónap
+	January	január
+	February	február
+	March	március
+	April	április
+	May	május
+	June	június
+	July	július
+	August	augusztus
+	September	szeptember
+	October	október
+	November	november
+	December	december
+	Done	Kész
+	This certificate is in your list of trusted certificates.	Ez a tanúsítvány a megbízható tanúsítványaid között van.
+	This certificate is trusted through a certificate above it in the chain.	Ez a tanúsítvány a láncban fölötte lévő tanúsítványon keresztül megbízható.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Ez a tanúsítvány nem megbízható. A vele készült aláírások ismeretlen személyt mutatnak.
+	Add to Trusted Certificates	Hozzáadás a megbízható tanúsítványokhoz
+	Export…	Exportálás…
+	PDF Optimizer	PDF-optimalizáló
+	Discard Objects	Objektumok elvetése
+	Discard User Data	Felhasználói adatok elvetése
+	Clean Up	Tisztítás
+	Color Images	Színes képek
+	Grayscale Images	Szürkeárnyalatos képek
+	Bicubic downsampling to	Kettős köbös újramintázás erre
+	for images above	az ennél nagyobb képeknél
+	Compression	Tömörítés
+	ZIP	ZIP
+	Retain existing	Meglévő megtartása
+	Minimum	Minimális
+	Low	Alacsony
+	High	Magas
+	Maximum	Maximális
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Minden kép a lapon megjelenő méretében van mérve; csak akkor cserélődik, ha az eredmény kisebb.
+	Discard all links, actions and JavaScript	Összes hivatkozás, művelet és JavaScript elvetése
+	Discard alternate images	Alternatív képek elvetése
+	Discard embedded page thumbnails	Beágyazott oldalbélyegképek elvetése
+	Discard document tags	Dokumentumcímkék elvetése
+	Discard embedded print settings	Beágyazott nyomtatási beállítások elvetése
+	Discard bookmarks	Könyvjelzők elvetése
+	Discard hidden layer content	Rejtett rétegek tartalmának elvetése
+	Discard all comments, forms and multimedia	Összes megjegyzés, űrlap és multimédia elvetése
+	Discard document information and metadata	Dokumentumadatok és metaadatok elvetése
+	Discard all object data (file attachments)	Összes objektumadat (fájlmelléklet) elvetése
+	Discard private data of other applications	Más alkalmazások privát adatainak elvetése
+	Discard hidden text	Rejtett szöveg elvetése
+	Use Flate to encode streams that are not encoded	A kódolatlan adatfolyamok Flate kódolása
+	Remove invalid links and bookmarks	Érvénytelen hivatkozások és könyvjelzők eltávolítása
+	Remove unreferenced named destinations	Hivatkozás nélküli elnevezett célok eltávolítása
+	Compress document structure (object streams)	Dokumentumszerkezet tömörítése (objektumfolyamok)
+	Remove unused objects and merge identical ones	Nem használt objektumok eltávolítása és az azonosak egyesítése
+	Audit space usage…	Helyfoglalás vizsgálata…
+	Space Audit	Helyfoglalás
+	Bytes	Bájt
+	Content Streams	Tartalomfolyamok
+	X Object Forms	XObject-űrlapok
+	Structure Info	Szerkezetadatok
+	Thumbnails	Bélyegképek
+	Named Destinations	Elnevezett célok
+	Color Spaces	Színterek
+	Shadings	Árnyalatok
+	Patterns (graphics objects)	Minták (grafikai objektumok)
+	Extended Graphics States	Kiterjesztett grafikai állapotok
+	Embedded Files	Beágyazott fájlok
+	Document Overhead	Dokumentum többlet
+	Total	Összesen
+	Text Field Properties	Szövegmező tulajdonságai
+	Check Box Properties	Jelölőnégyzet tulajdonságai
+	Radio Button Properties	Választógomb tulajdonságai
+	Dropdown Properties	Legördülő lista tulajdonságai
+	List Box Properties	Lista tulajdonságai
+	Button Properties	Gomb tulajdonságai
+	Digital Signature Properties	Digitális aláírás tulajdonságai
+	Position	Pozíció
+	Options	Beállítások
+	Validate	Ellenőrzés
+	Calculate	Számítás
+	Actions	Műveletek
+	This field is locked. Unlock it to change its properties.	Ez a mező zárolva van. Oldd fel a tulajdonságai módosításához.
+	Tooltip:	Elemleírás:
+	Common Properties	Általános tulajdonságok
+	Read Only	Csak olvasható
+	Required	Kötelező
+	Font Size:	Betűméret:
+	Auto	Automatikus
+	Text Color:	Szöveg színe:
+	Borders and Colors	Szegélyek és színek
+	Border Color:	Szegély színe:
+	Fill Color:	Kitöltőszín:
+	No color	Nincs szín
+	Beveled	Leélezett
+	Left:	Bal:
+	Bottom:	Alsó:
+	Width:	Szélesség:
+	Height:	Magasság:
+	Points from the page's bottom-left corner.	Pontok az oldal bal alsó sarkától.
+	Alignment:	Igazítás:
+	Default Value:	Alapértelmezett érték:
+	Multi-line	Többsoros
+	Scroll long text	Hosszú szöveg görgetése
+	Allow Rich Text Formatting	Formázott szöveg engedélyezése
+	Limit of	Korlát
+	characters	karakter
+	Field is used for file selection	A mező fájlválasztásra szolgál
+	Check spelling	Helyesírás-ellenőrzés
+	Comb of	Fésű, ennyi karakter
+	Export Value: {on}	Exportérték: {on}
+	Check box is checked by default	A jelölőnégyzet alapból be van jelölve
+	Button is checked by default	A gomb alapból be van jelölve
+	Buttons with the same name and value are selected in unison	Az azonos nevű és értékű gombok együtt lesznek kijelölve
+	Item:	Elem:
+	Item List	Elemlista
+	Up	Fel
+	Delete {o}	{o} törlése
+	Add the choices people pick from.	Add hozzá a választható lehetőségeket.
+	Default:	Alapértelmezett:
+	(none)	(nincs)
+	Sort items	Elemek rendezése
+	Allow user to enter custom text	Saját szöveg beírásának engedélyezése
+	Multiple selection	Többszörös kijelölés
+	Commit selected value immediately	A kijelölt érték azonnali átvétele
+	Number	Szám
+	Percentage	Százalék
+	Time	Idő
+	Special	Speciális
+	Select format category:	Formátumkategória kiválasztása:
+	The value is shown as typed.	Az érték úgy jelenik meg, ahogy beírtad.
+	Decimal places:	Tizedesjegyek:
+	Separator style:	Elválasztó stílusa:
+	Currency symbol:	Pénznem jele:
+	Before the number	A szám előtt
+	Negative number style:	Negatív szám stílusa:
+	Format:	Formátum:
+	Custom:	Egyéni:
+	Zip Code	Irányítószám
+	Zip Code + 4	Irányítószám + 4
+	Phone Number	Telefonszám
+	Social Security Number	Társadalombiztosítási szám
+	Arbitrary Mask	Tetszőleges maszk
+	Mask:	Maszk:
+	9 digit, A letter, O letter or digit, X any character	9 számjegy, A betű, O betű vagy számjegy, X bármely karakter
+	Example: {sample}	Példa: {sample}
+	Field value is not validated	A mező értéke nincs ellenőrizve
+	Field value is in range:	A mező értéke ebbe a tartományba esik:
+	Add an Action	Művelet hozzáadása
+	Select Trigger:	Esemény kiválasztása:
+	Mouse Up	Egérgomb felengedése
+	Mouse Down	Egérgomb lenyomása
+	Mouse Enter	Egér belépése
+	Mouse Exit	Egér kilépése
+	On Focus	Fókusz megkapása
+	On Blur	Fókusz elvesztése
+	Select Action:	Művelet kiválasztása:
+	Open a web link	Webhivatkozás megnyitása
+	Reset a form	Űrlap visszaállítása
+	Execute a menu item	Menüparancs végrehajtása
+	Show a field	Mező megjelenítése
+	Hide a field	Mező elrejtése
+	Submit a form	Űrlap elküldése
+	Fields to reset (comma-separated; empty: all)	Visszaállítandó mezők (vesszővel elválasztva; üres: mind)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage vagy LastPage
+	Field names (comma-separated)	Mezőnevek (vesszővel elválasztva)
+	URL to submit to	A beküldés URL-je
+	Script:	Szkript:
+	Value:	Érték:
+	No actions	Nincs művelet
+	Value is not calculated	Az érték nincs számítva
+	Value is the	Az érték a
+	sum (+)	összeg (+)
+	product (x)	szorzat (×)
+	average	átlag
+	minimum	minimum
+	maximum	maximum
+	of the following fields:	a következő mezőkből:
+	Simplified field notation:	Egyszerűsített mezőjelölés:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Mezőnevek + - * / jelekkel és zárójelekkel; a nevekben lévő szóköz elé tegyél \\ jelet.
+	Format text	Szöveg formázása
+	Bold	Félkövér
+	Italic	Dőlt
+	Align left	Balra igazítás
+	Centre	Középre
+	Align right	Jobbra igazítás
+	Justify	Sorkizárás
+	Standard fonts; text outside Windows-1252 isn't supported yet.	Szabványos betűtípusok; a Windows-1252-n kívüli szöveg még nem támogatott.
+	Edit image	Kép szerkesztése
+	Rotate counterclockwise	Forgatás az óramutató járásával ellentétesen
+	Rotate clockwise	Forgatás az óramutató járásával megegyezően
+	Flip horizontal	Vízszintes tükrözés
+	Flip vertical	Függőleges tükrözés
+	Replace image	Kép cseréje
+	Crop (% trimmed from each side)	Levágás (mindkét oldalról levágott %)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Kattints az oldalra szöveg hozzáadásához; minden kattintás új dobozt kezd, a ✓ befejezi. Húzd az elemeket az áthelyezéshez, a sarkot a méretezéshez, és kattints duplán a szövegre a szerkesztéshez.
+	Choose an image	Kép kiválasztása
+	Export to Image	Exportálás képként
+	Export to Text	Exportálás szövegként
+	Export All Images	Összes kép exportálása
+	Resolution	Felbontás
+	Format	Formátum
+	Quality	Minőség
+	One {f} file per page, named after the document.	Oldalanként egy {f} fájl, a dokumentum neve alapján.
+	Exclude images smaller than	Az ennél kisebb képek kihagyása
+	No limit	Nincs korlát
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Minden kép egyszer, a dokumentum és az oldal neve alapján. A JPEG-képek változatlanul mentődnek, a többi PNG-ként.
+	Plain text in reading order; pages are separated by form feeds.	Formázatlan szöveg olvasási sorrendben; az oldalakat lapdobás választja el.
+	Create {what}	{what} létrehozása
+	initials	monogram
+	signature	aláírás
+	Create Custom Stamp	Egyéni bélyegző létrehozása
+	From {file}	Ebből: {file}
+	Category:	Kategória:
+	e.g. My stamps	pl. Saját bélyegzők
+	Name:	Név:
+	Custom	Egyéni
+	Delete stamp	Bélyegző törlése
+	Create custom stamp…	Egyéni bélyegző létrehozása…
+	From a PDF page or an image	PDF-oldalból vagy képből
+	Line spacing	Sorköz
+	Character spacing	Karaktertávolság
+	Horizontal scale	Vízszintes méretezés
+	Rotate Clockwise	Forgatás az óramutató járásával megegyezően
+	Rotate Counterclockwise	Forgatás az óramutató járásával ellentétesen
+	Flip Horizontal	Vízszintes tükrözés
+	Flip Vertical	Függőleges tükrözés
+	Replace Image…	Kép cseréje…
+	Save Image As…	Kép mentése másként…
+	Check for updates	Frissítések keresése
+	No check has run yet.	Még nem futott ellenőrzés.
+	Checking for a newer version…	Újabb verzió keresése…
+	PdfCraft {v} is available.	Elérhető a PdfCraft {v}.
+	You have version {c}. Download the new version from its release page.	A jelenlegi verzió: {c}. Töltsd le az újat a kiadási oldaláról.
+	PdfCraft {c} is up to date.	A PdfCraft {c} naprakész.
+	Couldn't check for updates: {e}	A frissítések keresése nem sikerült: {e}
+	You have version {c}. All releases are listed at {page}.	A jelenlegi verzió: {c}. Minden kiadás itt található: {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	A GitHubtól kéri le a legújabb kiadást. Semmi sem töltődik le vagy települ automatikusan.
+	Download	Letöltés
+	Later	Később
+	none	nincs
+	Declared conformance: {shown}	Megadott megfelelőség: {shown}
+	Output intent: {list}	Kimeneti cél: {list}
+	Conformance level:	Megfelelőségi szint:
+	No problems found: the document conforms to {level}.	Nem találtunk problémát: a dokumentum megfelel ennek: {level}.
+	 (page {p})	 (oldal: {p})
+	  · not fixable here	  · itt nem javítható
+	Verify	Ellenőrzés
+	Box	Keret
+	Units	Mértékegységek
+	Set to zero	Nullázás
+	Current page ({n})	Aktuális oldal ({n})
+	Subset	Részhalmaz
+	Update	Frissítés
+	Add	Hozzáadás
+	{verb} Header and Footer	Fejléc és lábléc: {verb}
+	{verb} Watermark	Vízjel: {verb}
+	{verb} Background	Háttér: {verb}
+	Margins (in)	Margók (hüvelyk)
+	Left Header Text	Bal fejléc szövege
+	Center Header Text	Középső fejléc szövege
+	Right Header Text	Jobb fejléc szövege
+	Left Footer Text	Bal lábléc szövege
+	Center Footer Text	Középső lábléc szövege
+	Right Footer Text	Jobb lábléc szövege
+	Insert Page Number	Oldalszám beszúrása
+	Insert Date	Dátum beszúrása
+	Start page number	Kezdő oldalszám
+	Source	Forrás
+	Fit to page	Oldalhoz igazítás
+	Rotation	Elforgatás
+	Appear behind page	Az oldal mögött
+	Appear on top of page	Az oldal előtt
+	From colour	Színből
+	Page Range Options	Oldaltartomány beállításai
+	Preview: page {p} of {n}	Előnézet: {p}. oldal / {n}
+	Applies to 1 page	1 oldalra vonatkozik
+	Applies to {n} pages	{n} oldalra vonatkozik
+	Replaces the existing one on those pages.	Lecseréli a meglévőt ezeken az oldalakon.
+	PDF or image	PDF vagy kép
+	No file chosen	Nincs fájl kiválasztva
+	Page number	Oldalszám
+	Scale relative to target page	Méretezés a céloldalhoz képest
+	Link Properties	Hivatkozás tulajdonságai
+	Create Link	Hivatkozás létrehozása
+	Link Appearance	Hivatkozás megjelenése
+	Link Type:	Hivatkozás típusa:
+	Visible Rectangle	Látható téglalap
+	Invisible Rectangle	Láthatatlan téglalap
+	Highlight Style:	Kiemelés stílusa:
+	Invert	Invertálás
+	Outline	Körvonal
+	Inset	Besüllyesztett
+	Line Thickness:	Vonalvastagság:
+	Thin	Vékony
+	Thick	Vastag
+	Line Style:	Vonalstílus:
+	Solid	Folytonos
+	Dashed	Szaggatott
+	Color:	Szín:
+	Link Action	Hivatkozás művelete
+	Open a web page	Weboldal megnyitása
+	Go to a page view	Ugrás egy oldalnézetre
+	Type the web address.	Írd be a webcímet.
+	This document has no signatures.	Ebben a dokumentumban nincs aláírás.
+	The Keychain's digital IDs couldn't be listed: {e}	A Kulcskarika digitális azonosítóit nem sikerült kilistázni: {e}
+	Signed and saved to {path}	Aláírva és mentve ide: {path}
+	Couldn't open revision {n}: {e}	A {n}. változatot nem sikerült megnyitni: {e}
+	Couldn't open the signed version: {e}	Az aláírt változatot nem sikerült megnyitni: {e}
+	Sign with a Digital ID	Aláírás digitális azonosítóval
+	Choose the digital ID that you want to use for signing:	Válaszd ki az aláíráshoz használandó digitális azonosítót:
+	Keychain  ·  	Kulcskarika  ·  
+	Windows store  ·  	Windows-tároló  ·  
+	Issued by: 	Kiállította: 
+	, Expires: 	, lejár: 
+	No digital IDs yet.	Még nincs digitális azonosító.
+	Configure New Digital ID	Új digitális azonosító beállítása
+	Continue	Tovább
+	Configure a Digital ID for Signing	Digitális azonosító beállítása aláíráshoz
+	Use a Digital ID from a file	Digitális azonosító használata fájlból
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Új digitális azonosító létrehozása (önaláírt, jelszóval védett fájlba mentve)
+	Name	Név
+	Organizational Unit	Szervezeti egység
+	Organization Name	Szervezet neve
+	Email Address	E-mail-cím
+	Country/Region	Ország/régió
+	Key Algorithm	Kulcsalgoritmus
+	Confirm Password	Jelszó megerősítése
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	5 évig érvényes, digitális aláírásra. Az önaláírt azonosítókban mások általában nem bíznak.
+	File (.p12, .pfx)	Fájl (.p12, .pfx)
+	Digital ID	Digitális azonosító
+	Browse…	Tallózás…
+	{verb} as "{name}"	{verb} mint „{name}”
+	Certify	Hitelesítés
+	The signature will be invisible.	Az aláírás láthatatlan lesz.
+	Distinguished name	Megkülönböztető név
+	Labels	Címkék
+	Permitted actions after certifying	Engedélyezett műveletek hitelesítés után
+	No changes allowed	Semmilyen módosítás nem engedélyezett
+	Annotations, form fill-in, and digital signatures	Széljegyzetek, űrlapkitöltés és digitális aláírások
+	Form fill-in and digital signatures	Űrlapkitöltés és digitális aláírások
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	A kulcs a macOS Kulcskarikában van, amely megkérdezheti, engedélyezed-e a PdfCraftnak a használatát.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	A kulcs a Windows tanúsítványtárolójában van, amely megkérdezheti, engedélyezed-e a PdfCraftnak a használatát.
+	Digital ID password	A digitális azonosító jelszava
+	Back	Vissza
+	Validate all	Összes ellenőrzése
+	Sign this field…	Mező aláírása…
+	Signature is valid:	Az aláírás érvényes:
+	Signature validity is UNKNOWN:	Az aláírás érvényessége ISMERETLEN:
+	Signature is INVALID:	Az aláírás ÉRVÉNYTELEN:
+	Signature Details	Aláírás részletei
+	Reason	Ok
+	Signing time	Aláírás időpontja
+	Algorithm	Algoritmus
+	Signer	Aláíró
+	Issued by	Kiállította
+	Valid	Érvényes
+	Field	Mező
+	Field: {field} on page {p}	Mező: {field}, {p}. oldal
+	Add to trusted certificates	Hozzáadás a megbízható tanúsítványokhoz
+	View signed version	Aláírt változat megtekintése
+	Show certificate…	Tanúsítvány megjelenítése…
+	Export certificate…	Tanúsítvány exportálása…
+	Certificate Viewer	Tanúsítványmegjelenítő
+	This dialog shows the details of a certificate and its chain.	Ez a párbeszédablak a tanúsítvány és a lánca részleteit mutatja.
+	Trust	Megbízhatóság
+	Issued to	Kiállítva neki
+	Valid from	Érvényes ettől
+	Valid to	Érvényes eddig
+	Intended usage	Tervezett használat
+	Any	Bármely
+	Version	Verzió
+	Serial number	Sorozatszám
+	Issuer	Kiállító
+	Validity starts	Érvényesség kezdete
+	Validity ends	Érvényesség vége
+	Public key	Nyilvános kulcs
+	Key usage	Kulcshasználat
+	Not present	Nincs megadva
+	Self-signed	Önaláírt
+	Edit Action	Művelet szerkesztése
+	New Action	Új művelet
+	Action name:	Művelet neve:
+	Description:	Leírás:
+	Steps	Lépések
+	Add the steps this action runs, in order.	Add hozzá a lépéseket, amelyeket ez a művelet sorban végrehajt.
+	Add Step	Lépés hozzáadása
+	An action with this name already exists.	Már van művelet ezzel a névvel.
+	New Action…	Új művelet…
+	Edit…	Szerkesztés…
+	Add watermark	Vízjel hozzáadása
+	Add header	Fejléc hozzáadása
+	Add footer	Lábléc hozzáadása
+	Set document title	Dokumentumcím beállítása
+	Run a JavaScript	JavaScript futtatása
+	Prepare for Distribution	Előkészítés terjesztésre
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Rejtett adatok eltávolítása, valamint a megjegyzések és űrlapmezők beégetése, hogy a címzettek csak az oldalakat lássák.
+	Optimize Scanned Documents	Beolvasott dokumentumok optimalizálása
+	Make scans searchable, then make them smaller.	Tedd kereshetővé a beolvasott oldalakat, majd kicsinyítsd őket.
+	Add Page Numbers	Oldalszámok hozzáadása
+	Number every page in the footer.	Minden oldal számozása a láblécben.
+	Mark as Confidential	Megjelölés bizalmasként
+	A diagonal CONFIDENTIAL watermark on every page.	Átlós BIZALMAS vízjel minden oldalon.
+	Sanitize Documents	Dokumentumok megtisztítása
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Rejtett adatok, metaadatok, szkriptek és beágyazott tartalom eltávolítása, majd a fájlok újraírása.
+	Type text	Szöveg beírása
+	Text to insert	Beszúrandó szöveg
+	Replacement text	Csere szövege
+	Edit text…	Szöveg szerkesztése…
+	Add a sticky note here	Cetli hozzáadása ide
+	{kind} Properties	{kind} tulajdonságai
+	Appearance	Megjelenés
+	General	Általános
+	Review History	Átnézési előzmények
+	This comment's appearance can't be changed yet.	Ennek a megjegyzésnek a megjelenése még nem módosítható.
+	Icon	Ikon
+	Thickness	Vastagság
+	Modified	Módosítva
+	No status has been set.	Nincs beállított állapot.
+	Compare Files	Fájlok összehasonlítása
+	Old file:	Régi fájl:
+	Open the older version first	Először a régebbi változatot nyisd meg
+	New file:	Új fájl:
+	Text is compared word by word; the differences are shown on the new file.	A szöveg szóról szóra van összehasonlítva; a különbségek az új fájlon látszanak.
+	Compare this file with an older version: Compare files… in All tools.	Hasonlítsd össze ezt a fájlt egy régebbi változattal: Fájlok összehasonlítása… a Minden eszközben.
+	No differences in the text.	Nincs különbség a szövegben.
+	{n} {kind}	{n} {kind}
+	Inserted	Beszúrva
+	Deleted	Törölve
+	Replaced	Lecserélve
+	Visual	Vizuális
+	Mark as comments	Megjelölés megjegyzésként
+	Report…	Jelentés…
+	{kind} · page {p}	{kind} · {p}. oldal
+	Set Alternate Text	Helyettesítő szöveg beállítása
+	This document has no tagged figures.	Ebben a dokumentumban nincsenek címkézett ábrák.
+	 on page {p}	 ({p}. oldal)
+	Figure {i} of {n}{page}	{i}. ábra / {n}{page}
+	No preview	Nincs előnézet
+	Alternate text	Helyettesítő szöveg
+	Describe the figure	Írd le az ábrát
+	Decorative figure	Dekoratív ábra
+	Previous figure	Előző ábra
+	Next figure	Következő ábra
+	Save & Close	Mentés és bezárás
+	Accessibility Checker Options	Akadálymentesség-ellenőrzés beállításai
+	Report Options	Jelentés beállításai
+	Create accessibility report	Akadálymentességi jelentés létrehozása
+	Page Range	Oldaltartomány
+	All pages in document	A dokumentum összes oldala
+	Checking Options ({on} of 32 in all categories)	Ellenőrzési beállítások ({on} / 32, minden kategóriában)
+	Show this dialog when the Checker starts	Párbeszédablak megjelenítése az ellenőrzés indításakor
+	Select All	Összes kijelölése
+	Clear All	Kijelölés megszüntetése
+	Start Checking	Ellenőrzés indítása
+	This document hasn't been checked yet.	Ez a dokumentum még nincs ellenőrizve.
+	No issues found	Nincs probléma
+	1 issue	1 probléma
+	{n} issues	{n} probléma
+	{label} (1 issue)	{label} (1 probléma)
+	{label} ({n} issues)	{label} ({n} probléma)
+	Check again	Újraellenőrzés
+	Report	Jelentés
+	Show the accessibility report	Akadálymentességi jelentés megjelenítése
+	Collapse	Összecsukás
+	Expand	Kibontás
+	{rule} - {status}	{rule} – {status}
+	Passed	Megfelelt
+	Failed	Nem felelt meg
+	Needs manual check	Kézi ellenőrzés kell
+	Skipped	Kihagyva
+	Fix	Javítás
+	Skip Rule	Szabály kihagyása
+	Explain	Magyarázat
+	Check Again	Újraellenőrzés
+	Show Report	Jelentés megjelenítése
+	Options…	Beállítások…
+	Go to the page	Ugrás az oldalra
+	Page Content	Oldaltartalom
+	Forms	Űrlapok
+	Alternate Text	Helyettesítő szöveg
+	Tables	Táblázatok
+	Lists	Listák
+	Headings	Címsorok
+	Accessibility permission flag	Akadálymentességi engedély
+	Accessibility permission flag is set	Az akadálymentességi engedély be van állítva
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	A biztonsági beállításoknak engedniük kell, hogy a kisegítő technológia olvassa a tartalmat („Szöveghozzáférés engedélyezése képernyőolvasóknak”). Módosítsd a dokumentum biztonságát, hogy ez engedélyezett legyen.
+	Image-only PDF	Csak képből álló PDF
+	Document is not image-only PDF	A dokumentum nem csak képből álló PDF
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	A csak szöveg képéből álló oldalak nem olvashatók fel, és nem kereshetők. Futtass szövegfelismerést (OCR), hogy szöveges réteg kerüljön rájuk.
+	Document is tagged PDF	A dokumentum címkézett PDF
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	A címkék logikai szerkezetet adnak a dokumentumnak, amelyet a kisegítő technológia követ. Címkézd a dokumentumot (PDF automatikus címkézése).
+	Logical Reading Order	Logikai olvasási sorrend
+	Document structure provides a logical reading order	A dokumentumszerkezet logikai olvasási sorrendet ad
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Ellenőrizd, hogy a címkék abban a sorrendben olvasódnak-e, ahogy egy látó olvasó haladna. Javítsd az Olvasási sorrend eszközzel vagy a Címkék panelen.
+	Primary language	Elsődleges nyelv
+	Text language is specified	A szöveg nyelve meg van adva
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	A képernyőolvasók a dokumentum nyelve alapján választanak hangot. Állítsd be a Dokumentum tulajdonságai > Speciális > Nyelv helyen.
+	Document title is showing in title bar	A dokumentum címe látszik a címsorban
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Az ablaknak értelmes címet kell mutatnia a fájlnév helyett. Adj meg címet, és válaszd a Kezdeti nézet > Megjelenítés: Dokumentum címe lehetőséget.
+	Bookmarks are present in large documents	A nagy dokumentumokban vannak könyvjelzők
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	A 20 oldalnál hosszabb dokumentumokhoz könyvjelző kell a navigációhoz. Adj könyvjelzőt a főbb részekhez.
+	Color contrast	Színkontraszt
+	Document has appropriate color contrast	A dokumentum színkontrasztja megfelelő
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	A szövegnek eléggé el kell ütnie a hátterétől a gyengén látók számára. Ellenőrizd a színeket szemmel vagy kontraszteszközzel.
+	Tagged content	Címkézett tartalom
+	All page content is tagged	Az oldal teljes tartalma címkézett
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Az oldalon mindennek címkézettnek vagy díszítőelemnek kell lennie (díszítés, fejléc, lábléc). Címkézd a címkézetlen tartalmat.
+	Tagged annotations	Címkézett széljegyzetek
+	All annotations are tagged	Minden széljegyzet címkézett
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	A megjegyzéseknek, hivatkozásoknak és mezőknek a címkefában kell lenniük, hogy bemondják őket. Címkézd a széljegyzeteket.
+	Tab order	Tab-sorrend
+	Tab order is consistent with structure order	A tab-sorrend megegyezik a szerkezet sorrendjével
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	A hivatkozásokat, megjegyzéseket vagy mezőket tartalmazó oldalakon a tab-sorrend kövesse a szerkezetet. A javítás minden oldal tab-sorrendjét a dokumentumszerkezetre állítja.
+	Character encoding	Karakterkódolás
+	Reliable character encoding is provided	Megbízható karakterkódolás van megadva
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	A betűtípusoknak Unicode-ra kell képezniük a karaktereiket, hogy a szöveg olvasható és másolható legyen. Javítsd a betűtípusokat, vagy hozd létre újra a PDF-et.
+	Tagged multimedia	Címkézett multimédia
+	All multimedia objects are tagged	Minden multimédia-objektum címkézett
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	A videót, a hangot és a rich médiát címkézni kell, hogy bemondják őket. Címkézd a multimédia-széljegyzeteket.
+	Screen flicker	Képernyővillogás
+	Page will not cause screen flicker	Az oldal nem okoz képernyővillogást
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	A villogó animáció rohamot okozhat. Ellenőrizd a szkripteket és a médiát villogás szempontjából.
+	Scripts	Szkriptek
+	No inaccessible scripts	Nincs akadályt jelentő szkript
+	Timed responses	Időzített válaszok
+	Page does not require timed responses	Az oldal nem igényel időzített választ
+	People may need more time to respond. Check that nothing has a time limit.	Egyeseknek több idő kell a válaszhoz. Ellenőrizd, hogy semminek nincs időkorlátja.
+	Navigation links	Navigációs hivatkozások
+	Navigation links are not repetitive	A navigációs hivatkozások nem ismétlődnek
+	Repeated navigation links should be skippable. Check links that appear on every page.	Az ismétlődő navigációs hivatkozásokat át kell tudni ugrani. Ellenőrizd a minden oldalon megjelenő hivatkozásokat.
+	Tagged form fields	Címkézett űrlapmezők
+	All form fields are tagged	Minden űrlapmező címkézett
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Az űrlapmezőknek a címkefában kell lenniük (Form címkék), hogy bemondják őket. Címkézd az űrlapmezőket.
+	Field descriptions	Mezőleírások
+	All form fields have description	Minden űrlapmezőnek van leírása
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Minden mezőhöz kell egy elemleírás, amely megmondja, mit kell beírni. Add hozzá a Mező tulajdonságai > Általános > Elemleírás helyen.
+	Figures alternate text	Ábrák helyettesítő szövege
+	Figures require alternate text	Az ábrákhoz helyettesítő szöveg kell
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	A képekhez leíró helyettesítő szöveg kell, vagy dekoratívnak kell jelölni őket. Adj helyettesítő szöveget minden ábrához.
+	Nested alternate text	Beágyazott helyettesítő szöveg
+	Alternate text that will never be read	Helyettesítő szöveg, amelyet soha nem olvasnak fel
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Egy olyan elemben lévő helyettesítő szöveget, amelynek már van helyettesítő szövege, soha nem olvasnak fel. Távolítsd el a belsőt.
+	Associated with content	Tartalomhoz társítva
+	Alternate text must be associated with some content	A helyettesítő szövegnek tartalomhoz kell kapcsolódnia
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Egy oldaltartalom nélküli elem helyettesítő szövegéhez soha nem jut el az olvasó. Távolítsd el, vagy kösd az elemet tartalomhoz.
+	Hides annotation	Széljegyzetet takar
+	Alternate text should not hide annotation	A helyettesítő szöveg ne takarjon széljegyzetet
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Egy hivatkozást vagy mezőt tartalmazó elem helyettesítő szövege elrejti azt a széljegyzetet a kisegítő technológia elől. Helyezd át a helyettesítő szöveget.
+	Other elements alternate text	Más elemek helyettesítő szövege
+	Other elements that require alternate text	Más elemek, amelyekhez helyettesítő szöveg kell
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	A képleteknek és a hasonló nem szöveges elemeknek helyettesítő szöveg kell. Adj nekik helyettesítő szöveget.
+	Rows	Sorok
+	TR must be a child of Table, THead, TBody, or TFoot	A TR a Table, a THead, a TBody vagy a TFoot gyermeke kell legyen
+	Table cells belong in a row. Fix the table's tags.	A táblázatcellák egy sorba tartoznak. Javítsd a táblázat címkéit.
+	Headers	Fejlécek
+	Tables should have headers	A táblázatoknak legyen fejlécük
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	A fejléccellák (TH) elmondják, mit tartalmaz az egyes oszlop vagy sor. Jelöld meg a fejléccellákat.
+	Regularity	Szabályosság
+	Tables must contain the same number of columns in each row and rows in each column	A táblázatok minden sorában ugyanannyi oszlop, minden oszlopában ugyanannyi sor kell legyen
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	A szabálytalan táblázatok megzavarják a cellák közötti navigációt. Adj minden sornak ugyanannyi cellát (az összevonásokat is beleszámítva).
+	Summary	Összefoglaló
+	Tables must have a summary	A táblázatoknak legyen összefoglalójuk
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Az összefoglaló leírja a táblázat célját és elrendezését. Adj minden táblázathoz Summary attribútumot.
+	List items	Listaelemek
+	LI must be a child of L	Az LI az L gyermeke kell legyen
+	List items belong in a list. Fix the list's tags.	A listaelemek egy listába tartoznak. Javítsd a lista címkéit.
+	Lbl and LBody	Lbl és LBody
+	Lbl and LBody must be children of LI	Az Lbl és az LBody az LI gyermekei kell legyenek
+	List labels and bodies belong in a list item. Fix the list's tags.	A listacímkék és a listatartalom egy listaelembe tartoznak. Javítsd a lista címkéit.
+	Appropriate nesting	Megfelelő egymásba ágyazás
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	A címsorszintek ne ugorjanak (például H1 után ne H3 következzék). Címkézd újra a címsorokat.
+	TH and TD	TH és TD
+	TH and TD must be children of TR	A TH és a TD a TR gyermekei kell legyenek
+	Mark Page Range	Oldaltartomány megjelölése
+	Pages from	Oldalak ettől
+	Single word or phrase	Egy szó vagy kifejezés
+	Text to find	Keresett szöveg
+	Patterns	Minták
+	Phone Numbers	Telefonszámok
+	Email Addresses	E-mail-címek
+	Credit Cards	Bankkártyák
+	Social Security Numbers	Társadalombiztosítási számok
+	Dates	Dátumok
+	Text in images isn't found; recognise text (OCR) first.	A képekben lévő szöveg nem található meg; előbb futtass szövegfelismerést (OCR).
+	No matches.	Nincs találat.
+	{n} match(es) marked for redaction.	{n} találat megjelölve kitakarásra.
+	Redaction Tool Properties	Kitakaróeszköz tulajdonságai
+	Redacted area fill colour:	Kitakart terület kitöltőszíne:
+	Use overlay text	Fedőszöveg használata
+	Custom text:	Saját szöveg:
+	Font:	Betűtípus:
+	Font size:	Betűméret:
+	Auto-size text to fit redaction region	A szöveg automatikus méretezése a kitakarási területhez
+	Font colour:	Betű színe:
+	Repeat overlay text	Fedőszöveg ismétlése
+	Text alignment:	Szöveg igazítása:
+	Center	Középre
+	Apply redactions	Kitakarások alkalmazása
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	1 kitakarásjelölést fogsz alkalmazni. A jelölés alatti szöveg, képek és rajzok, valamint az azt átfedő megjegyzések és űrlapmezők véglegesen törlődnek.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	{n} kitakarásjelölést fogsz alkalmazni. A jelölések alatti szöveg, képek és rajzok, valamint az azokat átfedő megjegyzések és űrlapmezők véglegesen törlődnek.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	Utána mentsd a dokumentumot: a mentés újraírja az egész fájlt, így az eltávolított tartalomnak nem marad nyoma.
+	Select the items to remove from this document.	Válaszd ki, mit távolítsunk el ebből a dokumentumból.
+	Metadata	Metaadatok
+	File attachments	Fájlmellékletek
+	Comments and markups	Megjegyzések és jelölések
+	Hidden text	Rejtett szöveg
+	Hidden layers	Rejtett rétegek
+	Links, actions and JavaScripts	Hivatkozások, műveletek és JavaScriptek
+	Private data of other applications	Más alkalmazások privát adatai
+	None found	Nem található
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Az űrlapmezők beégnek: az értékeik láthatók maradnak. A mentés újraírja az egész fájlt.
+	Remove	Eltávolítás
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	A megtisztítás eltávolítja a rejtett adatokat a dokumentumból: metaadatokat, fájlmellékleteket, megjegyzéseket, űrlapmezőket (beégetve), rejtett szöveget és rétegeket, könyvjelzőket, hivatkozásokat, műveleteket és szkripteket, valamint az alkalmazások privát adatait.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	Utána mentsd a dokumentumot; a mentés újraírja az egész fájlt, így az eltávolított részek nem maradnak benne.
+	Printer:	Nyomtató:
+	Save as PDF	Mentés PDF-ként
+	{name} (default)	{name} (alapértelmezett)
+	Copies:	Példányok:
+	Collate	Szétválogatás
+	Print in grayscale	Nyomtatás szürkeárnyalatosan
+	Two-sided:	Kétoldalas:
+	Off	Ki
+	Flip on long edge	Hosszú él mentén
+	Flip on short edge	Rövid él mentén
+	Paper:	Papír:
+	Pages to Print	Nyomtatandó oldalak
+	More options:	További beállítások:
+	All pages in range	A tartomány minden oldala
+	Odd pages only	Csak a páratlan oldalak
+	Even pages only	Csak a páros oldalak
+	Reverse pages	Oldalak fordított sorrendben
+	Page Sizing & Handling	Oldalméret és kezelés
+	Size	Méret
+	Poster	Poszter
+	Multiple	Több oldal
+	Booklet	Füzet
+	Fit	Igazítás
+	Shrink oversized pages	Túl nagy oldalak kicsinyítése
+	Custom scale:	Egyéni méretarány:
+	Tile scale:	Csempe méretaránya:
+	Overlap:	Átfedés:
+	Cut marks	Vágójelek
+	Pages per sheet:	Oldalak laponként:
+	Page order:	Oldalsorrend:
+	Horizontal	Vízszintes
+	Horizontal reversed	Vízszintes, fordított
+	Vertical	Függőleges
+	Vertical reversed	Függőleges, fordított
+	Print page border	Oldalkeret nyomtatása
+	Auto-rotate pages	Oldalak automatikus forgatása
+	Booklet subset:	Füzetrész:
+	Both sides	Mindkét oldal
+	Front side only	Csak az előlap
+	Back side only	Csak a hátlap
+	Binding:	Kötés:
+	Left	Bal
+	Right	Jobb
+	Orientation:	Tájolás:
+	Auto portrait/landscape	Álló/fekvő automatikusan
+	Portrait	Álló
+	Landscape	Fekvő
+	Comments & Forms	Megjegyzések és űrlapok
+	Document	Dokumentum
+	Document and markups	Dokumentum és jelölések
+	Document and stamps	Dokumentum és bélyegzők
+	Form fields only	Csak űrlapmezők
+	Previous sheet	Előző lap
+	Next sheet	Következő lap
+	No sheets	Nincs lap
+	Sheet {s} of {n}	{s}. lap / {n}
+	Removed 1 hidden item. Save to remove them from the file.	1 rejtett elemet eltávolítottunk. Ments, hogy a fájlból is kikerüljön.
+	Removed {n} hidden items. Save to remove them from the file.	{n} rejtett elemet eltávolítottunk. Ments, hogy a fájlból is kikerüljenek.
+	Document sanitized. Save to finish: saving rewrites the whole file.	A dokumentum meg van tisztítva. Ments a befejezéshez: a mentés újraírja az egész fájlt.
+	Applied 1 redaction mark. Save to remove the content from the file.	1 kitakarásjelölést alkalmaztunk. Ments, hogy a tartalom kikerüljön a fájlból.
+	Applied {n} redaction marks. Save to remove the content from the file.	{n} kitakarásjelölést alkalmaztunk. Ments, hogy a tartalom kikerüljön a fájlból.
+	JavaScript Console	JavaScript-konzol
+	JavaScript is turned off (Preferences ▸ JavaScript).	A JavaScript ki van kapcsolva (Beállítások > JavaScript).
+	Output appears here.	A kimenet itt jelenik meg.
+	Script Name:	Szkript neve:
+	This document has no document-level scripts.	Ebben a dokumentumban nincs dokumentumszintű szkript.
+	No form fields were detected	Nem találtunk űrlapmezőt
+	Detected 1 form field	1 űrlapmezőt találtunk
+	Detected {n} form fields	{n} űrlapmezőt találtunk
+	{field}: {e}	{field}: {e}
+	Current page	Aktuális oldal
+	Selected pages	Kijelölt oldalak
+	Document language	Dokumentum nyelve
+	Output	Kimenet
+	Searchable Image (Exact)	Kereshető kép (pontos)
+	Adds invisible text over each word; the page image is not changed	Láthatatlan szöveget helyez minden szóra; az oldalkép nem változik
+	Downsample to	Feloldás csökkentése erre
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	A szövegfelismerés nincs telepítve: hiányoznak a modelljei (futtasd a `cargo xtask models` parancsot, vagy állítsd be a PRINTCRAFT_MODELS változót).
+	Settings	Beállítások
+	Optional	Nem kötelező
+	Planned · {m}	Tervezett · {m}
+	Planned for milestone {m} — open to see what it will include	{m} mérföldkőre tervezve — nyisd meg, és meglátod, mi lesz benne
+	Coming in milestone {m}. Items marked Ready work today.	{m} mérföldkőben érkezik. A Kész jelölésű elemek már működnek.
+	1 mark	1 jelölés
+	{n} marks	{n} jelölés
+	Dynamic	Dinamikus
+	Sign Here	Itt írd alá
+	Standard Business	Szokásos üzleti
+	Choose a stamp, then click on the page to place it.	Válassz bélyegzőt, majd kattints az oldalra az elhelyezéséhez.
+	Note	Jegyzet
+	Polyline	Töröttvonal
+	Attachment	Melléklet
+	Callout	Szövegbuborék
+	Typewriter	Írógép
+	Checked	Bejelölve
+	Unchecked	Nincs bejelölve
+	Marked	Megjelölve
+	Locked	Zárolva
+	Search comments	Megjegyzések keresése
+	Add a comment	Megjegyzés hozzáadása
+	No comments yet.	Még nincs megjegyzés.
+	Pick a tool in the quick bar, or type above.	Válassz eszközt a gyorssávon, vagy írj felülre.
+	No comments match.	Nincs illeszkedő megjegyzés.
+	Unknown author	Ismeretlen szerző
+	No colour	Nincs szín
+	Remove checkmark	Pipa eltávolítása
+	Mark with checkmark	Megjelölés pipával
+	Reply	Válasz
+	Add a reply	Válasz hozzáadása
+	Post	Küldés
+	Page {label}	{label}. oldal
+	{kind} — click to show it on the page	{kind} — kattints, hogy megjelenjen az oldalon
+	Set status	Állapot beállítása
+	Copy text	Szöveg másolása
+	Properties…	Tulajdonságok…
+	Make Current Properties Default	A jelenlegi tulajdonságok legyenek az alapértelmezettek
+	More options	További beállítások
+	Sort by	Rendezés szempontja
+	Author	Szerző
+	Type	Típus
+	Colour	Szín
+	Show all comments	Összes megjegyzés megjelenítése
+	Create PDF comment summary…	PDF-megjegyzésösszefoglaló létrehozása…
+	Export all to data file…	Összes exportálása adatfájlba…
+	Filter comments	Megjegyzések szűrése
+	Status	Állapot
+	Accepted	Elfogadva
+	Rejected	Elutasítva
+	Cancelled	Megszakítva
+	Completed	Befejezve
+	Show all	Összes megjelenítése
+	Yellow	Sárga
+	Orange	Narancs
+	Red	Piros
+	Pink	Rózsaszín
+	Purple	Lila
+	Blue	Kék
+	Light blue	Világoskék
+	Green	Zöld
+	Gray	Szürke
+	Black	Fekete
+	Bookmark options	Könyvjelző beállításai
+	Expand all bookmarks	Összes könyvjelző kibontása
+	Expand top-level bookmarks	A legfelső szintű könyvjelzők kibontása
+	Collapse all bookmarks	Összes könyvjelző összecsukása
+	New bookmark (⌘B)	Új könyvjelző (⌘B)
+	This document has no bookmarks.	Ebben a dokumentumban nincs könyvjelző.
+	This document has no layers.	Ebben a dokumentumban nincs réteg.
+	This document has no attachments.	Ebben a dokumentumban nincs melléklet.
+	Hide layer	Réteg elrejtése
+	Show layer	Réteg megjelenítése
+	on page {label}	{label}. oldal
+	Save attachment…	Melléklet mentése…
+	Open in a new tab	Megnyitás új lapon
+	This document has no pages.	Ebben a dokumentumban nincs oldal.
+	Find text	Szöveg keresése
+	No matches	Nincs találat
+	Searching… {s}/{p}	Keresés… {s}/{p}
+	{c} of {n}{more}	{c} / {n}{more}
+	Previous (⇧⌘G)	Előző (⇧⌘G)
+	Next (⌘G)	Következő (⌘G)
+	Find options	Keresés beállításai
+	Whole words only	Csak egész szavak
+	Case-sensitive	Kis- és nagybetű
+	Close (Esc)	Bezárás (Esc)
+	Align	Igazítás
+	Top	Fent
+	Bottom	Lent
+	Center horizontally	Vízszintesen középre
+	Center vertically	Függőlegesen középre
+	Distribute	Elosztás
+	Horizontally	Vízszintesen
+	Vertically	Függőlegesen
+	Set Fields to Same Size	Mezők azonos méretre állítása
+	Height	Magasság
+	Width	Szélesség
+	Both	Mindkettő
+	Duplicate…	Megkettőzés…
+	All pages	Minden oldal
+	Odd pages	Páratlan oldalak
+	Even pages	Páros oldalak
+	Landscape pages	Fekvő oldalak
+	Portrait pages	Álló oldalak
+	Move earlier	Előbbre helyezés
+	Move later	Hátrébb helyezés
+	Back to the document	Vissza a dokumentumhoz
+	Protect Using Password	Jelszavas védelem
+	Requires user to enter a password for:	Jelszó kell ehhez:
+	Viewing	Megtekintés
+	Editing	Szerkesztés
+	Type Password	Jelszó megadása
+	Re-type Password	Jelszó újra
+	Strength: {s}	Erősség: {s}
+	Strong	Erős
+	Medium	Közepes
+	Weak	Gyenge
+	Advanced Options {chevron}	Speciális beállítások {chevron}
+	Compatibility	Kompatibilitás
+	Acrobat X and later (256-bit AES)	Acrobat X és újabb (256 bites AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 és újabb (128 bites AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 és újabb (128 bites RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 és újabb (40 bites RC4)
+	Encrypt	Titkosítás
+	All document contents	A dokumentum teljes tartalma
+	All document contents except metadata	A dokumentum teljes tartalma, a metaadatok kivételével
+	Printing allowed	Nyomtatás engedélyezve
+	Low Resolution (150 dpi)	Alacsony felbontás (150 dpi)
+	Changes allowed	Módosítás engedélyezve
+	Inserting, deleting, and rotating pages	Oldalak beszúrása, törlése és forgatása
+	Filling in form fields and signing existing signature fields	Űrlapmezők kitöltése és a meglévő aláírásmezők aláírása
+	Commenting, filling in form fields, and signing existing signature fields	Megjegyzés, űrlapmezők kitöltése és a meglévő aláírásmezők aláírása
+	Any except extracting pages	Bármi, az oldalak kinyerése kivételével
+	Enable copying of text, images, and other content	Szöveg, képek és egyéb tartalom másolásának engedélyezése
+	Enable text access for screen reader devices for the visually impaired	Szöveghozzáférés engedélyezése képernyőolvasóknak látássérülteknek
+	Type a password.	Adj meg egy jelszót.
+	The passwords don't match.	A jelszavak nem egyeznek.
+	This compatibility level supports only plain ASCII passwords.	Ez a kompatibilitási szint csak sima ASCII-jelszót fogad el.
+	Anyone opening the document will need this password. It's applied when you save.	A dokumentumot megnyitóknak erre a jelszóra lesz szükségük. Mentéskor lép életbe.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	A dokumentum jelszó nélkül nyílik meg; ez a jelszó a korlátozások módosításához kell. Mentéskor lép életbe.
+	Recover unsaved documents?	Visszaállítod a nem mentett dokumentumokat?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	A PdfCraft nem szabályosan állt le. Ezekben a dokumentumokban automatikusan mentett módosítások voltak:
+	just now	épp most
+	{n} min ago	{n} perce
+	{n} h ago	{n} órája
+	 · password-protected	 · jelszóval védett
+	Recover	Visszaállítás
+	Discard	Elvetés
+	Version {v}	{v} verzió
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Tiszta szobás, nyílt forráskódú PDF-alkalmazás, Rustban írva. MIT OR Apache-2.0.
+	Part of	Része
+	Summarize Options	Összefoglaló beállításai
+	Choose a layout:	Válassz elrendezést:
+	Comments only	Csak megjegyzések
+	Sort comments by:	Megjegyzések rendezése eszerint:
+	Create PDF Comment Summary	PDF-megjegyzésösszefoglaló létrehozása
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Visszatérsz „{name}” előzőleg mentett változatához? Az azóta tett módosítások utána nem vonhatók vissza.
+	Number pages	Oldalak számozása
+	Style	Stílus
+	None (prefix only)	Nincs (csak előtag)
+	Prefix	Előtag
+	Start	Kezdés
+	Labels: {preview}. Later pages keep their labels.	Címkék: {preview}. A későbbi oldalak megtartják a címkéjüket.
+	Even and Odd Pages	Páros és páratlan oldalak
+	Even Pages Only	Csak a páros oldalak
+	Odd Pages Only	Csak a páratlan oldalak
+	Landscape and Portrait Pages	Fekvő és álló oldalak
+	Landscape Pages	Fekvő oldalak
+	Portrait Pages	Álló oldalak
+	Duplicate Field	Mező megkettőzése
+	Duplicate "{name}" onto:	„{name}” másolása ide:
+	1 page selected.	1 oldal kijelölve.
+	{n} pages selected.	{n} oldal kijelölve.
+	Delete pages after extracting	Oldalak törlése a kinyerés után
+	Extract pages as separate files	Oldalak kinyerése külön fájlokba
+	Rotate Pages	Oldalak forgatása
+	Direction:	Irány:
+	Clockwise 90 degrees	90 fok az óramutató járásával megegyezően
+	Counterclockwise 90 degrees	90 fok az óramutató járásával ellentétesen
+	180 degrees	180 fok
+	Pages:	Oldalak:
+	All	Mind
+	Selection	Kijelölés
+	From	Ettől
+	Rotate:	Forgatás:
+	Repairs	Javítások
+	Repair log	Javítási napló
+	Split document	Dokumentum felosztása
+	Number of pages	Oldalak száma
+	Pages per file	Oldalak fájlonként
+	File size	Fájlméret
+	At most	Legfeljebb
+	Top-level bookmarks ({n})	Legfelső szintű könyvjelzők ({n})
+	Before each selected page (select pages in Organize)	Minden kijelölt oldal előtt (az oldalakat a Rendezésben jelöld ki)
+	Creates 1 file from {n} pages.	1 fájl jön létre {n} oldalból.
+	Creates {f} files from {n} pages.	{f} fájl jön létre {n} oldalból.
+	Each file holds as many of the {n} pages as fit.	Minden fájl annyi oldalt tartalmaz {n} oldalból, amennyi belefér.
+	Replace Pages	Oldalak cseréje
+	Original: replace pages	Eredeti: cserélendő oldalak
+	to	eddig
+	to {n}	eddig: {n}
+	Replacement: pages of {name}	Csere: {name} oldalai
+	of {name}	ebből: {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Csak az oldaltartalom változik: az eredeti oldalak hivatkozásai, megjegyzései, űrlapmezői és könyvjelzői megmaradnak.
+	The replacement file doesn't have that many pages.	A cserefájlban nincs ennyi oldal.
+	Tagged PDF	Címkézett PDF
+	Document Properties	Dokumentum tulajdonságai
+	Description	Leírás
+	Initial View	Kezdeti nézet
+	Security	Biztonság
+	Fonts	Betűtípusok
+	Advanced	Speciális
+	Title	Cím
+	Subject	Tárgy
+	Keywords	Kulcsszavak
+	Application	Alkalmazás
+	PDF producer	PDF-készítő
+	Layout and Magnification	Elrendezés és nagyítás
+	Navigation tab	Navigációs lap
+	Page Only	Csak az oldal
+	Bookmarks Panel and Page	Könyvjelzők panel és oldal
+	Pages Panel and Page	Oldalak panel és oldal
+	Attachments Panel and Page	Mellékletek panel és oldal
+	Layers Panel and Page	Rétegek panel és oldal
+	Page layout	Oldalelrendezés
+	Default	Alapértelmezett
+	Single Page	Egy oldal
+	Single Page Continuous	Egy oldal, folyamatos
+	Two-Up (Facing)	Két oldal (szembe néző)
+	Two-Up Continuous (Facing)	Két oldal, folyamatos (szembe néző)
+	Two-Up (Cover Page)	Két oldal (borítóval)
+	Two-Up Continuous (Cover Page)	Két oldal, folyamatos (borítóval)
+	Magnification	Nagyítás
+	Actual Size	Tényleges méret
+	Fit Page	Teljes oldal
+	Fit Width	Oldalszélesség
+	Fit Height	Oldalmagasság
+	Fit Visible	Látható terület
+	Open to page	Megnyitás ezen az oldalon
+	of {pages}	ennyiből: {pages}
+	Window Options	Ablakbeállítások
+	Resize window to initial page	Ablak méretezése a kezdő oldalhoz
+	Center window on screen	Ablak középre helyezése a képernyőn
+	Open in Full Screen mode	Megnyitás teljes képernyőn
+	Show:	Megjelenítés:
+	File Name	Fájlnév
+	Document Title	Dokumentum címe
+	User Interface Options	Felület beállításai
+	Hide menu bar	Menüsor elrejtése
+	Hide toolbars	Eszköztárak elrejtése
+	Hide window controls	Ablakvezérlők elrejtése
+	Security method	Biztonsági módszer
+	No security	Nincs védelem
+	Restrictions	Korlátozások
+	None — everything is allowed	Nincs — minden engedélyezett
+	Password security	Jelszavas védelem
+	Encryption	Titkosítás
+	Opened with	Megnyitva ezzel
+	— (protection is applied when you save)	— (a védelem mentéskor lép életbe)
+	Owner password (no restrictions apply)	Tulajdonosi jelszó (nincs korlátozás)
+	User password	Felhasználói jelszó
+	Change settings…	Beállítások módosítása…
+	Printing	Nyomtatás
+	Not allowed	Nem engedélyezett
+	Allowed	Engedélyezett
+	High resolution	Nagy felbontás
+	Low resolution	Alacsony felbontás
+	Changing the document	A dokumentum módosítása
+	Document assembly	Dokumentum összeállítása
+	Content copying	Tartalom másolása
+	Content copying for accessibility	Tartalom másolása akadálymentességhez
+	Commenting	Megjegyzés hozzáadása
+	Filling of form fields	Űrlapmezők kitöltése
+	No fonts are referenced by the pages.	Az oldalak nem hivatkoznak betűtípusra.
+	PDF version	PDF-verzió
+	Location	Hely
+	Page size	Oldalméret
+	Yes	Igen
+	No	Nem
+	Revisions	Változatok
+	View revision {n}	{n}. változat megtekintése
+	Open the file as it was saved then	A fájl megnyitása úgy, ahogy akkor mentve volt
+	Binding	Kötés
+	Left Edge	Bal szél
+	Right Edge	Jobb szél
+	Language	Nyelv
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Mentve ide: {place}: {before} → {after} ({pct}%-kal kisebb){detail}
+	Couldn't save the image: {e}	A képet nem sikerült menteni: {e}
+	Adding images arrives on the web with file pickers for images	A képek hozzáadása a webes változatban a képválasztóval együtt érkezik
+	Replacing images on page {p} arrives on the web with image pickers ({i})	A {p}. oldal képeinek cseréje a webes változatban a képválasztóval együtt érkezik ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: a képek kiválasztása a webes változatban a képválasztóval együtt érkezik
+	Replacing images arrives on the web with image file pickers	A képek cseréje a webes változatban a képfájl-választóval együtt érkezik
+	Couldn't create a PDF: {e}	A PDF létrehozása nem sikerült: {e}
+	The clipboard has no image or text	A vágólapon nincs kép vagy szöveg
+	On the web, open or drop an image to convert it	A weben nyiss meg vagy húzz ide egy képet a konvertáláshoz
+	Couldn't optimize the file: {e}	A fájlt nem sikerült optimalizálni: {e}
+	Couldn't write {path}: {e}	Nem sikerült írni ide: {path}: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Az űrlap ide kéri a beküldést: {u}; a PdfCraft nem küld űrlapadatot. Mentsd a dokumentumot, hogy megmaradjanak a beírásaid.
+	{s} actions run in the JavaScript engine (M6)	{s} műveletek a JavaScript-motorban futnak (M6)
+	{name}: the {other} action isn't supported yet	{name}: ez a művelet még nem támogatott ({other})
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} ide küldi az űrlapot: {url}; a PdfCraft nem küld űrlapadatot. Mentsd a dokumentumot, hogy megmaradjanak a beírásaid.
+	Export stopped: {e}	Az exportálás leállt: {e}
+	Exported 1 image	1 kép exportálva
+	Exported {n} images	{n} kép exportálva
+	 ({s} not exported: {first})	 ({s} nincs exportálva: {first})
+	Exported the text of 1 page	1 oldal szövege exportálva
+	Exported the text of {n} pages	{n} oldal szövege exportálva
+	{msg} to {dir}	{msg} ide: {dir}
+	Exporting… {d} of {t}	Exportálás… {d} / {t}
+	Choose a folder for the exported files	Válassz mappát az exportált fájloknak
+	New {tool} comments will look like this one	Az új „{tool}” megjegyzések így fognak kinézni
+	This document can't be checked: it couldn't be read for editing	Ez a dokumentum nem ellenőrizhető: nem sikerült szerkesztésre beolvasni
+	The checker found no problems in this document.	Az ellenőrzés nem talált problémát ebben a dokumentumban.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Az ellenőrzés 1 problémát talált, amely megakadályozhatja, hogy a dokumentum teljesen akadálymentes legyen.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Az ellenőrzés {n} problémát talált, amelyek megakadályozhatják, hogy a dokumentum teljesen akadálymentes legyen.
+	The text is the same	A szöveg azonos
+	1 difference found	1 különbséget találtunk
+	{n} differences found	{n} különbséget találtunk
+	Added 1 comment	1 megjegyzés hozzáadva
+	Added {n} comments	{n} megjegyzés hozzáadva
+	Choose a folder for the results	Válassz mappát az eredményeknek
+	Files for {name}	Fájlok ehhez: {name}
+	An action is already running	Már fut egy művelet
+	Running action… file {d} of {t}	Művelet fut… {d}. fájl / {t}
+	No unlinked web addresses were found in the text	A szövegben nem találtunk hivatkozás nélküli webcímet
+	Created 1 link	1 hivatkozás létrehozva
+	Created {n} links	{n} hivatkozás létrehozva
+	Text recognition is already running	A szövegfelismerés már fut
+	Optimizing… removing user data	Optimalizálás… felhasználói adatok eltávolítása
+	Optimizing… image {d} of {t}	Optimalizálás… {d}. kép / {t}
+	Optimizing… cleaning up	Optimalizálás… tisztítás
+	Optimizing… merging identical objects	Optimalizálás… azonos objektumok egyesítése
+	Optimizing… writing the copy	Optimalizálás… a másolat írása
+	Cancelling…	Megszakítás…
+	Optimization is already running	Az optimalizálás már fut
+	Optimization cancelled	Optimalizálás megszakítva
+	Couldn't optimize the file	A fájlt nem sikerült optimalizálni
+	Recognizing text… file {d} of {t}	Szövegfelismerés… {d}. fájl / {t}
+	Recognizing text… page {d} of {t}	Szövegfelismerés… {d}. oldal / {t}
+	Recognized 1 word	1 szó felismerve
+	Recognized {n} words	{n} szó felismerve
+	{words} on {pages}	{words}, itt: {pages}
+	; 1 page already had text	; 1 oldalon már volt szöveg
+	; {n} pages already had text	; {n} oldalon már volt szöveg
+	Recognized {w} words in 1 file	{w} szó felismerve 1 fájlban
+	Recognized {w} words in {n} files	{w} szó felismerve {n} fájlban
+	; failed: {list}	; nem sikerült: {list}
+	1 file done	1 fájl kész
+	{n} files done	{n} fájl kész
+	The selected area has been copied ({w} × {h} pixels)	A kijelölt terület a vágólapra került ({w} × {h} képpont)
+	Couldn't take the snapshot: {e}	A pillanatképet nem sikerült elkészíteni: {e}
+	Couldn't recover {name}: {e}	{name} visszaállítása nem sikerült: {e}
+	The document now conforms to {level}; save it to keep the changes	A dokumentum most megfelel ennek: {level}; mentsd, hogy megmaradjanak a módosítások
+	Fixed what could be fixed; 1 problem remains	Minden javíthatót javítottunk; 1 probléma maradt
+	Fixed what could be fixed; {n} problems remain	Minden javíthatót javítottunk; {n} probléma maradt
+	Custom stamps arrive on the web with file pickers for images	Az egyéni bélyegzők a webes változatban a képválasztóval együtt érkeznek
+	{file} is too large for a stamp (at most {n} MB)	{file} túl nagy bélyegzőnek (legfeljebb {n} MB)
+	Sent to {printer}	Elküldve ide: {printer}
+	Sent to {printer}: {msg}	Elküldve ide: {printer}: {msg}
+	Choose a folder for the searchable files	Válassz mappát a kereshető fájloknak
+	Files are combined in this order. Leave Pages empty to take every page.	A fájlok ebben a sorrendben egyesülnek. Hagyd üresen az Oldalak mezőt, ha minden oldalt kéred.
+	Pages of {name} to combine, e.g. 1-3, 6	{name} egyesítendő oldalai, pl. 1-3, 6
+	Remove {name}	{name} eltávolítása
+	Add files…	Fájlok hozzáadása…
+	Add at least two files	Legalább két fájlt adj hozzá
+	Couldn't add {name}: {e}	{name} hozzáadása nem sikerült: {e}
+	Couldn't combine files: {e}	A fájlokat nem sikerült egyesíteni: {e}
+	Export comments	Megjegyzések exportálása
+	Export form data	Űrlapadatok exportálása
+	Comment and form data	Megjegyzés- és űrlapadatok
+	Export	Exportálás
+	Select data files to merge	Egyesítendő adatfájlok kiválasztása
+	Form data and PDF forms	Űrlapadatok és PDF-űrlapok
+	Save the spreadsheet	Táblázat mentése
+	Save the accessibility report	Akadálymentességi jelentés mentése
+	Save image	Kép mentése
+	Export certificate	Tanúsítvány exportálása
+	Choose a folder for the extracted pages	Válassz mappát a kinyert oldalaknak
+	Choose a folder for the split files	Válassz mappát a felosztott fájloknak
+	Couldn't use {name}: {e}	{name} használata nem sikerült: {e}
+	Couldn't extract pages: {e}	Az oldalakat nem sikerült kinyerni: {e}
+	Couldn't write {name}: {e}	{name} írása nem sikerült: {e}
+	Wrote 1 file to {dir}	1 fájl ide írva: {dir}
+	Wrote {n} files to {dir}	{n} fájl ide írva: {dir}
+	No pages match those choices	Egy oldal sem felel meg ezeknek a választásoknak
+	Couldn't split: {e}	A felosztás nem sikerült: {e}
+	Couldn't summarize comments: {e}	A megjegyzéseket nem sikerült összefoglalni: {e}
+	Couldn't open the result: {e}	Az eredményt nem sikerült megnyitni: {e}
+	Importing data arrives on the web with file pickers for data files	Az adatok importálása a webes változatban az adatfájl-választóval együtt érkezik
+	Exported to {path}	Exportálva ide: {path}
+	Merging data files needs the desktop app	Az adatfájlok egyesítéséhez az asztali alkalmazás kell
+	Merged 1 file into {path}	1 fájl egyesítve ide: {path}
+	Merged {n} files into {path}	{n} fájl egyesítve ide: {path}
+	Combined {n} files	{n} fájl egyesítve
+	Extracted 1 page	1 oldal kinyerve
+	Extracted {n} pages	{n} oldal kinyerve
+	Created a comment summary	Megjegyzésösszefoglaló létrehozva
+	Couldn't open {name}: {e}	{name} megnyitása nem sikerült: {e}
+	Couldn't read {name}: {e}	{name} olvasása nem sikerült: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	A hordozható mód ki van kapcsolva: {folder} nem írható ({error}). A beállítások helyette a felhasználói mappádban maradnak.
+	Couldn't save: {e}	A mentés nem sikerült: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	A mellékletek letöltése a weben az M3.10-zel érkezik ({n} bájt kész)
+	`{command}` {when}	`{command}` {when}
+	ships in milestone {m}	{m} mérföldkőben érkezik
+	needs an AI provider (off by default)	MI-szolgáltató kell hozzá (alapból ki van kapcsolva)
+	is available	elérhető
+	is not available yet	még nem elérhető
+	{label} failed: {e}	{label} nem sikerült: {e}
+	Undid {label}	{label} visszavonva
+	Redid {label}	{label} megismételve
+	A document needs at least one page: copy instead	Egy dokumentumnak legalább egy oldala kell legyen: inkább másold
+	Cut {what}	{what} kivágva
+	Copied {what}	{what} másolva
+	1 page	1 oldal
+	{n} pages	{n} oldal
+	Copy or cut pages first	Előbb másolj vagy vágj ki oldalakat
+	Couldn't save {name}: {e}	{name} mentése nem sikerült: {e}
+	Saved {name}	{name} mentve
+	Saved, but reopening failed: {e}	Mentve, de az újranyitás nem sikerült: {e}
+	Downloaded {name}	{name} letöltve
+	Couldn't download {name}: {e}	{name} letöltése nem sikerült: {e}
+	Reverted to the last saved version	Visszaállítva az utoljára mentett változatra
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Ez nem sikerült: egy belső hiba megállította ({m}). A dokumentumaid változatlanok.
+	Nothing to undo	Nincs mit visszavonni
+	Nothing to redo	Nincs mit megismételni
+	This document has no form fields you can fill in	Ebben a dokumentumban nincs kitölthető űrlapmező
+	This document has no comments to flatten	Ebben a dokumentumban nincs beégethető megjegyzés
+	This document has no form fields to flatten	Ebben a dokumentumban nincs beégethető űrlapmező
+	There are no redaction marks (mark text, areas or pages first)	Nincs kitakarásjelölés (előbb jelölj meg szöveget, területet vagy oldalakat)
+	This document has no {kind} to change	Ebben a dokumentumban nincs módosítható {kind}
+	header or footer	fejléc vagy lábléc
+	watermark	vízjel
+	background	háttér
+	This document isn't password-protected	Ez a dokumentum nincs jelszóval védve
+	Only the document's owner can change its security (open it with the permissions password)	Csak a dokumentum tulajdonosa módosíthatja a biztonságát (nyisd meg a jogosultsági jelszóval)
+	The document's security settings don't allow this change	A dokumentum biztonsági beállításai nem engedik ezt a módosítást
+	Open a document first	Előbb nyiss meg egy dokumentumot
+	Security will be removed when you save	A védelem mentéskor megszűnik
+	Click text or an image to edit it	Kattints a szövegre vagy egy képre a szerkesztéshez
+	Drag a rectangle to create a link; double-click a link to edit it	Húzz egy téglalapot hivatkozás létrehozásához; dupla kattintással szerkesztheted
+	There are no redaction marks to apply	Nincs alkalmazható kitakarásjelölés
+	Drag to draw the area where the signature should appear.	Húzással rajzold meg, hol jelenjen meg az aláírás.
+	Couldn't fit the visible content: {e}	A látható tartalmat nem sikerült igazítani: {e}
+	Drag a rectangle around the area to copy	Húzz egy téglalapot a másolandó terület köré
+	Click on the page to add a {tool}, or drag to set its size	Kattints az oldalra egy {tool} hozzáadásához, vagy húzással állítsd be a méretét
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Húzz egy téglalapot egy oldalon a levágáshoz; dupla kattintás az Oldalkeretek beállításához
+	Keep tool selected: on	Eszköz kiválasztva tartása: be
+	Keep tool selected	Eszköz kiválasztva tartása
+	Opacity	Átlátszatlanság
+	Line thickness	Vonalvastagság
+	What word or phrase would you like to search for?	Melyik szót vagy kifejezést keresed?
+	Searching… {s} of {p} pages	Keresés… {s} / {p} oldal
+	 (searching… {s} of {p} pages)	 (keresés… {s} / {p} oldal)
+	1 instance	1 előfordulás
+	{n} instances	{n} előfordulás
+	Go to this result	Ugrás ehhez a találathoz
+	Highlight	Kiemelés
+	Draw	Rajzolás
+	Polygon	Sokszög
+	Connected lines	Összekötött vonalak
+	Eraser	Radír
+	Sign	Aláírás
+	Certified by {by}	Hitelesítette: {by}
+	At least one signature is invalid.	Legalább egy aláírás érvénytelen.
+	Signed and all signatures are valid.	Aláírva, és minden aláírás érvényes.
+	At least one signature has problems.	Legalább egy aláírásnak problémája van.
+	This document is secured. Some changes are restricted by its security settings.	Ez a dokumentum védett. Egyes módosításokat a biztonsági beállításai korlátoznak.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Ez egy dinamikus XFA-űrlap, amelyet a PdfCraft még nem tud megjeleníteni. Amit látsz, a fájl helyőrző oldala.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Ez az űrlap XFA-adatokat is tartalmaz, amelyeket a PdfCraft még nem olvas. Kitöltheted a mezőit, de az Acrobat helyettük az XFA-értékeket mutathatja.
+	This document contains {n} interactive form fields.	Ez a dokumentum {n} interaktív űrlapmezőt tartalmaz.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Ez a fájl sérült volt, és javítottuk. A mentés megtartja a javított változatot.
+	Dismiss	Elvetés
+	Hide field highlights	Mezőkiemelés elrejtése
+	Highlight fields	Mezők kiemelése
+	Security settings	Biztonsági beállítások
+	Details	Részletek
+	Select (V)	Kijelölés (V)
+	Hand (H)	Kéz (H)
+	Delete pages (Delete)	Oldalak törlése (Delete)
+	Insert a blank page after the selection	Üres oldal beszúrása a kijelölés után
+	Insert pages from a file…	Oldalak beszúrása fájlból…
+	Extract pages to a new document	Oldalak kinyerése új dokumentumba
+	Split into files…	Felosztás fájlokra…
+	Select pages	Oldalak kijelölése
+	Cut	Kivágás
+	Copy	Másolás
+	Paste after	Beillesztés utána
+	Rename	Átnevezés
+	Set to current page ({n})	Beállítás az aktuális oldalra ({n})
+	Move up	Feljebb
+	Move down	Lejjebb
+	Indent	Behúzás
+	Outdent	Behúzás csökkentése
+	This document has no form fields.	Ebben a dokumentumban nincs űrlapmező.
+	Tab order: move a field with its arrows.	Tab-sorrend: a nyilakkal helyezd át a mezőt.
+	Unplaced	Nincs elhelyezve
+	Has JavaScript actions (run in M6)	JavaScript-műveletei vannak (futás az M6-ban)
+	Page	Oldal
+	None	Nincs
+	Delete selected fields	Kijelölt mezők törlése
+	Diagnostic details	Diagnosztikai részletek
+	The operation failed.	A művelet nem sikerült.
+	no such document	nincs ilyen dokumentum
+	nothing to undo	nincs mit visszavonni
+	nothing to redo	nincs mit megismételni
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	ez a dokumentum alá van írva: az újraírás érvénytelenítené az aláírásait (inkább növekményesen mentsd)
+	the document is protected by a password	a dokumentum jelszóval védett
+	the password is incorrect	a jelszó hibás
+	the document has no page tree	a dokumentumnak nincs oldalfája
+	a document must keep at least one page	egy dokumentumnak legalább egy oldala kell maradjon
+	a bookmark cannot be moved inside itself	egy könyvjelzőt nem lehet saját magába helyezni
+	the title must not be empty	a cím nem lehet üres
+	the document has no form fields	a dokumentumnak nincs űrlapmezője
+	there are no redaction marks to apply	nincs alkalmazható kitakarásjelölés
+	there are no pages to print	nincs nyomtatható oldal
+	the document has no tags	a dokumentumnak nincs címkéje
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	a szövegfelismerés modelljei nincsenek telepítve (futtasd a `cargo xtask models` parancsot, vagy állítsd be a PRINTCRAFT_MODELS változót)
+	the image is empty	a kép üres
+	this file isn't XFDF, FDF, XML or text form data	ez a fájl nem XFDF, FDF, XML vagy szöveges űrlapadat
+	nothing in the file matches this document	a fájlban semmi sem illeszkedik ehhez a dokumentumhoz
+	This page couldn't be displayed.\n{e}	Ezt az oldalt nem sikerült megjeleníteni.\n{e}
+	Go to page {p}	Ugrás ide: {p}. oldal
+	{s} action	{s} művelet
+	Page {p} of {n}	{p}. oldal / {n}
+	1 page selected	1 oldal kijelölve
+	{n} pages selected	{n} oldal kijelölve
+	{name} — unsaved changes	{name} — nem mentett módosítások
+	{kind} field	{kind} mező
+	Select a file for the stamp	Válassz fájlt a bélyegzőhöz
+	JavaScript, e.g. getField("total").value	JavaScript, pl. getField("total").value
+	Font: Helvetica	Betűtípus: Helvetica
+	e.g. en-US	pl. hu-HU
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Megjelenítés: hayro (kiindulás) · Felület: egui · Ikonok: Lucide (ISC) · Betűtípusok: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	Jelölőnégyzet
+	Radio	Választógomb
+	PushButton	Nyomógomb
+	Combo	Kombinált lista
+	List	Lista
+	Unknown	Ismeretlen
+	The document has no XMP metadata	A dokumentumnak nincs XMP-metaadata
+	The title in the metadata and the document information differ	A metaadatokban és a dokumentumadatokban lévő cím eltér
+	The document is encrypted	A dokumentum titkosított
+	Device colour is used, but there is no PDF/A output intent	Eszközszín van használatban, de nincs PDF/A kimeneti cél
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	DeviceCMYK van használatban: CMYK kimeneti cél kell hozzá (nem kerül bele automatikusan)
+	The document has additional actions (/AA)	A dokumentumnak további műveletei vannak (/AA)
+	The document has document-level JavaScript	A dokumentum dokumentumszintű JavaScriptet tartalmaz
+	The form asks viewers to make appearances (NeedAppearances)	Az űrlap arra kéri a megjelenítőket, hogy készítsenek megjelenést (NeedAppearances)
+	A form field has additional actions	Egy űrlapmezőnek további műveletei vannak
+	A stream uses LZW compression	Egy adatfolyam LZW-tömörítést használ
+	A stream refers to an external file	Egy adatfolyam külső fájlra hivatkozik
+	An image asks to be interpolated	Egy kép interpolálást kér
+	An image has alternates or OPI information	Egy képnek vannak alternatívái vagy OPI-adatai
+	PostScript XObjects aren't allowed	A PostScript XObjectek nem megengedettek
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	A beágyazott fájloknak maguknak is PDF/A fájloknak kell lenniük (a többihez PDF/A-3 kell)
+	An embedded file has no AFRelationship	Egy beágyazott fájlnak nincs AFRelationship értéke
+	Select Icon	Ikon kiválasztása
+	Choose images	Képek kiválasztása
+	{dpi} pixels/inch	{dpi} képpont/hüvelyk
+	Type your {what}.	Írd be a következőt: {what}.
+	Draw your {what} below.	Rajzold le alább a következőt: {what}.
+	Your name	A neved
+	Images and text (converted to PDF)	Képek és szöveg (PDF-fé alakítva)
+	Images and text	Képek és szöveg
+	Check Box Style:	Jelölőnégyzet stílusa:
+	Button Style:	Gomb stílusa:
+	Check	Pipa
+	Circle	Kör
+	Diamond	Rombusz
+	Square	Négyzet
+	Star	Csillag
+	{month} {y}	{y}. {month}
+	Change {key}	{key} módosítása
+	Insert pages from {name}	Oldalak beszúrása ebből: {name}
+	Fill in {name}	{name} kitöltése
+	Set the image of {name}	{name} képének beállítása
+	Edit script of {name}	{name} szkriptjének szerkesztése
+	Import {name}	{name} importálása
+	Add bookmark	Könyvjelző hozzáadása
+	Rename bookmark	Könyvjelző átnevezése
+	Delete bookmark	Könyvjelző törlése
+	Move bookmark	Könyvjelző áthelyezése
+	Set bookmark destination	Könyvjelző céljának beállítása
+	Add stamp	Bélyegző hozzáadása
+	Delete comment	Megjegyzés törlése
+	Edit comment	Megjegyzés szerkesztése
+	Erase	Radírozás
+	Lock comment	Megjegyzés zárolása
+	Unlock comment	Megjegyzés feloldása
+	Move comment	Megjegyzés áthelyezése
+	Resize comment	Megjegyzés méretezése
+	Change comment properties	Megjegyzés tulajdonságainak módosítása
+	Add field	Mező hozzáadása
+	Change field properties	Mező tulajdonságainak módosítása
+	Delete field	Mező törlése
+	Duplicate field	Mező megkettőzése
+	Set tab order	Tab-sorrend beállítása
+	Change initial view	Kezdeti nézet módosítása
+	Set alternate text	Helyettesítő szöveg beállítása
+	Mark figure as decorative	Ábra megjelölése dekoratívként
+	Run JavaScript	JavaScript futtatása
+	Delete document JavaScript	Dokumentum-JavaScript törlése
+	Edit document JavaScript	Dokumentum-JavaScript szerkesztése
+	Edit text	Szöveg szerkesztése
+	Move image	Kép áthelyezése
+	Rotate image	Kép forgatása
+	Flip image	Kép tükrözése
+	Delete image	Kép törlése
+	Add header & footer	Fejléc és lábléc hozzáadása
+	Update header & footer	Fejléc és lábléc frissítése
+	Update watermark	Vízjel frissítése
+	Add background	Háttér hozzáadása
+	Update background	Háttér frissítése
+	Add image	Kép hozzáadása
+	Edit content	Tartalom szerkesztése
+	Delete content	Tartalom törlése
+	Remove redaction marks	Kitakarásjelölések eltávolítása
+	Add link	Hivatkozás hozzáadása
+	Change link properties	Hivatkozás tulajdonságainak módosítása
+	Delete link	Hivatkozás törlése
+	Create link	Hivatkozás létrehozása
+	Flatten	Beégetés
+	Add sticky note	Cetli hozzáadása
+	Add highlight	Kiemelés hozzáadása
+	Add underline	Aláhúzás hozzáadása
+	Add strikethrough	Áthúzás hozzáadása
+	Add squiggly underline	Hullámos aláhúzás hozzáadása
+	Add rectangle	Téglalap hozzáadása
+	Add oval	Ellipszis hozzáadása
+	Add arrow	Nyíl hozzáadása
+	Add line	Vonal hozzáadása
+	Add drawing	Rajz hozzáadása
+	Add text box	Szövegdoboz hozzáadása
+	Add checkmark	Pipa hozzáadása
+	Add cross	Kereszt hozzáadása
+	Add dot	Pont hozzáadása
+	Add signature	Aláírás hozzáadása
+	Add redaction mark	Kitakarásjelölés hozzáadása
+	Add cloud	Felhő hozzáadása
+	Add polygon	Sokszög hozzáadása
+	Add connected lines	Összekötött vonalak hozzáadása
+	Add callout	Szövegbuborék hozzáadása
+	Add inserted text	Beszúrt szöveg hozzáadása
+	Add file attachment	Fájlmelléklet hozzáadása
+	Set status Accepted	Állapot: Elfogadva
+	Set status Rejected	Állapot: Elutasítva
+	Set status Cancelled	Állapot: Megszakítva
+	Set status Completed	Állapot: Befejezve
+	Set status None	Állapot: Nincs
+	Set status Unmarked	Állapot: Nincs megjelölve
+	Save as PDF/A-1b	Mentés PDF/A-1b-ként
+	Save as PDF/A-2b	Mentés PDF/A-2b-ként
+	Save as PDF/A-3b	Mentés PDF/A-3b-ként
+	Fill & Sign: change signature	Kitöltés és aláírás: aláírás módosítása
+	Fill & Sign: change initials	Kitöltés és aláírás: monogram módosítása
+	Fill & Sign: remove saved signature	Kitöltés és aláírás: mentett aláírás eltávolítása
+	Fill & Sign: remove saved initials	Kitöltés és aláírás: mentett monogram eltávolítása
+	Change signature	Aláírás módosítása
+	Change initials	Monogram módosítása
+	Measure distance	Távolság mérése
+	Measure perimeter	Kerület mérése
+	Measure area	Terület mérése
+	Set measurement scale	Mérési méretarány beállítása
+	Measurement information	Mérési adatok
+	Measurement snapping	Illesztés méréskor
+	Export measurements as CSV	Mérések exportálása CSV-be
+	Distance	Távolság
+	Perimeter	Kerület
+	Area	Terület
+	Drawing scale	Rajz méretaránya
+	Snapping	Illesztés
+	Export measurements	Mérések exportálása
+	Open a PDF to measure it.	Nyiss meg egy PDF-et a méréshez.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Kattints a csúcspontokra. Az Enter vagy a dupla kattintás lezárja a kerületet vagy a területet. Az első pontra kattintva zárod a területet.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	A Shift 45 fokra korlátoz. A Backspace töröl egy csúcspontot. Az Escape megszakítja.
+	Angle	Szög
+	Click the first point to begin.	Kattints az első pontra a kezdéshez.
+	Snap to drawing	Illesztés a rajzhoz
+	Endpoints	Végpontok
+	Midpoints	Felezőpontok
+	Intersections	Metszéspontok
+	Paths	Útvonalak
+	Sensitivity	Érzékenység
+	Unit	Mértékegység
+	Decimals	Tizedesjegyek
+	Calibrate from two points	Kalibrálás két pontból
+	Entire page	Teljes oldal
+	Viewport rectangle in page points (x, y, width, height)	Nézetablak téglalapja oldalpontokban (x, y, szélesség, magasság)
+	Viewport	Nézetablak
+	Apply scale	Méretarány alkalmazása
+	Saved measurements	Mentett mérések
+	Saved measurements.	Mérések mentve.
+	Endpoint	Végpont
+	Midpoint	Felezőpont
+	Intersection	Metszéspont
+	Path	Útvonal
+	This drawing exceeds the snapping limit; only the first paths are used.	Ez a rajz túllépi az illesztési korlátot; csak az első útvonalak vannak használatban.
+	Some page content couldn't be read; snapping uses the rest.	Az oldaltartalom egy részét nem sikerült beolvasni; az illesztés a többit használja.
+	Unsupported measurements	Nem támogatott mérések
+	Label	Felirat
+	{n} measurements use an unsupported format and are left out.	{n} mérés nem támogatott formátumot használ, ezért kimarad.
+	This area has too many overlapping paths; intersection snapping is limited.	Ezen a területen túl sok az átfedő útvonal; a metszéspontokhoz illesztés korlátozott.
+	This measurement needs at least {n} points.	Ehhez a méréshez legalább {n} pont kell.
+	Change {what}	{what} módosítása
+	Cut and stack	Vágás és halmozás
+	Default workspace mode	Alapértelmezett munkaterület
+	Documents and view	Dokumentumok és nézet
+	Open email app	E-mail alkalmazás megnyitása
+	Open link	Hivatkozás megnyitása
+	Open this web page?	Megnyitod ezt a weboldalt?
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	A szkriptek homokozóban futnak, fájl- és hálózat-hozzáférés nélkül. Ha egy szkript weboldalt akar nyitni, előbb az engedélyed kell. Kikapcsolt JavaScript mellett az Acrobat szabványos formázó, ellenőrző és számoló függvényei továbbra is működnek.
+	Sign yourself	Saját kezű aláírás
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	A szövegfelismerés nincs telepítve: hiányoznak a modelljei (futtasd a `cargo xtask models` parancsot, vagy állítsd be a PDFCRAFT_MODELS változót).
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	PDF-ek megnyitásakor érvényes. A kifejezetten választott indítási vagy vezérlőmód a munkamenetre felülírja.
+	Write this email?	Megírod ezt az e-mailt?
+	{who} in this document wants to open this address in your browser:	{who} ebben a dokumentumban meg akarja nyitni ezt a címet a böngésződben:
+	{who} in this document wants to open your email app with this address:	{who} ebben a dokumentumban meg akarja nyitni az e-mail alkalmazásodat ezzel a címmel:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Ez a webcím több ábécé betűit keveri, ami gyakori módja egy másik oldal nevének utánzásának.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Ez a webcím egy másik ábécé betűit használja, amelyek ismerős betűkre hasonlíthatnak.
+	Create PDF from images	PDF létrehozása képekből
+	Selected image files: {count}	Kiválasztott képfájlok: {count}
+	Use image resolution	A kép felbontásának használata
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Minden kép beágyazott DPI-értékének használata; 72 DPI, ha nincs ilyen.
+	Use 72 DPI (one point per pixel)	72 DPI használata (egy pont képpontonként)
+	Use custom DPI	Egyéni DPI használata
+	DPI sets the printed page size without resampling the image.	A DPI a nyomtatott oldalméretet állítja be, a kép újramintázása nélkül.
+	Create	Létrehozás
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Dinamikus XFA-űrlap, a sablonjából felépítve: {pages}, {fields}.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA-űrlap: a mezői és az XFA-adatai együtt maradnak, így más megjelenítők azt mutatják, amit beírsz.
+@plural	{n} page|{n} pages	{n} oldal|{n} oldal
+@plural	{n} field|{n} fields	{n} mező|{n} mező
+	Switch to two-page view first to show the cover page	Előbb válts kétoldalas nézetre a borító megjelenítéséhez
+	Page display: {layout}	Oldalmegjelenítés: {layout}
+	Fit to width scrolling	Görgetés szélességhez igazítva
+	Fit one full page	Egy teljes oldal igazítása
+	Default page display	Alapértelmezett oldalmegjelenítés
+	Default zoom	Alapértelmezett nagyítás
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Akkor érvényes, ha a PDF nem kér elrendezést vagy nagyítást. A folyamatos görgetés soha nem ugrik oldalak közé.
+	Show	Megjelenítés
+	Sort	Rendezés
+	Reverse the order	Sorrend megfordítása
+	Grab bag	Vegyes
+	Table	Táblázat
+	Username	Felhasználónév
+	Display name	Megjelenített név
+	Real name	Valódi név
+	Name (A–Z)	Név (A–Z)
+	Merged PRs	Beolvasztott PR-ek
+	PRs	PR-ek
+	Commits	Commitok
+	Lines added	Hozzáadott sorok
+	+LOC	+LOC
+	Lines deleted	Törölt sorok
+	−LOC	−LOC
+	Line delta	Sorok különbsége
+	ΔLOC	ΔLOC
+	Binary assets added	Hozzáadott bináris fájlok
+	+Bin	+Bin
+	Binary assets removed	Eltávolított bináris fájlok
+	−Bin	−Bin
+	First commit	Első commit
+	First	Első
+	Last commit	Utolsó commit
+	Last	Utolsó
+	No contributor data was built into this copy.	Ebben a példányban nincsenek beépített közreműködői adatok.
+	No model credits were built into this copy.	Ebben a példányban nincsenek beépített modelladatok.
+	{n} contributors · {c} commits	{n} közreműködő · {c} commit
+	Company	Cég
+	Model	Modell
+	% of all commits	Az összes commit %-a
+	Lines +/−	Sorok +/−
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: {prs} PR, {commits} commit, +{added} / −{deleted} sor (Δ {delta}), +{bin_added} / −{bin_deleted} bináris fájl, {first} – {last}
+	Set layer visibility	Réteg láthatóságának beállítása
+	Created a PDF from {n} files	PDF létrehozva {n} fájlból
+	PDF, images and text	PDF, képek és szöveg
+	Insert a file before page {label}	Fájl beszúrása a {label}. oldal elé
+	Insert a file at the end	Fájl beszúrása a végére
+	Save pages	Oldalak mentése
+	Save these pages as one PDF	Ezeknek az oldalaknak a mentése egy PDF-be
+	No changes to save	Nincs mit menteni
+	Created a PDF from {n} files; left out: {names}	PDF létrehozva {n} fájlból; kimaradt: {names}
+	Created a PDF from the first {n} files	PDF létrehozva az első {n} fájlból
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Ezekből a fájlokból nem készíthető PDF; használj PDF-et, képet vagy .txt fájlt
+	1 file	1 fájl
+	1 file needs attention	1 fájl figyelmet kér
+	? of {n}	? / {n}
+	Add folder	Mappa hozzáadása
+	Add folder and subfolders	Mappa és almappák hozzáadása
+	Add folder and subfolders…	Mappa és almappák hozzáadása…
+	Add folder…	Mappa hozzáadása…
+	Add open documents	Megnyitott dokumentumok hozzáadása
+	Add the PDFs to combine	Add hozzá az egyesítendő PDF-eket
+	Added more than once	Többször hozzáadva
+	All open documents	Minden megnyitott dokumentum
+	Can't be read: {e}	Nem olvasható: {e}
+	Check the pages of {name}: {why}	Ellenőrizd {name} oldalait: {why}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Kattints a rendezéshez, húzd az oszlop áthelyezéséhez. A szélét húzva méretezd.
+	Drag to reorder	Húzás az átrendezéshez
+	Drop PDFs or folders here, or choose them.	Húzz ide PDF-eket vagy mappákat, vagy válaszd ki őket.
+	Enter the password that opens it	Add meg a megnyitó jelszót
+	Enter the permissions password to allow combining	Add meg a jogosultsági jelszót az egyesítés engedélyezéséhez
+	Every PDF in the folder	A mappa minden PDF-je
+	Every PDF in the folder and the folders inside it	A mappa és az almappái minden PDF-je
+	File name	Fájlnév
+	Files are combined from top to bottom. Leave Pages empty to take every page.	A fájlok fentről lefelé egyesülnek. Hagyd üresen az Oldalak mezőt, ha minden oldalt kérsz.
+	Hide password	Jelszó elrejtése
+	Includes unsaved changes	Nem mentett módosításokat tartalmaz
+	Its security settings don't allow copying pages	A biztonsági beállításai nem engedik az oldalak másolását
+	More ways to add files	További módok fájlok hozzáadására
+	No documents are open	Nincs megnyitott dokumentum
+	No pages selected	Nincs kijelölt oldal
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Megnyitva, de a biztonsági beállításai nem engedik az egyesítést. Add meg a jogosultsági jelszót.
+	Password-protected	Jelszóval védett
+	Protected: the combined file won't keep its security settings	Védett: az egyesített fájl nem tartja meg a biztonsági beállításait
+	Remove {n} files	{n} fájl eltávolítása
+	Reset columns	Oszlopok visszaállítása
+	Select a file first	Előbb válassz egy fájlt
+	Select a password-protected file first	Előbb válassz egy jelszóval védett fájlt
+	Show password	Jelszó megjelenítése
+	The password is only used to read the file; it isn't saved.	A jelszó csak a fájl olvasásához kell, és nem kerül mentésre.
+	The same password is tried on each file.	Ugyanezt a jelszót próbáljuk meg minden fájlon.
+	Unlock	Feloldás
+	Unlock {name}	{name} feloldása
+	Unlock {n} files	{n} fájl feloldása
+	Unlocked: the combined file won't be password-protected	Feloldva: az egyesített fájl nem lesz jelszóval védve
+	Unlock…	Feloldás…
+	Warnings	Figyelmeztetések
+	Wrong password	Hibás jelszó
+	sorted ascending	növekvő sorrendben
+	sorted descending	csökkenő sorrendben
+	yesterday	tegnap
+	{k} of {n}	{k} / {n}
+	{name} can't be combined: {why}	{name} nem egyesíthető: {why}
+	{n} days ago	{n} napja
+	{n} files	{n} fájl
+	{n} files need attention	{n} fájl figyelmet kér
+	{n} selected	{n} kijelölve
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Válassz PNG- vagy JPEG-képet (legfeljebb 4 MiB). Az átlátszóság megmarad.
+	Couldn't import the signature image: {e}	Az aláírásképet nem sikerült importálni: {e}
+	Open Recent	Legutóbbi megnyitása
+	Pin folder to Home…	Mappa kitűzése a kezdőlapra…
+	Folders	Mappák
+	Pin a folder…	Mappa kitűzése…
+	Pin a folder to Home	Mappa kitűzése a kezdőlapra
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Tűzz ki egy mappát, hogy a legújabb PDF-jei itt jelenjenek meg, például oda, ahová a szkennered vagy egy szinkronizált felhőmeghajtó menti őket.
+	Unpin	Kitűzés megszüntetése
+	Unpin {folder}	{folder} kitűzésének megszüntetése
+	Looking for PDFs…	PDF-ek keresése…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Ez a mappa jelenleg nem érhető el. Lehet, hogy áthelyezték, vagy a meghajtója, illetve a felhőszinkron offline.
+	No PDFs in this folder yet	Ebben a mappában még nincs PDF
+	Show less	Kevesebb megjelenítése
+	Show {n} more	További {n} megjelenítése
+	The newest {n} of {total} PDFs	A legújabb {n} / {total} PDF
+	Pinned folders need the desktop app	A kitűzött mappákhoz az asztali alkalmazás kell
+	Choose a folder on this computer to pin	Válassz egy mappát ezen a számítógépen a kitűzéshez
+	{folder} is already pinned to Home	{folder} már ki van tűzve a kezdőlapra
+	You can pin up to {n} folders. Unpin one first.	Legfeljebb {n} mappát tűzhetsz ki. Előbb szüntesd meg az egyik kitűzését.
+	Pinned {folder} to Home	{folder} kitűzve a kezdőlapra
+	No recent files	Nincs legutóbbi fájl
+	Go to page…	Ugrás oldalra…
+	About	Névjegy
+	Contributors	Közreműködők
+	Models	Modellek
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Csak akkor folytasd, ha megbízol ebben a dokumentumban. Egy cím adatokat vihet a dokumentumból, például azt, amit az űrlapjába írtál.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Nyomtass egyoldalasan. Tartsd a lapokat sorrendben, vágd el a jeleknél, majd rakd a kötegeket balról jobbra, fentről lefelé egymásra.
+	Unlocked {n} of {m} files	{n} / {m} fájl feloldva
+	No PDFs found in {folder}	Nem található PDF itt: {folder}
+	Added the first {n} PDFs in {folder}	{folder} első {n} PDF-je hozzáadva
+comment menu	Edit	Szerkesztés
+	Undo {action}	{action} visszavonása
+	Redo {action}	{action} megismétlése
+signature pad	Type	Gépelés
+action wizard	Start	Indítás
+	Reopen the files that were open when PdfCraft last closed	A PdfCraft legutóbbi bezárásakor megnyitott fájlok újranyitása
+	Clear Recent Files	Legutóbbi fájlok listájának törlése
+	Remove from Recent	Eltávolítás a legutóbbiak közül
+	Remove {name} from Recent	{name} eltávolítása a legutóbbiak közül
+
+# Labels that reach tl!() through a variable (Fill & Sign buttons, link prompts, notices, history labels, checker and certificate rows)
+	Add {what}	{what} hozzáadása
+	Use {what}	{what} használata
+	Place saved {what}	Mentett elem elhelyezése: {what}
+	Remove saved {what}	Mentett elem eltávolítása: {what}
+	A link	Egy hivatkozás
+	A button	Egy gomb
+	A script	Egy szkript
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	{who} ebben a dokumentumban olyan címet próbált megnyitni, amelyet a PdfCraft nem nyit meg: {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} ebben a dokumentumban olyan címet próbált megnyitni, amelyet a PdfCraft nem nyit meg: {e}. Dokumentumokból csak webes (http, https) és e-mail (mailto) hivatkozások nyílnak meg.
+	Another file dialog is still open. Finish with it first.	Egy másik fájlpárbeszédablak még nyitva van. Előbb fejezd be azt.
+	Couldn't show the file picker. Please try again.	Nem sikerült megjeleníteni a fájlválasztót. Próbáld újra.
+	The document changed while you were choosing a file, so nothing was changed.	A dokumentum megváltozott, amíg fájlt választottál, ezért semmi sem módosult.
+	The document was closed before it could be saved.	A dokumentum bezárult, mielőtt menteni lehetett volna.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Az oldalak kinyerése megtörtént, de nem lettek törölve, mert a dokumentum megváltozott, amíg mappát választottál.
+	That didn't work: an internal error stopped it ({m}).	Ez nem sikerült: belső hiba állította le ({m}).
+	The Windows store's digital IDs couldn't be listed: {e}	A Windows-tároló digitális azonosítóit nem sikerült listázni: {e}
+	Align fields	Mezők igazítása
+	Distribute fields	Mezők elosztása
+	Match field sizes	Mezőméretek egyeztetése
+	Mark for redaction	Megjelölés kitakarásra
+	Mark pages for redaction	Oldalak megjelölése kitakarásra
+	Change document properties	Dokumentum tulajdonságainak módosítása
+	Mark differences	Különbségek megjelölése
+	Run form script	Űrlapszkript futtatása
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	A szkriptelt tartalomnak billentyűzettel és kisegítő technológiával is használhatónak kell lennie. Ellenőrizd a dokumentum szkriptjeit.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	A táblázatsorok közvetlenül a táblázatba vagy annak fejlécébe, törzsébe vagy láblécébe tartoznak. Javítsd a táblázat címkéit.
+	Basic constraints	Alapvető korlátozások
+	SHA-1 digest	SHA-1 kivonat
+	SHA-256 digest	SHA-256 kivonat
+	Squiggly	Hullámos
+	Home / End	Home / End
+	H / Space (hold)	H / szóköz (nyomva tartva)
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 818fbee8..4a8cde47 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -87,7 +87,7 @@ fn plural_russian(n: u64) -> usize {
 }
 
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 12] = [
+pub static LANGUAGES: [LangInfo; 13] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -110,6 +110,8 @@ pub static LANGUAGES: [LangInfo; 12] = [
     LangInfo { code: "bg", name: "Български", source: include_str!("bg.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
     // Telugu; every `te-*` locale (`te-IN`) resolves here.
     LangInfo { code: "te", name: "తెలుగు", source: include_str!("te.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
+    // Hungarian; every `hu-*` locale (`hu-HU`) resolves here.
+    LangInfo { code: "hu", name: "Magyar", source: include_str!("hu.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
 ];
 
 impl LangInfo {
@@ -1445,6 +1447,117 @@ mod tests {
         set_current(Lang::EN);
     }
 
+    #[test]
+    fn hungarian_is_registered() {
+        let hu = Lang::from_code("hu").expect("hu registered");
+        assert_eq!(hu.name(), "Magyar");
+        assert_eq!(normalize_pref("HU"), Some("hu"));
+        assert_eq!(lang_from_tag("hu_HU.UTF-8"), Some(hu));
+        assert_eq!(lang_from_tag("hu-HU"), Some(hu));
+        assert_eq!(first_supported("hu-HU\r\nen-US"), Some(hu));
+        assert_eq!(tr(hu, "File"), "Fájl");
+        assert_eq!(tr(hu, "Save as…"), "Mentés másként…");
+        assert_eq!(tr(hu, "Bookmarks"), "Könyvjelzők");
+        assert_eq!(tr(hu, "Layers"), "Rétegek");
+        assert_eq!(tr(hu, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
+        assert_eq!(tr_ctx(hu, "signature pad", "Type"), "Gépelés");
+        assert_eq!(tr_ctx(hu, "action wizard", "Start"), "Indítás");
+        // one (1), other (0, 2+)
+        assert_eq!((0..=3).map(|n| (hu.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+        assert_eq!(trn(hu, 0, "{n} page", "{n} pages"), "0 oldal");
+        assert_eq!(trn(hu, 1, "{n} page", "{n} pages"), "1 oldal");
+        assert_eq!(trn(hu, 2, "{n} page", "{n} pages"), "2 oldal");
+        assert_eq!(trn(hu, 1, "{n} field", "{n} fields"), "1 mező");
+        assert_eq!(trn(hu, 5, "{n} field", "{n} fields"), "5 mező");
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", "hu").unwrap();
+        assert_eq!(app.language, "hu");
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, "hu");
+    }
+
+    /// Hungarian translates every registered command and every All tools group, section and item.
+    #[test]
+    fn hungarian_covers_commands_and_catalogue() {
+        let hu = Lang::from_code("hu").expect("hu registered");
+        for command in pdfcraft_engine::commands::COMMANDS {
+            assert!(has(hu, command.label), "missing command: {}", command.label);
+            if let Some(menu) = command.menu {
+                assert!(has(hu, menu), "missing menu: {menu}");
+            }
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            assert!(has(hu, group.label), "missing group: {}", group.label);
+            for section in group.sections {
+                assert!(has(hu, section.title), "missing section: {}", section.title);
+                for item in section.items {
+                    assert!(has(hu, item.label), "missing item: {}", item.label);
+                }
+            }
+        }
+    }
+
+    /// New tl!("literal") labels must not silently fall back to English.
+    #[test]
+    fn hungarian_covers_ui_literals() {
+        let hu = Lang::from_code("hu").expect("hu registered");
+        let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+        let mut literals = std::collections::BTreeSet::new();
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(dir).expect("UI source directory") {
+                let path = entry.expect("UI source entry").path();
+                if path.is_dir() {
+                    if path.file_name().is_some_and(|name| name != "i18n") {
+                        stack.push(path);
+                    }
+                } else if path.extension().is_some_and(|ext| ext == "rs") {
+                    let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n");
+                    let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+                    while let Some((_, after)) = rest.split_once("tl!(\"") {
+                        let mut escaped = false;
+                        let end = after
+                            .char_indices()
+                            .find_map(|(i, c)| {
+                                if c == '"' && !escaped {
+                                    return Some(i);
+                                }
+                                escaped = c == '\\' && !escaped;
+                                None
+                            })
+                            .expect("closed tl! literal");
+                        let (raw, tail) = after.split_at(end);
+                        if tail.starts_with("\")") {
+                            let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
+                            literals.insert(label);
+                        }
+                        rest = tail.strip_prefix('"').expect("closing quote");
+                    }
+                }
+            }
+        }
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(hu, label)).collect();
+        assert!(missing.is_empty(), "untranslated Hungarian UI literals: {missing:#?}");
+    }
+
+    #[test]
+    fn hungarian_history_and_diagnostics_preserve_user_values() {
+        let hu = Lang::from_code("hu").expect("hu registered");
+        set_current(hu);
+        assert_eq!(command_label("Undo Insert pages from Rapport {n}.pdf"), "Oldalak beszúrása ebből: Rapport {n}.pdf visszavonása");
+        assert_eq!(command_label("Redo Fill in Contact {key}"), "Contact {key} kitöltése megismétlése");
+        assert_eq!(action_label("Change Title"), "Cím módosítása");
+        assert_eq!(action_label("Custom action {n}"), "Custom action {n}");
+        assert_eq!(
+            fmt(t("This page couldn't be displayed.\n{e}"), &[("e", "OS error {n}")]),
+            "Ezt az oldalt nem sikerült megjeleníteni.\nOS error {n}"
+        );
+        assert_eq!(fmt(t("{n} pages selected"), &[("n", "3")]), "3 oldal kijelölve");
+        assert_eq!(tr(hu, "CheckBox"), "Jelölőnégyzet");
+        set_current(Lang::EN);
+    }
+
     /// Every bundled catalog is well-formed and consistent with its sources.
     #[test]
     fn bundled_catalogs_are_consistent() {
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index 046cf1b9..a8a9b89e 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -162,7 +162,7 @@ fn ui_fonts_work_without_craft_fonts() {
     theme::install_fonts(&ctx);
 }
 
-/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, German, Spanish, French, Russian, Bulgarian) are drawn entirely by the app's own faces
+/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, German, Spanish, French, Russian, Bulgarian, Hungarian) are drawn entirely by the app's own faces
 /// (Inter, JetBrains Mono): no letter falls through to egui's defaults or a CJK fallback. (egui's
 /// `has_glyphs` can't answer this: with only the primary face it is also the replacement face.)
 #[test]
@@ -177,8 +177,9 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
         ("fr", include_str!("../src/i18n/fr.tsv")),
         ("ru", include_str!("../src/i18n/ru.tsv")),
         ("bg", include_str!("../src/i18n/bg.tsv")),
+        ("hu", include_str!("../src/i18n/hu.tsv")),
     ] {
-        let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜäÄöÖß„“¿¡«»…");
+        let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜäÄöÖőűß„“¿¡«»…");
         for line in catalog.lines().filter(|l| !l.starts_with('#')) {
             if let Some(translation) = line.split('\t').nth(2) {
                 text.extend(translation.chars().filter(|c| !c.is_whitespace()));
diff --git a/docs/localization.md b/docs/localization.md
index 621ba4db..73e53f3f 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,8 +1,8 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français** or **తెలుగు**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **తెలుగు** or **Magyar**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, and Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
@@ -10,11 +10,11 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr` or `te`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`, `hu`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te` or `hu`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French and Telugu translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu and Hungarian translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish and French need only the bundled Latin faces (tested in `tests/fonts.rs`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
+Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French and Hungarian need only the bundled Latin faces (tested in `tests/fonts.rs`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 
 There is no right-to-left interface language yet. File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
 
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 4f114286..c9ab74d1 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9818,8 +9818,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs"]
-notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish and French cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
+evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values"]
+notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"

From eb00280eba9d8df28c06a47f9db17d139401505c Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Sat, 10 Oct 2026 01:28:33 +0900
Subject: [PATCH 088/149] M1: stream data read from a file points into the file
 instead of being copied (#552)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M1: stream data read from a file points into the file instead of being copied

Every stream COS loaded was copied out of the document's bytes
(`data[start..end].to_vec()`) and kept in the object cache until the document
closed. Anything that reads every object therefore left a second copy of all
stream data behind. That includes a full save, which edits needing a rewrite
(repaired files, security changes, redaction) run on every change. A full save
of a 208 MB document left 208 MB cached on it.

`Stream::raw` is now `Bytes`: owned bytes, or a range of a larger shared
buffer. Streams parsed from a document's own bytes are ranges of that buffer,
which the document keeps anyway. Decrypted and newly built streams own their
bytes as before. A stream added to a document from another document's file gets
its own copy of just its bytes (`Document::set`/`add`), so it never keeps
another whole file alive.

Results, measured with an exact heap counter:
- A full save of a 208 MB document leaves 0.2 MB cached instead of 208.2 MB.
- The first full save of a freshly opened document is about twice as fast:
  10 → 5 ms at 40 MB, 38 → 21 ms at 200 MB.

Output is identical: 68 incremental and full saves of five originals,
encrypted ones included, hash the same before and after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M1: the full-save capacity test (#523) builds its stream from Bytes

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/cos/src/bytes.rs            | 93 ++++++++++++++++++++++++++++++
 crates/cos/src/document.rs         | 26 +++++++--
 crates/cos/src/lib.rs              |  2 +
 crates/cos/src/object.rs           | 12 ++--
 crates/cos/src/parser.rs           | 36 ++++++++++--
 crates/cos/src/security.rs         |  2 +-
 crates/cos/tests/shared_streams.rs | 78 +++++++++++++++++++++++++
 crates/cos/tests/writer.rs         |  4 +-
 crates/organize/src/dedupe.rs      |  9 +--
 crates/organize/src/pdfx.rs        |  2 +-
 10 files changed, 236 insertions(+), 28 deletions(-)
 create mode 100644 crates/cos/src/bytes.rs
 create mode 100644 crates/cos/tests/shared_streams.rs

diff --git a/crates/cos/src/bytes.rs b/crates/cos/src/bytes.rs
new file mode 100644
index 00000000..d2dcf238
--- /dev/null
+++ b/crates/cos/src/bytes.rs
@@ -0,0 +1,93 @@
+//! Stream data that can share a larger buffer instead of copying out of it.
+
+use std::ops::{Deref, Range};
+use std::sync::Arc;
+
+/// A stream's bytes: a buffer of their own, or a range of a larger shared buffer. Streams read
+/// from a file point into the file's bytes, which the document keeps anyway, so caching a
+/// parsed stream costs its dictionary and not a second copy of its data.
+#[derive(Clone, Default)]
+pub struct Bytes {
+    buf: Arc<Vec<u8>>,
+    range: Range<usize>,
+}
+
+impl Bytes {
+    /// `range` of `buf`, without copying; `None` when the range is not within `buf`.
+    pub(crate) fn view(buf: &Arc<Vec<u8>>, range: Range<usize>) -> Option<Self> {
+        (range.start <= range.end && range.end <= buf.len()).then(|| Self { buf: buf.clone(), range })
+    }
+
+    /// Whether these bytes keep alive a larger buffer than themselves that isn't `owner`.
+    pub(crate) fn borrows_other_than(&self, owner: &Arc<Vec<u8>>) -> bool {
+        self.range.len() < self.buf.len() && !Arc::ptr_eq(&self.buf, owner)
+    }
+
+    /// The same bytes, in a buffer of their own.
+    pub(crate) fn detached(&self) -> Self {
+        Self::from(self.to_vec())
+    }
+}
+
+impl From<Vec<u8>> for Bytes {
+    fn from(v: Vec<u8>) -> Self {
+        let range = 0..v.len();
+        Self { buf: Arc::new(v), range }
+    }
+}
+
+impl From<Arc<Vec<u8>>> for Bytes {
+    fn from(buf: Arc<Vec<u8>>) -> Self {
+        let range = 0..buf.len();
+        Self { buf, range }
+    }
+}
+
+impl Deref for Bytes {
+    type Target = [u8];
+
+    fn deref(&self) -> &[u8] {
+        // `view` and `From` only build in-bounds ranges; an empty slice keeps this panic-free.
+        self.buf.get(self.range.clone()).unwrap_or_default()
+    }
+}
+
+impl AsRef<[u8]> for Bytes {
+    fn as_ref(&self) -> &[u8] {
+        self
+    }
+}
+
+impl PartialEq for Bytes {
+    fn eq(&self, other: &Self) -> bool {
+        (Arc::ptr_eq(&self.buf, &other.buf) && self.range == other.range) || **self == **other
+    }
+}
+
+impl Eq for Bytes {}
+
+impl std::fmt::Debug for Bytes {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        (**self).fmt(f)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn views_share_their_buffer_and_compare_by_content() {
+        let file = Arc::new(b"0123456789".to_vec());
+        let view = Bytes::view(&file, 2..5).expect("in range");
+        assert_eq!(&*view, b"234");
+        assert_eq!(view.as_ptr(), file[2..].as_ptr(), "no copy");
+        assert_eq!(view, Bytes::from(b"234".to_vec()));
+        assert!(Bytes::view(&file, 5..11).is_none() && Bytes::view(&file, Range { start: 6, end: 5 }).is_none());
+        let other = Arc::new(Vec::new());
+        assert!(view.borrows_other_than(&other) && !view.borrows_other_than(&file));
+        let own = view.detached();
+        assert!(!own.borrows_other_than(&other) && own == view && own.as_ptr() != view.as_ptr());
+        assert!(!Bytes::from(file.clone()).borrows_other_than(&other), "a whole buffer is its own");
+    }
+}
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index f44d2d24..665bebe5 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -10,7 +10,7 @@ use std::sync::{Arc, Mutex};
 
 use crate::CosError;
 use crate::object::{Dict, ObjRef, Object};
-use crate::parser::{Lexer, is_whitespace, parse_indirect};
+use crate::parser::{Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
 
 thread_local! {
     /// The objects being loaded on this thread, innermost last (see `Document::try_get`).
@@ -509,7 +509,7 @@ impl Document {
                     length
                 };
                 let off = *offset as usize;
-                let at = |off: usize| match parse_indirect(&self.data, off, &resolve) {
+                let at = |off: usize| match parse_indirect_shared(&self.data, off, &resolve) {
                     Ok((id, o)) if id.num == num => Some(self.decrypted(id, o)),
                     _ => None,
                 };
@@ -564,7 +564,7 @@ impl Document {
             if p > 0 && !is_whitespace(data[p - 1]) {
                 continue;
             }
-            if let Ok((id, o)) = parse_indirect(data, p, &|_| None)
+            if let Ok((id, o)) = parse_indirect_shared(data, p, &|_| None)
                 && id.num == num
             {
                 found = Some((id, o)); // keep the last (newest) definition
@@ -575,9 +575,22 @@ impl Document {
 
     // ── editing ─────────────────────────────────────────────────────────────────────────────
 
+    /// Stream data still pointing into another document's file would keep that whole file
+    /// alive for as long as this edit exists: give it a buffer of its own (just its bytes).
+    fn adopt(&self, obj: Object) -> Object {
+        match obj {
+            Object::Stream(mut s) if s.raw.borrows_other_than(&self.data) => {
+                s.raw = s.raw.detached();
+                Object::Stream(s)
+            }
+            other => other,
+        }
+    }
+
     /// Replace an object (keeping its generation).
     pub fn set(&mut self, r: ObjRef, obj: impl Into<Object>) {
-        self.overlay.insert(r.num, Slot::Set(r.generation, Arc::new(obj.into())));
+        let obj = self.adopt(obj.into());
+        self.overlay.insert(r.num, Slot::Set(r.generation, Arc::new(obj)));
         if r.num >= self.next_num {
             self.next_num = r.num + 1;
         }
@@ -587,7 +600,8 @@ impl Document {
     pub fn add(&mut self, obj: impl Into<Object>) -> ObjRef {
         let r = ObjRef::new(self.next_num, 0);
         self.next_num += 1;
-        self.overlay.insert(r.num, Slot::Set(0, Arc::new(obj.into())));
+        let obj = self.adopt(obj.into());
+        self.overlay.insert(r.num, Slot::Set(0, Arc::new(obj)));
         r
     }
 
@@ -1010,7 +1024,7 @@ mod tests {
         // Either recovered via the endstream search or reported — but never a stack overflow.
         let o = doc.get(ObjRef::new(3, 0));
         if let Object::Stream(s) = o.as_ref() {
-            assert_eq!(s.raw.as_slice(), b"abc");
+            assert_eq!(&s.raw[..], b"abc");
         }
     }
 
diff --git a/crates/cos/src/lib.rs b/crates/cos/src/lib.rs
index 4cab44d7..29e906e1 100644
--- a/crates/cos/src/lib.rs
+++ b/crates/cos/src/lib.rs
@@ -11,12 +11,14 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+mod bytes;
 mod document;
 mod object;
 mod parser;
 mod security;
 mod writer;
 
+pub use bytes::Bytes;
 pub use document::{Document, Revision, XrefEntry};
 pub use object::{Dict, MAX_DECODED, Name, ObjRef, Object, PdfString, Stream};
 pub use parser::{Lexer, parse_indirect};
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index 808fdef1..42659f9f 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -3,11 +3,9 @@
 //! Dictionaries keep their key order so rewritten objects stay recognisable in diffs and
 //! byte-stable when re-serialized. Streams keep their *encoded* bytes; decoding is on demand.
 
-use std::sync::Arc;
-
 use pdfcraft_filters::{Filter, Params};
 
-use crate::CosError;
+use crate::{Bytes, CosError};
 
 /// An indirect reference: object number and generation.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
@@ -160,7 +158,7 @@ impl FromIterator<(Name, Object)> for Dict {
 #[derive(Clone, Debug, PartialEq)]
 pub struct Stream {
     pub dict: Dict,
-    pub raw: Arc<Vec<u8>>,
+    pub raw: Bytes,
 }
 
 /// Upper bound for a single decoded stream (decompression-bomb defence).
@@ -169,14 +167,14 @@ pub const MAX_DECODED: usize = 1 << 30;
 impl Stream {
     /// A new stream from already-encoded bytes (`/Length` is set at write time).
     pub fn from_raw(dict: Dict, raw: Vec<u8>) -> Self {
-        Self { dict, raw: Arc::new(raw) }
+        Self { dict, raw: raw.into() }
     }
 
     /// A new stream holding `data` compressed with Flate.
     pub fn flate(mut dict: Dict, data: &[u8]) -> Self {
         dict.set(b"Filter".to_vec(), Object::Name(b"FlateDecode".to_vec()));
         dict.remove(b"DecodeParms");
-        Self { dict, raw: Arc::new(pdfcraft_filters::encode_flate(data)) }
+        Self { dict, raw: pdfcraft_filters::encode_flate(data).into() }
     }
 
     /// The filter chain declared in the dictionary.
@@ -244,7 +242,7 @@ impl Stream {
         if self.raw.len() > max {
             return Err(CosError::Filter(pdfcraft_filters::FilterError::LimitExceeded(max).to_string()));
         }
-        Ok(self.raw.as_ref().clone())
+        Ok(self.raw.to_vec())
     }
 }
 
diff --git a/crates/cos/src/parser.rs b/crates/cos/src/parser.rs
index 8bb71398..dcb1c58a 100644
--- a/crates/cos/src/parser.rs
+++ b/crates/cos/src/parser.rs
@@ -4,8 +4,10 @@
 //! never panics on malformed input (every index is bounds-checked). Depth is limited to defend
 //! against pathological nesting.
 
-use crate::CosError;
+use std::sync::Arc;
+
 use crate::object::{Dict, ObjRef, Object, PdfString, Stream};
+use crate::{Bytes, CosError};
 
 const MAX_DEPTH: usize = 128;
 
@@ -356,6 +358,25 @@ fn hexval(b: u8) -> Option<u8> {
 /// Parse an indirect object at `offset`: `N G obj <object> [stream…endstream] endobj`.
 /// `resolve_length` resolves an indirect `/Length`. Returns the object and its (num, gen).
 pub fn parse_indirect(data: &[u8], offset: usize, resolve_length: &dyn Fn(ObjRef) -> Option<i64>) -> Result<(ObjRef, Object), CosError> {
+    parse_indirect_in(data, None, offset, resolve_length)
+}
+
+/// [`parse_indirect`] for a document's own bytes: stream data points into `data` instead of
+/// being copied out of it.
+pub(crate) fn parse_indirect_shared(
+    data: &Arc<Vec<u8>>,
+    offset: usize,
+    resolve_length: &dyn Fn(ObjRef) -> Option<i64>,
+) -> Result<(ObjRef, Object), CosError> {
+    parse_indirect_in(data, Some(data), offset, resolve_length)
+}
+
+fn parse_indirect_in(
+    data: &[u8],
+    shared: Option<&Arc<Vec<u8>>>,
+    offset: usize,
+    resolve_length: &dyn Fn(ObjRef) -> Option<i64>,
+) -> Result<(ObjRef, Object), CosError> {
     let mut lx = Lexer::new(data, offset);
     lx.skip_ws();
     let num_tok = lx.token();
@@ -407,10 +428,15 @@ pub fn parse_indirect(data: &[u8], offset: usize, resolve_length: &dyn Fn(ObjRef
             // Wrong or missing /Length: search for "endstream" (§7.3.8.1 recovery).
             _ => find_endstream(data, start).ok_or_else(|| CosError::Syntax { offset: start, detail: "stream without endstream".into() })? - start,
         };
-        let raw = data[start..start + len].to_vec();
+        let range = start..start + len;
+        let raw = match shared {
+            Some(buf) => Bytes::view(buf, range),
+            None => data.get(range).map(|r| Bytes::from(r.to_vec())),
+        }
+        .ok_or_else(|| CosError::Syntax { offset: start, detail: "stream data past the end of the file".into() })?;
         let mut dict = dict.clone();
         dict.set(b"Length".to_vec(), Object::Int(raw.len() as i64));
-        return Ok((id, Object::Stream(Stream::from_raw(dict, raw))));
+        return Ok((id, Object::Stream(Stream { dict, raw })));
     }
     Ok((id, obj))
 }
@@ -506,7 +532,7 @@ mod tests {
         let (id, o) = parse_indirect(data, 0, &|_| None).unwrap();
         assert_eq!(id, ObjRef::new(7, 0));
         let Object::Stream(s) = o else { panic!("stream expected") };
-        assert_eq!(s.raw.as_slice(), b"HELLO");
+        assert_eq!(&s.raw[..], b"HELLO");
         assert_eq!(s.dict.int(b"Length"), Some(5));
     }
 
@@ -515,7 +541,7 @@ mod tests {
         let data = b"7 0 obj\n<< /Length 8 0 R >>\nstream\r\nAB\r\nendstream\nendobj\n";
         let (_, o) = parse_indirect(data, 0, &|r| (r.num == 8).then_some(2)).unwrap();
         let Object::Stream(s) = o else { panic!() };
-        assert_eq!(s.raw.as_slice(), b"AB");
+        assert_eq!(&s.raw[..], b"AB");
     }
 
     #[test]
diff --git a/crates/cos/src/security.rs b/crates/cos/src/security.rs
index 709176b3..252b2b4a 100644
--- a/crates/cos/src/security.rs
+++ b/crates/cos/src/security.rs
@@ -108,7 +108,7 @@ fn walk(o: &Object, strings: &dyn Fn(&PdfString) -> PdfString, h: &SecurityHandl
                 _ => StreamKind::Normal,
             };
             let raw = if decrypt { h.decrypt_stream(num, generation, &s.raw, kind) } else { h.encrypt_stream(num, generation, &s.raw, kind) };
-            Object::Stream(Stream { dict, raw: std::sync::Arc::new(raw) })
+            Object::Stream(Stream { dict, raw: raw.into() })
         }
         other => other.clone(),
     }
diff --git a/crates/cos/tests/shared_streams.rs b/crates/cos/tests/shared_streams.rs
new file mode 100644
index 00000000..477da65b
--- /dev/null
+++ b/crates/cos/tests/shared_streams.rs
@@ -0,0 +1,78 @@
+//! Stream data read from a file points into the file's bytes instead of being copied: the
+//! document's object cache holds parsed dictionaries, not a second copy of every stream.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::{Document, ObjRef, Object, SaveOptions, write_full, write_incremental};
+
+const CONTENT: &[u8] = b"0 0 1 rg 10 10 30 20 re f";
+
+fn fixture() -> Vec<u8> {
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 100 50] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>".to_string(),
+        format!("<< /Length {} >>\nstream\n{}\nendstream", CONTENT.len(), String::from_utf8_lossy(CONTENT)),
+    ];
+    let mut out = b"%PDF-1.4\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+const CONTENTS: ObjRef = ObjRef { num: 4, generation: 0 };
+
+fn stream_bytes(doc: &Document, r: ObjRef) -> (Vec<u8>, *const u8) {
+    match &*doc.get(r) {
+        Object::Stream(s) => (s.raw.to_vec(), s.raw.as_ptr()),
+        other => panic!("{other:?}"),
+    }
+}
+
+#[test]
+fn cached_streams_are_the_files_own_bytes() {
+    let file = Arc::new(fixture());
+    let doc = Document::open(file.clone()).unwrap();
+    let (data, at) = stream_bytes(&doc, CONTENTS);
+    assert_eq!(data, CONTENT);
+    assert!(file.as_ptr_range().contains(&at), "not a copy");
+    // A full save reads and caches every object; the cache still holds no copy of stream data.
+    let full = write_full(&doc, &SaveOptions::default()).unwrap();
+    assert!(file.as_ptr_range().contains(&stream_bytes(&doc, CONTENTS).1));
+    // Saves are unchanged: the stream is written as it was read.
+    let back = Document::open(Arc::new(full)).unwrap();
+    assert_eq!(stream_bytes(&back, ObjRef::new(4, 0)).0, CONTENT);
+}
+
+#[test]
+fn edits_within_a_document_keep_pointing_into_its_file() {
+    let file = Arc::new(fixture());
+    let mut doc = Document::open(file.clone()).unwrap();
+    doc.update_dict(CONTENTS, |d| d.set(b"Marked".to_vec(), Object::Bool(true))).unwrap();
+    assert!(file.as_ptr_range().contains(&stream_bytes(&doc, CONTENTS).1));
+    let updated = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let back = Document::open(Arc::new(updated)).unwrap();
+    assert_eq!(stream_bytes(&back, CONTENTS).0, CONTENT);
+}
+
+#[test]
+fn streams_moved_to_another_document_get_their_own_bytes() {
+    let file = Arc::new(fixture());
+    let source = Document::open(file.clone()).unwrap();
+    let moved = (*source.get(CONTENTS)).clone();
+    let mut target = Document::new_empty();
+    let r = target.add(moved);
+    drop(source);
+    // The target keeps just the stream's bytes, not the whole source file.
+    assert_eq!(Arc::strong_count(&file), 1);
+    assert_eq!(stream_bytes(&target, r).0, CONTENT);
+}
diff --git a/crates/cos/tests/writer.rs b/crates/cos/tests/writer.rs
index 6ba65375..4be398bf 100644
--- a/crates/cos/tests/writer.rs
+++ b/crates/cos/tests/writer.rs
@@ -98,7 +98,7 @@ fn incremental_saves_are_allocated_at_their_exact_size() {
     for original in [table, stream, no_newline] {
         let mut doc = Document::open(original.clone()).unwrap();
         let data: Vec<u8> = (0..100_000u32).map(|i| (i % 251) as u8).collect();
-        let added = doc.add(Object::Stream(Stream { dict: Dict::new(), raw: Arc::new(data.clone()) }));
+        let added = doc.add(Object::Stream(Stream { dict: Dict::new(), raw: data.clone().into() }));
         let updated = write_incremental(&doc, &SaveOptions::default()).unwrap();
         assert_eq!(updated.capacity(), updated.len());
         assert!(updated.starts_with(&original), "an incremental save only appends");
@@ -118,7 +118,7 @@ fn incremental_saves_are_allocated_at_their_exact_size() {
 fn full_saves_are_allocated_at_their_exact_size() {
     let mut doc = Document::open(Arc::new(fixture())).unwrap();
     let data: Vec<u8> = (0..100_000u32).map(|i| (i % 251) as u8).collect();
-    let added = doc.add(Object::Stream(Stream { dict: Dict::new(), raw: Arc::new(data.clone()) }));
+    let added = doc.add(Object::Stream(Stream { dict: Dict::new(), raw: Arc::new(data.clone()).into() }));
     let root = doc.root().unwrap();
     doc.update_dict(root, |d| d.set(b"Extra".to_vec(), Object::Ref(added))).unwrap();
     for object_streams in [true, false] {
diff --git a/crates/organize/src/dedupe.rs b/crates/organize/src/dedupe.rs
index ba1f39eb..020c0df2 100644
--- a/crates/organize/src/dedupe.rs
+++ b/crates/organize/src/dedupe.rs
@@ -112,7 +112,7 @@ fn hash_obj(o: &Object, map: &HashMap<ObjRef, ObjRef>, h: &mut impl Hasher) {
         Object::Stream(s) => {
             8u8.hash(h);
             hash_obj(&Object::Dict(s.dict.clone()), map, h);
-            s.raw.as_slice().hash(h);
+            s.raw[..].hash(h);
         }
         Object::Ref(r) => {
             let c = canon(map, *r);
@@ -125,9 +125,7 @@ fn eq_obj(a: &Object, b: &Object, map: &HashMap<ObjRef, ObjRef>) -> bool {
     match (a, b) {
         (Object::Array(x), Object::Array(y)) => x.len() == y.len() && x.iter().zip(y).all(|(p, q)| eq_obj(p, q, map)),
         (Object::Dict(x), Object::Dict(y)) => x.len() == y.len() && x.iter().all(|(k, v)| y.get(k).is_some_and(|w| eq_obj(v, w, map))),
-        (Object::Stream(x), Object::Stream(y)) => {
-            (std::sync::Arc::ptr_eq(&x.raw, &y.raw) || x.raw == y.raw) && eq_obj(&Object::Dict(x.dict.clone()), &Object::Dict(y.dict.clone()), map)
-        }
+        (Object::Stream(x), Object::Stream(y)) => x.raw == y.raw && eq_obj(&Object::Dict(x.dict.clone()), &Object::Dict(y.dict.clone()), map),
         (Object::Ref(x), Object::Ref(y)) => canon(map, *x) == canon(map, *y),
         (Object::Real(x), Object::Real(y)) => x.to_bits() == y.to_bits(),
         (Object::String(x), Object::String(y)) => x.bytes == y.bytes,
@@ -241,10 +239,9 @@ pub fn dedupe_resources(doc: &mut Document, candidates: &[ObjRef], index_existin
 mod tests {
     use super::*;
     use pdfcraft_cos::{Dict, Stream};
-    use std::sync::Arc;
 
     fn stream(data: &[u8]) -> Object {
-        Object::Stream(Stream { dict: Dict::new(), raw: Arc::new(data.to_vec()) })
+        Object::Stream(Stream { dict: Dict::new(), raw: data.to_vec().into() })
     }
 
     fn font(doc: &mut Document, file: ObjRef, name: &str) -> ObjRef {
diff --git a/crates/organize/src/pdfx.rs b/crates/organize/src/pdfx.rs
index eb240d1a..a24b5a3a 100644
--- a/crates/organize/src/pdfx.rs
+++ b/crates/organize/src/pdfx.rs
@@ -49,7 +49,7 @@ impl PrintStandard {
                 let id = d.and_then(|d| d.get(b"OutputConditionIdentifier")).and_then(|v| doc.resolve(v).as_string().map(|s| s.bytes.clone()));
                 let profile = d.and_then(|d| d.get(b"DestOutputProfile")).map(|p| doc.resolve(p)).and_then(|p| match &*p {
                     // Undecodable: compare the bytes as stored.
-                    Object::Stream(s) => Some(s.decoded_within(MAX_DECODED).unwrap_or_else(|_| s.raw.as_ref().clone())),
+                    Object::Stream(s) => Some(s.decoded_within(MAX_DECODED).unwrap_or_else(|_| s.raw.to_vec())),
                     _ => None,
                 });
                 (kind, id.unwrap_or_default(), profile.unwrap_or_default())

From 63363ec4385adacecb4d2346b83c8bfe5e179173 Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Sat, 10 Oct 2026 01:28:46 +0900
Subject: [PATCH 089/149] M3: rasters reach egui without a copy on the UI
 thread (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M3: rasters reach egui without a copy on the UI thread

Every page, tile and thumbnail raster was copied pixel by pixel on the UI
thread (`ColorImage::from_rgba_premultiplied`), because egui's `Color32` is
4-byte aligned and a `Vec<u8>` isn't. That is 0.5 ms per 1024² tile, 5.4 ms
for a 33 MB page and 36 ms for a 197 MB page, against a 16.7 ms frame.

hayro, vendored patch 7: `render_size` and `render_into` render into a buffer
the caller allocates. `render` is `render_into` on a new pixmap, so its output
is unchanged. pdfcraft-render renders straight into `Pixels`, the same
premultiplied RGBA bytes kept in one 4-byte word per pixel. `Pixels`
dereferences to `[u8]`, so every reader of `RenderedPage::rgba` compiles
unchanged. The canvas reinterprets the words as `Color32`s and hands them to
egui as they are.

Pixels are identical: all 33 renders of #260's test file hash the same. The
UI-thread copy is gone, and rendering a 6182×8000 page takes 67 ms instead of
71–76 ms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: render_into leaves a buffer of the wrong length untouched instead of reaching vello's assert

* M3: regression test for render_into with a wrong-length buffer

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                   |  1 +
 crates/render/Cargo.toml     |  4 +-
 crates/render/src/lib.rs     |  2 +
 crates/render/src/pixels.rs  | 47 ++++++++++++++++++++++++
 crates/render/src/raster.rs  | 71 +++++++++++++++++++++++-------------
 crates/ui-egui/Cargo.toml    |  4 +-
 crates/ui-egui/src/canvas.rs | 34 ++++++++++++++++-
 crates/ui-egui/src/lib.rs    |  2 +-
 vendor/README.md             |  2 +-
 vendor/hayro/src/lib.rs      | 64 ++++++++++++++++++++++++++------
 10 files changed, 187 insertions(+), 44 deletions(-)
 create mode 100644 crates/render/src/pixels.rs

diff --git a/Cargo.lock b/Cargo.lock
index 848d311a..09db2e2a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3791,6 +3791,7 @@ version = "0.4.0"
 dependencies = [
  "arboard",
  "base64 0.22.1",
+ "bytemuck",
  "eframe",
  "egui",
  "egui_extras",
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index 0a42520e..0c63377a 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -16,8 +16,8 @@ lopdf = { workspace = true }
 kurbo = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
-# Moves rendered pixels out of the renderer's pixmap without copying; already in the tree through hayro.
-bytemuck = { version = "1", features = ["extern_crate_alloc"] }
+# Reads rendered pixel words as bytes; already in the tree through hayro.
+bytemuck = { version = "1" }
 
 # lopdf (bootstrap) draws random bytes for encryption; on the web they come from the browser.
 [target.'cfg(target_arch = "wasm32")'.dependencies]
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index 580f0f86..12e3a6d6 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -9,6 +9,7 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 mod inspect;
+mod pixels;
 mod raster;
 pub mod text;
 
@@ -16,6 +17,7 @@ pub use inspect::{
     Annotation, Attachment, AttachmentSource, DestView, DocInfo, Field, FieldKind, FontInfo, Layer, LayerOp, Link, LinkTarget, OutlineItem, PageInfo,
     Xfa, attachment_data, inspect, pretty_date,
 };
+pub use pixels::Pixels;
 pub use raster::{
     MAX_PIXELS, MAX_SIDE, PageRenderer, RenderConfig, RenderPool, RenderRequest, RenderedPage, RequestKind, Tile, device_pixels, effective_scale,
 };
diff --git a/crates/render/src/pixels.rs b/crates/render/src/pixels.rs
new file mode 100644
index 00000000..0864803a
--- /dev/null
+++ b/crates/render/src/pixels.rs
@@ -0,0 +1,47 @@
+//! Raster pixels in a buffer a GUI can take over as texture data.
+
+use std::ops::Deref;
+
+/// A raster's premultiplied RGBA8 bytes, row-major, kept in 4-byte words: one word per pixel,
+/// with the bytes in R, G, B, A order in memory. The words make the buffer aligned to whole
+/// pixels, so it can become a GUI's pixel array (egui's `Color32`) without copying. Read it as
+/// bytes through `Deref`.
+#[derive(Clone, Default, PartialEq, Eq)]
+pub struct Pixels(Vec<u32>);
+
+impl Pixels {
+    /// Zeroed pixels for a `width` × `height` raster; `None` when the size overflows.
+    pub(crate) fn zeroed(width: usize, height: usize) -> Option<Self> {
+        Some(Self(vec![0; width.checked_mul(height)?]))
+    }
+
+    /// The bytes, for the rasterizer to write into.
+    pub(crate) fn bytes_mut(&mut self) -> &mut [u8] {
+        bytemuck::cast_slice_mut(&mut self.0)
+    }
+
+    /// The buffer itself: one word per pixel, its bytes in R, G, B, A memory order.
+    pub fn into_words(self) -> Vec<u32> {
+        self.0
+    }
+}
+
+impl Deref for Pixels {
+    type Target = [u8];
+
+    fn deref(&self) -> &[u8] {
+        bytemuck::cast_slice(&self.0)
+    }
+}
+
+impl AsRef<[u8]> for Pixels {
+    fn as_ref(&self) -> &[u8] {
+        self
+    }
+}
+
+impl std::fmt::Debug for Pixels {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "Pixels({} bytes)", self.len())
+    }
+}
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 8d80b1bd..652ae6ea 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -17,9 +17,10 @@ use hayro::hayro_interpret::InterpreterSettings;
 use hayro::hayro_interpret::font::{FontData, FontQuery};
 use hayro::hayro_interpret::hayro_cmap::CidFamily;
 use hayro::hayro_syntax::Pdf;
-use hayro::vello_cpu::Pixmap;
 use hayro::vello_cpu::color::palette::css::WHITE;
-use hayro::{RenderCache, RenderSettings, render};
+use hayro::{RenderCache, RenderSettings, render_into, render_size};
+
+use crate::Pixels;
 
 /// Monotonic-ish timer that is safe on wasm32 (where `std::time::Instant` panics).
 #[derive(Clone, Copy)]
@@ -152,7 +153,7 @@ pub struct RenderedPage {
     pub width: u32,
     pub height: u32,
     /// Premultiplied RGBA8, row-major. Empty when `error` is set.
-    pub rgba: Vec<u8>,
+    pub rgba: Pixels,
     /// Why the page could not be rendered (renderer panic, empty page box, …).
     pub error: Option<String>,
     /// For `RequestKind::Text`.
@@ -182,12 +183,12 @@ pub fn device_pixels(pt: f32, scale: f32) -> u32 {
 
 /// Render one page with a caller-owned parser and cache. Panics inside the renderer are caught
 /// and reported as `Err((message, panicked))`.
-type Output = (u32, u32, Vec<u8>, Option<Arc<crate::text::PageText>>);
+type Output = (u32, u32, Pixels, Option<Arc<crate::text::PageText>>);
 
 fn render_page<'a>(pdf: &'a Pdf, cache: &RenderCache<'a>, settings: &InterpreterSettings, req: RenderRequest) -> Result<Output, (String, bool)> {
     if req.kind == RequestKind::Text {
         return match catch_unwind(AssertUnwindSafe(|| crate::text::extract_page(pdf, req.page, settings))) {
-            Ok(Some(t)) => Ok((0, 0, Vec::new(), Some(Arc::new(t)))),
+            Ok(Some(t)) => Ok((0, 0, Pixels::default(), Some(Arc::new(t)))),
             Ok(None) => Err((format!("page {} does not exist", req.page + 1), false)),
             Err(panic) => Err((format!("text extraction crashed on page {}: {}", req.page + 1, panic_message(&panic)), true)),
         };
@@ -222,8 +223,11 @@ fn render_page<'a>(pdf: &'a Pdf, cache: &RenderCache<'a>, settings: &Interpreter
                 RenderSettings { x_scale: scale, y_scale: scale, width: Some(side(w)), height: Some(side(h)), bg_color: WHITE, ..Default::default() }
             }
         };
-        let pixmap = render(page, cache, settings, &rs);
-        Ok((pixmap.width() as u32, pixmap.height() as u32, into_bytes(pixmap), None))
+        // Rendered straight into a buffer of whole pixels, which the GUI takes over as is.
+        let (w, h) = render_size(page, &rs);
+        let mut pixels = Pixels::zeroed(w.into(), h.into()).ok_or_else(|| format!("page {} is too large to render", req.page + 1))?;
+        render_into(page, cache, settings, &rs, pixels.bytes_mut());
+        Ok((w.into(), h.into(), pixels, None))
     }));
     match result {
         Ok(Ok(v)) => Ok(v),
@@ -232,18 +236,11 @@ fn render_page<'a>(pdf: &'a Pdf, cache: &RenderCache<'a>, settings: &Interpreter
     }
 }
 
-/// The pixmap's premultiplied RGBA bytes, moved out rather than copied (a page raster can be
-/// hundreds of megabytes). Four one-byte channels always recast to bytes in place; the copy is
-/// only there because the cast's signature allows failure.
-fn into_bytes(pixmap: Pixmap) -> Vec<u8> {
-    bytemuck::allocation::try_cast_vec(pixmap.take()).unwrap_or_else(|(_, pixels)| pixels.iter().flat_map(|p| [p.r, p.g, p.b, p.a]).collect())
-}
-
 fn finish(req: RenderRequest, start: Stopwatch, r: Result<Output, (String, bool)>) -> RenderedPage {
     let millis = start.millis();
     match r {
         Ok((width, height, rgba, text)) => RenderedPage { request: req, width, height, rgba, error: None, text, millis },
-        Err((e, _)) => RenderedPage { request: req, width: 0, height: 0, rgba: Vec::new(), error: Some(e), text: None, millis },
+        Err((e, _)) => RenderedPage { request: req, width: 0, height: 0, rgba: Pixels::default(), error: Some(e), text: None, millis },
     }
 }
 
@@ -503,7 +500,7 @@ impl RenderPool {
                     request: req,
                     width: 0,
                     height: 0,
-                    rgba: Vec::new(),
+                    rgba: Pixels::default(),
                     error: Some(error),
                     text: None,
                     millis: 0,
@@ -556,7 +553,7 @@ fn worker(
             };
             if lock(&shared.stuck).contains(&(req.page, req.kind)) {
                 let error = format!("page {} was skipped earlier because it took too long to render", req.page + 1);
-                let page = RenderedPage { request: req, width: 0, height: 0, rgba: Vec::new(), error: Some(error), text: None, millis: 0 };
+                let page = RenderedPage { request: req, width: 0, height: 0, rgba: Pixels::default(), error: Some(error), text: None, millis: 0 };
                 if out.send(page).is_err() {
                     return;
                 }
@@ -760,15 +757,37 @@ trailer << /Root 1 0 R >>
     }
 
     #[test]
-    fn rendered_pixels_are_moved_out_of_the_pixmap() {
-        let mut pixmap = Pixmap::new(3, 2);
-        for (i, b) in pixmap.data_as_u8_slice_mut().iter_mut().enumerate() {
-            *b = i as u8;
+    fn pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over() {
+        let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
+        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0 });
+        assert!(out.error.is_none(), "{:?}", out.error);
+        // The same bytes as hayro's own render to a pixmap, with the same settings.
+        let pdf = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
+        let pages = pdf.pages();
+        let page = pages.first().expect("a page");
+        let rs = RenderSettings { x_scale: 2.0, y_scale: 2.0, width: Some(200), height: Some(100), bg_color: WHITE, ..Default::default() };
+        let plain = hayro::render(page, &RenderCache::new(), &RenderConfig::default().settings(), &rs);
+        assert_eq!((out.width, out.height), (200, 100));
+        assert_eq!(&*out.rgba, plain.data_as_u8_slice());
+        // Whole pixels, aligned, handed over without a copy.
+        let at = out.rgba.as_ptr();
+        assert_eq!(at as usize % 4, 0);
+        let words = out.rgba.into_words();
+        assert_eq!(words.as_ptr().cast::<u8>(), at);
+    }
+
+    #[test]
+    fn render_into_a_buffer_of_the_wrong_length_leaves_it_untouched() {
+        let pdf = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
+        let pages = pdf.pages();
+        let page = pages.first().expect("a page");
+        let rs = RenderSettings { width: Some(10), height: Some(10), bg_color: WHITE, ..Default::default() };
+        let settings = RenderConfig::default().settings();
+        for len in [0, 399, 401, 4000] {
+            let mut buf = vec![7u8; len];
+            render_into(page, &RenderCache::new(), &settings, &rs, &mut buf);
+            assert!(buf.iter().all(|&b| b == 7), "a {len}-byte buffer was written");
         }
-        let (at, expected) = (pixmap.data_as_u8_slice().as_ptr(), pixmap.data_as_u8_slice().to_vec());
-        let bytes = into_bytes(pixmap);
-        assert_eq!(bytes, expected);
-        assert_eq!(bytes.as_ptr(), at, "the pixmap's own buffer, not a copy");
     }
 
     #[test]
@@ -1182,7 +1201,7 @@ trailer << /Root 1 0 R >>
         let page = pages.first().expect("a page");
         let rs = RenderSettings { bg_color: WHITE, ..Default::default() };
         let blue = |s: &InterpreterSettings| {
-            let p = render(page, &RenderCache::new(), s, &rs).sample(20, 30);
+            let p = hayro::render(page, &RenderCache::new(), s, &rs).sample(20, 30);
             [p.r, p.g, p.b, p.a] == [0, 0, 255, 255]
         };
         let glyphs = |s: &InterpreterSettings| crate::text::extract_page(&text, 0, s).map_or(0, |t| t.glyphs.len());
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index ed1e9a32..f7f0406a 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -14,12 +14,14 @@ pdfcraft-engine = { workspace = true }
 pdfcraft-render = { workspace = true }
 pdfcraft-model = { workspace = true }
 pdfcraft-platform = { workspace = true }
-egui = { workspace = true }
+egui = { workspace = true, features = ["bytemuck"] }
 egui_extras = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "persistence", "links"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+# Hands rendered rasters to egui as its pixels, without copying; already in the tree through egui and wgpu.
+bytemuck = { version = "1", features = ["extern_crate_alloc"] }
 
 rfd = { workspace = true }
 png = "0.18"
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index ac94f775..a349c843 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -946,7 +946,7 @@ impl DocView {
                 self.errors.insert(r.request.page, e);
                 continue;
             }
-            let img = egui::ColorImage::from_rgba_premultiplied([r.width as usize, r.height as usize], &r.rgba);
+            let img = texture_image([r.width as usize, r.height as usize], r.rgba);
             let page = r.request.page;
             if let Some(t) = r.request.tile {
                 let tex = ctx.load_texture(format!("tile-{:?}-{page}-{}-{}", self.id, t.x, t.y), img, TextureOptions::LINEAR);
@@ -3031,10 +3031,42 @@ fn organize_grid(
     }
 }
 
+/// A rendered raster as texture data. Its words are premultiplied RGBA bytes, exactly
+/// `Color32`s, so the renderer's buffer becomes the image without a copy on the UI thread.
+fn texture_image(size: [usize; 2], pixels: pdfcraft_render::Pixels) -> egui::ColorImage {
+    match bytemuck::allocation::try_cast_vec::<u32, Color32>(pixels.into_words()) {
+        Ok(px) if px.len() == size[0].saturating_mul(size[1]) => egui::ColorImage::new(size, px),
+        Ok(px) => egui::ColorImage::from_rgba_premultiplied(size, bytemuck::cast_slice(&px)),
+        Err((_, words)) => egui::ColorImage::from_rgba_premultiplied(size, bytemuck::cast_slice(&words)),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn rendered_rasters_become_texture_images_without_a_copy() {
+        let pdf = b"%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
+4 0 obj << /Length 35 >> stream
+0 0 1 rg 10 10 30 20 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+        let mut r = pdfcraft_render::PageRenderer::new(Arc::new(pdf.to_vec()), Default::default());
+        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.5, tag: 0 });
+        assert!(out.error.is_none(), "{:?}", out.error);
+        let size = [out.width as usize, out.height as usize];
+        let copied = egui::ColorImage::from_rgba_premultiplied(size, &out.rgba);
+        let at = out.rgba.as_ptr();
+        let img = texture_image(size, out.rgba);
+        assert_eq!(img, copied);
+        assert_eq!(img.pixels.as_ptr().cast::<u8>(), at, "the renderer's own buffer");
+    }
+
     fn view(pages: usize, layout: PageLayout) -> DocView {
         let info = pdfcraft_render::DocInfo {
             pages: (0..pages)
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index c70cdc12..46edd4bf 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -481,7 +481,7 @@ pub struct PdfCraftApp {
     grid_drop: Option<GridDrop>,
     /// The last snapshot (width, height, RGBA); `system_clipboard` also puts it on the
     /// system clipboard (tests turn that off).
-    pub last_snapshot: Option<(u32, u32, Vec<u8>)>,
+    pub last_snapshot: Option<(u32, u32, pdfcraft_render::Pixels)>,
     pub system_clipboard: bool,
     /// Attach file: the file to attach instead of asking (tests, automation).
     pub attach_override: Option<(String, Vec<u8>)>,
diff --git a/vendor/README.md b/vendor/README.md
index 9674a825..408621f9 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -9,7 +9,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 |---|---|---|---|---|
 | hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on` |
 
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid` |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream` |
diff --git a/vendor/hayro/src/lib.rs b/vendor/hayro/src/lib.rs
index 79c2f683..7acc4851 100644
--- a/vendor/hayro/src/lib.rs
+++ b/vendor/hayro/src/lib.rs
@@ -127,19 +127,56 @@ pub fn render<'a>(
     interpreter_settings: &InterpreterSettings,
     render_settings: &RenderSettings,
 ) -> Pixmap {
-    let (x_scale, y_scale) = (render_settings.x_scale, render_settings.y_scale);
-    let (width, height) = page.render_dimensions();
-    let (scaled_width, scaled_height) = ((width * x_scale) as f64, (height * y_scale) as f64);
-    let initial_transform = Affine::translate((-render_settings.x_offset as f64, -render_settings.y_offset as f64))
-        * Affine::scale_non_uniform(x_scale as f64, y_scale as f64)
-        * page.initial_transform(true).to_kurbo();
+    let (pix_width, pix_height) = render_size(page, render_settings);
+    let mut pixmap = Pixmap::new(pix_width, pix_height);
+    render_into(
+        page,
+        cache,
+        interpreter_settings,
+        render_settings,
+        pixmap.data_as_u8_slice_mut(),
+    );
+    pixmap
+}
 
-    let (pix_width, pix_height) = (
+/// PdfCraft patch: the size in pixels of what [`render`] produces with these settings.
+pub fn render_size(page: &Page<'_>, render_settings: &RenderSettings) -> (u16, u16) {
+    let (width, height) = page.render_dimensions();
+    let (scaled_width, scaled_height) = (
+        (width * render_settings.x_scale) as f64,
+        (height * render_settings.y_scale) as f64,
+    );
+    (
         render_settings.width.unwrap_or(scaled_width.floor() as u16),
         render_settings
             .height
             .unwrap_or(scaled_height.floor() as u16),
-    );
+    )
+}
+
+/// PdfCraft patch: [`render`] into `buffer`, premultiplied RGBA8 rows of [`render_size`]
+/// pixels, so the caller chooses the allocation (one aligned to whole pixels can then become
+/// texture data without a copy). `buffer.len()` must be width × height × 4; any other length
+/// leaves `buffer` untouched (vello_cpu asserts on the length, and a panic must not be reachable).
+pub fn render_into<'a>(
+    page: &'a Page<'a>,
+    cache: &RenderCache<'a>,
+    interpreter_settings: &InterpreterSettings,
+    render_settings: &RenderSettings,
+    buffer: &mut [u8],
+) {
+    let (x_scale, y_scale) = (render_settings.x_scale, render_settings.y_scale);
+    let initial_transform = Affine::translate((-render_settings.x_offset as f64, -render_settings.y_offset as f64))
+        * Affine::scale_non_uniform(x_scale as f64, y_scale as f64)
+        * page.initial_transform(true).to_kurbo();
+
+    let (pix_width, pix_height) = render_size(page, render_settings);
+    let expected = (pix_width as usize)
+        .checked_mul(pix_height as usize)
+        .and_then(|n| n.checked_mul(4));
+    if expected != Some(buffer.len()) {
+        return;
+    }
     let mut state = Context::new(
         initial_transform,
         Rect::new(0.0, 0.0, pix_width as f64, pix_height as f64),
@@ -174,11 +211,14 @@ pub fn render<'a>(
 
     device.pop_clip_path();
 
-    let mut pixmap = Pixmap::new(pix_width, pix_height);
     let mut resources = vello_cpu::Resources::default();
-    device.ctx.render_to_pixmap(&mut resources, &mut pixmap);
-
-    pixmap
+    device.ctx.render_to_buffer(
+        &mut resources,
+        buffer,
+        pix_width,
+        pix_height,
+        vc_settings.render_mode,
+    );
 }
 
 // Just a convenience method for testing.

From f626db25cca2c89f8fa3f7e30d22bf59faea65ec Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Fri, 9 Oct 2026 18:39:57 +0200
Subject: [PATCH 090/149] M14: refine German labels and prevent translated UI
 text overlap (#515)

* M14: refine German labels and keep translated text within UI bounds

Co-authored-by: Codex <codex@openai.com>

* Tool names inside notices stay lowercase in English; German keeps its capitalised nouns

---------

Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                    |  2 +-
 ROADMAP.md                          |  2 +
 crates/ui-egui/src/commands.rs      |  5 ++-
 crates/ui-egui/src/comment_props.rs |  2 +-
 crates/ui-egui/src/comments.rs      |  2 +-
 crates/ui-egui/src/home.rs          | 57 ++++++++++++++++++++++++++++-
 crates/ui-egui/src/i18n/de.tsv      | 34 +++++++++--------
 crates/ui-egui/src/i18n/mod.rs      | 24 ++++++++++++
 crates/ui-egui/src/sign_ui.rs       |  2 +-
 crates/ui-egui/src/widgets.rs       | 41 +++++++++++++++++++--
 crates/ui-egui/tests/control.rs     | 31 ++++++++++++++++
 docs/localization.md                |  2 +
 parity/acrobat-features.toml        |  4 +-
 13 files changed, 180 insertions(+), 28 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 6e8f5cda..f5938abb 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f46a3815d45c4ffba9690dd8c30c1f799bca1620dc33f242e2d27e805f9747a6"
+sha256 = "ef0c8f5830ecb2950b6956eff50f963282bc607f4aedd98d89b9020a73db53b7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
diff --git a/ROADMAP.md b/ROADMAP.md
index a48c118c..d0f1c09d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -139,6 +139,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (M14, German interface follow-up):** Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.
+
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, M14, Hungarian):** Magyar (`hu`) is a complete interface catalog (2,036 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `hu` and `hu_HU`, and from Preferences. Informal "te"; commands are nouns (Mentés, Megnyitás). After a numeral the noun stays singular, so both plural forms match. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover Hungarian diacritics including ő and ű. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 4cf9d338..1b3637a2 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -466,7 +466,10 @@ impl PdfCraftApp {
                 if let Some(i) = active {
                     self.views[i].forms.focus = None;
                 }
-                self.notify_fmt("Click on the page to add a {tool}, or drag to set its size", &[("tool", &tl!(tool.label()).to_lowercase())]);
+                self.notify_fmt(
+                    "Click on the page to add a {tool}, or drag to set its size",
+                    &[("tool", &crate::i18n::in_sentence(tl!(tool.label())))],
+                );
             }
             "sign.fill.signature.remove" => self.signature = None,
             "sign.fill.initials.remove" => self.initials = None,
diff --git a/crates/ui-egui/src/comment_props.rs b/crates/ui-egui/src/comment_props.rs
index 96eb5ef3..01fa8488 100644
--- a/crates/ui-egui/src/comment_props.rs
+++ b/crates/ui-egui/src/comment_props.rs
@@ -85,7 +85,7 @@ impl PdfCraftApp {
             style.width = w;
         }
         self.comment_prefs.set_style(tool, style);
-        self.notify_fmt("New {tool} comments will look like this one", &[("tool", &tl!(tool.label()).to_lowercase())]);
+        self.notify_fmt("New {tool} comments will look like this one", &[("tool", &crate::i18n::in_sentence(tl!(tool.label())))]);
     }
 
     /// Open Comment Properties for the comment at `(page, index)` of the active document.
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index 3d08ac95..5621d630 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -1074,7 +1074,7 @@ pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
             ui.set_width(260.0);
             ui.horizontal(|ui| {
                 ui.label(egui::RichText::new(&prefs.author).font(theme::semibold(13.0)));
-                ui.label(egui::RichText::new(title).font(theme::regular(11.5)).color(t.text_faint));
+                ui.label(egui::RichText::new(tl!(title)).font(theme::regular(11.5)).color(t.text_faint));
             });
             ui.add_space(6.0);
             let hint = match c.kind {
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 048aacdd..2b689fef 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -60,13 +60,22 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                             ui.painter().rect(rect, CornerRadius::same(10), fill, Stroke::new(1.0, t.divider), egui::StrokeKind::Inside);
                             let color = egui::Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
                             icons::paint(ui, Rect::from_min_size(rect.min + vec2(14.0, 14.0), vec2(22.0, 22.0)), g.icon, 21.0, color);
-                            ui.painter().text(rect.min + vec2(44.0, 25.0), Align2::LEFT_CENTER, tl!(g.label), theme::semibold(13.5), t.text);
+                            let mut title_job = egui::text::LayoutJob::simple_singleline(tl!(g.label).to_owned(), theme::semibold(13.5), t.text);
+                            title_job.wrap =
+                                egui::text::TextWrapping { max_width: rect.width() - 58.0, max_rows: 1, break_anywhere: true, ..Default::default() };
+                            let title = ui.fonts_mut(|f| f.layout_job(title_job));
+                            let title_elided = title.elided;
+                            ui.painter().galley(rect.min + vec2(44.0, 25.0 - title.size().y * 0.5), title, t.text);
                             let blurb = g
                                 .sections
                                 .first()
                                 .map(|s| s.items.iter().take(3).map(|i| tl!(i.label)).collect::<Vec<_>>().join(" · "))
                                 .unwrap_or_default();
-                            let galley = ui.fonts_mut(|f| f.layout(blurb, theme::regular(11.5), t.text_muted, rect.width() - 28.0));
+                            // Fixed-height cards must leave room for their action in every language.
+                            let mut job = egui::text::LayoutJob::simple(blurb.clone(), theme::regular(11.5), t.text_muted, rect.width() - 28.0);
+                            job.wrap.max_rows = 2;
+                            let galley = ui.fonts_mut(|f| f.layout_job(job));
+                            let blurb_elided = galley.elided;
                             ui.painter().galley(rect.min + vec2(14.0, 46.0), galley, t.text_muted);
                             ui.painter().text(
                                 rect.left_bottom() + vec2(14.0, -14.0),
@@ -75,6 +84,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                 theme::medium(12.0),
                                 t.accent_text,
                             );
+                            let resp = if title_elided || blurb_elided { resp.on_hover_text(format!("{}\n{blurb}", tl!(g.label))) } else { resp };
                             if resp.clicked() {
                                 app.left = LeftPanel::Tool(g.id);
                                 app.left_open = true;
@@ -182,3 +192,46 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         });
     });
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn translated_card_description_leaves_room_for_the_action() {
+        let de = crate::i18n::Lang::from_code("de").unwrap();
+        crate::i18n::set_current(de);
+        let ctx = egui::Context::default();
+        ctx.set_fonts(theme::font_definitions());
+        let mut app = PdfCraftApp::new();
+        let blurb = catalog::group("form")
+            .unwrap()
+            .sections
+            .first()
+            .unwrap()
+            .items
+            .iter()
+            .take(3)
+            .map(|item| crate::i18n::tr(de, item.label))
+            .collect::<Vec<_>>()
+            .join(" · ");
+        let output = ctx
+            .run_ui(egui::RawInput { screen_rect: Some(Rect::from_min_size(egui::Pos2::ZERO, vec2(1440.0, 900.0))), ..Default::default() }, |ui| {
+                show(&mut app, ui)
+            });
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let text_shapes: Vec<_> =
+            output.shapes.iter().filter_map(|shape| if let egui::Shape::Text(text) = &shape.shape { Some(text) } else { None }).collect();
+        let description = text_shapes.iter().find(|text| text.galley.job.text == blurb).unwrap();
+        let action = text_shapes
+            .iter()
+            .find(|text| text.galley.job.text == crate::i18n::tr(de, "Use now") && (text.pos.x - description.pos.x).abs() < 0.1)
+            .unwrap();
+        assert!(description.galley.rows.len() <= 2);
+        assert!(
+            description.pos.y + description.galley.size().y + 4.0 <= action.pos.y,
+            "the translated description must leave a visible gap before its action"
+        );
+        output.drop_without_applying_deltas();
+    }
+}
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 52a6678a..c7503969 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -50,7 +50,7 @@
 	Comments panel	Kommentarbereich
 	Form fields panel	Formularfeldbereich
 	Clear form	Formular zurücksetzen
-	Find tools and commands…	Werkzeuge und Befehle suchen…
+	Find tools and commands…	Tools und Befehle suchen…
 	Zoom	Zoom
 	Actual size	Originalgröße
 	Zoom to page level	Ganze Seite
@@ -84,7 +84,7 @@
 	Print (⌘P)	Drucken (⌘P)
 	Save (M4)	Speichern (M4)
 	Document properties (⌘D)	Dokumenteigenschaften (⌘D)
-	Find tools and commands	Werkzeuge und Befehle suchen
+	Find tools and commands	Tools und Befehle suchen
 	Fit to height	Seitenhöhe
 	Zoom in	Vergrößern
 	Zoom out	Verkleinern
@@ -94,7 +94,7 @@
 	Previous view	Vorherige Ansicht
 	Next view	Nächste Ansicht
 	Page display	Seitenanzeige
-	Continuous scrolling	Fortlaufend blättern
+	Continuous scrolling	Fortlaufendes Scrollen
 	Two-page view	Doppelseitenansicht
 	Single page	Einzelseite
 	Show cover page in two-page view	Deckblatt in Doppelseitenansicht anzeigen
@@ -137,7 +137,7 @@
 	View more	Mehr anzeigen
 	Available	Verfügbar
 	Ready	Bereit
-	Search tools and commands…	Werkzeuge und Befehle suchen…
+	Search tools and commands…	Tools und Befehle suchen…
 	No matching tools	Keine passenden Werkzeuge
 	Tool	Werkzeug
 	Command	Befehl
@@ -155,7 +155,7 @@
 	Draw a polygon	Polygon zeichnen
 	Draw connected lines	Verbundene Linien zeichnen
 	Draw a cloud	Wolke zeichnen
-	Add a callout	Legende hinzufügen
+	Add a callout	Text mit Hinweislinie hinzufügen
 	Insert text	Text einfügen
 	Replace text	Text ersetzen
 	Attach a file	Datei anhängen
@@ -324,7 +324,7 @@
 	Set page boxes	Seitenrahmen festlegen
 	Page labels	Seitenbeschriftungen
 	Page transitions	Seitenübergänge
-	Add comments	Kommentare hinzufügen
+	Add comments	Kommentieren
 	Markup	Markierungen
 	Sticky note	Notiz
 	Underline	Unterstreichen
@@ -840,7 +840,7 @@
 	View signed version	Signierte Version anzeigen
 	Show certificate…	Zertifikat anzeigen…
 	Export certificate…	Zertifikat exportieren…
-	Certificate Viewer	Zertifikatanzeige
+	Certificate Viewer	Zertifikatsanzeige
 	This dialog shows the details of a certificate and its chain.	Dieser Dialog zeigt die Details eines Zertifikats und seiner Kette.
 	Trust	Vertrauen
 	Issued to	Ausgestellt für
@@ -884,6 +884,7 @@
 	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Ausgeblendete Informationen, Metadaten, Skripte und eingebettete Inhalte entfernen und die Dateien neu schreiben.
 	Type text	Text eingeben
 	Text to insert	Einzufügender Text
+	Inserted text	Eingefügter Text
 	Replacement text	Ersatztext
 	Edit text…	Text bearbeiten…
 	Add a sticky note here	Hier eine Notiz hinzufügen
@@ -924,7 +925,7 @@
 	Save & Close	Speichern und schließen
 	Accessibility Checker Options	Optionen der Barrierefreiheitsprüfung
 	Report Options	Berichtsoptionen
-	Create accessibility report	Bericht zur Barrierefreiheit erstellen
+	Create accessibility report	Barrierefreiheitsbericht erstellen
 	Page Range	Seitenbereich
 	All pages in document	Alle Seiten im Dokument
 	Checking Options ({on} of 32 in all categories)	Prüfoptionen ({on} von 32 in allen Kategorien)
@@ -940,7 +941,7 @@
 	{label} ({n} issues)	{label} ({n} Probleme)
 	Check again	Erneut prüfen
 	Report	Bericht
-	Show the accessibility report	Bericht zur Barrierefreiheit anzeigen
+	Show the accessibility report	Barrierefreiheitsbericht anzeigen
 	Collapse	Einklappen
 	Expand	Ausklappen
 	{rule} - {status}	{rule} – {status}
@@ -1002,8 +1003,8 @@
 	Animation that flashes can cause seizures. Check scripts and media for flicker.	Blinkende Animationen können Anfälle auslösen. Prüfe Skripte und Medien auf Flackern.
 	Scripts	Skripte
 	No inaccessible scripts	Keine nicht barrierefreien Skripte
-	Timed responses	Zeitgesteuerte Antworten
-	Page does not require timed responses	Seite erfordert keine zeitgesteuerten Antworten
+	Timed responses	Zeitbegrenzte Antworten
+	Page does not require timed responses	Die Seite erfordert keine zeitbegrenzten Antworten
 	People may need more time to respond. Check that nothing has a time limit.	Manche Menschen brauchen mehr Zeit zum Reagieren. Prüfe, dass nichts ein Zeitlimit hat.
 	Navigation links	Navigationslinks
 	Navigation links are not repetitive	Navigationslinks wiederholen sich nicht
@@ -1179,12 +1180,12 @@
 	{n} marks	{n} Markierungen
 	Dynamic	Dynamisch
 	Sign Here	Hier unterschreiben
-	Standard Business	Standard-Geschäftsstempel
+	Standard Business	Geschäftlich
 	Choose a stamp, then click on the page to place it.	Wähle einen Stempel und klicke dann auf die Seite, um ihn zu platzieren.
 	Note	Notiz
 	Polyline	Polylinie
 	Attachment	Anhang
-	Callout	Legende
+	Callout	Text mit Hinweislinie
 	Typewriter	Schreibmaschine
 	Checked	Abgehakt
 	Unchecked	Nicht abgehakt
@@ -1207,7 +1208,7 @@
 	Set status	Status festlegen
 	Copy text	Text kopieren
 	Properties…	Eigenschaften…
-	Make Current Properties Default	Aktuelle Eigenschaften als Standard festlegen
+	Make Current Properties Default	Als Standard festlegen
 	More options	Weitere Optionen
 	Sort by	Sortieren nach
 	Author	Verfasser
@@ -1326,7 +1327,7 @@
 	Choose a layout:	Layout wählen:
 	Comments only	Nur Kommentare
 	Sort comments by:	Kommentare sortieren nach:
-	Create PDF Comment Summary	PDF-Kommentarzusammenfassung erstellen
+	Create PDF Comment Summary	Kommentarübersicht erstellen
 	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Zur zuletzt gespeicherten Version von „{name}“ zurückkehren? Seitdem vorgenommene Änderungen lassen sich danach nicht wiederherstellen.
 	Number pages	Seiten nummerieren
 	Style	Stil
@@ -1812,7 +1813,7 @@
 	Add cloud	Wolke hinzufügen
 	Add polygon	Polygon hinzufügen
 	Add connected lines	Verbundene Linien hinzufügen
-	Add callout	Legende hinzufügen
+	Add callout	Text mit Hinweislinie hinzufügen
 	Add inserted text	Eingefügten Text hinzufügen
 	Add file attachment	Dateianhang hinzufügen
 	Set status Accepted	Status „Angenommen“ festlegen
@@ -2043,6 +2044,7 @@ comment menu	Edit	Bearbeiten
 	Undo {action}	{action} rückgängig machen
 	Redo {action}	{action} wiederholen
 signature pad	Type	Tippen
+certificate	Subject	Zertifikatsinhaber
 action wizard	Start	Starten
 	Reopen the files that were open when PdfCraft last closed	Beim Start die Dateien wieder öffnen, die beim letzten Beenden von PdfCraft geöffnet waren
 
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 4a8cde47..f6895a74 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -290,6 +290,12 @@ pub fn set_current(lang: Lang) {
 }
 
 /// The language the UI is drawn in.
+/// `label` as it reads inside a sentence ("add a text box"): lowercased, except in languages
+/// that capitalise nouns (German), where lowercasing would misspell it.
+pub fn in_sentence(label: &str) -> std::borrow::Cow<'_, str> {
+    if current().code() == "de" { std::borrow::Cow::Borrowed(label) } else { std::borrow::Cow::Owned(label.to_lowercase()) }
+}
+
 pub fn current() -> Lang {
     CURRENT.get()
 }
@@ -1216,6 +1222,24 @@ mod tests {
         assert!(missing.is_empty(), "untranslated German UI literals: {missing:#?}");
     }
 
+    #[test]
+    fn tool_names_inside_sentences_are_lowercased_except_in_german() {
+        set_current(Lang::EN);
+        assert_eq!(in_sentence("Text Box"), "text box");
+        set_current(Lang::from_code("de").expect("de registered"));
+        assert_eq!(in_sentence("Textfeld"), "Textfeld");
+        set_current(Lang::EN);
+    }
+
+    #[test]
+    fn german_certificate_subject_has_a_distinct_context() {
+        let de = Lang::from_code("de").expect("de registered");
+        assert_eq!(tr(de, "Subject"), "Thema");
+        assert_eq!(tr_ctx(de, "certificate", "Subject"), "Zertifikatsinhaber");
+        assert_eq!(tr_ctx(de, "certificate", "Issuer"), tr(de, "Issuer"));
+        assert_eq!(tr_ctx(Lang::EN, "certificate", "Subject"), "Subject");
+    }
+
     #[test]
     fn german_history_and_diagnostics_preserve_user_values() {
         let de = Lang::from_code("de").expect("de registered");
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/sign_ui.rs
index a7dc7fb4..bb453ff1 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/sign_ui.rs
@@ -1044,7 +1044,7 @@ pub(crate) fn cert_viewer(ui: &mut egui::Ui, v: &mut CertViewer, trusted: &[Cert
             let grid = |ui: &mut egui::Ui, rows: Vec<(&str, String)>| {
                 egui::Grid::new(("cert-rows", v.tab as u8)).num_columns(2).spacing([12.0, 5.0]).show(ui, |ui| {
                     for (k, val) in rows {
-                        ui.label(egui::RichText::new(tl!(k)).color(t.text_muted));
+                        ui.label(egui::RichText::new(tl_ctx!("certificate", k)).color(t.text_muted));
                         ui.add(egui::Label::new(val).wrap());
                         ui.end_row();
                     }
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 8351c126..9e45c927 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -63,10 +63,22 @@ pub fn search_box(ui: &mut egui::Ui, placeholder: &str, width: f32) -> Response
     let fill = if resp.hovered() { t.hover } else { t.field };
     ui.painter().rect(rect, CornerRadius::same(16), fill, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     icons::paint(ui, Rect::from_min_size(rect.min + vec2(10.0, 8.0), vec2(16.0, 16.0)), "search", 15.0, t.text_muted);
-    ui.painter().text(rect.left_center() + vec2(34.0, 0.0), Align2::LEFT_CENTER, placeholder, theme::regular(13.0), t.text_faint);
     let shortcut = ui.ctx().format_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, egui::Key::K));
-    ui.painter().text(rect.right_center() - vec2(12.0, 0.0), Align2::RIGHT_CENTER, shortcut, theme::regular(11.5), t.text_faint);
-    resp.on_hover_cursor(egui::CursorIcon::Text)
+    let shortcut = ui.painter().layout_no_wrap(shortcut, theme::regular(11.5), t.text_faint);
+    let shortcut_pos = rect.right_center() - vec2(12.0 + shortcut.size().x, shortcut.size().y * 0.5);
+    // Reserve the measured shortcut width in every language; long translations are elided
+    // within the remaining space rather than painted underneath the shortcut.
+    let text_right = (shortcut_pos.x - 10.0).max(rect.left());
+    let text_left = (rect.left() + 34.0).min(text_right);
+    let text_rect = Rect::from_min_max(egui::pos2(text_left, rect.top()), egui::pos2(text_right, rect.bottom()));
+    let mut job = egui::text::LayoutJob::simple_singleline(placeholder.to_owned(), theme::regular(13.0), t.text_faint);
+    job.wrap = egui::text::TextWrapping { max_width: text_rect.width(), max_rows: 1, break_anywhere: true, ..Default::default() };
+    let text = ui.fonts_mut(|f| f.layout_job(job));
+    let elided = text.elided;
+    ui.painter().with_clip_rect(text_rect).galley(egui::pos2(text_left, rect.center().y - text.size().y * 0.5), text, t.text_faint);
+    ui.painter().with_clip_rect(rect).galley(shortcut_pos, shortcut, t.text_faint);
+    let resp = resp.on_hover_cursor(egui::CursorIcon::Text);
+    if elided { resp.on_hover_text(placeholder) } else { resp }
 }
 
 pub fn menu_item(ui: &mut egui::Ui, label: &str, shortcut: &str) -> Response {
@@ -298,6 +310,29 @@ mod tests {
     use super::*;
     use egui::Pos2;
 
+    #[test]
+    fn search_placeholder_never_overlaps_the_shortcut() {
+        for width in [260.0, 160.0, 90.0] {
+            let ctx = egui::Context::default();
+            ctx.set_fonts(theme::font_definitions());
+            let placeholder = "Werkzeuge und Befehle suchen";
+            let output = ctx.run_ui(egui::RawInput::default(), |ui| {
+                search_box(ui, placeholder, width);
+            });
+            let text_shapes: Vec<_> = output
+                .shapes
+                .iter()
+                .filter_map(|shape| if let egui::Shape::Text(text) = &shape.shape { Some((shape.clip_rect, text)) } else { None })
+                .collect();
+            let (clip, hint) = text_shapes.iter().find(|(_, text)| text.galley.job.text == placeholder).unwrap();
+            let (_, shortcut) = text_shapes.iter().find(|(_, text)| text.galley.job.text.contains('K')).unwrap();
+            assert!(clip.right() <= shortcut.pos.x - 9.0, "hint must leave a gap before the shortcut at width {width}");
+            assert!(hint.galley.elided, "the long original German hint must be elided at width {width}");
+            assert_eq!(hint.galley.rows.len(), 1);
+            output.drop_without_applying_deltas();
+        }
+    }
+
     fn toast_rect(app: &mut PdfCraftApp, ctx: &egui::Context, width: f32, now: &mut f64) -> Rect {
         // Let the Area settle after a notice/viewport change, without advancing to
         // expiry. No native rendering or renderer worker is needed for this layout.
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 67662937..c585b3f2 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -502,6 +502,37 @@ fn japanese_controls_and_search_keep_command_ids() {
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["mode"], "AllTools");
 }
 
+#[test]
+fn german_preferences_and_search_keep_command_ids() {
+    let (mut h, c) = harness();
+    ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": "de" }));
+    ok(&mut h, &c, "ui.click", json!({ "label": "Lesen" }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["mode"], "Read");
+    ok(&mut h, &c, "ui.command", json!({ "id": "app.preferences" }));
+    let prefs = ok(&mut h, &c, "ui.inspect", json!({ "query": "Sprache der Oberfläche" }));
+    assert!(prefs["count"].as_u64().unwrap() > 0, "{prefs}");
+    let selector = ok(&mut h, &c, "ui.inspect", json!({ "query": "Deutsch" }));
+    let combo = selector["widgets"].as_array().unwrap().iter().find(|w| w["role"] == "ComboBox").expect("language selector");
+    ok(&mut h, &c, "ui.click", json!({ "id": combo["id"] }));
+    ok(&mut h, &c, "ui.click", json!({ "label": "English" }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["language"], "en");
+    let selector = ok(&mut h, &c, "ui.inspect", json!({ "query": "English" }));
+    let combo = selector["widgets"].as_array().unwrap().iter().find(|w| w["role"] == "ComboBox").expect("language selector");
+    ok(&mut h, &c, "ui.click", json!({ "id": combo["id"] }));
+    ok(&mut h, &c, "ui.click", json!({ "label": "Deutsch" }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["language"], "de");
+    ok(&mut h, &c, "ui.click", json!({ "label": "OK" }));
+    for query in ["Dokument teilen", "Split document", "page.split"] {
+        ok(&mut h, &c, "ui.command", json!({ "id": "view.palette" }));
+        ok(&mut h, &c, "ui.type", json!({ "text": query }));
+        let hits = ok(&mut h, &c, "ui.inspect", json!({ "query": "Dokument teilen…" }));
+        assert!(hits["count"].as_u64().unwrap() > 0, "{query}: {hits}");
+        ok(&mut h, &c, "ui.key", json!({ "key": "Escape" }));
+        h.state_mut().palette_query.clear();
+    }
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["documents"][0]["name"], "doc.pdf");
+}
+
 #[test]
 fn preferences_menu_and_shortcut_allow_switching_interface_languages() {
     let (mut h, c) = harness();
diff --git a/docs/localization.md b/docs/localization.md
index 73e53f3f..6515235a 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -20,6 +20,8 @@ There is no right-to-left interface language yet. File names and document titles
 
 Simplified Chinese, French and German coverage tests, following PhotoCraft's complete-catalog approach, check every registered command, All tools label and `tl!("literal")` in the UI source. Simplified Chinese also checks direct `i18n::t` calls and multiline literals, plus the About tabs, contributor name modes, sort options, table headers and model columns. Generated history labels, contributor summaries and diagnostics are tested with user-supplied names and error details. Catalog coverage does not guarantee glyph coverage: the release-pinned craft-fonts input currently has no `Hans` face, and the web build embeds only BIZ UDPGothic Regular. Chinese font delivery remains separate work, as discussed in [#112](https://github.com/storytold/pdfcraft/pull/112) and [#140](https://github.com/storytold/pdfcraft/pull/140).
 
+German labels keep nouns capitalized, including tool names inserted into notices. The certificate viewer uses the `certificate` context for `Subject` (the certificate holder), while document properties keep the plain translation (the topic). Search hints reserve room for the shortcut, and Home cards limit their title and description to the available rows; hovering shows the full text when it is shortened.
+
 ## How translations work
 
 PdfCraft uses the same system as PhotoCraft (`crates/ui-egui/src/i18n/`):
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c9ab74d1..f558ecbd 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9818,8 +9818,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values"]
-notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
+evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values"]
+notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"

From e6df6b13844ba74a66efd22ad25544ef4d87ba8d Mon Sep 17 00:00:00 2001
From: Dmytro <140102908+dmatviichuk@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:55:46 +0200
Subject: [PATCH 091/149] i18n: add complete Ukrainian interface translation
 (#509)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M14: add complete Ukrainian interface translation

Add the uk registry entry and original catalog, Ukrainian integer plurals,
calendar month inflection, attribution and localization documentation.
Fit Home recommendation cards and the search hint to translated text.
Cover locale detection, persistence, catalogs, bundled glyphs and UI control.

Fixes #503
Related to #348

Co-authored-by: Codex <codex@openai.com>

* uk: add the recent-files labels, labels that reach tl!() through a variable, and 'Inserted text'; fix 'мають мати'

* uk: Home / End are key-cap names

---------

Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.md                  |    3 +-
 ATTRIBUTION.toml                |   11 +
 ROADMAP.md                      |    4 +
 crates/ui-egui/src/forms_ui.rs  |    6 +-
 crates/ui-egui/src/i18n/mod.rs  |  223 +++-
 crates/ui-egui/src/i18n/uk.tsv  | 2106 +++++++++++++++++++++++++++++++
 crates/ui-egui/tests/control.rs |   37 +-
 crates/ui-egui/tests/fonts.rs   |    5 +-
 docs/localization.md            |   10 +-
 parity/acrobat-features.toml    |    4 +-
 10 files changed, 2396 insertions(+), 13 deletions(-)
 create mode 100644 crates/ui-egui/src/i18n/uk.tsv

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index da39180e..afe30062 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (256)
+## In this repository (257)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -20,6 +20,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/hu.tsv` | Hungarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/bg.tsv` | Bulgarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ja.tsv` | Japanese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/uk.tsv` | Ukrainian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index f5938abb..51878b9e 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -142,6 +142,17 @@ kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
 sha256 = "2bfcb94d72df43a6146e45e971950433a13bb008fc18c68463c096089f715466"
 
+[[asset]]
+path = "crates/ui-egui/src/i18n/uk.tsv"
+title = "Ukrainian interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "6939906a84a2b5b7f5d2ca36c454ed1787751232d435daa30cc62ededbe7c165"
+
 [[asset]]
 path = "assets/icons/accessibility.svg"
 title = "Lucide icon \"accessibility\""
diff --git a/ROADMAP.md b/ROADMAP.md
index d0f1c09d..e80fb3da 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -80,6 +80,7 @@ The gaps that matter most, in priority order. Agents: prefer these over adding P
 4. **Editing existing content (M7).** Fonts, subsets, reflow and CJK. The most visible gap for Pro users.
 5. **Pro workflows.** Signatures with timestamps and LTV (M9), OCR beyond Latin (M10), Office import/export (M10), preflight and PDF/A/X/UA (M11), XFA (M12).
 6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, German, Spanish, Japanese, Russian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
+6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, Spanish, Japanese, Russian, Ukrainian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
 
 Decided against for now (owner, 2026-10-05): self-installing updates and an update check at start. Help ▸ Check for updates is manual only.
 
@@ -104,6 +105,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 23% | 155–295 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 33–66 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
 | M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, German, Spanish and French catalogs have ≈1,800 entries each; Simplified Chinese, French and German coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog. Missing: more catalogs filled in, installers, performance budgets |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Spanish, French and Ukrainian catalogs have ≈1,800–2,000 entries each; Simplified Chinese, French and Ukrainian coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog; Ukrainian locales (`uk`, `uk_UA`) follow the Ukrainian one. Missing: more catalogs filled in, installers, performance budgets |
 | | **Total (original plan sizing)** | **2,085–3,840** | **≈ 35%** | **≈ 1,350–2,500 at the planned rate; ≈ 600–1,100 at the measured rate** | |
 
 **Overall progress: about 30–35% of the effort (51.0% of features shipped).** The viewer and the core are far ahead of the editing features, because the viewer was built first so progress could be seen; rendering itself is still borrowed from `hayro`. See [Honest assessment](#honest-assessment-2026-10-05).
@@ -149,6 +151,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 - **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, document inspection):** Annotation dates preserve non-date Unicode text instead of panicking while opening; failed auxiliary structure inspection keeps renderer page geometry and reports a warning. Synthetic UTF16BE annotation, UTF8-boundary and independent panic regressions cover the fix. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (community, M14, #503):** Ukrainian (Українська, `uk`) adds 2,047 original catalog entries covering commands, tools, dialogs, panels, notices, history and contributor controls. Auto resolves `uk`/`uk_UA`; the manual preference persists. Integer plurals distinguish one/few/many, including 11–14 and large counts; fixed-count templates use count-neutral wording. Calendar dates use genitive month names; Home cards fit wrapped text and the search hint keeps clear of its shortcut. Coverage checks scan UI literals, and font checks use bundled Inter and JetBrains Mono, including ґ/є/і/ї. Control tests check translated Preferences, command search, error framing and language switching with unsaved documents. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (community, Home pinned folders):** Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, M14, Telugu):** Telugu (తెలుగు, `te`) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; `te` and `te_IN` locales follow it. Telugu text is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/forms_ui.rs b/crates/ui-egui/src/forms_ui.rs
index 866b58d2..3f07f9bd 100644
--- a/crates/ui-egui/src/forms_ui.rs
+++ b/crates/ui-egui/src/forms_ui.rs
@@ -226,7 +226,11 @@ fn calendar(ctx: &egui::Context, view: &mut DocView, field: egui::Rect, fmt: &st
                                 .selectable_label(selected, text)
                                 .on_hover_text(crate::i18n::fmt(
                                     tl!("{month} {day}, {y}"),
-                                    &[("month", tl!(MONTHS[(m - 1) as usize])), ("day", &day.to_string()), ("y", &y.to_string())],
+                                    &[
+                                        ("month", tl_ctx!("calendar date", MONTHS[(m - 1) as usize])),
+                                        ("day", &day.to_string()),
+                                        ("y", &y.to_string()),
+                                    ],
                                 ))
                                 .clicked()
                             {
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index f6895a74..e1939349 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -86,8 +86,21 @@ fn plural_russian(n: u64) -> usize {
     }
 }
 
+/// Ukrainian (CLDR `uk`, integer counts): one (1, 21), few (2–4, 22–24), many (0, 5–19).
+/// Counts ending in 11–14 always take many, regardless of the last digit.
+fn plural_ukrainian(n: u64) -> usize {
+    match n % 100 {
+        11..=14 => 2,
+        _ => match n % 10 {
+            1 => 0,
+            2..=4 => 1,
+            _ => 2,
+        },
+    }
+}
+
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 13] = [
+pub static LANGUAGES: [LangInfo; 14] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -112,6 +125,8 @@ pub static LANGUAGES: [LangInfo; 13] = [
     LangInfo { code: "te", name: "తెలుగు", source: include_str!("te.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
     // Hungarian; every `hu-*` locale (`hu-HU`) resolves here.
     LangInfo { code: "hu", name: "Magyar", source: include_str!("hu.tsv"), plural: plural_one_other, catalog: OnceLock::new() },
+    // Ukrainian; every `uk-*` locale (`uk-UA`, `uk_UA.UTF-8`) resolves here.
+    LangInfo { code: "uk", name: "Українська", source: include_str!("uk.tsv"), plural: plural_ukrainian, catalog: OnceLock::new() },
 ];
 
 impl LangInfo {
@@ -1582,6 +1597,212 @@ mod tests {
         set_current(Lang::EN);
     }
 
+    #[test]
+    fn ukrainian_is_registered_and_persists() {
+        let uk = Lang::from_code("uk").expect("uk registered");
+        assert_eq!(uk.name(), "Українська");
+        assert_eq!(normalize_pref("UK"), Some("uk"));
+        for tag in ["uk", "uk-UA", "uk_UA.UTF-8", "UK-ua", "uk_UA@variant"] {
+            assert_eq!(lang_from_tag(tag), Some(uk), "{tag}");
+        }
+        assert_eq!(first_supported("uk-UA\r\nen-US"), Some(uk));
+        assert_eq!(first_supported("(\n    \"uk-UA\",\n    \"en-US\"\n)\n"), Some(uk));
+        assert_eq!(tr(uk, "File"), "Файл");
+        assert_eq!(tr(uk, "Save as…"), "Зберегти як…");
+        assert_eq!(tr(uk, "Bookmarks"), "Закладки");
+        assert_eq!(tr(uk, "Layers"), "Шари");
+        assert_eq!(tr(uk, "Звіт {n}.pdf"), "Звіт {n}.pdf");
+        assert_eq!(tr_ctx(uk, "comment menu", "Edit"), "Редагувати");
+        assert_eq!(tr_ctx(uk, "signature pad", "Type"), "Ввести");
+        assert_eq!(tr_ctx(uk, "action wizard", "Start"), "Почати");
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", "UK").unwrap();
+        assert_eq!(app.language, "uk");
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, "uk");
+        assert!(restored.set_option("language", "xx").is_err());
+        assert_eq!(restored.language, "uk");
+    }
+
+    #[test]
+    fn ukrainian_integer_plurals_cover_teens_and_large_counts() {
+        let uk = Lang::from_code("uk").expect("uk registered");
+        for (counts, page, field) in [
+            (vec![1, 21, 31, 101, 121, 1001], "сторінка", "поле"),
+            (vec![2, 3, 4, 22, 23, 24, 102, 104, 122, 1002], "сторінки", "поля"),
+            (vec![0, 5, 10, 11, 12, 13, 14, 19, 20, 25, 100, 110, 111, 112, 114, 1000, u64::MAX], "сторінок", "полів"),
+        ] {
+            for n in counts {
+                assert_eq!(trn(uk, n, "{n} page", "{n} pages"), format!("{n} {page}"));
+                assert_eq!(trn(uk, n, "{n} field", "{n} fields"), format!("{n} {field}"));
+            }
+        }
+    }
+
+    #[test]
+    fn ukrainian_calendar_uses_month_case_for_dates() {
+        let uk = Lang::from_code("uk").expect("uk registered");
+        for (source, standalone, date) in [
+            ("January", "Січень", "січня"),
+            ("February", "Лютий", "лютого"),
+            ("March", "Березень", "березня"),
+            ("April", "Квітень", "квітня"),
+            ("May", "Травень", "травня"),
+            ("June", "Червень", "червня"),
+            ("July", "Липень", "липня"),
+            ("August", "Серпень", "серпня"),
+            ("September", "Вересень", "вересня"),
+            ("October", "Жовтень", "жовтня"),
+            ("November", "Листопад", "листопада"),
+            ("December", "Грудень", "грудня"),
+        ] {
+            assert_eq!(tr(uk, source), standalone);
+            let month = tr_ctx(uk, "calendar date", source);
+            assert_eq!(month, date);
+            assert_eq!(fmt(tr(uk, "{month} {day}, {y}"), &[("month", month), ("day", "9"), ("y", "2026")]), format!("9 {date} 2026"));
+            // Catalogs without this context retain their existing month translation.
+            assert_eq!(tr_ctx(Lang::EN, "calendar date", source), source);
+            assert_eq!(tr_ctx(JA(), "calendar date", source), tr(JA(), source));
+        }
+    }
+
+    /// Preserve only product/format names, abbreviations and templates with no English words.
+    #[test]
+    fn ukrainian_catalog_does_not_leave_english_ui_text() {
+        let uk = Lang::from_code("uk").expect("uk registered");
+        let (entries, errors) = parse_entries(uk.0.source, uk.0.plural_forms());
+        assert!(errors.is_empty(), "{errors:?}");
+        let keep = [
+            "OK",
+            "PDF/A…",
+            "Microsoft Word (.docx)",
+            "PostScript / EPS",
+            // Key-cap names, printed in English on Ukrainian keyboards.
+            "Home / End",
+            "JavaScript",
+            "ZIP",
+            "{n} {kind}",
+            "{rule} - {status}",
+            "{field}: {e}",
+            "`{command}` {when}",
+            "{0}: {1}",
+            "{month} {y}",
+            "+LOC",
+            "−LOC",
+            "ΔLOC",
+            "+Bin",
+            "−Bin",
+        ];
+        let unchanged: Vec<_> = entries.iter().filter(|e| e.source == e.translation && !keep.contains(&e.source.as_str())).collect();
+        assert!(unchanged.is_empty(), "untranslated Ukrainian catalog entries: {unchanged:#?}");
+    }
+
+    /// Ukrainian translates every registered command and every All tools label.
+    #[test]
+    fn ukrainian_covers_commands_and_catalogue() {
+        let uk = Lang::from_code("uk").expect("uk registered");
+        for command in pdfcraft_engine::commands::COMMANDS {
+            assert!(has(uk, command.label), "missing command: {}", command.label);
+            if let Some(menu) = command.menu {
+                assert!(has(uk, menu), "missing menu: {menu}");
+            }
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            assert!(has(uk, group.label), "missing group: {}", group.label);
+            for section in group.sections {
+                assert!(has(uk, section.title), "missing section: {}", section.title);
+                for item in section.items {
+                    assert!(has(uk, item.label), "missing item: {}", item.label);
+                }
+            }
+        }
+    }
+
+    /// Check direct lookups and multiline literals as well as ordinary tl!("literal") calls,
+    /// following the complete-catalog check for Simplified Chinese.
+    #[test]
+    fn ukrainian_covers_ui_literals() {
+        let uk = Lang::from_code("uk").expect("uk registered");
+        let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+        let mut literals = std::collections::BTreeSet::new();
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(dir).expect("UI source directory") {
+                let path = entry.expect("UI source entry").path();
+                if path.is_dir() {
+                    if path.file_name().is_some_and(|name| name != "i18n") {
+                        stack.push(path);
+                    }
+                } else if path.extension().is_some_and(|ext| ext == "rs") {
+                    let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n").replace("crate::i18n::t(", "tl!(");
+                    let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+                    while let Some((_, after)) = rest.split_once("tl!(") {
+                        let after = after.trim_start();
+                        let Some(after) = after.strip_prefix('"') else {
+                            rest = after;
+                            continue;
+                        };
+                        let mut escaped = false;
+                        let end = after
+                            .char_indices()
+                            .find_map(|(i, c)| {
+                                if c == '"' && !escaped {
+                                    return Some(i);
+                                }
+                                escaped = c == '\\' && !escaped;
+                                None
+                            })
+                            .expect("closed tl! literal");
+                        let (raw, tail) = after.split_at(end);
+                        let closing = tail.strip_prefix('"').expect("closing quote").trim_start();
+                        let closing = closing.strip_prefix(',').unwrap_or(closing).trim_start();
+                        if closing.starts_with(')') {
+                            let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
+                            literals.insert(label);
+                        }
+                        rest = tail.strip_prefix('"').expect("closing quote");
+                    }
+                }
+            }
+        }
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(uk, label)).collect();
+        assert!(missing.is_empty(), "untranslated Ukrainian UI literals: {missing:#?}");
+    }
+
+    #[test]
+    fn ukrainian_history_and_diagnostics_preserve_user_values() {
+        let uk = Lang::from_code("uk").expect("uk registered");
+        set_current(uk);
+        assert_eq!(command_label("Undo Insert pages from Звіт {n}.pdf"), "Скасувати: Вставити сторінки з Звіт {n}.pdf");
+        assert_eq!(command_label("Redo Fill in Контакт {key}"), "Повторити: Заповнити Контакт {key}");
+        assert_eq!(action_label("Change Title"), "Змінити: Заголовок");
+        assert_eq!(action_label("Custom action {n}"), "Custom action {n}");
+        assert_eq!(fmt(t("This page couldn't be displayed.\n{e}"), &[("e", "OS error {n}")]), "Не вдалося відобразити цю сторінку.\nOS error {n}");
+        assert_eq!(fmt(t("{n} pages selected"), &[("n", "3")]), "Вибрано сторінок: 3");
+        assert_eq!(fmt(t("{n} contributors · {c} commits"), &[("n", "2"), ("c", "1,234")]), "Учасників: 2 · Комітів: 1,234");
+        assert_eq!(tr(uk, "CheckBox"), "Прапорець");
+        let contributor = crate::credits::Contributor {
+            login: "reader{n}",
+            display_name: Some("Save"),
+            real_name: None,
+            prs: 2,
+            commits: 3,
+            lines_added: 10,
+            lines_deleted: 4,
+            binary_added: 1,
+            binary_deleted: 0,
+            first_commit: "2026-10-01T00:00:00Z",
+            last_commit: "2026-10-09T00:00:00Z",
+        };
+        assert_eq!(
+            contributor.summary(),
+            "@reader{n}: PR: 2, комітів: 3, +10 / −4 рядків (Δ +6), +1 / −0 бінарних ресурсів, 2026-10-01 – 2026-10-09"
+        );
+        assert_eq!(contributor.name(crate::credits::NameMode::DisplayName), "Save");
+        set_current(Lang::EN);
+    }
+
     /// Every bundled catalog is well-formed and consistent with its sources.
     #[test]
     fn bundled_catalogs_are_consistent() {
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
new file mode 100644
index 00000000..c9505c16
--- /dev/null
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -0,0 +1,2106 @@
+# Ukrainian (uk) catalog. Columns, separated by a TAB:  context <TAB> source <TAB> translation
+#
+#   context  empty                a plain UI string; `source` is the English text in the code
+#            @id                  a command id (e.g. file.saveAs): wins over the English text for
+#                                 that menu item, so one id can read differently from its twin
+#            @plural              `source` is "one|other" (English forms); the translation lists the
+#                                 language's forms separated by "|" (see `plural` in i18n/mod.rs)
+#            anything else        a disambiguating context passed to `tr_ctx`
+#   escapes  \n  \t  \\  inside a column. `{name}` placeholders must appear in both columns.
+#   lines starting with # and blank lines are ignored.
+#
+# Clean-room: every entry was written from the plain meaning of the English label using ordinary
+# Ukrainian computing vocabulary. No proprietary localisation resource, string table or product UI
+# (Acrobat's included) was consulted or copied; add entries the same way.
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
+# the trailing "…" of dialog commands is kept.
+
+# Integer plurals (CLDR uk): one (1, 21) | few (2–4, 22–24) | many (0, 5–19); 11–14 take many.
+# Commands use infinitives. Fixed-count templates use count-neutral wording.
+
+	Menu	Меню
+	File	Файл
+	Edit	Редагування
+	Pages	Сторінки
+	View	Перегляд
+	Help	Довідка
+	Preferences	Налаштування
+	Preferences…	Налаштування…
+	Interface language	Мова інтерфейсу
+	Identity	Особисті дані
+	Name on new comments	Ім’я в нових коментарях
+	Open…	Відкрити…
+	Open Recent	Відкрити нещодавні
+	Pin folder to Home…	Закріпити теку на головній…
+	Folders	Теки
+	Pin a folder…	Закріпити теку…
+	Pin a folder to Home	Закріпити теку на головній
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Закріпіть теку, щоб бачити тут її найновіші PDF, наприклад теку, куди сканер або синхронізований хмарний диск зберігає файли.
+	Unpin	Відкріпити
+	Unpin {folder}	Відкріпити {folder}
+	Looking for PDFs…	Пошук PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Ця тека зараз недоступна. Можливо, її переміщено або її диск чи хмарна синхронізація не в мережі.
+	No PDFs in this folder yet	У цій теці ще немає PDF
+	Show less	Показати менше
+	Show {n} more	Показати ще {n}
+	The newest {n} of {total} PDFs	Найновіші {n} PDF із {total}
+	Pinned folders need the desktop app	Для закріплених тек потрібен настільний застосунок
+	Choose a folder on this computer to pin	Виберіть теку на цьому комп’ютері, щоб закріпити її
+	{folder} is already pinned to Home	{folder} уже закріплено на головній
+	You can pin up to {n} folders. Unpin one first.	Можна закріпити не більше {n} тек. Спочатку відкріпіть одну з них.
+	Pinned {folder} to Home	Теку {folder} закріплено на головній
+	No recent files	Немає нещодавніх файлів
+	New blank PDF	Новий порожній PDF
+	Create PDF from file…	Створити PDF із файлу…
+	Create PDF from images…	Створити PDF із зображень…
+	Create PDF from clipboard	Створити PDF із буфера обміну
+	Combine files…	Об’єднати файли…
+	Save	Зберегти
+	Save as…	Зберегти як…
+	Close file	Закрити файл
+	Close all	Закрити все
+	Revert	Повернути збережену версію
+	Print…	Друк…
+	Document properties…	Властивості документа…
+	Undo	Скасувати
+	Redo	Повторити
+	Find…	Знайти…
+	Advanced search…	Розширений пошук…
+	Copy pages	Копіювати сторінки
+	Cut pages	Вирізати сторінки
+	Paste pages	Вставити сторінки
+	Fit visible	За видимою областю
+	Marquee zoom	Масштабувати виділену область
+	Take a snapshot	Зробити знімок
+	Full screen mode	Повноекранний режим
+	Read mode	Режим читання
+	Switch light / dark theme	Перемкнути світлу / темну тему
+	Comments panel	Панель коментарів
+	Form fields panel	Панель полів форми
+	Clear form	Очистити форму
+	Find tools and commands…	Знайти інструменти й команди…
+	Zoom	Масштаб
+	Actual size	Фактичний розмір
+	Zoom to page level	За розміром сторінки
+	Fit to width	За шириною
+	Display theme	Тема оформлення
+	Side panels	Бічні панелі
+	Enable Acrobat JavaScript	Увімкнути Acrobat JavaScript
+	OK	OK
+	Join our Discord	Приєднатися до нашого Discord
+	Close	Закрити
+	Next / previous match	Наступний / попередній збіг
+	Copy selected text	Копіювати виділений текст
+	Double-click	Подвійне клацання
+	Select a word	Виділити слово
+	Clear selection / close find	Зняти виділення / закрити пошук
+	Zoom in / out (also pinch or ⌘-scroll)	Збільшити / зменшити (також жестом зведення або ⌘-прокручуванням)
+	Rotate view	Повернути вигляд
+	First / last page	Перша / остання сторінка
+	Previous / next page	Попередня / наступна сторінка
+	Delete selected pages (Organize)	Видалити вибрані сторінки (Упорядкування)
+	Select all pages (Organize)	Вибрати всі сторінки (Упорядкування)
+	Home	Головна
+	Open	Відкрити
+	Open a PDF (⌘O)	Відкрити PDF (⌘O)
+	Dark gray theme	Темно-сіра тема
+	Light theme	Світла тема
+	All tools	Усі інструменти
+	Read	Читання
+	Convert	Перетворення
+	E-Sign	Електронний підпис
+	Print (⌘P)	Друк (⌘P)
+	Save (M4)	Зберегти (M4)
+	Document properties (⌘D)	Властивості документа (⌘D)
+	Find tools and commands	Знайти інструменти й команди
+	Fit to height	За висотою
+	Zoom in	Збільшити
+	Zoom out	Зменшити
+	Rotate view clockwise	Повернути вигляд за годинниковою стрілкою
+	Rotate view counterclockwise	Повернути вигляд проти годинникової стрілки
+	Page navigation	Навігація сторінками
+	Previous view	Попередній вигляд
+	Next view	Наступний вигляд
+	Page display	Відображення сторінок
+	Continuous scrolling	Безперервне прокручування
+	Two-page view	Дві сторінки
+	Single page	Одна сторінка
+	Show cover page in two-page view	Показувати обкладинку в режимі двох сторінок
+	Use system setting	Використовувати системні налаштування
+	Light gray	Світло-сіра
+	Dark gray	Темно-сіра
+	Comments	Коментарі
+	Bookmarks	Закладки
+	Fields	Поля
+	Layers	Шари
+	Attachments	Вкладення
+	Signatures	Підписи
+	Accessibility Checker	Перевірка доступності
+	Search	Пошук
+	Compare	Порівняння
+	Page thumbnails	Мініатюри сторінок
+	Form fields	Поля форми
+	Zoom out (⌘−)	Зменшити (⌘−)
+	Zoom in (⌘+)	Збільшити (⌘+)
+	Rotate view clockwise (⇧⌘+)	Повернути вигляд за годинниковою стрілкою (⇧⌘+)
+	Toggle fit page / fit width	Перемкнути масштаб за сторінкою / за шириною
+	Next page	Наступна сторінка
+	Previous page	Попередня сторінка
+	Current page — type a page number or label (such as iv) and press Enter	Поточна сторінка — введіть номер або позначку сторінки (наприклад iv) і натисніть Enter
+	Welcome to PdfCraft	Вітаємо в PdfCraft
+	An open-source PDF workbench — local, private, and scriptable.	Відкритий інструментарій для PDF — локальний, приватний і з підтримкою сценаріїв.
+	Join the ArtCraft community	Приєднатися до спільноти ArtCraft
+	Get help, share feedback and follow development on Discord.	Отримуйте допомогу, діліться відгуками й стежте за розробкою в Discord.
+	Recommended tools	Рекомендовані інструменти
+	Use now	Використати зараз
+	Open file	Відкрити файл
+	Recent	Нещодавні
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	Тут з’являються файли, які ви відкриваєте в PdfCraft. Перетягніть PDF будь-куди, щоб відкрити його.
+	Privacy	Приватність
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft працює офлайн. Без телеметрії, облікового запису та хмарної обробки, якщо ви не додасте постачальника.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Сценарії виконуються в ізольованому середовищі без доступу до файлів і мережі. Коли JavaScript вимкнено, стандартні функції форматування, перевірки й обчислення Acrobat усе одно працюють.
+	Back to all tools	Назад до всіх інструментів
+	Close panel	Закрити панель
+	View less	Показати менше
+	View more	Показати більше
+	Available	Доступно
+	Ready	Готово
+	Search tools and commands…	Пошук інструментів і команд…
+	No matching tools	Відповідних інструментів немає
+	Tool	Інструмент
+	Command	Команда
+	Add a sticky note	Додати нотатку
+	Add a text box	Додати текстове поле коментаря
+	Highlight text	Виділити текст кольором
+	Underline text	Підкреслити текст
+	Strikethrough text	Закреслити текст
+	Squiggly underline text	Підкреслити текст хвилястою лінією
+	Draw freehand	Малювати від руки
+	Draw a line	Намалювати лінію
+	Draw an arrow	Намалювати стрілку
+	Draw a rectangle	Намалювати прямокутник
+	Draw an oval	Намалювати овал
+	Draw a polygon	Намалювати багатокутник
+	Draw connected lines	Намалювати ламану лінію
+	Draw a cloud	Намалювати хмару
+	Add a callout	Додати виноску
+	Insert text	Вставити текст
+	Replace text	Замінити текст
+	Attach a file	Вкласти файл
+	Erase drawings	Стерти малюнки
+	Flatten comments	Звести коментарі
+	Import comments…	Імпортувати коментарі…
+	Add a stamp	Додати штамп
+	Export all comments to data file…	Експортувати всі коментарі у файл даних…
+	Hide all comments	Приховати всі коментарі
+	Summarize comments	Створити зведення коментарів
+	Import form data…	Імпортувати дані форми…
+	Export form data…	Експортувати дані форми…
+	PDF/A…	PDF/A…
+	Action Wizard…	Майстер дій…
+	Prepare for distribution…	Підготувати до розповсюдження…
+	Optimize scanned documents…	Оптимізувати відскановані документи…
+	Compare files…	Порівняти файли…
+	Detect form fields	Виявити поля форми
+	Merge data files into spreadsheet…	Об’єднати файли даних в електронну таблицю…
+	Flatten form fields	Звести поля форми
+	Prepare a form	Підготувати форму
+	Tab order: by rows	Порядок табуляції: за рядками
+	Tab order: by columns	Порядок табуляції: за стовпцями
+	Tab order: by document structure	Порядок табуляції: за структурою документа
+	Add text	Додати текст
+	Edit text & images	Редагувати текст і зображення
+	Add or edit links	Додати або редагувати посилання
+	Create links from URLs	Створити посилання з URL
+	Remove all links	Видалити всі посилання
+	Add Bates numbering…	Додати нумерацію Бейтса…
+	Add image…	Додати зображення…
+	Redact text and images	Вилучити текст і зображення
+	Redact pages…	Вилучити вміст сторінок…
+	Find text and redact…	Знайти й вилучити текст…
+	Redaction properties…	Властивості вилучення вмісту…
+	Apply redactions…	Застосувати вилучення вмісту…
+	Clear redaction marks	Очистити позначки вилучення
+	Remove hidden information…	Видалити приховану інформацію…
+	Sanitize document…	Очистити документ від конфіденційних даних…
+	Field properties…	Властивості поля…
+	Add a text field	Додати текстове поле
+	Add a checkbox	Додати прапорець
+	Add a radio button	Додати перемикач
+	Add a drop-down list	Додати розкривний список
+	Add a list box	Додати список
+	Add a button	Додати кнопку
+	Add an image field	Додати поле зображення
+	Add a date field	Додати поле дати
+	Add a digital signature field	Додати поле цифрового підпису
+	Digitally sign	Підписати цифровим підписом
+	Certify (visible signature)	Засвідчити (видимий підпис)
+	Certify (invisible signature)	Засвідчити (невидимий підпис)
+	Validate all signatures	Перевірити всі підписи
+	Signatures panel	Панель підписів
+	Fill & Sign: add text	Заповнення й підпис: додати текст
+	Fill & Sign: checkmark	Заповнення й підпис: позначка
+	Fill & Sign: cross	Заповнення й підпис: хрестик
+	Fill & Sign: dot	Заповнення й підпис: крапка
+	Fill & Sign: line	Заповнення й підпис: лінія
+	Fill & Sign: date	Заповнення й підпис: дата
+	Fill & Sign: sign	Заповнення й підпис: підпис
+	Fill & Sign: initials	Заповнення й підпис: ініціали
+	Export to image…	Експортувати в зображення…
+	Reduce file size…	Зменшити розмір файлу…
+	Optimize PDF…	Оптимізувати PDF…
+	Export to text…	Експортувати в текст…
+	Export to Word…	Експортувати у Word…
+	Export to HTML…	Експортувати в HTML…
+	Export to RTF…	Експортувати в RTF…
+	JavaScript console…	Консоль JavaScript…
+	Document JavaScripts…	Сценарії JavaScript документа…
+	Recognize text…	Розпізнати текст…
+	Recognize text in multiple files…	Розпізнати текст у кількох файлах…
+	Check for accessibility…	Перевірити доступність…
+	Open accessibility report	Відкрити звіт про доступність
+	Change reading options…	Змінити параметри читання…
+	Add alternate text…	Додати альтернативний текст…
+	Export all images…	Експортувати всі зображення…
+	Add header & footer…	Додати колонтитули…
+	Update header & footer…	Оновити колонтитули…
+	Remove header & footer	Видалити колонтитули
+	Add watermark…	Додати водяний знак…
+	Update watermark…	Оновити водяний знак…
+	Remove watermark	Видалити водяний знак
+	Add background…	Додати тло…
+	Update background…	Оновити тло…
+	Remove background	Видалити тло
+	Protect using password…	Захистити паролем…
+	Remove security	Зняти захист
+	Security properties…	Властивості захисту…
+	Organize pages	Упорядкувати сторінки
+	New bookmark	Нова закладка
+	Rotate pages clockwise	Повернути сторінки за годинниковою стрілкою
+	Rotate pages counterclockwise	Повернути сторінки проти годинникової стрілки
+	Delete pages	Видалити сторінки
+	Insert blank page	Вставити порожню сторінку
+	Rotate pages…	Повернути сторінки…
+	Duplicate pages	Дублювати сторінки
+	Crop pages	Обітнути сторінки
+	Set page boxes…	Задати межі сторінок…
+	Insert pages from file…	Вставити сторінки з файлу…
+	Replace pages…	Замінити сторінки…
+	Extract pages…	Видобути сторінки…
+	Split document…	Розділити документ…
+	Number pages…	Пронумерувати сторінки…
+	Keyboard shortcuts	Клавіатурні скорочення
+	Join the ArtCraft Discord	Приєднатися до Discord ArtCraft
+	PdfCraft web page	Вебсторінка PdfCraft
+	PdfCraft on GitHub	PdfCraft на GitHub
+	ArtCraft website	Вебсайт ArtCraft
+	Check for updates…	Перевірити оновлення…
+	About PdfCraft	Про PdfCraft
+	Export a PDF	Експортувати PDF
+	Export to	Експортувати в
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Spreadsheet (.xlsx)	Електронна таблиця (.xlsx)
+	Presentation (.pptx)	Презентація (.pptx)
+	Image (PNG)	Зображення (PNG)
+	Export all images	Експортувати всі зображення
+	HTML web page	Вебсторінка HTML
+	Rich Text Format (.rtf)	Форматований текст (.rtf)
+	Text (plain)	Звичайний текст
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	Заповнення й підпис
+	Fill	Заповнити
+	Checkmark	Позначка
+	Cross	Хрестик
+	Dot	Крапка
+	Line	Лінія
+	Date	Дата
+	Signature	Підпис
+	Initials	Ініціали
+	Edit a PDF	Редагувати PDF
+	Modify page	Змінити сторінку
+	Rotate pages	Повернути сторінки
+	Insert pages	Вставити сторінки
+	Extract pages	Видобути сторінки
+	Add content	Додати вміст
+	Text	Текст
+	Image	Зображення
+	Header and footer	Колонтитули
+	Watermark	Водяний знак
+	Link	Посилання
+	Bates numbering	Нумерація Бейтса
+	Background	Тло
+	Attach file	Вкласти файл
+	Create a PDF	Створити PDF
+	Create from	Створити з
+	Single file	Один файл
+	Multiple files	Кілька файлів
+	Images	Зображення
+	Clipboard	Буфер обміну
+	Blank page	Порожня сторінка
+	Combine files	Об’єднати файли
+	Combine	Об’єднати
+	Add files to combine	Додати файли для об’єднання
+	Page options	Параметри сторінки
+	Page grid	Сітка сторінок
+	Rotate	Повернути
+	Delete	Видалити
+	Extract	Видобути
+	Insert	Вставити
+	Replace	Замінити
+	Split	Розділити
+	More	Більше
+	Set page boxes	Задати межі сторінок
+	Page labels	Позначки сторінок
+	Page transitions	Переходи між сторінками
+	Add comments	Додати коментарі
+	Markup	Розмітка
+	Sticky note	Нотатка
+	Underline	Підкреслення
+	Strikethrough	Закреслення
+	Squiggly underline	Хвилясте підкреслення
+	Text box	Текстове поле коментаря
+	Drawing	Малювання
+	Rectangle	Прямокутник
+	Oval	Овал
+	Arrow	Стрілка
+	Cloud	Хмара
+	Stamp	Штамп
+	Review	Рецензування
+	Comment list	Список коментарів
+	Scan & OCR	Сканування й OCR
+	Recognize text	Розпізнати текст
+	In this file	У цьому файлі
+	In multiple files	У кількох файлах
+	Enhance scanned file	Поліпшити відсканований файл
+	Correct recognized text	Виправити розпізнаний текст
+	Protect a PDF	Захистити PDF
+	Protect	Захистити
+	Protect with password	Захистити паролем
+	Remove hidden information	Видалити приховану інформацію
+	Advanced options	Додаткові параметри
+	Encrypt with certificate	Зашифрувати сертифікатом
+	Security properties	Властивості захисту
+	Redact a PDF	Вилучити вміст PDF
+	Redact	Вилучити вміст
+	Redact pages	Вилучити вміст сторінок
+	Find text and redact	Знайти й вилучити текст
+	Set properties	Задати властивості
+	Sanitize document	Очистити документ від конфіденційних даних
+	Compress a PDF	Стиснути PDF
+	Optimize	Оптимізувати
+	Reduce file size	Зменшити розмір файлу
+	Advanced optimization	Розширена оптимізація
+	Audit space usage	Аналіз використання місця
+	Field list	Список полів
+	Field properties	Властивості поля
+	Tab order by rows	Порядок табуляції за рядками
+	Tab order by columns	Порядок табуляції за стовпцями
+	Import data	Імпортувати дані
+	Export data	Експортувати дані
+	Add form components	Додати компоненти форми
+	Text field	Текстове поле
+	Checkbox	Прапорець
+	Radio button	Перемикач
+	Drop-down list	Розкривний список
+	List box	Список
+	Button	Кнопка
+	Image field	Поле зображення
+	Date field	Поле дати
+	Digital signature	Цифровий підпис
+	Stamps	Штампи
+	Stamp palette	Палітра штампів
+	Use a certificate	Використати сертифікат
+	Certificates	Сертифікати
+	Timestamp	Позначка часу
+	Use print production	Підготувати до друку
+	Print production	Підготовка до друку
+	Output preview	Попередній перегляд виводу
+	Preflight	Переддрукова перевірка
+	Convert colors	Перетворити кольори
+	Add printer marks	Додати друкарські мітки
+	Fix hairlines	Виправити надтонкі лінії
+	Measure objects	Виміряти об’єкти
+	Measure	Виміряти
+	Measuring tool	Інструмент вимірювання
+	Geospatial location	Геопросторове розташування
+	Compare files	Порівняти файли
+	Select files to compare	Вибрати файли для порівняння
+	Use guided actions	Використати покрокові дії
+	Actions list	Список дій
+	Action Wizard	Майстер дій
+	Make accessible	Зробити доступним
+	Prepare for distribution	Підготувати до розповсюдження
+	Optimize scanned documents	Оптимізувати відскановані документи
+	Archive documents	Архівувати документи
+	Prepare for accessibility	Підготувати для доступності
+	Accessibility	Доступність
+	Automatically tag PDF	Автоматично додати теги до PDF
+	Change reading options	Змінити параметри читання
+	Check for accessibility	Перевірити доступність
+	Add alternate text	Додати альтернативний текст
+	Fix reading order	Виправити порядок читання
+	Apply PDF standards	Застосувати стандарти PDF
+	Standards	Стандарти
+	Save as PDF/A	Зберегти як PDF/A
+	Save as PDF/X	Зберегти як PDF/X
+	Save as PDF/UA	Зберегти як PDF/UA
+	Add search index	Додати пошуковий індекс
+	Index	Індекс
+	Manage embedded index	Керувати вбудованим індексом
+	Use JavaScript	Використати JavaScript
+	JavaScript	JavaScript
+	Console	Консоль
+	Document JavaScripts	Сценарії JavaScript документа
+	Document actions	Дії документа
+	AI assistant	ШІ-асистент
+	Bring your own model (off by default)	Додайте власну модель (типово вимкнено)
+	Summarize	Створити зведення
+	Ask about this document	Запитати про цей документ
+	Translate	Перекласти
+	pages	сторінки
+	Planned	Заплановано
+	Planned for milestone	Заплановано на етап
+	open to see what it will include	відкрийте, щоб побачити, що він міститиме
+	Optional: needs an AI provider you configure	Необов’язково: потрібен налаштований вами постачальник ШІ
+	Coming in milestone	З’явиться на етапі
+	Items marked Ready work today.	Елементи з позначкою «Готово» вже працюють.
+	Preview	Попередній перегляд
+	Edit fields	Редагувати поля
+	Try the form as people filling it in will see it	Перевірте форму так, як її бачитимуть користувачі під час заповнення
+	Redact all	Вилучити весь вміст
+	Clear all	Очистити все
+	Rotate page	Повернути сторінку
+	Delete page	Видалити сторінку
+	Move page	Перемістити сторінку
+	Move pages	Перемістити сторінки
+	Duplicate page	Дублювати сторінку
+	Replace page	Замінити сторінку
+	Replace pages	Замінити сторінки
+	Crop page	Обітнути сторінку
+	Cancel	Скасувати
+	Don't save	Не зберігати
+	Apply	Застосувати
+	Run	Виконати
+	Clear	Очистити
+	Sanitize	Очистити конфіденційні дані
+	Mark all	Позначити все
+	Save changes to “{name}” before closing?	Зберегти зміни у «{name}» перед закриттям?
+	Your changes will be lost if you don't save them.	Якщо не зберегти зміни, їх буде втрачено.
+	Password required	Потрібен пароль
+	“{name}” is protected. Enter a password to open it.	«{name}» захищено. Введіть пароль, щоб відкрити файл.
+	Password	Пароль
+	Incorrect password. Try again.	Неправильний пароль. Спробуйте ще раз.
+	Recognize Text	Розпізнати текст
+	Password protection will be applied when you save	Захист паролем буде застосовано під час збереження
+	Saved the print-ready PDF to {path}	Готовий до друку PDF збережено в {path}
+	Could not save: {e}	Не вдалося зберегти: {e}
+	Earlier in tab order	Раніше в порядку табуляції
+	Later in tab order	Пізніше в порядку табуляції
+	From:	Від:
+	To:	До:
+	High Resolution	Висока роздільна здатність
+	Print	Друк
+	Verify to see what the document needs.	Виконайте перевірку, щоб з’ясувати потреби документа.
+	Set Page Boxes	Задати межі сторінок
+	Signature panel	Панель підписів
+	{month} {day}, {y}	{day} {month} {y}
+	The document's security settings don't allow filling in form fields	Налаштування захисту документа не дозволяють заповнювати поля форми
+	{name} is read-only	{name} доступне лише для читання
+	{name} has no action	{name} не має дії
+	Previous month	Попередній місяць
+	Next month	Наступний місяць
+	January	Січень
+	February	Лютий
+	March	Березень
+	April	Квітень
+	May	Травень
+	June	Червень
+	July	Липень
+	August	Серпень
+	September	Вересень
+	October	Жовтень
+	November	Листопад
+	December	Грудень
+	Done	Готово
+	This certificate is in your list of trusted certificates.	Цей сертифікат є у вашому списку довірених сертифікатів.
+	This certificate is trusted through a certificate above it in the chain.	Цей сертифікат є довіреним завдяки сертифікату вище в ланцюжку.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Цей сертифікат не є довіреним. Підписи, створені ним, мають невідому особу підписувача.
+	Add to Trusted Certificates	Додати до довірених сертифікатів
+	Export…	Експортувати…
+	PDF Optimizer	Оптимізатор PDF
+	Discard Objects	Видалення об’єктів
+	Discard User Data	Видалення даних користувача
+	Clean Up	Очищення
+	Color Images	Кольорові зображення
+	Grayscale Images	Зображення у відтінках сірого
+	Bicubic downsampling to	Бікубічне зниження роздільної здатності до
+	for images above	для зображень із роздільною здатністю понад
+	Compression	Стиснення
+	ZIP	ZIP
+	Retain existing	Зберегти наявне
+	Minimum	Мінімальна
+	Low	Низька
+	High	Висока
+	Maximum	Максимальна
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Кожне зображення вимірюється там, де його відтворюють сторінки; зображення замінюється лише тоді, коли результат менший.
+	Discard all links, actions and JavaScript	Видалити всі посилання, дії та JavaScript
+	Discard alternate images	Видалити альтернативні зображення
+	Discard embedded page thumbnails	Видалити вбудовані мініатюри сторінок
+	Discard document tags	Видалити теги документа
+	Discard embedded print settings	Видалити вбудовані налаштування друку
+	Discard bookmarks	Видалити закладки
+	Discard hidden layer content	Видалити вміст прихованих шарів
+	Discard all comments, forms and multimedia	Видалити всі коментарі, форми й мультимедіа
+	Discard document information and metadata	Видалити відомості про документ і метадані
+	Discard all object data (file attachments)	Видалити всі дані об’єктів (файлові вкладення)
+	Discard private data of other applications	Видалити приватні дані інших застосунків
+	Discard hidden text	Видалити прихований текст
+	Use Flate to encode streams that are not encoded	Кодувати незакодовані потоки за допомогою Flate
+	Remove invalid links and bookmarks	Видалити недійсні посилання й закладки
+	Remove unreferenced named destinations	Видалити іменовані призначення без посилань
+	Compress document structure (object streams)	Стиснути структуру документа (потоки об’єктів)
+	Remove unused objects and merge identical ones	Видалити невикористані об’єкти й об’єднати однакові
+	Audit space usage…	Аналіз використання місця…
+	Space Audit	Аналіз місця
+	Bytes	Байти
+	Content Streams	Потоки вмісту
+	X Object Forms	Форми XObject
+	Structure Info	Відомості про структуру
+	Thumbnails	Мініатюри
+	Named Destinations	Іменовані призначення
+	Color Spaces	Колірні простори
+	Shadings	Градієнтні заливки
+	Patterns (graphics objects)	Візерунки (графічні об’єкти)
+	Extended Graphics States	Розширені графічні стани
+	Embedded Files	Вбудовані файли
+	Document Overhead	Службові дані документа
+	Total	Усього
+	Text Field Properties	Властивості текстового поля
+	Check Box Properties	Властивості прапорця
+	Radio Button Properties	Властивості перемикача
+	Dropdown Properties	Властивості розкривного списку
+	List Box Properties	Властивості списку
+	Button Properties	Властивості кнопки
+	Digital Signature Properties	Властивості цифрового підпису
+	Position	Положення
+	Options	Параметри
+	Validate	Перевірка
+	Calculate	Обчислення
+	Actions	Дії
+	This field is locked. Unlock it to change its properties.	Це поле заблоковано. Розблокуйте його, щоб змінити властивості.
+	Tooltip:	Підказка:
+	Common Properties	Загальні властивості
+	Read Only	Лише для читання
+	Required	Обов’язкове
+	Font Size:	Розмір шрифту:
+	Auto	Автоматично
+	Text Color:	Колір тексту:
+	Borders and Colors	Рамки й кольори
+	Border Color:	Колір рамки:
+	Fill Color:	Колір заливки:
+	No color	Без кольору
+	Beveled	Скошена
+	Left:	Зліва:
+	Bottom:	Знизу:
+	Width:	Ширина:
+	Height:	Висота:
+	Points from the page's bottom-left corner.	Пункти від нижнього лівого кута сторінки.
+	Alignment:	Вирівнювання:
+	Default Value:	Типове значення:
+	Multi-line	Багаторядкове
+	Scroll long text	Прокручувати довгий текст
+	Allow Rich Text Formatting	Дозволити форматування тексту
+	Limit of	Обмеження:
+	characters	символів
+	Field is used for file selection	Поле використовується для вибору файлу
+	Check spelling	Перевіряти правопис
+	Comb of	Комірки для
+	Export Value: {on}	Значення експорту: {on}
+	Check box is checked by default	Прапорець типово встановлено
+	Button is checked by default	Кнопку типово вибрано
+	Buttons with the same name and value are selected in unison	Кнопки з однаковими назвою й значенням вибираються разом
+	Item:	Елемент:
+	Item List	Список елементів
+	Up	Угору
+	Delete {o}	Видалити {o}
+	Add the choices people pick from.	Додайте варіанти, з яких користувачі вибиратимуть.
+	Default:	Типово:
+	(none)	(немає)
+	Sort items	Сортувати елементи
+	Allow user to enter custom text	Дозволити користувачу вводити власний текст
+	Multiple selection	Множинний вибір
+	Commit selected value immediately	Одразу застосовувати вибране значення
+	Number	Число
+	Percentage	Відсоток
+	Time	Час
+	Special	Спеціальний
+	Select format category:	Виберіть категорію формату:
+	The value is shown as typed.	Значення відображається як введено.
+	Decimal places:	Знаків після коми:
+	Separator style:	Стиль роздільників:
+	Currency symbol:	Символ валюти:
+	Before the number	Перед числом
+	Negative number style:	Стиль від’ємних чисел:
+	Format:	Формат:
+	Custom:	Власний:
+	Zip Code	Поштовий індекс
+	Zip Code + 4	Поштовий індекс + 4
+	Phone Number	Номер телефону
+	Social Security Number	Номер соціального страхування
+	Arbitrary Mask	Довільна маска
+	Mask:	Маска:
+	9 digit, A letter, O letter or digit, X any character	9 — цифра, A — літера, O — літера або цифра, X — будь-який символ
+	Example: {sample}	Приклад: {sample}
+	Field value is not validated	Значення поля не перевіряється
+	Field value is in range:	Значення поля в діапазоні:
+	Add an Action	Додати дію
+	Select Trigger:	Виберіть подію:
+	Mouse Up	Відпускання кнопки миші
+	Mouse Down	Натискання кнопки миші
+	Mouse Enter	Наведення вказівника
+	Mouse Exit	Вихід вказівника
+	On Focus	Отримання фокуса
+	On Blur	Втрата фокуса
+	Select Action:	Виберіть дію:
+	Open a web link	Відкрити вебпосилання
+	Reset a form	Скинути форму
+	Execute a menu item	Виконати пункт меню
+	Show a field	Показати поле
+	Hide a field	Приховати поле
+	Submit a form	Надіслати форму
+	Fields to reset (comma-separated; empty: all)	Поля для скидання (через кому; порожньо: усі)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage або LastPage
+	Field names (comma-separated)	Назви полів (через кому)
+	URL to submit to	URL для надсилання
+	Script:	Сценарій:
+	Value:	Значення:
+	No actions	Немає дій
+	Value is not calculated	Значення не обчислюється
+	Value is the	Значення — це
+	sum (+)	сума (+)
+	product (x)	добуток (x)
+	average	середнє
+	minimum	мінімум
+	maximum	максимум
+	of the following fields:	таких полів:
+	Simplified field notation:	Спрощений запис полів:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Назви полів із + - * / та дужками; перед пробілами в назвах ставте \\.
+	Format text	Форматувати текст
+	Bold	Напівжирний
+	Italic	Курсив
+	Align left	Вирівняти ліворуч
+	Centre	По центру
+	Align right	Вирівняти праворуч
+	Justify	За шириною
+	Standard fonts; text outside Windows-1252 isn't supported yet.	Стандартні шрифти; текст поза Windows-1252 ще не підтримується.
+	Edit image	Редагувати зображення
+	Rotate counterclockwise	Повернути проти годинникової стрілки
+	Rotate clockwise	Повернути за годинниковою стрілкою
+	Flip horizontal	Віддзеркалити горизонтально
+	Flip vertical	Віддзеркалити вертикально
+	Replace image	Замінити зображення
+	Crop (% trimmed from each side)	Обтинання (% з кожного боку)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Клацніть на сторінці, щоб додати текст; кожне клацання створює нове поле, а ✓ завершує. Перетягуйте елементи, щоб перемістити їх, тягніть за кут, щоб змінити розмір, двічі клацніть текст, щоб редагувати його.
+	Choose an image	Вибрати зображення
+	Export to Image	Експортувати в зображення
+	Export to Text	Експортувати в текст
+	Export All Images	Експортувати всі зображення
+	Resolution	Роздільна здатність
+	Format	Формат
+	Quality	Якість
+	One {f} file per page, named after the document.	Один файл {f} на сторінку з назвою документа.
+	Exclude images smaller than	Виключити зображення, менші за
+	No limit	Без обмежень
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Кожне зображення один раз, із назвою документа й сторінки. Зображення JPEG зберігаються без змін; решта — як PNG.
+	Plain text in reading order; pages are separated by form feeds.	Звичайний текст у порядку читання; сторінки розділено символами переведення сторінки.
+	Create {what}	Створити {what}
+	initials	ініціали
+	signature	підпис
+	Create Custom Stamp	Створити власний штамп
+	From {file}	Із {file}
+	Category:	Категорія:
+	e.g. My stamps	наприклад Мої штампи
+	Name:	Назва:
+	Custom	Власний
+	Delete stamp	Видалити штамп
+	Create custom stamp…	Створити власний штамп…
+	From a PDF page or an image	Із сторінки PDF або зображення
+	Line spacing	Міжрядковий інтервал
+	Character spacing	Міжсимвольний інтервал
+	Horizontal scale	Горизонтальний масштаб
+	Rotate Clockwise	Повернути за годинниковою стрілкою
+	Rotate Counterclockwise	Повернути проти годинникової стрілки
+	Flip Horizontal	Віддзеркалити горизонтально
+	Flip Vertical	Віддзеркалити вертикально
+	Replace Image…	Замінити зображення…
+	Save Image As…	Зберегти зображення як…
+	Check for updates	Перевірити оновлення
+	No check has run yet.	Перевірку ще не виконано.
+	Checking for a newer version…	Перевірка наявності новішої версії…
+	PdfCraft {v} is available.	Доступна версія PdfCraft {v}.
+	You have version {c}. Download the new version from its release page.	У вас версія {c}. Завантажте нову версію зі сторінки випуску.
+	PdfCraft {c} is up to date.	Ваша версія PdfCraft {c} актуальна.
+	Couldn't check for updates: {e}	Не вдалося перевірити оновлення: {e}
+	You have version {c}. All releases are listed at {page}.	У вас версія {c}. Усі випуски наведено на {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Запитує в GitHub найновіший випуск. Нічого не завантажується й не встановлюється автоматично.
+	Download	Завантажити
+	Later	Пізніше
+	none	немає
+	Declared conformance: {shown}	Заявлена відповідність: {shown}
+	Output intent: {list}	Профіль виводу: {list}
+	Conformance level:	Рівень відповідності:
+	No problems found: the document conforms to {level}.	Проблем не виявлено: документ відповідає {level}.
+	 (page {p})	 (сторінка {p})
+	  · not fixable here	  · тут неможливо виправити
+	Verify	Перевірити
+	Box	Область
+	Units	Одиниці
+	Set to zero	Установити нуль
+	Current page ({n})	Поточна сторінка ({n})
+	Subset	Підмножина
+	Update	Оновити
+	Add	Додати
+	{verb} Header and Footer	{verb}: колонтитули
+	{verb} Watermark	{verb}: водяний знак
+	{verb} Background	{verb}: тло
+	Margins (in)	Поля (дюйми)
+	Left Header Text	Текст ліворуч у верхньому колонтитулі
+	Center Header Text	Текст по центру у верхньому колонтитулі
+	Right Header Text	Текст праворуч у верхньому колонтитулі
+	Left Footer Text	Текст ліворуч у нижньому колонтитулі
+	Center Footer Text	Текст по центру у нижньому колонтитулі
+	Right Footer Text	Текст праворуч у нижньому колонтитулі
+	Insert Page Number	Вставити номер сторінки
+	Insert Date	Вставити дату
+	Start page number	Початковий номер сторінки
+	Source	Джерело
+	Fit to page	За розміром сторінки
+	Rotation	Поворот
+	Appear behind page	Позаду сторінки
+	Appear on top of page	Поверх сторінки
+	From colour	Із кольору
+	Page Range Options	Параметри діапазону сторінок
+	Preview: page {p} of {n}	Попередній перегляд: сторінка {p} із {n}
+	Applies to 1 page	Застосовується до 1 сторінки
+	Applies to {n} pages	Застосовується до {n} сторінок
+	Replaces the existing one on those pages.	Замінює наявний елемент на цих сторінках.
+	PDF or image	PDF або зображення
+	No file chosen	Файл не вибрано
+	Page number	Номер сторінки
+	Scale relative to target page	Масштаб відносно цільової сторінки
+	Link Properties	Властивості посилання
+	Create Link	Створити посилання
+	Link Appearance	Вигляд посилання
+	Link Type:	Тип посилання:
+	Visible Rectangle	Видимий прямокутник
+	Invisible Rectangle	Невидимий прямокутник
+	Highlight Style:	Стиль підсвічування:
+	Invert	Інверсія
+	Outline	Контур
+	Inset	Заглиблення
+	Line Thickness:	Товщина лінії:
+	Thin	Тонка
+	Thick	Товста
+	Line Style:	Стиль лінії:
+	Solid	Суцільна
+	Dashed	Штрихова
+	Color:	Колір:
+	Link Action	Дія посилання
+	Open a web page	Відкрити вебсторінку
+	Go to a page view	Перейти до вигляду сторінки
+	Type the web address.	Введіть вебадресу.
+	This document has no signatures.	Цей документ не має підписів.
+	The Keychain's digital IDs couldn't be listed: {e}	Не вдалося отримати список цифрових посвідчень із В’язки ключів: {e}
+	Signed and saved to {path}	Підписано й збережено в {path}
+	Couldn't open revision {n}: {e}	Не вдалося відкрити редакцію {n}: {e}
+	Couldn't open the signed version: {e}	Не вдалося відкрити підписану версію: {e}
+	Sign with a Digital ID	Підписати цифровим посвідченням
+	Choose the digital ID that you want to use for signing:	Виберіть цифрове посвідчення для підписування:
+	Keychain  ·  	В’язка ключів  ·  
+	Windows store  ·  	Сховище Windows  ·  
+	Issued by: 	Видавець: 
+	, Expires: 	, Дійсний до: 
+	No digital IDs yet.	Ще немає цифрових посвідчень.
+	Configure New Digital ID	Налаштувати нове цифрове посвідчення
+	Continue	Продовжити
+	Configure a Digital ID for Signing	Налаштувати цифрове посвідчення для підписування
+	Use a Digital ID from a file	Використати цифрове посвідчення з файлу
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Створити нове цифрове посвідчення (самопідписане, збережене у файлі, захищеному паролем)
+	Name	Ім’я
+	Organizational Unit	Підрозділ організації
+	Organization Name	Назва організації
+	Email Address	Адреса електронної пошти
+	Country/Region	Країна/регіон
+	Key Algorithm	Алгоритм ключа
+	Confirm Password	Підтвердьте пароль
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Дійсне протягом 5 років, для цифрових підписів. Інші зазвичай не довіряють самопідписаним посвідченням.
+	File (.p12, .pfx)	Файл (.p12, .pfx)
+	Digital ID	Цифрове посвідчення
+	Browse…	Огляд…
+	{verb} as "{name}"	{verb} як «{name}»
+	Certify	Засвідчити
+	The signature will be invisible.	Підпис буде невидимим.
+	Distinguished name	Розпізнавальне ім’я
+	Labels	Позначки
+	Permitted actions after certifying	Дозволені дії після засвідчення
+	No changes allowed	Зміни заборонено
+	Annotations, form fill-in, and digital signatures	Коментарі, заповнення форми й цифрові підписи
+	Form fill-in and digital signatures	Заповнення форми й цифрові підписи
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	Ключ у В’язці ключів macOS, яка може запитати дозвіл на його використання PdfCraft.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	Ключ у сховищі сертифікатів Windows, яке може запитати дозвіл на його використання PdfCraft.
+	Digital ID password	Пароль цифрового посвідчення
+	Back	Назад
+	Validate all	Перевірити все
+	Sign this field…	Підписати це поле…
+	Signature is valid:	Підпис дійсний:
+	Signature validity is UNKNOWN:	Дійсність підпису НЕВІДОМА:
+	Signature is INVALID:	Підпис НЕДІЙСНИЙ:
+	Signature Details	Відомості про підпис
+	Reason	Причина
+	Signing time	Час підписування
+	Algorithm	Алгоритм
+	Signer	Підписувач
+	Issued by	Видавець
+	Valid	Дійсний
+	Field	Поле
+	Field: {field} on page {p}	Поле: {field} на сторінці {p}
+	Add to trusted certificates	Додати до довірених сертифікатів
+	View signed version	Переглянути підписану версію
+	Show certificate…	Показати сертифікат…
+	Export certificate…	Експортувати сертифікат…
+	Certificate Viewer	Перегляд сертифіката
+	This dialog shows the details of a certificate and its chain.	Це вікно показує відомості про сертифікат і його ланцюжок.
+	Trust	Довіра
+	Issued to	Кому видано
+	Valid from	Дійсний від
+	Valid to	Дійсний до
+	Intended usage	Призначення
+	Any	Будь-яке
+	Version	Версія
+	Serial number	Серійний номер
+	Issuer	Видавець
+	Validity starts	Початок строку дії
+	Validity ends	Кінець строку дії
+	Public key	Відкритий ключ
+	Key usage	Використання ключа
+	Not present	Відсутнє
+	Self-signed	Самопідписаний
+	Edit Action	Редагувати дію
+	New Action	Нова дія
+	Action name:	Назва дії:
+	Description:	Опис:
+	Steps	Кроки
+	Add the steps this action runs, in order.	Додайте кроки, які ця дія виконуватиме, у потрібному порядку.
+	Add Step	Додати крок
+	An action with this name already exists.	Дія з такою назвою вже існує.
+	New Action…	Нова дія…
+	Edit…	Редагувати…
+	Add watermark	Додати водяний знак
+	Add header	Додати верхній колонтитул
+	Add footer	Додати нижній колонтитул
+	Set document title	Задати заголовок документа
+	Run a JavaScript	Виконати JavaScript
+	Prepare for Distribution	Підготувати до розповсюдження
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Видалити приховану інформацію та звести коментарі й поля форми, щоб одержувачі бачили лише сторінки.
+	Optimize Scanned Documents	Оптимізувати відскановані документи
+	Make scans searchable, then make them smaller.	Додати пошук у сканах, а потім зменшити їхній розмір.
+	Add Page Numbers	Додати номери сторінок
+	Number every page in the footer.	Пронумерувати кожну сторінку в нижньому колонтитулі.
+	Mark as Confidential	Позначити як конфіденційне
+	A diagonal CONFIDENTIAL watermark on every page.	Діагональний водяний знак CONFIDENTIAL на кожній сторінці.
+	Sanitize Documents	Очистити документи від конфіденційних даних
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Видалити приховану інформацію, метадані, сценарії та вбудований вміст і перезаписати файли.
+	Type text	Ввести текст
+	Text to insert	Текст для вставлення
+	Replacement text	Текст заміни
+	Edit text…	Редагувати текст…
+	Add a sticky note here	Додати нотатку тут
+	{kind} Properties	Властивості: {kind}
+	Appearance	Вигляд
+	General	Загальні
+	Review History	Історія рецензування
+	This comment's appearance can't be changed yet.	Вигляд цього коментаря поки неможливо змінити.
+	Icon	Піктограма
+	Thickness	Товщина
+	Modified	Змінено
+	No status has been set.	Статус не задано.
+	Compare Files	Порівняти файли
+	Old file:	Старий файл:
+	Open the older version first	Спочатку відкрийте старішу версію
+	New file:	Новий файл:
+	Text is compared word by word; the differences are shown on the new file.	Текст порівнюється слово за словом; відмінності показано в новому файлі.
+	Compare this file with an older version: Compare files… in All tools.	Порівняйте цей файл зі старішою версією: «Порівняти файли…» в розділі «Усі інструменти».
+	No differences in the text.	Відмінностей у тексті немає.
+	{n} {kind}	{n} {kind}
+	Inserted	Вставлено
+	Deleted	Видалено
+	Replaced	Замінено
+	Visual	Візуальні
+	Mark as comments	Позначити як коментарі
+	Report…	Звіт…
+	{kind} · page {p}	{kind} · сторінка {p}
+	Set Alternate Text	Задати альтернативний текст
+	This document has no tagged figures.	У цьому документі немає рисунків із тегами.
+	 on page {p}	 на сторінці {p}
+	Figure {i} of {n}{page}	Рисунок {i} із {n}{page}
+	No preview	Немає попереднього перегляду
+	Alternate text	Альтернативний текст
+	Describe the figure	Опишіть рисунок
+	Decorative figure	Декоративний рисунок
+	Previous figure	Попередній рисунок
+	Next figure	Наступний рисунок
+	Save & Close	Зберегти й закрити
+	Accessibility Checker Options	Параметри перевірки доступності
+	Report Options	Параметри звіту
+	Create accessibility report	Створити звіт про доступність
+	Page Range	Діапазон сторінок
+	All pages in document	Усі сторінки документа
+	Checking Options ({on} of 32 in all categories)	Параметри перевірки ({on} із 32 в усіх категоріях)
+	Show this dialog when the Checker starts	Показувати це вікно під час запуску перевірки
+	Select All	Вибрати все
+	Clear All	Очистити все
+	Start Checking	Почати перевірку
+	This document hasn't been checked yet.	Цей документ ще не перевірено.
+	No issues found	Проблем не виявлено
+	1 issue	1 проблема
+	{n} issues	Проблем: {n}
+	{label} (1 issue)	{label} (1 проблема)
+	{label} ({n} issues)	{label} (проблем: {n})
+	Check again	Перевірити ще раз
+	Report	Звіт
+	Show the accessibility report	Показати звіт про доступність
+	Collapse	Згорнути
+	Expand	Розгорнути
+	{rule} - {status}	{rule} - {status}
+	Passed	Успішно
+	Failed	Не пройдено
+	Needs manual check	Потрібна ручна перевірка
+	Skipped	Пропущено
+	Fix	Виправити
+	Skip Rule	Пропустити правило
+	Explain	Пояснити
+	Check Again	Перевірити ще раз
+	Show Report	Показати звіт
+	Options…	Параметри…
+	Go to the page	Перейти до сторінки
+	Page Content	Вміст сторінки
+	Forms	Форми
+	Alternate Text	Альтернативний текст
+	Tables	Таблиці
+	Lists	Списки
+	Headings	Заголовки
+	Accessibility permission flag	Прапорець дозволу доступності
+	Accessibility permission flag is set	Прапорець дозволу доступності встановлено
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Налаштування захисту мають дозволяти допоміжним технологіям читати вміст («Увімкнути доступ до тексту для засобів читання з екрана»). Змініть захист документа, щоб дозволити це.
+	Image-only PDF	PDF лише із зображень
+	Document is not image-only PDF	Документ містить не лише зображення
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Сторінки, які є лише зображеннями тексту, неможливо прочитати вголос або шукати. Розпізнайте текст (OCR), щоб додати текстовий шар.
+	Document is tagged PDF	Документ є PDF із тегами
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	Теги надають документу логічну структуру для допоміжних технологій. Додайте теги до документа («Автоматично додати теги до PDF»).
+	Logical Reading Order	Логічний порядок читання
+	Document structure provides a logical reading order	Структура документа забезпечує логічний порядок читання
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Перевірте, чи теги читаються в тому порядку, у якому читав би зрячий читач. Виправте порядок інструментом порядку читання або на панелі тегів.
+	Primary language	Основна мова
+	Text language is specified	Мову тексту вказано
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	Засоби читання з екрана вибирають голос відповідно до мови документа. Задайте її в «Властивості документа > Додаткові > Мова».
+	Document title is showing in title bar	Заголовок документа показано в заголовку вікна
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Вікно має показувати змістовний заголовок замість назви файлу. Задайте заголовок і «Початковий вигляд > Показувати: Заголовок документа».
+	Bookmarks are present in large documents	У великих документах є закладки
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	Документи з понад 20 сторінками потребують закладок для навігації. Додайте закладки до основних розділів.
+	Color contrast	Колірний контраст
+	Document has appropriate color contrast	Документ має належний колірний контраст
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	Текст має достатньо контрастувати з тлом для людей зі слабким зором. Перевірте кольори візуально або інструментом перевірки контрасту.
+	Tagged content	Вміст із тегами
+	All page content is tagged	Увесь вміст сторінок має теги
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Усе на сторінці має бути позначено тегами або як артефакт (оздоблення, колонтитули). Додайте теги до непозначеного вмісту.
+	Tagged annotations	Коментарі з тегами
+	All annotations are tagged	Усі коментарі мають теги
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Коментарі, посилання й поля мають бути в дереві тегів, щоб їх озвучували. Додайте теги до коментарів.
+	Tab order	Порядок табуляції
+	Tab order is consistent with structure order	Порядок табуляції відповідає порядку структури
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	На сторінках із посиланнями, коментарями чи полями табуляція має відповідати порядку структури. Виправлення задає для кожної сторінки порядок «За структурою документа».
+	Character encoding	Кодування символів
+	Reliable character encoding is provided	Забезпечено надійне кодування символів
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	Шрифти мають зіставляти символи з Unicode, щоб текст можна було читати й копіювати. Виправте шрифти або створіть PDF заново.
+	Tagged multimedia	Мультимедіа з тегами
+	All multimedia objects are tagged	Усі мультимедійні об’єкти мають теги
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	Відео, звук та інтерактивне мультимедіа повинні мати теги для озвучення. Додайте теги до мультимедійних коментарів.
+	Screen flicker	Мерехтіння екрана
+	Page will not cause screen flicker	Сторінка не спричинятиме мерехтіння екрана
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	Мерехтлива анімація може спричиняти напади. Перевірте сценарії та медіа на мерехтіння.
+	Scripts	Сценарії
+	No inaccessible scripts	Немає недоступних сценаріїв
+	Timed responses	Відповіді з обмеженням часу
+	Page does not require timed responses	Сторінка не потребує відповідей з обмеженням часу
+	People may need more time to respond. Check that nothing has a time limit.	Людям може знадобитися більше часу для відповіді. Перевірте відсутність часових обмежень.
+	Navigation links	Навігаційні посилання
+	Navigation links are not repetitive	Навігаційні посилання не повторюються
+	Repeated navigation links should be skippable. Check links that appear on every page.	Повторювані навігаційні посилання має бути можливо пропускати. Перевірте посилання, що є на кожній сторінці.
+	Tagged form fields	Поля форми з тегами
+	All form fields are tagged	Усі поля форми мають теги
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Поля форми мають бути в дереві тегів (теги Form), щоб їх озвучували. Додайте теги до полів форми.
+	Field descriptions	Описи полів
+	All form fields have description	Усі поля форми мають опис
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Кожне поле потребує підказки про те, що слід увести. Додайте її в «Властивості поля > Загальні > Підказка».
+	Figures alternate text	Альтернативний текст рисунків
+	Figures require alternate text	Рисунки потребують альтернативного тексту
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	Зображення потребують альтернативного тексту з описом або позначки декоративного рисунка. Додайте альтернативний текст до кожного рисунка.
+	Nested alternate text	Вкладений альтернативний текст
+	Alternate text that will never be read	Альтернативний текст, який ніколи не буде прочитано
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Альтернативний текст усередині елемента, який уже має альтернативний текст, ніколи не читається. Видаліть внутрішній альтернативний текст.
+	Associated with content	Пов’язаний із вмістом
+	Alternate text must be associated with some content	Альтернативний текст має бути пов’язаний із вмістом
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Альтернативний текст елемента без вмісту сторінки ніколи не буде прочитано. Видаліть його або пов’яжіть елемент із вмістом.
+	Hides annotation	Приховує коментар
+	Alternate text should not hide annotation	Альтернативний текст не має приховувати коментар
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Альтернативний текст елемента, що містить посилання чи поле, приховує цей коментар від допоміжних технологій. Перемістіть альтернативний текст.
+	Other elements alternate text	Альтернативний текст інших елементів
+	Other elements that require alternate text	Інші елементи, які потребують альтернативного тексту
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Формули та подібні нетекстові елементи потребують альтернативного тексту. Додайте його до них.
+	Rows	Рядки
+	TR must be a child of Table, THead, TBody, or TFoot	TR має бути дочірнім елементом Table, THead, TBody або TFoot
+	Table cells belong in a row. Fix the table's tags.	Комірки таблиці мають належати рядку. Виправте теги таблиці.
+	Headers	Заголовки
+	Tables should have headers	Таблиці повинні мати заголовки
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	Комірки заголовків (TH) пояснюють слухачам, що містить кожен стовпець чи рядок. Позначте комірки заголовків.
+	Regularity	Регулярність
+	Tables must contain the same number of columns in each row and rows in each column	Таблиці мають містити однакову кількість стовпців у кожному рядку й рядків у кожному стовпці
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	Нерегулярні таблиці ускладнюють навігацію комірками. Надайте кожному рядку однакову кількість комірок (з урахуванням об’єднання).
+	Summary	Зведення
+	Tables must have a summary	Таблиці повинні містити зведення
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Зведення описує призначення й будову таблиці. Додайте атрибут Summary до кожної таблиці.
+	List items	Елементи списку
+	LI must be a child of L	LI має бути дочірнім елементом L
+	List items belong in a list. Fix the list's tags.	Елементи списку мають належати списку. Виправте теги списку.
+	Lbl and LBody	Lbl і LBody
+	Lbl and LBody must be children of LI	Lbl і LBody мають бути дочірніми елементами LI
+	List labels and bodies belong in a list item. Fix the list's tags.	Позначки й вміст списку мають належати елементу списку. Виправте теги списку.
+	Appropriate nesting	Належна вкладеність
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	Рівні заголовків не мають пропускатися (H1, за яким іде H3). Змініть теги заголовків.
+	TH and TD	TH і TD
+	TH and TD must be children of TR	TH і TD мають бути дочірніми елементами TR
+	Mark Page Range	Позначити діапазон сторінок
+	Pages from	Сторінки від
+	Single word or phrase	Окреме слово або фраза
+	Text to find	Текст для пошуку
+	Patterns	Шаблони
+	Phone Numbers	Номери телефонів
+	Email Addresses	Адреси електронної пошти
+	Credit Cards	Кредитні картки
+	Social Security Numbers	Номери соціального страхування
+	Dates	Дати
+	Text in images isn't found; recognise text (OCR) first.	Текст у зображеннях не знаходиться; спочатку розпізнайте текст (OCR).
+	No matches.	Збігів немає.
+	{n} match(es) marked for redaction.	Збігів, позначених для вилучення: {n}.
+	Redaction Tool Properties	Властивості інструмента вилучення вмісту
+	Redacted area fill colour:	Колір заливки вилученої області:
+	Use overlay text	Використовувати накладений текст
+	Custom text:	Власний текст:
+	Font:	Шрифт:
+	Font size:	Розмір шрифту:
+	Auto-size text to fit redaction region	Автоматично добирати розмір тексту до області вилучення
+	Font colour:	Колір шрифту:
+	Repeat overlay text	Повторювати накладений текст
+	Text alignment:	Вирівнювання тексту:
+	Center	По центру
+	Apply redactions	Застосувати вилучення вмісту
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Ви збираєтеся застосувати 1 позначку вилучення. Текст, зображення й малюнки під позначками, а також коментарі й поля форми, що їх перекривають, буде видалено назавжди.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Ви збираєтеся застосувати позначки вилучення: {n}. Текст, зображення й малюнки під позначками, а також коментарі й поля форми, що їх перекривають, буде видалено назавжди.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	Після цього збережіть документ: збереження перезаписує весь файл, щоб у ньому не залишилося слідів вилученого вмісту.
+	Select the items to remove from this document.	Виберіть елементи для видалення з цього документа.
+	Metadata	Метадані
+	File attachments	Файлові вкладення
+	Comments and markups	Коментарі й розмітка
+	Hidden text	Прихований текст
+	Hidden layers	Приховані шари
+	Links, actions and JavaScripts	Посилання, дії та сценарії JavaScript
+	Private data of other applications	Приватні дані інших застосунків
+	None found	Нічого не знайдено
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Поля форми зводяться: їхні значення залишаються видимими. Збереження перезаписує весь файл.
+	Remove	Видалити
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	Очищення видаляє приховану інформацію з документа: метадані, файлові вкладення, коментарі, поля форми (зводяться), прихований текст і шари, закладки, посилання, дії та сценарії, а також приватні дані застосунків.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	Після цього збережіть документ; збереження перезаписує весь файл, щоб у ньому не залишилося видалених даних.
+	Printer:	Принтер:
+	Save as PDF	Зберегти як PDF
+	{name} (default)	{name} (типовий)
+	Copies:	Копії:
+	Collate	Зібрати за копіями
+	Print in grayscale	Друкувати у відтінках сірого
+	Two-sided:	Двобічний друк:
+	Off	Вимкнено
+	Flip on long edge	Перевертати за довгим краєм
+	Flip on short edge	Перевертати за коротким краєм
+	Paper:	Папір:
+	Pages to Print	Сторінки для друку
+	More options:	Додаткові параметри:
+	All pages in range	Усі сторінки діапазону
+	Odd pages only	Лише непарні сторінки
+	Even pages only	Лише парні сторінки
+	Reverse pages	Зворотний порядок сторінок
+	Page Sizing & Handling	Розмір і розміщення сторінок
+	Size	Розмір
+	Poster	Плакат
+	Multiple	Кілька сторінок
+	Booklet	Буклет
+	Fit	Припасувати
+	Shrink oversized pages	Зменшувати завеликі сторінки
+	Custom scale:	Власний масштаб:
+	Tile scale:	Масштаб фрагментів:
+	Overlap:	Перекриття:
+	Cut marks	Мітки різання
+	Pages per sheet:	Сторінок на аркуші:
+	Page order:	Порядок сторінок:
+	Horizontal	Горизонтально
+	Horizontal reversed	Горизонтально у зворотному порядку
+	Vertical	Вертикально
+	Vertical reversed	Вертикально у зворотному порядку
+	Print page border	Друкувати рамку сторінки
+	Auto-rotate pages	Автоматично повертати сторінки
+	Booklet subset:	Частина буклета:
+	Both sides	Обидва боки
+	Front side only	Лише лицьовий бік
+	Back side only	Лише зворотний бік
+	Binding:	Корінець:
+	Left	Ліворуч
+	Right	Праворуч
+	Orientation:	Орієнтація:
+	Auto portrait/landscape	Автоматично: книжкова/альбомна
+	Portrait	Книжкова
+	Landscape	Альбомна
+	Comments & Forms	Коментарі й форми
+	Document	Документ
+	Document and markups	Документ і розмітка
+	Document and stamps	Документ і штампи
+	Form fields only	Лише поля форми
+	Previous sheet	Попередній аркуш
+	Next sheet	Наступний аркуш
+	No sheets	Немає аркушів
+	Sheet {s} of {n}	Аркуш {s} із {n}
+	Removed 1 hidden item. Save to remove them from the file.	Видалено 1 прихований елемент. Збережіть, щоб видалити його з файлу.
+	Removed {n} hidden items. Save to remove them from the file.	Видалено прихованих елементів: {n}. Збережіть, щоб видалити їх із файлу.
+	Document sanitized. Save to finish: saving rewrites the whole file.	Документ очищено. Збережіть для завершення: збереження перезаписує весь файл.
+	Applied 1 redaction mark. Save to remove the content from the file.	Застосовано 1 позначку вилучення. Збережіть, щоб видалити вміст із файлу.
+	Applied {n} redaction marks. Save to remove the content from the file.	Застосовано позначок вилучення: {n}. Збережіть, щоб видалити вміст із файлу.
+	JavaScript Console	Консоль JavaScript
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript вимкнено («Налаштування > JavaScript»).
+	Output appears here.	Тут з’являється вивід.
+	Script Name:	Назва сценарію:
+	This document has no document-level scripts.	Цей документ не має сценаріїв рівня документа.
+	No form fields were detected	Полів форми не виявлено
+	Detected 1 form field	Виявлено 1 поле форми
+	Detected {n} form fields	Виявлено полів форми: {n}
+	{field}: {e}	{field}: {e}
+	Current page	Поточна сторінка
+	Selected pages	Вибрані сторінки
+	Document language	Мова документа
+	Output	Вивід
+	Searchable Image (Exact)	Зображення з пошуком (точне)
+	Adds invisible text over each word; the page image is not changed	Додає невидимий текст поверх кожного слова; зображення сторінки не змінюється
+	Downsample to	Знизити роздільну здатність до
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Розпізнавання тексту не встановлено: бракує моделей (виконайте `cargo xtask models` або задайте PRINTCRAFT_MODELS).
+	Settings	Налаштування
+	Optional	Необов’язково
+	Planned · {m}	Заплановано · {m}
+	Planned for milestone {m} — open to see what it will include	Заплановано на етап {m} — відкрийте, щоб побачити, що він міститиме
+	Coming in milestone {m}. Items marked Ready work today.	З’явиться на етапі {m}. Елементи з позначкою «Готово» вже працюють.
+	1 mark	1 позначка
+	{n} marks	Позначок: {n}
+	Dynamic	Динамічні
+	Sign Here	Підпишіть тут
+	Standard Business	Стандартні ділові
+	Choose a stamp, then click on the page to place it.	Виберіть штамп, а потім клацніть на сторінці, щоб розмістити його.
+	Note	Нотатка
+	Polyline	Ламана лінія
+	Attachment	Вкладення
+	Callout	Виноска
+	Typewriter	Друкований текст
+	Checked	Із позначкою
+	Unchecked	Без позначки
+	Marked	Позначено
+	Locked	Заблоковано
+	Search comments	Пошук коментарів
+	Add a comment	Додати коментар
+	No comments yet.	Ще немає коментарів.
+	Pick a tool in the quick bar, or type above.	Виберіть інструмент на панелі швидкого доступу або введіть текст вище.
+	No comments match.	Відповідних коментарів немає.
+	Unknown author	Невідомий автор
+	No colour	Без кольору
+	Remove checkmark	Зняти позначку
+	Mark with checkmark	Установити позначку
+	Reply	Відповісти
+	Add a reply	Додати відповідь
+	Post	Опублікувати
+	Page {label}	Сторінка {label}
+	{kind} — click to show it on the page	{kind} — клацніть, щоб показати на сторінці
+	Set status	Задати статус
+	Copy text	Копіювати текст
+	Properties…	Властивості…
+	Make Current Properties Default	Зробити поточні властивості типовими
+	More options	Додаткові параметри
+	Sort by	Сортувати за
+	Author	Автор
+	Type	Тип
+	Colour	Колір
+	Show all comments	Показати всі коментарі
+	Create PDF comment summary…	Створити PDF зі зведенням коментарів…
+	Export all to data file…	Експортувати все у файл даних…
+	Filter comments	Фільтрувати коментарі
+	Status	Статус
+	Accepted	Прийнято
+	Rejected	Відхилено
+	Cancelled	Скасовано
+	Completed	Завершено
+	Show all	Показати все
+	Yellow	Жовтий
+	Orange	Помаранчевий
+	Red	Червоний
+	Pink	Рожевий
+	Purple	Фіолетовий
+	Blue	Синій
+	Light blue	Блакитний
+	Green	Зелений
+	Gray	Сірий
+	Black	Чорний
+	Bookmark options	Параметри закладок
+	Expand all bookmarks	Розгорнути всі закладки
+	Expand top-level bookmarks	Розгорнути закладки верхнього рівня
+	Collapse all bookmarks	Згорнути всі закладки
+	New bookmark (⌘B)	Нова закладка (⌘B)
+	This document has no bookmarks.	Цей документ не має закладок.
+	This document has no layers.	Цей документ не має шарів.
+	This document has no attachments.	Цей документ не має вкладень.
+	Hide layer	Приховати шар
+	Show layer	Показати шар
+	Set layer visibility	Задати видимість шару
+	on page {label}	на сторінці {label}
+	Save attachment…	Зберегти вкладення…
+	Open in a new tab	Відкрити в новій вкладці
+	This document has no pages.	Цей документ не має сторінок.
+	Find text	Знайти текст
+	No matches	Збігів немає
+	Searching… {s}/{p}	Пошук… {s}/{p}
+	{c} of {n}{more}	{c} із {n}{more}
+	Previous (⇧⌘G)	Попередній (⇧⌘G)
+	Next (⌘G)	Наступний (⌘G)
+	Find options	Параметри пошуку
+	Whole words only	Лише цілі слова
+	Case-sensitive	З урахуванням регістру
+	Close (Esc)	Закрити (Esc)
+	Align	Вирівняти
+	Top	Зверху
+	Bottom	Знизу
+	Center horizontally	По центру горизонтально
+	Center vertically	По центру вертикально
+	Distribute	Розподілити
+	Horizontally	Горизонтально
+	Vertically	Вертикально
+	Set Fields to Same Size	Задати однаковий розмір полів
+	Height	Висота
+	Width	Ширина
+	Both	Обидва
+	Duplicate…	Дублювати…
+	All pages	Усі сторінки
+	Odd pages	Непарні сторінки
+	Even pages	Парні сторінки
+	Landscape pages	Альбомні сторінки
+	Portrait pages	Книжкові сторінки
+	Move earlier	Перемістити раніше
+	Move later	Перемістити пізніше
+	Back to the document	Назад до документа
+	Protect Using Password	Захистити паролем
+	Requires user to enter a password for:	Вимагати від користувача пароль для:
+	Viewing	Перегляду
+	Editing	Редагування
+	Type Password	Введіть пароль
+	Re-type Password	Повторіть пароль
+	Strength: {s}	Надійність: {s}
+	Strong	Надійний
+	Medium	Середній
+	Weak	Слабкий
+	Advanced Options {chevron}	Додаткові параметри {chevron}
+	Compatibility	Сумісність
+	Acrobat X and later (256-bit AES)	Acrobat X і новіші (256-бітний AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 і новіші (128-бітний AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 і новіші (128-бітний RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 і новіші (40-бітний RC4)
+	Encrypt	Зашифрувати
+	All document contents	Увесь вміст документа
+	All document contents except metadata	Увесь вміст документа, крім метаданих
+	Printing allowed	Дозволений друк
+	Low Resolution (150 dpi)	Низька роздільна здатність (150 dpi)
+	Changes allowed	Дозволені зміни
+	Inserting, deleting, and rotating pages	Вставлення, видалення й поворот сторінок
+	Filling in form fields and signing existing signature fields	Заповнення полів форми й підписування наявних полів підпису
+	Commenting, filling in form fields, and signing existing signature fields	Коментування, заповнення полів форми й підписування наявних полів підпису
+	Any except extracting pages	Будь-які, крім видобування сторінок
+	Enable copying of text, images, and other content	Дозволити копіювання тексту, зображень та іншого вмісту
+	Enable text access for screen reader devices for the visually impaired	Дозволити доступ до тексту засобам читання з екрана для людей із порушеннями зору
+	Type a password.	Введіть пароль.
+	The passwords don't match.	Паролі не збігаються.
+	This compatibility level supports only plain ASCII passwords.	Цей рівень сумісності підтримує лише паролі з простих символів ASCII.
+	Anyone opening the document will need this password. It's applied when you save.	Кожному, хто відкриватиме документ, знадобиться цей пароль. Він застосовується під час збереження.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	Документ відкривається без пароля; цей пароль потрібен для зміни обмежень. Він застосовується під час збереження.
+	Recover unsaved documents?	Відновити незбережені документи?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft завершив роботу некоректно. Зміни цих документів було автоматично збережено:
+	just now	щойно
+	{n} min ago	{n} хв тому
+	{n} h ago	{n} год тому
+	 · password-protected	 · захищено паролем
+	Recover	Відновити
+	Discard	Відкинути
+	Version {v}	Версія {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Відкритий застосунок для PDF, написаний на Rust за принципом незалежної розробки. MIT OR Apache-2.0.
+	Part of	Частина
+	Summarize Options	Параметри зведення
+	Choose a layout:	Виберіть макет:
+	Comments only	Лише коментарі
+	Sort comments by:	Сортувати коментарі за:
+	Create PDF Comment Summary	Створити PDF зі зведенням коментарів
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Повернутися до попередньої збереженої версії «{name}»? Після цього зміни, внесені відтоді, неможливо буде повернути.
+	Number pages	Пронумерувати сторінки
+	Style	Стиль
+	None (prefix only)	Немає (лише префікс)
+	Prefix	Префікс
+	Start	Початок
+	Labels: {preview}. Later pages keep their labels.	Позначки: {preview}. Наступні сторінки зберігають свої позначки.
+	Even and Odd Pages	Парні й непарні сторінки
+	Even Pages Only	Лише парні сторінки
+	Odd Pages Only	Лише непарні сторінки
+	Landscape and Portrait Pages	Альбомні й книжкові сторінки
+	Landscape Pages	Альбомні сторінки
+	Portrait Pages	Книжкові сторінки
+	Duplicate Field	Дублювати поле
+	Duplicate "{name}" onto:	Дублювати «{name}» на:
+	1 page selected.	Вибрано 1 сторінку.
+	{n} pages selected.	Вибрано сторінок: {n}.
+	Delete pages after extracting	Видалити сторінки після видобування
+	Extract pages as separate files	Видобути сторінки як окремі файли
+	Rotate Pages	Повернути сторінки
+	Direction:	Напрямок:
+	Clockwise 90 degrees	За годинниковою стрілкою на 90 градусів
+	Counterclockwise 90 degrees	Проти годинникової стрілки на 90 градусів
+	180 degrees	180 градусів
+	Pages:	Сторінки:
+	All	Усі
+	Selection	Вибрані
+	From	Від
+	Rotate:	Повернути:
+	Repairs	Виправлення
+	Repair log	Журнал виправлень
+	Split document	Розділити документ
+	Number of pages	Кількість сторінок
+	Pages per file	Сторінок у файлі
+	File size	Розмір файлу
+	At most	Не більше
+	Top-level bookmarks ({n})	Закладки верхнього рівня ({n})
+	Before each selected page (select pages in Organize)	Перед кожною вибраною сторінкою (виберіть сторінки в «Упорядкуванні»)
+	Creates 1 file from {n} pages.	Створює 1 файл зі сторінок: {n}.
+	Creates {f} files from {n} pages.	Створює файли ({f}) зі сторінок ({n}).
+	Each file holds as many of the {n} pages as fit.	Кожен файл містить стільки сторінок із {n}, скільки вміщується.
+	Replace Pages	Замінити сторінки
+	Original: replace pages	Оригінал: замінити сторінки
+	to	до
+	to {n}	до {n}
+	Replacement: pages of {name}	Заміна: сторінки з {name}
+	of {name}	із {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Змінюється лише вміст сторінок: посилання, коментарі, поля форми й закладки на оригінальних сторінках залишаються.
+	The replacement file doesn't have that many pages.	Файл заміни не має такої кількості сторінок.
+	Tagged PDF	PDF із тегами
+	Document Properties	Властивості документа
+	Description	Опис
+	Initial View	Початковий вигляд
+	Security	Захист
+	Fonts	Шрифти
+	Advanced	Додаткові
+	Title	Заголовок
+	Subject	Тема
+	Keywords	Ключові слова
+	Application	Застосунок
+	PDF producer	Засіб створення PDF
+	Layout and Magnification	Макет і масштаб
+	Navigation tab	Вкладка навігації
+	Page Only	Лише сторінка
+	Bookmarks Panel and Page	Панель закладок і сторінка
+	Pages Panel and Page	Панель сторінок і сторінка
+	Attachments Panel and Page	Панель вкладень і сторінка
+	Layers Panel and Page	Панель шарів і сторінка
+	Page layout	Макет сторінок
+	Default	Типово
+	Single Page	Одна сторінка
+	Single Page Continuous	Одна сторінка, безперервно
+	Two-Up (Facing)	Дві сторінки (розворот)
+	Two-Up Continuous (Facing)	Дві сторінки, безперервно (розворот)
+	Two-Up (Cover Page)	Дві сторінки (з обкладинкою)
+	Two-Up Continuous (Cover Page)	Дві сторінки, безперервно (з обкладинкою)
+	Magnification	Масштаб
+	Actual Size	Фактичний розмір
+	Fit Page	За розміром сторінки
+	Fit Width	За шириною
+	Fit Height	За висотою
+	Fit Visible	За видимою областю
+	Open to page	Відкрити на сторінці
+	of {pages}	із {pages}
+	Window Options	Параметри вікна
+	Resize window to initial page	Змінити розмір вікна за початковою сторінкою
+	Center window on screen	Розмістити вікно по центру екрана
+	Open in Full Screen mode	Відкрити в повноекранному режимі
+	Show:	Показувати:
+	File Name	Назва файлу
+	Document Title	Заголовок документа
+	User Interface Options	Параметри інтерфейсу
+	Hide menu bar	Приховати рядок меню
+	Hide toolbars	Приховати панелі інструментів
+	Hide window controls	Приховати елементи керування вікном
+	Security method	Спосіб захисту
+	No security	Без захисту
+	Restrictions	Обмеження
+	None — everything is allowed	Немає — усе дозволено
+	Password security	Захист паролем
+	Encryption	Шифрування
+	Opened with	Відкрито за допомогою
+	— (protection is applied when you save)	— (захист застосовується під час збереження)
+	Owner password (no restrictions apply)	Пароля власника (обмеження не застосовуються)
+	User password	Пароля користувача
+	Change settings…	Змінити налаштування…
+	Printing	Друк
+	Not allowed	Заборонено
+	Allowed	Дозволено
+	High resolution	Висока роздільна здатність
+	Low resolution	Низька роздільна здатність
+	Changing the document	Зміна документа
+	Document assembly	Складання документа
+	Content copying	Копіювання вмісту
+	Content copying for accessibility	Копіювання вмісту для доступності
+	Commenting	Коментування
+	Filling of form fields	Заповнення полів форми
+	No fonts are referenced by the pages.	Сторінки не посилаються на жоден шрифт.
+	PDF version	Версія PDF
+	Location	Розташування
+	Page size	Розмір сторінки
+	Yes	Так
+	No	Ні
+	Revisions	Редакції
+	View revision {n}	Переглянути редакцію {n}
+	Open the file as it was saved then	Відкрити файл у стані на момент того збереження
+	Binding	Корінець
+	Left Edge	Лівий край
+	Right Edge	Правий край
+	Language	Мова
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Збережено {place}: {before} → {after} (менше на {pct}%){detail}
+	Couldn't save the image: {e}	Не вдалося зберегти зображення: {e}
+	Adding images arrives on the web with file pickers for images	Додавання зображень з’явиться у вебверсії разом із вибором файлів зображень
+	Replacing images on page {p} arrives on the web with image pickers ({i})	Заміна зображень на сторінці {p} з’явиться у вебверсії разом із вибором зображень ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: вибір зображень з’явиться у вебверсії разом із вибором файлів зображень
+	Replacing images arrives on the web with image file pickers	Заміна зображень з’явиться у вебверсії разом із вибором файлів зображень
+	Couldn't create a PDF: {e}	Не вдалося створити PDF: {e}
+	The clipboard has no image or text	У буфері обміну немає зображення чи тексту
+	On the web, open or drop an image to convert it	У вебверсії відкрийте або перетягніть зображення, щоб перетворити його
+	Couldn't optimize the file: {e}	Не вдалося оптимізувати файл: {e}
+	Couldn't write {path}: {e}	Не вдалося записати {path}: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Форма запитує надсилання до {u}; PdfCraft не надсилає дані форми. Збережіть документ, щоб зберегти введені дані.
+	{s} actions run in the JavaScript engine (M6)	Дії ({s}) виконуються в рушії JavaScript (M6)
+	{name}: the {other} action isn't supported yet	{name}: дія {other} ще не підтримується
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} надсилає форму до {url}; PdfCraft не надсилає дані форми. Збережіть документ, щоб зберегти введені дані.
+	Export stopped: {e}	Експорт зупинено: {e}
+	Exported 1 image	Експортовано 1 зображення
+	Exported {n} images	Експортовано зображень: {n}
+	 ({s} not exported: {first})	 (не експортовано: {s}; перше: {first})
+	Exported the text of 1 page	Експортовано текст 1 сторінки
+	Exported the text of {n} pages	Експортовано текст сторінок: {n}
+	{msg} to {dir}	{msg} до {dir}
+	Exporting… {d} of {t}	Експорт… {d} із {t}
+	Choose a folder for the exported files	Виберіть теку для експортованих файлів
+	New {tool} comments will look like this one	Нові коментарі інструмента «{tool}» матимуть такий вигляд
+	This document can't be checked: it couldn't be read for editing	Цей документ неможливо перевірити: не вдалося прочитати його для редагування
+	The checker found no problems in this document.	Перевірка не виявила проблем у цьому документі.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Перевірка виявила 1 проблему, яка може заважати повній доступності документа.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Перевірка виявила проблеми ({n}), які можуть заважати повній доступності документа.
+	The text is the same	Текст однаковий
+	1 difference found	Знайдено 1 відмінність
+	{n} differences found	Знайдено відмінностей: {n}
+	Added 1 comment	Додано 1 коментар
+	Added {n} comments	Додано коментарів: {n}
+	Choose a folder for the results	Виберіть теку для результатів
+	Files for {name}	Файли для {name}
+	An action is already running	Дія вже виконується
+	Running action… file {d} of {t}	Виконання дії… файл {d} із {t}
+	No unlinked web addresses were found in the text	У тексті не знайдено вебадрес без посилань
+	Created 1 link	Створено 1 посилання
+	Created {n} links	Створено посилань: {n}
+	Text recognition is already running	Розпізнавання тексту вже виконується
+	Recognizing text… file {d} of {t}	Розпізнавання тексту… файл {d} із {t}
+	Recognizing text… page {d} of {t}	Розпізнавання тексту… сторінка {d} із {t}
+	Recognized 1 word	Розпізнано 1 слово
+	Recognized {n} words	Розпізнано слів: {n}
+	{words} on {pages}	{words} на {pages}
+	; 1 page already had text	; 1 сторінка вже мала текст
+	; {n} pages already had text	; сторінки ({n}) вже мали текст
+	Recognized {w} words in 1 file	Розпізнано слів ({w}) в 1 файлі
+	Recognized {w} words in {n} files	Розпізнано слів ({w}) у файлах ({n})
+	; failed: {list}	; невдалі: {list}
+	1 file done	Оброблено 1 файл
+	{n} files done	Оброблено файлів: {n}
+	The selected area has been copied ({w} × {h} pixels)	Вибрану область скопійовано ({w} × {h} пікселів)
+	Couldn't take the snapshot: {e}	Не вдалося зробити знімок: {e}
+	Couldn't recover {name}: {e}	Не вдалося відновити {name}: {e}
+	The document now conforms to {level}; save it to keep the changes	Документ тепер відповідає {level}; збережіть його, щоб зберегти зміни
+	Fixed what could be fixed; 1 problem remains	Усе можливе виправлено; залишилася 1 проблема
+	Fixed what could be fixed; {n} problems remain	Усе можливе виправлено; залишилося проблем: {n}
+	Custom stamps arrive on the web with file pickers for images	Власні штампи з’являться у вебверсії разом із вибором файлів зображень
+	{file} is too large for a stamp (at most {n} MB)	{file} завеликий для штампа (не більше {n} МБ)
+	Sent to {printer}	Надіслано на {printer}
+	Sent to {printer}: {msg}	Надіслано на {printer}: {msg}
+	Choose a folder for the searchable files	Виберіть теку для файлів із пошуком
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Файли об’єднуються згори донизу. Залиште «Сторінки» порожнім, щоб узяти всі сторінки.
+	Unlock…	Розблокувати…
+	Select a password-protected file first	Спочатку виберіть файл, захищений паролем
+	Enter the permissions password to allow combining	Введіть пароль дозволів для об’єднання
+	Enter the password that opens it	Введіть пароль для відкриття файлу
+	Unlock {name}	Розблокувати {name}
+	Unlock {n} files	Розблокувати файли: {n}
+	The same password is tried on each file.	Той самий пароль перевіряється для кожного файлу.
+	Hide password	Приховати пароль
+	Show password	Показати пароль
+	Wrong password	Неправильний пароль
+	The password is only used to read the file; it isn't saved.	Пароль використовується лише для читання файлу; він не зберігається.
+	Unlock	Розблокувати
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Відкрито, але налаштування захисту не дозволяють об’єднання. Введіть пароль дозволів.
+	Unlocked: the combined file won't be password-protected	Розблоковано: об’єднаний файл не буде захищено паролем
+	Unlocked {n} of {m} files	Розблоковано {n} із {m} файлів
+	Drop PDFs or folders here, or choose them.	Перетягніть сюди PDF або теки чи виберіть їх.
+	Add folder…	Додати теку…
+	Add folder and subfolders…	Додати теку й підтеки…
+	More ways to add files	Інші способи додати файли
+	Every PDF in the folder	Усі PDF у теці
+	Every PDF in the folder and the folders inside it	Усі PDF у теці та її підтеках
+	Add folder	Додати теку
+	Add folder and subfolders	Додати теку й підтеки
+	No PDFs found in {folder}	У {folder} не знайдено PDF
+	Added the first {n} PDFs in {folder}	Додано перші {n} PDF із {folder}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Клацніть для сортування, перетягніть для переміщення стовпця. Тягніть за його край для зміни розміру.
+	Reset columns	Скинути стовпці
+	Remove {n} files	Видалити файли: {n}
+	{n} selected	Вибрано: {n}
+	sorted ascending	відсортовано за зростанням
+	sorted descending	відсортовано за спаданням
+	Protected: the combined file won't keep its security settings	Захищено: об’єднаний файл не збереже налаштування захисту
+	Add open documents	Додати відкриті документи
+	All open documents	Усі відкриті документи
+	No documents are open	Немає відкритих документів
+	Select a file first	Спочатку виберіть файл
+	1 file	1 файл
+	{n} files	Файлів: {n}
+	1 file needs attention	1 файл потребує уваги
+	{n} files need attention	Файли потребують уваги: {n}
+	{name} can't be combined: {why}	{name} неможливо об’єднати: {why}
+	Check the pages of {name}: {why}	Перевірте сторінки {name}: {why}
+	Add the PDFs to combine	Додайте PDF для об’єднання
+	File name	Назва файлу
+	Warnings	Попередження
+	Drag to reorder	Перетягніть для зміни порядку
+	{k} of {n}	{k} із {n}
+	? of {n}	? із {n}
+	Added more than once	Додано більше одного разу
+	yesterday	учора
+	{n} days ago	{n} дн. тому
+	No pages selected	Сторінки не вибрано
+	Password-protected	Захищено паролем
+	Its security settings don't allow copying pages	Налаштування захисту не дозволяють копіювати сторінки
+	Can't be read: {e}	Не вдалося прочитати: {e}
+	Includes unsaved changes	Містить незбережені зміни
+	Pages of {name} to combine, e.g. 1-3, 6	Сторінки з {name} для об’єднання, наприклад 1-3, 6
+	Remove {name}	Видалити {name}
+	Add files…	Додати файли…
+	Add at least two files	Додайте щонайменше два файли
+	Couldn't add {name}: {e}	Не вдалося додати {name}: {e}
+	Couldn't combine files: {e}	Не вдалося об’єднати файли: {e}
+	Export comments	Експортувати коментарі
+	Export form data	Експортувати дані форми
+	Comment and form data	Дані коментарів і форми
+	Export	Експортувати
+	Select data files to merge	Виберіть файли даних для об’єднання
+	Form data and PDF forms	Дані форми й форми PDF
+	Save the spreadsheet	Зберегти електронну таблицю
+	Save the accessibility report	Зберегти звіт про доступність
+	Save image	Зберегти зображення
+	Export certificate	Експортувати сертифікат
+	Choose a folder for the extracted pages	Виберіть теку для видобутих сторінок
+	Choose a folder for the split files	Виберіть теку для розділених файлів
+	Couldn't use {name}: {e}	Не вдалося використати {name}: {e}
+	Couldn't extract pages: {e}	Не вдалося видобути сторінки: {e}
+	Couldn't write {name}: {e}	Не вдалося записати {name}: {e}
+	Wrote 1 file to {dir}	Записано 1 файл у {dir}
+	Wrote {n} files to {dir}	Записано файлів ({n}) у {dir}
+	No pages match those choices	Жодна сторінка не відповідає вибраним параметрам
+	Couldn't split: {e}	Не вдалося розділити: {e}
+	Couldn't summarize comments: {e}	Не вдалося створити зведення коментарів: {e}
+	Couldn't open the result: {e}	Не вдалося відкрити результат: {e}
+	Importing data arrives on the web with file pickers for data files	Імпорт даних з’явиться у вебверсії разом із вибором файлів даних
+	Exported to {path}	Експортовано до {path}
+	Merging data files needs the desktop app	Для об’єднання файлів даних потрібен настільний застосунок
+	Merged 1 file into {path}	Об’єднано 1 файл у {path}
+	Merged {n} files into {path}	Об’єднано файлів ({n}) у {path}
+	Combined {n} files	Об’єднано файлів: {n}
+	Extracted 1 page	Видобуто 1 сторінку
+	Extracted {n} pages	Видобуто сторінок: {n}
+	Created a comment summary	Створено зведення коментарів
+	Couldn't open {name}: {e}	Не вдалося відкрити {name}: {e}
+	Couldn't read {name}: {e}	Не вдалося прочитати {name}: {e}
+	Couldn't save: {e}	Не вдалося зберегти: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Завантаження вкладень у вебверсії з’явиться на етапі M3.10 (готово байтів: {n})
+	`{command}` {when}	`{command}` {when}
+	ships in milestone {m}	з’явиться на етапі {m}
+	needs an AI provider (off by default)	потребує постачальника ШІ (типово вимкнено)
+	is available	доступна
+	is not available yet	ще недоступна
+	{label} failed: {e}	Помилка «{label}»: {e}
+	Undid {label}	Скасовано: {label}
+	Redid {label}	Повторено: {label}
+	A document needs at least one page: copy instead	Документ потребує щонайменше однієї сторінки: натомість скопіюйте
+	Cut {what}	Вирізано: {what}
+	Copied {what}	Скопійовано: {what}
+	1 page	1 сторінка
+	{n} pages	Сторінок: {n}
+	Copy or cut pages first	Спочатку скопіюйте або виріжте сторінки
+	Couldn't save {name}: {e}	Не вдалося зберегти {name}: {e}
+	Saved {name}	Збережено {name}
+	Saved, but reopening failed: {e}	Збережено, але не вдалося відкрити повторно: {e}
+	Downloaded {name}	Завантажено {name}
+	Couldn't download {name}: {e}	Не вдалося завантажити {name}: {e}
+	Reverted to the last saved version	Повернуто останню збережену версію
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Не вдалося виконати: внутрішня помилка зупинила дію ({m}). Ваші документи не змінено.
+	Nothing to undo	Немає дій для скасування
+	Nothing to redo	Немає дій для повторення
+	This document has no form fields you can fill in	Цей документ не має полів форми для заповнення
+	This document has no comments to flatten	Цей документ не має коментарів для зведення
+	This document has no form fields to flatten	Цей документ не має полів форми для зведення
+	There are no redaction marks (mark text, areas or pages first)	Немає позначок вилучення (спочатку позначте текст, області чи сторінки)
+	This document has no {kind} to change	У цьому документі немає елемента «{kind}» для зміни
+	header or footer	колонтитул
+	watermark	водяний знак
+	background	тло
+	This document isn't password-protected	Цей документ не захищено паролем
+	Only the document's owner can change its security (open it with the permissions password)	Лише власник документа може змінювати захист (відкрийте з паролем дозволів)
+	The document's security settings don't allow this change	Налаштування захисту документа не дозволяють цю зміну
+	Open a document first	Спочатку відкрийте документ
+	Security will be removed when you save	Захист буде знято під час збереження
+	Click text or an image to edit it	Клацніть текст або зображення для редагування
+	Drag a rectangle to create a link; double-click a link to edit it	Намалюйте прямокутник, щоб створити посилання; двічі клацніть посилання, щоб редагувати його
+	There are no redaction marks to apply	Немає позначок вилучення для застосування
+	Drag to draw the area where the signature should appear.	Намалюйте область, у якій має з’явитися підпис.
+	Couldn't fit the visible content: {e}	Не вдалося припасувати видимий вміст: {e}
+	Drag a rectangle around the area to copy	Намалюйте прямокутник навколо області для копіювання
+	Click on the page to add a {tool}, or drag to set its size	Клацніть на сторінці, щоб додати інструмент «{tool}», або перетягніть, щоб задати розмір
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Намалюйте прямокутник на сторінці, щоб обітнути її; двічі клацніть сторінку, щоб задати її межі
+	Keep tool selected: on	Залишати інструмент вибраним: увімкнено
+	Keep tool selected	Залишати інструмент вибраним
+	Opacity	Непрозорість
+	Line thickness	Товщина лінії
+	What word or phrase would you like to search for?	Яке слово чи фразу ви хочете знайти?
+	Searching… {s} of {p} pages	Пошук… {s} із {p} сторінок
+	 (searching… {s} of {p} pages)	 (пошук… {s} із {p} сторінок)
+	1 instance	1 входження
+	{n} instances	Входжень: {n}
+	Go to this result	Перейти до цього результату
+	Highlight	Виділення кольором
+	Draw	Малювати
+	Polygon	Багатокутник
+	Connected lines	Ламана лінія
+	Eraser	Гумка
+	Sign	Підписати
+	Certified by {by}	Засвідчено: {by}
+	At least one signature is invalid.	Щонайменше один підпис недійсний.
+	Signed and all signatures are valid.	Підписано, і всі підписи дійсні.
+	At least one signature has problems.	Щонайменше один підпис має проблеми.
+	This document is secured. Some changes are restricted by its security settings.	Цей документ захищено. Деякі зміни обмежено налаштуваннями захисту.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Це динамічна форма XFA, яку PdfCraft ще не може відобразити. Ви бачите сторінку-заглушку файлу.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Ця форма також містить дані XFA, які PdfCraft ще не читає. Ви можете заповнювати поля, але Acrobat може показувати натомість значення XFA.
+	This document contains {n} interactive form fields.	Цей документ містить інтерактивні поля форми: {n}.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Цей файл було пошкоджено й виправлено. Збереження збереже виправлену версію.
+	Dismiss	Приховати
+	Hide field highlights	Приховати підсвічування полів
+	Highlight fields	Підсвітити поля
+	Security settings	Налаштування захисту
+	Details	Відомості
+	Select (V)	Виділення (V)
+	Hand (H)	Рука (H)
+	Delete pages (Delete)	Видалити сторінки (Delete)
+	Insert a blank page after the selection	Вставити порожню сторінку після вибраних
+	Insert pages from a file…	Вставити сторінки з файлу…
+	Extract pages to a new document	Видобути сторінки в новий документ
+	Split into files…	Розділити на файли…
+	Select pages	Вибрати сторінки
+	Cut	Вирізати
+	Copy	Копіювати
+	Paste after	Вставити після
+	Rename	Перейменувати
+	Set to current page ({n})	Задати поточну сторінку ({n})
+	Move up	Перемістити вгору
+	Move down	Перемістити вниз
+	Indent	Збільшити відступ
+	Outdent	Зменшити відступ
+	This document has no form fields.	Цей документ не має полів форми.
+	Tab order: move a field with its arrows.	Порядок табуляції: переміщуйте поле його стрілками.
+	Unplaced	Не розміщено
+	Has JavaScript actions (run in M6)	Має дії JavaScript (виконуються на етапі M6)
+	Page	Сторінка
+	None	Немає
+	Delete selected fields	Видалити вибрані поля
+	Diagnostic details	Діагностичні відомості
+	The operation failed.	Операція завершилася невдало.
+	no such document	такого документа немає
+	nothing to undo	немає дій для скасування
+	nothing to redo	немає дій для повторення
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	цей документ підписано: перезапис зробить підписи недійсними (натомість збережіть поступово)
+	the document is protected by a password	документ захищено паролем
+	the password is incorrect	неправильний пароль
+	the document has no page tree	документ не має дерева сторінок
+	a document must keep at least one page	документ має зберігати щонайменше одну сторінку
+	a bookmark cannot be moved inside itself	закладку неможливо перемістити всередину себе
+	the title must not be empty	заголовок не має бути порожнім
+	the document has no form fields	документ не має полів форми
+	there are no redaction marks to apply	немає позначок вилучення для застосування
+	there are no pages to print	немає сторінок для друку
+	the document has no tags	документ не має тегів
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	моделі розпізнавання тексту не встановлено (виконайте `cargo xtask models` або задайте PRINTCRAFT_MODELS)
+	the image is empty	зображення порожнє
+	this file isn't XFDF, FDF, XML or text form data	цей файл не містить даних форми XFDF, FDF, XML чи текстових даних
+	nothing in the file matches this document	ніщо у файлі не відповідає цьому документу
+	This page couldn't be displayed.\n{e}	Не вдалося відобразити цю сторінку.\n{e}
+	Go to page {p}	Перейти до сторінки {p}
+	{s} action	Дія: {s}
+	Page {p} of {n}	Сторінка {p} із {n}
+	1 page selected	Вибрано 1 сторінку
+	{n} pages selected	Вибрано сторінок: {n}
+	{name} — unsaved changes	{name} — незбережені зміни
+	{kind} field	Поле: {kind}
+	Select a file for the stamp	Виберіть файл для штампа
+	JavaScript, e.g. getField("total").value	JavaScript, наприклад getField("total").value
+	Font: Helvetica	Шрифт: Helvetica
+	e.g. en-US	наприклад uk-UA
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Відтворення: hayro (початковий рушій) · Інтерфейс: egui · Піктограми: Lucide (ISC) · Шрифти: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	Прапорець
+	Radio	Перемикач
+	PushButton	Кнопка
+	Combo	Розкривний список
+	List	Список
+	Unknown	Невідомо
+	The document has no XMP metadata	Документ не має метаданих XMP
+	The title in the metadata and the document information differ	Заголовки в метаданих і відомостях про документ відрізняються
+	The document is encrypted	Документ зашифровано
+	Device colour is used, but there is no PDF/A output intent	Використано колір пристрою, але немає профілю виводу PDF/A
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	Використано DeviceCMYK: потрібен профіль виводу CMYK (не додається автоматично)
+	The document has additional actions (/AA)	Документ має додаткові дії (/AA)
+	The document has document-level JavaScript	Документ має JavaScript рівня документа
+	The form asks viewers to make appearances (NeedAppearances)	Форма просить засоби перегляду створювати вигляд полів (NeedAppearances)
+	A form field has additional actions	Поле форми має додаткові дії
+	A stream uses LZW compression	Потік використовує стиснення LZW
+	A stream refers to an external file	Потік посилається на зовнішній файл
+	An image asks to be interpolated	Зображення потребує інтерполяції
+	An image has alternates or OPI information	Зображення має альтернативи або відомості OPI
+	PostScript XObjects aren't allowed	Об’єкти PostScript XObject заборонено
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	Вбудовані файли самі мають бути файлами PDF/A (для інших використовуйте PDF/A-3)
+	An embedded file has no AFRelationship	Вбудований файл не має AFRelationship
+	Select Icon	Вибрати піктограму
+	Choose images	Виберіть зображення
+	{dpi} pixels/inch	{dpi} пікселів/дюйм
+	Type your {what}.	Введіть {what}.
+	Draw your {what} below.	Намалюйте {what} нижче.
+	Your name	Ваше ім’я
+	Images and text (converted to PDF)	Зображення й текст (перетворені на PDF)
+	Images and text	Зображення й текст
+	Check Box Style:	Стиль прапорця:
+	Button Style:	Стиль кнопки:
+	Check	Позначка
+	Circle	Коло
+	Diamond	Ромб
+	Square	Квадрат
+	Star	Зірка
+	{month} {y}	{month} {y}
+	Change {key}	Змінити: {key}
+	Insert pages from {name}	Вставити сторінки з {name}
+	Fill in {name}	Заповнити {name}
+	Set the image of {name}	Задати зображення для {name}
+	Edit script of {name}	Редагувати сценарій {name}
+	Import {name}	Імпортувати {name}
+	Add bookmark	Додати закладку
+	Rename bookmark	Перейменувати закладку
+	Delete bookmark	Видалити закладку
+	Move bookmark	Перемістити закладку
+	Set bookmark destination	Задати призначення закладки
+	Add stamp	Додати штамп
+	Delete comment	Видалити коментар
+	Edit comment	Редагувати коментар
+	Erase	Стерти
+	Lock comment	Заблокувати коментар
+	Unlock comment	Розблокувати коментар
+	Move comment	Перемістити коментар
+	Resize comment	Змінити розмір коментаря
+	Change comment properties	Змінити властивості коментаря
+	Add field	Додати поле
+	Change field properties	Змінити властивості поля
+	Delete field	Видалити поле
+	Duplicate field	Дублювати поле
+	Set tab order	Задати порядок табуляції
+	Change initial view	Змінити початковий вигляд
+	Set alternate text	Задати альтернативний текст
+	Mark figure as decorative	Позначити рисунок як декоративний
+	Run JavaScript	Виконати JavaScript
+	Delete document JavaScript	Видалити JavaScript документа
+	Edit document JavaScript	Редагувати JavaScript документа
+	Edit text	Редагувати текст
+	Move image	Перемістити зображення
+	Rotate image	Повернути зображення
+	Flip image	Віддзеркалити зображення
+	Delete image	Видалити зображення
+	Add header & footer	Додати колонтитули
+	Update header & footer	Оновити колонтитули
+	Update watermark	Оновити водяний знак
+	Add background	Додати тло
+	Update background	Оновити тло
+	Add image	Додати зображення
+	Edit content	Редагувати вміст
+	Delete content	Видалити вміст
+	Remove redaction marks	Видалити позначки вилучення
+	Add link	Додати посилання
+	Change link properties	Змінити властивості посилання
+	Delete link	Видалити посилання
+	Create link	Створити посилання
+	Flatten	Звести
+	Add sticky note	Додати нотатку
+	Add highlight	Додати виділення кольором
+	Add underline	Додати підкреслення
+	Add strikethrough	Додати закреслення
+	Add squiggly underline	Додати хвилясте підкреслення
+	Add rectangle	Додати прямокутник
+	Add oval	Додати овал
+	Add arrow	Додати стрілку
+	Add line	Додати лінію
+	Add drawing	Додати малюнок
+	Add text box	Додати текстове поле коментаря
+	Add checkmark	Додати позначку
+	Add cross	Додати хрестик
+	Add dot	Додати крапку
+	Add signature	Додати підпис
+	Add redaction mark	Додати позначку вилучення
+	Add cloud	Додати хмару
+	Add polygon	Додати багатокутник
+	Add connected lines	Додати ламану лінію
+	Add callout	Додати виноску
+	Add inserted text	Додати вставлений текст
+	Add file attachment	Додати файлове вкладення
+	Set status Accepted	Задати статус «Прийнято»
+	Set status Rejected	Задати статус «Відхилено»
+	Set status Cancelled	Задати статус «Скасовано»
+	Set status Completed	Задати статус «Завершено»
+	Set status None	Задати статус «Немає»
+	Set status Unmarked	Задати статус «Без позначки»
+	Save as PDF/A-1b	Зберегти як PDF/A-1b
+	Save as PDF/A-2b	Зберегти як PDF/A-2b
+	Save as PDF/A-3b	Зберегти як PDF/A-3b
+	Fill & Sign: change signature	Заповнення й підпис: змінити підпис
+	Fill & Sign: change initials	Заповнення й підпис: змінити ініціали
+	Fill & Sign: remove saved signature	Заповнення й підпис: видалити збережений підпис
+	Fill & Sign: remove saved initials	Заповнення й підпис: видалити збережені ініціали
+	Change signature	Змінити підпис
+	Change initials	Змінити ініціали
+	Measure distance	Виміряти відстань
+	Measure perimeter	Виміряти периметр
+	Measure area	Виміряти площу
+	Set measurement scale	Задати масштаб вимірювання
+	Measurement information	Відомості про вимірювання
+	Measurement snapping	Прив’язування вимірювань
+	Export measurements as CSV	Експортувати вимірювання як CSV
+	Distance	Відстань
+	Perimeter	Периметр
+	Area	Площа
+	Drawing scale	Масштаб креслення
+	Snapping	Прив’язування
+	Export measurements	Експортувати вимірювання
+	Open a PDF to measure it.	Відкрийте PDF для вимірювання.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Клацайте вершини. Enter або подвійне клацання завершує периметр чи площу. Клацніть першу точку, щоб замкнути область.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift обмежує кут до 45 градусів. Backspace видаляє вершину. Escape скасовує.
+	Angle	Кут
+	Click the first point to begin.	Клацніть першу точку, щоб почати.
+	Snap to drawing	Прив’язувати до креслення
+	Endpoints	Кінцеві точки
+	Midpoints	Серединні точки
+	Intersections	Перетини
+	Paths	Контури
+	Sensitivity	Чутливість
+	Unit	Одиниця
+	Decimals	Знаків після коми
+	Calibrate from two points	Калібрувати за двома точками
+	Entire page	Уся сторінка
+	Viewport rectangle in page points (x, y, width, height)	Прямокутник області перегляду в пунктах сторінки (x, y, ширина, висота)
+	Viewport	Область перегляду
+	Apply scale	Застосувати масштаб
+	Saved measurements	Збережені вимірювання
+	Saved measurements.	Вимірювання збережено.
+	Endpoint	Кінцева точка
+	Midpoint	Серединна точка
+	Intersection	Перетин
+	Path	Контур
+	This drawing exceeds the snapping limit; only the first paths are used.	Це креслення перевищує межу прив’язування; використовуються лише перші контури.
+	Some page content couldn't be read; snapping uses the rest.	Частину вмісту сторінки не вдалося прочитати; прив’язування використовує решту.
+	Unsupported measurements	Непідтримувані вимірювання
+	Label	Позначка
+	{n} measurements use an unsupported format and are left out.	Вимірювання ({n}) використовують непідтримуваний формат і пропускаються.
+	This area has too many overlapping paths; intersection snapping is limited.	Ця область має забагато контурів, що перекриваються; прив’язування до перетинів обмежено.
+	This measurement needs at least {n} points.	Для цього вимірювання потрібно щонайменше точок: {n}.
+	Change {what}	Змінити: {what}
+	Cut and stack	Різання й укладання
+	Default workspace mode	Типовий режим робочої області
+	Documents and view	Документи й перегляд
+	Open email app	Відкрити поштовий застосунок
+	Open link	Відкрити посилання
+	Open this web page?	Відкрити цю вебсторінку?
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Сценарії виконуються в ізольованому середовищі без доступу до файлів і мережі. Сценарій, що просить відкрити вебсторінку, спочатку потребує вашого дозволу. Коли JavaScript вимкнено, стандартні функції форматування, перевірки й обчислення Acrobat усе одно працюють.
+	Sign yourself	Підписати самостійно
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Розпізнавання тексту не встановлено: бракує моделей (виконайте `cargo xtask models` або задайте PDFCRAFT_MODELS).
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Використовується під час відкриття PDF. Явно заданий режим запуску або керування має пріоритет для сеансу.
+	Write this email?	Написати цього листа?
+	{who} in this document wants to open this address in your browser:	{who} у цьому документі хоче відкрити цю адресу у вашому браузері:
+	{who} in this document wants to open your email app with this address:	{who} у цьому документі хоче відкрити ваш поштовий застосунок із цією адресою:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Ця вебадреса поєднує літери різних абеток — поширений спосіб імітувати назву іншого сайту.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Ця вебадреса використовує літери іншої абетки, які можуть виглядати як знайомі.
+	Create PDF from images	Створити PDF із зображень
+	Selected image files: {count}	Вибрано файлів зображень: {count}
+	Use image resolution	Використовувати роздільну здатність зображення
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Використовувати вбудоване DPI кожного зображення; за його відсутності — 72 DPI.
+	Use 72 DPI (one point per pixel)	Використовувати 72 DPI (один пункт на піксель)
+	Use custom DPI	Використовувати власне DPI
+	DPI sets the printed page size without resampling the image.	DPI задає розмір друкованої сторінки без зміни кількості пікселів зображення.
+	Create	Створити
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Динамічну форму XFA скомпоновано за її шаблоном: {pages}, {fields}.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Форма XFA: її поля й дані XFA синхронізуються, тому інші засоби перегляду показують введені вами дані.
+	Switch to two-page view first to show the cover page	Спочатку перемкніть на двосторінковий вигляд, щоб показати обкладинку
+	Page display: {layout}	Відображення сторінок: {layout}
+	Fit to width scrolling	Прокручування за шириною
+	Fit one full page	Одна повна сторінка
+	Default page display	Типове відображення сторінок
+	Default zoom	Типовий масштаб
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Використовується, коли PDF не задає макет або масштаб. Безперервне прокручування ніколи не прив’язується до сторінок.
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Виберіть зображення PNG або JPEG (до 4 МіБ). Прозорість зберігається.
+	Couldn't import the signature image: {e}	Не вдалося імпортувати зображення підпису: {e}
+@plural	{n} page|{n} pages	{n} сторінка|{n} сторінки|{n} сторінок
+@plural	{n} field|{n} fields	{n} поле|{n} поля|{n} полів
+	Create PDF from multiple files…	Створити PDF із кількох файлів…
+	Optimizing… removing user data	Оптимізація… видалення даних користувача
+	Optimizing… image {d} of {t}	Оптимізація… зображення {d} із {t}
+	Optimizing… cleaning up	Оптимізація… очищення
+	Optimizing… merging identical objects	Оптимізація… об’єднання однакових об’єктів
+	Optimizing… writing the copy	Оптимізація… запис копії
+	Cancelling…	Скасування…
+	Created a PDF from {n} files	Створено PDF із файлів: {n}
+	PDF, images and text	PDF, зображення й текст
+	Insert a file before page {label}	Вставити файл перед сторінкою {label}
+	Insert a file at the end	Вставити файл у кінці
+	Save pages	Зберегти сторінки
+	Save these pages as one PDF	Зберегти ці сторінки як один PDF
+	No changes to save	Немає змін для збереження
+	Created a PDF from {n} files; left out: {names}	Створено PDF із файлів ({n}); пропущено: {names}
+	Created a PDF from the first {n} files	Створено PDF із перших файлів: {n}
+	Go to page…	Перейти до сторінки…
+	Optimization is already running	Оптимізація вже виконується
+	Optimization cancelled	Оптимізацію скасовано
+	Couldn't optimize the file	Не вдалося оптимізувати файл
+	Files are combined in this order. Leave Pages empty to take every page.	Файли об’єднуються в цьому порядку. Залиште «Сторінки» порожнім, щоб узяти всі сторінки.
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Портативний режим вимкнено: неможливо записати в {folder} ({error}). Налаштування зберігаються у вашій користувацькій теці.
+	Show	Показувати
+	Sort	Сортувати
+	Reverse the order	Зворотний порядок
+	Grab bag	Добірка
+	Table	Таблиця
+	Username	Ім’я користувача
+	Display name	Відображуване ім’я
+	Real name	Справжнє ім’я
+	Name (A–Z)	Ім’я (А–Я)
+	Merged PRs	Злиті PR
+	PRs	PR
+	Commits	Коміти
+	Lines added	Додано рядків
+	+LOC	+LOC
+	Lines deleted	Видалено рядків
+	−LOC	−LOC
+	Line delta	Зміна кількості рядків
+	ΔLOC	ΔLOC
+	Binary assets added	Додано бінарних ресурсів
+	+Bin	+Bin
+	Binary assets removed	Видалено бінарних ресурсів
+	−Bin	−Bin
+	First commit	Перший коміт
+	First	Перший
+	Last commit	Останній коміт
+	Last	Останній
+	No contributor data was built into this copy.	У цю копію не вбудовано даних про учасників.
+	No model credits were built into this copy.	У цю копію не вбудовано відомостей про моделі.
+	{n} contributors · {c} commits	Учасників: {n} · Комітів: {c}
+	Company	Компанія
+	Model	Модель
+	% of all commits	% усіх комітів
+	Lines +/−	Рядків +/−
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: PR: {prs}, комітів: {commits}, +{added} / −{deleted} рядків (Δ {delta}), +{bin_added} / −{bin_deleted} бінарних ресурсів, {first} – {last}
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Жоден із цих файлів неможливо перетворити на PDF; використовуйте PDF, зображення або файли .txt
+	About	Про застосунок
+	Contributors	Учасники
+	Models	Моделі
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Продовжуйте лише якщо довіряєте цьому документу. Адреса може містити інформацію з документа, наприклад дані, введені у форму.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Друкуйте з одного боку. Зберігайте порядок аркушів, розріжте за мітками, а потім складіть стоси зліва направо, згори донизу.
+comment menu	Edit	Редагувати
+	Undo {action}	Скасувати: {action}
+	Redo {action}	Повторити: {action}
+signature pad	Type	Ввести
+action wizard	Start	Почати
+calendar date	January	січня
+calendar date	February	лютого
+calendar date	March	березня
+calendar date	April	квітня
+calendar date	May	травня
+calendar date	June	червня
+calendar date	July	липня
+calendar date	August	серпня
+calendar date	September	вересня
+calendar date	October	жовтня
+calendar date	November	листопада
+calendar date	December	грудня
+	Reopen the files that were open when PdfCraft last closed	Знову відкривати файли, які були відкриті під час останнього закриття PdfCraft
+	Clear Recent Files	Очистити список нещодавніх файлів
+	Remove from Recent	Вилучити з нещодавніх
+	Remove {name} from Recent	Вилучити {name} з нещодавніх
+	Inserted text	Вставлений текст
+
+# Labels that reach tl!() through a variable (Fill & Sign buttons, link prompts, notices, history labels, checker and certificate rows)
+	Add {what}	Додати: {what}
+	Use {what}	Використати: {what}
+	Place saved {what}	Розмістити збережене: {what}
+	Remove saved {what}	Видалити збережене: {what}
+	A link	Посилання
+	A button	Кнопка
+	A script	Сценарій
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	{who} у цьому документі намагається відкрити адресу, яку PdfCraft не відкриває: {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} у цьому документі намагається відкрити адресу, яку PdfCraft не відкриває: {e}. З документів відкриваються лише вебпосилання (http, https) та посилання на електронну пошту (mailto).
+	Another file dialog is still open. Finish with it first.	Ще відкрито інше вікно вибору файлу. Спершу завершіть роботу з ним.
+	Couldn't show the file picker. Please try again.	Не вдалося показати вікно вибору файлу. Спробуйте ще раз.
+	The document changed while you were choosing a file, so nothing was changed.	Документ змінився, поки ви вибирали файл, тому нічого не змінено.
+	The document was closed before it could be saved.	Документ було закрито до того, як його вдалося зберегти.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Сторінки видобуто, але не видалено, бо документ змінився, поки ви вибирали теку.
+	That didn't work: an internal error stopped it ({m}).	Не вдалося: дію зупинила внутрішня помилка ({m}).
+	The Windows store's digital IDs couldn't be listed: {e}	Не вдалося отримати список цифрових посвідчень зі сховища Windows: {e}
+	Align fields	Вирівняти поля
+	Distribute fields	Розподілити поля
+	Match field sizes	Вирівняти розміри полів
+	Mark for redaction	Позначити для вилучення вмісту
+	Mark pages for redaction	Позначити сторінки для вилучення вмісту
+	Change document properties	Змінити властивості документа
+	Mark differences	Позначити відмінності
+	Run form script	Виконати сценарій форми
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Вміст зі сценаріями має бути доступним із клавіатури та допоміжних технологій. Перевірте сценарії документа.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Рядки таблиці мають бути безпосередньо в таблиці або в її заголовку, тілі чи підсумку. Виправте теги таблиці.
+	Basic constraints	Основні обмеження
+	SHA-1 digest	Дайджест SHA-1
+	SHA-256 digest	Дайджест SHA-256
+	Squiggly	Хвилясте
+	Home / End	Home / End
+	H / Space (hold)	H / Пробіл (утримувати)
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index c585b3f2..f21aee6d 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -132,7 +132,7 @@ fn language_switch_preserves_document_and_command_ids() {
     let documents = ok(&mut h, &c, "ui.state", json!({}))["documents"].clone();
     assert_eq!(documents[0]["dirty"], true);
     let commands = ok(&mut h, &c, "ui.commands", json!({}));
-    for code in ["ja", "zh-hans", "fr", "de", "en"] {
+    for code in ["ja", "zh-hans", "fr", "de", "uk", "en"] {
         ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": code }));
         h.run_steps(2);
         let state = ok(&mut h, &c, "ui.state", json!({}));
@@ -533,6 +533,38 @@ fn german_preferences_and_search_keep_command_ids() {
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["documents"][0]["name"], "doc.pdf");
 }
 
+#[test]
+fn ukrainian_preferences_and_search_keep_command_ids() {
+    let (mut h, c) = harness();
+    ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": "uk" }));
+    ok(&mut h, &c, "ui.command", json!({ "id": "app.preferences" }));
+    for label in ["Мова інтерфейсу", "Українська"] {
+        let found = ok(&mut h, &c, "ui.inspect", json!({ "query": label }));
+        assert!(found["count"].as_u64().unwrap() > 0, "{label}: {found}");
+    }
+    ok(&mut h, &c, "ui.click", json!({ "label": "OK" }));
+    for query in ["Розділити", "Split document", "page.split"] {
+        ok(&mut h, &c, "ui.command", json!({ "id": "view.palette" }));
+        ok(&mut h, &c, "ui.type", json!({ "text": query }));
+        let hits = ok(&mut h, &c, "ui.inspect", json!({ "query": "Розділити документ…" }));
+        assert!(hits["count"].as_u64().unwrap() > 0, "{query}: {hits}");
+        ok(&mut h, &c, "ui.key", json!({ "key": "Escape" }));
+        h.state_mut().palette_query.clear();
+    }
+    for (dialog, label) in [("properties", "Властивості документа"), ("protect", "Захистити паролем"), ("about", "Учасники")]
+    {
+        ok(&mut h, &c, "ui.set", json!({ "key": "dialog", "value": dialog }));
+        let found = ok(&mut h, &c, "ui.inspect", json!({ "query": label }));
+        assert!(found["count"].as_u64().unwrap() > 0, "{dialog}: {found}");
+    }
+    ok(&mut h, &c, "ui.set", json!({ "key": "dialog", "value": "none" }));
+    assert!(!h.state_mut().apply_edit(pdfcraft_engine::Edit::DeletePages { pages: vec![0, 1, 2, 3, 4] }));
+    let state = ok(&mut h, &c, "ui.state", json!({}));
+    assert_eq!(state["language"], "uk");
+    assert_eq!(state["notice"], "Помилка «Видалити сторінки»: a document must keep at least one page");
+    assert_eq!(state["documents"][0]["name"], "doc.pdf");
+}
+
 #[test]
 fn preferences_menu_and_shortcut_allow_switching_interface_languages() {
     let (mut h, c) = harness();
@@ -542,7 +574,8 @@ fn preferences_menu_and_shortcut_allow_switching_interface_languages() {
     let menu = ok(&mut h, &c, "ui.inspect", json!({ "query": "環境設定…" }));
     let prefs = menu["widgets"].as_array().unwrap().iter().find(|w| w["clickable"] == true).expect("Preferences menu item");
     ok(&mut h, &c, "ui.click", json!({ "id": prefs["id"] }));
-    for (current, next, code) in [("日本語", "English", "en"), ("English", "日本語", "ja")] {
+    for (current, next, code) in [("日本語", "English", "en"), ("English", "Українська", "uk"), ("Українська", "日本語", "ja")]
+    {
         let selector = ok(&mut h, &c, "ui.inspect", json!({ "query": current }));
         let combo = selector["widgets"].as_array().unwrap().iter().find(|w| w["role"] == "ComboBox").expect("language selector");
         ok(&mut h, &c, "ui.click", json!({ "id": combo["id"] }));
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index a8a9b89e..d65b2b6c 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -162,7 +162,7 @@ fn ui_fonts_work_without_craft_fonts() {
     theme::install_fonts(&ctx);
 }
 
-/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, German, Spanish, French, Russian, Bulgarian, Hungarian) are drawn entirely by the app's own faces
+/// Latin- and Cyrillic-script catalogs (Czech, Brazilian Portuguese, German, Spanish, French, Russian, Bulgarian, Hungarian, Ukrainian) are drawn entirely by the app's own faces
 /// (Inter, JetBrains Mono): no letter falls through to egui's defaults or a CJK fallback. (egui's
 /// `has_glyphs` can't answer this: with only the primary face it is also the replacement face.)
 #[test]
@@ -178,8 +178,9 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
         ("ru", include_str!("../src/i18n/ru.tsv")),
         ("bg", include_str!("../src/i18n/bg.tsv")),
         ("hu", include_str!("../src/i18n/hu.tsv")),
+        ("uk", include_str!("../src/i18n/uk.tsv")),
     ] {
-        let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜäÄöÖőűß„“¿¡«»…");
+        let mut text = String::from("áčďéěíňóřšťúůýžÁČĎÉĚÍŇÓŘŠŤÚŮÝŽãõçâêôàÃÕÇÂÊÔÀñÑüÜäÄöÖőűß„“¿¡«»…ґҐєЄіІїЇ");
         for line in catalog.lines().filter(|l| !l.starts_with('#')) {
             if let Some(translation) = line.split('\t').nth(2) {
                 text.extend(translation.chars().filter(|c| !c.is_whitespace()));
diff --git a/docs/localization.md b/docs/localization.md
index 6515235a..801bb260 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,8 +1,8 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **తెలుగు** or **Magyar**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **తెలుగు**, **Magyar** or **Українська**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
@@ -10,9 +10,11 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`, `hu`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te` or `hu`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`, `hu`, `uk`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`, `hu` or `uk`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu and Hungarian translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian and Ukrainian translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+
+The Ukrainian catalog has 2,047 entries, written from the meaning of the English labels using Ukrainian computing vocabulary. Commands use infinitives; fixed-count messages use count-neutral wording. Plural-aware messages use the three [CLDR Ukrainian integer forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#uk): `1 сторінка`, `2 сторінки`, `5 сторінок`; 11–14 take the third form, while 21 and 22 return to the first and second. Calendar dates use genitive month names (`9 жовтня 2026`), while headings use standalone names (`Жовтень 2026`). Home recommendation cards grow to fit translated text; the toolbar search hint truncates before the shortcut, with the full label available on hover.
 
 Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French and Hungarian need only the bundled Latin faces (tested in `tests/fonts.rs`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index f558ecbd..7056ae7b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9818,8 +9818,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values"]
-notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
+evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values"]
+notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"

From f78f74164ca42c26cb4b12687ea2360af018f1cf Mon Sep 17 00:00:00 2001
From: Chen Tao <t.clydechen@gmail.com>
Date: Sat, 10 Oct 2026 01:58:38 +0900
Subject: [PATCH 092/149] M6.2: check boxes with non-UTF-8 state names show
 their mark when clicked (#536)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Japanese forms often name a check box's on state in Shift-JIS (「はい」 is
/#82#CD#82#A2). State names were read with from_utf8_lossy, so ticking such a
box wrote a different name to /AS and /V, no appearance matched, and the box
was drawn with no mark (or not at all).

Names now map to text losslessly (forms::name_text / name_bytes: UTF-8 as
itself, other bytes and `#` as #XX) wherever states and values are read and
written: /V, /DV and /AS, PdfCraft's own state appearances, and FDF import and
export, so such values also survive an FDF or XFDF round trip.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/forms/src/appearance.rs |  2 +-
 crates/forms/src/author.rs     |  2 +-
 crates/forms/src/lib.rs        | 48 ++++++++++++++++++++++++++++++----
 crates/forms/src/tests.rs      | 40 ++++++++++++++++++++++++++++
 crates/xfdf/src/lib.rs         |  6 ++---
 crates/xfdf/src/tests.rs       | 43 ++++++++++++++++++++++++++++++
 6 files changed, 131 insertions(+), 10 deletions(-)

diff --git a/crates/forms/src/appearance.rs b/crates/forms/src/appearance.rs
index f13f53f8..fc4e36d2 100644
--- a/crates/forms/src/appearance.rs
+++ b/crates/forms/src/appearance.rs
@@ -331,7 +331,7 @@ pub fn check_box_states(doc: &mut Document, w: &Widget, kind: FieldKind, on_name
     let s = width.min(height);
     let mark = check_mark(style, width / 2.0, height / 2.0, s);
     let mut nd = Dict::new();
-    nd.set(on_name.as_bytes().to_vec(), form(format!("{frame_c}{mark}")));
+    nd.set(crate::name_bytes(on_name), form(format!("{frame_c}{mark}")));
     nd.set(b"Off".to_vec(), form(frame_c));
     let mut ap = Dict::new();
     ap.set(b"N".to_vec(), Object::Dict(nd));
diff --git a/crates/forms/src/author.rs b/crates/forms/src/author.rs
index d51abda7..fd013328 100644
--- a/crates/forms/src/author.rs
+++ b/crates/forms/src/author.rs
@@ -809,7 +809,7 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
         }
         match &props.default_value {
             // Buttons name their default state; text and choices hold a string.
-            Some(Some(v)) if matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) => d.set(b"DV".to_vec(), Object::name(v)),
+            Some(Some(v)) if matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) => d.set(b"DV".to_vec(), Object::Name(crate::name_bytes(v))),
             Some(Some(v)) => d.set(b"DV".to_vec(), PdfString::text(v)),
             Some(None) => {
                 d.remove(b"DV");
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index 8d99b62c..d8685031 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -204,11 +204,49 @@ pub enum FieldValue {
 fn text_of(o: &Object) -> Option<String> {
     match o {
         Object::String(s) => Some(s.to_text()),
-        Object::Name(n) => Some(String::from_utf8_lossy(n).into_owned()),
+        Object::Name(n) => Some(name_text(n)),
         _ => None,
     }
 }
 
+/// A name object's bytes as text that [`name_bytes`] turns back into the same bytes. UTF-8 names
+/// read as themselves; other bytes (Shift-JIS check box states such as 「はい」 in Japanese
+/// forms) and `#` are written `#XX`, as in PDF name syntax.
+pub fn name_text(bytes: &[u8]) -> String {
+    let escape = |b: u8| format!("#{b:02X}");
+    match std::str::from_utf8(bytes) {
+        Ok(s) => s.replace('#', "#23"),
+        Err(_) => bytes.iter().map(|&b| if (0x21..=0x7e).contains(&b) && b != b'#' { char::from(b).to_string() } else { escape(b) }).collect(),
+    }
+}
+
+/// The bytes of the name written as `text` by [`name_text`] (`#XX` is the byte XX).
+pub fn name_bytes(text: &str) -> Vec<u8> {
+    let b = text.as_bytes();
+    let mut out = Vec::with_capacity(b.len());
+    let mut i = 0;
+    while let Some(&c) = b.get(i) {
+        let hex = |j: usize| b.get(j).and_then(|h| char::from(*h).to_digit(16));
+        match (c, hex(i + 1), hex(i + 2)) {
+            // Both digits are below 16, so the byte fits.
+            (b'#', Some(hi), Some(lo)) => {
+                out.push(u8::try_from(hi * 16 + lo).unwrap_or(b'#'));
+                i += 3;
+            }
+            _ => {
+                out.push(c);
+                i += 1;
+            }
+        }
+    }
+    out
+}
+
+/// A name object from text written by [`name_text`].
+fn name_obj(text: &str) -> Object {
+    Object::Name(name_bytes(text))
+}
+
 /// At most this many `/State` entries of a set-layer-visibility action are read.
 const MAX_LAYER_STATE: usize = 1024;
 
@@ -654,13 +692,13 @@ fn walk(
                 .map(|ap| doc.resolve(ap))
                 .and_then(|ap| ap.as_dict().and_then(|a| a.get(b"N").cloned()))
                 .and_then(|n| doc.resolve(&n).as_dict().cloned())
-                .and_then(|n| n.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).find(|k| k != "Off"));
+                .and_then(|n| n.iter().map(|(k, _)| name_text(k)).find(|k| k != "Off"));
             Some(Widget {
                 obj: w,
                 page: page_of.get(&w).copied(),
                 rect: [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])],
                 on_state: on_state.filter(|_| matches!(kind, FieldKind::CheckBox | FieldKind::Radio)),
-                state: wd.name(b"AS").map(|s| String::from_utf8_lossy(s).into_owned()),
+                state: wd.name(b"AS").map(name_text),
                 tab: usize::MAX,
                 locked: annot_flags & 128 != 0,
                 hidden: annot_flags & (2 | 32) != 0,
@@ -893,7 +931,7 @@ fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut
 /// Check boxes and radio buttons: `/V` on the field, `/AS` on each widget.
 fn set_states(doc: &mut Document, f: &Field, on: Option<&str>) -> Result<(), FormError> {
     let v = on.unwrap_or("Off");
-    doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), Object::name(v)))?;
+    doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), name_obj(v)))?;
     for w in &f.widgets {
         let state = match (on, w.on_state.as_deref()) {
             (Some(c), Some(s)) if c == s => s,
@@ -906,7 +944,7 @@ fn set_states(doc: &mut Document, f: &Field, on: Option<&str>) -> Result<(), For
             let ap = appearance::check_box_states(doc, w, f.kind, &on_name);
             doc.update_dict(w.obj, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
         }
-        doc.update_dict(w.obj, |d| d.set(b"AS".to_vec(), Object::name(state)))?;
+        doc.update_dict(w.obj, |d| d.set(b"AS".to_vec(), name_obj(state)))?;
     }
     Ok(())
 }
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 38fcfd8d..8e846edb 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -185,6 +185,46 @@ fn check_boxes_and_radios_switch_states() {
     assert!(field(&fields(&doc), "agree").value.is_empty());
 }
 
+#[test]
+fn check_boxes_keep_non_utf8_state_names() {
+    // Japanese forms often name a check box's on state 「はい」 in Shift-JIS: ticking it has to
+    // write those exact bytes to /AS and /V, or no appearance matches and no mark shows.
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R] >>".into(),
+        "<< /Fields [5 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /AS /Off /Rect [50 700 56 706] /P 3 0 R /AP << /N << /Off 6 0 R /#82#CD#82#A2 7 0 R >> >> >>".into(),
+        "<< /Length 0 >>\nstream\n\nendstream".into(),
+        "<< /Length 0 >>\nstream\n\nendstream".into(),
+    ];
+    let sjis_hai: &[u8] = b"\x82\xcd\x82\xa2";
+    let mut doc = document(&objs);
+    let all = fields(&doc);
+    assert_eq!(field(&all, "agree").widgets[0].on_state.as_deref(), Some("#82#CD#82#A2"));
+    set_value(&mut doc, "agree", &FieldValue::Check(true)).unwrap();
+    let doc = reopen(&doc);
+    let f = field(&fields(&doc), "agree").clone();
+    let wd = doc.get(f.widgets[0].obj).as_dict().cloned().unwrap();
+    assert_eq!(wd.name(b"AS"), Some(sjis_hai));
+    assert_eq!(doc.get(f.obj).as_dict().unwrap().name(b"V"), Some(sjis_hai));
+    assert_eq!(f.value, ["#82#CD#82#A2"]);
+    let mut doc = doc;
+    set_value(&mut doc, "agree", &FieldValue::Check(false)).unwrap();
+    assert_eq!(doc.get(f.widgets[0].obj).as_dict().unwrap().name(b"AS"), Some(&b"Off"[..]));
+}
+
+#[test]
+fn name_text_round_trips() {
+    for bytes in [&b"Yes"[..], b"\x82\xcd\x82\xa2", "はい".as_bytes(), b"A#1", b"a b", b"", b"\xff#\x00"] {
+        assert_eq!(name_bytes(&name_text(bytes)), bytes, "{bytes:?}");
+    }
+    assert_eq!(name_text("はい".as_bytes()), "はい");
+    assert_eq!(name_text(b"A#1"), "A#231");
+    // Malformed escapes stay as they are.
+    assert_eq!(name_bytes("#G1#4"), b"#G1#4");
+}
+
 #[test]
 fn choices_accept_exports_or_display_text() {
     let mut doc = fixture();
diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs
index e52e2318..19008061 100644
--- a/crates/xfdf/src/lib.rs
+++ b/crates/xfdf/src/lib.rs
@@ -152,7 +152,7 @@ fn nums_of(doc: &Document, o: Option<&Object>) -> Vec<f64> {
 fn text_of(doc: &Document, d: &Dict, k: &[u8]) -> Option<String> {
     d.get(k).and_then(|o| match &*doc.resolve(o) {
         Object::String(s) => Some(s.to_text()),
-        Object::Name(n) => Some(String::from_utf8_lossy(n).into_owned()),
+        Object::Name(n) => Some(pdfcraft_forms::name_text(n)),
         _ => None,
     })
 }
@@ -370,7 +370,7 @@ pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> V
             match f.kind {
                 FieldKind::CheckBox | FieldKind::Radio => {
                     let v = f.value.first().cloned().unwrap_or_else(|| "Off".into());
-                    pdfcraft_cos::serialize(&Object::Name(v.into_bytes()), &mut body);
+                    pdfcraft_cos::serialize(&Object::Name(pdfcraft_forms::name_bytes(&v)), &mut body);
                 }
                 FieldKind::List if f.value.len() > 1 => {
                     pdfcraft_cos::serialize(&Object::Array(f.value.iter().map(|v| Object::String(PdfString::text(v))).collect()), &mut body);
@@ -759,7 +759,7 @@ fn walk_fdf(fdf: &Document, list: &[Object], prefix: &str, out: &mut Vec<(String
         if let Some(v) = d.get(b"V").map(|v| fdf.resolve(v)) {
             let vals: Vec<String> = match &*v {
                 Object::String(s) => vec![s.to_text()],
-                Object::Name(n) => vec![String::from_utf8_lossy(n).into_owned()],
+                Object::Name(n) => vec![pdfcraft_forms::name_text(n)],
                 Object::Array(a) => a.iter().filter_map(|x| fdf.resolve(x).as_string().map(|s| s.to_text())).collect(),
                 _ => Vec::new(),
             };
diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index 10b17981..ca1debe4 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -132,6 +132,49 @@ fn fdf_round_trips_values_and_comments() {
     assert_eq!(comment_view(&dst), comment_view(&src), "replies keep their thread");
 }
 
+/// One page with a check box whose on state is the Shift-JIS name 「はい」 (`/#82#CD#82#A2`).
+fn shift_jis_check_box() -> Document {
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R] >>",
+        "<< /Fields [5 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [50 700 64 714] /P 3 0 R /AP << /N << /Off 6 0 R /#82#CD#82#A2 6 0 R >> >> >>",
+        "<< /Length 0 >>\nstream\n\nendstream",
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn non_utf8_check_box_states_round_trip() {
+    let sjis_hai: &[u8] = b"\x82\xcd\x82\xa2";
+    let mut src = shift_jis_check_box();
+    set_value(&mut src, "agree", &FieldValue::Check(true)).unwrap();
+    // FDF writes the state's own bytes, not its #XX text.
+    let fdf = export_fdf(&src, false, true, "form.pdf");
+    let name: &[u8] = b"/#82#CD#82#A2";
+    assert!(fdf.windows(name.len()).any(|w| w == name), "{}", String::from_utf8_lossy(&fdf));
+    for data in [fdf, export_xfdf(&src, false, true, "form.pdf").into_bytes()] {
+        let mut dst = shift_jis_check_box();
+        assert_eq!(import(&mut dst, &data).unwrap().fields, 1);
+        assert_eq!(values(&dst), values(&src));
+        let w = fields(&dst).into_iter().next().unwrap().widgets[0].obj;
+        assert_eq!(dst.get(w).as_dict().unwrap().name(b"AS"), Some(sjis_hai));
+    }
+}
+
 /// Who each comment replies to, by name, with its review state.
 fn threads(doc: &Document) -> Vec<(Option<String>, Option<String>, Option<String>)> {
     summaries(doc).into_iter().map(|s| (s.name, s.in_reply_to, s.state)).collect()

From 0375bd1e28960f15fc8947409d896d1fa52e36c9 Mon Sep 17 00:00:00 2001
From: Chen Tao <t.clydechen@gmail.com>
Date: Sat, 10 Oct 2026 01:59:33 +0900
Subject: [PATCH 093/149] M6.2: form fields in Unicode CID fonts show Japanese
 instead of "?" (#535)

* M6.2: form fields in Unicode CID fonts show Japanese instead of "?"

Japanese forms often give their fields a /DA font that /DR defines as a Type0
font with a predefined Unicode CMap, such as a non-embedded HeiseiMin-W3 with
/UniJIS-UCS2-H. Field appearances accepted only simple fonts, so they fell back
to Helvetica and WinAnsi, and every Japanese character was drawn as "?".

Appearances now use such fonts and encode the text in the CMap's form (UCS-2,
UTF-16, UTF-8 or UTF-32), measuring full-width characters as one em so centring,
auto size, comb cells and multiline wrapping fit. Identity-H and embedded CMaps
still fall back to Helvetica.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M6.2: vertical Unicode CMaps fall back to Helvetica, since field appearances are horizontal

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/fonts/src/lib.rs        | 115 ++++++++++++++++++++++++++++++++-
 crates/forms/src/appearance.rs |  63 +++++++++++++-----
 crates/forms/src/tests.rs      |  49 ++++++++++++++
 3 files changed, 209 insertions(+), 18 deletions(-)

diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index d5965f8b..ecd7630b 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -39,15 +39,51 @@ pub fn helvetica_width(s: &str, size: f64) -> f64 {
     units * size / 1000.0
 }
 
+/// Approximate advance of `s` at `size` points in a CJK font: full-width characters take one
+/// em, half-width forms half of one, and everything else is measured as Helvetica.
+pub fn cjk_width(s: &str, size: f64) -> f64 {
+    let mut buf = [0u8; 4];
+    s.chars()
+        .map(|c| match c {
+            '\u{ff61}'..='\u{ffdc}' | '\u{ffe8}'..='\u{ffee}' => size * 0.5,
+            _ if is_wide(c) => size,
+            _ => helvetica_width(c.encode_utf8(&mut buf), size),
+        })
+        .sum()
+}
+
+/// East Asian wide and full-width characters (Unicode UAX #11 W and F, by block).
+fn is_wide(c: char) -> bool {
+    matches!(c,
+        '\u{1100}'..='\u{115f}' // Hangul Jamo initials
+        | '\u{2e80}'..='\u{303e}' // CJK radicals, Kangxi, ideographic description, CJK symbols
+        | '\u{3041}'..='\u{33ff}' // kana, Bopomofo, Hangul compatibility, Kanbun, CJK compatibility
+        | '\u{3400}'..='\u{4dbf}' // CJK extension A
+        | '\u{4e00}'..='\u{9fff}' // CJK unified ideographs
+        | '\u{a000}'..='\u{a4cf}' // Yi
+        | '\u{ac00}'..='\u{d7a3}' // Hangul syllables
+        | '\u{f900}'..='\u{faff}' // CJK compatibility ideographs
+        | '\u{fe30}'..='\u{fe4f}' // CJK compatibility forms
+        | '\u{ff00}'..='\u{ff60}' // full-width forms
+        | '\u{ffe0}'..='\u{ffe6}'
+        | '\u{20000}'..='\u{3fffd}' // supplementary ideographic planes
+    )
+}
+
 /// Greedy line breaking within `width` points (paragraphs split on newlines; words longer
 /// than a line are broken by character).
 pub fn wrap(text: &str, size: f64, width: f64) -> Vec<String> {
+    wrap_with(text, size, width, helvetica_width)
+}
+
+/// [`wrap`], measuring with `measure` (for example [`cjk_width`]).
+pub fn wrap_with(text: &str, size: f64, width: f64, measure: impl Fn(&str, f64) -> f64) -> Vec<String> {
     let mut lines = Vec::new();
     for para in text.split(['\n', '\r']) {
         let mut line = String::new();
         for word in para.split(' ') {
             let candidate = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
-            if helvetica_width(&candidate, size) <= width || line.is_empty() && helvetica_width(word, size) <= width {
+            if measure(&candidate, size) <= width || line.is_empty() && measure(word, size) <= width {
                 line = candidate;
                 continue;
             }
@@ -55,7 +91,7 @@ pub fn wrap(text: &str, size: f64, width: f64) -> Vec<String> {
                 lines.push(std::mem::take(&mut line));
             }
             for ch in word.chars() {
-                if !line.is_empty() && helvetica_width(&format!("{line}{ch}"), size) > width {
+                if !line.is_empty() && measure(&format!("{line}{ch}"), size) > width {
                     lines.push(std::mem::take(&mut line));
                 }
                 line.push(ch);
@@ -87,6 +123,59 @@ pub fn win_ansi(s: &str) -> Vec<u8> {
     s.chars().map(|c| if c == '\t' { b' ' } else { win_ansi_byte(c).unwrap_or(b'?') }).collect()
 }
 
+/// The character encoding of a predefined Unicode CMap (`UniJIS-UTF16-H`, `UniGB-UCS2-H`, …;
+/// ISO 32000-2 §9.7.5.2), which maps Unicode text straight to codes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum UnicodeCMap {
+    Ucs2,
+    Utf16,
+    Utf8,
+    Utf32,
+}
+
+impl UnicodeCMap {
+    /// The encoding of the predefined CMap `name`, if it is a horizontal Unicode one. Vertical
+    /// (`-V`) CMaps are refused: field appearances are laid out horizontally, so their glyphs
+    /// would be drawn stacked down the field instead of across it.
+    pub fn from_name(name: &[u8]) -> Option<Self> {
+        let name = std::str::from_utf8(name).ok()?;
+        if !name.starts_with("Uni") || !name.ends_with("-H") {
+            return None;
+        }
+        name.split('-').find_map(|part| match part {
+            "UCS2" => Some(Self::Ucs2),
+            "UTF16" => Some(Self::Utf16),
+            "UTF8" => Some(Self::Utf8),
+            "UTF32" => Some(Self::Utf32),
+            _ => None,
+        })
+    }
+
+    /// Encode `s`; tabs become spaces, and characters UCS-2 can't hold become `?`.
+    pub fn encode(self, s: &str) -> Vec<u8> {
+        let mut out = Vec::with_capacity(s.len().saturating_mul(2));
+        let mut units = [0u16; 2];
+        let mut buf = [0u8; 4];
+        for c in s.chars() {
+            let c = if c == '\t' { ' ' } else { c };
+            match self {
+                Self::Ucs2 => {
+                    let unit = u16::try_from(u32::from(c)).unwrap_or(u16::from(b'?'));
+                    out.extend_from_slice(&unit.to_be_bytes());
+                }
+                Self::Utf16 => {
+                    for unit in c.encode_utf16(&mut units) {
+                        out.extend_from_slice(&unit.to_be_bytes());
+                    }
+                }
+                Self::Utf8 => out.extend_from_slice(c.encode_utf8(&mut buf).as_bytes()),
+                Self::Utf32 => out.extend_from_slice(&u32::from(c).to_be_bytes()),
+            }
+        }
+        out
+    }
+}
+
 /// Bytes as a PDF literal string, `(` … `)`, with delimiters escaped.
 pub fn literal(bytes: &[u8]) -> Vec<u8> {
     let mut out = Vec::with_capacity(bytes.len() + 2);
@@ -136,4 +225,26 @@ mod tests {
         assert_eq!(win_ansi("čć\u{81}\u{8d}\t"), b"???? ");
         assert_eq!(win_ansi_byte('\0'), None);
     }
+
+    #[test]
+    fn unicode_cmaps_encode_cjk_text() {
+        assert_eq!(UnicodeCMap::from_name(b"UniJIS-UTF16-H"), Some(UnicodeCMap::Utf16));
+        assert_eq!(UnicodeCMap::from_name(b"UniGB-UCS2-V"), None);
+        assert_eq!(UnicodeCMap::from_name(b"UniJIS-UCS2-HW-H"), Some(UnicodeCMap::Ucs2));
+        assert_eq!(UnicodeCMap::from_name(b"UniKS-UTF8-H"), Some(UnicodeCMap::Utf8));
+        assert_eq!(UnicodeCMap::from_name(b"UniJIS2004-UTF32-H"), Some(UnicodeCMap::Utf32));
+        assert_eq!(UnicodeCMap::from_name(b"Identity-H"), None);
+        assert_eq!(UnicodeCMap::from_name(b"90ms-RKSJ-H"), None);
+        assert_eq!(UnicodeCMap::from_name(b"\xff\xfe"), None);
+        assert_eq!(UnicodeCMap::Utf16.encode("令A"), [0x4e, 0xe4, 0x00, 0x41]);
+        assert_eq!(UnicodeCMap::Utf16.encode("𠀋"), [0xd8, 0x40, 0xdc, 0x0b]);
+        assert_eq!(UnicodeCMap::Ucs2.encode("𠀋\t"), [0x00, b'?', 0x00, b' ']);
+        assert_eq!(UnicodeCMap::Utf8.encode("令"), "令".as_bytes());
+        assert_eq!(UnicodeCMap::Utf32.encode("令"), [0, 0, 0x4e, 0xe4]);
+        assert_eq!(cjk_width("令和", 10.0), 20.0);
+        assert_eq!(cjk_width("ｱ", 10.0), 5.0);
+        assert_eq!(cjk_width("A", 10.0), helvetica_width("A", 10.0));
+        let lines = wrap_with("日本語のテキストは文字単位で折り返されます", 10.0, 45.0, cjk_width);
+        assert!(lines.len() > 3 && lines.iter().all(|l| cjk_width(l, 10.0) <= 45.0), "{lines:?}");
+    }
 }
diff --git a/crates/forms/src/appearance.rs b/crates/forms/src/appearance.rs
index fc4e36d2..38050cfb 100644
--- a/crates/forms/src/appearance.rs
+++ b/crates/forms/src/appearance.rs
@@ -5,12 +5,14 @@
 //! marked-content block as viewers expect. Supported: single-line, multiline (wrapped), comb,
 //! password, quadding, auto font size (`0 Tf`), combo boxes and list boxes (selection shown).
 //!
-//! The `/DA` font is used when the form's `/DR` defines it as a simple font; text is encoded in
-//! WinAnsi. Otherwise (composite fonts, missing resources) Helvetica is used, so text is always
-//! visible. Widths use the approximate Helvetica metrics of `pdfcraft-fonts`.
+//! The `/DA` font is used when the form's `/DR` defines it as a simple font (text encoded in
+//! WinAnsi) or as a composite font with a predefined Unicode CMap such as `UniJIS-UTF16-H`, as
+//! Japanese forms use (text encoded in that CMap). Otherwise (other composite fonts, missing
+//! resources) Helvetica is used, so text is always visible. Widths use the approximate metrics
+//! of `pdfcraft-fonts` (Helvetica, or one em per full-width character in composite fonts).
 
 use pdfcraft_cos::{Dict, Document, Object, Stream};
-use pdfcraft_fonts::{helvetica_width, literal, win_ansi, wrap};
+use pdfcraft_fonts::{UnicodeCMap, cjk_width, helvetica_width, literal, win_ansi, wrap_with};
 
 use crate::{Field, FieldKind, Widget, acroform, flags};
 
@@ -53,8 +55,32 @@ pub fn parse_da(da: &str) -> Da {
     out
 }
 
-/// The font resource for `name` from the form's `/DR`, if it is a simple font we can encode for.
-fn dr_font(doc: &Document, name: &str) -> Option<Object> {
+/// How a field font's text is encoded and measured.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum FontText {
+    WinAnsi,
+    /// A composite font with a predefined Unicode CMap.
+    Unicode(UnicodeCMap),
+}
+
+impl FontText {
+    fn encode(self, s: &str) -> Vec<u8> {
+        match self {
+            Self::WinAnsi => win_ansi(s),
+            Self::Unicode(cmap) => cmap.encode(s),
+        }
+    }
+
+    fn width(self, s: &str, size: f64) -> f64 {
+        match self {
+            Self::WinAnsi => helvetica_width(s, size),
+            Self::Unicode(_) => cjk_width(s, size),
+        }
+    }
+}
+
+/// The font resource for `name` from the form's `/DR`, if it is a font we can encode for.
+fn dr_font(doc: &Document, name: &str) -> Option<(Object, FontText)> {
     let af = acroform(doc)?;
     let dr = doc.resolve(af.get(b"DR")?);
     let fonts = doc.resolve(dr.as_dict()?.get(b"Font")?);
@@ -63,13 +89,17 @@ fn dr_font(doc: &Document, name: &str) -> Option<Object> {
     let fd = font.as_dict()?;
     match fd.name(b"Subtype") {
         Some(b"Type1" | b"TrueType" | b"MMType1") => {}
+        // Japanese, Chinese and Korean forms: a CID font addressed by Unicode (a non-embedded
+        // `/HeiseiMin-W3` with `/UniJIS-UCS2-H`, say). Embedded CMap streams and Identity-H need
+        // the font's own mapping, so those still fall back to Helvetica.
+        Some(b"Type0") => return Some((entry, FontText::Unicode(UnicodeCMap::from_name(fd.name(b"Encoding")?)?))),
         _ => return None,
     }
     // Symbolic fonts (ZapfDingbats, Symbol) can't show WinAnsi text.
     if matches!(fd.name(b"BaseFont"), Some(b"ZapfDingbats" | b"Symbol")) {
         return None;
     }
-    Some(entry)
+    Some((entry, FontText::WinAnsi))
 }
 
 fn helvetica() -> Object {
@@ -194,10 +224,11 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
     let wd = wobj.as_dict().cloned().unwrap_or_default();
     let (width, height) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
     let da = parse_da(wd.get(b"DA").and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text())).as_deref().unwrap_or(&f.da));
-    let (font_name, font_obj) = match dr_font(doc, &da.font) {
-        Some(o) => (da.font.clone(), o),
-        None => ("Helv".to_string(), helvetica()),
+    let (font_name, font_obj, enc) = match dr_font(doc, &da.font) {
+        Some((o, enc)) => (da.font.clone(), o, enc),
+        None => ("Helv".to_string(), helvetica(), FontText::WinAnsi),
     };
+    let width_of = |text: &str, size: f64| enc.width(text, size);
     let (mut c, bw) = frame(doc, &wd, width, height);
     let pad = 2.0 + bw;
     let inner_w = (width - 2.0 * pad).max(1.0);
@@ -205,11 +236,11 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
     let mut body: Vec<u8> = Vec::new();
     let show = |body: &mut Vec<u8>, x: f64, y: f64, text: &str| {
         body.extend(format!("1 0 0 1 {} {} Tm ", n(x), n(y)).bytes());
-        body.extend(literal(&win_ansi(text)));
+        body.extend(literal(&enc.encode(text)));
         body.extend_from_slice(b" Tj\n");
     };
     let x_for = |text: &str, size: f64| -> f64 {
-        let tw = helvetica_width(text, size);
+        let tw = width_of(text, size);
         match q {
             1 => pad + (inner_w - tw) / 2.0,
             2 => width - pad - tw,
@@ -249,12 +280,12 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
                 if size == 0.0 {
                     // Auto size: the largest size (≤ 12) whose wrapped lines fit the height.
                     size = 12.0;
-                    while size > 4.0 && wrap(&text, size, inner_w).len() as f64 * size * 1.15 > height - 2.0 * pad {
+                    while size > 4.0 && wrap_with(&text, size, inner_w, width_of).len() as f64 * size * 1.15 > height - 2.0 * pad {
                         size -= 0.5;
                     }
                 }
                 let mut y = height - pad - size * 0.85;
-                for line in wrap(&text, size, inner_w) {
+                for line in wrap_with(&text, size, inner_w, width_of) {
                     if y < -size {
                         break;
                     }
@@ -264,7 +295,7 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
             } else {
                 if size == 0.0 {
                     size = ((height - 2.0 * pad) / 1.15).clamp(4.0, 12.0);
-                    let tw = helvetica_width(&text, size);
+                    let tw = width_of(&text, size);
                     if tw > inner_w && !comb {
                         size = (size * inner_w / tw).max(4.0);
                     }
@@ -276,7 +307,7 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
                     let cell = width / cells as f64;
                     for (i, ch) in text.chars().take(cells).enumerate() {
                         let s = ch.to_string();
-                        show(&mut body, cell * i as f64 + (cell - helvetica_width(&s, size)) / 2.0, y, &s);
+                        show(&mut body, cell * i as f64 + (cell - width_of(&s, size)) / 2.0, y, &s);
                     }
                 } else {
                     show(&mut body, x_for(&text, size), y, &text);
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 8e846edb..74e4b080 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -159,6 +159,55 @@ fn text_fields_get_new_appearances() {
     assert!(raw.windows(8).any(|x| x == b"(Z\xfcrich)"));
 }
 
+#[test]
+fn japanese_choices_use_the_unicode_cid_font() {
+    // A choice field whose /DA names a non-embedded CID font with a predefined Unicode CMap
+    // (UniJIS-UTF16-H). Selecting 令 must draw it in that font, not "?" in Helvetica.
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [8 0 R 9 0 R 10 0 R] >>".into(),
+        "<< /Fields [8 0 R 9 0 R 10 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R /HeiseiMin-W3 6 0 R /Emb 7 0 R >> >> >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        "<< /Type /Font /Subtype /Type0 /BaseFont /HeiseiMin-W3 /Encoding /UniJIS-UTF16-H /DescendantFonts [<< /Type /Font /Subtype /CIDFontType0 /BaseFont /HeiseiMin-W3 /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 6 >> >>] >>".into(),
+        "<< /Type /Font /Subtype /Type0 /BaseFont /ABCDEF+Subset /Encoding /Identity-H /DescendantFonts [] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (era) /Ff 131072 /DA (/HeiseiMin-W3 10 Tf 0 g) /Q 1 /Opt [<FEFF3000> <FEFF660E> <FEFF4EE4>] /V <FEFF3000> /Rect [50 700 80 715] /P 3 0 R >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (address) /Ff 4096 /DA (/HeiseiMin-W3 10 Tf 0 g) /Rect [50 600 100 680] /P 3 0 R >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (subset) /DA (/Emb 10 Tf 0 g) /Rect [50 500 100 520] /P 3 0 R >>".into(),
+    ];
+    let mut doc = document(&objs);
+    assert_eq!(field(&fields(&doc), "era").options.get(2), Some(&("令".to_string(), "令".to_string())));
+    set_value(&mut doc, "era", &FieldValue::Text("令".into())).unwrap();
+    set_value(&mut doc, "address", &FieldValue::Text("日本語のテキスト入力欄です".into())).unwrap();
+    set_value(&mut doc, "subset", &FieldValue::Text("令和".into())).unwrap();
+    let doc = reopen(&doc);
+    let all = fields(&doc);
+    assert_eq!(field(&all, "era").value, ["令"]);
+    let raw = |name: &str| {
+        let w = &field(&all, name).widgets[0];
+        let n = doc.get(w.obj).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+        let Object::Stream(s) = &*doc.get(n) else { panic!() };
+        let fonts = doc.resolve(s.dict.get(b"Resources").unwrap()).as_dict().unwrap().get(b"Font").map(|f| doc.resolve(f)).unwrap();
+        let fonts: Vec<String> = fonts.as_dict().unwrap().iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect();
+        (s.decoded().unwrap(), fonts)
+    };
+    let utf16 = |t: &str| t.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
+    let (era, era_fonts) = raw("era");
+    assert!(era.windows(4).any(|x| x == b"(N\xe4)"), "令 as UTF-16BE: {}", String::from_utf8_lossy(&era));
+    assert!(String::from_utf8_lossy(&era).contains("/HeiseiMin-W3 10 Tf"));
+    assert!(!era.windows(3).any(|x| x == b"(?)"), "no WinAnsi fallback");
+    assert_eq!(era_fonts, ["HeiseiMin-W3"]);
+    // Multiline Japanese wraps by character at about one em each (50 pt wide, 10 pt type).
+    let (addr, _) = raw("address");
+    let addr_text = String::from_utf8_lossy(&addr);
+    assert!(addr_text.matches(" Tj").count() >= 4, "{addr_text}");
+    assert!(addr.windows(4).any(|x| x == utf16("日本").as_slice()));
+    // An Identity-H subset can't be addressed by Unicode: Helvetica, as before.
+    let (sub, sub_fonts) = raw("subset");
+    assert!(String::from_utf8_lossy(&sub).contains("/Helv "), "{}", String::from_utf8_lossy(&sub));
+    assert_eq!(sub_fonts, ["Helv"]);
+}
+
 #[test]
 fn check_boxes_and_radios_switch_states() {
     let mut doc = fixture();

From 2d24de1c16d46d9bbace012ae848c91f3e70558e Mon Sep 17 00:00:00 2001
From: Dimitar <bulgaria_mitko@yahoo.com>
Date: Fri, 9 Oct 2026 20:06:33 +0300
Subject: [PATCH 094/149] M7: edit text: Cyrillic/Greek fallback letters are
 spaced proportionally (#528)

Replacement text that the line's own (subset) font can't show and WinAnsi can't either goes
to the Type 3 fallback. For serif sources that was always Shippori Mincho, which has no
Cyrillic or Greek, so e.g. retyping a Bulgarian word in a Garamond line failed with
"Japanese fallback font has no glyph for U+0421". BIZ UDMincho and BIZ UDPGothic have the
letters. document_font_for_text keeps the style's face when it shows every character and
otherwise picks the closest Japanese face that does (Mincho first for serif, then weight).

Those faces draw Cyrillic and Greek full-width (1 em, JIS X 0208) with no palt metrics, so
fallback glyphs in those blocks are respaced to their ink width plus a 0.05 em side bearing.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/automation/src/tools.rs |  2 +-
 crates/edit/src/tests.rs       | 46 +++++++++++++++++++++++++++++++---
 crates/edit/src/text.rs        | 31 +++++++++++++++++------
 3 files changed, 68 insertions(+), 11 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index e088a64f..20963cd5 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -998,7 +998,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("text_edit", "Edit text", "Replace the text of one paragraph (paragraph, from text_paragraphs: rewrapped to the paragraph's width with its line spacing) or one line (line, from text_lines) in place, keeping position, size and colour. For a paragraph, also change its formatting: font (helvetica, times, courier) with bold/italic, size (points), color (#rrggbb), align (left, center, right, justify), underline, line_spacing (× size), char_spacing (points) and scale (horizontal, percent), or move it (dx, dy in points; up is +dy) and rewrap it to a new width (points); text may then be omitted. Its own font is reused when it can show every character and no font/weight change is requested; otherwise it uses a standard font matching the source style or, for Japanese, real Mincho/Gothic fallback outlines matching the requested/source family and available weight (the result shows the font used). Missing Japanese weights use Regular, not synthetic bold; the small web build has only Gothic Regular. Paragraph bold may be set without font to keep the source family. Text that no available font can show is refused. Undoable.")
+        t("text_edit", "Edit text", "Replace the text of one paragraph (paragraph, from text_paragraphs: rewrapped to the paragraph's width with its line spacing) or one line (line, from text_lines) in place, keeping position, size and colour. For a paragraph, also change its formatting: font (helvetica, times, courier) with bold/italic, size (points), color (#rrggbb), align (left, center, right, justify), underline, line_spacing (× size), char_spacing (points) and scale (horizontal, percent), or move it (dx, dy in points; up is +dy) and rewrap it to a new width (points); text may then be omitted. Its own font is reused when it can show every character and no font/weight change is requested; otherwise it uses a standard font matching the source style or, for Japanese and other text no standard font can show (Cyrillic, Greek), real Mincho/Gothic fallback outlines matching the requested/source family and available weight, from a face that has every character (the result shows the font used). Missing Japanese weights use Regular, not synthetic bold; the small web build has only Gothic Regular. Paragraph bold may be set without font to keep the source family. Text that no available font can show is refused. Undoable.")
             .cmd("edit.edit_text")
             .with(schema(
                 json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "line": { "type": "integer", "minimum": 1 },
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index fca770b5..3896b830 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -582,9 +582,13 @@ fn type3_fallback_glyphs_declare_a_well_formed_d1() {
     if without_craft_fonts("type3_fallback_glyphs_declare_a_well_formed_d1") {
         return;
     }
-    let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
-    text::replace_line(&mut doc, 0, 0, "見本商会 御中").unwrap();
-    let glyphs = fallback_paths(&reopen(&doc));
+    // Cyrillic is respaced (shifted by its side bearing), and its box must move with it.
+    let mut glyphs = Vec::new();
+    for replacement in ["見本商会 御中", "София 2027"] {
+        let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+        text::replace_line(&mut doc, 0, 0, replacement).unwrap();
+        glyphs.extend(fallback_paths(&reopen(&doc)));
+    }
     assert!(!glyphs.is_empty());
     for glyph in glyphs {
         let text = String::from_utf8(glyph).unwrap();
@@ -602,6 +606,42 @@ fn type3_fallback_glyphs_declare_a_well_formed_d1() {
     }
 }
 
+/// Shippori Mincho, the serif fallback, has no Cyrillic: Bulgarian replacement text in a serif
+/// line takes a fallback face that has every letter instead of failing on the first one.
+#[test]
+fn cyrillic_replacement_in_a_serif_line_uses_a_face_with_the_letters() {
+    if without_craft_fonts("cyrillic_replacement_in_a_serif_line_uses_a_face_with_the_letters") {
+        return;
+    }
+    let replacement = "София 2027";
+    for paragraph in [false, true] {
+        let mut doc = styled_text_page("ABCDEF+Garamond");
+        if paragraph {
+            text::replace_block(&mut doc, 0, 0, replacement).unwrap();
+        } else {
+            text::replace_line(&mut doc, 0, 0, replacement).unwrap();
+        }
+        let lines = text::text_lines(&reopen(&doc), 0).unwrap();
+        assert_eq!(lines[0].text, replacement);
+        // Letters are spaced by their shape, not one em each (the faces' full-width Cyrillic).
+        let widths = fallback_widths(&doc);
+        assert!(widths.iter().all(|w| *w > 300.0 && *w < 900.0), "{widths:?}");
+        assert!(widths.windows(2).any(|w| w[0] != w[1]), "proportional: {widths:?}");
+    }
+}
+
+/// The `/Widths` of the page's Type 3 fallback font, for its Cyrillic letters.
+fn fallback_widths(doc: &Document) -> Vec<f64> {
+    let p = pdfcraft_model::pages(doc).swap_remove(0);
+    let res = doc.resolve(p.dict.get(b"Resources").unwrap());
+    let fonts = doc.resolve(res.as_dict().unwrap().get(b"Font").unwrap());
+    let font = doc.resolve(fonts.as_dict().unwrap().get(b"PCJp").unwrap());
+    let font = font.as_dict().unwrap();
+    let widths = doc.resolve(font.get(b"Widths").unwrap()).as_array().unwrap().iter().filter_map(|w| w.as_f64()).collect::<Vec<_>>();
+    // "София 2027": the first five codes are the letters.
+    widths[..5].to_vec()
+}
+
 #[test]
 fn japanese_paragraph_keeps_ideographic_spaces() {
     if without_craft_fonts("japanese_paragraph_keeps_ideographic_spaces") {
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 7753b56f..2fe05ef6 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -538,32 +538,49 @@ fn pdf_num(v: f64) -> String {
 fn type3_path(face: &CraftFont, ch: char) -> Result<(Vec<u8>, f64), EditError> {
     let glyph = japanese_glyph_from(face, ch).map_err(|e| match e {
         GlyphError::NoFont => no_japanese_font(),
-        GlyphError::Missing => EditError::Invalid(format!("Japanese fallback font has no glyph for U+{:04X}", ch as u32)),
+        GlyphError::Missing => EditError::Invalid(format!("no fallback font has a glyph for U+{:04X}", ch as u32)),
         GlyphError::TooComplex => EditError::Invalid(format!("Japanese fallback glyph U+{:04X} is too complex", ch as u32)),
     })?;
+    let (dx, width) = proportional(ch, &glyph);
     let scale = 1000.0;
     // d1 is `wx wy llx lly urx ury` (ISO 32000-2 §9.6.4) with a box enclosing the glyph;
     // Acrobat draws a bullet in place of a glyph whose d1 is malformed.
     let b = if glyph.contours.is_empty() { [0.0; 4] } else { glyph.bbox };
     let mut out = format!(
         "{} 0 {} {} {} {} d1\n",
-        pdf_num(glyph.width * scale),
-        pdf_num((b[0] * scale).floor()),
+        pdf_num(width * scale),
+        pdf_num(((b[0] + dx) * scale).floor()),
         pdf_num((b[1] * scale).floor()),
-        pdf_num((b[2] * scale).ceil()),
+        pdf_num(((b[2] + dx) * scale).ceil()),
         pdf_num((b[3] * scale).ceil())
     )
     .into_bytes();
     for contour in glyph.contours {
         let Some(first) = contour.first() else { continue };
-        out.extend_from_slice(format!("{} {} m\n", pdf_num(first[0] * scale), pdf_num(first[1] * scale)).as_bytes());
+        out.extend_from_slice(format!("{} {} m\n", pdf_num((first[0] + dx) * scale), pdf_num(first[1] * scale)).as_bytes());
         for p in contour.iter().skip(1) {
-            out.extend_from_slice(format!("{} {} l\n", pdf_num(p[0] * scale), pdf_num(p[1] * scale)).as_bytes());
+            out.extend_from_slice(format!("{} {} l\n", pdf_num((p[0] + dx) * scale), pdf_num(p[1] * scale)).as_bytes());
         }
         out.extend_from_slice(b"h\n");
     }
     out.extend_from_slice(b"f\n");
-    Ok((out, glyph.width))
+    Ok((out, width))
+}
+
+/// Side bearing (em) given to a respaced glyph on each side.
+const SIDE_BEARING: f64 = 0.05;
+
+/// Shift and advance for a fallback glyph. Japanese faces draw Cyrillic and Greek full-width
+/// (one em each, as in JIS X 0208) and have no proportional (`palt`) metrics for them, so a
+/// word set that way reads as letter-spaced. Those letters get their ink width plus a side
+/// bearing instead; everything else keeps the face's own advance.
+fn proportional(ch: char, glyph: &pdfcraft_fonts::GlyphOutline) -> (f64, f64) {
+    let respace = matches!(ch, '\u{0370}'..='\u{03FF}' | '\u{0400}'..='\u{052F}' | '\u{1F00}'..='\u{1FFF}');
+    let ink = glyph.bbox[2] - glyph.bbox[0];
+    if !respace || glyph.contours.is_empty() || !(ink > 0.0 && ink < glyph.width) {
+        return (0.0, glyph.width);
+    }
+    (SIDE_BEARING - glyph.bbox[0], ink + 2.0 * SIDE_BEARING)
 }
 
 fn unicode_hex(ch: char) -> String {

From c9d06192267d5a4daf059dd70a117355e55c6670 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rk=20Bartalos?= <bartalos86@gmail.com>
Date: Fri, 9 Oct 2026 19:13:12 +0200
Subject: [PATCH 095/149] Forms: rotate field widgets with /MK /R (#516)

* M6: rotate form field widgets with /MK /R

Filling or restyling a rotated field redrew its text upright. Appearances now follow /MK /R, and Field Properties and form_set_props can set the rotation.

* Forms: a rotation refused as too small is checked before any other property is written; no indexing by widget number

* hu, uk: Rotation:

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                      |  26 ++---
 Cargo.lock                            |   1 +
 ROADMAP.md                            |   1 +
 crates/automation/src/forms.rs        |   6 ++
 crates/automation/src/tools.rs        |   5 +-
 crates/automation/tests/automation.rs |  28 ++++++
 crates/forms/Cargo.toml               |   1 +
 crates/forms/README.md                |   5 +-
 crates/forms/src/appearance.rs        |  67 +++++++++++-
 crates/forms/src/author.rs            |  78 ++++++++++++--
 crates/forms/src/lib.rs               |   3 +
 crates/forms/src/tests.rs             | 140 ++++++++++++++++++++++++++
 crates/ui-egui/src/i18n/bg.tsv        |   1 +
 crates/ui-egui/src/i18n/cs.tsv        |   1 +
 crates/ui-egui/src/i18n/de.tsv        |   1 +
 crates/ui-egui/src/i18n/es.tsv        |   1 +
 crates/ui-egui/src/i18n/fr.tsv        |   1 +
 crates/ui-egui/src/i18n/hu.tsv        |   1 +
 crates/ui-egui/src/i18n/ja.tsv        |   1 +
 crates/ui-egui/src/i18n/pt-br.tsv     |   1 +
 crates/ui-egui/src/i18n/ru.tsv        |   1 +
 crates/ui-egui/src/i18n/te.tsv        |   1 +
 crates/ui-egui/src/i18n/uk.tsv        |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv   |   1 +
 crates/ui-egui/src/i18n/zh-hant.tsv   |   1 +
 crates/ui-egui/src/prepare.rs         |  23 +++++
 crates/ui-egui/tests/prepare.rs       |  33 ++++++
 parity/acrobat-features.toml          |   6 +-
 28 files changed, 402 insertions(+), 34 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 51878b9e..20e81b7f 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6bed3ae5e307b0a225c49bb6a4c688911869f4bbf5df527a3bf84d0997e6baaf"
+sha256 = "997f3479a8930bacfc330ee2c7bf882720ac4a382630b87ae808c86702586926"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "42c3498eac138f95ac700f71332742658ed59bec171460aa675b1cb67e97ca36"
+sha256 = "8e2051a5fdf7c52cc4fd5f79bf4be3405c213e247cf80bba714e008ee405ec13"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fb315c0c3dfbafd35d73e7dedd1260daa1da919b0b30db53d16725cbd0f0ae12"
+sha256 = "8bab483a3f5ba3a724365c2a5a892291a10f41fdc443eaceb66f49c8a20cae20"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "20043dd4e64d6a8405dbf3167e9f315f68d4894c3d76c0b2b68e9c7e2879c06f"
+sha256 = "2cd5dcc6cf7e94914b955ee0f2f5c3e8951b16e26ab49fcb7111246a6e31ee2a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4c576bf5573a127ba2565980623e92b104699e7e03ac68dc3eddf4e788c7e8a4"
+sha256 = "05ebb95a81e3516fed37329237a6b4f26fd2168fa36cb3e16d4ae218d00e373a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "66ea8fd85159745626643bfce304dbe7ae0f9ae45a006a5d3834c3cad181080b"
+sha256 = "78f794a4fdcf870b15b5692f1ff5567d4afd439bb2647c637a7ec4bdb9bc2ddb"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ef0c8f5830ecb2950b6956eff50f963282bc607f4aedd98d89b9020a73db53b7"
+sha256 = "04f4cbb7d72d42059135bb2e49fcfcaa5812eae773047769c6024e289a0d149d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2c399d16589f2d0c3659c87406cb45d27792e7286774ededaa6578a224e2fae9"
+sha256 = "d3630f989e9725c22444dc27765142674b66f72436502ca969b2851fc38d703d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1782bfb95566a44e9cc3e22a595ff158965c55b67936d994a8dae9b3e51975a2"
+sha256 = "36d25dacd015fabf5e351407edbed3920bfdfb429d6a1482744c80e504c65c0d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "96fa31e4e77f54680ee2d66ad2a8d6662fd6dea592f8b07126e06f0bcbfc5248"
+sha256 = "cec5873ded1b535b2f9413408db8cc61e5a99a4ac9a62d13caaaca5c22b086c9"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "eb0b3fa525198152d7cf514284460ff904bcb9af091142ddd1c09deb8461ed69"
+sha256 = "1b164ae65c65e2902aebc1a12643cd51b2a67dd0ae2502726b8588fb3c6b54ff"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2bfcb94d72df43a6146e45e971950433a13bb008fc18c68463c096089f715466"
+sha256 = "d0cbe639f664b47ec97dd573ab2642b72a1b80c170f3a756f045647f5afa34cb"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6939906a84a2b5b7f5d2ca36c454ed1787751232d435daa30cc62ededbe7c165"
+sha256 = "0d4247fb4538391b8f65238c0a422e0bd751765c3e9e3c1e85428fb967f1296c"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/Cargo.lock b/Cargo.lock
index 09db2e2a..bd57e410 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3641,6 +3641,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
+ "pdfcraft-render",
  "thiserror 2.0.21",
 ]
 
diff --git a/ROADMAP.md b/ROADMAP.md
index e80fb3da..a8ee318e 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -127,6 +127,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 ## Log
 
+- **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
 
diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 4775bed2..eb3f1b38 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -194,6 +194,7 @@ impl Automation {
                     },
                     "page": w.and_then(|w| w.page).map(|p| p + 1),
                     "rect": rect,
+                    "rotation": w.map(|w| w.rotation).unwrap_or(0),
                     "read_only": f.read_only(),
                     "required": f.has(field_flags::REQUIRED),
                 });
@@ -394,6 +395,11 @@ impl Automation {
                     out
                 }
             },
+            rotation: match a.opt_int("rotation")? {
+                None => None,
+                Some(r @ (0 | 90 | 180 | 270)) => Some((0, r)),
+                Some(r) => return Err(ToolError::InvalidArgs(format!("rotation must be 0, 90, 180 or 270, not {r}"))),
+            },
             actions: None,
             check_style: match a.opt_str("check_style")? {
                 None => None,
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 20963cd5..79e82d4e 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -245,7 +245,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["doc", "from", "to"],
         )),
-        t("form_fields", "List form fields", "Every interactive form field: name, type (text, checkbox, radio, combo, list, button, signature), value, options, page and rect (top-left-origin points), read-only and required flags.")
+        t("form_fields", "List form fields", "Every interactive form field: name, type (text, checkbox, radio, combo, list, button, signature), value, options, page, rect (top-left-origin points) and rotation (0, 90, 180 or 270 degrees counterclockwise), read-only and required flags.")
             .ro()
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t(
@@ -298,7 +298,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "form_set_props",
             "Field properties",
-            "Change a field's properties (General and Options tabs): name (renames it), tooltip, read_only, required, multiline, max_length (0 = no limit), options (combo/list items), font_size (0 = auto), rect (position), format, validate, calculate (Acrobat's Format/Validate/Calculate tabs, run natively: values are checked, formatted and recalculated as in Acrobat). Options tab: align (left, center, right), default (the value Reset form restores; for check boxes and radio buttons their on state, \"\" for off), flags { scroll, rich_text, password, file_select, spell_check, comb (needs max_length), sort, editable, multi_select, commit_immediately }, check_style (check boxes and radio buttons: check, circle, cross, diamond, square, star). Only the given ones change. Undoable.",
+            "Change a field's properties (General and Options tabs): name (renames it), tooltip, read_only, required, multiline, max_length (0 = no limit), options (combo/list items), font_size (0 = auto), rect (position), rotation (0, 90, 180 or 270 degrees counterclockwise; changing between horizontal and vertical swaps width and height around the center), format, validate, calculate (Acrobat's Format/Validate/Calculate tabs, run natively: values are checked, formatted and recalculated as in Acrobat). Options tab: align (left, center, right), default (the value Reset form restores; for check boxes and radio buttons their on state, \"\" for off), flags { scroll, rich_text, password, file_select, spell_check, comb (needs max_length), sort, editable, multi_select, commit_immediately }, check_style (check boxes and radio buttons: check, circle, cross, diamond, square, star). Only the given ones change. Undoable.",
         )
         .with(schema(
             json!({
@@ -318,6 +318,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "flags": { "type": "object", "additionalProperties": { "type": "boolean" } },
                 "font_size": { "type": "number", "minimum": 0 },
                 "rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4, "description": "Move/resize: points from the top-left of the displayed page." },
+                "rotation": { "type": "integer", "enum": [0, 90, 180, 270], "description": "Widget rotation in degrees, counterclockwise. Changing between horizontal and vertical swaps the rectangle around its center." },
                 "appearance": { "type": "object", "description": "Appearance tab: border, fill, text_color (#RRGGBB, a name or \"none\"), width (1 thin, 2 medium, 3 thick), style (solid, dashed, beveled, inset, underline), font (helvetica, times, courier)." },
                 "format": { "description": "Format tab: {\"type\": \"number\", \"decimals\": 2, \"currency\": \"$\", \"separator\": 0-4, \"negative\": 0-3}, {\"type\": \"percent\"}, {\"type\": \"date\"|\"time\", \"pattern\": \"mm/dd/yyyy\"}, {\"type\": \"zip\"|\"zip4\"|\"phone\"|\"ssn\"}, {\"type\": \"mask\", \"mask\": \"AA-9999\"}, or \"none\"." },
                 "validate": { "description": "Validate tab: {\"min\": 0, \"max\": 100} (either may be left out) or \"none\"." },
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index ead2321c..e82bdc32 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1698,6 +1698,34 @@ fn preparing_a_form_through_tools() {
     assert!(matches!(a.call("form_set_image", &json!({ "doc": doc, "field": "size", "path": "pics/a_page_1.png" })), Err(ToolError::Failed(_))));
 }
 
+#[test]
+fn rotating_a_field_through_tools() {
+    let dir = workdir("rotate-field");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "form_add_field", json!({ "doc": doc, "page": 1, "type": "text", "rect": [20, 20, 180, 42], "name": "City" }));
+    let rect_of = |a: &mut Automation| {
+        let f = &ok(a, "form_fields", json!({ "doc": doc }))["fields"][0];
+        (f["rotation"].as_i64().unwrap(), f["rect"].as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect::<Vec<_>>())
+    };
+    let (rot, before) = rect_of(&mut a);
+    assert_eq!(rot, 0);
+    assert!(matches!(a.call("form_set_props", &json!({ "doc": doc, "field": "City", "rotation": 45 })), Err(ToolError::InvalidArgs(_))));
+    assert_eq!(rect_of(&mut a).1, before, "a rejected rotation changes nothing");
+    ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "City", "rotation": 90 }));
+    let (rot, turned) = rect_of(&mut a);
+    assert_eq!(rot, 90);
+    let (bw, bh) = (before[2] - before[0], before[3] - before[1]);
+    let (tw, th) = (turned[2] - turned[0], turned[3] - turned[1]);
+    assert!((tw - bh).abs() < 0.2 && (th - bw).abs() < 0.2, "swapped {before:?} -> {turned:?}");
+    let center = |r: &[f64]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    let (bc, tc) = (center(&before), center(&turned));
+    assert!((bc.0 - tc.0).abs() < 0.2 && (bc.1 - tc.1).abs() < 0.2, "center moved {bc:?} -> {tc:?}");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Change field properties");
+    let (rot, back) = rect_of(&mut a);
+    assert_eq!((rot, back), (0, before));
+}
+
 #[test]
 fn redacting_through_tools() {
     let dir = workdir("redact");
diff --git a/crates/forms/Cargo.toml b/crates/forms/Cargo.toml
index 3f085ee6..ce6a73a5 100644
--- a/crates/forms/Cargo.toml
+++ b/crates/forms/Cargo.toml
@@ -17,3 +17,4 @@ thiserror = { workspace = true }
 
 [dev-dependencies]
 hayro-syntax = { workspace = true }
+pdfcraft-render = { workspace = true }
diff --git a/crates/forms/README.md b/crates/forms/README.md
index 27459bab..0fa6d0de 100644
--- a/crates/forms/README.md
+++ b/crates/forms/README.md
@@ -39,5 +39,6 @@ delete_field(&mut doc, "email")?;
 ## Not yet
 
 JavaScript actions (format, keystroke, validate, calculate; M6.4/M6.5), rich-text values,
-`/MK /R` rotation, the Appearance (colours, fonts), Actions, Format, Validate and Calculate
-property tabs, FDF/XFDF import and export (M6.7).
+the Appearance (colours, fonts), Actions, Format, Validate and Calculate property tabs,
+FDF/XFDF import and export (M6.7). `/MK /R` rotation (0, 90, 180, 270) is drawn into the
+appearance.
diff --git a/crates/forms/src/appearance.rs b/crates/forms/src/appearance.rs
index 38050cfb..ea88f675 100644
--- a/crates/forms/src/appearance.rs
+++ b/crates/forms/src/appearance.rs
@@ -10,6 +10,10 @@
 //! Japanese forms use (text encoded in that CMap). Otherwise (other composite fonts, missing
 //! resources) Helvetica is used, so text is always visible. Widths use the approximate metrics
 //! of `pdfcraft-fonts` (Helvetica, or one em per full-width character in composite fonts).
+//!
+//! `/MK /R` (0, 90, 180, 270, counterclockwise) lays the content out in the upright box and sets
+//! the appearance `/Matrix` so that box lands on the widget rectangle. Any other value is 0, and
+//! rotation 0 leaves `/Matrix` off.
 
 use pdfcraft_cos::{Dict, Document, Object, Stream};
 use pdfcraft_fonts::{UnicodeCMap, cjk_width, helvetica_width, literal, win_ansi, wrap_with};
@@ -28,6 +32,57 @@ pub fn fmt(v: f64) -> String {
     n(v)
 }
 
+/// `/MK /R` as a quadrant, or 0 when it is missing or not a multiple of 90.
+pub(crate) fn mk_rotation(doc: &Document, wd: &Dict) -> i64 {
+    let Some(raw) = wd.get(b"MK") else { return 0 };
+    let mk_obj = doc.resolve(raw);
+    let Some(mk) = mk_obj.as_dict() else { return 0 };
+    let Some(r_obj) = mk.get(b"R") else { return 0 };
+    let resolved = doc.resolve(r_obj);
+    let Some(r) = degrees(&resolved) else { return 0 };
+    match r.rem_euclid(360) {
+        q @ (0 | 90 | 180 | 270) => q,
+        _ => 0,
+    }
+}
+
+fn degrees(o: &Object) -> Option<i64> {
+    if let Some(i) = o.as_int() {
+        return Some(i);
+    }
+    let v = o.as_f64()?;
+    (v.is_finite() && v.abs() <= 1.0e6).then_some(v.round() as i64)
+}
+
+/// Where an appearance is drawn: the upright layout box, and the `/Matrix` that turns it onto
+/// the widget rectangle. Rotation 0 has no matrix.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Placement {
+    pub layout_w: f64,
+    pub layout_h: f64,
+    pub matrix: Option<[f64; 6]>,
+}
+
+pub(crate) fn placement(rotation: i64, page_w: f64, page_h: f64) -> Placement {
+    let (layout_w, layout_h, matrix) = match rotation {
+        // (x, y) -> (page_w - y, x): text that ran to the right runs upward.
+        90 => (page_h, page_w, Some([0.0, 1.0, -1.0, 0.0, page_w, 0.0])),
+        180 => (page_w, page_h, Some([-1.0, 0.0, 0.0, -1.0, page_w, page_h])),
+        // (x, y) -> (y, page_h - x): text that ran to the right runs downward.
+        270 => (page_h, page_w, Some([0.0, -1.0, 1.0, 0.0, 0.0, page_h])),
+        _ => (page_w, page_h, None),
+    };
+    Placement { layout_w, layout_h, matrix }
+}
+
+pub(crate) fn set_form_box(d: &mut Dict, place: Placement) {
+    let box_ = [0.0, 0.0, place.layout_w, place.layout_h];
+    d.set(b"BBox".to_vec(), Object::Array(box_.iter().map(|v| Object::Real(*v)).collect()));
+    if let Some(m) = place.matrix {
+        d.set(b"Matrix".to_vec(), Object::Array(m.iter().map(|v| Object::Real(*v)).collect()));
+    }
+}
+
 /// A parsed default appearance string: font resource name, size (0 = auto) and colour operator.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Da {
@@ -222,7 +277,9 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
     };
     let wobj = doc.get(w.obj);
     let wd = wobj.as_dict().cloned().unwrap_or_default();
-    let (width, height) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
+    let (page_w, page_h) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
+    let place = placement(mk_rotation(doc, &wd), page_w, page_h);
+    let (width, height) = (place.layout_w, place.layout_h);
     let da = parse_da(wd.get(b"DA").and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text())).as_deref().unwrap_or(&f.da));
     let (font_name, font_obj, enc) = match dr_font(doc, &da.font) {
         Some((o, enc)) => (da.font.clone(), o, enc),
@@ -338,7 +395,7 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
     let mut d = Dict::new();
     d.set(b"Type".to_vec(), Object::name("XObject"));
     d.set(b"Subtype".to_vec(), Object::name("Form"));
-    d.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, width, height].iter().map(|v| Object::Real(*v)).collect()));
+    set_form_box(&mut d, place);
     d.set(b"Resources".to_vec(), Object::Dict(res));
     Stream::flate(d, &content)
 }
@@ -349,14 +406,16 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
 pub fn check_box_states(doc: &mut Document, w: &Widget, kind: FieldKind, on_name: &str) -> Dict {
     let wobj = doc.get(w.obj);
     let wd = wobj.as_dict().cloned().unwrap_or_default();
-    let (width, height) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
+    let (page_w, page_h) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
+    let place = placement(mk_rotation(doc, &wd), page_w, page_h);
+    let (width, height) = (place.layout_w, place.layout_h);
     let (frame_c, _) = frame(doc, &wd, width, height);
     let style = crate::author::CheckStyle::of_widget(doc, &wd, kind);
     let mut form = |content: String| -> Object {
         let mut d = Dict::new();
         d.set(b"Type".to_vec(), Object::name("XObject"));
         d.set(b"Subtype".to_vec(), Object::name("Form"));
-        d.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, width, height].iter().map(|v| Object::Real(*v)).collect()));
+        set_form_box(&mut d, place);
         Object::Ref(doc.add(Object::Stream(Stream::flate(d, content.as_bytes()))))
     };
     let s = width.min(height);
diff --git a/crates/forms/src/author.rs b/crates/forms/src/author.rs
index fd013328..edf5294c 100644
--- a/crates/forms/src/author.rs
+++ b/crates/forms/src/author.rs
@@ -91,6 +91,10 @@ pub struct FieldProps {
     pub actions: Option<Vec<(crate::Trigger, crate::FieldAction)>>,
     /// Options tab: the mark of a check box or radio button (every widget).
     pub check_style: Option<CheckStyle>,
+    /// Position tab: rotate one widget (`/MK /R`) to 0, 90, 180 or 270 degrees counterclockwise.
+    /// Changing between horizontal and vertical swaps that widget's width and height around its
+    /// center, unless [`Self::rect`] is also set.
+    pub rotation: Option<(usize, i64)>,
 }
 
 fn invalid<T>(m: impl Into<String>) -> Result<T, FormError> {
@@ -524,6 +528,7 @@ pub fn add_field(doc: &mut Document, page: usize, rect: [f64; 4], kind: &NewFiel
                 tab: usize::MAX,
                 locked: false,
                 hidden: false,
+                rotation: 0,
             };
             let ap = appearance::check_box_states(doc, &w, FieldKind::Radio, export);
             doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
@@ -574,10 +579,12 @@ pub fn redraw_field(doc: &mut Document, name: &str) -> Result<(), FormError> {
     Ok(())
 }
 
-fn frame_only(doc: &Document, w: &Widget) -> (String, f64, f64) {
-    let (width, height) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
+fn frame_only(doc: &Document, w: &Widget) -> (String, crate::appearance::Placement) {
+    let (page_w, page_h) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
     let wobj = doc.get(w.obj);
     let wd = wobj.as_dict().cloned().unwrap_or_default();
+    let place = crate::appearance::placement(crate::appearance::mk_rotation(doc, &wd), page_w, page_h);
+    let (width, height) = (place.layout_w, place.layout_h);
     let mk = wd.get(b"MK").and_then(|m| m.as_dict()).cloned().unwrap_or_default();
     let col = |k: &[u8]| -> Option<String> {
         let v: Vec<f64> = mk.get(k)?.as_array()?.iter().filter_map(|x| x.as_f64()).collect();
@@ -590,14 +597,14 @@ fn frame_only(doc: &Document, w: &Widget) -> (String, f64, f64) {
     if let Some(bc) = col(b"BC") {
         c.push_str(&format!("{bc} RG 1 w 0.5 0.5 {:.3} {:.3} re S\n", width - 1.0, height - 1.0));
     }
-    (c, width, height)
+    (c, place)
 }
 
-fn form_stream(width: f64, height: f64, content: Vec<u8>, resources: Dict) -> Stream {
+fn form_stream(place: crate::appearance::Placement, content: Vec<u8>, resources: Dict) -> Stream {
     let mut d = Dict::new();
     d.set(b"Type".to_vec(), Object::name("XObject"));
     d.set(b"Subtype".to_vec(), Object::name("Form"));
-    d.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, width, height].iter().map(|v| Object::Real(*v)).collect()));
+    crate::appearance::set_form_box(&mut d, place);
     d.set(b"Resources".to_vec(), Object::Dict(resources));
     Stream::flate(d, &content)
 }
@@ -605,7 +612,8 @@ fn form_stream(width: f64, height: f64, content: Vec<u8>, resources: Dict) -> St
 /// A push button: background, border, its icon (`/MK /I`, scaled to fit and centred) and its
 /// centred caption (unless the layout is icon only, `/TP 1`).
 fn button_appearance(doc: &Document, w: &Widget) -> Stream {
-    let (mut c, width, height) = frame_only(doc, w);
+    let (mut c, place) = frame_only(doc, w);
+    let (width, height) = (place.layout_w, place.layout_h);
     let wobj = doc.get(w.obj);
     let mk = wobj.as_dict().and_then(|d| d.get(b"MK")).map(|m| doc.resolve(m)).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
     let caption = mk.get(b"CA").and_then(|c| c.as_string()).map(|s| s.to_text()).unwrap_or_default();
@@ -646,7 +654,7 @@ fn button_appearance(doc: &Document, w: &Widget) -> Stream {
     if !xobjects.is_empty() {
         res.set(b"XObject".to_vec(), Object::Dict(xobjects));
     }
-    form_stream(width, height, content, res)
+    form_stream(place, content, res)
 }
 
 /// Give a push button (an image field) the picture `image` (an image XObject of `px` pixels):
@@ -662,7 +670,8 @@ pub fn set_button_icon(doc: &mut Document, name: &str, image: ObjRef, px: (u32,
     xo.set(b"Im0".to_vec(), Object::Ref(image));
     let mut res = Dict::new();
     res.set(b"XObject".to_vec(), Object::Dict(xo));
-    let icon = doc.add(Object::Stream(form_stream(w, h, format!("q {w} 0 0 {h} 0 0 cm /Im0 Do Q").into_bytes(), res)));
+    let icon =
+        doc.add(Object::Stream(form_stream(crate::appearance::placement(0, w, h), format!("q {w} 0 0 {h} 0 0 cm /Im0 Do Q").into_bytes(), res)));
     for wd in &f.widgets {
         let mut mk =
             doc.get(wd.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m))).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
@@ -676,14 +685,43 @@ pub fn set_button_icon(doc: &mut Document, name: &str, image: ObjRef, px: (u32,
 }
 
 fn empty_box(doc: &Document, w: &Widget) -> Stream {
-    let (c, width, height) = frame_only(doc, w);
-    form_stream(width, height, c.into_bytes(), Dict::new())
+    let (c, place) = frame_only(doc, w);
+    form_stream(place, c.into_bytes(), Dict::new())
+}
+
+/// Swap width and height, keeping the center. `None` when that is not a usable widget.
+fn swapped_around_center(r: [f64; 4]) -> Option<[f64; 4]> {
+    if !r.iter().all(|v| v.is_finite()) {
+        return None;
+    }
+    let (x0, y0, x1, y1) = (r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3]));
+    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
+    let (nw, nh) = (y1 - y0, x1 - x0);
+    let out = [cx - nw / 2.0, cy - nh / 2.0, cx + nw / 2.0, cy + nh / 2.0];
+    (out.iter().all(|v| v.is_finite()) && out[2] - out[0] >= 4.0 && out[3] - out[1] >= 4.0).then_some(out)
 }
 
 /// Change a field's properties (General and Options tabs) and redraw it.
 pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<String, FormError> {
     let all = fields(doc);
     let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
+    // Validated before anything is written, so a refused rotation leaves the document unchanged.
+    // `Some(Some(rect))`: the widget's axis changes and it gets the swapped rectangle.
+    let mut rotated_rect: Option<Option<[f64; 4]>> = None;
+    if let Some((wi, rot)) = props.rotation {
+        if !matches!(rot, 0 | 90 | 180 | 270) {
+            return invalid("rotation must be 0, 90, 180 or 270 degrees");
+        }
+        let Some(w) = f.widgets.get(wi) else {
+            return invalid(format!("{name} has no widget {}", wi.saturating_add(1)));
+        };
+        let axis_change = (w.rotation % 180 == 0) != (rot % 180 == 0);
+        rotated_rect = Some(None);
+        if axis_change && props.rect.is_none() {
+            let Some(rect) = swapped_around_center(w.rect) else { return invalid("the field is too small") };
+            rotated_rect = Some(Some(rect));
+        }
+    }
     // A locked field only takes unlocking (Acrobat greys its properties out).
     if f.locked() && props.locked != Some(false) && *props != (FieldProps { locked: props.locked, ..FieldProps::default() }) {
         return invalid(format!("{name} is locked: unlock it first"));
@@ -943,6 +981,26 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
             }
         }
     }
+    if let (Some((wi, rot)), Some(swapped)) = (props.rotation, rotated_rect)
+        && let Some(w) = f.widgets.get(wi)
+    {
+        if let Some(rect) = swapped {
+            doc.update_dict(w.obj, |d| d.set(b"Rect".to_vec(), Object::Array(rect.iter().map(|v| Object::Real(*v)).collect())))?;
+        }
+        let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
+        if rot == 0 {
+            mk.remove(b"R");
+        } else {
+            mk.set(b"R".to_vec(), Object::Int(rot));
+        }
+        doc.update_dict(w.obj, |d| {
+            if mk.is_empty() {
+                d.remove(b"MK");
+            } else {
+                d.set(b"MK".to_vec(), Object::Dict(mk));
+            }
+        })?;
+    }
     redraw_field(doc, &new_name)?;
     if props.calculate.is_some() {
         crate::recalculate(doc)?;
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index d8685031..041c2480 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -101,6 +101,8 @@ pub struct Widget {
     pub locked: bool,
     /// The widget's Hidden or NoView flag (`/F` bit 2 or 6): it isn't shown and takes no input.
     pub hidden: bool,
+    /// `/MK /R` as 0, 90, 180 or 270 degrees counterclockwise. Anything else is stored as 0.
+    pub rotation: i64,
 }
 
 /// A terminal form field.
@@ -702,6 +704,7 @@ fn walk(
                 tab: usize::MAX,
                 locked: annot_flags & 128 != 0,
                 hidden: annot_flags & (2 | 32) != 0,
+                rotation: appearance::mk_rotation(doc, wd),
             })
         })
         .collect();
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 74e4b080..6d5317ad 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -955,3 +955,143 @@ fn page_shapes_reads_boxes_and_rules() {
     assert_eq!(sh.boxes, [[20.0, 20.0, 32.0, 32.0]]);
     assert_eq!(sh.rules, [[40.0, 100.0, 240.0, 100.0], [60.0, 600.5, 260.0, 600.5]]);
 }
+
+fn close(a: f64, b: f64) -> bool {
+    (a - b).abs() < 0.05
+}
+
+fn nums(o: &Object) -> Vec<f64> {
+    o.as_array().unwrap().iter().filter_map(Object::as_f64).collect()
+}
+
+/// Normal appearance `/BBox` and `/Matrix` (absent when the widget is not rotated).
+fn appearance_box(doc: &Document, w: &Widget) -> (Vec<f64>, Option<Vec<f64>>) {
+    let n = doc.get(w.obj).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+    let Object::Stream(s) = &*doc.get(n) else { panic!("appearance") };
+    (nums(s.dict.get(b"BBox").unwrap()), s.dict.get(b"Matrix").map(nums))
+}
+
+#[test]
+fn rotated_fields_draw_in_their_quadrant() {
+    let mut doc = fixture();
+    // No /R: the appearance is the widget rectangle and carries no /Matrix.
+    set_value(&mut doc, "name", &FieldValue::Text("Ada".into())).unwrap();
+    let (bbox, matrix) = appearance_box(&doc, &field(&fields(&doc), "name").widgets[0]);
+    assert!(close(bbox[2], 200.0) && close(bbox[3], 20.0), "{bbox:?}");
+    assert!(matrix.is_none(), "{matrix:?}");
+
+    let set_r = |doc: &mut Document, degrees: i64| {
+        let obj = field(&fields(doc), "name").widgets[0].obj;
+        doc.update_dict(obj, |d| {
+            let mut mk = d.get(b"MK").and_then(|m| m.as_dict().cloned()).unwrap_or_default();
+            mk.set(b"R".to_vec(), Object::Int(degrees));
+            d.set(b"MK".to_vec(), Object::Dict(mk));
+        })
+        .unwrap();
+        set_value(doc, "name", &FieldValue::Text("Ada".into())).unwrap();
+    };
+    // 90 and 270 lay the text out in the swapped box. 180 keeps the box and turns it over.
+    set_r(&mut doc, 90);
+    let (bbox, matrix) = appearance_box(&doc, &field(&fields(&doc), "name").widgets[0]);
+    assert!(close(bbox[2], 20.0) && close(bbox[3], 200.0), "{bbox:?}");
+    let m = matrix.unwrap();
+    assert!(close(m[0], 0.0) && close(m[1], 1.0) && close(m[2], -1.0) && close(m[4], 200.0), "{m:?}");
+    set_r(&mut doc, 180);
+    let (bbox, matrix) = appearance_box(&doc, &field(&fields(&doc), "name").widgets[0]);
+    assert!(close(bbox[2], 200.0) && close(bbox[3], 20.0), "{bbox:?}");
+    let m = matrix.unwrap();
+    assert!(close(m[0], -1.0) && close(m[3], -1.0) && close(m[4], 200.0) && close(m[5], 20.0), "{m:?}");
+    set_r(&mut doc, 270);
+    let (bbox, matrix) = appearance_box(&doc, &field(&fields(&doc), "name").widgets[0]);
+    assert!(close(bbox[2], 20.0) && close(bbox[3], 200.0), "{bbox:?}");
+    let m = matrix.unwrap();
+    assert!(close(m[1], -1.0) && close(m[2], 1.0) && close(m[5], 20.0), "{m:?}");
+    // A non-quadrant /R is drawn upright.
+    set_r(&mut doc, 45);
+    let (bbox, matrix) = appearance_box(&doc, &field(&fields(&doc), "name").widgets[0]);
+    assert!(matrix.is_none() && close(bbox[2], 200.0) && close(bbox[3], 20.0), "{bbox:?} {matrix:?}");
+    assert_eq!(field(&fields(&doc), "name").widgets[0].rotation, 0);
+
+    let before = field(&fields(&doc), "name").widgets[0].rect;
+    assert!(set_props(&mut doc, "name", &FieldProps { rotation: Some((0, 45)), ..FieldProps::default() }).is_err());
+    assert!(field(&fields(&doc), "name").widgets[0].rect.iter().zip(before).all(|(a, b)| close(*a, b)));
+    set_props(&mut doc, "name", &FieldProps { rotation: Some((0, 90)), ..FieldProps::default() }).unwrap();
+    let turned = field(&fields(&doc), "name").widgets[0].clone();
+    assert_eq!(turned.rotation, 90);
+    let r = turned.rect;
+    // [50 700 250 720] around its center becomes 20 wide and 200 tall.
+    assert!(close(r[0], 140.0) && close(r[1], 610.0) && close(r[2], 160.0) && close(r[3], 810.0), "{r:?}");
+    let widget = doc.get(turned.obj);
+    let mk = widget.as_dict().unwrap().get(b"MK").unwrap().as_dict().cloned().unwrap();
+    assert!(mk.contains(b"BG") && mk.contains(b"BC") && mk.int(b"R") == Some(90));
+    let (_, matrix) = appearance_box(&doc, &turned);
+    assert!(matrix.is_some());
+    // 270 stays on the vertical axis, so the rectangle is not swapped again.
+    set_props(&mut doc, "name", &FieldProps { rotation: Some((0, 270)), ..FieldProps::default() }).unwrap();
+    let r270 = field(&fields(&doc), "name").widgets[0].rect;
+    assert!(r270.iter().zip(r).all(|(a, b)| close(*a, b)), "{r270:?}");
+
+    // A check box and a push button use the same matrix.
+    let mut doc = one_page();
+    add_field(&mut doc, 0, [20.0, 40.0, 40.0, 60.0], &NewField::CheckBox, Some("agree")).unwrap();
+    add_field(&mut doc, 0, [20.0, 80.0, 120.0, 110.0], &NewField::Button { caption: "Go".into() }, Some("go")).unwrap();
+    set_props(&mut doc, "agree", &FieldProps { rotation: Some((0, 90)), ..FieldProps::default() }).unwrap();
+    set_props(&mut doc, "go", &FieldProps { rotation: Some((0, 90)), ..FieldProps::default() }).unwrap();
+    let agree = field(&fields(&doc), "agree").widgets[0].clone();
+    let widget = doc.get(agree.obj);
+    let n = widget.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().get(b"N").cloned().unwrap();
+    let states = doc.resolve(&n);
+    let yes = states.as_dict().unwrap().reference(b"Yes").unwrap();
+    let Object::Stream(s) = &*doc.get(yes) else { panic!("check") };
+    assert!(s.dict.contains(b"Matrix"), "the check mark is rotated");
+    let go = field(&fields(&doc), "go").widgets[0].clone();
+    let (text, matrix) = (ap(&doc, &go), appearance_box(&doc, &go).1);
+    assert!(text.contains("(Go) Tj") && matrix.is_some(), "{text}");
+}
+
+#[test]
+fn a_rotation_refused_as_too_small_changes_nothing_else() {
+    let mut doc = one_page();
+    add_field(&mut doc, 0, [50.0, 700.0, 250.0, 720.0], &NewField::Text { multiline: false }, Some("thin")).unwrap();
+    // 200 x 3: turned a quarter it would be 3 wide, too small to use.
+    let obj = field(&fields(&doc), "thin").widgets[0].obj;
+    doc.update_dict(obj, |d| d.set(b"Rect".to_vec(), Object::Array([50.0, 700.0, 250.0, 703.0].iter().map(|v| Object::Real(*v)).collect()))).unwrap();
+    let props = FieldProps { tooltip: Some("changed".into()), rotation: Some((0, 90)), ..FieldProps::default() };
+    assert!(set_props(&mut doc, "thin", &props).is_err());
+    let f = field(&fields(&doc), "thin").clone();
+    assert_eq!(f.tooltip, None, "the tooltip was written before the rotation was refused");
+    assert_eq!(f.widgets[0].rotation, 0);
+}
+
+#[test]
+fn a_rotated_field_draws_along_the_vertical_edge() {
+    use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind};
+    let mut doc = one_page();
+    add_field(&mut doc, 0, [10.0, 40.0, 90.0, 60.0], &NewField::Text { multiline: false }, Some("wide")).unwrap();
+    set_value(&mut doc, "wide", &FieldValue::Text("MMMMMM".into())).unwrap();
+    set_props(&mut doc, "wide", &FieldProps { font_size: Some(12.0), ..FieldProps::default() }).unwrap();
+    let span = |doc: &Document| -> (u32, u32) {
+        let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+        let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0 });
+        assert!(p.error.is_none(), "{:?}", p.error);
+        let (mut x0, mut y0, mut x1, mut y1) = (u32::MAX, u32::MAX, 0, 0);
+        let mut ink = false;
+        for y in 0..p.height {
+            for x in 0..p.width {
+                let i = ((y * p.width + x) * 4) as usize;
+                if p.rgba[i] < 200 {
+                    ink = true;
+                    (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
+                }
+            }
+        }
+        assert!(ink, "the field drew no text");
+        (x1 - x0, y1 - y0)
+    };
+    let (wide, tall) = span(&doc);
+    assert!(wide > tall, "upright text is a horizontal run: {wide}x{tall}");
+    set_props(&mut doc, "wide", &FieldProps { rotation: Some((0, 90)), ..FieldProps::default() }).unwrap();
+    let (wide, tall) = span(&doc);
+    assert!(tall > wide, "rotated text is a vertical run: {wide}x{tall}");
+}
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ec604567..4aed0598 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -290,6 +290,7 @@
 	Bottom:	Долу:
 	Width:	Ширина:
 	Height:	Височина:
+	Rotation:	Завъртане:
 	Points from the page's bottom-left corner.	Точки от долния ляв ъгъл на страницата.
 	Alignment:	Подравняване:
 	Default Value:	Стойност по подразбиране:
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index d9a78a03..36c2d243 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -10,6 +10,7 @@
 
 	Menu	Nabídka
 	File	Soubor
+	Rotation:	Otočení:
 	Edit	Úpravy
 	Pages	Stránky
 	View	Zobrazení
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index c7503969..20f9440e 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -576,6 +576,7 @@
 	Bottom:	Unten:
 	Width:	Breite:
 	Height:	Höhe:
+	Rotation:	Drehung:
 	Points from the page's bottom-left corner.	Punkte ab der unteren linken Ecke der Seite.
 	Alignment:	Ausrichtung:
 	Default Value:	Standardwert:
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 80a87c11..0b3b79a5 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -599,6 +599,7 @@
 	Bottom:	Inferior:
 	Width:	Ancho:
 	Height:	Alto:
+	Rotation:	Rotación:
 	Points from the page's bottom-left corner.	Puntos desde la esquina inferior izquierda de la página.
 	Alignment:	Alineación:
 	Default Value:	Valor predeterminado:
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 771ba74b..8aca5cf8 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -576,6 +576,7 @@
 	Bottom:	Bas :
 	Width:	Largeur :
 	Height:	Hauteur :
+	Rotation:	Rotation :
 	Points from the page's bottom-left corner.	Points depuis le coin inférieur gauche de la page.
 	Alignment:	Alignement :
 	Default Value:	Valeur par défaut :
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index acf390f2..04b39f8b 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2082,3 +2082,4 @@ action wizard	Start	Indítás
 	Squiggly	Hullámos
 	Home / End	Home / End
 	H / Space (hold)	H / szóköz (nyomva tartva)
+	Rotation:	Elforgatás:
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index fc737888..c527d8b7 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -605,6 +605,7 @@
 	Bottom:	下:
 	Width:	幅:
 	Height:	高さ:
+	Rotation:	回転:
 	Points from the page's bottom-left corner.	ページの左下隅からの距離（ポイント）。
 	Alignment:	配置:
 	Default Value:	既定値:
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 2bd64c7d..a9b1f742 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -10,6 +10,7 @@
 
 	Menu	Menu
 	File	Arquivo
+	Rotation:	Rotação:
 	Edit	Editar
 	Pages	Páginas
 	View	Exibir
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 10ce91df..415e22f9 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -597,6 +597,7 @@
 	Bottom:	Снизу:
 	Width:	Ширина:
 	Height:	Высота:
+	Rotation:	Поворот:
 	Points from the page's bottom-left corner.	Точки от левого нижнего угла страницы.
 	Alignment:	Выравнивание:
 	Default Value:	Значение по умолчанию:
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 79c09709..301d49a8 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -582,6 +582,7 @@ comment menu	Edit	సవరించు
 	Bottom:	కింద:
 	Width:	వెడల్పు:
 	Height:	ఎత్తు:
+	Rotation:	భ్రమణం:
 	Points from the page's bottom-left corner.	పేజీ కింది ఎడమ మూల నుండి పాయింట్‌లలో కొలుస్తారు.
 	Alignment:	అమరిక:
 	Default Value:	డిఫాల్ట్ విలువ:
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index c9505c16..dfb2b437 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2104,3 +2104,4 @@ calendar date	December	грудня
 	Squiggly	Хвилясте
 	Home / End	Home / End
 	H / Space (hold)	H / Пробіл (утримувати)
+	Rotation:	Поворот:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 6b0650f7..0969213f 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -296,6 +296,7 @@
 	Bottom:	下：
 	Width:	宽：
 	Height:	高：
+	Rotation:	旋转：
 	Points from the page's bottom-left corner.	从页面左下角算起的点数。
 	Alignment:	对齐：
 	Default Value:	默认值：
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 98f4893f..824b4e85 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -254,6 +254,7 @@
 	Bottom:	下：
 	Width:	寬：
 	Height:	高：
+	Rotation:	旋轉：
 	Points from the page's bottom-left corner.	從頁面左下角算起的點數。
 	Alignment:	對齊：
 	Default Value:	預設值：
diff --git a/crates/ui-egui/src/prepare.rs b/crates/ui-egui/src/prepare.rs
index 7bba3a93..9b79acc8 100644
--- a/crates/ui-egui/src/prepare.rs
+++ b/crates/ui-egui/src/prepare.rs
@@ -666,6 +666,8 @@ pub struct FieldDraft {
     pub font_size: f64,
     /// Left, bottom, width, height in points.
     pub position: [f64; 4],
+    /// `/MK /R`: 0, 90, 180 or 270 degrees counterclockwise.
+    pub rotation: i64,
     pub look: Option<FieldLook>,
     /// Check boxes and radio buttons: the mark when on (Options tab).
     pub check_style: Option<pdfcraft_engine::CheckStyle>,
@@ -709,6 +711,7 @@ impl FieldDraft {
             on_state: f.widgets.get(widget).and_then(|w| w.on_state.clone()).unwrap_or_default(),
             font_size: da_size(&f.da),
             position: [r[0], r[1], r[2] - r[0], r[3] - r[1]],
+            rotation: f.widgets.get(widget).map(|w| w.rotation).unwrap_or(0),
             look: None,
             check_style: None,
             format: f.actions.format.clone(),
@@ -764,6 +767,7 @@ impl FieldDraft {
                 let [x, y, w, h] = self.position;
                 (self.widget, [x, y, x + w.max(4.0), y + h.max(4.0)])
             }),
+            rotation: (self.rotation != o.rotation).then_some((self.widget, self.rotation)),
             look: (self.look != o.look).then_some(self.look).flatten(),
             check_style: (self.check_style != o.check_style).then_some(self.check_style).flatten(),
             format: (self.format != o.format).then(|| self.format.clone()),
@@ -929,6 +933,25 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
                     }
                 });
                 ui.label(egui::RichText::new(tl!("Points from the page's bottom-left corner.")).small().color(t.text_faint));
+                ui.add_space(8.0);
+                ui.horizontal(|ui| {
+                    let l = ui.label(tl!("Rotation:"));
+                    let before = d.rotation;
+                    egui::ComboBox::from_id_salt("field-rotation")
+                        .selected_text(format!("{}°", d.rotation))
+                        .show_ui(ui, |ui| {
+                            for r in [0, 90, 180, 270] {
+                                if ui.selectable_value(&mut d.rotation, r, format!("{r}°")).changed() && (before % 180 == 0) != (r % 180 == 0) {
+                                    // Keep the same center. set_props skips its own swap when the rect changed too.
+                                    let [x, y, w, h] = d.position;
+                                    let (cx, cy) = (x + w / 2.0, y + h / 2.0);
+                                    d.position = [cx - h / 2.0, cy - w / 2.0, h, w];
+                                }
+                            }
+                        })
+                        .response
+                        .labelled_by(l.id);
+                });
             }
             FieldTab::Format => format_tab(ui, d, t),
             FieldTab::Validate => validate_tab(ui, d),
diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index 5f011fa8..cd6e0132 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -171,6 +171,39 @@ fn appearance_tab_restyles_the_field() {
     assert_eq!((l.style, l.font, l.fill), (BorderStyle::Dashed, FieldFont::Courier, Some([1.0, 1.0, 0.8])));
 }
 
+#[test]
+fn position_tab_rotates_a_field() {
+    let mut h = harness();
+    h.state_mut().open_field_props("city", 0);
+    h.run_steps(2);
+    let widget = |h: &Harness<'static, PdfCraftApp>| {
+        let s = h.state();
+        let f = s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == "city").unwrap();
+        f.widgets[0].clone()
+    };
+    let before = widget(&h);
+    assert_eq!(before.rotation, 0);
+    assert!(h.state().field_props.as_ref().unwrap().props().is_none(), "an unchanged draft is not an edit");
+    h.get_by_label("Position").click();
+    h.run_steps(2);
+    h.get_by_label("Rotation:");
+    h.state_mut().field_props.as_mut().unwrap().rotation = 90;
+    assert!(h.state().field_props.as_ref().unwrap().props().is_some());
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    let turned = widget(&h);
+    assert_eq!(turned.rotation, 90);
+    let [x0, y0, x1, y1] = before.rect;
+    let (cx, cy, w, ht) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0, x1 - x0, y1 - y0);
+    let expect = [cx - ht / 2.0, cy - w / 2.0, cx + ht / 2.0, cy + w / 2.0];
+    assert!(turned.rect.iter().zip(expect).all(|(a, b)| (a - b).abs() < 0.05), "{:?} vs {expect:?}", turned.rect);
+    h.state_mut().execute("edit.undo");
+    h.run_steps(3);
+    let back = widget(&h);
+    assert_eq!(back.rotation, 0);
+    assert!(back.rect.iter().zip(before.rect).all(|(a, b)| (a - b).abs() < 0.05), "{:?} vs {:?}", back.rect, before.rect);
+}
+
 #[test]
 fn options_tab_sets_the_check_box_style() {
     // #94: Check Box Style on the Options tab.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 7056ae7b..9dcabbef 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4397,9 +4397,9 @@ tier = "P0"
 milestone = "M6"
 status = "partial"
 commands = ["form.fields"]
-tools = ["form_fill"]
-evidence = ["crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text"]
-notes = "auto-size, comb, multiline, password, quadding, /MK colours; approximate Helvetica metrics, no /MK rotation yet"
+tools = ["form_fill", "form_set_props"]
+evidence = ["crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text", "crates/forms/src/tests.rs::rotated_fields_draw_in_their_quadrant", "crates/forms/src/tests.rs::a_rotated_field_draws_along_the_vertical_edge", "crates/automation/tests/automation.rs::rotating_a_field_through_tools", "crates/ui-egui/tests/prepare.rs::position_tab_rotates_a_field"]
+notes = "auto-size, comb, multiline, password, quadding, /MK colours and /MK /R rotation (0, 90, 180, 270); approximate Helvetica metrics"
 
 [[feature]]
 id = "form.rich-text-fields"

From 3af93c758548135b1de16204982b045e6a75bf7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rk=20Bartalos?= <bartalos86@gmail.com>
Date: Fri, 9 Oct 2026 19:15:44 +0200
Subject: [PATCH 096/149] M5: draw all ten PDF line-ending styles (#520)

* M5: draw all ten PDF line-ending styles

Imported lines, polylines and callouts kept Square, Circle, Diamond, Butt, Slash and reverse arrows in /LE but would not redraw them. Those styles now draw, and comment_add and Comment properties can set them.

* hu, uk: Line ending

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                      |  14 +--
 Cargo.lock                            |   1 +
 ROADMAP.md                            |   1 +
 crates/annot/src/appearance.rs        | 127 ++++++++++++++++----
 crates/annot/src/lib.rs               | 166 +++++++++++++++++++++++---
 crates/annot/src/tests.rs             | 143 ++++++++++++++++++++--
 crates/automation/Cargo.toml          |   1 +
 crates/automation/src/comments.rs     |  57 ++++++++-
 crates/automation/src/tools.rs        |   3 +-
 crates/automation/tests/automation.rs |  66 ++++++++++
 crates/engine/src/lib.rs              |  12 +-
 crates/engine/src/tests.rs            |   2 +-
 crates/measure/src/lib.rs             |   7 +-
 crates/measure/src/tests.rs           |   2 +-
 crates/ui-egui/src/comment_props.rs   |  20 +++-
 crates/ui-egui/src/comments.rs        |  38 ++++--
 crates/ui-egui/src/i18n/bg.tsv        |   1 +
 crates/ui-egui/src/i18n/de.tsv        |   1 +
 crates/ui-egui/src/i18n/fr.tsv        |   1 +
 crates/ui-egui/src/i18n/hu.tsv        |   1 +
 crates/ui-egui/src/i18n/ru.tsv        |   1 +
 crates/ui-egui/src/i18n/uk.tsv        |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv   |   1 +
 crates/ui-egui/tests/comments.rs      |  33 +++++
 parity/acrobat-features.toml          |   4 +-
 25 files changed, 615 insertions(+), 89 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 20e81b7f..07ec3777 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "997f3479a8930bacfc330ee2c7bf882720ac4a382630b87ae808c86702586926"
+sha256 = "163a07f4dcf89deebb8bc44fa05f59a5d85a35ddfe82665dd650522fa9f1fe20"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "78f794a4fdcf870b15b5692f1ff5567d4afd439bb2647c637a7ec4bdb9bc2ddb"
+sha256 = "a5b888d86c9866ec8825a91e845cfa881c16e774be16d9be636e7dfb8dfe3b67"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "04f4cbb7d72d42059135bb2e49fcfcaa5812eae773047769c6024e289a0d149d"
+sha256 = "bdf30a0f69c3aafb6e660f2666534b16d05b053812ae344a4f9a281fe294851e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "36d25dacd015fabf5e351407edbed3920bfdfb429d6a1482744c80e504c65c0d"
+sha256 = "09e063f1c9bb0a5c1485f5e8b4633df3b7f77b00f8f8cbfa4f8c169764e329c2"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cec5873ded1b535b2f9413408db8cc61e5a99a4ac9a62d13caaaca5c22b086c9"
+sha256 = "1c9db94bc77c6d7dd046adae0a81bebe4cafb372a789711c37911f46756f8c9d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1b164ae65c65e2902aebc1a12643cd51b2a67dd0ae2502726b8588fb3c6b54ff"
+sha256 = "b09f7de47fed031109de88a028b82ca86d9228d872f7f54e7e113d9df3d00ac2"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0d4247fb4538391b8f65238c0a422e0bd751765c3e9e3c1e85428fb967f1296c"
+sha256 = "fde7607a8e14c8d39d2807a21f94b78da56207fcafab7271e41fc10e69f848e7"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/Cargo.lock b/Cargo.lock
index bd57e410..b174b4ae 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3487,6 +3487,7 @@ version = "0.4.0"
 dependencies = [
  "base64 0.22.1",
  "image",
+ "pdfcraft-cos",
  "pdfcraft-engine",
  "pdfcraft-organize",
  "pdfcraft-platform",
diff --git a/ROADMAP.md b/ROADMAP.md
index a8ee318e..5020e708 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -127,6 +127,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 ## Log
 
+- **2026-10-09 (M5, line endings):** Lines, connected lines and callouts draw all ten standard line-ending styles. `comment_add` accepts `endings`, and Comment properties can change them in one undo step. An unknown name is left undrawn, and a non-finite direction is rejected. Cloudy borders remain polygon-only, so `comment.line-endings` stays partial. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index 11b21434..9a026069 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -26,23 +26,77 @@ pub fn cloud_radius(w: f64) -> f64 {
     6.0 + 1.5 * w.max(0.0)
 }
 
-/// Draw a line ending (`/LE`) at `tip`, for a line arriving from `from`. Open and closed arrows only.
-fn line_end(c: &mut String, kind: &[u8], tip: (f64, f64), from: (f64, f64), w: f64) {
+/// One of the ten `/LE` names (ISO 32000-2 Table 217). Unknown names are not drawn.
+pub(crate) fn known_ending(kind: &[u8]) -> bool {
+    std::str::from_utf8(kind).ok().and_then(crate::LineEnding::parse).is_some()
+}
+
+/// Draw a line ending (`/LE`) at `tip`, for a line arriving from `from`.
+///
+/// Returns false for an unknown style or a non-finite direction, so the caller keeps the
+/// previous appearance instead of writing `NaN`. `None` and a zero-length direction draw nothing.
+fn line_end(c: &mut String, kind: &[u8], tip: (f64, f64), from: (f64, f64), w: f64) -> bool {
     if kind == b"None" {
-        return;
+        return true;
+    }
+    if !known_ending(kind) {
+        return false;
     }
     let (dx, dy) = (from.0 - tip.0, from.1 - tip.1);
-    let len = dx.hypot(dy);
-    if len == 0.0 {
-        return;
+    if !dx.is_finite() || !dy.is_finite() {
+        return false;
+    }
+    let len = dx.hypot(dy);
+    if !len.is_finite() {
+        return false;
+    }
+    if len == 0.0 {
+        return true;
     }
-    let (ux, uy) = (dx / len, dy / len);
     let s = arrow_size(w);
-    let (cos, sin) = (30f64.to_radians().cos(), 30f64.to_radians().sin());
-    let a = (tip.0 + s * (ux * cos - uy * sin), tip.1 + s * (ux * sin + uy * cos));
-    let b = (tip.0 + s * (ux * cos + uy * sin), tip.1 + s * (-ux * sin + uy * cos));
-    let op = if kind == b"ClosedArrow" { "h B" } else { "S" };
-    c.push_str(&format!("{} {} m {} {} l {} {} l {op}\n", n(a.0), n(a.1), n(tip.0), n(tip.1), n(b.0), n(b.1)));
+    if !s.is_finite() {
+        return false;
+    }
+    let (ix, iy) = (dx / len, dy / len);
+    match kind {
+        b"OpenArrow" | b"ClosedArrow" | b"ROpenArrow" | b"RClosedArrow" => {
+            // Open and closed arrows keep their original geometry. A reverse arrow uses the same
+            // head, pointing back along the line.
+            let (ux, uy) = if kind.starts_with(b"R") { (-ix, -iy) } else { (ix, iy) };
+            let (cos, sin) = (30f64.to_radians().cos(), 30f64.to_radians().sin());
+            let a = (tip.0 + s * (ux * cos - uy * sin), tip.1 + s * (ux * sin + uy * cos));
+            let b = (tip.0 + s * (ux * cos + uy * sin), tip.1 + s * (-ux * sin + uy * cos));
+            let op = if kind.ends_with(b"ClosedArrow") { "h B" } else { "S" };
+            c.push_str(&format!("{} {} m {} {} l {} {} l {op}\n", n(a.0), n(a.1), n(tip.0), n(tip.1), n(b.0), n(b.1)));
+        }
+        b"Square" | b"Circle" | b"Diamond" => {
+            let h = s / 2.0;
+            if kind == b"Square" {
+                c.push_str(&format!("{} {} {} {} re h B\n", n(tip.0 - h), n(tip.1 - h), n(s), n(s)));
+            } else if kind == b"Circle" {
+                c.push_str(&ellipse(tip.0 - h, tip.1 - h, tip.0 + h, tip.1 + h));
+                c.push_str("B\n");
+            } else {
+                let (px, py) = (-iy, ix);
+                let v = |along: f64, across: f64| (tip.0 + ix * along + px * across, tip.1 + iy * along + py * across);
+                let (a, b, d, e) = (v(h, 0.0), v(0.0, h), v(-h, 0.0), v(0.0, -h));
+                c.push_str(&format!("{} {} m {} {} l {} {} l {} {} l h B\n", n(a.0), n(a.1), n(b.0), n(b.1), n(d.0), n(d.1), n(e.0), n(e.1)));
+            }
+        }
+        _ => {
+            // Butt is perpendicular to the line. Slash is that stroke turned 45 degrees.
+            let (px, py) = (-iy, ix);
+            let (sx, sy) = if kind == b"Slash" {
+                let q = std::f64::consts::FRAC_1_SQRT_2;
+                (px * q - py * q, px * q + py * q)
+            } else {
+                (px, py)
+            };
+            let h = s / 2.0;
+            c.push_str(&format!("{} {} m {} {} l S\n", n(tip.0 - sx * h), n(tip.1 - sy * h), n(tip.0 + sx * h), n(tip.1 + sy * h)));
+        }
+    }
+    true
 }
 
 /// The cubic Bézier segments (first control point, second control point, end) of a smooth curve
@@ -340,32 +394,45 @@ pub fn build(d: &Dict) -> Option<Stream> {
             });
         }
         b"Line" => {
-            let l = nums(d, b"L").filter(|l| l.len() == 4)?;
+            let l = nums(d, b"L").filter(|l| l.len() == 4 && l.iter().all(|x| x.is_finite()))?;
             let col = stroke?;
             let ends: Vec<Vec<u8>> = match d.get(b"LE") {
                 None => vec![b"None".to_vec(), b"None".to_vec()],
                 Some(o) => o.as_array()?.iter().map(|e| e.as_name().map(<[u8]>::to_vec)).collect::<Option<_>>()?,
             };
-            if ends.len() != 2 || ends.iter().any(|e| !matches!(e.as_slice(), b"None" | b"OpenArrow" | b"ClosedArrow")) {
+            if ends.len() != 2 || ends.iter().any(|e| !known_ending(e)) {
                 return None;
             }
             let fill = color(d, b"IC")?.unwrap_or(col);
             c.push_str(&format!("{}{}{} w 1 J 1 j\n{}", rg_stroke(col), rg(fill), n(w), dash(d)));
             c.push_str(&format!("{} {} m {} {} l S\n[] 0 d\n", n(l[0]), n(l[1]), n(l[2]), n(l[3])));
             for (end, (tip, from)) in ends.iter().zip([((l[0], l[1]), (l[2], l[3])), ((l[2], l[3]), (l[0], l[1]))]) {
-                line_end(&mut c, end, tip, from, w);
+                if !line_end(&mut c, end, tip, from, w) {
+                    return None;
+                }
             }
         }
         b"Polygon" | b"PolyLine" => {
-            let v = nums(d, b"Vertices").filter(|v| v.len() >= 4 && v.len() % 2 == 0)?;
+            let v = nums(d, b"Vertices").filter(|v| v.len() >= 4 && v.len() % 2 == 0 && v.iter().all(|x| x.is_finite()))?;
             let pts: Vec<(f64, f64)> = v.as_chunks::<2>().0.iter().map(|p| (p[0], p[1])).collect();
             let col = stroke;
             let closed = subtype == b"Polygon";
             let fill = if closed { color(d, b"IC")? } else { None };
-            if subtype == b"PolyLine" && d.get(b"LE").is_some_and(|e| e.as_array().is_none_or(|a| a.iter().any(|x| x.as_name() != Some(b"None")))) {
-                // Line endings on connected lines aren't drawn yet.
-                return None;
-            }
+            let ends = if subtype == b"PolyLine" {
+                match d.get(b"LE") {
+                    None => None,
+                    Some(o) => {
+                        let names: Vec<Vec<u8>> =
+                            o.as_array().filter(|a| a.len() == 2)?.iter().map(|e| e.as_name().map(<[u8]>::to_vec)).collect::<Option<_>>()?;
+                        if names.iter().any(|e| !known_ending(e)) {
+                            return None;
+                        }
+                        Some(names)
+                    }
+                }
+            } else {
+                None
+            };
             if let Some(f) = fill {
                 c.push_str(&rg(f));
             }
@@ -389,6 +456,17 @@ pub fn build(d: &Dict) -> Option<Stream> {
                 (false, true) => "S\n",
                 (false, false) => "n\n",
             });
+            if let Some(ends) = ends {
+                let col = col?;
+                let (Some(start), Some(end)) = (ends.first(), ends.get(1)) else { return None };
+                let (Some(&tip0), Some(&from0)) = (pts.first(), pts.get(1)) else { return None };
+                let (Some(&tip1), Some(&from1)) = (pts.last(), pts.get(pts.len().saturating_sub(2))) else { return None };
+                let fill = color(d, b"IC")?.unwrap_or(col);
+                c.push_str(&format!("[] 0 d\n{}", rg(fill)));
+                if !line_end(&mut c, start, tip0, from0, w) || !line_end(&mut c, end, tip1, from1, w) {
+                    return None;
+                }
+            }
         }
         b"Caret" => {
             // A filled caret: two curved flanks meeting at the top centre.
@@ -553,17 +631,22 @@ pub fn build(d: &Dict) -> Option<Stream> {
                     None => b"None".to_vec(),
                     Some(o) => o.as_name()?.to_vec(),
                 };
-                if !matches!(end.as_slice(), b"None" | b"OpenArrow" | b"ClosedArrow") {
+                if !known_ending(&end) {
                     return None;
                 }
                 let lw = bw.max(0.5);
                 let pts: Vec<(f64, f64)> = cl.as_chunks::<2>().0.iter().map(|p| (p[0], p[1])).collect();
+                if pts.len() < 2 || pts.iter().any(|p| !p.0.is_finite() || !p.1.is_finite()) {
+                    return None;
+                }
                 c.push_str(&format!("{}{}{} w 1 J 1 j\n", rg_stroke(text_color), rg(bg.unwrap_or([1.0; 3])), n(lw)));
                 for (i, p) in pts.iter().enumerate() {
                     c.push_str(&format!("{} {} {}\n", n(p.0), n(p.1), if i == 0 { "m" } else { "l" }));
                 }
                 c.push_str("S\n");
-                line_end(&mut c, &end, pts[0], pts[1], lw);
+                if !line_end(&mut c, &end, pts[0], pts[1], lw) {
+                    return None;
+                }
             }
             if let Some(bg) = bg {
                 c.push_str(&format!("{}{} {} {} {} re f\n", rg(bg), n(rect[0]), n(rect[1]), n(rect[2] - rect[0]), n(rect[3] - rect[1])));
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index ff553ac2..73bf42a4 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -274,6 +274,55 @@ impl StampKind {
     }
 }
 
+/// A line ending (`/LE`): the ten styles in ISO 32000-2 Table 217.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LineEnding {
+    None,
+    Square,
+    Circle,
+    Diamond,
+    OpenArrow,
+    ClosedArrow,
+    Butt,
+    ROpenArrow,
+    RClosedArrow,
+    Slash,
+}
+
+impl LineEnding {
+    pub const ALL: [Self; 10] = [
+        Self::None,
+        Self::Square,
+        Self::Circle,
+        Self::Diamond,
+        Self::OpenArrow,
+        Self::ClosedArrow,
+        Self::Butt,
+        Self::ROpenArrow,
+        Self::RClosedArrow,
+        Self::Slash,
+    ];
+
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::None => "None",
+            Self::Square => "Square",
+            Self::Circle => "Circle",
+            Self::Diamond => "Diamond",
+            Self::OpenArrow => "OpenArrow",
+            Self::ClosedArrow => "ClosedArrow",
+            Self::Butt => "Butt",
+            Self::ROpenArrow => "ROpenArrow",
+            Self::RClosedArrow => "RClosedArrow",
+            Self::Slash => "Slash",
+        }
+    }
+
+    pub fn parse(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|ending| ending.name() == name)
+    }
+}
+
 /// Geometry of a new comment, in PDF user space of its page.
 #[derive(Clone, Debug, PartialEq)]
 pub enum Shape {
@@ -294,11 +343,12 @@ pub enum Shape {
     Oval {
         rect: [f64; 4],
     },
-    /// A line, with an open arrowhead at `to` when `arrow` is set.
+    /// A line. An open arrow at `to` is `start: None`, `end: OpenArrow` (the Arrow tool).
     Line {
         from: [f64; 2],
         to: [f64; 2],
-        arrow: bool,
+        start: LineEnding,
+        end: LineEnding,
     },
     /// Freehand strokes (Draw tool).
     Ink {
@@ -357,9 +407,11 @@ pub enum Shape {
         vertices: Vec<[f64; 2]>,
         cloud: bool,
     },
-    /// Connected lines (Polygonal Line tool).
+    /// Connected lines (Polygonal Line tool). `start` is the first vertex, `end` the last.
     PolyLine {
         vertices: Vec<[f64; 2]>,
+        start: LineEnding,
+        end: LineEnding,
     },
     /// A text callout: a text box at `rect` with a leader line from `point` (arrowhead) via
     /// `knee` to the box (FreeText, `/IT /FreeTextCallout`, `/CL`).
@@ -368,6 +420,7 @@ pub enum Shape {
         knee: [f64; 2],
         point: [f64; 2],
         font_size: f64,
+        ending: LineEnding,
     },
     /// Insert text: a caret in `rect` (its point at the top centre).
     Caret {
@@ -726,6 +779,14 @@ fn grow(r: [f64; 4], by: f64) -> [f64; 4] {
     [r[0] - by, r[1] - by, r[2] + by, r[3] + by]
 }
 
+fn ending_draws(ending: LineEnding) -> bool {
+    ending != LineEnding::None
+}
+
+fn ending_pair(start: LineEnding, end: LineEnding) -> Object {
+    Object::Array(vec![Object::name(start.name()), Object::name(end.name())])
+}
+
 /// Validate and compute `/Rect` for a new comment.
 fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
     let bad = |what: &str| AnnotError::Invalid(format!("invalid {what}"));
@@ -765,11 +826,11 @@ fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
             }
             r
         }
-        Shape::Line { from, to, arrow } => {
+        Shape::Line { from, to, start, end } => {
             if !finite(from) || !finite(to) || (from[0] - to[0]).hypot(from[1] - to[1]) < 1.0 {
                 return Err(bad("line (too short)"));
             }
-            let pad = half + if *arrow { appearance::arrow_size(style.width) } else { 0.0 };
+            let pad = half + if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
             grow(bounds([*from, *to].into_iter()).unwrap_or_default(), pad + 1.0)
         }
         Shape::Ink { strokes } | Shape::Signature { strokes } => {
@@ -790,10 +851,11 @@ fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
             let b = b.ok_or_else(|| bad("polygon (it needs three points)"))?;
             grow(b, half + 1.0 + if *cloud { 1.5 * appearance::cloud_radius(style.width) } else { 0.0 })
         }
-        Shape::PolyLine { vertices } => {
+        Shape::PolyLine { vertices, start, end } => {
             let b = bounds(vertices.iter().copied())
                 .filter(|b| vertices.len() >= 2 && vertices.iter().all(|p| finite(p)) && (b[2] - b[0]).max(b[3] - b[1]) >= 1.0);
-            grow(b.ok_or_else(|| bad("connected lines (they need two points)"))?, half + 1.0)
+            let extra = if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
+            grow(b.ok_or_else(|| bad("connected lines (they need two points)"))?, half + 1.0 + extra)
         }
         Shape::Callout { rect, knee, point, .. } => {
             let r = normalize(*rect);
@@ -846,7 +908,7 @@ fn subject(shape: &Shape) -> &'static str {
         Shape::TextMarkup { kind: Markup::Squiggly, .. } => "Squiggly",
         Shape::Rectangle { .. } => "Rectangle",
         Shape::Oval { .. } => "Oval",
-        Shape::Line { arrow: true, .. } => "Arrow",
+        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Arrow",
         Shape::Line { .. } => "Line",
         Shape::Ink { .. } => "Pencil",
         Shape::TextBox { .. } => "Text Box",
@@ -943,11 +1005,11 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
             }
             border(&mut d);
         }
-        Shape::Line { from, to, arrow } => {
+        Shape::Line { from, to, start, end } => {
             d.set(b"C".to_vec(), rgb(style.color));
             d.set(b"L".to_vec(), num_array(&[from[0], from[1], to[0], to[1]]));
-            if *arrow {
-                d.set(b"LE".to_vec(), Object::Array(vec![Object::name("None"), Object::name("OpenArrow")]));
+            if ending_draws(*start) || ending_draws(*end) {
+                d.set(b"LE".to_vec(), ending_pair(*start, *end));
             }
             border(&mut d);
         }
@@ -1008,9 +1070,12 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
             }
             border(&mut d);
         }
-        Shape::PolyLine { vertices } => {
+        Shape::PolyLine { vertices, start, end } => {
             d.set(b"C".to_vec(), rgb(style.color));
             d.set(b"Vertices".to_vec(), num_array(&vertices.concat()));
+            if ending_draws(*start) || ending_draws(*end) {
+                d.set(b"LE".to_vec(), ending_pair(*start, *end));
+            }
             border(&mut d);
         }
         Shape::Caret { .. } => {
@@ -1047,12 +1112,12 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
                 d.set(b"Contents".to_vec(), PdfString::text(file.trim()));
             }
         }
-        Shape::Callout { rect: tb, knee, point, .. } => {
+        Shape::Callout { rect: tb, knee, point, ending, .. } => {
             let tb = normalize(*tb);
             let attach = callout_attach(tb, *knee);
             d.set(b"IT".to_vec(), Object::name("FreeTextCallout"));
             d.set(b"CL".to_vec(), num_array(&[point[0], point[1], knee[0], knee[1], attach[0], attach[1]]));
-            d.set(b"LE".to_vec(), Object::name("OpenArrow"));
+            d.set(b"LE".to_vec(), Object::name(ending.name()));
             // The text box inside /Rect (§12.5.6.6 /RD).
             d.set(b"RD".to_vec(), num_array(&[tb[0] - rect[0], tb[1] - rect[1], rect[2] - tb[2], rect[3] - tb[3]]));
         }
@@ -1526,7 +1591,8 @@ fn border_width_of(d: &Dict) -> f64 {
     d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0).max(0.0)
 }
 
-/// Change a comment's colour, opacity and/or line width, and redraw it.
+/// Change a comment's colour, opacity, line width and/or line endings, and redraw it.
+#[allow(clippy::too_many_arguments)]
 pub fn set_style(
     doc: &mut Document,
     page: usize,
@@ -1534,6 +1600,7 @@ pub fn set_style(
     color: Option<Rgb>,
     opacity: Option<f64>,
     width: Option<f64>,
+    endings: Option<&[LineEnding]>,
     meta: &Meta,
 ) -> Result<(), AnnotError> {
     let (_, r) = annot_ref(doc, page, index)?;
@@ -1542,11 +1609,18 @@ pub fn set_style(
     let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
     // Check before changing anything: a stale appearance would contradict the new style.
     if appearance::build(&d).is_none() {
-        return Err(AnnotError::Unsupported(subtype));
+        return Err(AnnotError::Unsupported(subtype.clone()));
     }
     if color.is_some_and(|c| !finite(&c)) || opacity.is_some_and(|o| !o.is_finite()) || width.is_some_and(|w| !w.is_finite()) {
         return Err(AnnotError::Invalid("invalid style".into()));
     }
+    if let Some(ends) = endings {
+        let callout = subtype == "FreeText" && d.contains(b"CL");
+        let pair = matches!(subtype.as_str(), "Line" | "PolyLine");
+        if (callout && ends.len() != 1) || (pair && ends.len() != 2) || (!callout && !pair) {
+            return Err(AnnotError::Invalid("this comment has no line endings to change".into()));
+        }
+    }
     let free_text = subtype == "FreeText";
     doc.update_dict(r, |d| {
         if let Some(c) = color {
@@ -1573,11 +1647,55 @@ pub fn set_style(
             d.set(b"BS".to_vec(), Object::Dict(bs));
             d.remove(b"Border");
         }
+        if let Some(ends) = endings {
+            if ends.len() == 1 {
+                if let Some(ending) = ends.first() {
+                    d.set(b"LE".to_vec(), Object::name(ending.name()));
+                }
+            } else if let (Some(start), Some(end)) = (ends.first(), ends.get(1)) {
+                d.set(b"LE".to_vec(), ending_pair(*start, *end));
+            }
+        }
+        ensure_ending_room(d);
         touch(d, meta);
     })?;
     set_appearance(doc, r)
 }
 
+/// Grow a line or polyline's rectangle so a non-`None` ending is not clipped. Idempotent.
+fn ensure_ending_room(d: &mut Dict) {
+    let subtype = d.name(b"Subtype").unwrap_or_default();
+    if !matches!(subtype, b"Line" | b"PolyLine") {
+        return;
+    }
+    if !line_endings_of(d).is_some_and(|ends| ends.iter().any(|e| ending_draws(*e))) {
+        return;
+    }
+    let key: &[u8] = if subtype == b"Line" { b"L" } else { b"Vertices" };
+    let Some(pts) = pair_points(d, key) else { return };
+    let Some(bounds) = bounds(pts.iter().copied()) else { return };
+    let w = border_width_of(d);
+    let need = grow(bounds, w / 2.0 + appearance::arrow_size(w) + 1.0);
+    let vals: Vec<f64> = d.get(b"Rect").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect()).unwrap_or_default();
+    let Some(rect) = four(&vals) else { return };
+    let union = [rect[0].min(need[0]), rect[1].min(need[1]), rect[2].max(need[2]), rect[3].max(need[3])];
+    if union != rect {
+        d.set(b"Rect".to_vec(), num_array(&union));
+    }
+}
+
+fn four(v: &[f64]) -> Option<[f64; 4]> {
+    Some([*v.first()?, *v.get(1)?, *v.get(2)?, *v.get(3)?])
+}
+
+fn pair_points(d: &Dict, key: &[u8]) -> Option<Vec<[f64; 2]>> {
+    let v: Vec<f64> = d.get(key)?.as_array()?.iter().filter_map(|o| o.as_f64()).collect();
+    if v.len() < 4 || !v.len().is_multiple_of(2) || v.iter().any(|x| !x.is_finite()) {
+        return None;
+    }
+    Some(v.as_chunks::<2>().0.to_vec())
+}
+
 // ── reading ─────────────────────────────────────────────────────────────────────────────────
 
 /// One comment as the viewer lists it (the same fields and rules as
@@ -1723,6 +1841,8 @@ pub struct Props {
     pub restylable: bool,
     /// The Locked flag.
     pub locked: bool,
+    /// `/LE`: two names for a line or polyline (`None` when unset), one for a callout.
+    pub endings: Option<Vec<LineEnding>>,
 }
 
 /// The current properties of the comment at `(page, index)`.
@@ -1747,9 +1867,23 @@ pub fn props(doc: &Document, page: usize, index: usize) -> Option<Props> {
         restylable: appearance::build(d).is_some(),
         locked: d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0) & FLAG_LOCKED != 0,
         subtype,
+        endings: line_endings_of(d),
     })
 }
 
+/// `/LE` for a line, polyline or callout. Unknown names yield `None` so the control stays hidden.
+fn line_endings_of(d: &Dict) -> Option<Vec<LineEnding>> {
+    let parse = |name: &[u8]| std::str::from_utf8(name).ok().and_then(LineEnding::parse);
+    match d.name(b"Subtype")? {
+        b"Line" | b"PolyLine" => match d.get(b"LE") {
+            None => Some(vec![LineEnding::None, LineEnding::None]),
+            Some(o) => o.as_array().filter(|a| a.len() == 2)?.iter().map(|e| parse(e.as_name()?)).collect(),
+        },
+        b"FreeText" if d.contains(b"CL") => Some(vec![parse(d.name(b"LE").unwrap_or(b"None"))?]),
+        _ => None,
+    }
+}
+
 /// Replace Text (Acrobat's proposal): strike out `quads` and add a caret at the end of the
 /// struck text holding `replacement`, grouped with the strikeout (`/IRT` + `/RT /Group`) so they
 /// move, list and delete as one. Returns the strikeout's index.
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index 3664e7ca..de75b323 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -84,7 +84,7 @@ fn every_tool_creates_a_drawable_comment() {
         Shape::TextMarkup { kind: Markup::Squiggly, quads: vec![[72.0, 412.0, 200.0, 412.0, 72.0, 400.0, 200.0, 400.0]] },
         Shape::Rectangle { rect: [300.0, 300.0, 200.0, 200.0] },
         Shape::Oval { rect: [300.0, 300.0, 400.0, 350.0] },
-        Shape::Line { from: [50.0, 50.0], to: [150.0, 100.0], arrow: true },
+        Shape::Line { from: [50.0, 50.0], to: [150.0, 100.0], start: LineEnding::None, end: LineEnding::OpenArrow },
         Shape::Ink { strokes: vec![vec![[10.0, 10.0], [20.0, 30.0], [30.0, 10.0]], vec![[40.0, 40.0]]] },
         Shape::TextBox { rect: [300.0, 600.0, 500.0, 650.0], font_size: 14.0 },
     ];
@@ -179,7 +179,7 @@ fn invalid_geometry_is_rejected() {
     let bad = [
         Shape::TextMarkup { kind: Markup::Highlight, quads: vec![] },
         Shape::Rectangle { rect: [0.0, 0.0, 0.5, 10.0] },
-        Shape::Line { from: [1.0, 1.0], to: [1.0, 1.0], arrow: false },
+        Shape::Line { from: [1.0, 1.0], to: [1.0, 1.0], start: LineEnding::None, end: LineEnding::None },
         Shape::Ink { strokes: vec![vec![]] },
         Shape::Note { at: [f64::NAN, 0.0], icon: NoteIcon::Note },
     ];
@@ -261,7 +261,7 @@ fn move_shifts_all_geometry_and_the_popup() {
 fn restyle_and_resize_redraw_the_appearance() {
     let mut doc = fixture();
     let r = add_annotation(&mut doc, &new(0, Shape::Rectangle { rect: [10.0, 10.0, 110.0, 60.0] }), &meta("r")).unwrap();
-    set_style(&mut doc, 0, r, Some([1.0, 0.0, 0.0]), Some(0.5), Some(4.0), &meta("")).unwrap();
+    set_style(&mut doc, 0, r, Some([1.0, 0.0, 0.0]), Some(0.5), Some(4.0), None, &meta("")).unwrap();
     set_rect(&mut doc, 0, r, [0.0, 0.0, 200.0, 100.0], &meta("")).unwrap();
     let doc2 = reopen(&doc);
     let d = &list(&doc2, 0)[r];
@@ -271,10 +271,15 @@ fn restyle_and_resize_redraw_the_appearance() {
     assert_eq!(d.get(b"CA").and_then(|o| o.as_f64()), Some(0.5));
     // A stamp's appearance can't be regenerated, so restyling it changes nothing.
     let before = list(&doc, 1)[0].clone();
-    assert_eq!(set_style(&mut doc, 1, 0, Some([0.0; 3]), None, None, &meta("")), Err(AnnotError::Unsupported("Stamp".into())));
+    assert_eq!(set_style(&mut doc, 1, 0, Some([0.0; 3]), None, None, None, &meta("")), Err(AnnotError::Unsupported("Stamp".into())));
     assert_eq!(list(&doc, 1)[0], before);
     // Lines can't be resized as rectangles.
-    let l = add_annotation(&mut doc, &new(0, Shape::Line { from: [0.0, 0.0], to: [10.0, 10.0], arrow: false }), &meta("l")).unwrap();
+    let l = add_annotation(
+        &mut doc,
+        &new(0, Shape::Line { from: [0.0, 0.0], to: [10.0, 10.0], start: LineEnding::None, end: LineEnding::None }),
+        &meta("l"),
+    )
+    .unwrap();
     assert!(matches!(set_rect(&mut doc, 0, l, [0.0, 0.0, 5.0, 5.0], &meta("")), Err(AnnotError::Invalid(_))));
 }
 
@@ -283,7 +288,7 @@ fn text_box_text_and_colour_changes_are_drawn() {
     let mut doc = fixture();
     let t = add_annotation(&mut doc, &new(0, Shape::TextBox { rect: [0.0, 0.0, 300.0, 100.0], font_size: 12.0 }), &meta("t")).unwrap();
     set_contents(&mut doc, 0, t, "Caf\u{e9} (draft) \u{2014} 100%", &meta("")).unwrap();
-    set_style(&mut doc, 0, t, Some([1.0, 0.0, 0.0]), None, None, &meta("")).unwrap();
+    set_style(&mut doc, 0, t, Some([1.0, 0.0, 0.0]), None, None, None, &meta("")).unwrap();
     let doc = reopen(&doc);
     let d = &list(&doc, 0)[t];
     assert_eq!(text(d, b"Contents"), "Caf\u{e9} (draft) \u{2014} 100%");
@@ -337,7 +342,16 @@ fn editing_a_callout_refits_the_box_and_keeps_the_leader() {
     let mut doc = fixture();
     let c = add_annotation(
         &mut doc,
-        &new(0, Shape::Callout { rect: [300.0, 600.0, 500.0, 612.0], knee: [260.0, 560.0], point: [200.0, 520.0], font_size: 12.0 }),
+        &new(
+            0,
+            Shape::Callout {
+                rect: [300.0, 600.0, 500.0, 612.0],
+                knee: [260.0, 560.0],
+                point: [200.0, 520.0],
+                font_size: 12.0,
+                ending: LineEnding::OpenArrow,
+            },
+        ),
         &meta("c"),
     )
     .unwrap();
@@ -429,8 +443,8 @@ fn fill_and_sign_items_are_drawn() {
     assert_eq!(text(&all[s], b"Subj"), "Signature");
     // Other stamps still can't be restyled; ours can.
     let mut doc = doc;
-    set_style(&mut doc, 1, marks[0], Some([0.0, 0.0, 1.0]), None, None, &meta("")).unwrap();
-    assert!(set_style(&mut doc, 1, 0, Some([0.0; 3]), None, None, &meta("")).is_err());
+    set_style(&mut doc, 1, marks[0], Some([0.0, 0.0, 1.0]), None, None, None, &meta("")).unwrap();
+    assert!(set_style(&mut doc, 1, 0, Some([0.0; 3]), None, None, None, &meta("")).is_err());
 }
 
 #[test]
@@ -515,11 +529,24 @@ fn polygons_clouds_connected_lines_callouts_and_carets_are_drawn() {
     let tri = vec![[100.0, 100.0], [200.0, 100.0], [150.0, 180.0]];
     let i = add_annotation(&mut doc, &new(0, Shape::Polygon { vertices: tri.clone(), cloud: false }), &meta("p")).unwrap();
     let c = add_annotation(&mut doc, &new(0, Shape::Polygon { vertices: tri.clone(), cloud: true }), &meta("c")).unwrap();
-    let l =
-        add_annotation(&mut doc, &new(0, Shape::PolyLine { vertices: vec![[300.0, 300.0], [350.0, 320.0], [400.0, 300.0]] }), &meta("l")).unwrap();
+    let l = add_annotation(
+        &mut doc,
+        &new(0, Shape::PolyLine { vertices: vec![[300.0, 300.0], [350.0, 320.0], [400.0, 300.0]], start: LineEnding::None, end: LineEnding::None }),
+        &meta("l"),
+    )
+    .unwrap();
     let co = add_annotation(
         &mut doc,
-        &new(0, Shape::Callout { rect: [300.0, 500.0, 420.0, 540.0], knee: [260.0, 520.0], point: [220.0, 460.0], font_size: 10.0 }),
+        &new(
+            0,
+            Shape::Callout {
+                rect: [300.0, 500.0, 420.0, 540.0],
+                knee: [260.0, 520.0],
+                point: [220.0, 460.0],
+                font_size: 10.0,
+                ending: LineEnding::OpenArrow,
+            },
+        ),
         &meta("co"),
     )
     .unwrap();
@@ -576,7 +603,7 @@ fn polygons_clouds_connected_lines_callouts_and_carets_are_drawn() {
 
     for bad in [
         Shape::Polygon { vertices: vec![[0.0, 0.0], [10.0, 10.0]], cloud: false },
-        Shape::PolyLine { vertices: vec![[0.0, 0.0]] },
+        Shape::PolyLine { vertices: vec![[0.0, 0.0]], start: LineEnding::None, end: LineEnding::None },
         Shape::Caret { rect: [0.0, 0.0, 0.0, 10.0] },
     ] {
         assert!(add_annotation(&mut doc, &new(0, bad), &meta("b")).is_err());
@@ -735,3 +762,93 @@ fn comments_without_appearances_get_one_for_display_only() {
     ]);
     assert!(with_missing_appearances(&complete).is_none());
 }
+
+fn line_dict(coords: [f64; 4], ending: &str) -> pdfcraft_cos::Dict {
+    let mut d = pdfcraft_cos::Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Line"));
+    d.set(b"Rect".to_vec(), Object::Array([0.0, 0.0, 300.0, 300.0].into_iter().map(Object::Real).collect()));
+    d.set(b"C".to_vec(), Object::Array([1.0, 0.0, 0.0].into_iter().map(Object::Real).collect()));
+    d.set(b"L".to_vec(), Object::Array(coords.into_iter().map(Object::Real).collect()));
+    d.set(b"LE".to_vec(), Object::Array(vec![Object::name("None"), Object::name(ending)]));
+    d
+}
+
+#[test]
+fn every_line_ending_is_drawn() {
+    let filled = [LineEnding::Square, LineEnding::Circle, LineEnding::Diamond, LineEnding::ClosedArrow, LineEnding::RClosedArrow];
+    let (mut open, mut reverse) = (String::new(), String::new());
+    for ending in LineEnding::ALL {
+        let mut doc = fixture();
+        add_annotation(
+            &mut doc,
+            &new(0, Shape::Line { from: [80.0, 100.0], to: [200.0, 160.0], start: LineEnding::None, end: ending }),
+            &meta("ending"),
+        )
+        .unwrap();
+        let doc = reopen(&doc);
+        let line = list(&doc, 0).into_iter().find(|d| d.name(b"Subtype") == Some(b"Line")).expect("line");
+        let content = ap_content(&doc, &line);
+        assert!(!content.is_empty(), "{ending:?}");
+        let paints = content.contains("h B") || content.contains("B\n");
+        assert_eq!(paints, filled.contains(&ending), "{ending:?} fill: {content}");
+        if ending != LineEnding::None {
+            let r = rect(&line);
+            assert!(r[0] < 70.0 && r[2] > 210.0, "{ending:?} rectangle includes the ending: {r:?}");
+        }
+        if ending == LineEnding::OpenArrow {
+            open = content.clone();
+        }
+        if ending == LineEnding::ROpenArrow {
+            reverse = content;
+        }
+    }
+    assert_ne!(open, reverse, "a reverse arrow points the other way");
+
+    let mut doc = fixture();
+    let index = add_annotation(
+        &mut doc,
+        &new(0, Shape::Line { from: [40.0, 40.0], to: [140.0, 40.0], start: LineEnding::None, end: LineEnding::None }),
+        &meta("plain"),
+    )
+    .unwrap();
+    let before = rect(&list(&doc, 0).into_iter().find(|d| d.name(b"Subtype") == Some(b"Line")).expect("line"));
+    set_style(&mut doc, 0, index, None, None, None, Some(&[LineEnding::None, LineEnding::Square]), &meta("style")).unwrap();
+    let mut doc = reopen(&doc);
+    let line = list(&doc, 0).into_iter().find(|d| d.name(b"Subtype") == Some(b"Line")).expect("line");
+    let after = rect(&line);
+    assert!(after[1] < before[1] - 5.0 && after[3] > before[3] + 5.0, "the square is not clipped: {before:?} → {after:?}");
+    assert!(ap_content(&doc, &line).contains("re h B"), "square ending");
+
+    add_annotation(
+        &mut doc,
+        &new(0, Shape::PolyLine { vertices: vec![[40.0, 200.0], [90.0, 260.0], [150.0, 200.0]], start: LineEnding::Circle, end: LineEnding::Slash }),
+        &meta("poly"),
+    )
+    .unwrap();
+    add_annotation(
+        &mut doc,
+        &new(
+            0,
+            Shape::Callout {
+                rect: [300.0, 500.0, 420.0, 540.0],
+                knee: [260.0, 520.0],
+                point: [220.0, 460.0],
+                font_size: 10.0,
+                ending: LineEnding::Diamond,
+            },
+        ),
+        &meta("call"),
+    )
+    .unwrap();
+    let doc = reopen(&doc);
+    let all = list(&doc, 0);
+    let poly = all.iter().find(|d| d.name(b"Subtype") == Some(b"PolyLine")).expect("polyline");
+    let poly_ap = ap_content(&doc, poly);
+    assert!(poly_ap.contains("B\n") && poly_ap.contains(" l S"), "circle fills and the slash only strokes: {poly_ap}");
+    let call = all.iter().find(|d| d.name(b"IT") == Some(b"FreeTextCallout")).expect("callout");
+    assert_eq!(call.name(b"LE"), Some(b"Diamond".as_slice()));
+    assert!(ap_content(&doc, call).contains("h B"), "diamond callout");
+
+    assert!(appearance::build(&line_dict([f64::NAN, 0.0, 10.0, 0.0], "OpenArrow")).is_none(), "a non-finite endpoint is rejected");
+    assert!(appearance::build(&line_dict([0.0, 0.0, 10.0, 0.0], "Foo")).is_none(), "an unknown ending is not replaced");
+}
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index 7383970b..74d90c04 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -24,5 +24,6 @@ default = ["mcp"]
 mcp = ["dep:base64"]
 
 [dev-dependencies]
+pdfcraft-cos = { workspace = true }
 pdfcraft-xfa = { workspace = true }
 image = { version = "0.25", default-features = false, features = ["jpeg"] }
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index 4483f0ca..ebeab262 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -3,7 +3,9 @@
 //! Geometry follows the automation convention: points from the top-left of the displayed page,
 //! y down. It is converted to PDF user space (crop box, `/Rotate`) here.
 
-use pdfcraft_engine::{Edit, Markup, NOTE_SIZE, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, StampGroup, StampKind, Style, SummarySort};
+use pdfcraft_engine::{
+    Edit, LineEnding, Markup, NOTE_SIZE, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, StampGroup, StampKind, Style, SummarySort,
+};
 use pdfcraft_render::{Annotation, PageInfo};
 use serde_json::{Value, json};
 
@@ -34,6 +36,33 @@ pub(crate) fn parse_color(s: &str) -> Result<Rgb> {
     Ok([c(0), c(2), c(4)])
 }
 
+const ENDING_NAMES: &str = "None, Square, Circle, Diamond, OpenArrow, ClosedArrow, Butt, ROpenArrow, RClosedArrow, Slash";
+
+fn line_endings(a: &Args) -> Result<Option<Vec<LineEnding>>> {
+    let Some(v) = a.get("endings") else { return Ok(None) };
+    let arr = v.as_array().ok_or_else(|| ToolError::InvalidArgs("endings must be an array of line-ending names".into()))?;
+    if arr.is_empty() || arr.len() > 2 {
+        return Err(ToolError::InvalidArgs("endings takes one name for a callout, or two for a line or polyline".into()));
+    }
+    arr.iter()
+        .map(|item| {
+            let name = item.as_str().ok_or_else(|| ToolError::InvalidArgs("endings must be line-ending names".into()))?;
+            LineEnding::parse(name).ok_or_else(|| ToolError::InvalidArgs(format!("unknown line ending {name:?} ({ENDING_NAMES})")))
+        })
+        .collect::<Result<Vec<_>>>()
+        .map(Some)
+}
+
+/// `[start, end]` for a line, arrow or polyline. An arrow with no `endings` stays `[None, OpenArrow]`.
+fn ending_pair(kind: &str, endings: Option<&[LineEnding]>) -> Result<[LineEnding; 2]> {
+    match endings {
+        None if kind == "arrow" => Ok([LineEnding::None, LineEnding::OpenArrow]),
+        None => Ok([LineEnding::None, LineEnding::None]),
+        Some(v) if v.len() == 2 => Ok([v.first().copied().unwrap_or(LineEnding::None), v.get(1).copied().unwrap_or(LineEnding::None)]),
+        Some(_) => Err(ToolError::InvalidArgs("a line or polyline needs two endings, the start and the end".into())),
+    }
+}
+
 fn hex(c: [f32; 3]) -> String {
     let b = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
     format!("#{:02X}{:02X}{:02X}", b(c[0]), b(c[1]), b(c[2]))
@@ -181,6 +210,10 @@ impl Automation {
         let page = self.page(a)?;
         let info = self.doc(a)?.info.pages[page].clone();
         let kind = a.str("type")?;
+        let endings = line_endings(a)?;
+        if endings.is_some() && !matches!(kind, "line" | "arrow" | "polyline" | "callout") {
+            return Err(ToolError::InvalidArgs("endings apply to a line, arrow, polyline or callout".into()));
+        }
         let markup = match kind {
             "highlight" => Some(Markup::Highlight),
             "underline" => Some(Markup::Underline),
@@ -254,7 +287,8 @@ impl Automation {
                 }
                 "line" | "arrow" => {
                     let (f, t) = (a.need::<2>("from", "a line")?, a.need::<2>("to", "a line")?);
-                    Shape::Line { from: to_user(&info, f[0], f[1]), to: to_user(&info, t[0], t[1]), arrow: kind == "arrow" }
+                    let [start, end] = ending_pair(kind, endings.as_deref())?;
+                    Shape::Line { from: to_user(&info, f[0], f[1]), to: to_user(&info, t[0], t[1]), start, end }
                 }
                 "ink" => {
                     let wrong = || ToolError::InvalidArgs("strokes must be an array of arrays of [x, y] points".into());
@@ -287,7 +321,10 @@ impl Automation {
                         })
                         .collect::<Result<Vec<_>>>()?;
                     match kind {
-                        "polyline" => Shape::PolyLine { vertices },
+                        "polyline" => {
+                            let [start, end] = ending_pair(kind, endings.as_deref())?;
+                            Shape::PolyLine { vertices, start, end }
+                        }
                         _ => Shape::Polygon { vertices, cloud: kind == "cloud" },
                     }
                 }
@@ -310,7 +347,17 @@ impl Automation {
                             [(point[0] + side) / 2.0, mid]
                         }
                     };
-                    Shape::Callout { rect, knee, point, font_size: a.opt_num("font_size")?.unwrap_or(10.0) }
+                    Shape::Callout {
+                        rect,
+                        knee,
+                        point,
+                        font_size: a.opt_num("font_size")?.unwrap_or(10.0),
+                        ending: match endings.as_deref() {
+                            None => LineEnding::OpenArrow,
+                            Some([ending]) => *ending,
+                            Some(_) => return Err(ToolError::InvalidArgs("a callout needs one ending".into())),
+                        },
+                    }
                 }
                 "attachment" => {
                     let [x, y] = a.need::<2>("at", "an attachment (its icon's top-left)")?;
@@ -484,7 +531,7 @@ impl Automation {
         }
         let (color, opacity, width) = (a.color("color")?, a.opt_num("opacity")?, a.opt_num("width")?);
         if color.is_some() || opacity.is_some() || width.is_some() {
-            edits.push(Edit::StyleAnnotation { page, index, color, opacity, width });
+            edits.push(Edit::StyleAnnotation { page, index, color, opacity, width, endings: None });
         }
         if let Some(r) = a.nums::<4>("rect")? {
             edits.push(Edit::ResizeAnnotation { page, index, rect: rect_to_user(&info, r) });
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 79e82d4e..18b7c67e 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -528,7 +528,7 @@ pub fn tools() -> Vec<ToolDef> {
             "Add a comment",
             "Add a comment as Acrobat's commenting tools do. Geometry is in points with the origin at the top-left of the displayed page, y down (as in page_render images at 72 dpi and text_find rects). \
              note: `at` [x, y] (icon top-left). stamp: `at` [x, y] (its centre) and `stamp`: approved, completed, confidential, draft, final, for comment, for public release, information only, not approved, not for public release, preliminary results, void, accepted, initial here, rejected, sign here, witness; dynamic: true for the dynamic approved/confidential/received/reviewed/revised stamps with a By … at … line. highlight/underline/strikeout/squiggly: `find` (text on the page to mark; every match with all: true) or `quads`. \
-             rectangle/oval/textbox: `rect` [x0, y0, x1, y1]. line/arrow: `from`, `to`. ink: `strokes` [[[x, y], …], …]. \
+             rectangle/oval/textbox: `rect` [x0, y0, x1, y1]. line/arrow: `from`, `to`. Optional `endings` (two names: start, end) for a line, arrow or polyline, or one name for a callout: None, Square, Circle, Diamond, OpenArrow, ClosedArrow, Butt, ROpenArrow, RClosedArrow, Slash. An arrow without endings is None then OpenArrow. ink: `strokes` [[[x, y], …], …]. \
              polygon/cloud/polyline (connected lines): `points` [[x, y], …]. callout: `rect` (its text box), `to` (the point the arrow touches), optional `knee`. caret (inserted text): `at`, the insertion point on the baseline. replace (Replace Text): `find` or `quads` like highlight, `contents` the replacement. attachment: `path` (the file), `at`, optional `icon` (PushPin, Paperclip, Graph, Tag). Undoable.",
         )
         .with(schema(
@@ -556,6 +556,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "fill": color(),
                 "opacity": { "type": "number", "minimum": 0, "maximum": 1 },
                 "width": { "type": "number", "minimum": 0, "description": "Line width in points." },
+                "endings": { "type": "array", "items": { "type": "string", "enum": ["None", "Square", "Circle", "Diamond", "OpenArrow", "ClosedArrow", "Butt", "ROpenArrow", "RClosedArrow", "Slash"] }, "minItems": 1, "maxItems": 2, "description": "Line endings. Two names (start, end) for a line, arrow or polyline; one name for a callout." },
                 "font_size": { "type": "number", "exclusiveMinimum": 0 },
             }),
             &["doc", "page", "type"],
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index e82bdc32..f5e3abbf 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -2247,6 +2247,72 @@ fn comment_checkmarks_locks_hiding_and_summaries_through_tools() {
     assert!(matches!(a.call("comments_summarize", &json!({ "doc": doc, "sort": "colour" })), Err(ToolError::InvalidArgs(_))));
 }
 
+#[test]
+fn line_endings_through_the_tool() {
+    let dir = workdir("endings");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "line", "from": [20, 40], "to": [120, 80], "endings": ["None", "Diamond"] }));
+    ok(
+        &mut a,
+        "comment_add",
+        json!({ "doc": doc, "page": 1, "type": "polyline", "points": [[20, 120], [60, 100], [100, 140]], "endings": ["Circle", "Slash"] }),
+    );
+    ok(
+        &mut a,
+        "comment_add",
+        json!({ "doc": doc, "page": 1, "type": "callout", "rect": [110, 200, 190, 240], "to": [40, 160], "contents": "Look", "endings": ["Square"] }),
+    );
+    assert!(matches!(
+        a.call("comment_add", &json!({ "doc": doc, "page": 1, "type": "line", "from": [20, 40], "to": [120, 80], "endings": ["Sparkle", "None"] })),
+        Err(ToolError::InvalidArgs(_))
+    ));
+    assert!(matches!(
+        a.call(
+            "comment_add",
+            &json!({ "doc": doc, "page": 1, "type": "callout", "rect": [10, 10, 80, 40], "to": [90, 80], "endings": ["None", "None"] })
+        ),
+        Err(ToolError::InvalidArgs(_))
+    ));
+    assert!(matches!(
+        a.call("comment_add", &json!({ "doc": doc, "page": 1, "type": "rectangle", "rect": [10, 10, 40, 40], "endings": ["Circle"] })),
+        Err(ToolError::InvalidArgs(_))
+    ));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "ended.pdf" }));
+    let saved = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("ended.pdf")).unwrap())).unwrap();
+    for name in [b"Diamond".as_slice(), b"Circle", b"Slash", b"Square"] {
+        assert!(
+            saved.object_numbers().iter().any(|n| saved.try_get(*n).ok().is_some_and(|o| object_has_name(&o, name))),
+            "missing /{}",
+            String::from_utf8_lossy(name)
+        );
+    }
+    let drawn: Vec<String> = saved
+        .object_numbers()
+        .into_iter()
+        .filter_map(|n| {
+            let obj = saved.try_get(n).ok()?;
+            let pdfcraft_cos::Object::Stream(s) = &*obj else { return None };
+            if s.dict.name(b"Subtype") != Some(b"Form") {
+                return None;
+            }
+            s.decoded().ok().map(|b| String::from_utf8_lossy(&b).into_owned())
+        })
+        .collect();
+    assert!(drawn.iter().any(|s| s.contains("h B")), "a filled ending was drawn: {drawn:?}");
+    assert!(drawn.iter().any(|s| s.contains(" l S")), "an open ending was drawn: {drawn:?}");
+}
+
+fn object_has_name(obj: &pdfcraft_cos::Object, name: &[u8]) -> bool {
+    match obj {
+        pdfcraft_cos::Object::Name(n) => n.as_slice() == name,
+        pdfcraft_cos::Object::Array(items) => items.iter().any(|o| object_has_name(o, name)),
+        pdfcraft_cos::Object::Dict(d) => d.iter().any(|(_, o)| object_has_name(o, name)),
+        pdfcraft_cos::Object::Stream(s) => s.dict.iter().any(|(_, o)| object_has_name(o, name)),
+        _ => false,
+    }
+}
+
 #[test]
 fn drawing_comments_through_tools() {
     let dir = workdir("drawing");
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 1b17908d..7532da50 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -94,8 +94,8 @@ pub fn typed_signature_shape(at: [f64; 2], text: &str, height: f64, rotation: i6
 pub use pdfcraft_annot::appearance as annot_text;
 pub use pdfcraft_annot::links::{Highlight as LinkHighlight, LinkAction, LinkItem, LinkStyle};
 pub use pdfcraft_annot::{
-    AttachIcon, FillMark, Markup, NOTE_SIZE, NewAnnotation, NoteIcon, OverlayFont, OverlayLook, Props as CommentProps, ReviewState, Rgb, Shape,
-    StampGroup, StampKind, Style, rect_quad,
+    AttachIcon, FillMark, LineEnding, Markup, NOTE_SIZE, NewAnnotation, NoteIcon, OverlayFont, OverlayLook, Props as CommentProps, ReviewState, Rgb,
+    Shape, StampGroup, StampKind, Style, rect_quad,
 };
 pub use pdfcraft_forms::detect;
 pub use pdfcraft_optimize as optimize;
@@ -852,6 +852,8 @@ pub enum Edit {
         color: Option<Rgb>,
         opacity: Option<f64>,
         width: Option<f64>,
+        /// Line or polyline: two endings. Callout: one. `None` leaves `/LE` unchanged.
+        endings: Option<Vec<pdfcraft_annot::LineEnding>>,
     },
     /// Comment properties ▸ General / note icon.
     SetAnnotationInfo {
@@ -1197,7 +1199,7 @@ fn annotation_noun(s: &Shape) -> &'static str {
         Shape::TextMarkup { kind: Markup::Squiggly, .. } => "squiggly underline",
         Shape::Rectangle { .. } => "rectangle",
         Shape::Oval { .. } => "oval",
-        Shape::Line { arrow: true, .. } => "arrow",
+        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "arrow",
         Shape::Line { .. } => "line",
         Shape::Ink { .. } => "drawing",
         Shape::TextBox { .. } => "text box",
@@ -1494,8 +1496,8 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
         Edit::LockAnnotation { page, index, locked } => pdfcraft_annot::set_locked(doc, *page, *index, *locked)?,
         Edit::MoveAnnotation { page, index, dx, dy } => pdfcraft_annot::move_annotation(doc, *page, *index, *dx, *dy, &cx.meta())?,
         Edit::ResizeAnnotation { page, index, rect } => pdfcraft_annot::set_rect(doc, *page, *index, *rect, &cx.meta())?,
-        Edit::StyleAnnotation { page, index, color, opacity, width } => {
-            pdfcraft_annot::set_style(doc, *page, *index, *color, *opacity, *width, &cx.meta())?;
+        Edit::StyleAnnotation { page, index, color, opacity, width, endings } => {
+            pdfcraft_annot::set_style(doc, *page, *index, *color, *opacity, *width, endings.as_deref(), &cx.meta())?;
         }
         Edit::SetAnnotationInfo { page, index, author, subject, icon } => {
             pdfcraft_annot::set_info(doc, *page, *index, author.as_deref(), subject.as_deref(), *icon, &cx.meta())?;
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index e885a9bd..1e497399 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -79,7 +79,7 @@ fn custom_image_stamp_keeps_displayed_orientation_on_rotated_pages() {
         for (actual, expected) in bounds.into_iter().zip([60.0, 80.0, 140.0, 120.0]) {
             assert!((actual - expected).abs() < 0.0001, "displayed bounds {bounds:?}");
         }
-        session.apply(id, Edit::StyleAnnotation { page: 0, index: 0, color: None, opacity: Some(1.0), width: None }).unwrap();
+        session.apply(id, Edit::StyleAnnotation { page: 0, index: 0, color: None, opacity: Some(1.0), width: None, endings: None }).unwrap();
         check(&session, points);
         let resized = info.view_rect_to_user([40.0, 70.0, 160.0, 130.0]).map(f64::from);
         session.apply(id, Edit::ResizeAnnotation { page: 0, index: 0, rect: resized }).unwrap();
diff --git a/crates/measure/src/lib.rs b/crates/measure/src/lib.rs
index 2415b774..fbd9684e 100644
--- a/crates/measure/src/lib.rs
+++ b/crates/measure/src/lib.rs
@@ -336,9 +336,12 @@ pub fn add(doc: &mut Document, new: &NewMeasurement, meta: &Meta) -> Result<usiz
         Kind::Distance => Shape::Line {
             from: new.points.first().copied().ok_or_else(|| invalid("missing start"))?,
             to: new.points.last().copied().ok_or_else(|| invalid("missing end"))?,
-            arrow: true,
+            start: pdfcraft_annot::LineEnding::None,
+            end: pdfcraft_annot::LineEnding::OpenArrow,
         },
-        Kind::Perimeter => Shape::PolyLine { vertices: new.points.clone() },
+        Kind::Perimeter => {
+            Shape::PolyLine { vertices: new.points.clone(), start: pdfcraft_annot::LineEnding::None, end: pdfcraft_annot::LineEnding::None }
+        }
         Kind::Area => Shape::Polygon { vertices: new.points.clone(), cloud: false },
     };
     let index = pdfcraft_annot::add_annotation(
diff --git a/crates/measure/src/tests.rs b/crates/measure/src/tests.rs
index 0d2c6d79..1a563dd6 100644
--- a/crates/measure/src/tests.rs
+++ b/crates/measure/src/tests.rs
@@ -92,7 +92,7 @@ fn standard_annotations_captions_restyle_move_and_unknown_keys() {
     let (r, dict) = annot(&d, 0, 0).unwrap();
     assert_eq!(dict.name(b"IT"), Some(&b"LineDimension"[..]));
     d.update_dict(r, |d| d.set(b"VendorKey".to_vec(), Object::Int(42))).unwrap();
-    pdfcraft_annot::set_style(&mut d, 0, 0, Some([1.0, 0.0, 0.0]), None, Some(2.0), &meta).unwrap();
+    pdfcraft_annot::set_style(&mut d, 0, 0, Some([1.0, 0.0, 0.0]), None, Some(2.0), None, &meta).unwrap();
     let (_, dict) = annot(&d, 0, 0).unwrap();
     assert_eq!(dict.int(b"VendorKey"), Some(42));
     let ap = d.resolve(dict.get(b"AP").unwrap());
diff --git a/crates/ui-egui/src/comment_props.rs b/crates/ui-egui/src/comment_props.rs
index 01fa8488..92a7beb7 100644
--- a/crates/ui-egui/src/comment_props.rs
+++ b/crates/ui-egui/src/comment_props.rs
@@ -3,7 +3,7 @@
 //! subject, modified) and Review History (status changes), with Acrobat's Locked box.
 
 use egui::{Align, Layout};
-use pdfcraft_engine::{CommentProps, Edit, NoteIcon};
+use pdfcraft_engine::{CommentProps, Edit, LineEnding, NoteIcon};
 
 use crate::comments::swatch_grid;
 use crate::theme::{self, Tokens};
@@ -108,8 +108,9 @@ pub fn edits(d: &PropsDraft) -> Vec<Edit> {
     let color = (e.color != o.color).then_some(e.color).flatten();
     let opacity = ((e.opacity - o.opacity).abs() > 1e-6).then_some(e.opacity);
     let width = (e.width != o.width).then_some(e.width).flatten();
-    if e.restylable && (color.is_some() || opacity.is_some() || width.is_some()) {
-        out.push(Edit::StyleAnnotation { page: d.page, index: d.index, color, opacity, width });
+    let endings = (e.endings != o.endings).then(|| e.endings.clone()).flatten();
+    if e.restylable && (color.is_some() || opacity.is_some() || width.is_some() || endings.is_some()) {
+        out.push(Edit::StyleAnnotation { page: d.page, index: d.index, color, opacity, width, endings });
     }
     let author = (e.author != o.author).then(|| e.author.clone());
     let subject = (e.subject != o.subject).then(|| e.subject.clone());
@@ -188,6 +189,19 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                         ui.add(egui::Slider::new(w, 0.5..=12.0).step_by(0.5).suffix(" pt"));
                         ui.end_row();
                     }
+                    if let Some(ends) = e.endings.as_mut() {
+                        ui.label(tl!("Line ending"));
+                        ui.horizontal(|ui| {
+                            for (i, ending) in ends.iter_mut().enumerate() {
+                                egui::ComboBox::from_id_salt(("line-ending", i)).selected_text(ending.name()).width(130.0).show_ui(ui, |ui| {
+                                    for style in LineEnding::ALL {
+                                        ui.selectable_value(ending, style, style.name());
+                                    }
+                                });
+                            }
+                        });
+                        ui.end_row();
+                    }
                 });
             });
         }
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index 5621d630..bfe48b9a 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -13,7 +13,7 @@
 //! applied by the app, so each change is one undo step.
 
 use egui::{Color32, CornerRadius, Pos2, Rect, Sense, Stroke, pos2, vec2};
-use pdfcraft_engine::{Edit, Markup, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, Style};
+use pdfcraft_engine::{Edit, LineEnding, Markup, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, Style};
 use pdfcraft_render::{Annotation, DocInfo};
 
 use crate::canvas::{DocView, PageXform};
@@ -200,14 +200,14 @@ impl CommentTool {
                 Shape::TextMarkup { kind: self.markup().unwrap_or(Markup::Highlight), quads: Vec::new() }
             }
             Self::Ink => Shape::Ink { strokes: Vec::new() },
-            Self::Line => Shape::Line { from: [0.0; 2], to: [0.0; 2], arrow: false },
-            Self::Arrow => Shape::Line { from: [0.0; 2], to: [0.0; 2], arrow: true },
+            Self::Line => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::None },
+            Self::Arrow => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::OpenArrow },
             Self::Rectangle => Shape::Rectangle { rect: [0.0; 4] },
             Self::Oval => Shape::Oval { rect: [0.0; 4] },
             Self::Polygon => Shape::Polygon { vertices: Vec::new(), cloud: false },
             Self::Cloud => Shape::Polygon { vertices: Vec::new(), cloud: true },
-            Self::PolyLine => Shape::PolyLine { vertices: Vec::new() },
-            Self::Callout => Shape::Callout { rect: [0.0; 4], knee: [0.0; 2], point: [0.0; 2], font_size: 10.0 },
+            Self::PolyLine => Shape::PolyLine { vertices: Vec::new(), start: LineEnding::None, end: LineEnding::None },
+            Self::Callout => Shape::Callout { rect: [0.0; 4], knee: [0.0; 2], point: [0.0; 2], font_size: 10.0, ending: LineEnding::OpenArrow },
             Self::Caret => Shape::Caret { rect: [0.0; 4] },
             Self::ReplaceText => Shape::TextMarkup { kind: Markup::StrikeOut, quads: Vec::new() },
             Self::Eraser => Shape::Ink { strokes: Vec::new() },
@@ -1008,13 +1008,20 @@ fn drawn_shape(tool: CommentTool, points: &[[f64; 2]]) -> Option<Shape> {
     let big = rect[2] - rect[0] >= 2.0 && rect[3] - rect[1] >= 2.0;
     match tool {
         CommentTool::Ink if points.len() >= 2 => Some(Shape::Ink { strokes: vec![points.to_vec()] }),
-        CommentTool::Line | CommentTool::Arrow if far => Some(Shape::Line { from: first, to: last, arrow: tool == CommentTool::Arrow }),
+        CommentTool::Line | CommentTool::Arrow if far => Some(Shape::Line {
+            from: first,
+            to: last,
+            start: LineEnding::None,
+            end: if tool == CommentTool::Arrow { LineEnding::OpenArrow } else { LineEnding::None },
+        }),
         CommentTool::Rectangle if big => Some(Shape::Rectangle { rect }),
         CommentTool::Oval if big => Some(Shape::Oval { rect }),
         CommentTool::Polygon | CommentTool::Cloud if points.len() >= 3 => {
             Some(Shape::Polygon { vertices: points.to_vec(), cloud: tool == CommentTool::Cloud })
         }
-        CommentTool::PolyLine if points.len() >= 2 => Some(Shape::PolyLine { vertices: points.to_vec() }),
+        CommentTool::PolyLine if points.len() >= 2 => {
+            Some(Shape::PolyLine { vertices: points.to_vec(), start: LineEnding::None, end: LineEnding::None })
+        }
         _ => None,
     }
 }
@@ -1144,7 +1151,7 @@ pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
                 (rect[0] + rect[2]) / 2.0
             };
             let knee = [(point[0] + side) / 2.0, (rect[1] + rect[3]) / 2.0];
-            Some(new_comment(&cx, CommentTool::Callout, Shape::Callout { rect, knee, point, font_size: 10.0 }, text))
+            Some(new_comment(&cx, CommentTool::Callout, Shape::Callout { rect, knee, point, font_size: 10.0, ending: LineEnding::OpenArrow }, text))
         }
         ComposerKind::Replace => {
             view.comments.tool_done = true;
@@ -1236,8 +1243,14 @@ pub(crate) fn context_menu(ui: &mut egui::Ui, view: &mut DocView, info: &DocInfo
                 });
                 ui.menu_button(tl!("Colour"), |ui| {
                     if let Some(c) = swatch_grid(ui, a.color.map(|c| c.map(f64::from))) {
-                        action =
-                            Some(CanvasAction::Edit(Box::new(Edit::StyleAnnotation { page, index, color: Some(c), opacity: None, width: None })));
+                        action = Some(CanvasAction::Edit(Box::new(Edit::StyleAnnotation {
+                            page,
+                            index,
+                            color: Some(c),
+                            opacity: None,
+                            width: None,
+                            endings: None,
+                        })));
                         ui.close();
                     }
                 });
@@ -1404,7 +1417,10 @@ mod tests {
         assert_eq!(drawn_shape(CommentTool::Rectangle, &[[0.0, 0.0], [1.0, 1.0]]), None);
         assert_eq!(drawn_shape(CommentTool::Rectangle, &[[10.0, 0.0], [0.0, 10.0]]), Some(Shape::Rectangle { rect: [0.0, 0.0, 10.0, 10.0] }));
         assert_eq!(drawn_shape(CommentTool::Ink, &[[0.0, 0.0]]), None);
-        assert!(matches!(drawn_shape(CommentTool::Arrow, &[[0.0, 0.0], [5.0, 0.0]]), Some(Shape::Line { arrow: true, .. })));
+        assert!(matches!(
+            drawn_shape(CommentTool::Arrow, &[[0.0, 0.0], [5.0, 0.0]]),
+            Some(Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. })
+        ));
     }
 
     #[test]
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 4aed0598..3a916579 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -608,6 +608,7 @@
 	This comment's appearance can't be changed yet.	Външният вид на този коментар все още не може да се променя.
 	Icon	Икона
 	Thickness	Дебелина
+	Line ending	Край на линията
 	Modified	Променено
 	No status has been set.	Не е зададено състояние.
 	Compare Files	Сравняване на файлове
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 20f9440e..b33ae95f 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -896,6 +896,7 @@
 	This comment's appearance can't be changed yet.	Die Darstellung dieses Kommentars kann noch nicht geändert werden.
 	Icon	Symbol
 	Thickness	Stärke
+	Line ending	Linienende
 	Modified	Geändert
 	No status has been set.	Es wurde kein Status festgelegt.
 	Compare Files	Dateien vergleichen
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 8aca5cf8..69f9a0bf 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -895,6 +895,7 @@
 	This comment's appearance can't be changed yet.	L'apparence de ce commentaire ne peut pas encore être modifiée.
 	Icon	Icône
 	Thickness	Épaisseur
+	Line ending	Extrémité de ligne
 	Modified	Modifié
 	No status has been set.	Aucun état n'a été défini.
 	Compare Files	Comparer des fichiers
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 04b39f8b..ba51c4e8 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2083,3 +2083,4 @@ action wizard	Start	Indítás
 	Home / End	Home / End
 	H / Space (hold)	H / szóköz (nyomva tartva)
 	Rotation:	Elforgatás:
+	Line ending	Vonalvég
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 415e22f9..fc1e1d62 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -916,6 +916,7 @@
 	This comment's appearance can't be changed yet.	Внешний вид этого комментария пока нельзя изменить.
 	Icon	Значок
 	Thickness	Толщина
+	Line ending	Окончание линии
 	Modified	Изменено
 	No status has been set.	Статус не установлен.
 	Compare Files	Сравнить файлы
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index dfb2b437..25fc9bda 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2105,3 +2105,4 @@ calendar date	December	грудня
 	Home / End	Home / End
 	H / Space (hold)	H / Пробіл (утримувати)
 	Rotation:	Поворот:
+	Line ending	Закінчення лінії
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 0969213f..c3a9d769 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -615,6 +615,7 @@
 	This comment's appearance can't be changed yet.	此注释的外观尚无法更改。
 	Icon	图标
 	Thickness	粗细
+	Line ending	线条端点
 	Modified	修改时间
 	No status has been set.	尚未设置状态。
 	Compare Files	比较文件
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index ad36b6f4..3bade2c7 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -264,6 +264,37 @@ fn the_panel_posts_comments_and_replies() {
     h.get_by_label_contains("Agreed");
 }
 
+#[test]
+fn line_ending_properties_change_and_undo() {
+    let mut h = harness(|app| app.set_option("quick", "line").unwrap());
+    drag_pt(&mut h, (40.0, 100.0), (160.0, 40.0));
+    h.state_mut().open_comment_props(0, 0);
+    h.run_steps(2);
+    h.get_by_label("Line ending");
+    {
+        let d = h.state_mut().comment_props.as_mut().expect("open");
+        assert_eq!(d.edited.endings.as_deref(), Some(&[pdfcraft_engine::LineEnding::None, pdfcraft_engine::LineEnding::None][..]));
+        d.edited.endings = Some(vec![pdfcraft_engine::LineEnding::None, pdfcraft_engine::LineEnding::Diamond]);
+    }
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    let endings = {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!(doc.can_undo(), Some("Change comment properties"));
+        doc.comment_props(0, 0).unwrap().endings
+    };
+    assert_eq!(endings.as_deref(), Some(&[pdfcraft_engine::LineEnding::None, pdfcraft_engine::LineEnding::Diamond][..]));
+    h.state_mut().execute("edit.undo");
+    h.run_steps(2);
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(
+        doc.comment_props(0, 0).unwrap().endings.as_deref(),
+        Some(&[pdfcraft_engine::LineEnding::None, pdfcraft_engine::LineEnding::None][..])
+    );
+}
+
 #[test]
 fn comment_properties_change_appearance_and_author() {
     let mut h = harness(|app| app.set_option("quick", "square").unwrap());
@@ -453,6 +484,7 @@ fn the_panel_filters_by_colour_and_checkmark() {
         color: Some([0.0, 0.47, 0.84]),
         opacity: None,
         width: None,
+        endings: None,
     });
     h.state_mut().apply_edit(pdfcraft_engine::Edit::MarkAnnotation { page: 0, index: 0, marked: true, author: "Tester".into() });
     h.run_steps(2);
@@ -487,6 +519,7 @@ fn make_current_properties_default() {
         color: Some([0.0, 0.47, 0.84]),
         opacity: Some(0.5),
         width: Some(5.0),
+        endings: None,
     });
     h.run_steps(2);
     h.get_by_label("More").click();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 9dcabbef..7a77624c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -3770,8 +3770,8 @@ milestone = "M5"
 status = "partial"
 commands = []
 tools = ["comment_add"]
-evidence = ["crates/annot/src/tests.rs::every_tool_creates_a_drawable_comment"]
-notes = "None, OpenArrow and ClosedArrow are drawn; other endings are kept but not redrawn"
+evidence = ["crates/annot/src/tests.rs::every_line_ending_is_drawn", "crates/automation/tests/automation.rs::line_endings_through_the_tool", "crates/ui-egui/tests/comments.rs::line_ending_properties_change_and_undo"]
+notes = "All ten /LE styles (None, Square, Circle, Diamond, OpenArrow, ClosedArrow, Butt, ROpenArrow, RClosedArrow, Slash) are drawn on lines, polylines and callouts. comment_add endings and Comment properties set them. Dashed borders are drawn. Cloudy borders are still polygon-only."
 
 [[feature]]
 id = "comment.properties-dialog"

From f1af1e2e79ba9d2df3cb7debf88098b952dc6fd7 Mon Sep 17 00:00:00 2001
From: Hal Goff <henry@tollitt.com>
Date: Fri, 9 Oct 2026 18:20:47 +0100
Subject: [PATCH 097/149] Issue #125: page text the standard fonts can't draw
 is refused, not written as ? (#510)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add text, headers/footers and watermarks wrote every character outside
WinAnsiEncoding as `?` and reported success. They now refuse it with a
specific error ("the standard fonts can't draw "中" (U+4E2D) ...") before
changing anything, as the maintainer asked on #327. Form fields and
text-box comments are unchanged (they keep the value).

- fonts: win_ansi_encodable / first_non_win_ansi, defined through
  win_ansi itself so a fuller table widens them too; the edited-text
  Type 3 decision uses the same check (same character set as before).
- edit: one drawable() check, fed the lines exactly as each tool draws
  them, so a CR that would become `?` is refused and CRLF in headers is not.
- ui: the Add-text editor keeps such text open with an inline warning.
  Done, a click elsewhere or a double-click on another item don't take
  or replace it; it counts as unsaved work; Save stops and shows it; a
  deleted page takes its draft with it.
- Arabic (#403): one public check, first_undrawable, follows the drawing:
  Arabic shaped with the craft-fonts face is drawable, and only what's left
  to the standard font counts. Without the face, #403 still decides for the
  Arabic letters (new items refused with what's missing, existing ones stay
  movable), but nothing else in the item may become `?`. The editor uses
  the same check, cached per draft.
- #403's odd_arabic_text_never_panics: its U+2029/U+0085 input, which was
  drawn as `?`, now expects a refusal naming the character.
- The warning is translated (fr, ru, zh-hans, zh-hant, es, ja, bg, de); the
  catalogs' SHA-256 entries in ATTRIBUTION.toml are updated.


Claude-Session: https://claude.ai/code/session_01VNJqS2dEQawHJn1qTRJiKp

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                    | 20 ++++----
 crates/edit/src/added.rs            | 39 ++++++++++++++
 crates/edit/src/lib.rs              | 26 +++++++++-
 crates/edit/src/tests.rs            | 80 +++++++++++++++++++++++++++--
 crates/engine/src/lib.rs            |  2 +-
 crates/fonts/src/lib.rs             | 22 ++++++++
 crates/ui-egui/src/canvas.rs        |  4 ++
 crates/ui-egui/src/content_ui.rs    | 66 +++++++++++++++++++++++-
 crates/ui-egui/src/editing.rs       | 20 +++++++-
 crates/ui-egui/src/i18n/bg.tsv      |  1 +
 crates/ui-egui/src/i18n/de.tsv      |  1 +
 crates/ui-egui/src/i18n/es.tsv      |  1 +
 crates/ui-egui/src/i18n/fr.tsv      |  1 +
 crates/ui-egui/src/i18n/hu.tsv      |  1 +
 crates/ui-egui/src/i18n/ja.tsv      |  1 +
 crates/ui-egui/src/i18n/ru.tsv      |  1 +
 crates/ui-egui/src/i18n/uk.tsv      |  1 +
 crates/ui-egui/src/i18n/zh-hans.tsv |  1 +
 crates/ui-egui/src/i18n/zh-hant.tsv |  1 +
 crates/ui-egui/tests/content.rs     | 56 ++++++++++++++++++++
 20 files changed, 328 insertions(+), 17 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 07ec3777..b33510f3 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "163a07f4dcf89deebb8bc44fa05f59a5d85a35ddfe82665dd650522fa9f1fe20"
+sha256 = "2d56f8464f3c25efe9737b204db34cef012ea3716f4d78209d9abeaf0ea9393b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8e2051a5fdf7c52cc4fd5f79bf4be3405c213e247cf80bba714e008ee405ec13"
+sha256 = "b0ca648560c45e554447aae8dba37c1c9c636c86b277d00fceeb2a21b474c8f7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "05ebb95a81e3516fed37329237a6b4f26fd2168fa36cb3e16d4ae218d00e373a"
+sha256 = "e9a9bad1252afdcb42c36b24ca85411f8c63df7debada94d4423bd48761ecb05"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "a5b888d86c9866ec8825a91e845cfa881c16e774be16d9be636e7dfb8dfe3b67"
+sha256 = "0351382a91d2df51da3d45e25a09af87a081bc88e3496c3512ad89f5d4460a3a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "bdf30a0f69c3aafb6e660f2666534b16d05b053812ae344a4f9a281fe294851e"
+sha256 = "57f52e3671a322938a160ac11b73b1f55fb6311140f20d89ae12c9a91a0500d6"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "09e063f1c9bb0a5c1485f5e8b4633df3b7f77b00f8f8cbfa4f8c169764e329c2"
+sha256 = "e505c00bcc8b8af6aec27abf84bebac7a1925c632130411000a6c57241816193"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1c9db94bc77c6d7dd046adae0a81bebe4cafb372a789711c37911f46756f8c9d"
+sha256 = "c198f1de831d7f9c853baa6977894ccc34d94e6b36c772c2e53fc5b0e0fe708b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b09f7de47fed031109de88a028b82ca86d9228d872f7f54e7e113d9df3d00ac2"
+sha256 = "9682b2c3c28449dc63637cb5962b309df3ad7db7e8d96bf8bb0f0bc386c9c611"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d0cbe639f664b47ec97dd573ab2642b72a1b80c170f3a756f045647f5afa34cb"
+sha256 = "319b032d2c50097ec14e2c7eab92e8696d33e198aeac3585ff46e98c61dec90f"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fde7607a8e14c8d39d2807a21f94b78da56207fcafab7271e41fc10e69f848e7"
+sha256 = "f3a03fc466c1f956cbd44a5cad101c53db5ffc80b3b7551a273ac41f43263dd5"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/crates/edit/src/added.rs b/crates/edit/src/added.rs
index 6537f92d..40a2770e 100644
--- a/crates/edit/src/added.rs
+++ b/crates/edit/src/added.rs
@@ -239,6 +239,34 @@ fn is_arabic(c: char) -> bool {
     matches!(u32::from(c), 0x0600..=0x06FF | 0x0750..=0x077F | 0x0870..=0x08FF | 0xFB50..=0xFDFF | 0xFE70..=0xFEFC)
 }
 
+/// The first character of `t` that would be drawn as `?`: outside WinAnsiEncoding and not drawn
+/// with the craft-fonts Arabic face (#125), or Arabic that the face can't draw (or that has no
+/// face to draw it). Page-content tools refuse such text; the Add-text editor keeps it open.
+pub fn first_undrawable(t: &AddedText) -> Option<char> {
+    // Arabic that nothing can draw: there's no face, or the face lacks it.
+    if let Some(c) = t.text.chars().find(|c| shaped_arabic(*c) && !pdfcraft_fonts::arabic_has(*c)) {
+        return Some(c);
+    }
+    if pdfcraft_fonts::document_arabic_font().is_none() || !t.text.chars().any(is_arabic) {
+        // Drawn line by line in the item's standard font (`\n` splits lines). Without the face
+        // that is also how `draw` redraws an existing item, so it's checked that way.
+        return t.text.split('\n').find_map(pdfcraft_fonts::first_non_win_ansi);
+    }
+    // What `arabic_layout` leaves to the standard font, exactly as `draw_arabic` splits it.
+    wrapped(t).into_iter().find_map(|(line, rtl)| {
+        let (pieces, _) = arabic_layout(t, &line, rtl).ok()?;
+        pieces.iter().find_map(|p| match p {
+            Piece::Latin(s) => pdfcraft_fonts::first_non_win_ansi(s),
+            Piece::Arabic(_) => None,
+        })
+    })
+}
+
+/// An Arabic character the face shapes and draws (U+061C, a direction mark, is dropped).
+fn shaped_arabic(c: char) -> bool {
+    is_arabic(c) && !is_bidi_control(c)
+}
+
 /// Direction marks, embeddings, overrides and isolates: they steer the order and are not drawn.
 fn is_bidi_control(c: char) -> bool {
     matches!(c, '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}')
@@ -706,6 +734,17 @@ fn validate(c: &Content) -> Result<(), EditError> {
             if (r[2] - r[0]).abs() < 1.0 {
                 return Err(EditError::Invalid("the text box is too narrow".into()));
             }
+            // Without the Arabic face, `draw` decides for the Arabic letters themselves (#403): a new
+            // item is refused with what's missing, and one that already holds Arabic stays movable.
+            // Everything else in it is drawn in the standard font, so it still has to fit.
+            let undrawable = if t.text.chars().any(shaped_arabic) && pdfcraft_fonts::document_arabic_font().is_none() {
+                t.text.split('\n').find_map(|line| line.chars().find(|c| !shaped_arabic(*c) && !pdfcraft_fonts::win_ansi_encodable(*c)))
+            } else {
+                first_undrawable(t)
+            };
+            if let Some(c) = undrawable {
+                return Err(crate::undrawable(c));
+            }
         }
         Content::Image(_) => {
             if (r[2] - r[0]).abs() < 1.0 || (r[3] - r[1]).abs() < 1.0 {
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 7950184e..93df6829 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -375,6 +375,24 @@ fn begin(kind: MarkKind, subtype: &str, matrix: [f64; 6]) -> String {
 
 const END: &str = "EMC\nQ\n";
 
+/// Refuses page text the standard-14 fonts (WinAnsiEncoding) can't draw: written anyway, each
+/// such character would become a `?` on the page (#125). `lines` must split the text the way the
+/// caller draws it, so a `\r` that would be drawn is refused too.
+pub(crate) fn drawable<'a>(lines: impl IntoIterator<Item = &'a str>) -> Result<(), EditError> {
+    match lines.into_iter().find_map(pdfcraft_fonts::first_non_win_ansi) {
+        Some(c) => Err(undrawable(c)),
+        None => Ok(()),
+    }
+}
+
+/// The refusal for page text with `c`, which nothing here can draw.
+pub(crate) fn undrawable(c: char) -> EditError {
+    EditError::Invalid(format!(
+        "the standard fonts can't draw \"{c}\" (U+{:04X}); only Western European characters can be added as text for now",
+        u32::from(c)
+    ))
+}
+
 fn text_op(x: f64, y: f64, text: &str) -> Vec<u8> {
     let mut v = format!("1 0 0 1 {} {} Tm ", n(x), n(y)).into_bytes();
     v.extend(literal(&win_ansi(text)));
@@ -390,6 +408,9 @@ pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter,
     if hf.text.iter().all(|t| t.trim().is_empty()) {
         return Err(EditError::Invalid("type the header or footer text first".into()));
     }
+    // Tokens only add ASCII (Bates prefixes and suffixes are part of the template), so checking
+    // the templates, split as `expand`'s output is, covers every page.
+    hf.text.iter().try_for_each(|t| drawable(t.lines()))?;
     if !(hf.font_size.is_finite() && hf.font_size > 0.0 && hf.font_size <= 200.0 && hf.margins.iter().all(|m| m.is_finite() && *m >= 0.0)) {
         return Err(EditError::Invalid("invalid font size or margins".into()));
     }
@@ -452,6 +473,9 @@ pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replac
     if text.is_empty() && wm.source.is_none() {
         return Err(EditError::Invalid("type the watermark text first".into()));
     }
+    if wm.source.is_none() {
+        drawable(text.lines())?;
+    }
     if !(wm.opacity.is_finite() && wm.rotation.is_finite() && wm.font_size.is_finite() && wm.font_size >= 0.0) {
         return Err(EditError::Invalid("invalid watermark settings".into()));
     }
@@ -594,7 +618,7 @@ pub use images::{ImageChange, PageImage, change_image, page_images, rect_to_rect
 pub mod text;
 pub use text::{BlockStyle, LineEdit, TextBlock, TextLine, replace_block, replace_line, rewrite_block, text_blocks, text_lines};
 pub mod added;
-pub use added::{Added, AddedImage, AddedText, Align, Content, Family, add_content, delete_content, list_added, update_content};
+pub use added::{Added, AddedImage, AddedText, Align, Content, Family, add_content, delete_content, first_undrawable, list_added, update_content};
 
 #[cfg(test)]
 mod tests;
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 3896b830..f7756941 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -336,12 +336,22 @@ fn own(doc: &Document, index: usize) -> Vec<String> {
 fn odd_arabic_text_never_panics() {
     let mut doc = fixture();
     let long = "بسم الله ".repeat(2_000);
-    for s in
-        ["\u{202E}ب\u{064B}\u{064B} (]", "\u{064B}", "ا\u{200F}\u{2067}b\u{2069}", "ا\n\nب\tc", "ا\u{2029}ب\rc\u{85}د\n", "ﷺ ١٢٣ 456", long.as_str()]
-    {
+    for s in ["\u{202E}ب\u{064B}\u{064B} (]", "\u{064B}", "ا\u{200F}\u{2067}b\u{2069}", "ا\n\nب\tc", "ﷺ ١٢٣ 456", long.as_str()] {
         let r = add_content(&mut doc, 0, &Content::Text(AddedText { rect: [0.0, 800.0, 300.0, 780.0], text: s.into(), ..AddedText::default() }));
         assert_eq!(r.is_ok(), pdfcraft_fonts::document_arabic_font().is_some(), "{:?}: {r:?}", s.chars().take(12).collect::<String>());
     }
+    // U+2029 and U+0085 (paragraph and line separators) have no WinAnsi code, so the standard font
+    // would draw them as `?`: refused, by name, rather than written (#125). Laying it out still
+    // mustn't panic.
+    let r = add_content(
+        &mut doc,
+        0,
+        &Content::Text(AddedText { rect: [0.0, 800.0, 300.0, 780.0], text: "ا\u{2029}ب\rc\u{85}د\n".into(), ..AddedText::default() }),
+    );
+    assert!(r.is_err(), "{r:?}");
+    if pdfcraft_fonts::document_arabic_font().is_some() {
+        assert!(matches!(&r, Err(EditError::Invalid(m)) if m.contains("U+2029") || m.contains("U+0085")), "{r:?}");
+    }
     // A character the face lacks is an error that names it, not a box or a crash.
     if pdfcraft_fonts::document_arabic_font().is_some() && !pdfcraft_fonts::arabic_has('\u{FDFD}') {
         let r = add_content(
@@ -1194,3 +1204,67 @@ fn the_graphics_state_carries_over_between_content_streams() {
     let l = &text::text_lines(&doc, 0).unwrap()[0];
     assert!(close(l.rect[0], 100.0) && close(l.size, 10.0), "{l:?}");
 }
+
+/// #125: page-content tools refuse text the standard fonts can't draw instead of writing `?`,
+/// and leave the document untouched.
+#[test]
+fn page_text_the_standard_fonts_cant_draw_is_refused() {
+    let mut doc = fixture();
+    let before: Vec<Vec<String>> = (0..3).map(|p| streams(&reopen(&doc), p)).collect();
+    let text = AddedText { rect: [72.0, 600.0, 300.0, 700.0], text: "日本語のテキスト".into(), ..AddedText::default() };
+    let err = add_content(&mut doc, 0, &Content::Text(text)).unwrap_err().to_string();
+    assert!(err.contains("\"日\" (U+65E5)"), "{err}");
+    let hf = HeaderFooter {
+        text: ["Ελληνικά".into(), String::new(), String::new(), String::new(), String::new(), String::new()],
+        ..HeaderFooter::default()
+    };
+    assert!(add_header_footer(&mut doc, &[0, 1], &hf, true, &cx()).unwrap_err().to_string().contains("U+0395"));
+    let wm = Watermark { text: "机密".into(), ..Watermark::default() };
+    assert!(add_watermark(&mut doc, &[0], &wm, true).unwrap_err().to_string().contains("U+673A"));
+    let after: Vec<Vec<String>> = (0..3).map(|p| streams(&reopen(&doc), p)).collect();
+    assert_eq!(before, after, "a refused edit changes nothing");
+    // Western European text, including what only WinAnsi (not Latin-1) has, still works.
+    let text = AddedText { rect: [72.0, 600.0, 300.0, 700.0], text: "Café — 5€ ™".into(), ..AddedText::default() };
+    add_content(&mut doc, 0, &Content::Text(text.clone())).unwrap();
+    // Retyping existing text is refused the same way, and the whole document is left as it was.
+    let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let retyped = AddedText { text: "Café 中".into(), ..text.clone() };
+    assert!(update_content(&mut doc, 0, 0, &Content::Text(retyped)).unwrap_err().to_string().contains("U+4E2D"));
+    assert_eq!(write_incremental(&doc, &SaveOptions::default()).unwrap(), saved, "a refused update changes nothing");
+    // A carriage return is checked where it would be drawn: added text splits on LF only, so
+    // CRLF would leave a `?`; headers and watermarks split CRLF into lines, but not a lone CR.
+    let crlf = AddedText { text: "A\r\nB".into(), ..text };
+    assert!(add_content(&mut doc, 0, &Content::Text(crlf)).unwrap_err().to_string().contains("U+000D"));
+    let hf = |t: &str| HeaderFooter {
+        text: [t.into(), String::new(), String::new(), String::new(), String::new(), String::new()],
+        ..HeaderFooter::default()
+    };
+    add_header_footer(&mut doc, &[0], &hf("Left\r\n<<Bates Number#6#1#ACME-#>>"), true, &cx()).unwrap();
+    assert!(add_header_footer(&mut doc, &[0], &hf("A\rB"), true, &cx()).unwrap_err().to_string().contains("U+000D"));
+    // Arabic is shaped with the craft-fonts Arabic face (#403): drawable when that face is built
+    // in, refused (never written as `?`) when it isn't. Text left to the standard font still counts.
+    let arabic = |text: &str| AddedText { rect: [72.0, 600.0, 300.0, 700.0], text: text.into(), ..AddedText::default() };
+    // U+061C is in the Arabic block but is a direction mark that's dropped, not shaped: it never
+    // makes text drawable, nor (with the face) undrawable.
+    assert!(add_content(&mut doc, 0, &Content::Text(arabic("\u{061C}中"))).is_err());
+    if pdfcraft_fonts::arabic_has('م') {
+        add_content(&mut doc, 0, &Content::Text(arabic("مرحبا Hello"))).unwrap();
+        add_content(&mut doc, 0, &Content::Text(arabic("\u{061C}Hello"))).unwrap();
+        for text in ["مرحبا 中", "\u{061C}中"] {
+            let err = add_content(&mut doc, 0, &Content::Text(arabic(text))).unwrap_err().to_string();
+            assert!(err.contains("U+4E2D"), "{text:?}: {err}");
+        }
+    } else {
+        // #403's own refusal says what's missing; the Add-text editor still keeps the draft.
+        let err = add_content(&mut doc, 0, &Content::Text(arabic("مرحبا Hello"))).unwrap_err().to_string();
+        assert!(err.contains("CRAFT_FONTS_DIR"), "{err}");
+        assert_eq!(first_undrawable(&arabic("مرحبا Hello")), Some('م'));
+        // An existing item may still take Arabic (#403 keeps it movable), but nothing else that
+        // the standard font would write as `?`.
+        let n = list_added(&doc).iter().filter(|a| a.page == 0).count();
+        add_content(&mut doc, 0, &Content::Text(arabic("x"))).unwrap();
+        let err = update_content(&mut doc, 0, n, &Content::Text(arabic("ب中"))).unwrap_err().to_string();
+        assert!(err.contains("U+4E2D"), "{err}");
+        update_content(&mut doc, 0, n, &Content::Text(arabic("ب"))).unwrap();
+    }
+}
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 7532da50..9ee20873 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -44,7 +44,7 @@ pub use pdfcraft_forms::{
 };
 
 pub use pdfcraft_a11y as a11y;
-pub use pdfcraft_edit::{BlockStyle, PageImage, TextBlock, TextLine};
+pub use pdfcraft_edit::{BlockStyle, PageImage, TextBlock, TextLine, first_undrawable};
 pub use pdfcraft_measure as measure;
 pub use pdfcraft_xfa::Report as XfaLayout;
 
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index ecd7630b..ee94566d 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -176,6 +176,16 @@ impl UnicodeCMap {
     }
 }
 
+/// Whether [`win_ansi`] keeps `c` rather than writing `?` (a tab becomes a space).
+pub fn win_ansi_encodable(c: char) -> bool {
+    c == '\t' || win_ansi_byte(c).is_some()
+}
+
+/// The first character of `s` that [`win_ansi`] can't encode and would write as `?`.
+pub fn first_non_win_ansi(s: &str) -> Option<char> {
+    s.chars().find(|c| !win_ansi_encodable(*c))
+}
+
 /// Bytes as a PDF literal string, `(` … `)`, with delimiters escaped.
 pub fn literal(bytes: &[u8]) -> Vec<u8> {
     let mut out = Vec::with_capacity(bytes.len() + 2);
@@ -196,6 +206,18 @@ pub fn literal(bytes: &[u8]) -> Vec<u8> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn win_ansi_encodability_matches_the_encoder() {
+        for c in ['a', 'é', 'ÿ', '€', '—', '™', '\t', '?'] {
+            assert!(win_ansi_encodable(c), "{c:?}");
+        }
+        for c in ['中', 'あ', 'Ω', 'č', 'ă', '☃', '😀'] {
+            assert!(!win_ansi_encodable(c), "{c:?}");
+        }
+        assert_eq!(first_non_win_ansi("Café — 5€"), None);
+        assert_eq!(first_non_win_ansi("Dvořák"), Some('ř'));
+    }
+
     #[test]
     fn widths_wrap_and_encode() {
         assert!(helvetica_width("MMMM", 10.0) > helvetica_width("iiii", 10.0) * 2.0);
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index a349c843..f985925e 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -429,6 +429,10 @@ impl DocView {
         self.current = self.current.min(last);
         self.page_input = (self.current + 1).to_string();
         self.selected.retain(|p| *p <= last);
+        // Text being typed on a page that no longer exists goes with the page.
+        if self.content.draft.as_ref().is_some_and(|d| d.page > last || self.page_count == 0) {
+            self.content.draft = None;
+        }
         if self.select_anchor.is_some_and(|a| a > last) {
             self.select_anchor = None;
         }
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index fcebab34..7d0f10f0 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -11,6 +11,37 @@ use crate::canvas::{DocView, PageXform};
 use crate::theme::Tokens;
 use crate::widgets;
 
+/// The colour of the warning under text the standard fonts can't draw.
+const UNDRAWABLE: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
+
+/// The first character of a draft that can't be drawn, as the engine decides it (it refuses
+/// such text, #125): outside the standard fonts and not shaped with the Arabic face.
+pub(crate) fn undrawable(d: &TextDraft, memo: &UndrawableMemo) -> Option<char> {
+    // Checked as `finish` will commit it: without trailing whitespace.
+    let t = AddedText { text: d.text.trim_end().to_string(), rect: d.rect, ..d.style.clone() };
+    if let Some((key, c)) = memo.borrow().as_ref()
+        && *key == t
+    {
+        return *c;
+    }
+    let c = pdfcraft_engine::first_undrawable(&t);
+    *memo.borrow_mut() = Some((t, c));
+    c
+}
+
+/// The last draft [`undrawable`] checked and its answer: the check lays the text out (and shapes
+/// Arabic), too slow to repeat every frame for long text, so it reruns only when the text or
+/// anything that changes its layout does.
+pub(crate) type UndrawableMemo = std::cell::RefCell<Option<(AddedText, Option<char>)>>;
+
+/// The warning shown for text with `c` in it.
+pub(crate) fn undrawable_message(c: char) -> String {
+    crate::i18n::fmt(
+        tl!("The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now."),
+        &[("c", &c.to_string()), ("code", &format!("U+{:04X}", u32::from(c)))],
+    )
+}
+
 const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
 /// The text being typed or retyped in place.
@@ -41,6 +72,24 @@ pub struct ContentView {
     /// Select the item an add creates (the page's item count before it).
     pub select_added: Option<(usize, usize)>,
     grab: Option<(usize, Grab, Pos2)>,
+    undrawable: UndrawableMemo,
+}
+
+impl ContentView {
+    /// The draft's first character the standard fonts can't draw. Such a draft is kept open, and
+    /// counts as unsaved work, until it is corrected or discarded.
+    pub(crate) fn blocked(&self) -> Option<char> {
+        self.draft.as_ref().and_then(|d| undrawable(d, &self.undrawable))
+    }
+
+    /// Keeps a blocked draft open and focused instead of finishing or replacing it.
+    pub(crate) fn hold_blocked(&mut self) -> bool {
+        let blocked = self.blocked().is_some();
+        if let Some(d) = self.draft.as_mut().filter(|_| blocked) {
+            d.focus = true;
+        }
+        blocked
+    }
 }
 
 /// Text style for new text (the panel's Format controls set it).
@@ -151,6 +200,10 @@ pub(crate) fn page_input(
     if adding_text && hit.is_none() {
         ui.ctx().set_cursor_icon(egui::CursorIcon::Text);
         if resp.clicked() {
+            // Text that can't be drawn stays where it is being typed (#125).
+            if cv.hold_blocked() {
+                return true;
+            }
             // A click elsewhere keeps the text being typed and starts a new box (#74). The click
             // can reach the page before the editor sees it lose focus, so finish it here.
             let typed = cv.draft.take().and_then(|d| finish(cv, d, added));
@@ -195,6 +248,9 @@ pub(crate) fn page_input(
         && let Some((i, a)) = hit
         && let AddedContent::Text(t) = &a.content
     {
+        if cv.hold_blocked() {
+            return true;
+        }
         cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true });
         cv.selected = Some((page, i));
         consumed = true;
@@ -277,6 +333,8 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     let zoom = xf.rect.width() / xf.pw.max(1.0);
     let tokens = Tokens::get(ctx);
     let (mut commit, mut cancel, mut done) = (false, false, false);
+    let mut undrawable = None;
+    let memo = &view.content.undrawable;
     egui::Area::new(egui::Id::new(("added-text", view.id.0))).order(egui::Order::Foreground).fixed_pos(r.min).show(ctx, |ui| {
         let Some(t) = view.content.draft.as_mut() else { return };
         let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
@@ -315,12 +373,18 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             cancel |= ui.input(|i| i.key_pressed(egui::Key::Escape));
             commit = done || resp.lost_focus() && !on_buttons;
         });
+        // Page text is drawn with the standard fonts; anything else would be saved as `?` (#125).
+        undrawable = self::undrawable(t, memo);
+        if let Some(c) = undrawable {
+            ui.label(egui::RichText::new(undrawable_message(c)).small().color(UNDRAWABLE));
+        }
     });
     if cancel {
         view.content.draft = None;
         return (None, false);
     }
-    if !commit {
+    // Text that can't be drawn stays in the editor, with the warning, rather than being lost.
+    if !commit || undrawable.is_some() {
         return (None, false);
     }
     let edit = view.content.draft.take().and_then(|d| finish(&mut view.content, d, added));
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index fe1736b1..c2dd20e6 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -267,6 +267,21 @@ impl PdfCraftApp {
     /// brought forward first, so the commit and any field scripts act on that document.
     pub(crate) fn commit_typing_in(&mut self, id: pdfcraft_engine::DocId) -> bool {
         let Some(i) = self.views.iter().position(|v| v.id == id) else { return true };
+        // Added text the standard fonts can't draw can't be saved: show it rather than drop it.
+        // Its page is brought into view, so the text, the warning and Discard are on screen.
+        let blocked = self.views.get_mut(i).and_then(|v| {
+            let c = v.content.blocked()?;
+            v.content.hold_blocked();
+            if let Some(page) = v.content.draft.as_ref().map(|d| d.page) {
+                v.go_to_page(page);
+            }
+            Some(c)
+        });
+        if let Some(c) = blocked {
+            self.active = Some(i);
+            self.notify(crate::content_ui::undrawable_message(c));
+            return false;
+        }
         if self.active != Some(i) {
             let typing = self.views.get(i).is_some_and(|v| v.pending_edit.is_some() || v.forms.focus.is_some());
             if !typing {
@@ -281,7 +296,10 @@ impl PdfCraftApp {
     pub(crate) fn has_unsaved_work(&self, index: usize) -> bool {
         let Some(v) = self.views.get(index) else { return false };
         let Some(doc) = self.session.get(v.id) else { return false };
-        doc.dirty || v.pending_edit.is_some() || v.forms.focus.as_ref().is_some_and(|f| crate::forms_ui::draft_edit(f, &doc.form).is_some())
+        doc.dirty
+            || v.pending_edit.is_some()
+            || v.content.blocked().is_some()
+            || v.forms.focus.as_ref().is_some_and(|f| crate::forms_ui::draft_edit(f, &doc.form).is_some())
     }
 
     /// Save the active document. Returns `true` if it was written.
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 3a916579..fb9f352b 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2048,3 +2048,4 @@ action wizard	Start	Старт
 	Clear Recent Files	Изчисти последно отваряните файлове
 	Remove from Recent	Премахни от последно отваряните
 	Remove {name} from Recent	Премахни {name} от последно отваряните
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартните шрифтове не могат да покажат „{c}“ ({code}). Засега като текст могат да се добавят само западноевропейски символи.
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index b33ae95f..888c6eef 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2086,3 +2086,4 @@ action wizard	Start	Starten
 	Clear Recent Files	Liste „Zuletzt geöffnet“ leeren
 	Remove from Recent	Aus „Zuletzt geöffnet“ entfernen
 	Remove {name} from Recent	{name} aus „Zuletzt geöffnet“ entfernen
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Die Standardschriften können „{c}“ ({code}) nicht darstellen. Derzeit lassen sich nur westeuropäische Zeichen als Text hinzufügen.
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0b3b79a5..b478e910 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2004,3 +2004,4 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Elija una imagen PNG o JPEG (hasta 4 MiB). Se conserva la transparencia.
 	Couldn't import the signature image: {e}	No se pudo importar la imagen de la firma: {e}
 	Go to page…	Ir a la página…
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Las fuentes estándar no pueden mostrar «{c}» ({code}). Por ahora solo se pueden añadir como texto caracteres de Europa occidental.
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 69f9a0bf..c027fbaa 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2039,3 +2039,4 @@
 	Pinned {folder} to Home	{folder} épinglé à l'Accueil
 	No recent files	Aucun fichier récent
 	Go to page…	Aller à la page…
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Les polices standard ne peuvent pas afficher « {c} » ({code}). Pour l'instant, seuls les caractères d'Europe occidentale peuvent être ajoutés comme texte.
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index ba51c4e8..b0989516 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2084,3 +2084,4 @@ action wizard	Start	Indítás
 	H / Space (hold)	H / szóköz (nyomva tartva)
 	Rotation:	Elforgatás:
 	Line ending	Vonalvég
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	A szabványos betűtípusok nem tudják megjeleníteni ezt: „{c}” ({code}). Egyelőre csak nyugat-európai karakterek adhatók hozzá szövegként.
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index c527d8b7..103f4cba 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1980,3 +1980,4 @@
 	Couldn't import the signature image: {e}	署名画像を読み込めませんでした: {e}
 	Go to page…	ページへ移動…
 	Reopen the files that were open when PdfCraft last closed	前回 PdfCraft を閉じたときに開いていたファイルを再度開く
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準フォントでは「{c}」（{code}）を表示できません。現在、テキストとして追加できるのは西ヨーロッパの文字のみです。
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index fc1e1d62..bd29398e 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2000,3 +2000,4 @@
 	Created a PDF from {n} files; left out: {names}	PDF создан из файлов: {n}; пропущены: {names}
 	Created a PDF from the first {n} files	PDF создан из первых файлов: {n}
 	Go to page…	Перейти на страницу…
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартные шрифты не могут отобразить «{c}» ({code}). Пока в виде текста можно добавлять только западноевропейские символы.
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 25fc9bda..623b8a4f 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2106,3 +2106,4 @@ calendar date	December	грудня
 	H / Space (hold)	H / Пробіл (утримувати)
 	Rotation:	Поворот:
 	Line ending	Закінчення лінії
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартні шрифти не можуть відобразити «{c}» ({code}). Поки що як текст можна додавати лише західноєвропейські символи.
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index c3a9d769..90636c35 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2050,3 +2050,4 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	选择 PNG 或 JPEG 图像（最大 4 MiB）。透明度会保留。
 	Couldn't import the signature image: {e}	无法导入签名图像：{e}
 	Go to page…	转到页面…
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	标准字体无法显示“{c}”（{code}）。目前只能添加西欧字符作为文本。
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 824b4e85..b6efd14a 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1973,3 +1973,4 @@
 	Couldn't import the signature image: {e}	無法匯入簽名圖像：{e}
 	Go to page…	轉到頁面…
 	Reopen the files that were open when PdfCraft last closed	重新開啟上次關閉 PdfCraft 時開啟的檔案
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準字型無法顯示「{c}」（{code}）。目前只能新增西歐字元作為文字。
diff --git a/crates/ui-egui/tests/content.rs b/crates/ui-egui/tests/content.rs
index eefec1ce..fb91af5f 100644
--- a/crates/ui-egui/tests/content.rs
+++ b/crates/ui-egui/tests/content.rs
@@ -155,3 +155,59 @@ fn typing_moving_styling_and_deleting_added_content() {
     let pdfcraft_engine::AddedContent::Image(img) = &added(&h)[0].content else { panic!() };
     assert!(img.flip_h);
 }
+
+/// #125: text the standard fonts can't draw stays in the editor with a warning instead of being
+/// written to the page as `?` (or lost).
+#[test]
+fn text_the_standard_fonts_cant_draw_stays_in_the_editor() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(2);
+    let p = at(&h, 40.0, 300.0);
+    click(&mut h, p);
+    h.event(egui::Event::Text("Hello 世界".into()));
+    h.run_steps(2);
+    h.get_by_label_contains("can't draw “世” (U+4E16)");
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        h.render().unwrap().save(format!("{dir}/undrawable-text.png")).unwrap();
+    }
+    h.get_by_label("Done adding text").click();
+    h.run_steps(3);
+    assert!(texts(&h).is_empty(), "nothing was written to the page");
+    let draft = h.state().views[0].content.draft.as_ref().map(|d| d.text.clone());
+    assert_eq!(draft.as_deref(), Some("Hello 世界"), "the typed text is kept");
+    // A click elsewhere on the page doesn't finish it, or replace it with a new box.
+    let elsewhere = at(&h, 40.0, 150.0);
+    click(&mut h, elsewhere);
+    let draft = h.state().views[0].content.draft.as_ref().map(|d| d.text.clone());
+    assert_eq!(draft.as_deref(), Some("Hello 世界"), "clicking elsewhere keeps the typed text");
+    assert!(texts(&h).is_empty());
+    // Once the text can be drawn, Done adds it (Done took the focus, so edit the draft directly).
+    if let Some(d) = h.state_mut().views[0].content.draft.as_mut() {
+        d.text = "Hello world".into();
+    }
+    h.run_steps(2);
+    h.get_by_label("Done adding text").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["Hello world"]);
+}
+
+/// Text kept because it can't be drawn goes with its page when the page is deleted, so nothing
+/// is left blocking Save out of sight.
+#[test]
+fn a_kept_draft_goes_with_its_deleted_page() {
+    let mut h = harness();
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::InsertBlankPage { at: 1, width: 612.0, height: 792.0 }));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.text"));
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(4);
+    let p = h.state().views[0].page_screen_rect(1).expect("page 2 on screen").min + egui::vec2(40.0, 40.0);
+    click(&mut h, p);
+    h.event(egui::Event::Text("日本語".into()));
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| (d.page, d.text.as_str())), Some((1, "日本語")));
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::DeletePages { pages: vec![1] }));
+    h.run_steps(2);
+    assert!(h.state().views[0].content.draft.is_none());
+}

From a5202e11fca53b6b91483675ff9f74d3e353bde4 Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Fri, 9 Oct 2026 20:09:56 +0200
Subject: [PATCH 098/149] M2: normalize JPEG2000 samples without overflowing
 (#575)

* M2: normalize JPEG2000 samples without overflowing

Use bounded integer sample scaling for 1-32-bit JPX images and reject empty dimensions before chunking. Cover public decoding and continued page rendering with synthetic regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* ROADMAP: keep the JPX entry with this session's entries

---------

Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                            |  4 +-
 crates/render/src/raster.rs           | 96 +++++++++++++++++++++++++++
 vendor/README.md                      |  2 +-
 vendor/hayro-syntax/src/filter/jpx.rs | 77 +++++++++++++++++++--
 vendor/hayro-syntax/src/math.rs       | 25 -------
 5 files changed, 171 insertions(+), 33 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 5020e708..089ad198 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -91,7 +91,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M | Milestone | Est. hours | Done | Remaining (h) | Notes |
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 92% | 2–4 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
-| M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input. Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
+| M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
@@ -129,6 +129,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M5, line endings):** Lines, connected lines and callouts draw all ten standard line-ending styles. `comment_add` accepts `endings`, and Comment properties can change them in one undo step. An unknown name is left undrawn, and a non-finite direction is rejected. Cloudy borders remain polygon-only, so `comment.line-endings` stays partial. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
+- **2026-10-09 (M2, JPX sample normalization):** JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
 
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 652ae6ea..d6ef00a3 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1379,6 +1379,102 @@ trailer << /Root 1 0 R >>
         assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255]);
     }
 
+    /// Contributor-original JPEG 2000: one unsigned 8-bit pixel per component, one tile,
+    /// no decomposition, reversible wavelet, and one empty packet per component. Empty
+    /// coefficients decode to the midpoint (128) after the unsigned DC level shift.
+    fn jpx_midpoint_pdf(bpc: u8, components: u16) -> Vec<u8> {
+        let mut codestream = vec![0xff, 0x4f, 0xff, 0x51]; // SOC, SIZ.
+        codestream.extend_from_slice(&(38 + 3 * components).to_be_bytes());
+        codestream.extend_from_slice(&0_u16.to_be_bytes()); // Rsiz.
+        for value in [1_u32, 1, 0, 0, 1, 1, 0, 0] {
+            codestream.extend_from_slice(&value.to_be_bytes());
+        }
+        codestream.extend_from_slice(&components.to_be_bytes());
+        for _ in 0..components {
+            codestream.extend_from_slice(&[7, 1, 1]); // Eight bits, no subsampling.
+        }
+        // COD: LRCP, one layer, no transform between components, 64x64 codeblocks,
+        // zero decomposition levels, reversible wavelet. QCD: no quantization.
+        codestream.extend_from_slice(&[0xff, 0x52, 0, 12, 0, 0, 0, 1, 0, 0, 4, 4, 0, 1]);
+        codestream.extend_from_slice(&[0xff, 0x5c, 0, 4, 0x40, 0x40]);
+        codestream.extend_from_slice(&[0xff, 0x90, 0, 10, 0, 0]); // SOT, tile zero.
+        codestream.extend_from_slice(&(14 + u32::from(components)).to_be_bytes());
+        codestream.extend_from_slice(&[0, 1, 0xff, 0x93]); // One tile part, SOD.
+        codestream.extend(std::iter::repeat_n(0, usize::from(components)));
+        codestream.extend_from_slice(&[0xff, 0xd9]); // EOC.
+
+        let content = "q 20 0 0 20 5 5 cm /Im1 Do Q 1 0 0 rg 0 0 4 4 re f";
+        let mut pdf = format!(
+            "%PDF-1.7\n\
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
+4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent {bpc} /Filter /JPXDecode /Length {} >> stream\n",
+            content.len(),
+            codestream.len()
+        )
+        .into_bytes();
+        pdf.extend_from_slice(&codestream);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
+        pdf
+    }
+
+    #[test]
+    fn jpx_stream_bit_depth_boundaries_do_not_panic() {
+        use hayro::hayro_syntax::bit_reader::BitReader;
+        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+
+        for (bpc, expected) in [(1, 1), (8, 128), (16, 32_896), (31, 1_077_952_576), (32, 2_155_905_152)] {
+            let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(bpc, 1))).unwrap();
+            let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
+            let decoded = stream.decoded_image(&ImageDecodeParams { bpc: Some(bpc), ..Default::default() }).unwrap();
+            let image = decoded.image_data.unwrap();
+            assert_eq!((image.width, image.height, image.bits_per_component), (1, 1, bpc));
+            assert_eq!(decoded.data.len(), usize::from(bpc).div_ceil(8));
+            assert_eq!(BitReader::new(&decoded.data).read(bpc), Some(expected), "{bpc}-bit midpoint");
+        }
+    }
+
+    #[test]
+    fn jpx_streams_reject_out_of_range_bit_depths() {
+        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+
+        for bpc in [0, 33, 255] {
+            let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(bpc, 1))).unwrap();
+            let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
+            assert!(stream.decoded_image(&ImageDecodeParams { bpc: Some(bpc), ..Default::default() }).is_err());
+        }
+    }
+
+    #[test]
+    fn jpx_gray_rgb_and_alpha_keep_eight_bit_samples() {
+        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+
+        for components in [1, 3, 4] {
+            let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(8, components))).unwrap();
+            let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
+            let decoded = stream.decoded_image(&ImageDecodeParams::default()).unwrap();
+            let expected_colors = usize::from(components.min(3));
+            assert_eq!(decoded.data.as_ref(), vec![128; expected_colors]);
+            let alpha = decoded.image_data.unwrap().alpha;
+            assert_eq!(alpha, (components == 4).then(|| vec![128]));
+        }
+    }
+
+    #[test]
+    fn jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering() {
+        for bpc in [8, 32] {
+            let mut renderer = PageRenderer::new(Arc::new(jpx_midpoint_pdf(bpc, 1)), RenderConfig::default());
+            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 });
+            assert!(page.error.is_none(), "{bpc} bits: {:?}", page.error);
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "other page content draws");
+            if bpc == 8 {
+                assert_eq!(&page.rgba[((25 * 40 + 15) * 4)..][..4], &[128, 128, 128, 255], "the valid image paints gray");
+            }
+        }
+    }
+
     /// From the nightly `cargo xtask fuzz` (CI caps each child at 4 GiB): a stencil mask claiming
     /// /W 4294967295 and a CCITT image claiming /Columns 4294967295 each allocated 4 GiB while
     /// decoding (locally: 9.6 GB and 4.3 GB). Vendored hayro patches `image_size_ok` and
diff --git a/vendor/README.md b/vendor/README.md
index 408621f9..64102ddc 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -12,7 +12,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths` |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
diff --git a/vendor/hayro-syntax/src/filter/jpx.rs b/vendor/hayro-syntax/src/filter/jpx.rs
index 4acc343b..6a788591 100644
--- a/vendor/hayro-syntax/src/filter/jpx.rs
+++ b/vendor/hayro-syntax/src/filter/jpx.rs
@@ -1,6 +1,5 @@
-use crate::bit_reader::BitWriter;
+use crate::bit_reader::{BitWriter, bit_mask};
 use crate::filter::FilterResult;
-use crate::math::round_f32;
 use crate::object::stream::{ImageColorSpace, ImageData, ImageDecodeParams};
 use alloc::borrow::Cow;
 use alloc::vec;
@@ -95,12 +94,18 @@ fn scale(
     width: u32,
     height: u32,
 ) -> Option<Vec<u8>> {
-    if bit_per_component == 0 || bit_per_component > 32 {
+    if bit_per_component == 0
+        || bit_per_component > 32
+        || num_components == 0
+        || width == 0
+        || height == 0
+    {
         return None;
     }
 
-    let div_factor = ((1 << 8) - 1) as f32;
-    let mul_factor = ((1_u32 << bit_per_component) - 1) as f32;
+    // PdfCraft patch: normalize all supported bit widths without an overflowing
+    // shift or floating-point endpoint rounding, including no_std builds.
+    let max_sample = u64::from(bit_mask(bit_per_component));
 
     let bits_per_row = (width as usize)
         .checked_mul(num_components as usize)?
@@ -112,7 +117,9 @@ fn scale(
 
     for bytes in data.chunks_exact(components_per_row) {
         for byte in bytes {
-            let scaled = round_f32((*byte as f32 / div_factor) * mul_factor) as u32;
+            // The numerator is at most 255 * u32::MAX + 127, which fits in
+            // u64. The rounded quotient is <= max_sample, so the cast is exact.
+            let scaled = ((u64::from(*byte) * max_sample + 127) / 255) as u32;
             writer.write(scaled)?;
         }
 
@@ -124,3 +131,61 @@ fn scale(
 
     Some(input)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::scale;
+    use crate::bit_reader::{BitReader, bit_mask};
+    use alloc::vec::Vec;
+
+    #[test]
+    fn jpx_scale_accepts_32_bit_samples() {
+        assert_eq!(
+            scale(&[0, 255], 32, 1, 2, 1).unwrap(),
+            [0, 0, 0, 0, 255, 255, 255, 255]
+        );
+    }
+
+    #[test]
+    fn jpx_scale_keeps_supported_bit_depths() {
+        for bpc in 1_u8..=32 {
+            let bytes = scale(&[0, 255], bpc, 1, 2, 1).unwrap();
+            assert_eq!(bytes.len(), (2 * usize::from(bpc)).div_ceil(8));
+            let mut reader = BitReader::new(&bytes);
+            assert_eq!(reader.read(bpc), Some(0));
+            assert_eq!(reader.read(bpc), Some(bit_mask(bpc)));
+        }
+    }
+
+    #[test]
+    fn jpx_scale_rejects_out_of_range_bit_depths() {
+        for bpc in [0, 33, 255] {
+            assert!(scale(&[255], bpc, 1, 1, 1).is_none());
+        }
+    }
+
+    #[test]
+    fn jpx_scale_rejects_zero_dimensions_and_components() {
+        for (components, width, height) in [(0, 1, 1), (1, 0, 1), (1, 1, 0)] {
+            assert!(scale(&[255], 32, components, width, height).is_none());
+        }
+    }
+
+    #[test]
+    fn jpx_scale_preserves_one_eight_and_sixteen_bit_samples() {
+        let samples: Vec<u8> = (0..=255).collect();
+        for bpc in [1, 8, 16] {
+            let bytes = scale(&samples, bpc, 1, 256, 1).unwrap();
+            let mut reader = BitReader::new(&bytes);
+            for byte in &samples {
+                let expected = match bpc {
+                    1 => u32::from(*byte >= 128),
+                    8 => u32::from(*byte),
+                    16 => u32::from(*byte) * 257,
+                    _ => unreachable!(),
+                };
+                assert_eq!(reader.read(bpc), Some(expected), "{bpc}-bit sample {byte}");
+            }
+        }
+    }
+}
diff --git a/vendor/hayro-syntax/src/math.rs b/vendor/hayro-syntax/src/math.rs
index 60bf95e0..12d4724f 100644
--- a/vendor/hayro-syntax/src/math.rs
+++ b/vendor/hayro-syntax/src/math.rs
@@ -1,31 +1,6 @@
 // Note that these polyfills can be very imprecise, but hopefully good enough
 // for the vast majority of cases.
 
-#[cfg(feature = "images")]
-#[inline(always)]
-pub(crate) fn round_f32(x: f32) -> f32 {
-    #[cfg(feature = "std")]
-    {
-        x.round()
-    }
-    #[cfg(not(feature = "std"))]
-    {
-        if x >= 0.0 {
-            floor_f32(x + 0.5)
-        } else {
-            -floor_f32(-x + 0.5)
-        }
-    }
-}
-
-#[cfg(all(feature = "images", not(feature = "std")))]
-#[inline(always)]
-fn floor_f32(x: f32) -> f32 {
-    let xi = x as i32;
-    let xf = xi as f32;
-    if x < xf { xf - 1.0 } else { xf }
-}
-
 #[inline(always)]
 pub(crate) fn trunc_f64(x: f64) -> f64 {
     #[cfg(feature = "std")]

From e88def3465b314cf277eb612a7b630c8849e4c7d Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 11:10:50 -0700
Subject: [PATCH 099/149] Never crash: decompression bombs can't exhaust the
 renderer's memory (#411)

* Never crash: decompression bombs can't exhaust the renderer's memory

The renderer's parser (vendored hayro-syntax) decoded Flate, LZW and
RunLength streams with no output limit. A 2 MB page whose content
stream inflates to 2 GB, or whose 8 x 8 image does, took `pdfcraft-cli
render` and `text` past 3 GB in under a second, and a few more MB of
file scale it further. On the desktop that is the first-page render of
an emailed PDF, and the allocation-failure abort takes every open
document with it. Our own layers already bound single streams (lopdf's
load-time decoding at 256 MiB, cos at 1 GiB), so `info` stays at a few
MB; the renderer path didn't. Random mutation almost never makes a
high-ratio stream, so `cargo xtask fuzz` doesn't find this; found by
hand while triaging the fuzz run.

Vendored hayro-syntax patch (6):
- `decode_limit` gives each filter an output limit, and Flate (both
  flate2 and the fallback inflater), LZW and RunLength never write past
  it (the buffer can still grow to under twice it):
  `MAX_DECODED_STREAM`, 256 MiB, lopdf's figure; or, for the last filter
  of an image whose size, bits per component and components are known,
  twice its pixel bytes (a PNG predictor tag byte per byte at most),
  capped at 1 GiB. Earlier filters in a chain produce compressed data
  and get the general limit.
- `Stream::decoded_within(max)` for callers that budget.
- A page's `/Contents` array shares one `MAX_DECODED_STREAM` (naming one
  bomb twenty times decoded 5 GB), reserving exactly what it appends.

Vendored hayro-interpret patch (18):
- The content a page holds at once (its contents, and the forms, tiling
  patterns and Type 3 glyph procedures being painted) stays within
  `MAX_PAGE_CONTENT`, 512 MiB, reset per page like the existing paint
  budget. Forms nest fifty deep and each level kept its content while
  the next ran: a form painting itself around a 256 MiB stream would
  have held over 12 GB. Each level gives its bytes back when it is
  dropped, so content painted again and again keeps drawing, and a
  stream without filters (borrowed from the file) costs nothing.
- Type 0 sampled functions read every sample into a 4-byte value and
  then a table entry: 256 MiB of 1-bit samples asked for over 8 GB. They
  now take at most 2^21 table points and 2^23 values (the largest real
  tables, DeviceN tint transforms such as 33^4 points x 3 outputs, are
  1.2 million and 3.6 million), counted with checked arithmetic, and
  read no further than `/Size` asks. `/Size 0` no longer underflows
  building the default `/Encode`.

Three rounds of independent review found the aggregate cases, buffer
doubling past the limit, a chain/predictor shape the first image limit
would have truncated, the Type 0 amplifier, and a first, cumulative
budget that would have dropped legitimately repeated content, and a
first Type 0 cap low enough to refuse real tint transforms; all fixed
here.

Measured in a release build (render; OS peak commit):
- content stream inflating to 2 GB: 389 MB, 0.3 s
- 8 x 8 image inflating to 2 GB: 4 MB, 0.2 s
- /Contents naming it twenty times: 516 MB, 0.3 s
- a form painting itself around it: 644 MB, 0.4 s

Synthetic regression tests in render (flate2 is a new dev-dependency
there, already in the workspace):
- `decompression_bombs_stop_at_the_stream_limit`: 288 MiB bombs through
  flate2, the fallback inflater (a stored block with a wrong length
  check, which flate2 refuses and the fallback accepts), LZW and
  RunLength each decode exactly 256 MiB, and at most 128 bytes as an
  8 x 8 image.
- `page_contents_and_nested_forms_share_one_budget`: three /Contents
  references decode one stream's worth; a self-painting form finishes.
- `content_painted_again_and_again_keeps_drawing`: a 2 MiB form painted
  300 times draws the 300th time.
- `sampled_functions_with_billions_of_samples_are_refused`.
Ten mutations each turn them red: no limit at all; no limit in flate2,
the fallback, LZW, RunLength or for images; an unshared /Contents limit;
no page budget; no refund on drop; no Type 0 sample cap. (Taking a form
out of the budget no longer compiles: its content is the budget guard.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M2: normalize JPEG2000 samples without overflowing

Use bounded integer sample scaling for 1-32-bit JPX images and reject empty dimensions before chunking. Cover public decoding and continued page rendering with synthetic regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* Never crash: decompression cut at its limit is logged, not silent; vendor README renumbered after #575

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                                   |   1 +
 crates/render/Cargo.toml                     |   2 +
 crates/render/src/raster.rs                  | 222 +++++++++++++++++++
 vendor/README.md                             |   4 +-
 vendor/hayro-interpret/src/context.rs        |  57 ++++-
 vendor/hayro-interpret/src/font/type3.rs     |   3 +-
 vendor/hayro-interpret/src/function/type0.rs |  37 +++-
 vendor/hayro-interpret/src/interpret/mod.rs  |   2 +
 vendor/hayro-interpret/src/pattern.rs        |   3 +-
 vendor/hayro-interpret/src/x_object.rs       |   6 +-
 vendor/hayro-syntax/src/filter/lzw_flate.rs  |  99 ++++++---
 vendor/hayro-syntax/src/filter/mod.rs        |  39 +++-
 vendor/hayro-syntax/src/filter/run_length.rs |  21 +-
 vendor/hayro-syntax/src/object/stream.rs     |  25 ++-
 vendor/hayro-syntax/src/page.rs              |  23 +-
 15 files changed, 487 insertions(+), 57 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b174b4ae..f33ac705 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3750,6 +3750,7 @@ name = "pdfcraft-render"
 version = "0.4.0"
 dependencies = [
  "bytemuck",
+ "flate2",
  "getrandom 0.4.3",
  "hayro",
  "hayro-syntax",
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index 0c63377a..9a270747 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -26,3 +26,5 @@ getrandom = { version = "0.4", features = ["wasm_js"] }
 [dev-dependencies]
 # Checks the Japanese substitute's character coverage; the version pdfcraft-fonts already uses.
 skrifa = "0.44"
+# Builds the decompression-bomb streams in the raster tests.
+flate2 = { workspace = true }
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index d6ef00a3..9ab0aaab 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1831,6 +1831,228 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// Zlib data that inflates to `len` zero bytes.
+    fn zlib_zeros(len: usize) -> Vec<u8> {
+        use std::io::Write;
+        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+        let chunk = vec![0u8; 1 << 20];
+        let mut left = len;
+        while left > 0 {
+            let n = left.min(chunk.len());
+            z.write_all(&chunk[..n]).unwrap();
+            left -= n;
+        }
+        z.finish().unwrap()
+    }
+
+    /// A raw deflate stream that flate2 rejects at once and the fallback inflater expands to at
+    /// least `len` zero bytes: a one-byte stored block whose length check is wrong (flate2 refuses
+    /// it, the fallback carries on), then a fixed-Huffman block of 258-byte copies.
+    fn deflate_for_the_fallback(len: usize) -> Vec<u8> {
+        let mut out = vec![0b000]; // not final, stored; the rest of the byte is padding
+        out.extend_from_slice(&[1, 0, 0, 0, 0]); // LEN 1, NLEN 0 (should be !1), the byte 0
+        let (mut acc, mut bits) = (0u64, 0u32);
+        // Deflate packs bits from the least significant end; Huffman codes go most significant
+        // bit first.
+        let mut put = |value: u32, n: u32, huffman: bool| {
+            for i in 0..n {
+                let bit = if huffman { (value >> (n - 1 - i)) & 1 } else { (value >> i) & 1 };
+                acc |= u64::from(bit) << bits;
+                bits += 1;
+                if bits == 8 {
+                    out.push(acc as u8);
+                    (acc, bits) = (0, 0);
+                }
+            }
+        };
+        put(1, 1, false); // final block
+        put(1, 2, false); // fixed Huffman codes
+        for _ in 0..len / 258 + 1 {
+            put(0b1100_0101, 8, true); // length code 285: 258 bytes
+            put(0, 5, true); // distance code 0: 1 byte back
+        }
+        put(0, 7, true); // end of block
+        put(0, 7, false); // flush
+        out
+    }
+
+    /// LZW codes (MSB first, early change) for `fills` table fills of zero runs: after a clear,
+    /// code 0, then every code is the one being defined (the previous entry plus a zero), so
+    /// entry n holds n - 256 zeros. One fill is about 7 MB of output from 5 KB of codes.
+    fn lzw_zeros(fills: usize) -> Vec<u8> {
+        let width = |size: usize| match size + 1 {
+            2048.. => 12,
+            1024.. => 11,
+            512.. => 10,
+            _ => 9,
+        };
+        let (mut out, mut acc, mut bits) = (Vec::new(), 0u64, 0u32);
+        let mut emit = |code: usize, w: u32| {
+            acc = (acc << w) | code as u64;
+            bits += w;
+            while bits >= 8 {
+                bits -= 8;
+                out.push((acc >> bits) as u8);
+            }
+        };
+        let mut size = 258;
+        for _ in 0..fills {
+            emit(256, width(size)); // clear
+            size = 258;
+            emit(0, width(size));
+            for code in 258..4096 {
+                emit(code, width(size));
+                size = code + 1;
+            }
+        }
+        emit(257, width(size)); // end of data
+        emit(0, 7); // flush the last partial byte
+        out
+    }
+
+    /// Found while triaging `cargo xtask fuzz` on Windows, by hand rather than by the fuzzer
+    /// (random mutations almost never make a high-ratio stream): a 2 MB page whose content
+    /// stream, or whose 8 × 8 image, inflated to 2 GB took the renderer past 3 GB in under a
+    /// second. Flate (through flate2 and through the fallback inflater), LZW and RunLength expand
+    /// without limit. Vendored hayro-syntax patch: each stops at `MAX_DECODED_STREAM`, and an image
+    /// of known size at its own rows.
+    #[test]
+    fn decompression_bombs_stop_at_the_stream_limit() {
+        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+        use hayro::hayro_syntax::object::{Object, Stream};
+        let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
+        let big = limit + (32 << 20);
+        let mut run_length = [0x81u8, 0].repeat(big / 128 + 1); // runs of 128 zeros
+        run_length.push(128);
+        let streams: [(&str, Vec<u8>); 4] = [
+            ("/FlateDecode", zlib_zeros(big)),
+            ("/FlateDecode", deflate_for_the_fallback(big)),
+            ("/LZWDecode", lzw_zeros(big / 7_000_000 + 1)),
+            ("/RunLengthDecode", run_length),
+        ];
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] >> endobj\n".to_vec();
+        for (i, (filter, data)) in streams.iter().enumerate() {
+            pdf.extend_from_slice(format!("{} 0 obj << /Filter {filter} /Length {} >> stream\n", i + 4, data.len()).as_bytes());
+            pdf.extend_from_slice(data);
+            pdf.extend_from_slice(b"\nendstream endobj\n");
+        }
+        pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+        let doc = Pdf::new(pdf).expect("parses");
+        let found: Vec<Stream<'_>> = doc.objects().into_iter().filter_map(|o| if let Object::Stream(s) = o { Some(s) } else { None }).collect();
+        assert_eq!(found.len(), 4, "all four bomb streams are found");
+        for stream in &found {
+            let what = format!("{:?}", stream.filters());
+            let decoded = stream.decoded().expect("a bomb still decodes, up to the limit");
+            assert_eq!(decoded.len(), limit, "{what}: stops at MAX_DECODED_STREAM, not at {big} bytes");
+            // An 8 × 8 one-byte grey image has 64 pixel bytes, plus at most a predictor tag byte
+            // for each.
+            let params = ImageDecodeParams { bpc: Some(8), num_components: Some(1), width: 8, height: 8, ..ImageDecodeParams::default() };
+            let image = stream.decoded_image(&params).expect("decodes as an image");
+            assert!(image.data.len() <= 128, "{what}: an 8 × 8 image decodes at most 128 bytes, not {}", image.data.len());
+        }
+    }
+
+    /// Review of the decompression-bomb fix: one stream stopping at `MAX_DECODED_STREAM` isn't
+    /// enough when streams add up. A page's `/Contents` array can name the same bomb many times,
+    /// and a form that paints itself nests fifty deep, each level keeping its content while the
+    /// next runs. Vendored patches: a `/Contents` array shares one `MAX_DECODED_STREAM`
+    /// (hayro-syntax), and page contents, forms, tiling patterns and Type 3 glyphs share a
+    /// per-page budget (hayro-interpret `MAX_PAGE_CONTENT`).
+    #[test]
+    fn page_contents_and_nested_forms_share_one_budget() {
+        let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
+        let bomb = zlib_zeros(limit + (32 << 20));
+        // Three references to one bomb in /Contents decode no more than one stream's worth.
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [4 0 R 4 0 R 4 0 R] >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", bomb.len()).as_bytes());
+        pdf.extend_from_slice(&bomb);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let doc = Pdf::new(pdf).expect("parses");
+        let page = doc.pages().first().expect("one page");
+        let contents = page.page_stream().map_or(0, <[u8]>::len);
+        assert!(contents <= limit + 3, "the /Contents array decodes {contents} bytes, over one stream's {limit}");
+
+        // A form that paints itself before 256 MiB of spaces: every level would keep its content.
+        let mut content = b"/Fm0 Do ".to_vec();
+        content.resize(limit, b' ');
+        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+        std::io::Write::write_all(&mut z, &content).unwrap();
+        let form = z.finish().unwrap();
+        drop(content);
+        let page_content = b"/Fm0 Do 1 0 0 rg 0 0 4 4 re f";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Fm0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", page_content.len()).as_bytes());
+        pdf.extend_from_slice(page_content);
+        pdf.extend_from_slice(b"\nendstream endobj\n");
+        pdf.extend_from_slice(
+            format!("5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Resources << /XObject << /Fm0 5 0 R >> >> /Filter /FlateDecode /Length {} >> stream\n", form.len()).as_bytes(),
+        );
+        pdf.extend_from_slice(&form);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a self-painting form must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+    }
+
+    /// The page content budget counts what is held at once, not everything decoded: a form
+    /// with 2 MiB of content painted three hundred times (600 MiB in all) draws every time.
+    #[test]
+    fn content_painted_again_and_again_keeps_drawing() {
+        let mut content = b"1 0 0 rg 0 0 4 4 re f ".to_vec();
+        content.resize(2 << 20, b' ');
+        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+        std::io::Write::write_all(&mut z, &content).unwrap();
+        let form = z.finish().unwrap();
+        let mut page_content = "/Fm0 Do ".repeat(299);
+        page_content.push_str("q 1 0 0 1 30 30 cm /Fm0 Do Q");
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Fm0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n", page_content.len()).as_bytes());
+        pdf.extend_from_slice(
+            format!("5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Filter /FlateDecode /Length {} >> stream\n", form.len()).as_bytes(),
+        );
+        pdf.extend_from_slice(&form);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        // The last paint is at user (30, 30)–(34, 34): device row 40 - 32 = 8.
+        assert_eq!(&page.rgba[((8 * 40 + 32) * 4)..][..4], &[255, 0, 0, 255], "the 300th paint is drawn");
+    }
+
+    /// Review of the decompression-bomb fix: a Type 0 sampled function read every sample of its
+    /// stream into a 4-byte value, then a table entry each, so 256 MiB of 1-bit samples asked for
+    /// over 8 GB. Vendored hayro-interpret patch: at most `MAX_SAMPLE_VALUES` samples, read no
+    /// further than `/Size` asks.
+    #[test]
+    fn sampled_functions_with_billions_of_samples_are_refused() {
+        let bomb = zlib_zeros(hayro::hayro_syntax::MAX_DECODED_STREAM + (32 << 20));
+        let page_content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", page_content.len()).as_bytes());
+        pdf.extend_from_slice(page_content);
+        pdf.extend_from_slice(
+            b"\nendstream endobj\n5 0 obj << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Function 6 0 R >> endobj\n",
+        );
+        pdf.extend_from_slice(
+            format!("6 0 obj << /FunctionType 0 /Domain [0 1] /Range [0 1] /Size [1073741824] /BitsPerSample 1 /Filter /FlateDecode /Length {} >> stream\n", bomb.len()).as_bytes(),
+        );
+        pdf.extend_from_slice(&bomb);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a sampled-function bomb must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+    }
+
     /// From the nightly `cargo xtask fuzz`: an embedded Type 1 font program holding a long run of
     /// integers. read-fonts 0.39 (through skrifa 0.42) looked ahead after every integer by
     /// parsing the next token, which looked ahead again, recursing through the whole run: a long
diff --git a/vendor/README.md b/vendor/README.md
index 64102ddc..e719d4da 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -7,12 +7,12 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused` |
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB) | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget` |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
diff --git a/vendor/hayro-interpret/src/context.rs b/vendor/hayro-interpret/src/context.rs
index c5cea5cf..b21dc5f8 100644
--- a/vendor/hayro-interpret/src/context.rs
+++ b/vendor/hayro-interpret/src/context.rs
@@ -9,9 +9,11 @@ use crate::{ClipPath, Device, FillRule, InterpreterSettings, StrokeProps};
 use hayro_syntax::content::ops::Transform;
 use hayro_syntax::object::Dict;
 use hayro_syntax::object::Name;
+use hayro_syntax::object::Stream;
 use hayro_syntax::page::Resources;
 use hayro_syntax::xref::XRef;
 use kurbo::{Affine, BezPath, PathEl, Point, Rect, Shape};
+use std::borrow::Cow;
 use std::cell::RefCell;
 use std::collections::HashMap;
 use std::rc::Rc;
@@ -31,6 +33,58 @@ pub(crate) const MAX_NESTED_PAINTS: u32 = 50_000;
 
 std::thread_local! {
     static NESTED_PAINTS: core::cell::Cell<u32> = const { core::cell::Cell::new(0) };
+    static CONTENT_LEFT: core::cell::Cell<usize> = const { core::cell::Cell::new(MAX_PAGE_CONTENT) };
+}
+
+/// PdfCraft patch: decoded content-stream bytes one page may hold at once: its contents, and
+/// the forms, tiling patterns and Type 3 glyph procedures being painted. Each stream already
+/// stops at `MAX_DECODED_STREAM`, but forms nest fifty deep and every level keeps its content
+/// while the next one runs: a form painting itself around a stream that inflates to 256 MiB
+/// would have held over 12 GB. A level gives its bytes back when it finishes, so content
+/// painted again and again doesn't use the budget up. Ordinary pages hold a few megabytes.
+pub(crate) const MAX_PAGE_CONTENT: usize = 512 << 20;
+
+/// PdfCraft patch: a content stream decoded within the page's [`MAX_PAGE_CONTENT`]. The bytes
+/// it decoded count against the budget until it is dropped; a stream without filters is
+/// borrowed from the file and costs nothing.
+pub(crate) struct DecodedContent<'a> {
+    data: Cow<'a, [u8]>,
+    held: usize,
+}
+
+impl AsRef<[u8]> for DecodedContent<'_> {
+    fn as_ref(&self) -> &[u8] {
+        &self.data
+    }
+}
+
+impl Drop for DecodedContent<'_> {
+    fn drop(&mut self) {
+        let held = self.held;
+        CONTENT_LEFT.with(|c| c.set(c.get().saturating_add(held).min(MAX_PAGE_CONTENT)));
+    }
+}
+
+/// PdfCraft patch: decode a content stream within what is left of this page's
+/// [`MAX_PAGE_CONTENT`]. `None` once the budget is spent (the content is skipped).
+pub(crate) fn decode_content<'a>(stream: &Stream<'a>) -> Option<DecodedContent<'a>> {
+    let left = CONTENT_LEFT.with(core::cell::Cell::get);
+    if left == 0 {
+        warn!("page content budget exceeded");
+        return None;
+    }
+    let data = stream.decoded_within(left).ok()?;
+    let held = match &data {
+        Cow::Owned(v) => v.len(),
+        Cow::Borrowed(_) => 0,
+    };
+    charge_content(held);
+    Some(DecodedContent { data, held })
+}
+
+/// PdfCraft patch: count `len` bytes held for the rest of the page (its own contents).
+pub(crate) fn charge_content(len: usize) {
+    CONTENT_LEFT.with(|c| c.set(c.get().saturating_sub(len)));
 }
 
 /// PdfCraft patch: count a paint at `depth` (top-level ones are free); `false` once this
@@ -101,8 +155,9 @@ impl<'a> Context<'a> {
         settings: InterpreterSettings,
     ) -> Self {
         let state = State::new(initial_transform);
-        // PdfCraft patch: a page (or other top-level content) starts with a fresh budget.
+        // PdfCraft patch: a page (or other top-level content) starts with fresh budgets.
         NESTED_PAINTS.with(|n| n.set(0));
+        CONTENT_LEFT.with(|c| c.set(MAX_PAGE_CONTENT));
 
         Self::new_with(initial_transform, bbox, cache, xref, settings, state, 0)
     }
diff --git a/vendor/hayro-interpret/src/font/type3.rs b/vendor/hayro-interpret/src/font/type3.rs
index 4816f6a7..ccfeeb76 100644
--- a/vendor/hayro-interpret/src/font/type3.rs
+++ b/vendor/hayro-interpret/src/font/type3.rs
@@ -141,7 +141,8 @@ impl<'a> Type3<'a> {
 
         let name = self.glyph_simulator.glyph_to_string(glyph.glyph_id)?;
         let program = self.char_procs.get(&name)?;
-        let decoded = program.decoded().ok()?;
+        // PdfCraft patch: see `context::MAX_PAGE_CONTENT`.
+        let decoded = crate::context::decode_content(program)?;
         let iter = TypedIter::new(decoded.as_ref());
 
         let is_shape_glyph = {
diff --git a/vendor/hayro-interpret/src/function/type0.rs b/vendor/hayro-interpret/src/function/type0.rs
index 8b44ba6e..02bbc41b 100644
--- a/vendor/hayro-interpret/src/function/type0.rs
+++ b/vendor/hayro-interpret/src/function/type0.rs
@@ -44,9 +44,25 @@ impl Type0 {
             .iter::<u32>()
             .collect::<IntVec>();
 
-        let encode = dict
-            .get::<TupleVec>(ENCODE)
-            .unwrap_or(sizes.iter().map(|s| (0.0, (*s - 1) as f32)).collect());
+        let encode = dict.get::<TupleVec>(ENCODE).unwrap_or(
+            sizes
+                .iter()
+                .map(|s| (0.0, s.saturating_sub(1) as f32))
+                .collect(),
+        );
+
+        // PdfCraft patch: see `MAX_SAMPLE_VALUES`.
+        let Some(num_expected_entries) = sizes
+            .iter()
+            .try_fold(1usize, |n, s| n.checked_mul(*s as usize))
+            .filter(|entries| *entries <= MAX_SAMPLE_ENTRIES)
+            .and_then(|entries| entries.checked_mul(range.len()))
+            .filter(|n| *n <= MAX_SAMPLE_VALUES)
+        else {
+            warn!("Type0 function has too many samples");
+
+            return None;
+        };
 
         let decode = dict.get::<TupleVec>(DECODE).unwrap_or(range.clone());
 
@@ -55,15 +71,15 @@ impl Type0 {
             let mut buf = vec![];
             let mut reader = BitReader::new(&decoded);
 
-            while let Some(data) = reader.read(bits_per_sample) {
+            while buf.len() < num_expected_entries
+                && let Some(data) = reader.read(bits_per_sample)
+            {
                 buf.push(data);
             }
 
             buf
         };
 
-        let num_expected_entries = sizes.iter().fold(1, |i1, i2| i1 * *i2 as usize) * range.len();
-
         if data.len() != num_expected_entries {
             warn!("Type0 function didn't have the expected number of sample entries.");
             data.truncate(num_expected_entries);
@@ -233,6 +249,15 @@ impl Interpolator {
     }
 }
 
+/// PdfCraft patch: the most sample values a sampled function may have, and the most table
+/// entries (one per point of its `/Size` grid). The samples were read into 4-byte values and
+/// then into a table entry each, so a stream inflating to 256 MiB of 1-bit samples asked for
+/// 8 GB; `/Size` sets how many the table expects. The largest real tables are DeviceN tint
+/// transforms: 33 × 33 × 33 × 33 points with 3 outputs is 1.2 million entries and 3.6 million
+/// values, 17^5 points with 4 outputs 5.7 million values.
+const MAX_SAMPLE_VALUES: usize = 1 << 23;
+const MAX_SAMPLE_ENTRIES: usize = 1 << 21;
+
 fn build_table(data: &[u32], sizes: &[u32], n: usize) -> Option<HashMap<Key, IntVec>> {
     let mut key = Key::new(sizes);
     let mut table = HashMap::new();
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index e77ff75e..44850a3b 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -157,6 +157,8 @@ pub fn interpret_page<'a>(
     device: &mut impl Device<'a>,
 ) {
     let resources = page.resources();
+    // PdfCraft patch: the page's own contents count against its content budget too.
+    crate::context::charge_content(page.page_stream().map_or(0, <[u8]>::len));
     interpret(page.typed_operations(), resources, context, device);
 
     if context.settings.render_annotations
diff --git a/vendor/hayro-interpret/src/pattern.rs b/vendor/hayro-interpret/src/pattern.rs
index 145b143d..9295f517 100644
--- a/vendor/hayro-interpret/src/pattern.rs
+++ b/vendor/hayro-interpret/src/pattern.rs
@@ -248,7 +248,8 @@ impl<'a> TilingPattern<'a> {
             self.nesting_depth,
         );
 
-        let decoded = self.stream.decoded().ok()?;
+        // PdfCraft patch: see `context::MAX_PAGE_CONTENT`.
+        let decoded = crate::context::decode_content(&self.stream)?;
         let resources = Resources::from_parent(
             self.stream.dict().get(RESOURCES).unwrap_or_default(),
             self.parent_resources.clone(),
diff --git a/vendor/hayro-interpret/src/x_object.rs b/vendor/hayro-interpret/src/x_object.rs
index 954a0d05..86b6fa13 100644
--- a/vendor/hayro-interpret/src/x_object.rs
+++ b/vendor/hayro-interpret/src/x_object.rs
@@ -53,7 +53,8 @@ impl<'a> XObject<'a> {
 }
 
 pub(crate) struct FormXObject<'a> {
-    pub(crate) decoded: Cow<'a, [u8]>,
+    // PdfCraft patch: counted against the page's content budget while the form is alive.
+    pub(crate) decoded: crate::context::DecodedContent<'a>,
     pub(crate) matrix: Affine,
     pub(crate) bbox: [f32; 4],
     is_transparency_group: bool,
@@ -65,7 +66,8 @@ impl<'a> FormXObject<'a> {
     pub(crate) fn new(stream: &Stream<'a>) -> Option<Self> {
         let dict = stream.dict();
 
-        let decoded = stream.decoded().ok()?;
+        // PdfCraft patch: see `context::MAX_PAGE_CONTENT`.
+        let decoded = crate::context::decode_content(stream)?;
         let resources = dict.get::<Dict<'_>>(RESOURCES).unwrap_or_default();
 
         let matrix = Affine::new(
diff --git a/vendor/hayro-syntax/src/filter/lzw_flate.rs b/vendor/hayro-syntax/src/filter/lzw_flate.rs
index 296890b7..c82bc033 100644
--- a/vendor/hayro-syntax/src/filter/lzw_flate.rs
+++ b/vendor/hayro-syntax/src/filter/lzw_flate.rs
@@ -9,37 +9,51 @@ pub(crate) mod flate {
     use crate::filter::lzw_flate::{PredictorParams, apply_predictor};
     use crate::object::Dict;
 
+    /// PdfCraft patch: `limit` is the most bytes inflated (see `filter::decode_limit`).
     #[cfg(feature = "unsafe")]
-    pub(crate) fn decode(data: &[u8], params: &Dict<'_>) -> Option<Vec<u8>> {
+    pub(crate) fn decode(data: &[u8], params: &Dict<'_>, limit: usize) -> Option<Vec<u8>> {
         use flate2::read::{DeflateDecoder, ZlibDecoder};
         use std::io::Read;
 
-        fn zlib_stream(data: &[u8]) -> Option<Vec<u8>> {
-            let mut decoder = ZlibDecoder::new(data);
+        // Read in chunks and never past `limit`, so the buffer doesn't grow past it either.
+        fn read_up_to(mut decoder: impl Read, limit: usize) -> Option<Vec<u8>> {
             let mut result = Vec::new();
-            decoder.read_to_end(&mut result).ok().map(|_| result)
-        }
-
-        fn deflate_stream(data: &[u8]) -> Option<Vec<u8>> {
-            let mut decoder = DeflateDecoder::new(data);
-            let mut result = Vec::new();
-            decoder.read_to_end(&mut result).ok().map(|_| result)
+            let mut chunk = vec![0; 64 * 1024];
+            while result.len() < limit {
+                let n = decoder.read(&mut chunk).ok()?;
+                if n == 0 {
+                    break;
+                }
+                let take = n.min(limit - result.len());
+                result.extend_from_slice(chunk.get(..take)?);
+            }
+            Some(result)
         }
+        let zlib_stream = |data: &[u8]| read_up_to(ZlibDecoder::new(data), limit);
+        let deflate_stream = |data: &[u8]| read_up_to(DeflateDecoder::new(data), limit);
 
         let decoded = zlib_stream(data)
             .or_else(|| deflate_stream(data))
             .or_else(|| {
                 warn!("flate stream is broken, decoding with fallback");
 
-                fallback::decode(data)
+                fallback::decode(data, limit)
             })?;
+        // PdfCraft patch: output cut at the limit is reported, never dropped silently.
+        if decoded.len() >= limit {
+            warn!("flate stream stopped at its decode limit of {limit} bytes");
+        }
         let params = PredictorParams::from_params(params);
         apply_predictor(decoded, &params)
     }
 
     #[cfg(not(feature = "unsafe"))]
-    pub(crate) fn decode(data: &[u8], params: &Dict<'_>) -> Option<Vec<u8>> {
-        let decoded = fallback::decode(data)?;
+    pub(crate) fn decode(data: &[u8], params: &Dict<'_>, limit: usize) -> Option<Vec<u8>> {
+        let decoded = fallback::decode(data, limit)?;
+        // PdfCraft patch: output cut at the limit is reported, never dropped silently.
+        if decoded.len() >= limit {
+            warn!("flate stream stopped at its decode limit of {limit} bytes");
+        }
         let params = PredictorParams::from_params(params);
         apply_predictor(decoded, &params)
     }
@@ -50,11 +64,11 @@ pub(crate) mod flate {
         use alloc::vec;
         use alloc::vec::Vec;
 
-        pub(crate) fn decode(data: &[u8]) -> Option<Vec<u8>> {
-            flate_decode(data)
+        pub(crate) fn decode(data: &[u8], limit: usize) -> Option<Vec<u8>> {
+            flate_decode(data, limit)
         }
 
-        fn flate_decode(data: &[u8]) -> Option<Vec<u8>> {
+        fn flate_decode(data: &[u8], limit: usize) -> Option<Vec<u8>> {
             if data.len() >= 2 {
                 let cmf = data[0];
                 let flg = data[1];
@@ -63,12 +77,12 @@ pub(crate) mod flate {
                     && ((cmf as u16) << 8 | flg as u16).is_multiple_of(31)
                     && (flg & 0x20) == 0
                 {
-                    let mut stream = FlateStream::new(&data[2..]);
+                    let mut stream = FlateStream::new(&data[2..], limit);
                     return stream.decode();
                 }
             }
 
-            let mut stream = FlateStream::new(data);
+            let mut stream = FlateStream::new(data, limit);
             stream.decode()
         }
 
@@ -79,10 +93,12 @@ pub(crate) mod flate {
             code_size: u8,
             output: Vec<u8>,
             eof: bool,
+            /// PdfCraft patch: the most bytes inflated (see `filter::decode_limit`).
+            limit: usize,
         }
 
         impl<'a> FlateStream<'a> {
-            fn new(data: &'a [u8]) -> Self {
+            fn new(data: &'a [u8], limit: usize) -> Self {
                 FlateStream {
                     data,
                     pos: 0,
@@ -90,11 +106,12 @@ pub(crate) mod flate {
                     code_size: 0,
                     output: Vec::new(),
                     eof: false,
+                    limit,
                 }
             }
 
             fn decode(&mut self) -> Option<Vec<u8>> {
-                while !self.eof && self.pos < self.data.len() {
+                while !self.eof && self.pos < self.data.len() && self.output.len() < self.limit {
                     self.read_block();
                 }
 
@@ -252,7 +269,10 @@ pub(crate) mod flate {
                     }
                 } else {
                     let block = self.get_bytes(block_len as usize);
-                    self.output.extend_from_slice(&block);
+                    // PdfCraft patch: never past `limit`.
+                    let left = self.limit.saturating_sub(self.output.len());
+                    self.output
+                        .extend_from_slice(block.get(..block.len().min(left)).unwrap_or(&[]));
                     if block.len() < block_len as usize {
                         self.eof = true;
                     }
@@ -273,6 +293,10 @@ pub(crate) mod flate {
                 };
 
                 loop {
+                    // PdfCraft patch: one code adds at most 258 bytes; stop at the limit.
+                    if self.output.len() >= self.limit {
+                        return;
+                    }
                     let code1 = match self.get_code(&lit_code_table) {
                         Some(c) => c,
                         None => {
@@ -333,6 +357,10 @@ pub(crate) mod flate {
                         // Copy from previous output
                         let start = self.output.len().wrapping_sub(distance);
                         for _ in 0..length {
+                            // PdfCraft patch: never past `limit`.
+                            if self.output.len() >= self.limit {
+                                return;
+                            }
                             if start < self.output.len() {
                                 let byte = self.output[self.output.len() - distance];
                                 self.output.push(byte);
@@ -568,11 +596,17 @@ pub(crate) mod lzw {
     use alloc::vec;
     use alloc::vec::Vec;
 
-    /// Decode a LZW-encoded stream.
-    pub(crate) fn decode(data: &[u8], params: &Dict<'_>) -> Option<Vec<u8>> {
+    /// Decode a LZW-encoded stream. PdfCraft patch: `limit` is the most bytes produced (see
+    /// `filter::decode_limit`); with a full table every 12-bit code can repeat an entry of
+    /// thousands of bytes.
+    pub(crate) fn decode(data: &[u8], params: &Dict<'_>, limit: usize) -> Option<Vec<u8>> {
         let params = PredictorParams::from_params(params);
 
-        let decoded = decode_impl(data, params.early_change)?;
+        let decoded = decode_impl(data, params.early_change, limit)?;
+        // PdfCraft patch: output cut at the limit is reported, never dropped silently.
+        if decoded.len() >= limit {
+            warn!("LZW stream stopped at its decode limit of {limit} bytes");
+        }
 
         apply_predictor(decoded, &params)
     }
@@ -582,7 +616,7 @@ pub(crate) mod lzw {
     const MAX_ENTRIES: usize = 4096;
     const INITIAL_SIZE: u16 = 258;
 
-    fn decode_impl(data: &[u8], early_change: bool) -> Option<Vec<u8>> {
+    fn decode_impl(data: &[u8], early_change: bool, limit: usize) -> Option<Vec<u8>> {
         let mut table = Table::new(early_change);
         let mut bit_size = table.code_length();
         let mut reader = BitReader::new(data);
@@ -590,6 +624,9 @@ pub(crate) mod lzw {
         let mut prev = None;
 
         loop {
+            if decoded.len() >= limit {
+                return Some(decoded);
+            }
             let next = match reader.read(bit_size) {
                 Some(code) => code as usize,
                 None => {
@@ -611,10 +648,12 @@ pub(crate) mod lzw {
                         return None;
                     }
 
+                    // PdfCraft patch: never past `limit`.
+                    let left = limit.saturating_sub(decoded.len());
                     if new < table.size() {
                         let entry = table.get(new)?;
                         let first_byte = entry[0];
-                        decoded.extend_from_slice(entry);
+                        decoded.extend_from_slice(entry.get(..entry.len().min(left))?);
 
                         if let Some(prev_code) = prev {
                             table.register(prev_code, first_byte);
@@ -625,7 +664,7 @@ pub(crate) mod lzw {
                         let first_byte = prev_entry[0];
 
                         let new_entry = table.register(prev_code, first_byte)?;
-                        decoded.extend_from_slice(new_entry);
+                        decoded.extend_from_slice(new_entry.get(..new_entry.len().min(left))?);
                     } else {
                         warn!("LZW decode error: code {new} not found and prev is None");
                         return None;
@@ -973,7 +1012,7 @@ mod tests {
     #[test]
     fn decode_lzw() {
         let input = [0x80, 0x0B, 0x60, 0x50, 0x22, 0x0C, 0x0C, 0x85, 0x01];
-        let decoded = lzw::decode(&input, &Dict::default()).unwrap();
+        let decoded = lzw::decode(&input, &Dict::default(), usize::MAX).unwrap();
 
         assert_eq!(decoded, vec![45, 45, 45, 45, 45, 65, 45, 45, 45, 66]);
     }
@@ -984,7 +1023,7 @@ mod tests {
             0x78, 0x9c, 0xf3, 0x48, 0xcd, 0xc9, 0xc9, 0x7, 0x0, 0x5, 0x8c, 0x1, 0xf5,
         ];
 
-        let decoded = flate::decode(&input, &Dict::default()).unwrap();
+        let decoded = flate::decode(&input, &Dict::default(), usize::MAX).unwrap();
         assert_eq!(decoded, b"Hello");
     }
 
@@ -992,7 +1031,7 @@ mod tests {
     fn decode_flate() {
         let input = [0xf3, 0x48, 0xcd, 0xc9, 0xc9, 0x7, 0x0];
 
-        let decoded = flate::decode(&input, &Dict::default()).unwrap();
+        let decoded = flate::decode(&input, &Dict::default(), usize::MAX).unwrap();
         assert_eq!(decoded, b"Hello");
     }
     
diff --git a/vendor/hayro-syntax/src/filter/mod.rs b/vendor/hayro-syntax/src/filter/mod.rs
index f7356a39..e5353f35 100644
--- a/vendor/hayro-syntax/src/filter/mod.rs
+++ b/vendor/hayro-syntax/src/filter/mod.rs
@@ -80,11 +80,13 @@ impl Filter {
         }
     }
 
+    /// PdfCraft patch: `limit` is the most bytes the filter may produce (see `decode_limit`).
     pub(crate) fn apply(
         &self,
         data: &[u8],
         params: &Dict<'_>,
         #[cfg_attr(not(feature = "images"), allow(unused))] image_params: &ImageDecodeParams,
+        limit: usize,
     ) -> Result<FilterResult<'static>, DecodeFailure> {
         let res = match self {
             Self::AsciiHexDecode => ascii_hex::decode(data)
@@ -93,13 +95,13 @@ impl Filter {
             Self::Ascii85Decode => ascii_85::decode(data)
                 .map(FilterResult::from_data)
                 .ok_or(DecodeFailure::StreamDecode),
-            Self::RunLengthDecode => run_length::decode(data)
+            Self::RunLengthDecode => run_length::decode(data, limit)
                 .map(FilterResult::from_data)
                 .ok_or(DecodeFailure::StreamDecode),
-            Self::LzwDecode => lzw_flate::lzw::decode(data, params)
+            Self::LzwDecode => lzw_flate::lzw::decode(data, params, limit)
                 .map(FilterResult::from_data)
                 .ok_or(DecodeFailure::StreamDecode),
-            Self::FlateDecode => lzw_flate::flate::decode(data, params)
+            Self::FlateDecode => lzw_flate::flate::decode(data, params, limit)
                 .map(FilterResult::from_data)
                 .ok_or(DecodeFailure::StreamDecode),
             #[cfg(feature = "images")]
@@ -132,6 +134,37 @@ impl Filter {
     }
 }
 
+/// PdfCraft patch: the most bytes Flate, LZW or RunLength may produce for a stream that isn't an
+/// image of known size: content streams, fonts, forms, ICC profiles. These filters expand without
+/// limit (Flate about 1000:1), so a 2 MB page that inflated to 2 GB took the renderer past 3 GB in
+/// under a second. They never write past the limit (the buffer can still grow to under twice
+/// it). Real streams are far smaller; the same figure bounds lopdf's load-time decoding.
+pub const MAX_DECODED_STREAM: usize = 256 << 20;
+
+/// PdfCraft patch: the most bytes they may produce for an image of known size, however large it
+/// says it is.
+const MAX_DECODED_IMAGE: u64 = 1 << 30;
+
+/// PdfCraft patch: the output limit for one filter of a stream decoded with `params`; `last`
+/// says whether it is the last filter. The last filter of an image whose size, bits per
+/// component and components are known produces its pixels, plus at most one PNG predictor tag
+/// byte per pixel byte (a predictor row can be as short as one byte): bytes past that are never
+/// drawn. Earlier filters produce compressed data, which can be larger than the pixels, and
+/// everything else gets [`MAX_DECODED_STREAM`]. Decoding stops at the limit and keeps what it
+/// has.
+pub(crate) fn decode_limit(params: &ImageDecodeParams, last: bool) -> usize {
+    let (true, Some(bpc), Some(components)) = (last, params.bpc, params.num_components) else {
+        return MAX_DECODED_STREAM;
+    };
+    if params.width == 0 || params.height == 0 {
+        return MAX_DECODED_STREAM;
+    }
+    let bits = u64::from(params.width) * u64::from(components) * u64::from(bpc);
+    let pixels = bits.div_ceil(8).saturating_mul(u64::from(params.height));
+    let image = pixels.saturating_mul(2).min(MAX_DECODED_IMAGE);
+    usize::try_from(image).unwrap_or(MAX_DECODED_STREAM)
+}
+
 /// PdfCraft patch: whether a CCITT image of `columns` × `rows` may be decoded. The decoder sizes
 /// its line buffers from `/Columns`, which a fuzzed file set to 4294967295 (a 4 GiB allocation);
 /// real fax lines are a few thousand pixels wide.
diff --git a/vendor/hayro-syntax/src/filter/run_length.rs b/vendor/hayro-syntax/src/filter/run_length.rs
index e66d9ec7..2bef8e70 100644
--- a/vendor/hayro-syntax/src/filter/run_length.rs
+++ b/vendor/hayro-syntax/src/filter/run_length.rs
@@ -2,11 +2,17 @@ use crate::reader::Reader;
 use alloc::vec;
 use alloc::vec::Vec;
 
-pub(crate) fn decode(data: &[u8]) -> Option<Vec<u8>> {
+/// PdfCraft patch: `limit` is the most bytes produced (see `filter::decode_limit`); a run of 128
+/// copies costs two input bytes, so a few megabytes could ask for gigabytes.
+pub(crate) fn decode(data: &[u8], limit: usize) -> Option<Vec<u8>> {
     let mut reader = Reader::new(data);
     let mut decoded = vec![];
 
     loop {
+        let left = limit.saturating_sub(decoded.len());
+        if left == 0 {
+            break;
+        }
         let length = reader.read_byte()?;
 
         match length {
@@ -17,15 +23,20 @@ pub(crate) fn decode(data: &[u8]) -> Option<Vec<u8>> {
                     break;
                 };
 
-                decoded.extend(bytes);
+                decoded.extend(bytes.iter().take(left));
             }
             _ => {
-                let length = 257 - length as usize;
-                decoded.extend([reader.read_byte()?].repeat(length));
+                let length = (257 - length as usize).min(left);
+                let byte = reader.read_byte()?;
+                decoded.extend(core::iter::repeat_n(byte, length));
             }
         }
     }
 
+    // PdfCraft patch: output cut at the limit is reported, never dropped silently.
+    if decoded.len() >= limit {
+        warn!("run-length stream stopped at its decode limit of {limit} bytes");
+    }
     Some(decoded)
 }
 
@@ -37,7 +48,7 @@ mod tests {
     fn run_length() {
         let input = vec![4, 10, 11, 12, 13, 14, 253, 3, 128];
         assert_eq!(
-            decode(&input).unwrap(),
+            decode(&input, usize::MAX).unwrap(),
             vec![10, 11, 12, 13, 14, 3, 3, 3, 3]
         );
     }
diff --git a/vendor/hayro-syntax/src/object/stream.rs b/vendor/hayro-syntax/src/object/stream.rs
index 8b013969..f4856682 100644
--- a/vendor/hayro-syntax/src/object/stream.rs
+++ b/vendor/hayro-syntax/src/object/stream.rs
@@ -166,21 +166,44 @@ impl<'a> Stream<'a> {
     pub fn decoded_image(
         &self,
         image_params: &ImageDecodeParams,
+    ) -> Result<FilterResult<'a>, DecodeFailure> {
+        self.decode_within(image_params, usize::MAX)
+    }
+
+    /// PdfCraft patch: the decoded data of the stream, for callers that budget what a page
+    /// holds. Flate, LZW and RunLength stop at `max` bytes (and at
+    /// [`crate::filter::MAX_DECODED_STREAM`] in any case). A stream without filters is returned
+    /// as it is; ASCIIHex and ASCII85 barely expand, and the image codecs stop at their own pixel
+    /// limits.
+    pub fn decoded_within(&self, max: usize) -> Result<Cow<'a, [u8]>, DecodeFailure> {
+        self.decode_within(&ImageDecodeParams::default(), max)
+            .map(|r| r.data)
+    }
+
+    fn decode_within(
+        &self,
+        image_params: &ImageDecodeParams,
+        max: usize,
     ) -> Result<FilterResult<'a>, DecodeFailure> {
         let data = self.raw_data();
         let filters_and_params = self.filters_and_params();
+        let count = filters_and_params.filters.len();
 
         let mut current: Option<FilterResult<'a>> = None;
 
-        for (filter, params) in filters_and_params
+        for (i, (filter, params)) in filters_and_params
             .filters
             .iter()
             .zip(filters_and_params.params.iter())
+            .enumerate()
         {
+            // PdfCraft patch: see `filter::decode_limit`.
+            let limit = crate::filter::decode_limit(image_params, i + 1 == count).min(max);
             let new = filter.apply(
                 current.as_ref().map(|c| c.data.as_ref()).unwrap_or(&data),
                 params,
                 image_params,
+                limit,
             )?;
             current = Some(new);
         }
diff --git a/vendor/hayro-syntax/src/page.rs b/vendor/hayro-syntax/src/page.rs
index b36ed4c9..dd60f819 100644
--- a/vendor/hayro-syntax/src/page.rs
+++ b/vendor/hayro-syntax/src/page.rs
@@ -251,7 +251,9 @@ impl<'a> Page<'a> {
     pub fn page_stream(&self) -> Option<&[u8]> {
         let convert_single = |s: Stream<'_>| {
             let data = s.decoded().ok()?;
-            Some(data.to_vec())
+            // PdfCraft patch: take the decoded buffer instead of copying it (up to
+            // `MAX_DECODED_STREAM` twice over).
+            Some(data.into_owned())
         };
 
         self.page_streams
@@ -259,12 +261,23 @@ impl<'a> Page<'a> {
                 if let Some(stream) = self.inner.get::<Stream<'_>>(CONTENTS) {
                     convert_single(stream)
                 } else if let Some(array) = self.inner.get::<Array<'_>>(CONTENTS) {
-                    let streams = array.iter::<Stream<'_>>().flat_map(convert_single);
-
                     let mut collected = vec![];
 
-                    for stream in streams {
-                        collected.extend(stream);
+                    for stream in array.iter::<Stream<'_>>() {
+                        // PdfCraft patch: the streams share one `MAX_DECODED_STREAM` (an array
+                        // naming one inflating stream twenty times decoded 5 GB).
+                        let left =
+                            crate::filter::MAX_DECODED_STREAM.saturating_sub(collected.len());
+                        if left == 0 {
+                            break;
+                        }
+                        let Ok(data) = stream.decoded_within(left) else {
+                            continue;
+                        };
+                        // Exactly what this stream and its separator need: growing by doubling
+                        // here held 1 GB for a 256 MiB stream.
+                        collected.reserve_exact(data.len() + 1);
+                        collected.extend_from_slice(&data);
                         // Streams must have at least one whitespace in-between.
                         collected.push(b' ');
                     }

From f5c99ce05956e5ad1698ed06848c8233256b7146 Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 11:11:43 -0700
Subject: [PATCH 100/149] Never crash: mesh shadings can't exhaust memory or
 run for minutes (#412)

* Never crash: mesh shadings can't exhaust memory or run for minutes

`cargo xtask fuzz` (with the dash, JBIG2 and decompression fixes in
place) found a page whose Coons patch shading (type 6), a 147-byte
stream with 1-bit coordinates decoded onto +-40000, took the renderer
past 3 GB. hayro-interpret samples mesh shadings (types 4-7) pixel by
pixel over each triangle's device-space bounding box into a map, with
nothing but the u16 cast bounding it: up to 65536 x 65536 entries for
one triangle. A synthetic single patch passed 6 GB in six seconds; ten
thousand triangles that each cover half a 1000 x 1000 page ran for
minutes. Two rounds of review of earlier versions found more: every
patch was cut into 722 triangles (about 150 KB) before anything limited
them; a lattice mesh with `/VerticesPerRow 0` pushed empty rows forever,
and one with 4294967295 read the whole stream into one row; a mesh
painted a thousand times was triangulated a thousand times; and the
first caps cut content without a word.

Vendored hayro-interpret patch (18):
- `ShadingPattern::encode_within(area)`: the vendored hayro renderer
  passes the area it will actually draw (the path's bounding box on the
  canvas, which it already computes) plus a pixel for texels at a
  fractional edge, and triangles are sampled only inside it, so the map
  holds at most that area's pixels.
- `TriangleSampler`: at most 8 visits per pixel of that area plus 4 per
  triangle in it. A triangle's bounding box is about twice its area and a
  sub-pixel triangle's is at most 2 x 2 pixels, so tiling meshes and
  small dense ones (a patch in a few pixels is 722 triangles) still
  shade completely; overlapping ones stop.
- Coons and tensor-product patches are triangulated one at a time.
- Meshes hold at most `MAX_MESH_PATCHES` (2^16; a 200 x 200 gradient
  mesh is 40 thousand) patches and `MAX_MESH_TRIANGLES` (2^20)
  triangles, and a lattice needs two (ISO 32000-2 8.7.4.5.6) to 2^19
  vertices per row.
- A page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25; the 200 x 200
  mesh is 29 million) mesh triangles in all, reset per page like the
  existing paint budget.
- Each of these cuts logs a warning.
`encode()` keeps its signature; with no area it samples within a fixed
2^24 visits.

Synthetic regression tests in render:
- `mesh_shadings_far_off_the_page_render`: a Coons patch and a triangle
  mesh decoded onto +-40000 render and the rest of the page draws; a
  patch on the page, the part of the huge one that covers it, and a
  patch filling a 4 x 4 pt rectangle as a pattern are all shaded.
- `many_overlapping_mesh_triangles_finish`: 10,000 triangles each
  covering half of a 1000 x 1000 page finish, and are drawn.
- `mesh_shadings_with_many_patches_or_no_rows_finish`: 40,000 patches
  beside the page, and a lattice with `/VerticesPerRow 0`.
Red on main (out of memory, killed at 3.9 GB). Each part is pinned by a
mutation: no visit budget stalls past 60 s; no clip leaves the covering
patch unshaded; no per-triangle allowance leaves the small patch
unshaded; triangulating all patches first runs out of memory (killed at
5.8 GB); no rows check runs out of memory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Never crash: decompression bombs can't exhaust the renderer's memory

The renderer's parser (vendored hayro-syntax) decoded Flate, LZW and
RunLength streams with no output limit. A 2 MB page whose content
stream inflates to 2 GB, or whose 8 x 8 image does, took `pdfcraft-cli
render` and `text` past 3 GB in under a second, and a few more MB of
file scale it further. On the desktop that is the first-page render of
an emailed PDF, and the allocation-failure abort takes every open
document with it. Our own layers already bound single streams (lopdf's
load-time decoding at 256 MiB, cos at 1 GiB), so `info` stays at a few
MB; the renderer path didn't. Random mutation almost never makes a
high-ratio stream, so `cargo xtask fuzz` doesn't find this; found by
hand while triaging the fuzz run.

Vendored hayro-syntax patch (6):
- `decode_limit` gives each filter an output limit, and Flate (both
  flate2 and the fallback inflater), LZW and RunLength never write past
  it (the buffer can still grow to under twice it):
  `MAX_DECODED_STREAM`, 256 MiB, lopdf's figure; or, for the last filter
  of an image whose size, bits per component and components are known,
  twice its pixel bytes (a PNG predictor tag byte per byte at most),
  capped at 1 GiB. Earlier filters in a chain produce compressed data
  and get the general limit.
- `Stream::decoded_within(max)` for callers that budget.
- A page's `/Contents` array shares one `MAX_DECODED_STREAM` (naming one
  bomb twenty times decoded 5 GB), reserving exactly what it appends.

Vendored hayro-interpret patch (18):
- The content a page holds at once (its contents, and the forms, tiling
  patterns and Type 3 glyph procedures being painted) stays within
  `MAX_PAGE_CONTENT`, 512 MiB, reset per page like the existing paint
  budget. Forms nest fifty deep and each level kept its content while
  the next ran: a form painting itself around a 256 MiB stream would
  have held over 12 GB. Each level gives its bytes back when it is
  dropped, so content painted again and again keeps drawing, and a
  stream without filters (borrowed from the file) costs nothing.
- Type 0 sampled functions read every sample into a 4-byte value and
  then a table entry: 256 MiB of 1-bit samples asked for over 8 GB. They
  now take at most 2^21 table points and 2^23 values (the largest real
  tables, DeviceN tint transforms such as 33^4 points x 3 outputs, are
  1.2 million and 3.6 million), counted with checked arithmetic, and
  read no further than `/Size` asks. `/Size 0` no longer underflows
  building the default `/Encode`.

Three rounds of independent review found the aggregate cases, buffer
doubling past the limit, a chain/predictor shape the first image limit
would have truncated, the Type 0 amplifier, and a first, cumulative
budget that would have dropped legitimately repeated content, and a
first Type 0 cap low enough to refuse real tint transforms; all fixed
here.

Measured in a release build (render; OS peak commit):
- content stream inflating to 2 GB: 389 MB, 0.3 s
- 8 x 8 image inflating to 2 GB: 4 MB, 0.2 s
- /Contents naming it twenty times: 516 MB, 0.3 s
- a form painting itself around it: 644 MB, 0.4 s

Synthetic regression tests in render (flate2 is a new dev-dependency
there, already in the workspace):
- `decompression_bombs_stop_at_the_stream_limit`: 288 MiB bombs through
  flate2, the fallback inflater (a stored block with a wrong length
  check, which flate2 refuses and the fallback accepts), LZW and
  RunLength each decode exactly 256 MiB, and at most 128 bytes as an
  8 x 8 image.
- `page_contents_and_nested_forms_share_one_budget`: three /Contents
  references decode one stream's worth; a self-painting form finishes.
- `content_painted_again_and_again_keeps_drawing`: a 2 MiB form painted
  300 times draws the 300th time.
- `sampled_functions_with_billions_of_samples_are_refused`.
Ten mutations each turn them red: no limit at all; no limit in flate2,
the fallback, LZW, RunLength or for images; an unshared /Contents limit;
no page budget; no refund on drop; no Type 0 sample cap. (Taking a form
out of the budget no longer compiles: its content is the budget guard.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M2: normalize JPEG2000 samples without overflowing

Use bounded integer sample scaling for 1-32-bit JPX images and reject empty dimensions before chunking. Cover public decoding and continued page rendering with synthetic regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* Never crash: decompression cut at its limit is logged, not silent; vendor README renumbered after #575

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/render/src/raster.rs           | 187 ++++++++++++++++++++++++++
 vendor/README.md                      |   2 +-
 vendor/hayro-interpret/src/context.rs |   1 +
 vendor/hayro-interpret/src/encode.rs  | 164 +++++++++++++++++-----
 vendor/hayro-interpret/src/shading.rs |  31 +++++
 vendor/hayro/src/renderer.rs          |   4 +-
 6 files changed, 352 insertions(+), 37 deletions(-)

diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 9ab0aaab..08fa3906 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -2053,6 +2053,193 @@ trailer << /Root 1 0 R >>
         assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
     }
 
+    /// From `cargo xtask fuzz`: a mesh shading whose points lie far off the page (a 147-byte
+    /// Coons patch stream decoded onto ±40000) was sampled pixel by pixel over its whole
+    /// bounding box, up to 65536 × 65536 entries: a synthetic page passed 6 GB in six seconds.
+    /// Vendored hayro-interpret patch: mesh shadings are sampled only where they are drawn,
+    /// within eight visits per pixel of that area plus four per triangle in it.
+    #[test]
+    fn mesh_shadings_far_off_the_page_render() {
+        let render = |shading: Vec<u8>| {
+            let content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
+            let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+            pdf.extend_from_slice(content);
+            pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj ");
+            pdf.extend_from_slice(&shading);
+            pdf.extend_from_slice(b" endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+            let (tx, rx) = std::sync::mpsc::channel();
+            std::thread::spawn(move || {
+                let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+            });
+            let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a mesh shading must not stall the renderer");
+            assert!(page.error.is_none(), "{:?}", page.error);
+            page
+        };
+        let stream = |dict: &str, data: &[u8]| {
+            let mut s = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
+            s.extend_from_slice(data);
+            s.extend_from_slice(b"\nendstream");
+            s
+        };
+        // One Coons patch (flag, 12 points, 4 colours) with 8-bit coordinates around its square.
+        let mut coons = vec![0u8];
+        for p in [(0, 0), (0, 85), (0, 170), (0, 255), (85, 255), (170, 255), (255, 255), (255, 170), (255, 85), (255, 0), (170, 0), (85, 0)] {
+            coons.extend_from_slice(&[p.0, p.1]);
+        }
+        coons.extend_from_slice(&[255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0]);
+        // A free-form triangle mesh: three vertices (flag, x, y, colour).
+        let triangles = [0u8, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255];
+        let mesh = "/ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8";
+        let far = "/Decode [-40000 40000 -40000 40000 0 1 0 1 0 1]";
+        for (what, shading) in [
+            ("a Coons patch", stream(&format!("/ShadingType 6 {mesh} {far}"), &coons)),
+            ("a triangle mesh", stream(&format!("/ShadingType 4 {mesh} {far}"), &triangles)),
+        ] {
+            let page = render(shading);
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{what} far off the page: the rest of the page draws");
+        }
+        // A patch on the page, and the part of the huge one that covers it, are still shaded:
+        // the centre is neither white nor transparent.
+        for (what, decode) in [("on the page", "[0 40 0 40 0 1 0 1 0 1]"), ("covering the page", "[-40000 40000 -40000 40000 0 1 0 1 0 1]")] {
+            let page = render(stream(&format!("/ShadingType 6 {mesh} /Decode {decode}"), &coons));
+            let centre = &page.rgba[((20 * 40 + 20) * 4)..][..4];
+            assert!(centre != [255, 255, 255, 255] && centre[3] == 255, "a patch {what} is shaded: {centre:?}");
+        }
+        // A patch filling a 4 × 4 pt rectangle as a pattern is 722 triangles of a fraction of a
+        // pixel each: far more visits than its 16 pixels give, which the per-triangle allowance
+        // covers. The rectangle's middle is shaded.
+        let content = b"/Pattern cs /P0 scn 10 10 4 4 re f";
+        let shading = stream(&format!("/ShadingType 6 {mesh} /Decode [10 14 10 14 0 1 0 1 0 1]"), &coons);
+        let mut pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P0 << /PatternType 2 /Shading 5 0 R >> >> >> >> endobj
+".to_vec();
+        pdf.extend_from_slice(
+            format!(
+                "4 0 obj << /Length {} >> stream
+",
+                content.len()
+            )
+            .as_bytes(),
+        );
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(
+            b"
+endstream endobj
+5 0 obj ",
+        );
+        pdf.extend_from_slice(&shading);
+        pdf.extend_from_slice(
+            b" endobj
+trailer << /Root 1 0 R >>
+%%EOF
+",
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        let middle = &page.rgba[((28 * 40 + 12) * 4)..][..4];
+        assert!(middle != [255, 255, 255, 255] && middle[3] == 255, "a small patch is shaded: {middle:?}");
+    }
+
+    /// The other half of the mesh-shading patch: ten thousand triangles that each cover half
+    /// of this 1000 × 1000 canvas walked their bounding boxes ten thousand times over (ten
+    /// billion visits). The visit budget stops that work at eight per pixel plus four per
+    /// triangle.
+    #[test]
+    fn many_overlapping_mesh_triangles_finish() {
+        // Each triangle: three vertices of flag, x, y, red, green, blue; half of the page.
+        let one = [0u8, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255];
+        let triangles = one.repeat(10_000);
+        let content = b"/Sh0 sh";
+        let mut pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj
+"
+        .to_vec();
+        pdf.extend_from_slice(
+            format!(
+                "4 0 obj << /Length {} >> stream
+",
+                content.len()
+            )
+            .as_bytes(),
+        );
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(
+            format!("
+endstream endobj
+5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 40 0 40 0 1 0 1 0 1] /Length {} >> stream
+", triangles.len())
+                .as_bytes(),
+        );
+        pdf.extend_from_slice(&triangles);
+        pdf.extend_from_slice(
+            b"
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF
+",
+        );
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 25.0, tag: 0 }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("overlapping mesh triangles must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (1000, 1000));
+        // The triangles cover the lower left half: a pixel there is shaded.
+        let p = &page.rgba[((900 * 1000 + 100) * 4)..][..4];
+        assert!(p != [255, 255, 255, 255] && p[3] == 255, "the triangles are drawn: {p:?}");
+    }
+
+    /// Review of the mesh-shading patch: every patch was cut into 722 triangles before anything
+    /// limited them (about 150 KB per patch), and a lattice mesh with `/VerticesPerRow 0` pushed
+    /// empty rows for ever. Vendored hayro-interpret patch: patches are triangulated one at a
+    /// time, meshes hold at most `MAX_MESH_PATCHES` patches and `MAX_MESH_TRIANGLES` triangles,
+    /// and a lattice needs two vertices per row.
+    #[test]
+    fn mesh_shadings_with_many_patches_or_no_rows_finish() {
+        let render = |shading: Vec<u8>| {
+            let content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
+            let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+            pdf.extend_from_slice(content);
+            pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj ");
+            pdf.extend_from_slice(&shading);
+            pdf.extend_from_slice(b" endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+            let (tx, rx) = std::sync::mpsc::channel();
+            std::thread::spawn(move || {
+                let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+            });
+            let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a mesh shading must not stall the renderer");
+            assert!(page.error.is_none(), "{:?}", page.error);
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+        };
+        let stream = |dict: &str, data: &[u8]| {
+            let mut s = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
+            s.extend_from_slice(data);
+            s.extend_from_slice(b"\nendstream");
+            s
+        };
+        let mesh = "/ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8";
+        // Forty thousand Coons patches beside the page: 6 GB of triangles if collected first.
+        let mut coons = vec![0u8];
+        for p in [(0, 0), (0, 85), (0, 170), (0, 255), (85, 255), (170, 255), (255, 255), (255, 170), (255, 85), (255, 0), (170, 0), (85, 0)] {
+            coons.extend_from_slice(&[p.0, p.1]);
+        }
+        coons.extend_from_slice(&[255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0]);
+        render(stream(&format!("/ShadingType 6 {mesh} /BitsPerFlag 8 /Decode [100 140 100 140 0 1 0 1 0 1]"), &coons.repeat(40_000)));
+        // A lattice with no vertices per row.
+        render(stream(&format!("/ShadingType 5 {mesh} /VerticesPerRow 0 /Decode [0 40 0 40 0 1 0 1 0 1]"), &[0u8; 64]));
+    }
+
     /// From the nightly `cargo xtask fuzz`: an embedded Type 1 font program holding a long run of
     /// integers. read-fonts 0.39 (through skrifa 0.42) looked ahead after every integer by
     /// parsing the next token, which looked ahead again, recursing through the whole run: a long
diff --git a/vendor/README.md b/vendor/README.md
index e719d4da..eb708e41 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -7,7 +7,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish` |
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
diff --git a/vendor/hayro-interpret/src/context.rs b/vendor/hayro-interpret/src/context.rs
index b21dc5f8..222f74b4 100644
--- a/vendor/hayro-interpret/src/context.rs
+++ b/vendor/hayro-interpret/src/context.rs
@@ -158,6 +158,7 @@ impl<'a> Context<'a> {
         // PdfCraft patch: a page (or other top-level content) starts with fresh budgets.
         NESTED_PAINTS.with(|n| n.set(0));
         CONTENT_LEFT.with(|c| c.set(MAX_PAGE_CONTENT));
+        crate::encode::reset_mesh_budget();
 
         Self::new_with(initial_transform, bbox, cache, xref, settings, state, 0)
     }
diff --git a/vendor/hayro-interpret/src/encode.rs b/vendor/hayro-interpret/src/encode.rs
index d6b943ec..498ed909 100644
--- a/vendor/hayro-interpret/src/encode.rs
+++ b/vendor/hayro-interpret/src/encode.rs
@@ -43,6 +43,12 @@ impl EncodedShadingPattern {
 impl ShadingPattern {
     /// Encode the shading pattern.
     pub fn encode(&self) -> EncodedShadingPattern {
+        self.encode_within(None)
+    }
+
+    /// PdfCraft patch: encode the shading pattern for drawing inside `area` (device space) only.
+    /// Mesh shadings are sampled pixel by pixel, and only there (see `TriangleSampler`).
+    pub fn encode_within(&self, area: Option<kurbo::Rect>) -> EncodedShadingPattern {
         let base_transform;
 
         let shading_type = match self.shading.shading_type.as_ref() {
@@ -73,7 +79,9 @@ impl ShadingPattern {
                 function,
             } => {
                 let full_transform = self.matrix;
-                let samples = sample_triangles(triangles, full_transform);
+                let mut sampler = TriangleSampler::new(area);
+                sampler.sample(triangles, full_transform);
+                let samples = sampler.map;
 
                 base_transform = Affine::IDENTITY;
 
@@ -83,13 +91,22 @@ impl ShadingPattern {
                 }
             }
             ShadingType::CoonsPatchMesh { patches, function } => {
+                // PdfCraft patch: one patch's triangles at a time (each is 722); collecting all
+                // of them first held 150 KB per patch before any limit applied.
+                let full_transform = self.matrix;
+                let mut sampler = TriangleSampler::new(area);
                 let mut triangles = vec![];
                 for patch in patches {
+                    if !mesh_budget_left() {
+                        break;
+                    }
+                    triangles.clear();
                     patch.to_triangles(&mut triangles);
+                    if !sampler.sample(&triangles, full_transform) {
+                        break;
+                    }
                 }
-
-                let full_transform = self.matrix;
-                let samples = sample_triangles(&triangles, full_transform);
+                let samples = sampler.map;
 
                 base_transform = Affine::IDENTITY;
 
@@ -99,13 +116,21 @@ impl ShadingPattern {
                 }
             }
             ShadingType::TensorProductPatchMesh { patches, function } => {
+                // PdfCraft patch: one patch's triangles at a time, as for Coons patches.
+                let full_transform = self.matrix;
+                let mut sampler = TriangleSampler::new(area);
                 let mut triangles = vec![];
                 for patch in patches {
+                    if !mesh_budget_left() {
+                        break;
+                    }
+                    triangles.clear();
                     patch.to_triangles(&mut triangles);
+                    if !sampler.sample(&triangles, full_transform) {
+                        break;
+                    }
                 }
-
-                let full_transform = self.matrix;
-                let samples = sample_triangles(&triangles, full_transform);
+                let samples = sampler.map;
 
                 base_transform = Affine::IDENTITY;
 
@@ -185,41 +210,110 @@ fn encode_axial_shading(
     )
 }
 
-fn sample_triangles(
-    triangles: &[Triangle],
-    transform: Affine,
-) -> FxHashMap<(u16, u16), ColorComponents> {
-    let mut map = FxHashMap::default();
+/// PdfCraft patch: pixel visits one mesh shading may make, per pixel of the area it is drawn in
+/// and per triangle. Sampling walks each triangle's bounding box (rounded out to whole pixels),
+/// so triangles far off the page (a fuzzed patch decoded onto ±40000) asked for 65536 × 65536
+/// samples, and many triangles covering the same pixels repeat the work. A triangle's box is
+/// about twice its area, and a sub-pixel triangle's box is at most 2 × 2 pixels.
+const MESH_VISITS_PER_PIXEL: u64 = 8;
+const MESH_VISITS_PER_TRIANGLE: u64 = 4;
 
-    for t in triangles {
-        let t = {
-            let p0 = transform * t.p0.point;
-            let p1 = transform * t.p1.point;
-            let p2 = transform * t.p2.point;
+/// PdfCraft patch: the visits allowed when no area is given (the public `encode`).
+const MESH_VISITS_WITHOUT_AREA: u64 = 1 << 24;
 
-            let mut v0 = t.p0.clone();
-            v0.point = p0;
-            let mut v1 = t.p1.clone();
-            v1.point = p1;
-            let mut v2 = t.p2.clone();
-            v2.point = p2;
+/// PdfCraft patch: mesh triangles one page may sample in all, across every shading painted on
+/// it. A shading is triangulated again each time it is painted (2^16 patches are 47 million
+/// triangles, several seconds), so painting one a thousand times took hours. A 200 × 200
+/// gradient mesh is 29 million triangles.
+const MAX_PAGE_MESH_TRIANGLES: u64 = 1 << 25;
 
-            Triangle::new(v0, v1, v2)
+std::thread_local! {
+    static MESH_TRIANGLES_LEFT: core::cell::Cell<u64> =
+        const { core::cell::Cell::new(MAX_PAGE_MESH_TRIANGLES) };
+}
+
+/// PdfCraft patch: a page starts with a fresh mesh triangle budget (called from
+/// `Context::new`).
+pub(crate) fn reset_mesh_budget() {
+    MESH_TRIANGLES_LEFT.with(|n| n.set(MAX_PAGE_MESH_TRIANGLES));
+}
+
+/// PdfCraft patch: `false` once this page's mesh triangle budget is spent.
+fn mesh_budget_left() -> bool {
+    MESH_TRIANGLES_LEFT.with(|n| n.get() > 0)
+}
+
+/// PdfCraft patch: samples mesh triangles into a map with one entry per pixel, only inside
+/// `area` (device space), within the visit budget above.
+struct TriangleSampler {
+    map: FxHashMap<(u16, u16), ColorComponents>,
+    area: kurbo::Rect,
+    visits_left: u64,
+}
+
+impl TriangleSampler {
+    fn new(area: Option<kurbo::Rect>) -> Self {
+        let visits_left = match area {
+            Some(a) => (a.width().max(0.0).ceil() as u64)
+                .saturating_mul(a.height().max(0.0).ceil() as u64)
+                .saturating_mul(MESH_VISITS_PER_PIXEL),
+            None => MESH_VISITS_WITHOUT_AREA,
         };
-
-        let bbox = t.bounding_box();
-
-        for y in (bbox.y0.floor() as u16)..(bbox.y1.ceil() as u16) {
-            for x in (bbox.x0.floor() as u16)..(bbox.x1.ceil() as u16) {
-                let point = Point::new(x as f64, y as f64);
-                if t.contains_point(point) {
-                    map.insert((x, y), t.interpolate(point));
-                }
-            }
+        Self {
+            map: FxHashMap::default(),
+            area: area.unwrap_or(kurbo::Rect::new(0.0, 0.0, 65536.0, 65536.0)),
+            visits_left,
         }
     }
 
-    map
+    /// Sample `triangles`; `false` once a budget is spent (the rest is left unsampled).
+    fn sample(&mut self, triangles: &[Triangle], transform: Affine) -> bool {
+        let page_left = MESH_TRIANGLES_LEFT.with(core::cell::Cell::get);
+        if page_left < triangles.len() as u64 {
+            MESH_TRIANGLES_LEFT.with(|n| n.set(0));
+            warn!("page mesh triangle budget exceeded; the rest of the shading is not drawn");
+            return false;
+        }
+        MESH_TRIANGLES_LEFT.with(|n| n.set(page_left - triangles.len() as u64));
+        for t in triangles {
+            let t = {
+                let p0 = transform * t.p0.point;
+                let p1 = transform * t.p1.point;
+                let p2 = transform * t.p2.point;
+
+                let mut v0 = t.p0.clone();
+                v0.point = p0;
+                let mut v1 = t.p1.clone();
+                v1.point = p1;
+                let mut v2 = t.p2.clone();
+                v2.point = p2;
+
+                Triangle::new(v0, v1, v2)
+            };
+
+            // Only the part of the triangle inside `area`; only such triangles add visits.
+            let bbox = t.bounding_box().intersect(self.area);
+            if bbox.width() <= 0.0 || bbox.height() <= 0.0 {
+                continue;
+            }
+            self.visits_left = self.visits_left.saturating_add(MESH_VISITS_PER_TRIANGLE);
+
+            for y in (bbox.y0.floor() as u16)..(bbox.y1.ceil() as u16) {
+                for x in (bbox.x0.floor() as u16)..(bbox.x1.ceil() as u16) {
+                    if self.visits_left == 0 {
+                        warn!("mesh shading visit budget exceeded; the rest is not drawn");
+                        return false;
+                    }
+                    self.visits_left -= 1;
+                    let point = Point::new(x as f64, y as f64);
+                    if t.contains_point(point) {
+                        self.map.insert((x, y), t.interpolate(point));
+                    }
+                }
+            }
+        }
+        true
+    }
 }
 
 fn encode_function_shading(domain: &[f32; 4], function: &ShadingFunction) -> EncodedShadingType {
diff --git a/vendor/hayro-interpret/src/shading.rs b/vendor/hayro-interpret/src/shading.rs
index 1e29c5e9..74aaa801 100644
--- a/vendor/hayro-interpret/src/shading.rs
+++ b/vendor/hayro-interpret/src/shading.rs
@@ -545,6 +545,13 @@ impl TensorProductPatch {
     }
 }
 
+/// PdfCraft patch: the most triangles a free-form or lattice mesh, and the most patches a
+/// patch mesh, may hold. Each was read without limit: a patch can be 19 bits, a triangle 216
+/// bytes in memory, so a small stream made gigabytes. Real meshes are far smaller (a 200 × 200
+/// gradient mesh is 40 thousand patches).
+const MAX_MESH_TRIANGLES: usize = 1 << 20;
+const MAX_MESH_PATCHES: usize = 1 << 16;
+
 fn read_free_form_triangles(
     data: &[u8],
     bpf: u8,
@@ -594,6 +601,11 @@ fn read_free_form_triangles(
             continue;
         }
 
+        // PdfCraft patch: see `MAX_MESH_TRIANGLES`.
+        if triangles.len() >= MAX_MESH_TRIANGLES {
+            warn!("free-form mesh has over {MAX_MESH_TRIANGLES} triangles; the rest is not drawn");
+            break;
+        }
         triangles.push(Triangle::new(a.clone()?, b.clone()?, c.clone()?));
     }
 
@@ -787,6 +799,15 @@ fn read_lattice_triangles(
     vertices_per_row: u32,
     decode: &[f32],
 ) -> Option<Vec<Triangle>> {
+    // PdfCraft patch: ISO 32000-2 8.7.4.5.6 requires at least two vertices per row; with none,
+    // the loop below pushed empty rows for ever, and one row of 4294967295 read the whole stream
+    // into memory before any cap (see `MAX_MESH_TRIANGLES`).
+    if !(2..=(MAX_MESH_TRIANGLES / 2) as u32).contains(&vertices_per_row) {
+        warn!("lattice-form mesh with {vertices_per_row} vertices per row");
+
+        return None;
+    }
+
     let mut lattices = vec![];
 
     let ([x_min, x_max, y_min, y_max], decode) = split_decode(decode)?;
@@ -806,6 +827,11 @@ fn read_lattice_triangles(
     };
 
     'outer: loop {
+        // PdfCraft patch: see `MAX_MESH_TRIANGLES` (two triangles per vertex at most).
+        if lattices.len().saturating_mul(vertices_per_row as usize) >= MAX_MESH_TRIANGLES / 2 {
+            warn!("lattice-form mesh has too many vertices; the rest is not drawn");
+            break;
+        }
         let mut single_row = vec![];
 
         for _ in 0..vertices_per_row {
@@ -895,6 +921,11 @@ where
     let mut patches = vec![];
 
     while let Some(flag) = reader.read(bpf) {
+        // PdfCraft patch: see `MAX_MESH_PATCHES`.
+        if patches.len() >= MAX_MESH_PATCHES {
+            warn!("patch mesh has over {MAX_MESH_PATCHES} patches; the rest is not drawn");
+            break;
+        }
         let mut control_points = vec![Point::ZERO; 16]; // Always allocate 16, use subset as needed.
         let mut colors = [smallvec![], smallvec![], smallvec![], smallvec![]];
 
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index ebf3cdc5..89982c48 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -549,7 +549,9 @@ impl Renderer {
                             self.ctx.height() as f64,
                         ));
 
-                        let encoded = s.encode();
+                        // PdfCraft patch: mesh shadings are sampled only inside `bbox` (and a
+                        // pixel around it: texels at a fractional edge look one pixel further).
+                        let encoded = s.encode_within(Some(bbox.inflate(1.0, 1.0)));
                         let (image, width, height, transform, may_have_transparency) =
                             render_shading_texture(bbox, &encoded);
                         let may_have_transparency =

From 1399d38ea396f05c372d64821a3b822995169619 Mon Sep 17 00:00:00 2001
From: Phil Kwek <64081785+philkwek@users.noreply.github.com>
Date: Sat, 10 Oct 2026 02:11:59 +0800
Subject: [PATCH 101/149] Fix: High-precision float mantissa overflow in
 hayro-syntax, causing warped display of some PDFs  (#199) (#427)

* hayro-syntax: fix float mantissa overflow on high-precision coordinates (#199)

jsPDF outputs double-precision floating-point coordinates with 16+ decimal
places in /MediaBox. In hayro-syntax, read_inner accumulated float mantissa
digits into u64 using wrapping arithmetic. Integer mantissas exceeding
u64::MAX wrapped modulo 2^64, severely corrupting page dimensions
(e.g., 3874.96 pt became 185.61 pt, rendering as a warped ribbon).

Accumulation now uses checked arithmetic: trailing fractional digits
exceeding u64 capacity are safely ignored without incrementing decimal_shift.
This preserves full IEEE-754 f64 precision while preventing overflow for
numbers with arbitrary numbers of decimal places.

Includes:
- Unit test in hayro-syntax with reported values and a 50-digit fraction.
- Synthetic PDF regression test in pdfcraft-render verifying inspect().
- Vendored patch (6) documentation in vendor/README.md.

Fixes #199

* Never crash: mesh shadings can't exhaust memory or run for minutes

`cargo xtask fuzz` (with the dash, JBIG2 and decompression fixes in
place) found a page whose Coons patch shading (type 6), a 147-byte
stream with 1-bit coordinates decoded onto +-40000, took the renderer
past 3 GB. hayro-interpret samples mesh shadings (types 4-7) pixel by
pixel over each triangle's device-space bounding box into a map, with
nothing but the u16 cast bounding it: up to 65536 x 65536 entries for
one triangle. A synthetic single patch passed 6 GB in six seconds; ten
thousand triangles that each cover half a 1000 x 1000 page ran for
minutes. Two rounds of review of earlier versions found more: every
patch was cut into 722 triangles (about 150 KB) before anything limited
them; a lattice mesh with `/VerticesPerRow 0` pushed empty rows forever,
and one with 4294967295 read the whole stream into one row; a mesh
painted a thousand times was triangulated a thousand times; and the
first caps cut content without a word.

Vendored hayro-interpret patch (18):
- `ShadingPattern::encode_within(area)`: the vendored hayro renderer
  passes the area it will actually draw (the path's bounding box on the
  canvas, which it already computes) plus a pixel for texels at a
  fractional edge, and triangles are sampled only inside it, so the map
  holds at most that area's pixels.
- `TriangleSampler`: at most 8 visits per pixel of that area plus 4 per
  triangle in it. A triangle's bounding box is about twice its area and a
  sub-pixel triangle's is at most 2 x 2 pixels, so tiling meshes and
  small dense ones (a patch in a few pixels is 722 triangles) still
  shade completely; overlapping ones stop.
- Coons and tensor-product patches are triangulated one at a time.
- Meshes hold at most `MAX_MESH_PATCHES` (2^16; a 200 x 200 gradient
  mesh is 40 thousand) patches and `MAX_MESH_TRIANGLES` (2^20)
  triangles, and a lattice needs two (ISO 32000-2 8.7.4.5.6) to 2^19
  vertices per row.
- A page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25; the 200 x 200
  mesh is 29 million) mesh triangles in all, reset per page like the
  existing paint budget.
- Each of these cuts logs a warning.
`encode()` keeps its signature; with no area it samples within a fixed
2^24 visits.

Synthetic regression tests in render:
- `mesh_shadings_far_off_the_page_render`: a Coons patch and a triangle
  mesh decoded onto +-40000 render and the rest of the page draws; a
  patch on the page, the part of the huge one that covers it, and a
  patch filling a 4 x 4 pt rectangle as a pattern are all shaded.
- `many_overlapping_mesh_triangles_finish`: 10,000 triangles each
  covering half of a 1000 x 1000 page finish, and are drawn.
- `mesh_shadings_with_many_patches_or_no_rows_finish`: 40,000 patches
  beside the page, and a lattice with `/VerticesPerRow 0`.
Red on main (out of memory, killed at 3.9 GB). Each part is pinned by a
mutation: no visit budget stalls past 60 s; no clip leaves the covering
patch unshaded; no per-triangle allowance leaves the small patch
unshaded; triangulating all patches first runs out of memory (killed at
5.8 GB); no rows check runs out of memory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Never crash: decompression bombs can't exhaust the renderer's memory

The renderer's parser (vendored hayro-syntax) decoded Flate, LZW and
RunLength streams with no output limit. A 2 MB page whose content
stream inflates to 2 GB, or whose 8 x 8 image does, took `pdfcraft-cli
render` and `text` past 3 GB in under a second, and a few more MB of
file scale it further. On the desktop that is the first-page render of
an emailed PDF, and the allocation-failure abort takes every open
document with it. Our own layers already bound single streams (lopdf's
load-time decoding at 256 MiB, cos at 1 GiB), so `info` stays at a few
MB; the renderer path didn't. Random mutation almost never makes a
high-ratio stream, so `cargo xtask fuzz` doesn't find this; found by
hand while triaging the fuzz run.

Vendored hayro-syntax patch (6):
- `decode_limit` gives each filter an output limit, and Flate (both
  flate2 and the fallback inflater), LZW and RunLength never write past
  it (the buffer can still grow to under twice it):
  `MAX_DECODED_STREAM`, 256 MiB, lopdf's figure; or, for the last filter
  of an image whose size, bits per component and components are known,
  twice its pixel bytes (a PNG predictor tag byte per byte at most),
  capped at 1 GiB. Earlier filters in a chain produce compressed data
  and get the general limit.
- `Stream::decoded_within(max)` for callers that budget.
- A page's `/Contents` array shares one `MAX_DECODED_STREAM` (naming one
  bomb twenty times decoded 5 GB), reserving exactly what it appends.

Vendored hayro-interpret patch (18):
- The content a page holds at once (its contents, and the forms, tiling
  patterns and Type 3 glyph procedures being painted) stays within
  `MAX_PAGE_CONTENT`, 512 MiB, reset per page like the existing paint
  budget. Forms nest fifty deep and each level kept its content while
  the next ran: a form painting itself around a 256 MiB stream would
  have held over 12 GB. Each level gives its bytes back when it is
  dropped, so content painted again and again keeps drawing, and a
  stream without filters (borrowed from the file) costs nothing.
- Type 0 sampled functions read every sample into a 4-byte value and
  then a table entry: 256 MiB of 1-bit samples asked for over 8 GB. They
  now take at most 2^21 table points and 2^23 values (the largest real
  tables, DeviceN tint transforms such as 33^4 points x 3 outputs, are
  1.2 million and 3.6 million), counted with checked arithmetic, and
  read no further than `/Size` asks. `/Size 0` no longer underflows
  building the default `/Encode`.

Three rounds of independent review found the aggregate cases, buffer
doubling past the limit, a chain/predictor shape the first image limit
would have truncated, the Type 0 amplifier, and a first, cumulative
budget that would have dropped legitimately repeated content, and a
first Type 0 cap low enough to refuse real tint transforms; all fixed
here.

Measured in a release build (render; OS peak commit):
- content stream inflating to 2 GB: 389 MB, 0.3 s
- 8 x 8 image inflating to 2 GB: 4 MB, 0.2 s
- /Contents naming it twenty times: 516 MB, 0.3 s
- a form painting itself around it: 644 MB, 0.4 s

Synthetic regression tests in render (flate2 is a new dev-dependency
there, already in the workspace):
- `decompression_bombs_stop_at_the_stream_limit`: 288 MiB bombs through
  flate2, the fallback inflater (a stored block with a wrong length
  check, which flate2 refuses and the fallback accepts), LZW and
  RunLength each decode exactly 256 MiB, and at most 128 bytes as an
  8 x 8 image.
- `page_contents_and_nested_forms_share_one_budget`: three /Contents
  references decode one stream's worth; a self-painting form finishes.
- `content_painted_again_and_again_keeps_drawing`: a 2 MiB form painted
  300 times draws the 300th time.
- `sampled_functions_with_billions_of_samples_are_refused`.
Ten mutations each turn them red: no limit at all; no limit in flate2,
the fallback, LZW, RunLength or for images; an unshared /Contents limit;
no page budget; no refund on drop; no Type 0 sample cap. (Taking a form
out of the budget no longer compiles: its content is the budget guard.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M2: normalize JPEG2000 samples without overflowing

Use bounded integer sample scaling for 1-32-bit JPX images and reject empty dimensions before chunking. Cover public decoding and continued page rendering with synthetic regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* Never crash: decompression cut at its limit is logged, not silent; vendor README renumbered after #575

---------

Co-authored-by: James Locke <336218001+jcl-bit@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/render/src/inspect.rs             | 15 +++++
 vendor/README.md                         |  2 +-
 vendor/hayro-syntax/src/object/number.rs | 84 ++++++++++++++++++++----
 3 files changed, 86 insertions(+), 15 deletions(-)

diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 2ce2d986..8096888b 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -1457,6 +1457,21 @@ trailer << /Root 1 0 R >>
         assert_eq!(pretty_date("D:20260930104512-04'00'"), "2026-09-30 10:45");
         assert_eq!(pretty_date("yesterday"), "yesterday");
     }
+
+    #[test]
+    fn jspdf_high_precision_mediabox_does_not_overflow_dimensions() {
+        let pdf = b"%PDF-1.3
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 3874.9606299212600788 5493.5433070866147318] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+        let info = inspect(std::sync::Arc::new(pdf.to_vec()), None).expect("opens");
+        assert_eq!(info.pages.len(), 1);
+        let p = &info.pages[0];
+        assert!((p.width - 3874.96).abs() < 0.1, "width expected ~3874.96, got {}", p.width);
+        assert!((p.height - 5493.54).abs() < 0.1, "height expected ~5493.54, got {}", p.height);
+    }
 }
 
 /// "1.7" from the parser's version name ("Pdf17", "V1_7", …).
diff --git a/vendor/README.md b/vendor/README.md
index eb708e41..636f6029 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -12,7 +12,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB) | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite) | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax) |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
diff --git a/vendor/hayro-syntax/src/object/number.rs b/vendor/hayro-syntax/src/object/number.rs
index a2847cd7..bd37b19c 100644
--- a/vendor/hayro-syntax/src/object/number.rs
+++ b/vendor/hayro-syntax/src/object/number.rs
@@ -125,26 +125,30 @@ fn read_inner(r: &mut Reader<'_>) -> Option<Number> {
         _ => false,
     };
 
+    // PdfCraft patch: high-precision float mantissa overflow (jsPDF double-precision coordinates).
+    // Digits that don't fit in `mantissa` are dropped: past the dot they are only precision;
+    // before it, each one scales the value by ten (`extra_int_digits`).
     let mut mantissa: u64 = 0;
     let mut has_dot = false;
     let mut decimal_shift: u32 = 0;
     let mut has_digits = false;
+    let mut extra_int_digits: u32 = 0;
 
     loop {
         match r.peek_byte() {
             Some(b'0'..=b'9') => {
-                let d = r.read_byte().unwrap();
-                mantissa = mantissa
-                    // Using `saturating` would arguably be better here, but
-                    // profiling showed that it seems to be more expensive, at least
-                    // on ARM. Since such large numbers shouldn't appear anyway,
-                    // it doesn't really matter a lot what mode we use.
-                    .wrapping_mul(10)
-                    .wrapping_add((d - b'0') as u64);
+                let d = (r.read_byte().unwrap() - b'0') as u64;
                 has_digits = true;
-                if has_dot {
-                    decimal_shift += 1;
+                if let Some(next) = mantissa.checked_mul(10).and_then(|m| m.checked_add(d)) {
+                    mantissa = next;
+                    if has_dot {
+                        decimal_shift += 1;
+                    }
+                } else if !has_dot {
+                    extra_int_digits = extra_int_digits.saturating_add(1);
                 }
+                // If has_dot and adding the digit would overflow u64:
+                // Safely ignore excess trailing fractional digits (do not add, do not increment decimal_shift).
             }
             Some(b'.') if !has_dot => {
                 r.forward();
@@ -174,15 +178,34 @@ fn read_inner(r: &mut Reader<'_>) -> Option<Number> {
         return None;
     }
 
+    // A value whose integer part overflowed `u64` is a real, scaled by the digits dropped and
+    // kept finite.
+    let scaled = |value: f64| -> f64 {
+        let value = if extra_int_digits > 0 { value * powi_f64(10.0, extra_int_digits) } else { value };
+        if value.is_finite() { value } else { f64::MAX }
+    };
+
+    if !has_dot && extra_int_digits > 0 {
+        let value = scaled(mantissa as f64);
+        return Some(Number(InternalNumber::Real(if negative { -value } else { value })));
+    }
+
     if !has_dot {
-        let value = if negative {
-            (mantissa as i64).wrapping_neg()
+        let value = if mantissa <= i64::MAX as u64 {
+            let i = mantissa as i64;
+            if negative { -i } else { i }
+        } else if negative && mantissa == (i64::MIN as u64) {
+            i64::MIN
         } else {
-            mantissa as i64
+            let mut val = mantissa as f64;
+            if negative {
+                val = -val;
+            }
+            return Some(Number(InternalNumber::Real(val)));
         };
         Some(Number(InternalNumber::Integer(value)))
     } else {
-        let mut value = mantissa as f64;
+        let mut value = scaled(mantissa as f64);
 
         if decimal_shift > 0 {
             if decimal_shift < POWERS_OF_10.len() as u32 {
@@ -537,4 +560,37 @@ mod tests {
             4294966260
         );
     }
+
+    #[test]
+    fn high_precision_float_does_not_overflow_mantissa() {
+        let num1 = Reader::new("3874.9606299212600788".as_bytes())
+            .read_without_context::<f64>()
+            .unwrap();
+        assert!((num1 - 3874.96062992126).abs() < 1e-6, "got {num1}");
+
+        let num2 = Reader::new("5493.5433070866147318".as_bytes())
+            .read_without_context::<f64>()
+            .unwrap();
+        assert!((num2 - 5493.543307086615).abs() < 1e-6, "got {num2}");
+
+        // Verify extreme fractional precision (50 decimal places) truncates safely
+        let num3 = Reader::new("0.12345678901234567890123456789012345678901234567890".as_bytes())
+            .read_without_context::<f64>()
+            .unwrap();
+        assert!((num3 - 0.12345678901234568).abs() < 1e-15, "got {num3}");
+
+        // Integer digits past `u64` scale the value instead of being dropped.
+        let num4 = Reader::new("123456789012345678901.5".as_bytes())
+            .read_without_context::<f64>()
+            .unwrap();
+        assert!((num4 / 1.2345678901234568e20 - 1.0).abs() < 1e-12, "got {num4}");
+        let num5 = Reader::new("-123456789012345678901".as_bytes())
+            .read_without_context::<f64>()
+            .unwrap();
+        assert!((num5 / -1.2345678901234568e20 - 1.0).abs() < 1e-12, "got {num5}");
+        // Hundreds of digits stay finite.
+        let huge = "9".repeat(400);
+        let num6 = Reader::new(huge.as_bytes()).read_without_context::<f64>().unwrap();
+        assert!(num6.is_finite() && num6 > 1e300, "got {num6}");
+    }
 }

From bd4736d39c8659f3f1c93b0d227b412463451f83 Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Fri, 9 Oct 2026 20:12:16 +0200
Subject: [PATCH 102/149] M2: bound page-label traversal and output (#480)

* hayro-syntax: fix float mantissa overflow on high-precision coordinates (#199)

jsPDF outputs double-precision floating-point coordinates with 16+ decimal
places in /MediaBox. In hayro-syntax, read_inner accumulated float mantissa
digits into u64 using wrapping arithmetic. Integer mantissas exceeding
u64::MAX wrapped modulo 2^64, severely corrupting page dimensions
(e.g., 3874.96 pt became 185.61 pt, rendering as a warped ribbon).

Accumulation now uses checked arithmetic: trailing fractional digits
exceeding u64 capacity are safely ignored without incrementing decimal_shift.
This preserves full IEEE-754 f64 precision while preventing overflow for
numbers with arbitrary numbers of decimal places.

Includes:
- Unit test in hayro-syntax with reported values and a 50-digit fraction.
- Synthetic PDF regression test in pdfcraft-render verifying inspect().
- Vendored patch (6) documentation in vendor/README.md.

Fixes #199

* M2: bound page-label work and output before applying labels

Share bounded PDF Roman and repeated-letter formatters between inspection
and editing. Bound tree traversal, raw and decoded prefixes, individual
labels and aggregate label output, with checked numbering arithmetic.

Stage inspection labels before applying them and retain physical page
numbers with a warning when optional labels cannot be processed. Reject
unsupported label edits before changing the document tree.

Add synthetic limit, cycle, Unicode, numbering and atomic-edit regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* Never crash: mesh shadings can't exhaust memory or run for minutes

`cargo xtask fuzz` (with the dash, JBIG2 and decompression fixes in
place) found a page whose Coons patch shading (type 6), a 147-byte
stream with 1-bit coordinates decoded onto +-40000, took the renderer
past 3 GB. hayro-interpret samples mesh shadings (types 4-7) pixel by
pixel over each triangle's device-space bounding box into a map, with
nothing but the u16 cast bounding it: up to 65536 x 65536 entries for
one triangle. A synthetic single patch passed 6 GB in six seconds; ten
thousand triangles that each cover half a 1000 x 1000 page ran for
minutes. Two rounds of review of earlier versions found more: every
patch was cut into 722 triangles (about 150 KB) before anything limited
them; a lattice mesh with `/VerticesPerRow 0` pushed empty rows forever,
and one with 4294967295 read the whole stream into one row; a mesh
painted a thousand times was triangulated a thousand times; and the
first caps cut content without a word.

Vendored hayro-interpret patch (18):
- `ShadingPattern::encode_within(area)`: the vendored hayro renderer
  passes the area it will actually draw (the path's bounding box on the
  canvas, which it already computes) plus a pixel for texels at a
  fractional edge, and triangles are sampled only inside it, so the map
  holds at most that area's pixels.
- `TriangleSampler`: at most 8 visits per pixel of that area plus 4 per
  triangle in it. A triangle's bounding box is about twice its area and a
  sub-pixel triangle's is at most 2 x 2 pixels, so tiling meshes and
  small dense ones (a patch in a few pixels is 722 triangles) still
  shade completely; overlapping ones stop.
- Coons and tensor-product patches are triangulated one at a time.
- Meshes hold at most `MAX_MESH_PATCHES` (2^16; a 200 x 200 gradient
  mesh is 40 thousand) patches and `MAX_MESH_TRIANGLES` (2^20)
  triangles, and a lattice needs two (ISO 32000-2 8.7.4.5.6) to 2^19
  vertices per row.
- A page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25; the 200 x 200
  mesh is 29 million) mesh triangles in all, reset per page like the
  existing paint budget.
- Each of these cuts logs a warning.
`encode()` keeps its signature; with no area it samples within a fixed
2^24 visits.

Synthetic regression tests in render:
- `mesh_shadings_far_off_the_page_render`: a Coons patch and a triangle
  mesh decoded onto +-40000 render and the rest of the page draws; a
  patch on the page, the part of the huge one that covers it, and a
  patch filling a 4 x 4 pt rectangle as a pattern are all shaded.
- `many_overlapping_mesh_triangles_finish`: 10,000 triangles each
  covering half of a 1000 x 1000 page finish, and are drawn.
- `mesh_shadings_with_many_patches_or_no_rows_finish`: 40,000 patches
  beside the page, and a lattice with `/VerticesPerRow 0`.
Red on main (out of memory, killed at 3.9 GB). Each part is pinned by a
mutation: no visit budget stalls past 60 s; no clip leaves the covering
patch unshaded; no per-triangle allowance leaves the small patch
unshaded; triangulating all patches first runs out of memory (killed at
5.8 GB); no rows check runs out of memory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Never crash: decompression bombs can't exhaust the renderer's memory

The renderer's parser (vendored hayro-syntax) decoded Flate, LZW and
RunLength streams with no output limit. A 2 MB page whose content
stream inflates to 2 GB, or whose 8 x 8 image does, took `pdfcraft-cli
render` and `text` past 3 GB in under a second, and a few more MB of
file scale it further. On the desktop that is the first-page render of
an emailed PDF, and the allocation-failure abort takes every open
document with it. Our own layers already bound single streams (lopdf's
load-time decoding at 256 MiB, cos at 1 GiB), so `info` stays at a few
MB; the renderer path didn't. Random mutation almost never makes a
high-ratio stream, so `cargo xtask fuzz` doesn't find this; found by
hand while triaging the fuzz run.

Vendored hayro-syntax patch (6):
- `decode_limit` gives each filter an output limit, and Flate (both
  flate2 and the fallback inflater), LZW and RunLength never write past
  it (the buffer can still grow to under twice it):
  `MAX_DECODED_STREAM`, 256 MiB, lopdf's figure; or, for the last filter
  of an image whose size, bits per component and components are known,
  twice its pixel bytes (a PNG predictor tag byte per byte at most),
  capped at 1 GiB. Earlier filters in a chain produce compressed data
  and get the general limit.
- `Stream::decoded_within(max)` for callers that budget.
- A page's `/Contents` array shares one `MAX_DECODED_STREAM` (naming one
  bomb twenty times decoded 5 GB), reserving exactly what it appends.

Vendored hayro-interpret patch (18):
- The content a page holds at once (its contents, and the forms, tiling
  patterns and Type 3 glyph procedures being painted) stays within
  `MAX_PAGE_CONTENT`, 512 MiB, reset per page like the existing paint
  budget. Forms nest fifty deep and each level kept its content while
  the next ran: a form painting itself around a 256 MiB stream would
  have held over 12 GB. Each level gives its bytes back when it is
  dropped, so content painted again and again keeps drawing, and a
  stream without filters (borrowed from the file) costs nothing.
- Type 0 sampled functions read every sample into a 4-byte value and
  then a table entry: 256 MiB of 1-bit samples asked for over 8 GB. They
  now take at most 2^21 table points and 2^23 values (the largest real
  tables, DeviceN tint transforms such as 33^4 points x 3 outputs, are
  1.2 million and 3.6 million), counted with checked arithmetic, and
  read no further than `/Size` asks. `/Size 0` no longer underflows
  building the default `/Encode`.

Three rounds of independent review found the aggregate cases, buffer
doubling past the limit, a chain/predictor shape the first image limit
would have truncated, the Type 0 amplifier, and a first, cumulative
budget that would have dropped legitimately repeated content, and a
first Type 0 cap low enough to refuse real tint transforms; all fixed
here.

Measured in a release build (render; OS peak commit):
- content stream inflating to 2 GB: 389 MB, 0.3 s
- 8 x 8 image inflating to 2 GB: 4 MB, 0.2 s
- /Contents naming it twenty times: 516 MB, 0.3 s
- a form painting itself around it: 644 MB, 0.4 s

Synthetic regression tests in render (flate2 is a new dev-dependency
there, already in the workspace):
- `decompression_bombs_stop_at_the_stream_limit`: 288 MiB bombs through
  flate2, the fallback inflater (a stored block with a wrong length
  check, which flate2 refuses and the fallback accepts), LZW and
  RunLength each decode exactly 256 MiB, and at most 128 bytes as an
  8 x 8 image.
- `page_contents_and_nested_forms_share_one_budget`: three /Contents
  references decode one stream's worth; a self-painting form finishes.
- `content_painted_again_and_again_keeps_drawing`: a 2 MiB form painted
  300 times draws the 300th time.
- `sampled_functions_with_billions_of_samples_are_refused`.
Ten mutations each turn them red: no limit at all; no limit in flate2,
the fallback, LZW, RunLength or for images; an unshared /Contents limit;
no page budget; no refund on drop; no Type 0 sample cap. (Taking a form
out of the budget no longer compiles: its content is the budget guard.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M2: normalize JPEG2000 samples without overflowing

Use bounded integer sample scaling for 1-32-bit JPX images and reject empty dimensions before chunking. Cover public decoding and continued page rendering with synthetic regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* Never crash: decompression cut at its limit is logged, not silent; vendor README renumbered after #575

---------

Co-authored-by: philkwek <philkwek03@gmail.com>
Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: James Locke <336218001+jcl-bit@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                    |   1 +
 ROADMAP.md                    |   4 +
 crates/cos/src/lib.rs         |   1 +
 crates/cos/src/page_labels.rs |  91 ++++++++
 crates/organize/src/labels.rs | 315 ++++++++++++++++++++--------
 crates/organize/src/tests.rs  | 182 ++++++++++++++++
 crates/render/Cargo.toml      |   1 +
 crates/render/src/inspect.rs  | 382 ++++++++++++++++++++++++++++------
 8 files changed, 824 insertions(+), 153 deletions(-)
 create mode 100644 crates/cos/src/page_labels.rs

diff --git a/Cargo.lock b/Cargo.lock
index f33ac705..7c17ee53 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3757,6 +3757,7 @@ dependencies = [
  "kurbo 0.13.1",
  "log",
  "lopdf",
+ "pdfcraft-cos",
  "pdfcraft-fonts",
  "skrifa 0.44.0",
  "thiserror 2.0.21",
diff --git a/ROADMAP.md b/ROADMAP.md
index 089ad198..036eb652 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -93,6 +93,8 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 92% | 2–4 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
 | M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
+| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
+| M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
@@ -134,6 +136,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
 
+- **2026-10-09 (M2, bounded page labels):** Inspector number trees have shared work, depth, and cycle limits; prefixes are bounded before decoding and complete custom labels have per-label and aggregate UTF-8 byte caps. A refused tree leaves physical page numbers intact and records one warning, with custom labels applied only after every range succeeds. Pure COS Roman and repeated-letter formatters are shared with Organize; label queries and edits return errors for unsupported output before changing the stored tree, while ordinary labels and prefix-only ranges remain supported. Synthetic tests cover safe just-over-limit cases, large first numbers, aliases, cycles, wide/deep trees, UTF-16/UTF-8 boundaries, aggregate output, and unchanged refused edits. Milestone and overall effort estimates unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/cos/src/lib.rs b/crates/cos/src/lib.rs
index 29e906e1..e7b6406c 100644
--- a/crates/cos/src/lib.rs
+++ b/crates/cos/src/lib.rs
@@ -14,6 +14,7 @@
 mod bytes;
 mod document;
 mod object;
+pub mod page_labels;
 mod parser;
 mod security;
 mod writer;
diff --git a/crates/cos/src/page_labels.rs b/crates/cos/src/page_labels.rs
new file mode 100644
index 00000000..cf037bf1
--- /dev/null
+++ b/crates/cos/src/page_labels.rs
@@ -0,0 +1,91 @@
+//! Bounded numbering for page labels (ISO 32000-2 §12.4.2).
+//! Pure helpers shared by inspection and editing; no object graph or renderer dependency.
+
+/// A complete custom label, including its prefix, may contain this many UTF-8 bytes.
+pub const MAX_LABEL_BYTES: usize = 1024;
+/// Raw prefixes are bounded before decoding; this admits a full UTF-16BE ASCII label.
+pub const MAX_PREFIX_BYTES: usize = 2 * MAX_LABEL_BYTES + 2;
+/// Sum of the UTF-8 bytes of custom labels for one document.
+pub const MAX_LABEL_TOTAL_BYTES: usize = 4 << 20;
+/// The most number-tree entries (nodes, kids and range pairs) read from one `/PageLabels`
+/// tree. Scaled for real documents: one range per page on a ten-thousand-page PDF happens
+/// (prefix labels; #307's file has 9,156 pages), so the cap is twenty times that while still
+/// bounding hostile trees.
+pub const MAX_LABEL_TREE_WORK: usize = 200_000;
+/// Maximum nesting of a label number tree.
+pub const MAX_LABEL_TREE_DEPTH: usize = 32;
+
+/// Lowercase Roman numerals, or `None` if the output exceeds the remaining label budget.
+/// The budget is capped at [`MAX_LABEL_BYTES`], including when `n` is hostile.
+pub fn roman(mut n: u64, max_bytes: usize) -> Option<String> {
+    const PARTS: [(u64, &str); 13] = [
+        (1000, "m"),
+        (900, "cm"),
+        (500, "d"),
+        (400, "cd"),
+        (100, "c"),
+        (90, "xc"),
+        (50, "l"),
+        (40, "xl"),
+        (10, "x"),
+        (9, "ix"),
+        (5, "v"),
+        (4, "iv"),
+        (1, "i"),
+    ];
+    let max_bytes = max_bytes.min(MAX_LABEL_BYTES);
+    let mut out = String::new();
+    for (value, part) in PARTS {
+        let count = usize::try_from(n / value).ok()?;
+        let bytes = count.checked_mul(part.len())?;
+        if bytes > max_bytes.saturating_sub(out.len()) {
+            return None;
+        }
+        // The quotient is checked against the tiny byte budget before repeating.
+        out.push_str(&part.repeat(count));
+        n %= value;
+    }
+    Some(out)
+}
+
+/// a..z, aa..zz, aaa.. (the repeated-letter numbering specified by PDF).
+/// Returns `None` instead of truncating a label that exceeds the remaining byte budget.
+pub fn alpha(n: u64, max_bytes: usize) -> Option<String> {
+    let n = n.max(1) - 1;
+    let count = usize::try_from(n / 26 + 1).ok()?;
+    if count > max_bytes.min(MAX_LABEL_BYTES) {
+        return None;
+    }
+    let letter = char::from(b'a' + (n % 26) as u8);
+    Some(std::iter::repeat_n(letter, count).collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bounded_page_labels_follow_pdf_numbering() {
+        assert_eq!(roman(4, MAX_LABEL_BYTES).as_deref(), Some("iv"));
+        assert_eq!(roman(1994, MAX_LABEL_BYTES).as_deref(), Some("mcmxciv"));
+        for (n, expected) in [(0, "a"), (1, "a"), (26, "z"), (27, "aa"), (52, "zz"), (53, "aaa")] {
+            assert_eq!(alpha(n, MAX_LABEL_BYTES).as_deref(), Some(expected));
+        }
+    }
+
+    #[test]
+    fn bounded_page_labels_check_lengths_before_repeating() {
+        assert_eq!(roman(1_024_000, MAX_LABEL_BYTES).unwrap().len(), MAX_LABEL_BYTES);
+        assert!(roman(1_024_001, MAX_LABEL_BYTES).is_none());
+        assert_eq!(alpha(26 * 1024, MAX_LABEL_BYTES).unwrap().len(), MAX_LABEL_BYTES);
+        assert!(alpha(26 * 1024 + 1, MAX_LABEL_BYTES).is_none());
+        assert_eq!(roman(4, 2).as_deref(), Some("iv"));
+        assert!(roman(4, 1).is_none());
+        assert_eq!(alpha(27, 2).as_deref(), Some("aa"));
+        assert!(alpha(27, 1).is_none());
+        for max in [0, MAX_LABEL_BYTES, usize::MAX] {
+            assert!(roman(u64::MAX, max).is_none());
+            assert!(alpha(u64::MAX, max).is_none());
+        }
+    }
+}
diff --git a/crates/organize/src/labels.rs b/crates/organize/src/labels.rs
index e25a408c..46211a98 100644
--- a/crates/organize/src/labels.rs
+++ b/crates/organize/src/labels.rs
@@ -5,7 +5,10 @@
 //! `from..=to`, and keep every later page showing the label it had before. The tree is written
 //! back as one flat `/Nums` array, with ranges that merely continue the previous one merged.
 
-use pdfcraft_cos::{Dict, Document, Object, PdfString};
+use std::collections::HashSet;
+
+use pdfcraft_cos::page_labels::{MAX_LABEL_BYTES, MAX_LABEL_TOTAL_BYTES, MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_WORK, MAX_PREFIX_BYTES, alpha, roman};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString};
 
 use crate::{OrganizeError, page_count, pages_root};
 
@@ -48,50 +51,29 @@ impl LabelStyle {
         }
     }
 
-    /// Format `n` (≥ 1) in this style.
+    /// Format `n` (≥ 1) in this style for previews.
+    /// A numeral exceeding 1024 bytes falls back to decimal; editing and document label
+    /// queries use the checked formatter and return an error instead of storing a fallback.
     pub fn format(self, n: u32) -> String {
-        match self {
-            Self::Decimal => n.to_string(),
-            Self::UpperRoman => roman(n).to_uppercase(),
-            Self::LowerRoman => roman(n),
-            // §12.4.2: A to Z, then AA to ZZ, and so on (the letter repeated).
-            Self::UpperAlpha => alpha(n).to_uppercase(),
-            Self::LowerAlpha => alpha(n),
-            Self::None => String::new(),
-        }
+        self.format_checked(n, MAX_LABEL_BYTES).unwrap_or_else(|_| n.to_string())
     }
-}
 
-fn roman(mut n: u32) -> String {
-    const T: [(u32, &str); 13] = [
-        (1000, "m"),
-        (900, "cm"),
-        (500, "d"),
-        (400, "cd"),
-        (100, "c"),
-        (90, "xc"),
-        (50, "l"),
-        (40, "xl"),
-        (10, "x"),
-        (9, "ix"),
-        (5, "v"),
-        (4, "iv"),
-        (1, "i"),
-    ];
-    let mut s = String::new();
-    for (v, r) in T {
-        while n >= v {
-            s.push_str(r);
-            n -= v;
+    fn format_checked(self, n: u32, max_bytes: usize) -> Result<String, OrganizeError> {
+        let mut out = match self {
+            Self::Decimal => Some(n.to_string()),
+            Self::UpperRoman | Self::LowerRoman => roman(u64::from(n), max_bytes),
+            Self::UpperAlpha | Self::LowerAlpha => alpha(u64::from(n), max_bytes),
+            Self::None => Some(String::new()),
         }
+        .ok_or_else(|| invalid_label("a label exceeds 1024 UTF-8 bytes"))?;
+        if out.len() > max_bytes {
+            return Err(invalid_label("a label exceeds 1024 UTF-8 bytes"));
+        }
+        if matches!(self, Self::UpperRoman | Self::UpperAlpha) {
+            out.make_ascii_uppercase();
+        }
+        Ok(out)
     }
-    s
-}
-
-fn alpha(n: u32) -> String {
-    let n = n.max(1) - 1;
-    let letter = char::from(b'a' + (n % 26) as u8);
-    std::iter::repeat_n(letter, (n / 26 + 1).min(1000) as usize).collect()
 }
 
 /// One labelling range.
@@ -106,10 +88,25 @@ pub struct LabelRange {
 }
 
 impl LabelRange {
-    fn label(&self, page: usize) -> String {
-        let n = self.first.saturating_add((page - self.start) as u32);
-        format!("{}{}", self.prefix, self.style.format(n))
+    fn number(&self, page: usize) -> Result<u32, OrganizeError> {
+        if self.style == LabelStyle::None {
+            return Ok(self.first); // /St is ignored when the range has no numbering style.
+        }
+        let offset = page.checked_sub(self.start).and_then(|n| u32::try_from(n).ok()).ok_or_else(|| invalid_label("a page number is too large"))?;
+        self.first.checked_add(offset).ok_or_else(|| invalid_label("a page number overflows"))
     }
+
+    fn label(&self, page: usize) -> Result<String, OrganizeError> {
+        let remaining = MAX_LABEL_BYTES.checked_sub(self.prefix.len()).ok_or_else(|| invalid_label("a prefix exceeds 1024 UTF-8 bytes"))?;
+        let number = self.style.format_checked(self.number(page)?, remaining)?;
+        let mut label = self.prefix.clone();
+        label.push_str(&number);
+        Ok(label)
+    }
+}
+
+fn invalid_label(reason: &str) -> OrganizeError {
+    OrganizeError::Invalid(format!("Page labels could not be processed: {reason}"))
 }
 
 fn default_range() -> LabelRange {
@@ -117,53 +114,158 @@ fn default_range() -> LabelRange {
 }
 
 /// The document's label ranges, sorted by start page (empty when it has no `/PageLabels`).
+/// This compatibility query returns an empty list for a tree exceeding resource limits.
+/// Label display and edits use the checked reader and return an error instead.
 pub fn page_label_ranges(doc: &Document) -> Vec<LabelRange> {
-    let Some(root) = doc.root() else { return Vec::new() };
-    let Some(tree) = doc.get(root).as_dict().and_then(|c| c.get(b"PageLabels").cloned()) else { return Vec::new() };
-    let mut entries = Vec::new();
-    let mut stack = vec![(tree, 0u8)];
-    let mut budget = 10_000;
-    while let Some((node, depth)) = stack.pop() {
-        budget -= 1;
-        if budget == 0 || depth > 32 {
-            break;
-        }
-        let node = doc.resolve(&node);
-        let Some(d) = node.as_dict() else { continue };
-        if let Some(nums) = d.get(b"Nums").map(|n| doc.resolve(n)).and_then(|n| n.as_array().cloned()) {
-            for pair in nums.as_chunks::<2>().0 {
-                let (Some(start), Some(spec)) = (pair[0].as_int(), doc.resolve(&pair[1]).as_dict().cloned()) else { continue };
-                if start < 0 {
-                    continue;
-                }
-                entries.push(LabelRange {
-                    start: start as usize,
-                    style: spec.name(b"S").map_or(LabelStyle::None, LabelStyle::from_name),
-                    prefix: spec.get(b"P").map(|p| doc.resolve(p)).and_then(|p| p.as_string().map(|s| s.to_text())).unwrap_or_default(),
-                    first: spec.int(b"St").unwrap_or(1).clamp(1, u32::MAX as i64) as u32,
-                });
-            }
-        }
-        if let Some(kids) = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()) {
-            stack.extend(kids.into_iter().map(|k| (k, depth + 1)));
-        }
-    }
-    entries.sort_by_key(|r| r.start);
-    entries.dedup_by_key(|r| r.start);
-    entries
+    checked_ranges(doc).unwrap_or_default()
 }
 
-/// Every page's label, as a viewer shows it.
-pub fn page_labels(doc: &Document) -> Result<Vec<String>, OrganizeError> {
-    let n = page_count(doc)?;
-    let ranges = page_label_ranges(doc);
-    Ok((0..n)
-        .map(|p| match ranges.iter().rev().find(|r| r.start <= p) {
-            Some(r) => r.label(p),
-            // Pages before the first range have no label: viewers show the page number.
+// Borrow direct objects instead of cloning complete untrusted dictionaries or arrays.
+fn with_label_object<T>(doc: &Document, object: &Object, f: impl FnOnce(&Object) -> Result<T, OrganizeError>) -> Result<T, OrganizeError> {
+    let Object::Ref(r) = object else { return f(object) };
+    let mut seen = HashSet::from([*r]);
+    let mut object = doc.get(*r);
+    while let Object::Ref(r) = object.as_ref() {
+        if seen.len() >= MAX_LABEL_TREE_DEPTH || !seen.insert(*r) {
+            return Err(invalid_label("a number tree reference is cyclic or too deeply nested"));
+        }
+        object = doc.get(*r);
+    }
+    f(&object)
+}
+
+fn label_work(left: &mut usize, count: usize) -> Result<(), OrganizeError> {
+    *left = left.checked_sub(count).ok_or_else(|| invalid_label("the number tree has too many entries"))?;
+    Ok(())
+}
+
+fn read_label_node(
+    doc: &Document,
+    node: &Object,
+    depth: usize,
+    left: &mut usize,
+    seen: &mut HashSet<ObjRef>,
+    entries: &mut Vec<LabelRange>,
+) -> Result<(), OrganizeError> {
+    label_work(left, 1)?;
+    if depth > MAX_LABEL_TREE_DEPTH {
+        return Err(invalid_label("the number tree is too deep"));
+    }
+    // Only indirect nodes can be reached twice; key them by reference, not by the address of
+    // a resolved object (a missing reference resolves to a fresh, short-lived `Null`).
+    if let Object::Ref(r) = node
+        && !seen.insert(*r)
+    {
+        return Err(invalid_label("the number tree repeats a node or contains a cycle"));
+    }
+    with_label_object(doc, node, |node| {
+        let Some(d) = node.as_dict() else { return Ok(()) };
+        if let Some(nums) = d.get(b"Nums") {
+            with_label_object(doc, nums, |nums| {
+                let Some(nums) = nums.as_array() else { return Ok(()) };
+                label_work(left, nums.len().div_ceil(2))?;
+                for pair in nums.as_chunks::<2>().0 {
+                    let Some(start) = pair[0].as_int().and_then(|n| usize::try_from(n).ok()) else { continue };
+                    with_label_object(doc, &pair[1], |spec| {
+                        let Some(spec) = spec.as_dict() else { return Ok(()) };
+                        let prefix = match spec.get(b"P") {
+                            Some(prefix) => with_label_object(doc, prefix, |p| match p.as_string() {
+                                Some(p) if p.bytes.len() > MAX_PREFIX_BYTES => Err(invalid_label("a raw prefix exceeds 2050 bytes")),
+                                Some(p) => Ok(p.to_text()),
+                                None => Ok(String::new()),
+                            })?,
+                            None => String::new(),
+                        };
+                        if prefix.len() > MAX_LABEL_BYTES {
+                            return Err(invalid_label("a decoded prefix exceeds 1024 UTF-8 bytes"));
+                        }
+                        let style = spec.name(b"S").map_or(LabelStyle::None, LabelStyle::from_name);
+                        let first = spec.int(b"St").unwrap_or(1).max(1);
+                        let first = if style == LabelStyle::None {
+                            // /St has no effect without /S; keep the existing compatibility clamp.
+                            first.min(i64::from(u32::MAX)) as u32
+                        } else {
+                            u32::try_from(first).map_err(|_| invalid_label("a first number exceeds the supported integer range"))?
+                        };
+                        entries.push(LabelRange { start, style, prefix, first });
+                        Ok(())
+                    })?;
+                }
+                Ok(())
+            })?;
+        }
+        if let Some(kids) = d.get(b"Kids") {
+            with_label_object(doc, kids, |kids| {
+                let Some(kids) = kids.as_array() else { return Ok(()) };
+                label_work(left, kids.len())?;
+                if !kids.is_empty() && depth == MAX_LABEL_TREE_DEPTH {
+                    return Err(invalid_label("the number tree is too deep"));
+                }
+                // Recursion is bounded before descending, and arrays are borrowed throughout.
+                for kid in kids {
+                    read_label_node(doc, kid, depth + 1, left, seen, entries)?;
+                }
+                Ok(())
+            })?;
+        }
+        Ok(())
+    })
+}
+
+fn checked_ranges(doc: &Document) -> Result<Vec<LabelRange>, OrganizeError> {
+    let Some(root) = doc.root() else { return Ok(Vec::new()) };
+    let catalog = doc.get(root);
+    let Some(tree) = catalog.as_dict().and_then(|c| c.get(b"PageLabels")) else { return Ok(Vec::new()) };
+    let mut entries = Vec::new();
+    let mut left = MAX_LABEL_TREE_WORK;
+    read_label_node(doc, tree, 0, &mut left, &mut HashSet::new(), &mut entries)?;
+    // A start page given twice keeps its later range, as readers that overwrite do (the sort is
+    // stable, so the later one is last among equals).
+    entries.sort_by_key(|r| r.start);
+    let mut unique: Vec<LabelRange> = Vec::with_capacity(entries.len());
+    for r in entries {
+        match unique.last_mut() {
+            Some(last) if last.start == r.start => *last = r,
+            _ => unique.push(r),
+        }
+    }
+    Ok(unique)
+}
+
+/// Every page's label. `lenient` (reading a file): a range whose label can't be formatted
+/// shows physical page numbers for its pages instead of failing every label.
+fn labels_from_ranges(n: usize, ranges: &[LabelRange], lenient: bool) -> Result<Vec<String>, OrganizeError> {
+    let mut labels = Vec::new();
+    let mut total = 0usize;
+    let mut ranges = ranges.iter().peekable();
+    let mut active = None;
+    for p in 0..n {
+        while ranges.peek().is_some_and(|r| r.start <= p) {
+            active = ranges.next();
+        }
+        let label = match active {
+            Some(r) => {
+                let label = match r.label(p) {
+                    Ok(label) => label,
+                    Err(_) if lenient => String::new(),
+                    Err(e) => return Err(e),
+                };
+                total = total.checked_add(label.len()).ok_or_else(|| invalid_label("the total label size overflows"))?;
+                if total > MAX_LABEL_TOTAL_BYTES {
+                    return Err(invalid_label("custom labels exceed 4 MiB in total"));
+                }
+                if label.is_empty() { (p + 1).to_string() } else { label }
+            }
             None => (p + 1).to_string(),
-        })
-        .collect())
+        };
+        labels.push(label);
+    }
+    Ok(labels)
+}
+
+/// Every page's label, as a viewer shows it. Resource limits return an actionable error.
+pub fn page_labels(doc: &Document) -> Result<Vec<String>, OrganizeError> {
+    labels_from_ranges(page_count(doc)?, &checked_ranges(doc)?, true)
 }
 
 /// Replace all label ranges (an empty list removes `/PageLabels`).
@@ -176,8 +278,24 @@ pub fn set_page_label_ranges(doc: &mut Document, ranges: &[LabelRange]) -> Resul
         })?;
         return Ok(());
     }
-    let mut nums = Vec::new();
+    if ranges.len() >= MAX_LABEL_TREE_WORK {
+        return Err(invalid_label("the number tree has too many entries"));
+    }
+    // Validate every range and all effective labels before changing any document object.
     for r in ranges {
+        if r.first == 0 || i64::try_from(r.start).is_err() {
+            return Err(invalid_label("range starts and first numbers must be valid positive PDF integers"));
+        }
+        r.label(r.start)?;
+    }
+    let mut sorted = ranges.to_vec();
+    sorted.sort_by_key(|r| r.start);
+    if sorted.windows(2).any(|pair| pair.first().zip(pair.get(1)).is_some_and(|(a, b)| a.start == b.start)) {
+        return Err(invalid_label("range start pages must be unique"));
+    }
+    labels_from_ranges(page_count(doc)?, &sorted, false)?;
+    let mut nums = Vec::new();
+    for r in &sorted {
         let mut spec = Dict::new();
         if let Some(s) = r.style.name() {
             spec.set(b"S".to_vec(), Object::name(s));
@@ -201,6 +319,9 @@ pub fn set_page_label_ranges(doc: &mut Document, ranges: &[LabelRange]) -> Resul
 /// Acrobat's "Number pages": label pages `from..=to` (0-based) with `style`, `prefix` and
 /// starting number `first`; pages after `to` keep the labels they had.
 pub fn number_pages(doc: &mut Document, from: usize, to: usize, style: LabelStyle, prefix: &str, first: u32) -> Result<(), OrganizeError> {
+    if prefix.len() > MAX_LABEL_BYTES {
+        return Err(invalid_label("a prefix exceeds 1024 UTF-8 bytes"));
+    }
     let n = page_count(doc)?;
     if to >= n {
         return Err(OrganizeError::NoSuchPage(to));
@@ -208,7 +329,7 @@ pub fn number_pages(doc: &mut Document, from: usize, to: usize, style: LabelStyl
     if from > to {
         return Err(OrganizeError::NoSuchPage(from));
     }
-    let mut old = page_label_ranges(doc);
+    let mut old = checked_ranges(doc)?;
     if old.first().is_none_or(|r| r.start > 0) {
         old.insert(0, default_range());
     }
@@ -218,16 +339,18 @@ pub fn number_pages(doc: &mut Document, from: usize, to: usize, style: LabelStyl
     ranges.push(LabelRange { start: from, style, prefix: prefix.to_string(), first: first.max(1) });
     if to + 1 < n {
         let r = at(to + 1);
-        let first = r.first.saturating_add((to + 1 - r.start) as u32);
+        let first = r.number(to + 1)?;
         ranges.push(LabelRange { start: to + 1, first, ..r });
         ranges.extend(old.iter().filter(|r| r.start > to + 1).cloned());
     }
     // Drop ranges that only continue the previous one.
     let mut merged: Vec<LabelRange> = Vec::new();
     for r in ranges {
-        let continues = merged
-            .last()
-            .is_some_and(|p| p.style == r.style && p.prefix == r.prefix && u64::from(p.first) + (r.start - p.start) as u64 == u64::from(r.first));
+        let continues = merged.last().is_some_and(|p| {
+            p.style == r.style
+                && p.prefix == r.prefix
+                && r.start.checked_sub(p.start).and_then(|n| u32::try_from(n).ok()).and_then(|n| p.first.checked_add(n)) == Some(r.first)
+        });
         if !continues {
             merged.push(r);
         }
@@ -243,6 +366,14 @@ pub fn number_pages(doc: &mut Document, from: usize, to: usize, style: LabelStyl
 mod tests {
     use super::*;
 
+    #[test]
+    fn page_label_limits_bound_organizer_total_output() {
+        let range = LabelRange { start: 0, style: LabelStyle::None, prefix: "x".repeat(MAX_LABEL_BYTES), first: u32::MAX };
+        let count = MAX_LABEL_TOTAL_BYTES / MAX_LABEL_BYTES;
+        assert_eq!(labels_from_ranges(count, std::slice::from_ref(&range), false).unwrap().len(), count);
+        assert!(labels_from_ranges(count + 1, &[range], false).unwrap_err().to_string().contains("4 MiB"));
+    }
+
     #[test]
     fn styles_format_like_the_spec() {
         assert_eq!(LabelStyle::LowerRoman.format(14), "xiv");
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index a7b12af3..5db275a2 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -781,6 +781,188 @@ fn number_pages_like_acrobat() {
     assert!(d.get(d.root().unwrap()).as_dict().unwrap().get(b"PageLabels").is_none());
 }
 
+#[test]
+fn page_label_limits_reject_unsupported_edits_before_mutating() {
+    use crate::LabelStyle::*;
+    for (style, prefix, first) in [
+        (LowerRoman, String::new(), 1_025_000),
+        (LowerAlpha, String::new(), 26 * 1024 + 1),
+        (Decimal, "x".repeat(1025), 1),
+        (Decimal, String::new(), u32::MAX),
+    ] {
+        let mut d = doc_a();
+        let before = d.modified_objects();
+        assert!(crate::number_pages(&mut d, 0, 1, style, &prefix, first).is_err());
+        assert_eq!(d.modified_objects(), before, "a refused label edit must not change the tree");
+        assert!(crate::page_label_ranges(&d).is_empty());
+    }
+}
+
+#[test]
+fn page_label_limits_reject_unsupported_ranges_before_mutating() {
+    let mut d = doc_a();
+    let before = d.modified_objects();
+    let ranges = [crate::LabelRange { start: 0, style: crate::LabelStyle::LowerRoman, prefix: String::new(), first: 1_025_000 }];
+    assert!(crate::set_page_label_ranges(&mut d, &ranges).is_err());
+    assert_eq!(d.modified_objects(), before);
+}
+
+#[test]
+fn page_label_limits_reject_cyclic_old_trees_without_rewriting() {
+    let mut d = doc_a();
+    let tree = d.add(Object::Null);
+    let mut dict = Dict::new();
+    dict.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(tree)]));
+    d.set(tree, Object::Dict(dict));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree))).unwrap();
+    let before = d.modified_objects();
+    assert!(crate::page_labels(&d).is_err());
+    assert!(crate::page_label_ranges(&d).is_empty(), "compatibility query has documented empty fallback");
+    assert!(crate::number_pages(&mut d, 0, 1, crate::LabelStyle::Decimal, "", 1).is_err());
+    assert_eq!(d.modified_objects(), before);
+    assert_eq!(d.get(d.root().unwrap()).as_dict().unwrap().reference(b"PageLabels"), Some(tree));
+}
+
+#[test]
+fn page_label_limits_reject_oversized_old_arrays_without_rewriting() {
+    let mut d = doc_a();
+    let mut dict = Dict::new();
+    dict.set(b"Kids".to_vec(), Object::Array(vec![Object::Null; pdfcraft_cos::page_labels::MAX_LABEL_TREE_WORK + 1]));
+    let tree = d.add(Object::Dict(dict));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree))).unwrap();
+    let before = d.modified_objects();
+    assert!(crate::page_labels(&d).is_err());
+    assert!(crate::number_pages(&mut d, 0, 1, crate::LabelStyle::Decimal, "", 1).is_err());
+    assert_eq!(d.modified_objects(), before);
+}
+
+#[test]
+fn page_label_limits_keep_preview_fallback_and_valid_boundary_edits() {
+    use crate::LabelStyle::*;
+    assert_eq!(LowerRoman.format(u32::MAX), u32::MAX.to_string());
+    assert_eq!(LowerAlpha.format(u32::MAX), u32::MAX.to_string());
+    let mut d = doc_a();
+    crate::number_pages(&mut d, 0, 2, None, &"x".repeat(1024), 1).unwrap();
+    assert!(crate::page_labels(&d).unwrap().iter().all(|s| s.len() == 1024));
+}
+
+#[test]
+fn page_label_limits_preserve_prefix_only_max_first_and_aliases() {
+    let mut d = doc_a();
+    crate::number_pages(&mut d, 0, 2, crate::LabelStyle::None, "prefix", u32::MAX).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap(), ["prefix", "prefix", "prefix"]);
+    crate::number_pages(&mut d, 0, 0, crate::LabelStyle::Decimal, "", 1).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap(), ["1", "prefix", "prefix"]);
+
+    let prefix = d.add(Object::String(PdfString::text("alias")));
+    let prefix_alias = d.add(Object::Ref(prefix));
+    let mut spec = Dict::new();
+    spec.set(b"P".to_vec(), Object::Ref(prefix_alias));
+    spec.set(b"St".to_vec(), Object::Int(i64::MAX)); // unused without /S
+    let spec = d.add(Object::Dict(spec));
+    let spec_alias = d.add(Object::Ref(spec));
+    let nums = d.add(Object::Array(vec![Object::Int(0), Object::Ref(spec_alias)]));
+    let nums_alias = d.add(Object::Ref(nums));
+    let mut tree = Dict::new();
+    tree.set(b"Nums".to_vec(), Object::Ref(nums_alias));
+    let tree = d.add(Object::Dict(tree));
+    let tree_alias = d.add(Object::Ref(tree));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree_alias))).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap(), ["alias", "alias", "alias"]);
+    crate::number_pages(&mut d, 0, 0, crate::LabelStyle::Decimal, "", 1).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap(), ["1", "alias", "alias"]);
+}
+
+#[test]
+fn page_label_limits_refuse_reference_only_cycles_without_rewriting() {
+    let mut d = doc_a();
+    let tree = d.add(Object::Null);
+    d.set(tree, Object::Ref(tree));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree))).unwrap();
+    let before = d.modified_objects();
+    assert!(crate::page_labels(&d).is_err());
+    assert!(crate::number_pages(&mut d, 0, 1, crate::LabelStyle::Decimal, "", 1).is_err());
+    assert_eq!(d.modified_objects(), before);
+}
+
+#[test]
+fn page_label_limits_validate_the_same_ranges_that_are_written() {
+    use crate::{LabelRange, LabelStyle};
+    let mut d = doc_a();
+    let duplicates = [
+        LabelRange { start: 0, style: LabelStyle::None, prefix: "ok".into(), first: 1 },
+        LabelRange { start: 0, style: LabelStyle::None, prefix: "x".repeat(1024), first: 1 },
+    ];
+    let before = d.modified_objects();
+    assert!(crate::set_page_label_ranges(&mut d, &duplicates).unwrap_err().to_string().contains("unique"));
+    assert_eq!(d.modified_objects(), before);
+    let unsorted = [
+        LabelRange { start: 1, style: LabelStyle::UpperAlpha, prefix: "".into(), first: 1 },
+        LabelRange { start: 0, style: LabelStyle::LowerRoman, prefix: "".into(), first: 4 },
+    ];
+    crate::set_page_label_ranges(&mut d, &unsorted).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap(), ["iv", "A", "B"]);
+    let catalog = d.get(d.root().unwrap());
+    let tree = d.resolve(catalog.as_dict().unwrap().get(b"PageLabels").unwrap());
+    let nums = tree.as_dict().unwrap().get(b"Nums").unwrap().as_array().unwrap();
+    assert_eq!(nums[0].as_int(), Some(0));
+    assert_eq!(nums[2].as_int(), Some(1));
+}
+
+#[test]
+fn page_label_duplicate_starts_keep_the_later_range() {
+    let mut d = doc_a();
+    let mut a = Dict::new();
+    a.set(b"P".to_vec(), Object::String(PdfString::text("first")));
+    let mut b = Dict::new();
+    b.set(b"P".to_vec(), Object::String(PdfString::text("last")));
+    let mut tree = Dict::new();
+    tree.set(b"Nums".to_vec(), Object::Array(vec![Object::Int(0), Object::Dict(a), Object::Int(0), Object::Dict(b)]));
+    let tree = d.add(Object::Dict(tree));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree))).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap()[0], "last");
+    crate::number_pages(&mut d, 0, 0, crate::LabelStyle::Decimal, "", 1).unwrap();
+}
+
+/// Two kids naming objects the file doesn't have both resolve to a fresh `Null`; they are not
+/// the same node, so the tree isn't refused as cyclic.
+#[test]
+fn page_label_missing_kids_are_not_a_cycle() {
+    let mut d = doc_a();
+    let mut leaf = Dict::new();
+    let mut spec = Dict::new();
+    spec.set(b"P".to_vec(), Object::String(PdfString::text("p-")));
+    spec.set(b"S".to_vec(), Object::name("D"));
+    leaf.set(b"Nums".to_vec(), Object::Array(vec![Object::Int(0), Object::Dict(spec)]));
+    let leaf = d.add(Object::Dict(leaf));
+    let mut tree = Dict::new();
+    let missing = |n| Object::Ref(pdfcraft_cos::ObjRef { num: n, generation: 0 });
+    tree.set(b"Kids".to_vec(), Object::Array(vec![missing(9_000), missing(9_001), Object::Ref(leaf)]));
+    let tree = d.add(Object::Dict(tree));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree))).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap()[0], "p-1");
+}
+
+/// A range whose labels would be too long shows physical page numbers; other ranges keep
+/// their labels.
+#[test]
+fn page_label_too_long_range_falls_back_alone() {
+    let mut d = doc_a();
+    let mut ok = Dict::new();
+    ok.set(b"P".to_vec(), Object::String(PdfString::text("ok-")));
+    ok.set(b"S".to_vec(), Object::name("D"));
+    let mut huge = Dict::new();
+    huge.set(b"S".to_vec(), Object::name("r"));
+    huge.set(b"St".to_vec(), Object::Int(1_025_000));
+    let mut tree = Dict::new();
+    tree.set(b"Nums".to_vec(), Object::Array(vec![Object::Int(0), Object::Dict(ok), Object::Int(1), Object::Dict(huge)]));
+    let tree = d.add(Object::Dict(tree));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree))).unwrap();
+    let labels = crate::page_labels(&d).unwrap();
+    assert_eq!(labels[0], "ok-1");
+    assert_eq!(labels[1], "2");
+}
+
 #[test]
 fn page_boxes_default_inherit_and_set() {
     let mut doc = open(fixture());
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index 9a270747..ce4154db 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -9,6 +9,7 @@ license.workspace = true
 workspace = true
 
 [dependencies]
+pdfcraft-cos = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 hayro = { workspace = true }
 hayro-syntax = { workspace = true }
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 8096888b..1fc315fa 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -13,6 +13,7 @@ use hayro::hayro_syntax::DecryptionError;
 use hayro::hayro_syntax::LoadPdfError;
 use hayro::hayro_syntax::Pdf;
 use lopdf::{Dictionary, Document, LoadOptions, Object, ObjectId};
+use pdfcraft_cos::page_labels::{MAX_LABEL_BYTES, MAX_LABEL_TOTAL_BYTES, MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_WORK, MAX_PREFIX_BYTES, alpha, roman};
 
 use crate::OpenError;
 
@@ -443,7 +444,10 @@ impl<'a> Inspector<'a> {
             .and_then(|m| m.get(b"Marked").ok())
             .and_then(|o| o.as_bool().ok())
             .unwrap_or(false);
-        self.page_labels(catalog, &mut info.pages);
+        match self.page_labels(catalog, &mut info.pages) {
+            Ok(notes) => info.warnings.extend(notes.into_iter().map(|note| format!("Page labels: {note}."))),
+            Err(reason) => info.warnings.push(format!("Page labels were skipped: {reason}; using physical page numbers.")),
+        }
         if let Some(first) = catalog.get(b"Outlines").ok().and_then(|o| self.dict(o)).and_then(|d| d.get(b"First").ok()) {
             let mut seen = HashSet::new();
             info.outline = self.outline_siblings(first, &mut seen, 0);
@@ -627,45 +631,138 @@ impl<'a> Inspector<'a> {
 
     // ── page labels (ISO 32000-2 §12.4.2) ───────────────────────────────────────────────────
 
-    fn page_labels(&self, catalog: &Dictionary, pages: &mut [PageInfo]) {
-        let Some(tree) = catalog.get(b"PageLabels").ok().and_then(|o| self.dict(o)) else { return };
+    fn label_object(&self, object: &'a Object) -> Result<&'a Object, &'static str> {
+        self.doc.dereference(object).map(|(_, o)| o).map_err(|_| "a number tree reference is missing or cyclic")
+    }
+
+    fn label_dict(&self, object: &'a Object) -> Result<Option<&'a Dictionary>, &'static str> {
+        Ok(match self.label_object(object)? {
+            Object::Dictionary(d) => Some(d),
+            Object::Stream(s) => Some(&s.dict),
+            _ => None,
+        })
+    }
+
+    /// Apply `/PageLabels` to `pages`. `Err`: the tree is unusable and no label is applied.
+    /// `Ok(notes)`: labels applied, with what was repaired on the way (a duplicated start page,
+    /// a range whose labels are too long to show).
+    fn page_labels(&self, catalog: &Dictionary, pages: &mut [PageInfo]) -> Result<Vec<String>, &'static str> {
+        let mut notes = Vec::new();
+        let Ok(tree) = catalog.get(b"PageLabels") else { return Ok(notes) };
+        let Some(tree) = self.label_dict(tree)? else { return Ok(notes) };
         let mut ranges: BTreeMap<usize, &Dictionary> = BTreeMap::new();
-        let mut stack = vec![(tree, 0u32)];
+        let mut stack = vec![(tree, 0usize)];
+        let mut seen = HashSet::new();
+        let mut left = MAX_LABEL_TREE_WORK;
         while let Some((node, depth)) = stack.pop() {
-            if let Ok(Object::Array(nums)) = node.get(b"Nums").map(|o| self.resolve(o)) {
+            label_work(&mut left, 1)?;
+            if depth > MAX_LABEL_TREE_DEPTH {
+                return Err("the number tree is too deep");
+            }
+            if !seen.insert(node as *const Dictionary) {
+                return Err("the number tree repeats a node or contains a cycle");
+            }
+            if let Ok(nums) = node.get(b"Nums")
+                && let Object::Array(nums) = self.label_object(nums)?
+            {
+                label_work(&mut left, nums.len().div_ceil(2))?;
                 for pair in nums.chunks(2) {
                     if let [k, v] = pair
-                        && let (Ok(start), Some(d)) = (self.resolve(k).as_i64(), self.dict(v))
-                        && start >= 0
+                        && let (Ok(start), Some(d)) = (self.label_object(k)?.as_i64(), self.label_dict(v)?)
+                        && let Ok(start) = usize::try_from(start)
+                        && ranges.insert(start, d).is_some()
                     {
-                        ranges.insert(start as usize, d);
+                        // The later range wins, as in readers that overwrite.
+                        notes.push(format!("a range starts on page {} twice; the later one is used", start.saturating_add(1)));
                     }
                 }
             }
-            if depth < 32
-                && let Ok(Object::Array(kids)) = node.get(b"Kids").map(|o| self.resolve(o))
+            if let Ok(kids) = node.get(b"Kids")
+                && let Object::Array(kids) = self.label_object(kids)?
             {
-                stack.extend(kids.iter().filter_map(|k| self.dict(k)).map(|d| (d, depth + 1)));
+                label_work(&mut left, kids.len())?;
+                if kids.len() > MAX_LABEL_TREE_WORK.saturating_sub(stack.len()) {
+                    return Err("the number tree has too many pending nodes");
+                }
+                if !kids.is_empty() && depth == MAX_LABEL_TREE_DEPTH {
+                    return Err("the number tree is too deep");
+                }
+                for kid in kids {
+                    if let Some(d) = self.label_dict(kid)? {
+                        stack.push((d, depth + 1));
+                    }
+                }
             }
         }
-        for (i, page) in pages.iter_mut().enumerate() {
-            let Some((&start, d)) = ranges.range(..=i).next_back() else { continue };
-            let first = d.get(b"St").ok().and_then(|o| o.as_i64().ok()).unwrap_or(1).max(1) as usize;
-            let n = first + (i - start);
-            let prefix = self.text(d, b"P").unwrap_or_default();
-            let number = match self.name(d, b"S").as_deref() {
-                Some("D") => n.to_string(),
-                Some("R") => roman(n).to_uppercase(),
-                Some("r") => roman(n),
-                Some("A") => alpha(n).to_uppercase(),
-                Some("a") => alpha(n),
+        // Decode each bounded prefix once, rather than once for every page in its range.
+        let mut specs = BTreeMap::new();
+        for (start, d) in ranges {
+            let first = d.get(b"St").ok().and_then(|o| self.resolve(o).as_i64().ok()).unwrap_or(1).max(1) as u64;
+            let prefix = match d.get(b"P").ok().map(|o| self.resolve(o)) {
+                Some(Object::String(raw, _) | Object::Name(raw)) => {
+                    if raw.len() > MAX_PREFIX_BYTES {
+                        return Err("a raw prefix exceeds 2050 bytes");
+                    }
+                    self.text(d, b"P").unwrap_or_default()
+                }
                 _ => String::new(),
             };
-            page.label = format!("{prefix}{number}");
-            if page.label.is_empty() {
-                page.label = (i + 1).to_string();
+            if prefix.len() > MAX_LABEL_BYTES {
+                return Err("a decoded prefix exceeds 1024 UTF-8 bytes");
+            }
+            let style = d.get(b"S").ok().and_then(|o| self.resolve(o).as_name().ok());
+            specs.insert(start, (first, prefix, style));
+        }
+        let mut staged = Vec::new();
+        let mut total = 0usize;
+        for (i, _) in pages.iter().enumerate() {
+            let Some((&start, (first, prefix, style))) = specs.range(..=i).next_back() else { continue };
+            let n = if matches!(*style, Some(b"D" | b"R" | b"r" | b"A" | b"a")) {
+                let offset = u64::try_from(i - start).map_err(|_| "a page number is too large")?;
+                first.checked_add(offset).ok_or("a page number overflows")?
+            } else {
+                0 // /St is unused when the label consists only of its prefix.
+            };
+            let remaining = MAX_LABEL_BYTES - prefix.len();
+            let number = match *style {
+                Some(b"D") => Some(n.to_string()),
+                Some(b"R" | b"r") => roman(n, remaining),
+                Some(b"A" | b"a") => alpha(n, remaining),
+                _ => Some(String::new()),
+            }
+            .filter(|number| number.len() <= remaining);
+            // A label too long to show keeps that page's physical number; other ranges stay.
+            let Some(mut number) = number else {
+                let note = format!(
+                    "labels from page {} exceed {MAX_LABEL_BYTES} UTF-8 bytes; those pages show their physical page numbers",
+                    start.saturating_add(1)
+                );
+                if !notes.contains(&note) {
+                    notes.push(note);
+                }
+                continue;
+            };
+            if matches!(*style, Some(b"R" | b"A")) {
+                number.make_ascii_uppercase();
+            }
+            let mut label = prefix.clone();
+            label.push_str(&number);
+            if label.is_empty() {
+                continue; // Keep the existing physical number for an empty custom label.
+            }
+            total = total.checked_add(label.len()).ok_or("the total label size overflows")?;
+            if total > MAX_LABEL_TOTAL_BYTES {
+                return Err("custom labels exceed 4 MiB in total");
+            }
+            staged.push((i, label));
+        }
+        // A malformed later range must not leave a partially applied custom label sequence.
+        for (i, label) in staged {
+            if let Some(page) = pages.get_mut(i) {
+                page.label = label;
             }
         }
+        Ok(notes)
     }
 
     // ── annotations ─────────────────────────────────────────────────────────────────────────
@@ -1002,37 +1099,9 @@ fn rect4(o: &Object) -> [f32; 4] {
     }
 }
 
-fn roman(mut n: usize) -> String {
-    const T: [(usize, &str); 13] = [
-        (1000, "m"),
-        (900, "cm"),
-        (500, "d"),
-        (400, "cd"),
-        (100, "c"),
-        (90, "xc"),
-        (50, "l"),
-        (40, "xl"),
-        (10, "x"),
-        (9, "ix"),
-        (5, "v"),
-        (4, "iv"),
-        (1, "i"),
-    ];
-    let mut s = String::new();
-    for (v, r) in T {
-        while n >= v {
-            s.push_str(r);
-            n -= v;
-        }
-    }
-    s
-}
-
-/// a..z, aa..zz, aaa.. (ISO 32000-2: "a to z for the first 26 pages, aa to zz for the next 26").
-fn alpha(n: usize) -> String {
-    let n = n.max(1) - 1;
-    let letter = (b'a' + (n % 26) as u8) as char;
-    std::iter::repeat_n(letter, n / 26 + 1).collect()
+fn label_work(left: &mut usize, count: usize) -> Result<(), &'static str> {
+    *left = left.checked_sub(count).ok_or("the number tree has too many entries")?;
+    Ok(())
 }
 
 /// `D:20260930104512-04'00'` → `2026-09-30 10:45`.
@@ -1172,11 +1241,202 @@ mod tests {
 
     #[test]
     fn roman_and_alpha_labels() {
-        assert_eq!(roman(4), "iv");
-        assert_eq!(roman(1994), "mcmxciv");
-        assert_eq!(alpha(1), "a");
-        assert_eq!(alpha(27), "aa");
-        assert_eq!(alpha(53), "aaa");
+        assert_eq!(roman(4, MAX_LABEL_BYTES).as_deref(), Some("iv"));
+        assert_eq!(roman(1994, MAX_LABEL_BYTES).as_deref(), Some("mcmxciv"));
+        assert_eq!(alpha(1, MAX_LABEL_BYTES).as_deref(), Some("a"));
+        assert_eq!(alpha(27, MAX_LABEL_BYTES).as_deref(), Some("aa"));
+        assert_eq!(alpha(53, MAX_LABEL_BYTES).as_deref(), Some("aaa"));
+    }
+
+    // Synthetic label-only inspection fixtures: never construct an explosive branching tree.
+    fn label_info(nums: Vec<Object>, kids: Vec<Object>) -> DocInfo {
+        let mut doc = Document::with_version("1.7");
+        let mut tree = Dictionary::new();
+        tree.set("Nums", nums);
+        tree.set("Kids", kids);
+        doc.objects.insert((6, 0), Object::Dictionary(tree));
+        let mut catalog = Dictionary::new();
+        catalog.set("Type", Object::Name(b"Catalog".to_vec()));
+        catalog.set("PageLabels", Object::Reference((6, 0)));
+        doc.objects.insert((1, 0), Object::Dictionary(catalog));
+        doc.trailer.set("Root", Object::Reference((1, 0)));
+        let mut info = DocInfo {
+            pages: (1..=3)
+                .map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() })
+                .collect(),
+            ..Default::default()
+        };
+        Inspector::new(&doc).fill(&mut info);
+        info
+    }
+
+    fn label_spec(style: &str, prefix: Vec<u8>, first: i64) -> Object {
+        let mut d = Dictionary::new();
+        d.set("S", Object::Name(style.as_bytes().to_vec()));
+        d.set("P", Object::String(prefix, lopdf::StringFormat::Hexadecimal));
+        d.set("St", first);
+        Object::Dictionary(d)
+    }
+
+    fn assert_label_fallback(info: &DocInfo) {
+        assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["1", "2", "3"]);
+        assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
+        assert!(info.warnings[0].contains("Page labels"), "{:?}", info.warnings);
+        assert!(info.warnings[0].contains("physical page numbers"), "{:?}", info.warnings);
+    }
+
+    #[test]
+    fn page_label_limits_keep_normal_pdf_numbering() {
+        for (style, first, expected) in [
+            ("r", 4, ["iv", "v", "vi"]),
+            ("R", 1994, ["MCMXCIV", "MCMXCV", "MCMXCVI"]),
+            ("a", 26, ["z", "aa", "bb"]),
+            ("A", 52, ["ZZ", "AAA", "BBB"]),
+        ] {
+            let info = label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), first)], Vec::new());
+            assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), expected);
+            assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+        }
+    }
+
+    #[test]
+    fn page_label_limits_reject_long_prefixes_without_partial_labels() {
+        for prefix in [vec![b'x'; 1025], vec![b'x'; 2051]] {
+            let nums = vec![Object::Integer(0), label_spec("D", b"ok-".to_vec(), 1), Object::Integer(1), label_spec("D", prefix, 1)];
+            assert_label_fallback(&label_info(nums, Vec::new()));
+        }
+    }
+
+    #[test]
+    fn page_label_limits_count_decoded_utf8_bytes() {
+        let mut prefix = vec![0xfe, 0xff];
+        for _ in 0..342 {
+            prefix.extend_from_slice(&0x2022u16.to_be_bytes());
+        }
+        assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec("", prefix, 1)], Vec::new()));
+    }
+
+    #[test]
+    fn page_label_limits_bound_roman_and_alpha_output() {
+        // Just 1025 output bytes on the old path, so RED does not consume excessive memory.
+        for (style, first) in [("r", 1_025_000), ("a", 26 * 1024 + 1)] {
+            assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), first)], Vec::new()));
+        }
+    }
+
+    #[test]
+    fn page_label_limits_detect_one_node_cycle() {
+        let nums = vec![Object::Integer(0), label_spec("D", b"custom-".to_vec(), 1)];
+        assert_label_fallback(&label_info(nums, vec![Object::Reference((6, 0))]));
+    }
+
+    #[test]
+    fn page_label_limits_accept_utf16_ascii_at_the_output_boundary() {
+        let mut prefix = vec![0xfe, 0xff];
+        for _ in 0..1023 {
+            prefix.extend_from_slice(&u16::from(b'x').to_be_bytes());
+        }
+        let info = label_info(vec![Object::Integer(0), label_spec("D", prefix, 1)], Vec::new());
+        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+        assert_eq!(info.pages[0].label, format!("{}1", "x".repeat(1023)));
+        assert!(info.pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
+    }
+
+    #[test]
+    fn page_label_limits_refuse_hostile_numbers_before_allocating() {
+        for style in ["r", "R", "a", "A"] {
+            assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), i64::MAX)], Vec::new()));
+        }
+        // Decimal labels remain small even when their first number exceeds 32-bit usize.
+        let info = label_info(vec![Object::Integer(0), label_spec("D", Vec::new(), i64::MAX)], Vec::new());
+        assert_eq!(info.pages[0].label, i64::MAX.to_string());
+        assert_eq!(info.pages[1].label, (i64::MAX as u64 + 1).to_string());
+        assert!(info.warnings.is_empty());
+    }
+
+    #[test]
+    fn page_label_limits_bound_wide_number_trees() {
+        assert_label_fallback(&label_info(Vec::new(), vec![Object::Null; MAX_LABEL_TREE_WORK + 1]));
+        let pair = [Object::Integer(0), label_spec("D", Vec::new(), 1)];
+        let nums = (0..MAX_LABEL_TREE_WORK).flat_map(|_| pair.clone()).collect();
+        assert_label_fallback(&label_info(nums, Vec::new()));
+    }
+
+    #[test]
+    fn page_label_limits_bound_total_custom_output_atomically() {
+        let doc = Document::with_version("1.7");
+        let mut tree = Dictionary::new();
+        tree.set("Nums", vec![Object::Integer(0), label_spec("", vec![b'x'; MAX_LABEL_BYTES], 1)]);
+        let mut catalog = Dictionary::new();
+        catalog.set("PageLabels", Object::Dictionary(tree));
+        let count = MAX_LABEL_TOTAL_BYTES / MAX_LABEL_BYTES + 1;
+        let mut pages: Vec<_> = (1..=count)
+            .map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() })
+            .collect();
+        let err = Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap_err();
+        assert!(err.contains("4 MiB"), "{err}");
+        assert!(pages.iter().enumerate().all(|(i, p)| p.label == (i + 1).to_string()));
+        // Exact aggregate boundary remains supported.
+        pages.pop();
+        Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap();
+        assert!(pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
+    }
+
+    #[test]
+    fn page_label_limits_handle_prefix_only_and_reference_cycles() {
+        let info = label_info(vec![Object::Integer(0), label_spec("", b"prefix".to_vec(), i64::MAX)], Vec::new());
+        assert!(info.warnings.is_empty());
+        assert!(info.pages.iter().all(|p| p.label == "prefix"));
+        let mut doc = Document::with_version("1.7");
+        doc.objects.insert((6, 0), Object::Reference((6, 0)));
+        let mut catalog = Dictionary::new();
+        catalog.set("PageLabels", Object::Reference((6, 0)));
+        assert!(Inspector::new(&doc).page_labels(&catalog, &mut []).unwrap_err().contains("cyclic"));
+    }
+
+    #[test]
+    fn page_label_limits_bound_depth_and_count_combined_work() {
+        for depth in [MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_DEPTH + 1] {
+            let mut child = Dictionary::new();
+            child.set("Nums", vec![Object::Integer(0), label_spec("D", b"custom-".to_vec(), 1)]);
+            let mut child = Object::Dictionary(child);
+            for _ in 1..depth {
+                let mut parent = Dictionary::new();
+                parent.set("Kids", vec![child]);
+                child = Object::Dictionary(parent);
+            }
+            let info = label_info(Vec::new(), vec![child]);
+            if depth == MAX_LABEL_TREE_DEPTH {
+                assert!(info.warnings.is_empty());
+                assert_eq!(info.pages[0].label, "custom-1");
+            } else {
+                assert_label_fallback(&info);
+            }
+        }
+        // Each array alone fits: their combined work still must be bounded.
+        let half = MAX_LABEL_TREE_WORK / 2;
+        let spec = label_spec("D", Vec::new(), 1);
+        let nums = (0..half).flat_map(|i| [Object::Integer(i as i64), spec.clone()]).collect();
+        assert_label_fallback(&label_info(nums, vec![Object::Null; half]));
+    }
+
+    #[test]
+    fn page_label_limits_keep_the_later_of_duplicate_ranges() {
+        let nums = vec![Object::Integer(0), label_spec("D", b"first-".to_vec(), 1), Object::Integer(0), label_spec("D", b"last-".to_vec(), 1)];
+        let info = label_info(nums, Vec::new());
+        assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["last-1", "last-2", "last-3"]);
+        assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
+        assert!(info.warnings[0].contains("twice"), "{:?}", info.warnings);
+    }
+
+    #[test]
+    fn page_label_limits_keep_other_ranges_when_one_is_too_long() {
+        // Page 1 is labelled normally; pages 2–3 would need over 1024 bytes of roman numerals.
+        let nums = vec![Object::Integer(0), label_spec("D", b"ok-".to_vec(), 1), Object::Integer(1), label_spec("r", Vec::new(), 1_025_000)];
+        let info = label_info(nums, Vec::new());
+        assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["ok-1", "2", "3"]);
+        assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
+        assert!(info.warnings[0].contains("physical page numbers"), "{:?}", info.warnings);
     }
 
     const ATTACHMENTS: &[u8] = b"%PDF-1.7

From a70c2b49382960353cfe2c489121bd013aeae92a Mon Sep 17 00:00:00 2001
From: cyfung1031 <44498510+cyfung1031@users.noreply.github.com>
Date: Sat, 10 Oct 2026 03:12:43 +0900
Subject: [PATCH 103/149] View: keep earlier tiles on screen while a zoom's new
 tiles render (#415)

* View: keep earlier tiles on screen while a zoom's new tiles render

Zooming a tiled page (larger than 4096 device pixels) dropped every tile
of the previous scale at once, so each zoom step fell back to the
2048 px backdrop until the new tiles arrived: the page went blurry on
every frame of a pinch. Tiles are now keyed by scale; those of earlier
zooms stay (nearest scale on top, at most 64) and are drawn stretched
under the current ones until those cover the page. Entering the tiled
range also keeps a whole-page raster sharper than the backdrop instead
of replacing it with the backdrop.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* hayro-syntax: fix float mantissa overflow on high-precision coordinates (#199)

jsPDF outputs double-precision floating-point coordinates with 16+ decimal
places in /MediaBox. In hayro-syntax, read_inner accumulated float mantissa
digits into u64 using wrapping arithmetic. Integer mantissas exceeding
u64::MAX wrapped modulo 2^64, severely corrupting page dimensions
(e.g., 3874.96 pt became 185.61 pt, rendering as a warped ribbon).

Accumulation now uses checked arithmetic: trailing fractional digits
exceeding u64 capacity are safely ignored without incrementing decimal_shift.
This preserves full IEEE-754 f64 precision while preventing overflow for
numbers with arbitrary numbers of decimal places.

Includes:
- Unit test in hayro-syntax with reported values and a 50-digit fraction.
- Synthetic PDF regression test in pdfcraft-render verifying inspect().
- Vendored patch (6) documentation in vendor/README.md.

Fixes #199

* M2: bound page-label work and output before applying labels

Share bounded PDF Roman and repeated-letter formatters between inspection
and editing. Bound tree traversal, raw and decoded prefixes, individual
labels and aggregate label output, with checked numbering arithmetic.

Stage inspection labels before applying them and retain physical page
numbers with a warning when optional labels cannot be processed. Reject
unsupported label edits before changing the document tree.

Add synthetic limit, cycle, Unicode, numbering and atomic-edit regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* Never crash: mesh shadings can't exhaust memory or run for minutes

`cargo xtask fuzz` (with the dash, JBIG2 and decompression fixes in
place) found a page whose Coons patch shading (type 6), a 147-byte
stream with 1-bit coordinates decoded onto +-40000, took the renderer
past 3 GB. hayro-interpret samples mesh shadings (types 4-7) pixel by
pixel over each triangle's device-space bounding box into a map, with
nothing but the u16 cast bounding it: up to 65536 x 65536 entries for
one triangle. A synthetic single patch passed 6 GB in six seconds; ten
thousand triangles that each cover half a 1000 x 1000 page ran for
minutes. Two rounds of review of earlier versions found more: every
patch was cut into 722 triangles (about 150 KB) before anything limited
them; a lattice mesh with `/VerticesPerRow 0` pushed empty rows forever,
and one with 4294967295 read the whole stream into one row; a mesh
painted a thousand times was triangulated a thousand times; and the
first caps cut content without a word.

Vendored hayro-interpret patch (18):
- `ShadingPattern::encode_within(area)`: the vendored hayro renderer
  passes the area it will actually draw (the path's bounding box on the
  canvas, which it already computes) plus a pixel for texels at a
  fractional edge, and triangles are sampled only inside it, so the map
  holds at most that area's pixels.
- `TriangleSampler`: at most 8 visits per pixel of that area plus 4 per
  triangle in it. A triangle's bounding box is about twice its area and a
  sub-pixel triangle's is at most 2 x 2 pixels, so tiling meshes and
  small dense ones (a patch in a few pixels is 722 triangles) still
  shade completely; overlapping ones stop.
- Coons and tensor-product patches are triangulated one at a time.
- Meshes hold at most `MAX_MESH_PATCHES` (2^16; a 200 x 200 gradient
  mesh is 40 thousand) patches and `MAX_MESH_TRIANGLES` (2^20)
  triangles, and a lattice needs two (ISO 32000-2 8.7.4.5.6) to 2^19
  vertices per row.
- A page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25; the 200 x 200
  mesh is 29 million) mesh triangles in all, reset per page like the
  existing paint budget.
- Each of these cuts logs a warning.
`encode()` keeps its signature; with no area it samples within a fixed
2^24 visits.

Synthetic regression tests in render:
- `mesh_shadings_far_off_the_page_render`: a Coons patch and a triangle
  mesh decoded onto +-40000 render and the rest of the page draws; a
  patch on the page, the part of the huge one that covers it, and a
  patch filling a 4 x 4 pt rectangle as a pattern are all shaded.
- `many_overlapping_mesh_triangles_finish`: 10,000 triangles each
  covering half of a 1000 x 1000 page finish, and are drawn.
- `mesh_shadings_with_many_patches_or_no_rows_finish`: 40,000 patches
  beside the page, and a lattice with `/VerticesPerRow 0`.
Red on main (out of memory, killed at 3.9 GB). Each part is pinned by a
mutation: no visit budget stalls past 60 s; no clip leaves the covering
patch unshaded; no per-triangle allowance leaves the small patch
unshaded; triangulating all patches first runs out of memory (killed at
5.8 GB); no rows check runs out of memory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Never crash: decompression bombs can't exhaust the renderer's memory

The renderer's parser (vendored hayro-syntax) decoded Flate, LZW and
RunLength streams with no output limit. A 2 MB page whose content
stream inflates to 2 GB, or whose 8 x 8 image does, took `pdfcraft-cli
render` and `text` past 3 GB in under a second, and a few more MB of
file scale it further. On the desktop that is the first-page render of
an emailed PDF, and the allocation-failure abort takes every open
document with it. Our own layers already bound single streams (lopdf's
load-time decoding at 256 MiB, cos at 1 GiB), so `info` stays at a few
MB; the renderer path didn't. Random mutation almost never makes a
high-ratio stream, so `cargo xtask fuzz` doesn't find this; found by
hand while triaging the fuzz run.

Vendored hayro-syntax patch (6):
- `decode_limit` gives each filter an output limit, and Flate (both
  flate2 and the fallback inflater), LZW and RunLength never write past
  it (the buffer can still grow to under twice it):
  `MAX_DECODED_STREAM`, 256 MiB, lopdf's figure; or, for the last filter
  of an image whose size, bits per component and components are known,
  twice its pixel bytes (a PNG predictor tag byte per byte at most),
  capped at 1 GiB. Earlier filters in a chain produce compressed data
  and get the general limit.
- `Stream::decoded_within(max)` for callers that budget.
- A page's `/Contents` array shares one `MAX_DECODED_STREAM` (naming one
  bomb twenty times decoded 5 GB), reserving exactly what it appends.

Vendored hayro-interpret patch (18):
- The content a page holds at once (its contents, and the forms, tiling
  patterns and Type 3 glyph procedures being painted) stays within
  `MAX_PAGE_CONTENT`, 512 MiB, reset per page like the existing paint
  budget. Forms nest fifty deep and each level kept its content while
  the next ran: a form painting itself around a 256 MiB stream would
  have held over 12 GB. Each level gives its bytes back when it is
  dropped, so content painted again and again keeps drawing, and a
  stream without filters (borrowed from the file) costs nothing.
- Type 0 sampled functions read every sample into a 4-byte value and
  then a table entry: 256 MiB of 1-bit samples asked for over 8 GB. They
  now take at most 2^21 table points and 2^23 values (the largest real
  tables, DeviceN tint transforms such as 33^4 points x 3 outputs, are
  1.2 million and 3.6 million), counted with checked arithmetic, and
  read no further than `/Size` asks. `/Size 0` no longer underflows
  building the default `/Encode`.

Three rounds of independent review found the aggregate cases, buffer
doubling past the limit, a chain/predictor shape the first image limit
would have truncated, the Type 0 amplifier, and a first, cumulative
budget that would have dropped legitimately repeated content, and a
first Type 0 cap low enough to refuse real tint transforms; all fixed
here.

Measured in a release build (render; OS peak commit):
- content stream inflating to 2 GB: 389 MB, 0.3 s
- 8 x 8 image inflating to 2 GB: 4 MB, 0.2 s
- /Contents naming it twenty times: 516 MB, 0.3 s
- a form painting itself around it: 644 MB, 0.4 s

Synthetic regression tests in render (flate2 is a new dev-dependency
there, already in the workspace):
- `decompression_bombs_stop_at_the_stream_limit`: 288 MiB bombs through
  flate2, the fallback inflater (a stored block with a wrong length
  check, which flate2 refuses and the fallback accepts), LZW and
  RunLength each decode exactly 256 MiB, and at most 128 bytes as an
  8 x 8 image.
- `page_contents_and_nested_forms_share_one_budget`: three /Contents
  references decode one stream's worth; a self-painting form finishes.
- `content_painted_again_and_again_keeps_drawing`: a 2 MiB form painted
  300 times draws the 300th time.
- `sampled_functions_with_billions_of_samples_are_refused`.
Ten mutations each turn them red: no limit at all; no limit in flate2,
the fallback, LZW, RunLength or for images; an unshared /Contents limit;
no page budget; no refund on drop; no Type 0 sample cap. (Taking a form
out of the budget no longer compiles: its content is the budget guard.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M2: normalize JPEG2000 samples without overflowing

Use bounded integer sample scaling for 1-32-bit JPX images and reject empty dimensions before chunking. Cover public decoding and continued page rendering with synthetic regressions.

Co-Authored-By: OpenAI Codex <codex@openai.com>

* M14: use adapter texture limits for HiDPI surfaces (#577)

Preserve the existing egui-wgpu device descriptor while enabling the
selected adapter's supported 2D texture extent. Cover the observed
8600-pixel Outlook startup surface and downlevel limit preservation.

Co-authored-by: Codex <noreply@openai.com>

* Never crash: decompression cut at its limit is logged, not silent; vendor README renumbered after #575

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: philkwek <philkwek03@gmail.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: James Locke <336218001+jcl-bit@users.noreply.github.com>
Co-authored-by: msaulc <103976208+msaulc@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                   |  2 ++
 apps/pdfcraft/src/main.rs    | 43 ++++++++++++++++++++++++++
 crates/ui-egui/src/canvas.rs | 55 ++++++++++++++++++++++++++++------
 crates/ui-egui/tests/view.rs | 58 ++++++++++++++++++++++++++++++++++++
 docs/development.md          |  8 +++++
 5 files changed, 157 insertions(+), 9 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 036eb652..2823b980 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -133,6 +133,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 - **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, JPX sample normalization):** JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
+
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
 
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 5d567b81..ae295990 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -390,6 +390,16 @@ fn write_control_file(path: &str, port: u16, token: &str) -> std::io::Result<()>
 ///   its window appeared. D3D12 is the native, best-supported backend there.
 fn configure_gpu(native: &mut eframe::NativeOptions) {
     let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &mut native.wgpu_options.wgpu_setup else { return };
+    // egui-wgpu requests only 8192 pixels even when the adapter can render larger surfaces.
+    // A restored 3440-point window at 250% DPI requests 8600 pixels and otherwise panics in
+    // Surface::configure before the app starts. Keep the renderer's other device requirements,
+    // but enable the adapter's actual 2D texture extent (also for smaller/downlevel adapters).
+    let device_descriptor = std::sync::Arc::clone(&setup.device_descriptor);
+    setup.device_descriptor = std::sync::Arc::new(move |adapter| {
+        let mut descriptor = device_descriptor(adapter);
+        descriptor.required_limits = surface_texture_limits(descriptor.required_limits, &adapter.limits());
+        descriptor
+    });
     if std::env::var_os("WGPU_POWER_PREF").is_none() {
         setup.power_preference = eframe::wgpu::PowerPreference::LowPower;
         #[cfg(target_os = "linux")]
@@ -419,6 +429,13 @@ fn configure_gpu(native: &mut eframe::NativeOptions) {
     }
 }
 
+/// Surface textures must fit the device's enabled limits, not just the physical GPU's limits.
+/// Changing only the 2D extent preserves egui-wgpu's backend-specific downlevel requirements.
+fn surface_texture_limits(mut required: eframe::wgpu::Limits, supported: &eframe::wgpu::Limits) -> eframe::wgpu::Limits {
+    required.max_texture_dimension_2d = supported.max_texture_dimension_2d;
+    required
+}
+
 /// A GPU with a connected monitor.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
@@ -555,6 +572,32 @@ mod tests {
         }
     }
 
+    #[test]
+    fn restored_hidpi_window_fits_the_adapters_surface_limit() {
+        // The Outlook launch crash: 3440 x 1369 saved points at 250% DPI requested this surface.
+        let (width, height) = (8600, 3423);
+        let required = eframe::wgpu::Limits::default();
+        assert!(width > required.max_texture_dimension_2d);
+        let supported = eframe::wgpu::Limits { max_texture_dimension_2d: 16384, ..required.clone() };
+        let enabled = super::surface_texture_limits(required, &supported);
+        assert!(width <= enabled.max_texture_dimension_2d);
+        assert!(height <= enabled.max_texture_dimension_2d);
+    }
+
+    #[test]
+    fn surface_limits_preserve_other_requirements_and_never_overrequest() {
+        for required in [eframe::wgpu::Limits::default(), eframe::wgpu::Limits::downlevel_webgl2_defaults()] {
+            for extent in [4096, 8192, 16384] {
+                let supported = eframe::wgpu::Limits { max_texture_dimension_2d: extent, ..required.clone() };
+                let enabled = super::surface_texture_limits(required.clone(), &supported);
+                let mut expected = required.clone();
+                expected.max_texture_dimension_2d = extent;
+                assert_eq!(enabled, expected);
+                assert_eq!(enabled.max_texture_dimension_2d, supported.max_texture_dimension_2d);
+            }
+        }
+    }
+
     #[test]
     fn winit_carries_the_windows_11_monitor_scale_fix() {
         // Issue #324: winit 0.30.13 as released nudges a window dragged onto a monitor with another
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index f985925e..11bc1cb1 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -222,8 +222,9 @@ pub struct DocView {
     thumbs: HashMap<usize, TextureHandle>,
     /// Thumbnails that are out of date (still shown until their replacement arrives).
     stale_thumbs: HashSet<usize>,
-    /// Sharp tiles of large pages: (page, tile x, tile y) → (scale tag, texture).
-    tiles: HashMap<(usize, u32, u32), (u64, TextureHandle)>,
+    /// Sharp tiles of large pages: (page, scale tag, tile x, tile y) → texture. Tiles of an
+    /// earlier zoom stay, drawn stretched, until those of the current one cover the page.
+    tiles: HashMap<(usize, u64, u32, u32), TextureHandle>,
     /// Text layers, extracted in the background on demand (selection, find, copy).
     pub(crate) texts: HashMap<usize, Arc<PageText>>,
     pub(crate) text_failed: HashSet<usize>,
@@ -520,7 +521,7 @@ impl DocView {
         if self.thumbs.contains_key(&page) {
             self.stale_thumbs.insert(page);
         }
-        self.tiles.retain(|(p, _, _), _| *p != page);
+        self.tiles.retain(|(p, _, _, _), _| *p != page);
         self.texts.remove(&page);
         self.text_failed.remove(&page);
         self.errors.remove(&page);
@@ -954,7 +955,7 @@ impl DocView {
             let page = r.request.page;
             if let Some(t) = r.request.tile {
                 let tex = ctx.load_texture(format!("tile-{:?}-{page}-{}-{}", self.id, t.x, t.y), img, TextureOptions::LINEAR);
-                self.tiles.insert((page, t.x / TILE, t.y / TILE), (r.request.tag, tex));
+                self.tiles.insert((page, r.request.tag, t.x / TILE, t.y / TILE), tex);
                 continue;
             }
             if r.request.tag & THUMB_TAG != 0 {
@@ -1046,6 +1047,14 @@ fn scale_tag(scale: f32) -> u64 {
     (f64::from(scale) * 65536.0).round() as u64
 }
 
+/// The scale of a raster tagged by [`scale_tag`].
+fn tag_scale(tag: u64) -> f32 {
+    (tag as f64 / 65536.0) as f32
+}
+
+/// Tiles of earlier zooms kept for a page while its current tiles are rendered.
+const OLD_TILES: usize = 64;
+
 /// `r` moved so its corner lies on a whole physical pixel, so that a raster drawn from there
 /// maps texel for texel onto the screen.
 fn snap_to_pixels(r: Rect, ppp: f32) -> Rect {
@@ -1590,7 +1599,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             // A backdrop, or a raster at an older scale until the new one arrives.
                             xf.paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
                         }
-                        if p.tag != want_tag {
+                        // Under tiles, a whole-page raster sharper than the backdrop (from before
+                        // the page grew past the tiling size) is a better backdrop: keep it.
+                        let sharper = tiled && p.tag != STALE_TAG && tag_scale(p.tag) >= want_scale;
+                        if p.tag != want_tag && !sharper {
                             wanted.push((i, want_scale, want_tag, None));
                         }
                     }
@@ -1613,6 +1625,21 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     let (v0, v1) = corners.iter().fold((1.0f32, 0.0f32), |(a, b), c| (a.min(c.1), b.max(c.1)));
                     let (vx0, vy0) = ((u0.max(0.0) * dw as f32) as u32, (v0.max(0.0) * dh as f32) as u32);
                     let (vx1, vy1) = (((u1.min(1.0) * dw as f32).ceil() as u32).min(dw), ((v1.min(1.0) * dh as f32).ceil() as u32).min(dh));
+                    // Tiles of earlier zooms first, stretched, the nearest scale last (on top):
+                    // until the current tiles arrive, a zoom shows them rather than the backdrop.
+                    let mut older: Vec<(f32, u32, u32, &TextureHandle)> = view
+                        .tiles
+                        .iter()
+                        .filter(|((p, t, _, _), _)| *p == i && *t != tag)
+                        .map(|((_, t, tx, ty), tex)| (tag_scale(*t), *tx, *ty, tex))
+                        .collect();
+                    older.sort_by(|a, b| (b.0 / scale).ln().abs().total_cmp(&(a.0 / scale).ln().abs()));
+                    for (s, tx, ty, tex) in older {
+                        let (ow, oh) = (device_pixels(pw_pt, s) as f32, device_pixels(ph_pt, s) as f32);
+                        let [w, h] = tex.size();
+                        let (x, y) = ((tx * TILE) as f32, (ty * TILE) as f32);
+                        xf.paint_image(painter, tex.id(), x / ow, y / oh, (x + w as f32) / ow, (y + h as f32) / oh);
+                    }
                     for ty in vy0 / TILE..=(vy1.saturating_sub(1)) / TILE {
                         for tx in vx0 / TILE..=(vx1.saturating_sub(1)) / TILE {
                             let (x, y) = (tx * TILE, ty * TILE);
@@ -1620,8 +1647,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             if w == 0 || h == 0 {
                                 continue;
                             }
-                            match view.tiles.get(&(i, tx, ty)) {
-                                Some((ttag, tex)) if *ttag == tag => {
+                            match view.tiles.get(&(i, tag, tx, ty)) {
+                                Some(tex) => {
                                     let (fw, fh) = (dw as f32, dh as f32);
                                     xf.texel_aligned([dw as usize, dh as usize], ppp).paint_image(
                                         painter,
@@ -2056,8 +2083,18 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let cur = view.current;
     // Nearest pages first; for each page, the backdrop before its tiles.
     wanted.sort_by_key(|w| ((w.0 as isize - cur as isize).unsigned_abs(), w.3.is_some()));
-    // Tiles for other zoom levels or far-away pages are useless: free them.
-    view.tiles.retain(|(p, _, _), (t, _)| *t == tag && p.abs_diff(cur) <= 2);
+    // Tiles of far-away pages are useless: free them. Tiles of other zooms stay only while a
+    // current tile of their page is still missing, at most `OLD_TILES` of them, nearest scale first.
+    let missing: HashSet<usize> = wanted.iter().filter(|w| w.3.is_some()).map(|w| w.0).collect();
+    view.tiles.retain(|(p, t, _, _), _| p.abs_diff(cur) <= 2 && (*t == tag || missing.contains(p)));
+    let mut older: Vec<(f32, (usize, u64, u32, u32))> =
+        view.tiles.keys().filter(|k| k.1 != tag).map(|k| ((tag_scale(k.1) / scale).ln().abs(), *k)).collect();
+    if older.len() > OLD_TILES {
+        older.sort_by(|a, b| a.0.total_cmp(&b.0));
+        for (_, k) in older.drain(OLD_TILES..) {
+            view.tiles.remove(&k);
+        }
+    }
     let mut queue: Vec<RenderRequest> =
         wanted.iter().map(|&(page, scale, tag, tile)| RenderRequest { page, kind: RequestKind::Pixels, tile, scale, tag }).collect();
     // Text layers: visible pages for selection, every page while a search is active.
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index a85daa48..479c58b7 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -818,3 +818,61 @@ fn compare_page_with_raster(h: &mut Harness<'static, PdfCraftApp>, pdf: &[u8], z
     }
     (sum as f64 / n as f64, worst)
 }
+
+#[test]
+fn zooming_a_tiled_page_shows_its_earlier_tiles_until_new_ones_arrive() {
+    let _gpu = gpu();
+    // A 1200 pt square page of fine lines (0.5 pt every 1.7 pt): tiled at 300 %.
+    let mut content = String::from("0 g\n");
+    for i in 0..670 {
+        let v = 30.0 + 1.7 * i as f32;
+        content.push_str(&format!("{v} 30 0.5 1140 re 30 {v} 1140 0.5 re\n"));
+    }
+    content.push_str("f\n");
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 1200 1200] /Contents 4 0 R >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    )
+    .into_bytes();
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 800.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("grid.pdf", None, pdf.clone()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("panel", "none").unwrap();
+        app.set_option("zoom", "300").unwrap();
+        app
+    });
+    for _ in 0..400 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    // Detail in the middle of the window: the summed difference between neighbouring pixels.
+    let detail = |h: &mut Harness<'static, PdfCraftApp>| {
+        let img = h.render().expect("renders");
+        let (cx, cy) = (img.width() / 2, img.height() / 2);
+        let mut sum = 0u64;
+        for y in cy - 100..cy + 100 {
+            for x in cx - 150..cx + 150 {
+                sum += u64::from(img.get_pixel(x, y)[0].abs_diff(img.get_pixel(x + 1, y)[0]));
+            }
+        }
+        sum
+    };
+    let sharp = detail(&mut h);
+    // The first frame at a new zoom has no tiles for it yet (they are requested at its end).
+    h.state_mut().set_option("zoom", "310").unwrap();
+    h.step();
+    let first = detail(&mut h);
+    assert!(first * 10 > sharp * 7, "the first frame after zooming lost its detail: {first} against {sharp}");
+}
diff --git a/docs/development.md b/docs/development.md
index aa46e0cd..a6b2c488 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -24,6 +24,14 @@ By default PdfCraft's own crates (`pdfcraft*`) log at `info` and everything else
 covers every target starting with it (`pdfcraft*=debug`). The logger is
 `apps/pdfcraft/src/logging.rs`. It never records the control-channel token or document passwords.
 
+## GPU surface limits
+
+The desktop renderer enables the selected adapter's supported 2D texture extent, while keeping
+egui-wgpu's other device requirements. Restored windows on mixed-DPI monitors can exceed its
+default 8192-pixel extent even when the GPU supports a larger surface (#577). The enabled extent
+never exceeds the adapter's capability; this does not make surfaces larger than the hardware
+limit renderable.
+
 ## Environment variables
 
 | Variable | Effect |

From 86ec14291cc4b7f1b0f5f705f255b34d6fed50ac Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 14:13:58 -0400
Subject: [PATCH 104/149] Fix main CI: move the rotated-field render test out
 of pdfcraft-forms (#591)

#516 added pdfcraft-render as a dev-dependency of pdfcraft-forms for one
rendering test. Both crates are layer 3, so `cargo xtask layers` (run in
CI) rejects the sideways edge and main went red. The test now lives in
crates/engine/tests/form_rotation.rs, where both crates are already
dependencies, and forms drops the dev-dependency. The parity evidence
points at the new location.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                           |  1 -
 crates/engine/tests/form_rotation.rs | 58 ++++++++++++++++++++++++++++
 crates/forms/Cargo.toml              |  1 -
 crates/forms/src/tests.rs            | 33 ----------------
 parity/acrobat-features.toml         |  2 +-
 5 files changed, 59 insertions(+), 36 deletions(-)
 create mode 100644 crates/engine/tests/form_rotation.rs

diff --git a/Cargo.lock b/Cargo.lock
index 7c17ee53..ad0ef873 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3642,7 +3642,6 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
- "pdfcraft-render",
  "thiserror 2.0.21",
 ]
 
diff --git a/crates/engine/tests/form_rotation.rs b/crates/engine/tests/form_rotation.rs
new file mode 100644
index 00000000..a125af7e
--- /dev/null
+++ b/crates/engine/tests/form_rotation.rs
@@ -0,0 +1,58 @@
+//! Rendering checks for form fields. They live here, not in pdfcraft-forms, because forms and
+//! render are both layer 3 and may not depend on each other, not even for tests.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::{Dict, Document, Object, SaveOptions, write_incremental};
+use pdfcraft_forms::{FieldProps, FieldValue, NewField, add_field, set_props, set_value};
+use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind};
+
+fn one_page() -> Document {
+    let mut doc = Document::new_empty();
+    let pages = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Pages").unwrap();
+    let mut p = Dict::new();
+    p.set(b"Type".to_vec(), Object::name("Page"));
+    p.set(b"Parent".to_vec(), Object::Ref(pages));
+    p.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 600.into(), 800.into()]));
+    let r = doc.add(p);
+    doc.update_dict(pages, |d| {
+        d.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(r)]));
+        d.set(b"Count".to_vec(), Object::Int(1));
+    })
+    .unwrap();
+    doc
+}
+
+/// Width and height of the dark pixels on page 1.
+fn ink_span(doc: &Document) -> (u32, u32) {
+    let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+    let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0 });
+    assert!(p.error.is_none(), "{:?}", p.error);
+    let (mut x0, mut y0, mut x1, mut y1) = (u32::MAX, u32::MAX, 0, 0);
+    let mut ink = false;
+    for y in 0..p.height {
+        for x in 0..p.width {
+            let i = ((y * p.width + x) * 4) as usize;
+            if p.rgba[i] < 200 {
+                ink = true;
+                (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
+            }
+        }
+    }
+    assert!(ink, "the field drew no text");
+    (x1 - x0, y1 - y0)
+}
+
+#[test]
+fn a_rotated_field_draws_along_the_vertical_edge() {
+    let mut doc = one_page();
+    add_field(&mut doc, 0, [10.0, 40.0, 90.0, 60.0], &NewField::Text { multiline: false }, Some("wide")).unwrap();
+    set_value(&mut doc, "wide", &FieldValue::Text("MMMMMM".into())).unwrap();
+    set_props(&mut doc, "wide", &FieldProps { font_size: Some(12.0), ..FieldProps::default() }).unwrap();
+    let (wide, tall) = ink_span(&doc);
+    assert!(wide > tall, "upright text is a horizontal run: {wide}x{tall}");
+    set_props(&mut doc, "wide", &FieldProps { rotation: Some((0, 90)), ..FieldProps::default() }).unwrap();
+    let (wide, tall) = ink_span(&doc);
+    assert!(tall > wide, "rotated text is a vertical run: {wide}x{tall}");
+}
diff --git a/crates/forms/Cargo.toml b/crates/forms/Cargo.toml
index ce6a73a5..3f085ee6 100644
--- a/crates/forms/Cargo.toml
+++ b/crates/forms/Cargo.toml
@@ -17,4 +17,3 @@ thiserror = { workspace = true }
 
 [dev-dependencies]
 hayro-syntax = { workspace = true }
-pdfcraft-render = { workspace = true }
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 6d5317ad..af1a8529 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1062,36 +1062,3 @@ fn a_rotation_refused_as_too_small_changes_nothing_else() {
     assert_eq!(f.tooltip, None, "the tooltip was written before the rotation was refused");
     assert_eq!(f.widgets[0].rotation, 0);
 }
-
-#[test]
-fn a_rotated_field_draws_along_the_vertical_edge() {
-    use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind};
-    let mut doc = one_page();
-    add_field(&mut doc, 0, [10.0, 40.0, 90.0, 60.0], &NewField::Text { multiline: false }, Some("wide")).unwrap();
-    set_value(&mut doc, "wide", &FieldValue::Text("MMMMMM".into())).unwrap();
-    set_props(&mut doc, "wide", &FieldProps { font_size: Some(12.0), ..FieldProps::default() }).unwrap();
-    let span = |doc: &Document| -> (u32, u32) {
-        let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
-        let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0 });
-        assert!(p.error.is_none(), "{:?}", p.error);
-        let (mut x0, mut y0, mut x1, mut y1) = (u32::MAX, u32::MAX, 0, 0);
-        let mut ink = false;
-        for y in 0..p.height {
-            for x in 0..p.width {
-                let i = ((y * p.width + x) * 4) as usize;
-                if p.rgba[i] < 200 {
-                    ink = true;
-                    (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
-                }
-            }
-        }
-        assert!(ink, "the field drew no text");
-        (x1 - x0, y1 - y0)
-    };
-    let (wide, tall) = span(&doc);
-    assert!(wide > tall, "upright text is a horizontal run: {wide}x{tall}");
-    set_props(&mut doc, "wide", &FieldProps { rotation: Some((0, 90)), ..FieldProps::default() }).unwrap();
-    let (wide, tall) = span(&doc);
-    assert!(tall > wide, "rotated text is a vertical run: {wide}x{tall}");
-}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 7a77624c..aba11b3c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4398,7 +4398,7 @@ milestone = "M6"
 status = "partial"
 commands = ["form.fields"]
 tools = ["form_fill", "form_set_props"]
-evidence = ["crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text", "crates/forms/src/tests.rs::rotated_fields_draw_in_their_quadrant", "crates/forms/src/tests.rs::a_rotated_field_draws_along_the_vertical_edge", "crates/automation/tests/automation.rs::rotating_a_field_through_tools", "crates/ui-egui/tests/prepare.rs::position_tab_rotates_a_field"]
+evidence = ["crates/forms/src/tests.rs::text_fields_get_new_appearances", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text", "crates/forms/src/tests.rs::rotated_fields_draw_in_their_quadrant", "crates/engine/tests/form_rotation.rs::a_rotated_field_draws_along_the_vertical_edge", "crates/automation/tests/automation.rs::rotating_a_field_through_tools", "crates/ui-egui/tests/prepare.rs::position_tab_rotates_a_field"]
 notes = "auto-size, comb, multiline, password, quadding, /MK colours and /MK /R rotation (0, 90, 180, 270); approximate Helvetica metrics"
 
 [[feature]]

From a48e1a3ffefc4264e122e616bf0bcf6d6f1b4e25 Mon Sep 17 00:00:00 2001
From: codyvogt <cody.vogt@caltechsurveys.com>
Date: Fri, 9 Oct 2026 11:24:18 -0700
Subject: [PATCH 105/149] View: the middle button pans instead of drawing with
 markup tools (#565)

egui's drag responses accept every pointer button, so on Windows and macOS a
middle-button drag reached the page tools: with Draw (ink) selected it drew a
stroke, and other tools cropped, selected or moved. Linux was unaffected
because its middle-click auto-scroll already blocks page input.

Outside Linux a middle-button drag that starts in the viewport (document or
Organize Pages) now pans 1:1 while the button is held, with a Grabbing
cursor, and page input is blocked from the press through the release. Linux
keeps its latched auto-scroll.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/src/autoscroll.rs | 163 ++++++++++++++++++++++++-------
 crates/ui-egui/src/canvas.rs     |   5 +
 crates/ui-egui/tests/comments.rs |  46 +++++++++
 crates/ui-egui/tests/control.rs  |  22 ++++-
 parity/acrobat-features.toml     |   4 +-
 5 files changed, 201 insertions(+), 39 deletions(-)

diff --git a/crates/ui-egui/src/autoscroll.rs b/crates/ui-egui/src/autoscroll.rs
index e025733f..139bdaed 100644
--- a/crates/ui-egui/src/autoscroll.rs
+++ b/crates/ui-egui/src/autoscroll.rs
@@ -1,4 +1,6 @@
-//! Linux middle-button scrolling for the document viewport.
+//! Middle-button scrolling for the document viewport: Linux latches auto-scroll, other
+//! platforms pan while the button is held. Either way the page tools never see the button,
+//! because egui's drag responses accept every pointer button.
 
 use egui::{Context, CursorIcon, Event, Key, PointerButton, Pos2, Stroke, Vec2, vec2};
 
@@ -17,6 +19,8 @@ pub(crate) struct AutoScroll {
     /// Own a cancelling click through its release, so it cannot also edit page content.
     cancel_button: Option<PointerButton>,
     block_input: bool,
+    /// Where the pointer was last frame during a held middle-button pan (not Linux).
+    drag: Option<Pos2>,
 }
 
 impl AutoScroll {
@@ -24,8 +28,14 @@ impl AutoScroll {
         self.anchor.is_some()
     }
 
+    /// Whether a held middle-button pan is under way (platforms without auto-scroll).
+    pub(crate) fn panning(&self) -> bool {
+        self.drag.is_some()
+    }
+
     pub(crate) fn cancel(&mut self) {
         self.anchor = None;
+        self.drag = None;
         self.cancel_button = None;
         self.block_input = false;
     }
@@ -41,10 +51,8 @@ impl AutoScroll {
     }
 
     fn update_for_platform(&mut self, ui: &egui::Ui, viewport: egui::Rect, organize: bool, supported: bool) -> Vec2 {
-        // Leave middle-button events and widget interactions to the existing platform behavior.
         if !supported {
-            self.cancel();
-            return Vec2::ZERO;
+            return self.update_drag(ui, viewport);
         }
         let ctx = ui.ctx();
         let (pointer, middle_press, middle_down, middle_released, cancel, cancel_button, dt) = ctx.input(|i| {
@@ -108,8 +116,51 @@ impl AutoScroll {
         vec2(0.0, delta)
     }
 
+    /// Without auto-scroll, a middle-button drag pans the view 1:1, like the Hand tool. Input is
+    /// blocked from the press through the release, so the drag cannot also draw, select or move.
+    fn update_drag(&mut self, ui: &egui::Ui, viewport: egui::Rect) -> Vec2 {
+        self.anchor = None;
+        self.cancel_button = None;
+        let ctx = ui.ctx();
+        let (pointer, middle_press, middle_down, middle_released, focused) = ctx.input(|i| {
+            (
+                i.pointer.latest_pos().filter(|p| p.is_finite()),
+                // Read the press event itself: later movement in this frame is part of the pan.
+                i.events.iter().find_map(|event| match event {
+                    Event::PointerButton { pos, button: PointerButton::Middle, pressed: true, .. } if pos.is_finite() => Some(*pos),
+                    _ => None,
+                }),
+                i.pointer.button_down(PointerButton::Middle),
+                i.pointer.button_released(PointerButton::Middle),
+                i.focused,
+            )
+        });
+        self.block_input = self.drag.is_some() || middle_press.is_some() || middle_down || middle_released;
+        if !focused {
+            self.drag = None;
+            return Vec2::ZERO;
+        }
+        if let Some(pressed_at) = middle_press
+            && self.drag.is_none()
+            && !ctx.egui_wants_keyboard_input()
+            && viewport.intersect(ui.clip_rect()).contains(pressed_at)
+            && ctx.layer_id_at(pressed_at) == Some(ui.layer_id())
+        {
+            self.drag = Some(pressed_at);
+        }
+        let (Some(last), Some(pointer)) = (self.drag, pointer) else { return Vec2::ZERO };
+        self.drag = middle_down.then_some(pointer);
+        // egui's delta moves the content, so the page follows the pointer.
+        let delta = pointer - last;
+        if delta.is_finite() { delta } else { Vec2::ZERO }
+    }
+
     /// Draw an original geometric marker at the activation point, above page content.
     pub(crate) fn paint(&self, ui: &egui::Ui, viewport: egui::Rect) {
+        if self.drag.is_some() {
+            ui.ctx().set_cursor_icon(CursorIcon::Grabbing);
+            return;
+        }
         let Some(anchor) = self.anchor else { return };
         let painter = ui.painter().with_clip_rect(viewport);
         let ink = ui.visuals().text_color();
@@ -154,38 +205,80 @@ fn scroll_delta(displacement: f32, dt: f32) -> f32 {
 mod tests {
     use super::*;
 
+    fn middle(pos: Pos2, pressed: bool) -> Event {
+        Event::PointerButton { pos, button: PointerButton::Middle, pressed, modifiers: egui::Modifiers::NONE }
+    }
+
+    /// Run one frame of the non-Linux path; `check` sees the pan delta inside the frame.
+    fn drag_frame(ctx: &Context, scroll: &mut AutoScroll, events: Vec<Event>, focused: bool, check: impl Fn(&AutoScroll, Vec2)) {
+        let mut output = ctx.run_ui(
+            egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, vec2(400.0, 400.0))), events, focused, ..Default::default() },
+            |ui| {
+                let delta = scroll.update_for_platform(ui, ui.max_rect(), false, false);
+                check(scroll, delta);
+            },
+        );
+        // This input-only test has no renderer to apply the generated font texture.
+        output.textures_delta.clear();
+    }
+
     #[test]
-    fn unsupported_platform_leaves_middle_button_and_escape_input_untouched() {
-        for previously_active in [false, true] {
-            let ctx = Context::default();
-            let pos = egui::pos2(100.0, 100.0);
-            let mut scroll = AutoScroll { anchor: previously_active.then_some(pos), block_input: previously_active, ..Default::default() };
-            let mut output = ctx.run_ui(
-                egui::RawInput {
-                    screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, vec2(400.0, 400.0))),
-                    events: vec![
-                        Event::PointerMoved(pos),
-                        Event::PointerButton { pos, button: PointerButton::Middle, pressed: true, modifiers: egui::Modifiers::NONE },
-                        Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE },
-                    ],
-                    ..Default::default()
-                },
-                |ui| {
-                    assert_eq!(scroll.update_for_platform(ui, ui.max_rect(), false, false), Vec2::ZERO);
-                    assert!(!scroll.active(), "unsupported platforms must not start or retain custom scrolling");
-                    assert!(!scroll.blocks_input(), "middle-button input must reach the existing widgets");
-                    scroll.paint(ui, ui.max_rect());
-                    assert_eq!(ctx.output(|o| o.cursor_icon), CursorIcon::Default, "no custom marker or cursor");
-                    assert!(!scroll.escape(&ctx));
-                    ctx.input(|i| {
-                        assert!(i.pointer.button_pressed(PointerButton::Middle));
-                        assert!(i.key_pressed(Key::Escape), "Escape must remain available to the existing shortcuts");
-                    });
-                },
-            );
-            // This input-only test has no renderer to apply the generated font texture.
-            output.textures_delta.clear();
-        }
+    fn middle_drag_pans_one_to_one_and_owns_the_button_until_release() {
+        let ctx = Context::default();
+        let mut scroll = AutoScroll::default();
+        let p = egui::pos2(100.0, 100.0);
+        // The first frame lays out the layer that later presses are tested against.
+        drag_frame(&ctx, &mut scroll, vec![], true, |_, _| {});
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(p), middle(p, true)], true, |s, d| {
+            assert_eq!(d, Vec2::ZERO);
+            assert!(s.panning() && s.blocks_input(), "the press itself must not reach the page tools");
+            assert!(!s.active(), "no auto-scroll latch outside Linux");
+        });
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(p + vec2(-30.0, 40.0))], true, |s, d| {
+            assert_eq!(d, vec2(-30.0, 40.0), "the page follows the pointer on both axes");
+            assert!(s.blocks_input());
+        });
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(p + vec2(-30.0, 50.0)), middle(p + vec2(-30.0, 50.0), false)], true, |s, d| {
+            assert_eq!(d, vec2(0.0, 10.0), "movement in the release frame still counts");
+            assert!(!s.panning());
+            assert!(s.blocks_input(), "the release must not finish a drawing drag");
+        });
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(p)], true, |s, d| {
+            assert_eq!(d, Vec2::ZERO, "nothing moves once the button is up");
+            assert!(!s.blocks_input());
+        });
+    }
+
+    #[test]
+    fn middle_drag_ignores_presses_outside_the_viewport_and_stops_when_focus_is_lost() {
+        let ctx = Context::default();
+        let mut scroll = AutoScroll::default();
+        let outside = egui::pos2(500.0, 100.0);
+        drag_frame(&ctx, &mut scroll, vec![], true, |_, _| {});
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(outside), middle(outside, true)], true, |s, _| assert!(!s.panning()));
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(outside + vec2(0.0, 50.0))], true, |_, d| assert_eq!(d, Vec2::ZERO));
+        drag_frame(&ctx, &mut scroll, vec![middle(outside, false)], true, |_, _| {});
+
+        let p = egui::pos2(100.0, 100.0);
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(p), middle(p, true)], true, |s, _| assert!(s.panning()));
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(p + vec2(0.0, 50.0))], false, |s, d| {
+            assert_eq!(d, Vec2::ZERO);
+            assert!(!s.panning(), "losing focus ends the pan");
+        });
+    }
+
+    #[test]
+    fn middle_drag_leaves_escape_to_the_existing_shortcuts() {
+        let ctx = Context::default();
+        let mut scroll = AutoScroll::default();
+        let p = egui::pos2(100.0, 100.0);
+        drag_frame(&ctx, &mut scroll, vec![], true, |_, _| {});
+        let escape = Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE };
+        drag_frame(&ctx, &mut scroll, vec![Event::PointerMoved(p), middle(p, true), escape], true, |s, _| {
+            assert!(s.panning());
+            assert!(ctx.input(|i| i.key_pressed(Key::Escape)), "Escape must remain available to the existing shortcuts");
+        });
+        assert!(!scroll.escape(&ctx));
     }
 
     #[test]
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 11bc1cb1..3084f623 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -337,6 +337,11 @@ impl DocView {
         self.auto_scroll.active()
     }
 
+    /// Whether a held middle-button pan is active, outside Linux (tests and automation).
+    pub fn middle_panning(&self) -> bool {
+        self.auto_scroll.panning()
+    }
+
     /// Pages that could not be rendered, with the reason (for automation; 0-based pages).
     pub fn page_errors(&self) -> Vec<(usize, &str)> {
         let mut v: Vec<(usize, &str)> = self.errors.iter().map(|(p, e)| (*p, e.as_str())).collect();
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index 3bade2c7..2544eeb3 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -594,6 +594,52 @@ fn attaching_a_file_as_a_comment() {
     assert_eq!(s.quick_tool, QuickTool::Select);
 }
 
+/// Drag with the middle button (the mouse wheel) in small steps.
+fn middle_drag(h: &mut Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2) {
+    let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Middle, pressed, modifiers: egui::Modifiers::NONE };
+    h.event(egui::Event::PointerMoved(from));
+    h.run_steps(1);
+    h.event(button(from, true));
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.event(egui::Event::PointerMoved(from + (to - from) * (k as f32 / 4.0)));
+        h.run_steps(1);
+    }
+    h.event(button(to, false));
+    h.run_steps(3);
+}
+
+#[test]
+fn a_middle_drag_with_a_drawing_tool_scrolls_instead_of_drawing() {
+    // egui's drag responses accept any button, so the drawing tools used to draw with the wheel.
+    let mut h = harness(|app| {
+        app.set_option("zoom", "400").unwrap();
+        app.set_option("quick", "ink").unwrap();
+    });
+    let from = at(&h, 150.0, 100.0);
+    let top = h.state().views[0].page_screen_rect(0).expect("page 1 on screen").top();
+    middle_drag(&mut h, from, from - egui::vec2(0.0, 120.0));
+    assert!(comments(&h).is_empty(), "{:?}", comments(&h));
+    let s = h.state();
+    assert!(!s.session.get(s.views[0].id).unwrap().dirty, "scrolling never edits the PDF");
+    assert!(!s.views[0].middle_panning(), "releasing the wheel ends the pan");
+    let moved = s.views[0].page_screen_rect(0).expect("page 1 on screen").top();
+    if cfg!(target_os = "linux") {
+        // Linux latches auto-scroll instead of panning with the drag.
+        assert!(s.views[0].auto_scrolling());
+    } else {
+        assert!((moved - (top - 120.0)).abs() < 1.0, "the page follows the pointer: {top} -> {moved}");
+    }
+    // The tool still draws with the primary button afterwards.
+    if cfg!(target_os = "linux") {
+        h.key_press(egui::Key::Escape);
+        h.run_steps(2);
+    }
+    drag_pt(&mut h, (60.0, 120.0), (200.0, 80.0));
+    let kinds: Vec<String> = comments(&h).into_iter().map(|a| a.subtype).collect();
+    assert_eq!(kinds, ["Ink"]);
+}
+
 #[test]
 fn erasing_part_of_a_drawing() {
     let mut h = harness(|app| app.set_option("quick", "ink").unwrap());
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index f21aee6d..28f62419 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -446,7 +446,7 @@ fn organize_pages_supports_autoscroll_without_selecting_or_reordering_pages() {
 
 #[cfg(not(target_os = "linux"))]
 #[test]
-fn middle_button_input_does_not_start_custom_scrolling_outside_linux() {
+fn middle_button_pans_while_held_outside_linux() {
     for organize in [false, true] {
         let (mut h, c) = harness_pages(40);
         h.state_mut().views[0].organize = organize;
@@ -455,8 +455,26 @@ fn middle_button_input_does_not_start_custom_scrolling_outside_linux() {
         ok(&mut h, &c, "ui.click", json!({ "x": p.x, "y": p.y, "button": "middle" }));
         ok(&mut h, &c, "ui.move", json!({ "x": p.x, "y": p.y + 50.0 }));
         h.run_steps(8);
-        assert!(!h.state().views[0].auto_scrolling(), "custom scrolling must be Linux-only: organize={organize}");
+        assert!(!h.state().views[0].auto_scrolling(), "a click does not latch auto-scroll outside Linux: organize={organize}");
+        assert!(!h.state().views[0].middle_panning(), "a released click leaves nothing to pan: organize={organize}");
     }
+    // A drag pans while the button is held, and the Crop tool never sees it.
+    let (mut h, c) = harness();
+    h.state_mut().set_option("zoom", "400").unwrap();
+    h.run_steps(3);
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Crop;
+    let p = h.state().views[0].viewport_rect().center();
+    let top = h.state().views[0].page_screen_rect(1).unwrap().top();
+    ok(&mut h, &c, "ui.drag", json!({ "from": [p.x, p.y], "to": [p.x, p.y - 60.0], "steps": 12, "button": "middle" }));
+    h.run_steps(2);
+    let moved = h.state().views[0].page_screen_rect(1).unwrap().top();
+    assert!((moved - (top - 60.0)).abs() < 1.0, "the page follows the pointer 1:1: {top} -> {moved}");
+    h.run_steps(8);
+    assert_eq!(h.state().views[0].page_screen_rect(1).unwrap().top(), moved, "no drift after release");
+    assert!(h.state().views[0].crop_drag.is_none(), "the Crop tool must not receive a wheel drag");
+    assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
 }
 
 #[test]
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index aba11b3c..08b790f0 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -902,8 +902,8 @@ milestone = "M3"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/control.rs::middle_click_autoscroll_latches_has_a_dead_zone_and_scrolls_both_directions", "crates/ui-egui/tests/control.rs::organize_pages_supports_autoscroll_without_selecting_or_reordering_pages", "crates/ui-egui/tests/control.rs::moving_before_middle_button_release_keeps_scrolling_without_starting_page_tools", "crates/ui-egui/tests/control.rs::farther_from_the_click_scrolls_faster_in_the_viewer_and_page_grid", "crates/ui-egui/tests/control.rs::autoscroll_uses_the_initial_click_position_when_input_arrives_in_one_frame", "crates/ui-egui/tests/control.rs::autoscroll_uses_elapsed_frame_time_and_preserves_fractional_motion_in_both_views"]
-notes = "Linux-only middle-button vertical autoscroll in the document and Organize Pages; other targets retain their existing middle-button input behavior. Click to toggle, release keeps scrolling on, and a Chromium-style nonlinear curve increases speed with vertical screen distance from the initial click. A 15-point dead zone pauses immediately. Continuous redraws use elapsed frame time and preserve fractional movement, tested at 30/60/120/144 fps. Cancels on another middle click, Escape, other pointer/wheel input, focus loss, tab changes and dialogs. Driven headlessly through the opt-in UI control channel (ui.click/ui.move/ui.drag). Keyboard-started timed scrolling is not implemented."
+evidence = ["crates/ui-egui/tests/control.rs::middle_click_autoscroll_latches_has_a_dead_zone_and_scrolls_both_directions", "crates/ui-egui/tests/control.rs::organize_pages_supports_autoscroll_without_selecting_or_reordering_pages", "crates/ui-egui/tests/control.rs::moving_before_middle_button_release_keeps_scrolling_without_starting_page_tools", "crates/ui-egui/tests/control.rs::farther_from_the_click_scrolls_faster_in_the_viewer_and_page_grid", "crates/ui-egui/tests/control.rs::autoscroll_uses_the_initial_click_position_when_input_arrives_in_one_frame", "crates/ui-egui/tests/control.rs::autoscroll_uses_elapsed_frame_time_and_preserves_fractional_motion_in_both_views", "crates/ui-egui/tests/control.rs::middle_button_pans_while_held_outside_linux", "crates/ui-egui/tests/comments.rs::a_middle_drag_with_a_drawing_tool_scrolls_instead_of_drawing"]
+notes = "Linux-only middle-button vertical autoscroll in the document and Organize Pages; Windows and macOS pan 1:1 while the middle button is held (Grabbing cursor, no latch). On every target the middle button never reaches the page tools, so it scrolls instead of drawing, selecting, cropping or moving. Click to toggle, release keeps scrolling on, and a Chromium-style nonlinear curve increases speed with vertical screen distance from the initial click. A 15-point dead zone pauses immediately. Continuous redraws use elapsed frame time and preserve fractional movement, tested at 30/60/120/144 fps. Cancels on another middle click, Escape, other pointer/wheel input, focus loss, tab changes and dialogs. Driven headlessly through the opt-in UI control channel (ui.click/ui.move/ui.drag). Keyboard-started timed scrolling is not implemented."
 
 [[feature]]
 id = "view.zoom-in-out"

From d1b7e986982150e7f4f1096db09d63d335f39d4a Mon Sep 17 00:00:00 2001
From: Max Abramowitz <max@1e6.org>
Date: Fri, 9 Oct 2026 14:24:32 -0400
Subject: [PATCH 106/149] Pages panel: keep a short page current; context menu
 and drag to reorder (#573)

* View: the middle button pans instead of drawing with markup tools

egui's drag responses accept every pointer button, so on Windows and macOS a
middle-button drag reached the page tools: with Draw (ink) selected it drew a
stroke, and other tools cropped, selected or moved. Linux was unaffected
because its middle-click auto-scroll already blocks page input.

Outside Linux a middle-button drag that starts in the viewport (document or
Organize Pages) now pans 1:1 while the button is held, with a Grabbing
cursor, and page input is blocked from the press through the release. Linux
keeps its latched auto-scroll.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: a short page gone to from the Pages panel stays current

The current page was whichever page showed most of itself. Going to a short
page (a cheque) above a tall one scrolls it to the top, where the tall page
below shows more, so the current page and the Pages panel's highlight moved
to the tall page instead of the one clicked. The page navigated to now stays
current while it is wholly on screen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: page operations from the Pages panel: context menu and drag to reorder

Right-clicking a thumbnail offers Extract pages, Cut, Copy and Paste after, on
the selection or on the page clicked (which becomes the selection), as the
organize grid does. Dragging thumbnails moves the selection, or the page
grabbed, to the gap it is dropped on: a bar marks the gap, the page count
follows the pointer, and the panel scrolls near its edges. The move is one
undoable step; the moved pages stay selected and the current page follows
its page. Documents that forbid assembly keep click-only thumbnails.

Parity: view.thumbnail-context-ops is shipped, with what it still lacks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Pages panel: only the primary button drags thumbnails; a drag left over after the panel closed or the document changed is dropped

---------

Co-authored-by: Cody Vogt <Cody.Vogt@caltechsurveys.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: William Max & Co. <info@williammax.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/src/canvas.rs    |  12 ++-
 crates/ui-egui/src/panels.rs    | 142 +++++++++++++++++++++++++++++++-
 crates/ui-egui/tests/editing.rs |  37 +++++++++
 crates/ui-egui/tests/viewer.rs  |  59 +++++++++++++
 parity/acrobat-features.toml    |   6 +-
 5 files changed, 248 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 3084f623..948d153f 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -285,6 +285,8 @@ pub struct DocView {
     pub sign: crate::sign_ui::SignView,
     /// Organize: the pages being dragged to a new place.
     pub org_drag: Option<Vec<usize>>,
+    /// Pages panel: the pages being dragged to a new place.
+    pub panel_drag: Option<Vec<usize>>,
     /// Marquee Zoom / Snapshot: the rectangle being dragged (page, start), and a finished one.
     pub marquee: Option<(usize, Pos2)>,
     pub marquee_done: Option<crate::zoom_snap::Marquee>,
@@ -417,6 +419,7 @@ impl DocView {
             crop_drag: None,
             sign: Default::default(),
             org_drag: None,
+            panel_drag: None,
             marquee: None,
             marquee_done: None,
             fill_text: None,
@@ -446,6 +449,8 @@ impl DocView {
         self.goto_point = None;
         self.zoom_anchor = None;
         self.flash = None;
+        // A thumbnail drag holds page indexes from before the change.
+        self.panel_drag = None;
     }
 
     /// Pages an organize command acts on: the selection, or the current page.
@@ -1544,6 +1549,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         let mut current = view.current;
         let mut best_overlap = -1.0f32;
         let mut current_overlap = -1.0f32;
+        let mut current_height = f32::INFINITY;
         let pointer = ui.input(|i| i.pointer.hover_pos());
         for &i in &visible_pages {
             let r = snap_to_pixels(rects[i].translate(origin.to_vec2()), ppp);
@@ -1559,6 +1565,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             let overlap = r.intersect(visible).height();
             if i == view.current {
                 current_overlap = overlap;
+                current_height = r.height();
             }
             // Pages shown equally (two rows wholly on screen) differ only by rounding: the
             // topmost one counts.
@@ -2006,7 +2013,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         }
         // The page navigated to stays current while no page shows more of itself, so the next
         // page step starts from it rather than from a page further down the screen (#188).
-        if current_overlap >= best_overlap - TIE {
+        // It also stays current while it is wholly on screen: a short page (a cheque) gone to
+        // from the Pages panel shows less of itself than the tall page below it, and must not
+        // hand the highlight to that page.
+        if current_overlap >= best_overlap - TIE || current_overlap >= current_height - TIE {
             current = view.current;
         }
         if view.layout != PageLayout::Single {
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 377636f4..738d61de 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -546,7 +546,7 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                             outline_item(ui, &t, info, item, &[i], info.outline.len(), &mut ctx);
                         }
                     }
-                    RightPanel::Pages => pages(ui, &t, info, view, modal, &mut nav),
+                    RightPanel::Pages => pages(ui, &t, info, view, modal, bm_editable, &mut nav),
                     RightPanel::Fields => fields(ui, &t, info, &doc.form, preparing, &mut nav, &mut panel_edit),
                     RightPanel::Layers => {
                         if info.layers.is_empty() {
@@ -895,8 +895,10 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
 }
 
 /// The page thumbnails. A click goes to the page; ⌘/Ctrl-click and ⇧-click pick several pages
-/// (the selection page commands and Print act on) without moving the document.
-fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocView, modal: bool, nav: &mut Option<Nav>) {
+/// (the selection page commands and Print act on) without moving the document. Right-click
+/// offers Extract, Cut, Copy and Paste on the selection, or on the page clicked; dragging
+/// moves the selection, or the page grabbed, to the gap it is dropped on.
+fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocView, modal: bool, editable: bool, nav: &mut Option<Nav>) {
     // Escape drops the selection while the pointer is over the panel and nothing else wants the key.
     if !modal
         && !view.selected.is_empty()
@@ -907,10 +909,24 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
         view.clear_page_selection(Some(view.current));
     }
     let w = (ui.available_width() - 40.0).min(150.0);
+    let mut rows: Vec<Rect> = Vec::with_capacity(info.pages.len());
+    let mut dropped = false;
     for (i, p) in info.pages.iter().enumerate() {
         ui.vertical_centered(|ui| {
             let h = w * p.height / p.width.max(1.0);
-            let (rect, resp) = ui.allocate_exact_size(vec2(w + 16.0, h + 16.0), Sense::click());
+            let sense = if editable { Sense::click_and_drag() } else { Sense::click() };
+            let (rect, resp) = ui.allocate_exact_size(vec2(w + 16.0, h + 16.0), sense);
+            rows.push(rect);
+            // Only the primary button drags pages (the middle button scrolls, the secondary one opens the menu).
+            if resp.drag_started_by(egui::PointerButton::Primary) {
+                if !view.target_pages().contains(&i) {
+                    view.click_page(i, egui::Modifiers::NONE, true);
+                }
+                view.panel_drag = Some(view.target_pages());
+            }
+            if resp.drag_stopped() {
+                dropped = true;
+            }
             let info = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
             let picked = view.selected.contains(&i);
             resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, picked, info.clone()));
@@ -945,9 +961,98 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
                     *nav = Some(Nav::Page(i));
                 }
             }
+            resp.context_menu(|ui| {
+                // A page outside the selection becomes the selection, as in the organize grid.
+                if !view.target_pages().contains(&i) {
+                    view.click_page(i, egui::Modifiers::NONE, true);
+                }
+                if ui.button(tl!("Extract pages")).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::Extract);
+                    ui.close();
+                }
+                ui.separator();
+                if ui.add_enabled(editable, egui::Button::new(tl!("Cut"))).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::CopyPages { cut: true });
+                    ui.close();
+                }
+                if ui.button(tl!("Copy")).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::CopyPages { cut: false });
+                    ui.close();
+                }
+                if ui.add_enabled(editable, egui::Button::new(tl!("Paste after"))).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::PastePages);
+                    ui.close();
+                }
+            });
         });
         ui.add_space(4.0);
     }
+    page_drag(ui, t, view, &rows, dropped);
+}
+
+/// The gap (0 = before the first page, n = after the last) the pointer points at in the Pages
+/// panel, whose thumbnails are `rows`, top to bottom.
+fn panel_gap(rows: &[Rect], y: f32) -> Option<usize> {
+    let (i, r) = rows.iter().enumerate().min_by(|(_, a), (_, b)| (a.center().y - y).abs().total_cmp(&(b.center().y - y).abs()))?;
+    Some(if y < r.center().y { i } else { i + 1 })
+}
+
+/// Where page `p` goes when `moving` (sorted) move to `to` (counted without them).
+fn moved_index(p: usize, moving: &[usize], to: usize) -> usize {
+    match moving.iter().position(|m| *m == p) {
+        Some(k) => to + k,
+        None => {
+            let rest = p.saturating_sub(moving.iter().filter(|m| **m < p).count());
+            if rest >= to { rest + moving.len() } else { rest }
+        }
+    }
+}
+
+/// While thumbnails are dragged: a bar on the gap they would go to, the page count by the
+/// pointer, and scrolling near the panel's edges. On release, queue the move.
+fn page_drag(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, rows: &[Rect], dropped: bool) {
+    let Some(mut moving) = view.panel_drag.clone() else { return };
+    // A drag that ended while the panel was closed (or elsewhere) leaves nothing to drop.
+    if !dropped && !ui.input(|i| i.pointer.primary_down()) {
+        view.panel_drag = None;
+        return;
+    }
+    let pointer = ui.input(|i| i.pointer.interact_pos());
+    let gap = pointer.and_then(|p| panel_gap(rows, p.y));
+    if let (Some(gap), Some(first), Some(last)) = (gap, rows.first(), rows.last()) {
+        let y = rows.get(gap).map_or(last.bottom() + 20.0, |r| r.top() - 3.0);
+        ui.painter().line_segment([pos2(first.left(), y), pos2(first.right(), y)], Stroke::new(3.0, t.accent));
+    }
+    if let Some(p) = pointer {
+        let n = moving.len();
+        let what = if n == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &n.to_string())]) };
+        ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, what, theme::medium(12.0), t.accent_text);
+        let clip = ui.clip_rect();
+        let edge = 40.0;
+        if p.y < clip.top() + edge {
+            ui.scroll_with_delta(vec2(0.0, 10.0));
+        } else if p.y > clip.bottom() - edge {
+            ui.scroll_with_delta(vec2(0.0, -10.0));
+        }
+        ui.ctx().request_repaint();
+    }
+    if !dropped {
+        return;
+    }
+    view.panel_drag = None;
+    let Some(gap) = gap else { return };
+    moving.sort_unstable();
+    moving.dedup();
+    let Some(&first) = moving.first() else { return };
+    // `to` counts positions without the moving pages.
+    let to = gap.saturating_sub(moving.iter().filter(|x| **x < gap).count());
+    let contiguous = moving.windows(2).all(|w| w[1] == w[0] + 1);
+    if contiguous && to == first {
+        return;
+    }
+    view.current = moved_index(view.current, &moving, to);
+    view.selected = (to..to + moving.len()).collect();
+    view.pending_edit = Some(pdfcraft_engine::Edit::MovePages { pages: moving, to });
 }
 
 /// The Fields panel: fields by page, in tab order. While preparing a form, each field can move
@@ -1043,6 +1148,35 @@ pub fn human_size(n: usize) -> String {
     }
 }
 
+#[cfg(test)]
+mod page_moves {
+    use super::{moved_index, panel_gap};
+    use egui::{Rect, pos2};
+
+    /// Above a thumbnail's middle is the gap before it; below is the gap after it.
+    #[test]
+    fn the_gap_follows_the_nearest_thumbnail() {
+        let rows: Vec<Rect> = (0..3).map(|i| Rect::from_min_max(pos2(0.0, i as f32 * 100.0), pos2(50.0, i as f32 * 100.0 + 90.0))).collect();
+        assert_eq!(panel_gap(&rows, -20.0), Some(0));
+        assert_eq!(panel_gap(&rows, 30.0), Some(0));
+        assert_eq!(panel_gap(&rows, 60.0), Some(1));
+        assert_eq!(panel_gap(&rows, 260.0), Some(3));
+        assert_eq!(panel_gap(&rows, 900.0), Some(3));
+        assert_eq!(panel_gap(&[], 10.0), None);
+    }
+
+    /// The current page follows a move, whether it moved or others moved around it.
+    #[test]
+    fn pages_keep_their_identity_across_a_move() {
+        // [0 1 2 3 4], move [1 2] to the end: [0 3 4 1 2].
+        let order: Vec<usize> = (0..5).map(|p| moved_index(p, &[1, 2], 3)).collect();
+        assert_eq!(order, [0, 3, 4, 1, 2]);
+        // Move [3] to the front: [3 0 1 2 4].
+        let order: Vec<usize> = (0..5).map(|p| moved_index(p, &[3], 0)).collect();
+        assert_eq!(order, [1, 2, 3, 0, 4]);
+    }
+}
+
 #[cfg(test)]
 mod label_column {
     use super::ellipsized_prefix;
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 8225ecf3..8bd6e7c7 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -1898,3 +1898,40 @@ fn print_shortcut_offers_the_pages_picked_in_the_pages_panel() {
     h.get_by_label("Selected pages (2)");
     h.get_by_label("Sheet 1 of 2");
 }
+
+#[test]
+fn dragging_pages_panel_thumbnails_reorders_pages() {
+    let mut h = harness(4, |app| app.right = Some(pdfcraft_ui_egui::RightPanel::Pages));
+    let before = page_texts(h.state());
+    // The Pages panel is on the right; the document view may label its pages too.
+    let thumb = |h: &Harness<'static, PdfCraftApp>, label: &str| {
+        h.get_all_by_label(label).map(|n| n.rect()).max_by(|a, b| a.left().total_cmp(&b.left())).expect("the thumbnail")
+    };
+    // Grab page 3 (page 4 is below the window) and drop it above page 1.
+    let (from, to) = (thumb(&h, "Page 3").center(), thumb(&h, "Page 1").center_top() + egui::vec2(0.0, 4.0));
+    drag(&mut h, from, to);
+    h.run_steps(4);
+    let after = page_texts(h.state());
+    assert_eq!(after, vec![before[2].clone(), before[0].clone(), before[1].clone(), before[3].clone()], "{after:?}");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Move page"));
+    let view = &h.state().views[0];
+    assert_eq!(view.selected.iter().copied().collect::<Vec<_>>(), vec![0], "the moved page stays selected");
+    assert!(view.panel_drag.is_none());
+}
+
+#[test]
+fn a_thumbnail_drag_that_ends_off_the_panel_or_outlives_the_pages_is_dropped() {
+    let mut h = harness(4, |app| app.right = Some(pdfcraft_ui_egui::RightPanel::Pages));
+    let before = page_texts(h.state());
+    // A drag left over (the panel closed mid-drag, the button released elsewhere) moves nothing.
+    h.state_mut().views[0].panel_drag = Some(vec![2]);
+    h.run_steps(2);
+    assert!(h.state().views[0].panel_drag.is_none());
+    assert_eq!(page_texts(h.state()), before);
+    // A change to the document drops page indexes taken before it.
+    h.state_mut().views[0].panel_drag = Some(vec![3]);
+    let id = h.state().views[0].id;
+    let info = h.state().session.get(id).unwrap().info.clone();
+    h.state_mut().views[0].document_changed(&info);
+    assert!(h.state().views[0].panel_drag.is_none());
+}
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index 312f6b35..ebac7540 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -676,3 +676,62 @@ fn page_down_steps_every_spread_when_several_fit_on_screen() {
         assert_eq!(up, [9, 7, 5, 3, 1, 0], "{fit:?}");
     }
 }
+
+/// Open `sizes` in Fit width, continuous, with the Pages panel showing.
+fn pages_panel_harness(sizes: &[(u32, u32)]) -> Harness<'static, PdfCraftApp> {
+    let bytes = sized_fixture(sizes);
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("cheques.pdf", None, bytes).unwrap();
+        app.right = Some(pdfcraft_ui_egui::RightPanel::Pages);
+        app
+    });
+    h.run_steps(6);
+    h.state_mut().active = Some(0);
+    h.state_mut().views[0].fit = pdfcraft_ui_egui::canvas::Fit::Width;
+    h.run_steps(6);
+    h
+}
+
+/// A thumbnail in the Pages panel (the panel lists pages as "Page n" buttons).
+fn thumbnail(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Pos2 {
+    h.get_all_by_label(label).find(|n| n.rect().left() > 1000.0).expect("the Pages panel thumbnail").rect().center()
+}
+
+/// Press and release `button` at `at`.
+fn press(h: &mut Harness<'static, PdfCraftApp>, at: egui::Pos2, button: egui::PointerButton) {
+    h.hover_at(at);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: at, button, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: at, button, pressed: false, modifiers: Default::default() });
+}
+
+#[test]
+fn a_short_page_gone_to_from_the_pages_panel_stays_current() {
+    // A short page (a cheque) above a tall one: going to it scrolls it to the top, where the tall
+    // page below shows more of itself. The current page, and the Pages panel's highlight, moved
+    // to the tall page.
+    let mut h = pages_panel_harness(&[(600, 250), (600, 1800), (600, 250), (600, 1800)]);
+    for page in [1, 0, 2] {
+        let at = thumbnail(&h, &format!("Page {}", page + 1));
+        press(&mut h, at, egui::PointerButton::Primary);
+        h.run_steps(6);
+        assert_eq!(h.state().views[0].current, page, "clicked page {}", page + 1);
+    }
+}
+
+#[test]
+fn pages_panel_thumbnails_have_a_context_menu() {
+    let mut h = pages_panel_harness(&[(200, 300); 4]);
+    let at = thumbnail(&h, "Page 3");
+    press(&mut h, at, egui::PointerButton::Secondary);
+    h.run_steps(2);
+    // The page right-clicked becomes the selection the menu acts on.
+    assert_eq!(h.state().views[0].target_pages(), vec![2]);
+    for item in ["Extract pages", "Cut", "Paste after"] {
+        h.get_by_label(item);
+    }
+    h.get_by_label("Copy").click();
+    h.run_steps(3);
+    assert_eq!(h.state().page_clipboard.as_ref().map(|c| c.pages.clone()), Some(vec![2]));
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 08b790f0..96afa5e6 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1235,11 +1235,11 @@ title = "Page operations from the thumbnails panel (drag reorder, context menu)"
 area = "B"
 tier = "P1"
 milestone = "M4"
-status = "planned"
+status = "shipped"
 commands = []
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/viewer.rs::pages_panel_thumbnails_have_a_context_menu"]
+notes = "Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy and Paste after. Not yet: Rotate, Delete, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
 
 [[feature]]
 id = "view.bookmarks-panel"

From f28cbbcdd9ced4055e0ab862baad1fc6c6453ec0 Mon Sep 17 00:00:00 2001
From: Sameh Elhawary <basio20044@gmail.com>
Date: Fri, 9 Oct 2026 21:24:45 +0300
Subject: [PATCH 107/149] M4: zoom the Organize page grid (#468)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M4: zoom the Organize page grid

The page grid draws its pages at 50% to 300%: toolbar buttons with a
percentage that resets to 100%, trackpad pinch or Ctrl/⌘ + wheel about
the page under the pointer, and ⌘+ / ⌘− / ⌘0 (which no longer change the
hidden page view's zoom while the grid shows).

Thumbnails are re-rendered sharper in a few steps as the grid grows,
capped so one document's thumbnails stay within 256 MB. The page under
the pointer (or the first one in view) stays where it is across a zoom.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: zoomed grid pages are rendered at the size drawn

A zoomed page grid stretched 132 pt thumbnails, and the stepped detail
that was meant to help was capped by a memory budget, so a long document
stayed blurry at any zoom.

Pages drawn larger than their thumbnails now get a render at exactly the
size drawn while they are in view; the thumbnail stands in until it
arrives. Only pages in view keep one, so memory no longer depends on the
page count, and thumbnails go back to their one fixed size.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* View: the middle button pans instead of drawing with markup tools

egui's drag responses accept every pointer button, so on Windows and macOS a
middle-button drag reached the page tools: with Draw (ink) selected it drew a
stroke, and other tools cropped, selected or moved. Linux was unaffected
because its middle-click auto-scroll already blocks page input.

Outside Linux a middle-button drag that starts in the viewport (document or
Organize Pages) now pans 1:1 while the button is held, with a Grabbing
cursor, and page input is blocked from the press through the release. Linux
keeps its latched auto-scroll.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: a short page gone to from the Pages panel stays current

The current page was whichever page showed most of itself. Going to a short
page (a cheque) above a tall one scrolls it to the top, where the tall page
below shows more, so the current page and the Pages panel's highlight moved
to the tall page instead of the one clicked. The page navigated to now stays
current while it is wholly on screen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: page operations from the Pages panel: context menu and drag to reorder

Right-clicking a thumbnail offers Extract pages, Cut, Copy and Paste after, on
the selection or on the page clicked (which becomes the selection), as the
organize grid does. Dragging thumbnails moves the selection, or the page
grabbed, to the gap it is dropped on: a bar marks the gap, the page count
follows the pointer, and the panel scrolls near its edges. The move is one
undoable step; the moved pages stay selected and the current page follows
its page. Documents that forbid assembly keep click-only thumbnails.

Parity: view.thumbnail-context-ops is shipped, with what it still lacks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Pages panel: only the primary button drags thumbnails; a drag left over after the panel closed or the document changed is dropped

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cody Vogt <Cody.Vogt@caltechsurveys.com>
Co-authored-by: William Max & Co. <info@williammax.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                    |  20 ++--
 ROADMAP.md                          |   2 +
 crates/ui-egui/src/canvas.rs        | 175 +++++++++++++++++++++++++---
 crates/ui-egui/src/control.rs       |   1 +
 crates/ui-egui/src/i18n/bg.tsv      |   3 +
 crates/ui-egui/src/i18n/de.tsv      |   3 +
 crates/ui-egui/src/i18n/es.tsv      |   3 +
 crates/ui-egui/src/i18n/fr.tsv      |   3 +
 crates/ui-egui/src/i18n/hu.tsv      |   3 +
 crates/ui-egui/src/i18n/ja.tsv      |   3 +
 crates/ui-egui/src/i18n/ru.tsv      |   3 +
 crates/ui-egui/src/i18n/uk.tsv      |   3 +
 crates/ui-egui/src/i18n/zh-hans.tsv |   3 +
 crates/ui-egui/src/i18n/zh-hant.tsv |   3 +
 crates/ui-egui/src/lib.rs           |  13 ++-
 crates/ui-egui/tests/editing.rs     | 115 ++++++++++++++++++
 parity/acrobat-features.toml        |   8 +-
 17 files changed, 334 insertions(+), 30 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index b33510f3..85926623 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2d56f8464f3c25efe9737b204db34cef012ea3716f4d78209d9abeaf0ea9393b"
+sha256 = "844da6ed41f9baf939e1a99042dec5904447ca82fb5662c4361a9a809adb19f8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b0ca648560c45e554447aae8dba37c1c9c636c86b277d00fceeb2a21b474c8f7"
+sha256 = "e049f7df877d07137465cbe7ead240c9cd60daaaeb298f4877eb58974c728004"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e9a9bad1252afdcb42c36b24ca85411f8c63df7debada94d4423bd48761ecb05"
+sha256 = "f47c19dcf7272068dc8b46a37eb692948f5571737f6c1c82e8282f1b7d64458d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0351382a91d2df51da3d45e25a09af87a081bc88e3496c3512ad89f5d4460a3a"
+sha256 = "8fd69fd5e769259b99b059adb3a9d2fb90489bf561d62113ff8d25227495e122"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "57f52e3671a322938a160ac11b73b1f55fb6311140f20d89ae12c9a91a0500d6"
+sha256 = "8b380ba241bc25a05289717a3bfa4ea580be1c78b43c91d54c72de9c024b06eb"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e505c00bcc8b8af6aec27abf84bebac7a1925c632130411000a6c57241816193"
+sha256 = "ab089d2dab457a727158c3414dbe28b4edc3231cd30b5092feeeed3d8feca8a5"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "c198f1de831d7f9c853baa6977894ccc34d94e6b36c772c2e53fc5b0e0fe708b"
+sha256 = "59ec12395bc45ed15a0de3b2d0878d2ea250bfd9e9372103d8869b142bcc675f"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9682b2c3c28449dc63637cb5962b309df3ad7db7e8d96bf8bb0f0bc386c9c611"
+sha256 = "ca7c441f30dc116349f0aa523e8a6cfc8e019bf7ff73f377f0264f9dcda9f133"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "319b032d2c50097ec14e2c7eab92e8696d33e198aeac3585ff46e98c61dec90f"
+sha256 = "cba0c2ca8989a28aa41056b98eb1c8019e3a13e882ead246ea1d69f82c44e087"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f3a03fc466c1f956cbd44a5cad101c53db5ffc80b3b7551a273ac41f43263dd5"
+sha256 = "bdb59f15d5659bd54fb4316b37f3e50f7c352640aeef1860be87700682d3bb48"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index 2823b980..698d314d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -140,6 +140,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M2, bounded page labels):** Inspector number trees have shared work, depth, and cycle limits; prefixes are bounded before decoding and complete custom labels have per-label and aggregate UTF-8 byte caps. A refused tree leaves physical page numbers intact and records one warning, with custom labels applied only after every range succeeds. Pure COS Roman and repeated-letter formatters are shared with Organize; label queries and edits return errors for unsupported output before changing the stored tree, while ordinary labels and prefix-only ranges remain supported. Synthetic tests cover safe just-over-limit cases, large first numbers, aliases, cycles, wide/deep trees, UTF-16/UTF-8 boundaries, aggregate output, and unchanged refused edits. Milestone and overall effort estimates unchanged (about 30–35%).
 
+- **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 948d153f..d0f6e953 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -23,6 +23,8 @@ const MARGIN: f32 = 28.0;
 const SIDE: f32 = 70.0;
 const THUMB_TAG: u64 = 1 << 63;
 const TEXT_TAG: u64 = 1 << 62;
+/// A page rendered for the organize grid at the size it is drawn there.
+const GRID_TAG: u64 = 1 << 61;
 /// The tag of a raster that is out of date (shown until its replacement arrives).
 const STALE_TAG: u64 = u64::MAX;
 /// Pages whose raster would exceed this many device pixels on a side are drawn in tiles.
@@ -303,6 +305,29 @@ pub struct DocView {
     /// The page-grid gap under the pointer this frame (where dropped files go), when it can
     /// take pages.
     pub grid_gap: Option<usize>,
+    /// How large the page grid draws its pages (1.0 = the usual thumbnails).
+    grid_zoom: f32,
+    /// A zoom asked for this frame (toolbar, pinch, keys); the grid applies it once it has laid
+    /// out, so it can keep the same pages in view.
+    grid_zoom_request: Option<f32>,
+    /// The page to keep in place after a grid zoom, and how far below the top of the grid its
+    /// cell was.
+    grid_anchor: Option<(usize, f32)>,
+    /// Sharp renders of the pages the grid shows larger than a thumbnail: only those in view,
+    /// at the size drawn (device pixels wide).
+    grid_pages: HashMap<usize, (u32, TextureHandle)>,
+}
+
+/// The page grid's zoom range and the step of its buttons and keys.
+pub const GRID_ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.5..=3.0;
+const GRID_ZOOM_STEP: f32 = 1.25;
+/// How far a sharp grid render may be from the size drawn before it is redone: a pinch changes
+/// the size on every frame, and a slightly soft or slightly large image is fine meanwhile.
+const GRID_SHARP: std::ops::RangeInclusive<f32> = 0.9..=1.6;
+
+/// Whether an image `have` device pixels wide is good enough to draw `want` pixels wide.
+fn sharp_enough(have: u32, want: f32) -> bool {
+    want > 0.0 && GRID_SHARP.contains(&(have as f32 / want))
 }
 
 /// Organize-toolbar actions that need the app (file pickers, new tabs, dialogs).
@@ -408,6 +433,10 @@ impl DocView {
             pending_action: None,
             insert_at: None,
             grid_gap: None,
+            grid_zoom: 1.0,
+            grid_zoom_request: None,
+            grid_anchor: None,
+            grid_pages: HashMap::new(),
             comments: Default::default(),
             measure: Default::default(),
             forms: Default::default(),
@@ -509,6 +538,8 @@ impl DocView {
             p.tag = STALE_TAG;
         }
         self.stale_thumbs.extend(self.thumbs.keys().copied());
+        // Pages may have moved: a sharp render of another page would be worse than a soft one.
+        self.grid_pages.clear();
         self.tiles.clear();
         self.texts.clear();
         self.text_failed.clear();
@@ -901,6 +932,23 @@ impl DocView {
         true
     }
 
+    /// How large the page grid draws its pages (1.0 = the usual thumbnails).
+    pub fn grid_zoom(&self) -> f32 {
+        self.grid_zoom
+    }
+
+    /// Zoom the page grid; out-of-range values are clamped and nonsense is ignored.
+    pub fn set_grid_zoom(&mut self, zoom: f32) {
+        if zoom.is_finite() {
+            self.grid_zoom = zoom.clamp(*GRID_ZOOM_RANGE.start(), *GRID_ZOOM_RANGE.end());
+        }
+    }
+
+    /// How many device pixels wide the grid's sharp render of `page` is, if it has one.
+    pub fn grid_page_pixels(&self, page: usize) -> Option<u32> {
+        self.grid_pages.get(&page).map(|(w, _)| *w)
+    }
+
     /// Zoom keeping the centre of the view still.
     pub fn set_zoom(&mut self, zoom: f32) {
         let centre = self.viewport_screen.center();
@@ -968,7 +1016,10 @@ impl DocView {
                 self.tiles.insert((page, r.request.tag, t.x / TILE, t.y / TILE), tex);
                 continue;
             }
-            if r.request.tag & THUMB_TAG != 0 {
+            if r.request.tag & GRID_TAG != 0 {
+                let tex = ctx.load_texture(format!("grid-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+                self.grid_pages.insert(page, (r.width, tex));
+            } else if r.request.tag & THUMB_TAG != 0 {
                 let tex = ctx.load_texture(format!("thumb-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
                 self.thumbs.insert(page, tex);
                 self.stale_thumbs.remove(&page);
@@ -1205,15 +1256,29 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
     if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::Minus)) {
         view.rotate_view(false);
     }
-    if pressed(cmd(Key::Plus)) || pressed(cmd(Key::Equals)) {
-        view.zoom_step(true);
-    }
-    if pressed(cmd(Key::Minus)) {
-        view.zoom_step(false);
-    }
-    if pressed(cmd(Key::Num0)) {
-        view.fit = Fit::Page;
-        view.goto = Some((view.current, 0.0));
+    // In the page grid ⌘+ / ⌘− / ⌘0 size its pages instead (looking is always allowed).
+    let (zoom_in, zoom_out, zoom_reset) = (pressed(cmd(Key::Plus)) || pressed(cmd(Key::Equals)), pressed(cmd(Key::Minus)), pressed(cmd(Key::Num0)));
+    if view.organize {
+        if zoom_in {
+            view.grid_zoom_request = Some(view.grid_zoom * GRID_ZOOM_STEP);
+        }
+        if zoom_out {
+            view.grid_zoom_request = Some(view.grid_zoom / GRID_ZOOM_STEP);
+        }
+        if zoom_reset {
+            view.grid_zoom_request = Some(1.0);
+        }
+    } else {
+        if zoom_in {
+            view.zoom_step(true);
+        }
+        if zoom_out {
+            view.zoom_step(false);
+        }
+        if zoom_reset {
+            view.fit = Fit::Page;
+            view.goto = Some((view.current, 0.0));
+        }
     }
     if pressed(cmd(Key::Num1)) {
         view.set_zoom(1.0);
@@ -2834,6 +2899,30 @@ fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: b
                 if save.on_hover_text(tl!("Save these pages as one PDF")).on_disabled_hover_text(tl!("No changes to save")).clicked() {
                     view.pending_action = Some(ViewAction::Save);
                 }
+                ui.add_space(8.0);
+                // Page size in the grid (right to left: in, the percentage, out).
+                let zoom = view.grid_zoom;
+                if ui
+                    .add_enabled_ui(zoom < *GRID_ZOOM_RANGE.end(), |ui| icons::button(ui, "zoom-in", 30.0, false, tl!("Larger pages")))
+                    .inner
+                    .clicked()
+                {
+                    view.grid_zoom_request = Some(zoom * GRID_ZOOM_STEP);
+                }
+                let percent = egui::Button::new(egui::RichText::new(format!("{:.0}%", zoom * 100.0)).font(theme::medium(12.0)).color(t.text_muted))
+                    .frame(false);
+                let percent = ui.add_sized([44.0, 30.0], percent);
+                percent.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Reset page size")));
+                if percent.on_hover_text(tl!("Reset page size")).clicked() {
+                    view.grid_zoom_request = Some(1.0);
+                }
+                if ui
+                    .add_enabled_ui(zoom > *GRID_ZOOM_RANGE.start(), |ui| icons::button(ui, "zoom-out", 30.0, false, tl!("Smaller pages")))
+                    .inner
+                    .clicked()
+                {
+                    view.grid_zoom_request = Some(zoom / GRID_ZOOM_STEP);
+                }
             });
         });
     });
@@ -2901,7 +2990,9 @@ fn organize_grid(
     t: &Tokens,
 ) {
     let ppp = ui.ctx().pixels_per_point();
-    let cell = vec2(190.0, 250.0);
+    // The page image scales with the zoom; the padding and the page number don't.
+    let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 56.0);
+    let anchor = view.grid_anchor.take();
     let mut open_page = None;
     organize_toolbar(view, info, editable, dirty, ui, t);
     let viewport = ui.available_rect_before_wrap();
@@ -2914,6 +3005,9 @@ fn organize_grid(
     };
     let middle_gesture = view.auto_scroll.blocks_input();
     let mut cells: Vec<(usize, Rect)> = Vec::with_capacity(info.pages.len());
+    // The pages in view that are drawn larger than their thumbnails, and those of them that
+    // need a sharper render than they have.
+    let (mut in_view, mut sharper): (Vec<usize>, Vec<RenderRequest>) = (Vec::new(), Vec::new());
     let mut drop = false;
     egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
         if middle_gesture {
@@ -2936,6 +3030,9 @@ fn organize_grid(
                 let c = Rect::from_min_size(pos2(row_rect.left() + left + col as f32 * cell.x, row_rect.top()), cell);
                 let resp = ui.interact(c, ui.id().with(("org", i)), if editable { Sense::click_and_drag() } else { Sense::click() });
                 cells.push((i, c));
+                if let Some((_, above)) = anchor.filter(|(page, _)| *page == i) {
+                    ui.scroll_to_rect_animation(c.translate(vec2(0.0, -above)), Some(egui::Align::Min), egui::style::ScrollAnimation::none());
+                }
                 // Drag pages to move them (the selection, or the page grabbed).
                 if resp.drag_started() {
                     if !view.selected.contains(&i) {
@@ -2963,7 +3060,19 @@ fn organize_grid(
                 }
                 ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
                 ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
-                if let Some(tex) = view.thumbs.get(&i) {
+                // A page drawn larger than its thumbnail gets a render at the size drawn, while
+                // it is in view; until that arrives the thumbnail stands in.
+                let want = size.x * ppp;
+                let thumb = view.thumbs.get(&i);
+                let thumb_ok = thumb.is_some_and(|t| t.size()[0] as f32 >= want * GRID_SHARP.start());
+                let sharp = view.grid_pages.get(&i).filter(|_| !thumb_ok);
+                if !thumb_ok && ui.is_rect_visible(c) {
+                    in_view.push(i);
+                    if !sharp.is_some_and(|(w, _)| sharp_enough(*w, want)) && !view.errors.contains_key(&i) {
+                        sharper.push(RenderRequest { page: i, kind: RequestKind::Pixels, tile: None, scale: want / p.width.max(1.0), tag: GRID_TAG });
+                    }
+                }
+                if let Some(tex) = sharp.map(|(_, t)| t).or(thumb) {
                     ui.painter().image(tex.id(), pr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
                 }
                 ui.painter().rect_stroke(pr, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
@@ -3072,11 +3181,30 @@ fn organize_grid(
         }
     }
     view.auto_scroll.paint(ui, viewport);
+    // Pinch, or Ctrl/⌘ with the wheel, zooms the grid about the page under the pointer.
+    let pinch = ui.input(|i| i.zoom_delta());
+    if (pinch - 1.0).abs() > 0.001 && pointer.is_some() && !middle_gesture {
+        view.grid_zoom_request = Some(view.grid_zoom * pinch);
+    }
+    if let Some(zoom) = view.grid_zoom_request.take() {
+        let before = view.grid_zoom;
+        view.set_grid_zoom(zoom);
+        if view.grid_zoom != before {
+            // Keep the page under the pointer (or else the first one in view) where it is.
+            let under = pointer.and_then(|p| cells.iter().find(|(_, r)| r.contains(p)));
+            let anchor = under.or_else(|| cells.iter().find(|(_, r)| r.bottom() > viewport.top()));
+            view.grid_anchor = anchor.map(|(i, r)| (*i, r.top() - viewport.top()));
+            ui.ctx().request_repaint();
+        }
+    }
+    // Sharp renders are kept only for the pages in view, so their memory stays small however
+    // long the document is. They come first; the thumbnails of the other pages follow.
+    view.grid_pages.retain(|page, _| in_view.contains(page));
     let s = THUMB_W * ppp / info.pages.iter().map(|p| p.width).fold(1.0, f32::max);
-    let queue: Vec<RenderRequest> = (0..info.pages.len())
+    let thumbs = (0..info.pages.len())
         .filter(|p| (!view.thumbs.contains_key(p) || view.stale_thumbs.contains(p)) && !view.errors.contains_key(p))
-        .map(|page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: s, tag: THUMB_TAG })
-        .collect();
+        .map(|page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: s, tag: THUMB_TAG });
+    let queue: Vec<RenderRequest> = sharper.into_iter().chain(thumbs).collect();
     if queue != view.last_queue {
         pool.set_queue(queue.clone());
         view.last_queue = queue;
@@ -3123,6 +3251,23 @@ trailer << /Root 1 0 R >>
         assert_eq!(img.pixels.as_ptr().cast::<u8>(), at, "the renderer's own buffer");
     }
 
+    #[test]
+    fn grid_zoom_is_clamped_and_sharp_renders_tolerate_a_pinch() {
+        assert!(sharp_enough(900, 876.0) && sharp_enough(800, 876.0) && sharp_enough(1300, 876.0));
+        assert!(!sharp_enough(264, 876.0), "a thumbnail stretched over a zoomed page");
+        assert!(!sharp_enough(876, 200.0), "far larger than drawn: wasteful");
+        assert!(!sharp_enough(100, 0.0) && !sharp_enough(100, f32::NAN));
+        let mut v = view(3, PageLayout::Continuous);
+        for odd in [f32::NAN, f32::INFINITY] {
+            v.set_grid_zoom(odd);
+            assert_eq!(v.grid_zoom(), 1.0);
+        }
+        v.set_grid_zoom(99.0);
+        assert_eq!(v.grid_zoom(), 3.0);
+        v.set_grid_zoom(-4.0);
+        assert_eq!(v.grid_zoom(), 0.5);
+    }
+
     fn view(pages: usize, layout: PageLayout) -> DocView {
         let info = pdfcraft_render::DocInfo {
             pages: (0..pages)
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index b80135ff..37bdb425 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -553,6 +553,7 @@ impl Host for crate::PdfCraftApp {
                 "fit": format!("{:?}", v.fit),
                 "layout": format!("{:?}", v.layout),
                 "organize": v.organize,
+                "grid_zoom": v.grid_zoom(),
                 // Pages picked in the organize grid or the Pages panel (empty: the current page).
                 "selected_pages": v.selected.iter().map(|p| p + 1).collect::<Vec<_>>(),
                 "auto_scrolling": v.auto_scrolling(),
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index fb9f352b..11982108 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2049,3 +2049,6 @@ action wizard	Start	Старт
 	Remove from Recent	Премахни от последно отваряните
 	Remove {name} from Recent	Премахни {name} от последно отваряните
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартните шрифтове не могат да покажат „{c}“ ({code}). Засега като текст могат да се добавят само западноевропейски символи.
+	Larger pages	По-големи страници
+	Smaller pages	По-малки страници
+	Reset page size	Възстанови размера на страниците
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 888c6eef..01d601e2 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2087,3 +2087,6 @@ action wizard	Start	Starten
 	Remove from Recent	Aus „Zuletzt geöffnet“ entfernen
 	Remove {name} from Recent	{name} aus „Zuletzt geöffnet“ entfernen
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Die Standardschriften können „{c}“ ({code}) nicht darstellen. Derzeit lassen sich nur westeuropäische Zeichen als Text hinzufügen.
+	Larger pages	Größere Seiten
+	Smaller pages	Kleinere Seiten
+	Reset page size	Seitengröße zurücksetzen
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index b478e910..4973979b 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2005,3 +2005,6 @@
 	Couldn't import the signature image: {e}	No se pudo importar la imagen de la firma: {e}
 	Go to page…	Ir a la página…
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Las fuentes estándar no pueden mostrar «{c}» ({code}). Por ahora solo se pueden añadir como texto caracteres de Europa occidental.
+	Larger pages	Páginas más grandes
+	Smaller pages	Páginas más pequeñas
+	Reset page size	Restablecer el tamaño de las páginas
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index c027fbaa..251618fa 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2040,3 +2040,6 @@
 	No recent files	Aucun fichier récent
 	Go to page…	Aller à la page…
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Les polices standard ne peuvent pas afficher « {c} » ({code}). Pour l'instant, seuls les caractères d'Europe occidentale peuvent être ajoutés comme texte.
+	Larger pages	Pages plus grandes
+	Smaller pages	Pages plus petites
+	Reset page size	Rétablir la taille des pages
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index b0989516..acb523c0 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2085,3 +2085,6 @@ action wizard	Start	Indítás
 	Rotation:	Elforgatás:
 	Line ending	Vonalvég
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	A szabványos betűtípusok nem tudják megjeleníteni ezt: „{c}” ({code}). Egyelőre csak nyugat-európai karakterek adhatók hozzá szövegként.
+	Larger pages	Nagyobb oldalak
+	Smaller pages	Kisebb oldalak
+	Reset page size	Oldalméret visszaállítása
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 103f4cba..341515b6 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1981,3 +1981,6 @@
 	Go to page…	ページへ移動…
 	Reopen the files that were open when PdfCraft last closed	前回 PdfCraft を閉じたときに開いていたファイルを再度開く
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準フォントでは「{c}」（{code}）を表示できません。現在、テキストとして追加できるのは西ヨーロッパの文字のみです。
+	Larger pages	ページを大きく表示
+	Smaller pages	ページを小さく表示
+	Reset page size	ページサイズをリセット
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index bd29398e..d9a0995f 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2001,3 +2001,6 @@
 	Created a PDF from the first {n} files	PDF создан из первых файлов: {n}
 	Go to page…	Перейти на страницу…
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартные шрифты не могут отобразить «{c}» ({code}). Пока в виде текста можно добавлять только западноевропейские символы.
+	Larger pages	Крупнее страницы
+	Smaller pages	Мельче страницы
+	Reset page size	Сбросить размер страниц
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 623b8a4f..084417c9 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2107,3 +2107,6 @@ calendar date	December	грудня
 	Rotation:	Поворот:
 	Line ending	Закінчення лінії
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартні шрифти не можуть відобразити «{c}» ({code}). Поки що як текст можна додавати лише західноєвропейські символи.
+	Larger pages	Більші сторінки
+	Smaller pages	Менші сторінки
+	Reset page size	Скинути розмір сторінок
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 90636c35..19059258 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2051,3 +2051,6 @@
 	Couldn't import the signature image: {e}	无法导入签名图像：{e}
 	Go to page…	转到页面…
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	标准字体无法显示“{c}”（{code}）。目前只能添加西欧字符作为文本。
+	Larger pages	放大页面
+	Smaller pages	缩小页面
+	Reset page size	重置页面大小
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index b6efd14a..c7982efa 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1974,3 +1974,6 @@
 	Go to page…	轉到頁面…
 	Reopen the files that were open when PdfCraft last closed	重新開啟上次關閉 PdfCraft 時開啟的檔案
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準字型無法顯示「{c}」（{code}）。目前只能新增西歐字元作為文字。
+	Larger pages	放大頁面
+	Smaller pages	縮小頁面
+	Reset page size	重設頁面大小
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 46edd4bf..93c81a94 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -1420,6 +1420,14 @@ impl PdfCraftApp {
                     self.view_defaults.with_zoom(value).ok_or("default-zoom must be fit-width, fit-page or a percentage from 8 to 6400")?;
             }
             ("organize", Some(v)) => v.organize = value != "off",
+            // `--grid-zoom 150`: the size of the pages in the organize grid, in percent.
+            ("grid-zoom", Some(v)) => {
+                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
+                if !percent.is_finite() || !canvas::GRID_ZOOM_RANGE.contains(&(percent / 100.0)) {
+                    return Err("grid-zoom must be between 50 and 300".into());
+                }
+                v.set_grid_zoom(percent / 100.0);
+            }
             ("rotate", Some(v)) => {
                 let deg: u16 = value.parse().map_err(|_| "rotate: 0, 90, 180 or 270")?;
                 if !deg.is_multiple_of(90) {
@@ -1506,7 +1514,10 @@ impl PdfCraftApp {
                 v.comments.selected = Some((p.saturating_sub(1), i.saturating_sub(1)));
                 v.comments.reveal = true;
             }
-            (k, None) if ["page", "zoom", "layout", "cover", "organize", "fields", "find", "rotate", "select", "notice", "comment"].contains(&k) => {
+            (k, None)
+                if ["page", "zoom", "layout", "cover", "organize", "grid-zoom", "fields", "find", "rotate", "select", "notice", "comment"]
+                    .contains(&k) =>
+            {
                 return Err(format!("`{k}` needs an open document"));
             }
             (other, _) => return Err(format!("unknown option {other}")),
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 8bd6e7c7..a0d02e84 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -1227,6 +1227,117 @@ fn files_dropped_outside_the_page_grid_still_open_as_documents() {
     assert_eq!(texts_of(h.state(), 0), ["Page 1", "Page 2"]);
 }
 
+fn grid_zoom(h: &Harness<'static, PdfCraftApp>) -> f32 {
+    h.state().views[0].grid_zoom()
+}
+
+#[test]
+fn page_grid_zooms_with_its_buttons_keys_and_pinch() {
+    let mut h = organize(12);
+    let width = |h: &Harness<'static, PdfCraftApp>| h.get_by_label("Page 2").rect().left() - h.get_by_label("Page 1").rect().left();
+    let usual = width(&h);
+    h.get_by_label("Larger pages").click();
+    h.run_steps(3);
+    assert_eq!(grid_zoom(&h), 1.25);
+    assert!(width(&h) > usual + 20.0, "the pages are drawn larger");
+    h.get_by_label("Reset page size").click();
+    h.run_steps(3);
+    assert_eq!((grid_zoom(&h), width(&h)), (1.0, usual));
+    h.get_by_label("Smaller pages").click();
+    h.run_steps(3);
+    assert_eq!(grid_zoom(&h), 0.8);
+    assert!(width(&h) < usual - 20.0);
+    // Keys.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Num0);
+    h.run_steps(2);
+    assert_eq!(grid_zoom(&h), 1.0);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Equals);
+    h.run_steps(2);
+    assert_eq!(grid_zoom(&h), 1.25);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Minus);
+    h.run_steps(2);
+    assert_eq!(grid_zoom(&h), 1.0);
+    // Pinch (or Ctrl/⌘ + wheel) over the grid; elsewhere it leaves the grid alone.
+    let page = h.get_by_label("Page 1").rect().center();
+    h.hover_at(page);
+    h.run_steps(1);
+    h.event(egui::Event::Zoom(1.5));
+    h.run_steps(2);
+    assert_eq!(grid_zoom(&h), 1.5);
+    h.hover_at(h.get_by_label("Larger pages").rect().center());
+    h.run_steps(1);
+    h.event(egui::Event::Zoom(1.5));
+    h.run_steps(2);
+    assert_eq!(grid_zoom(&h), 1.5, "the pointer was on the toolbar");
+    // It stops at its limits, where the buttons switch off.
+    for _ in 0..12 {
+        h.key_press_modifiers(Modifiers::COMMAND, Key::Equals);
+        h.run_steps(1);
+    }
+    assert_eq!(grid_zoom(&h), 3.0);
+    h.get_by_label("Larger pages").click();
+    h.run_steps(2);
+    assert_eq!(grid_zoom(&h), 3.0);
+    for _ in 0..20 {
+        h.key_press_modifiers(Modifiers::COMMAND, Key::Minus);
+        h.run_steps(1);
+    }
+    assert_eq!(grid_zoom(&h), 0.5);
+    assert!(!dirty(&h), "zooming is not an edit");
+}
+
+#[test]
+fn zoomed_pages_in_view_are_rendered_at_the_size_drawn() {
+    // A long document: sharpness must not depend on how many pages there are.
+    let mut h = harness(400, |app| {
+        app.set_option("organize", "on").unwrap();
+        app.set_option("grid-zoom", "300").unwrap();
+    });
+    let drawn = 146.0 * 3.0 * h.ctx.pixels_per_point();
+    let sharp = |h: &Harness<'static, PdfCraftApp>, page| h.state().views[0].grid_page_pixels(page);
+    for _ in 0..200 {
+        if sharp(&h, 0).is_some_and(|w| w as f32 >= drawn * 0.9) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(20));
+        h.run_steps(1);
+    }
+    let width = sharp(&h, 0).expect("the first page has a sharp render");
+    assert!((drawn * 0.9..=drawn * 1.6).contains(&(width as f32)), "{width} for {drawn}");
+    assert!(sharp(&h, 399).is_none(), "pages out of view have none");
+    // Zoomed out again, thumbnails are enough and the sharp renders are dropped.
+    h.state_mut().set_option("grid-zoom", "50").unwrap();
+    h.run_steps(3);
+    assert!(sharp(&h, 0).is_none());
+}
+
+#[test]
+fn a_zoomed_page_grid_still_inserts_and_moves_at_the_right_gap() {
+    let dir = temp_path("zoomed-grid");
+    std::fs::create_dir_all(&dir).unwrap();
+    let note = dir.join("note.txt");
+    std::fs::write(&note, "a note").unwrap();
+    let mut h = harness(3, |app| {
+        app.set_option("organize", "on").unwrap();
+        app.set_option("grid-zoom", "200").unwrap();
+        assert!(
+            app.set_option("grid-zoom", "20").is_err() && app.set_option("grid-zoom", "NaN").is_err() && app.set_option("grid-zoom", "big").is_err()
+        );
+    });
+    assert_eq!(grid_zoom(&h), 2.0);
+    h.state_mut().pick_override = Some(vec![note.to_string_lossy().into_owned()]);
+    h.get_by_label("Insert a file before page 2").click();
+    h.run_steps(4);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "a note", "Page 2", "Page 3"]);
+    // Files dropped over a gap go there too.
+    let gap = h.get_by_label("Insert a file before page 2").rect().center();
+    h.hover_at(gap + egui::vec2(0.0, 60.0));
+    h.run_steps(2);
+    drop_files(&mut h, vec![Dropped("more.txt", b"more".to_vec())]);
+    h.run_steps(4);
+    assert_eq!(texts_of(h.state(), 0), ["Page 1", "more", "a note", "Page 2", "Page 3"]);
+}
+
 #[test]
 fn save_pages_writes_what_the_grid_shows() {
     let path = temp_path("grid-save.pdf");
@@ -1351,6 +1462,10 @@ fn restricted_documents_show_a_notice_and_block_page_changes() {
     h.run_steps(3);
     assert_eq!(texts_of(h.state(), 0).len(), 2, "page changes are blocked");
     assert_eq!(h.query_all_by_label_contains("Insert a file").count(), 0, "nothing to insert into");
+    // Looking closer is not a page change.
+    h.get_by_label("Larger pages").click();
+    h.run_steps(2);
+    assert_eq!(grid_zoom(&h), 1.25);
     assert!(!dirty(&h));
     h.get_by_label("Security settings").click();
     h.run_steps(3);
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 96afa5e6..de7b83de 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2815,11 +2815,11 @@ title = "Thumbnail size slider"
 area = "D"
 tier = "P2"
 milestone = "M4"
-status = "planned"
-commands = []
+status = "shipped"
+commands = ["page.organize"]
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::page_grid_zooms_with_its_buttons_keys_and_pinch", "crates/ui-egui/tests/editing.rs::a_zoomed_page_grid_still_inserts_and_moves_at_the_right_gap", "crates/ui-egui/tests/editing.rs::zoomed_pages_in_view_are_rendered_at_the_size_drawn"]
+notes = "Organize page grid: 50–300% with toolbar buttons (and a percentage that resets to 100%), trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0; pages drawn larger than their thumbnails are rendered at the size drawn while they are in view (the thumbnail stands in until then, and after an edit), so text stays sharp however long the document is. Missing: a slider as in Acrobat; the size is per document view and not remembered between sessions; the Pages side panel has no size control."
 
 [[feature]]
 id = "organize.split-every-n"

From 8e3782d5ca39b9c9103f325e95bc25beb6d126e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rk=20Bartalos?= <bartalos86@gmail.com>
Date: Fri, 9 Oct 2026 20:25:08 +0200
Subject: [PATCH 108/149] Flatten Fill & Sign marks when saving (#464)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M5: flatten Fill & Sign marks when saving

Saving can now bake typed text, marks and signatures into the page, from Preferences or doc_save. The option defaults off, so a normal save still leaves them editable, and other comments and form fields stay.

* M4: zoom the Organize page grid

The page grid draws its pages at 50% to 300%: toolbar buttons with a
percentage that resets to 100%, trackpad pinch or Ctrl/⌘ + wheel about
the page under the pointer, and ⌘+ / ⌘− / ⌘0 (which no longer change the
hidden page view's zoom while the grid shows).

Thumbnails are re-rendered sharper in a few steps as the grid grows,
capped so one document's thumbnails stay within 256 MB. The page under
the pointer (or the first one in view) stays where it is across a zoom.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: zoomed grid pages are rendered at the size drawn

A zoomed page grid stretched 132 pt thumbnails, and the stepped detail
that was meant to help was capped by a memory budget, so a long document
stayed blurry at any zoom.

Pages drawn larger than their thumbnails now get a render at exactly the
size drawn while they are in view; the thumbnail stands in until it
arrives. Only pages in view keep one, so memory no longer depends on the
page count, and thumbnails go back to their one fixed size.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* View: the middle button pans instead of drawing with markup tools

egui's drag responses accept every pointer button, so on Windows and macOS a
middle-button drag reached the page tools: with Draw (ink) selected it drew a
stroke, and other tools cropped, selected or moved. Linux was unaffected
because its middle-click auto-scroll already blocks page input.

Outside Linux a middle-button drag that starts in the viewport (document or
Organize Pages) now pans 1:1 while the button is held, with a Grabbing
cursor, and page input is blocked from the press through the release. Linux
keeps its latched auto-scroll.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: a short page gone to from the Pages panel stays current

The current page was whichever page showed most of itself. Going to a short
page (a cheque) above a tall one scrolls it to the top, where the tall page
below shows more, so the current page and the Pages panel's highlight moved
to the tall page instead of the one clicked. The page navigated to now stays
current while it is wholly on screen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: page operations from the Pages panel: context menu and drag to reorder

Right-clicking a thumbnail offers Extract pages, Cut, Copy and Paste after, on
the selection or on the page clicked (which becomes the selection), as the
organize grid does. Dragging thumbnails moves the selection, or the page
grabbed, to the gap it is dropped on: a bar marks the gap, the page count
follows the pointer, and the panel scrolls near its edges. The move is one
undoable step; the moved pages stay selected and the current page follows
its page. Documents that forbid assembly keep click-only thumbnails.

Parity: view.thumbnail-context-ops is shipped, with what it still lacks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Pages panel: only the primary button drags thumbnails; a drag left over after the panel closed or the document changed is dropped

* M5: translate Fill & Sign flatten labels into Ukrainian

The coverage test failed because the new preference strings had no Ukrainian entries.

* Fix main CI: move the rotated-field render test out of pdfcraft-forms (#591)

#516 added pdfcraft-render as a dev-dependency of pdfcraft-forms for one
rendering test. Both crates are layer 3, so `cargo xtask layers` (run in
CI) rejects the sideways edge and main went red. The test now lives in
crates/engine/tests/form_rotation.rs, where both crates are already
dependencies, and forms drops the dev-dependency. The parity evidence
points at the new location.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* uk: the author's wording for the flatten setting

---------

Co-authored-by: samehelhawary <basio20044@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cody Vogt <Cody.Vogt@caltechsurveys.com>
Co-authored-by: William Max & Co. <info@williammax.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                      |  14 ++--
 ROADMAP.md                            |   3 +
 crates/annot/src/lib.rs               |  58 ++++++++++++++
 crates/automation/src/lib.rs          |   4 +
 crates/automation/src/tools.rs        |   9 ++-
 crates/automation/tests/automation.rs |  22 ++++++
 crates/edit/Cargo.toml                |   2 +-
 crates/edit/src/flatten.rs            |  56 ++++++++++++-
 crates/edit/src/lib.rs                |   2 +-
 crates/edit/src/tests.rs              |  63 +++++++++++++++
 crates/engine/src/lib.rs              |  15 +++-
 crates/engine/src/tests.rs            | 110 ++++++++++++++++++++++++++
 crates/ui-egui/src/editing.rs         |  58 +++++++++++++-
 crates/ui-egui/src/i18n/bg.tsv        |   2 +
 crates/ui-egui/src/i18n/de.tsv        |   2 +
 crates/ui-egui/src/i18n/fr.tsv        |   2 +
 crates/ui-egui/src/i18n/hu.tsv        |   5 ++
 crates/ui-egui/src/i18n/ru.tsv        |   2 +
 crates/ui-egui/src/i18n/uk.tsv        |   5 ++
 crates/ui-egui/src/i18n/zh-hans.tsv   |   2 +
 crates/ui-egui/src/js_ui.rs           |   6 ++
 crates/ui-egui/src/lib.rs             |  14 ++++
 crates/ui-egui/tests/fill_sign.rs     |  59 ++++++++++++++
 parity/acrobat-features.toml          |  10 +--
 24 files changed, 503 insertions(+), 22 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 85926623..20866740 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "844da6ed41f9baf939e1a99042dec5904447ca82fb5662c4361a9a809adb19f8"
+sha256 = "5e6493d38917e6900f126d0a4fc9819b1b9a57e2d883207d03606d1c3e0c6d94"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8fd69fd5e769259b99b059adb3a9d2fb90489bf561d62113ff8d25227495e122"
+sha256 = "e735d7f40fa5d34627209287d82a4ce2651d7a04a31bc1bbae1b8be0ffbed972"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8b380ba241bc25a05289717a3bfa4ea580be1c78b43c91d54c72de9c024b06eb"
+sha256 = "97c6d0ef61a16419b8eb8807ad91a6544a5d7d9d3e20dfd35f33c39c105107a0"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ab089d2dab457a727158c3414dbe28b4edc3231cd30b5092feeeed3d8feca8a5"
+sha256 = "fb9e2120dab378f35110897e7d0ebc53fce331cc918df393946a1f96ad2335e3"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "59ec12395bc45ed15a0de3b2d0878d2ea250bfd9e9372103d8869b142bcc675f"
+sha256 = "fd4281afd9a33a0e73bab937b9d05cb92200967eb1847d8f43709ca9cdabf080"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ca7c441f30dc116349f0aa523e8a6cfc8e019bf7ff73f377f0264f9dcda9f133"
+sha256 = "4de7b3bae615f5b8bc29e56cd69d932735ee82ed5b7bbdb713c8b5c0c47cea84"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "bdb59f15d5659bd54fb4316b37f3e50f7c352640aeef1860be87700682d3bb48"
+sha256 = "ca16d314028a95bd3b7eb73e9ea6c9d388a844f841e8c8811e340eb5a4161227"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index 698d314d..4c8e3dcf 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -135,6 +135,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
 
+- **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
 
@@ -142,6 +143,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index 73bf42a4..f6d6add1 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -715,6 +715,59 @@ fn annot_dict(doc: &Document, r: ObjRef) -> Dict {
     doc.get(r).as_dict().cloned().unwrap_or_default()
 }
 
+/// A Fill & Sign item: typed text, a check/cross/dot/line, or a typed, drawn or image signature.
+///
+/// New items carry `/PCFillSign`. Older files are recognised from the dictionaries PdfCraft
+/// already writes (`/IT /FreeTextTypeWriter`, stamp `/Name`, drawn ink whose subject is
+/// "Signature").
+pub fn is_fill_sign(doc: &Document, d: &Dict) -> bool {
+    if matches!(d.get(b"PCFillSign").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true))) {
+        return true;
+    }
+    let subtype = d.name(b"Subtype").unwrap_or_default();
+    if subtype == b"FreeText" && d.name(b"IT") == Some(b"FreeTextTypeWriter") {
+        return true;
+    }
+    if subtype == b"Stamp" {
+        if matches!(d.name(b"Name"), Some(b"PCCheck" | b"PCCross" | b"PCDot" | b"PCLine" | b"PCTypedSignature")) {
+            return true;
+        }
+        if matches!(d.name(b"Name"), Some(b"PCCustomSignature" | b"PCCustomInitials"))
+            && matches!(d.get(b"PCPictureImage").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true)))
+        {
+            return true;
+        }
+    }
+    subtype == b"Ink" && text_value(doc, d, b"Subj").as_deref() == Some("Signature")
+}
+
+/// Whether any page has a Fill & Sign annotation that flatten would bake in (not hidden).
+pub fn has_visible_fill_sign(doc: &Document) -> bool {
+    let Ok(pages) = page_refs(doc) else { return false };
+    for page in pages {
+        for entry in annots(doc, page) {
+            let obj = doc.resolve(&entry);
+            let Some(d) = obj.as_dict() else { continue };
+            let flags = d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
+            if flags & (FLAG_HIDDEN | FLAG_NO_VIEW) != 0 {
+                continue;
+            }
+            if is_fill_sign(doc, d) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn fill_sign_shape(shape: &Shape) -> bool {
+    match shape {
+        Shape::Typewriter { .. } | Shape::Mark { .. } | Shape::Signature { .. } | Shape::TypedSignature { .. } => true,
+        Shape::CustomStamp { name, image: true, .. } => name == "Signature" || name == "Initials",
+        _ => false,
+    }
+}
+
 /// The embedded image of a Fill & Sign image signature or initials (0-based target).
 /// Other stamps have appearances that can't be represented by this image alone.
 pub fn signature_image(doc: &Document, page: usize, index: usize) -> Result<Option<ObjRef>, AnnotError> {
@@ -747,6 +800,7 @@ const FLAG_PRINT: i64 = 4;
 const FLAG_NO_ZOOM: i64 = 8;
 const FLAG_NO_ROTATE: i64 = 16;
 const FLAG_HIDDEN: i64 = 2;
+const FLAG_NO_VIEW: i64 = 32;
 const FLAG_LOCKED: i64 = 128;
 
 /// Size of a note icon (points, unscaled by zoom).
@@ -1140,6 +1194,10 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
         }
         _ => {}
     }
+    if fill_sign_shape(&new.shape) {
+        // Survives a later subject edit, so flatten-on-save still finds the mark.
+        d.set(b"PCFillSign".to_vec(), Object::Bool(true));
+    }
     let r = doc.add(Object::Dict(d.clone()));
     set_appearance(doc, r)?;
     let mut list = annots(doc, page);
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 1444b313..0315f58c 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -645,6 +645,10 @@ impl Automation {
         let same_file = doc.path.as_deref().is_some_and(|p| Path::new(p) == target);
         // Saving to a new file is a full rewrite unless asked otherwise, like Save As.
         let full = a.opt_bool("full")?.unwrap_or(!same_file);
+        let flatten_fill_sign = a.opt_bool("flatten_fill_sign")?.unwrap_or(false);
+        if flatten_fill_sign {
+            self.apply(a, Edit::FlattenFillSign)?;
+        }
         let bytes = if full { self.session.save_full_bytes(id) } else { self.session.save_bytes(id) }.map_err(failed)?;
         write_atomic(&target, &bytes)?;
         let path = target.to_string_lossy().into_owned();
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 18b7c67e..92f42e72 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -132,12 +132,17 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_save",
             "Save a document",
-            "Save to its own file (an incremental update, which keeps signatures valid) or to a new path (a full rewrite). The write is atomic.",
+            "Save to its own file (an incremental update, which keeps signatures valid) or to a new path (a full rewrite). The write is atomic. flatten_fill_sign bakes Fill & Sign text, marks and signatures into the page first and removes those annotations; other comments and form fields stay. Omit it, or pass false, to leave them editable.",
         )
         .destructive()
         .cmd("file.save")
         .with(schema(
-            json!({ "doc": doc(), "path": { "type": "string", "description": "Save as this file. Omit to save in place." }, "full": { "type": "boolean", "description": "Force a full rewrite (or, with false, an incremental update)." } }),
+            json!({
+                "doc": doc(),
+                "path": { "type": "string", "description": "Save as this file. Omit to save in place." },
+                "full": { "type": "boolean", "description": "Force a full rewrite (or, with false, an incremental update)." },
+                "flatten_fill_sign": { "type": "boolean", "description": "Bake Fill & Sign marks into the page before writing. Default false." }
+            }),
             &["doc"],
         )),
         t("doc_set_info", "Set document metadata", "Set a document information entry such as Title, Author, Subject or Keywords. Undoable.")
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index f5e3abbf..f42cbb6f 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1614,6 +1614,28 @@ fn creating_images_with_dpi_through_tools() {
     }
 }
 
+#[test]
+fn saving_with_flatten_fill_sign_bakes_marks_and_leaves_other_comments() {
+    let dir = workdir("fill-sign-flatten");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": 1, "type": "text", "at": [40.0, 80.0], "text": "Hello" }));
+    ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "highlight", "find": "Page", "contents": "keep" }));
+    ok(&mut a, "form_add_field", json!({ "doc": doc, "page": 1, "type": "text", "rect": [20.0, 120.0, 180.0, 142.0] }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "kept.pdf" }));
+    let kept = ok(&mut a, "doc_open", json!({ "path": "kept.pdf" }))["doc"].as_u64().unwrap();
+    let kept_comments = ok(&mut a, "comment_list", json!({ "doc": kept }))["comments"].as_array().unwrap().clone();
+    assert!(kept_comments.iter().any(|c| c["contents"] == "Hello"), "without the flag the typewriter stays: {kept_comments:?}");
+
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "flat.pdf", "flatten_fill_sign": true }));
+    let flat = ok(&mut a, "doc_open", json!({ "path": "flat.pdf" }))["doc"].as_u64().unwrap();
+    let comments = ok(&mut a, "comment_list", json!({ "doc": flat }))["comments"].as_array().unwrap().clone();
+    assert!(comments.iter().all(|c| c["contents"] != "Hello"), "the typewriter was baked in: {comments:?}");
+    assert!(comments.iter().any(|c| c["contents"] == "keep"), "the highlight stays: {comments:?}");
+    let fields = ok(&mut a, "form_fields", json!({ "doc": flat }))["fields"].as_array().unwrap().clone();
+    assert_eq!(fields.len(), 1, "the form field stays");
+}
+
 #[test]
 fn flattening_through_tools() {
     let dir = workdir("flatten");
diff --git a/crates/edit/Cargo.toml b/crates/edit/Cargo.toml
index 42733780..c929bfb4 100644
--- a/crates/edit/Cargo.toml
+++ b/crates/edit/Cargo.toml
@@ -9,6 +9,7 @@ license.workspace = true
 workspace = true
 
 [dependencies]
+pdfcraft-annot = { workspace = true }
 pdfcraft-cos = { workspace = true }
 pdfcraft-content = { workspace = true }
 pdfcraft-fonts = { workspace = true }
@@ -19,4 +20,3 @@ unicode-bidi = "0.3"
 
 [dev-dependencies]
 hayro-syntax = { workspace = true }
-pdfcraft-annot = { workspace = true }
diff --git a/crates/edit/src/flatten.rs b/crates/edit/src/flatten.rs
index 704f12b5..dd05dbb7 100644
--- a/crates/edit/src/flatten.rs
+++ b/crates/edit/src/flatten.rs
@@ -51,9 +51,53 @@ fn placement(doc: &Document, form: &Dict, rect: [f64; 4]) -> Option<[f64; 6]> {
     Some([sx, 0.0, 0.0, sy, rect[0] - x0 * sx, rect[1] - y0 * sy])
 }
 
+#[derive(Clone, Copy)]
+enum Which {
+    /// Every comment and/or every form field.
+    Comments { comments: bool, fields: bool },
+    /// Fill & Sign text, marks and signatures only.
+    FillSign,
+}
+
+fn selected(doc: &Document, d: &Dict, which: Which) -> bool {
+    let subtype = d.name(b"Subtype").unwrap_or_default();
+    match which {
+        Which::Comments { comments, fields } => {
+            let widget = subtype == b"Widget";
+            !matches!(subtype, b"Link" | b"Popup") && (!widget || fields) && (widget || comments)
+        }
+        Which::FillSign => !matches!(subtype, b"Link" | b"Popup" | b"Widget") && pdfcraft_annot::is_fill_sign(doc, d),
+    }
+}
+
+/// An XObject name that is not already on the page, so a later flatten cannot replace `PCFl0`.
+fn xobject_name(existing: &Dict, pending: &Dict, n: &mut u32) -> String {
+    loop {
+        let name = format!("PCFl{n}");
+        if *n == u32::MAX {
+            return format!("PCFl{}", existing.len().saturating_add(pending.len()));
+        }
+        *n += 1;
+        if !existing.contains(name.as_bytes()) && !pending.contains(name.as_bytes()) {
+            return name;
+        }
+    }
+}
+
 /// Flatten comments and/or form fields on `pages`. Returns how many annotations were merged
 /// into page content.
 pub fn flatten(doc: &mut Document, pages: &[usize], comments: bool, fields: bool) -> Result<usize, EditError> {
+    flatten_which(doc, pages, Which::Comments { comments, fields })
+}
+
+/// Bake Fill & Sign text, marks and signatures into `pages` and remove those annotations.
+/// Other comments, links and form fields stay. Returns how many appearances were drawn.
+/// Does not modify the document when nothing matches.
+pub fn flatten_fill_sign(doc: &mut Document, pages: &[usize]) -> Result<usize, EditError> {
+    flatten_which(doc, pages, Which::FillSign)
+}
+
+fn flatten_which(doc: &mut Document, pages: &[usize], which: Which) -> Result<usize, EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
     let mut drawn = 0;
@@ -64,6 +108,14 @@ pub fn flatten(doc: &mut Document, pages: &[usize], comments: bool, fields: bool
         let Some(list) = annots_obj.as_ref().map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()) else { continue };
         let mut content = String::new();
         let mut xobjects = Dict::new();
+        let mut name_n = 0u32;
+        let existing_xo = page
+            .dict
+            .get(b"Resources")
+            .map(|r| doc.resolve(r))
+            .and_then(|r| r.as_dict().cloned())
+            .and_then(|r| r.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()))
+            .unwrap_or_default();
         let mut gone: HashSet<ObjRef> = HashSet::new();
         let mut gone_inline: HashSet<usize> = HashSet::new();
         for (k, entry) in list.iter().enumerate() {
@@ -71,7 +123,7 @@ pub fn flatten(doc: &mut Document, pages: &[usize], comments: bool, fields: bool
             let Some(d) = obj.as_dict() else { continue };
             let subtype = d.name(b"Subtype").unwrap_or_default();
             let widget = subtype == b"Widget";
-            if matches!(subtype, b"Link" | b"Popup") || (widget && !fields) || (!widget && !comments) {
+            if !selected(doc, d, which) {
                 continue;
             }
             let flags = d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
@@ -82,7 +134,7 @@ pub fn flatten(doc: &mut Document, pages: &[usize], comments: bool, fields: bool
             if let (Some(ap), Some(rect)) = (appearance(doc, d), rect) {
                 let form = doc.get(ap).as_dict().cloned().unwrap_or_default();
                 if let Some(m) = placement(doc, &form, rect) {
-                    let name = format!("PCFl{drawn}");
+                    let name = xobject_name(&existing_xo, &xobjects, &mut name_n);
                     content.push_str(&format!("q {} {} {} {} {} {} cm /{name} Do Q\n", n(m[0]), n(m[1]), n(m[2]), n(m[3]), n(m[4]), n(m[5])));
                     xobjects.set(name.into_bytes(), Object::Ref(ap));
                     drawn += 1;
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 93df6829..dfdec9ed 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -612,7 +612,7 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
 }
 
 mod flatten;
-pub use flatten::flatten;
+pub use flatten::{flatten, flatten_fill_sign};
 pub mod images;
 pub use images::{ImageChange, PageImage, change_image, page_images, rect_to_rect, turn_about_centre};
 pub mod text;
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index f7756941..2ef3b48a 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -1268,3 +1268,66 @@ fn page_text_the_standard_fonts_cant_draw_is_refused() {
         update_content(&mut doc, 0, n, &Content::Text(arabic("ب"))).unwrap();
     }
 }
+
+fn xobject(doc: &Document, page: usize, name: &[u8]) -> Option<pdfcraft_cos::ObjRef> {
+    let p = &pdfcraft_model::pages(doc)[page];
+    let res = doc.resolve(p.dict.get(b"Resources")?);
+    let xo = doc.resolve(res.as_dict()?.get(b"XObject")?);
+    xo.as_dict()?.get(name).and_then(Object::as_ref)
+}
+
+fn annot_at(doc: &Document, page: usize, index: usize) -> pdfcraft_cos::ObjRef {
+    let p = &pdfcraft_model::pages(doc)[page];
+    let list = doc.resolve(p.dict.get(b"Annots").unwrap());
+    list.as_array().unwrap()[index].as_ref().unwrap()
+}
+
+#[test]
+fn fill_sign_flatten_bakes_marks_keeps_other_comments_and_does_not_reuse_pcfl0() {
+    use pdfcraft_annot::{FillMark, Markup, Meta, NewAnnotation, Shape, Style, add_annotation, summaries};
+    let mut doc = fixture();
+    assert_eq!(flatten_fill_sign(&mut doc, &[0]).unwrap(), 0);
+    assert!(!doc.is_modified(), "nothing to flatten leaves the file alone");
+
+    let meta = Meta { date: None, id: "x".into() };
+    let add = |doc: &mut Document, shape: Shape, contents: &str| {
+        let style = Style::default_for(&shape);
+        add_annotation(doc, &NewAnnotation { page: 0, shape, style, contents: contents.into(), author: "a".into() }, &meta).unwrap()
+    };
+    add(&mut doc, Shape::Rectangle { rect: [10.0, 10.0, 80.0, 40.0] }, "box");
+    assert_eq!(flatten(&mut doc, &[0], true, false).unwrap(), 1);
+    let kept = xobject(&doc, 0, b"PCFl0").expect("the first flatten's XObject");
+
+    add(&mut doc, Shape::Typewriter { rect: [20.0, 500.0, 140.0, 520.0], font_size: 10.0 }, "Hello");
+    doc.update_dict(annot_at(&doc, 0, 0), |d| {
+        d.remove(b"PCFillSign");
+    })
+    .unwrap();
+    add(&mut doc, Shape::Mark { rect: [100.0, 100.0, 120.0, 120.0], mark: FillMark::Check }, "");
+    add(&mut doc, Shape::Signature { strokes: vec![vec![[10.0, 50.0], [40.0, 80.0], [70.0, 50.0]]] }, "");
+    doc.update_dict(annot_at(&doc, 0, 2), |d| d.set(b"Subj".to_vec(), pdfcraft_cos::PdfString::text("Pencil"))).unwrap();
+    add(&mut doc, Shape::TypedSignature { rect: [20.0, 40.0, 90.0, 70.0], contours: vec![vec![[0.1, 0.2], [0.5, 0.9], [0.9, 0.2]]] }, "");
+    add(&mut doc, Shape::TextMarkup { kind: Markup::Highlight, quads: vec![[20.0, 400.0, 80.0, 400.0, 20.0, 390.0, 80.0, 390.0]] }, "keep");
+    add(&mut doc, Shape::TextBox { rect: [20.0, 300.0, 140.0, 340.0], font_size: 12.0 }, "Note");
+    add(&mut doc, Shape::Ink { strokes: vec![vec![[200.0, 200.0], [220.0, 220.0], [240.0, 200.0]]] }, "pencil");
+    let old = add(&mut doc, Shape::Signature { strokes: vec![vec![[300.0, 50.0], [330.0, 80.0], [360.0, 50.0]]] }, "");
+    doc.update_dict(annot_at(&doc, 0, old), |d| {
+        d.remove(b"PCFillSign");
+    })
+    .unwrap();
+    let hidden = add(&mut doc, Shape::Typewriter { rect: [20.0, 600.0, 140.0, 620.0], font_size: 10.0 }, "secret");
+    doc.update_dict(annot_at(&doc, 0, hidden), |d| d.set(b"F".to_vec(), Object::Int(2))).unwrap();
+
+    let n = flatten_fill_sign(&mut doc, &[0]).unwrap();
+    assert_eq!(n, 5, "text, check, both signatures and the typed signature; the hidden one stays");
+    assert_eq!(xobject(&doc, 0, b"PCFl0"), Some(kept), "an existing PCFl0 is not replaced");
+    let newest = streams(&doc, 0).last().unwrap().clone();
+    assert!(newest.contains("/PCFl1 Do") && !newest.contains("/PCFl0 Do"), "{newest}");
+
+    let doc = reopen(&doc);
+    let mut left: Vec<String> = summaries(&doc).iter().map(|s| s.contents.clone().unwrap_or_default()).collect();
+    left.sort();
+    assert_eq!(left, ["Note", "keep", "pencil", "secret"]);
+    assert!(summaries(&doc).iter().any(|s| s.intent.as_deref() == Some("FreeTextTypeWriter")), "the hidden typewriter stays");
+    assert_eq!(summaries(&doc).iter().filter(|s| s.intent.as_deref() == Some("FreeTextTypeWriter")).count(), 1);
+}
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 9ee20873..fbd92be3 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -1081,6 +1081,9 @@ pub enum Edit {
         comments: bool,
         fields: bool,
     },
+    /// Bake Fill & Sign text, marks and signatures into the page. Other comments and fields stay.
+    /// A no-op (no undo step) when the document has none.
+    FlattenFillSign,
     /// Protect with passwords and permissions (written by the next save, which is a full rewrite).
     Protect(Protection),
     /// Remove password security (needs the owner password).
@@ -1182,6 +1185,7 @@ impl Edit {
             Edit::Flatten { comments: true, fields: false } => "Flatten comments".into(),
             Edit::Flatten { comments: false, fields: true } => "Flatten form fields".into(),
             Edit::Flatten { .. } => "Flatten".into(),
+            Edit::FlattenFillSign => "Flatten Fill & Sign".into(),
             Edit::Protect(_) => "Protect with password".into(),
             Edit::RemoveProtection => "Remove security".into(),
             Edit::Batch { label, .. } => label.clone(),
@@ -1323,7 +1327,8 @@ fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), Ed
         | Edit::EditTextLine { .. }
         | Edit::EditTextBlock { .. }
         | Edit::EditPageImage { .. }
-        | Edit::Flatten { .. } => {
+        | Edit::Flatten { .. }
+        | Edit::FlattenFillSign => {
             if p.modify() {
                 Ok(())
             } else {
@@ -1673,6 +1678,10 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             let n = pdfcraft_model::pages(doc).len();
             pdfcraft_edit::flatten(doc, &(0..n).collect::<Vec<_>>(), *comments, *fields)?;
         }
+        Edit::FlattenFillSign => {
+            let n = pdfcraft_model::pages(doc).len();
+            pdfcraft_edit::flatten_fill_sign(doc, &(0..n).collect::<Vec<_>>())?;
+        }
         Edit::Protect(p) => {
             p.validate()?;
             let seed = cx.entropy();
@@ -2272,6 +2281,10 @@ impl Session {
         if let Some(p) = editor.cos.permissions() {
             check_permission(&edit, &p)?;
         }
+        // Nothing to bake: leave undo history and the dirty flag alone.
+        if matches!(&edit, Edit::FlattenFillSign) && !pdfcraft_annot::has_visible_fill_sign(&editor.cos) {
+            return Ok(());
+        }
         let mut next = editor.cos.clone();
         if !js_off && uses_scripts(&edit) {
             cx.js = Some(js::JsRunner::new(&next, &name));
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 1e497399..d560effa 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1100,6 +1100,116 @@ fn flattening_keeps_the_look_and_drops_the_objects() {
     assert_eq!(s.get(id).unwrap().form.len(), 2);
 }
 
+fn fill_item(shape: Shape, contents: &str) -> Edit {
+    let style = Style::default_for(&shape);
+    Edit::AddAnnotation(NewAnnotation { page: 0, shape, style, contents: contents.into(), author: "Ada".into() })
+}
+
+fn comment_text(s: &Session, id: DocId) -> Vec<String> {
+    let mut t: Vec<String> = s.get(id).unwrap().info.annotations.iter().map(|a| a.contents.clone().unwrap_or_default()).collect();
+    t.sort();
+    t
+}
+
+#[test]
+fn flattening_fill_and_sign_keeps_other_comments_fields_and_undoes() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, fill_item(Shape::Typewriter { rect: [20.0, 200.0, 120.0, 220.0], font_size: 10.0 }, "Hello")).unwrap();
+    s.apply(id, fill_item(Shape::Mark { rect: [140.0, 200.0, 160.0, 220.0], mark: FillMark::Check }, "")).unwrap();
+    s.apply(id, fill_item(Shape::Signature { strokes: vec![vec![[10.0, 40.0], [40.0, 70.0], [70.0, 40.0]]] }, "")).unwrap();
+    s.apply(id, fill_item(Shape::TypedSignature { rect: [90.0, 40.0, 150.0, 70.0], contours: vec![vec![[0.1, 0.2], [0.5, 0.9], [0.9, 0.2]]] }, ""))
+        .unwrap();
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 8, 8);
+        enc.set_color(png::ColorType::Rgba);
+        let pixel = [40u8, 60, 80, 200];
+        enc.write_header().unwrap().write_image_data(&pixel.repeat(64)).unwrap();
+    }
+    let image = SignatureImage::from_bytes(&png).unwrap();
+    let info = s.get(id).unwrap().info.pages[0].clone();
+    s.apply(id, image.edit(0, &info, [20.0, 120.0], false, "Ada").unwrap()).unwrap();
+    s.apply(id, fill_item(Shape::TextMarkup { kind: Markup::Highlight, quads: vec![[20.0, 280.0, 80.0, 280.0, 20.0, 270.0, 80.0, 270.0]] }, "keep"))
+        .unwrap();
+    s.apply(id, fill_item(Shape::TextBox { rect: [20.0, 150.0, 120.0, 180.0], font_size: 12.0 }, "Note")).unwrap();
+    s.apply(id, Edit::AddField { page: 0, rect: [20.0, 230.0, 120.0, 250.0], kind: NewField::Text { multiline: false }, name: Some("email".into()) })
+        .unwrap();
+
+    s.apply(id, Edit::FlattenFillSign).unwrap();
+    assert_eq!(s.get(id).unwrap().can_undo(), Some("Flatten Fill & Sign"));
+    assert_eq!(comment_text(&s, id), ["Note", "keep"]);
+    assert_eq!(s.get(id).unwrap().form.iter().map(|f| f.name.as_str()).collect::<Vec<_>>(), ["email"]);
+    s.undo(id).unwrap();
+    assert!(comment_text(&s, id).contains(&"Hello".to_string()), "undo restores the typewriter");
+
+    s.apply(id, Edit::FlattenFillSign).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    s.mark_saved(id, saved.clone(), None).unwrap();
+    let mut again = Session::new();
+    let id2 = again.open("saved.pdf", None, saved, None).unwrap();
+    assert_eq!(comment_text(&again, id2), ["Note", "keep"]);
+    assert_eq!(again.get(id2).unwrap().form.iter().map(|f| f.name.as_str()).collect::<Vec<_>>(), ["email"]);
+}
+
+#[test]
+fn flattening_fill_and_sign_does_nothing_when_there_are_none() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, fill_item(Shape::TextMarkup { kind: Markup::Highlight, quads: vec![[20.0, 200.0, 80.0, 200.0, 20.0, 190.0, 80.0, 190.0]] }, "keep"))
+        .unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    s.mark_saved(id, saved, None).unwrap();
+    assert!(!s.get(id).unwrap().dirty);
+    s.apply(id, Edit::FlattenFillSign).unwrap();
+    assert!(!s.get(id).unwrap().dirty, "nothing was baked in, so the document stays saved");
+    assert_eq!(s.get(id).unwrap().can_undo(), Some("Add highlight"), "no undo step for a flatten that changed nothing");
+    assert_eq!(comment_text(&s, id), ["keep"]);
+}
+
+#[test]
+fn flattening_fill_and_sign_is_refused_without_permission_to_change() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, fill_item(Shape::Typewriter { rect: [20.0, 200.0, 120.0, 220.0], font_size: 10.0 }, "Hello")).unwrap();
+    let p = Protection { printing: Printing::Low, changes: Changes::CommentFillSign, copy: false, ..protection(None, Some("boss")) };
+    s.apply(id, Edit::Protect(p)).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    let mut other = Session::new();
+    let id2 = other.open("locked.pdf", None, saved, None).unwrap();
+    let before = other.get(id2).unwrap().bytes.clone();
+    assert_eq!(other.apply(id2, Edit::FlattenFillSign), Err(EditError::NotPermitted("changes to the document")));
+    assert_eq!(other.get(id2).unwrap().bytes, before);
+    assert!(!other.get(id2).unwrap().dirty);
+    assert!(comment_text(&other, id2).contains(&"Hello".to_string()));
+}
+
+#[test]
+fn flattening_fill_and_sign_on_a_signed_file_stays_incremental() {
+    let p12 = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12")).unwrap();
+    let digital_id = sign::pkcs12::open(&p12, "test").unwrap();
+    let mut s = Session::new().with_clock(|| 1_800_000_000);
+    let id = s.open("fixture.pdf", None, Arc::new(fixture(1)), None).unwrap();
+    let opts = SignOptions { page: 0, rect: Some([20.0, 20.0, 160.0, 50.0]), ..SignOptions::default() };
+    let signed = s.sign(id, &digital_id, opts).unwrap();
+    s.mark_signed(id, signed.clone(), None).unwrap();
+    s.apply(id, fill_item(Shape::Typewriter { rect: [20.0, 200.0, 120.0, 220.0], font_size: 10.0 }, "Hello")).unwrap();
+    s.apply(id, Edit::FlattenFillSign).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.starts_with(signed.as_ref()), "the signature's bytes stay an incremental update");
+    assert!(!comment_text(&s, id).contains(&"Hello".to_string()));
+}
+
+#[test]
+fn flattening_fill_and_sign_reopens_an_encrypted_file() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, fill_item(Shape::Typewriter { rect: [20.0, 200.0, 120.0, 220.0], font_size: 10.0 }, "Hello")).unwrap();
+    s.apply(id, Edit::Protect(protection(Some("secret"), None))).unwrap();
+    s.apply(id, Edit::FlattenFillSign).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    let mut again = Session::new();
+    assert!(again.open("p.pdf", None, saved.clone(), None).is_err());
+    let id2 = again.open("p.pdf", None, saved, Some("secret")).unwrap();
+    assert!(!comment_text(&again, id2).contains(&"Hello".to_string()));
+}
+
 #[test]
 fn pages_export_as_png_jpeg_and_tiff() {
     use crate::export::{Exporter, ImageFormat};
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index c2dd20e6..ecce8dc7 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -282,14 +282,62 @@ impl PdfCraftApp {
             self.notify(crate::content_ui::undrawable_message(c));
             return false;
         }
+        let typing = self
+            .views
+            .get(i)
+            .is_some_and(|v| v.pending_edit.is_some() || v.forms.focus.is_some() || v.fill_text.as_ref().is_some_and(|t| !t.text.trim().is_empty()));
         if self.active != Some(i) {
-            let typing = self.views.get(i).is_some_and(|v| v.pending_edit.is_some() || v.forms.focus.is_some());
             if !typing {
                 return true;
             }
             self.active = Some(i);
         }
-        self.commit_form_typing()
+        self.commit_form_typing() && self.commit_open_fill_text(id)
+    }
+
+    /// The Fill & Sign type box commits on click-away. Save does that first, so the text is in
+    /// the file (and can be flattened) instead of being left on the screen.
+    fn commit_open_fill_text(&mut self, id: pdfcraft_engine::DocId) -> bool {
+        let Some(i) = self.views.iter().position(|v| v.id == id) else { return true };
+        let Some(tb) = self.views[i].fill_text.clone() else { return true };
+        let text = tb.text.trim().to_string();
+        if text.is_empty() {
+            if let Some(view) = self.views.get_mut(i) {
+                view.fill_text = None;
+            }
+            return true;
+        }
+        let author = self.comment_prefs.author.clone();
+        let edit = crate::fill_sign::typed(tb.page, tb.at, &text, &author);
+        if self.apply_edit(edit) {
+            if let Some(view) = self.views.get_mut(i) {
+                view.fill_text = None;
+            }
+            true
+        } else {
+            false
+        }
+    }
+
+    /// When the preference is on, bake Fill & Sign marks before the bytes are written.
+    /// Returns false when the document is not allowed to change (nothing is written).
+    fn flatten_fill_sign_for_save(&mut self, id: pdfcraft_engine::DocId) -> bool {
+        if !self.flatten_fill_sign_on_save {
+            return true;
+        }
+        let before = self.session.get(id).map(|d| d.edit_generation());
+        if let Err(e) = self.session.apply(id, Edit::FlattenFillSign) {
+            self.notify_error(e);
+            return false;
+        }
+        let after = self.session.get(id).map(|d| d.edit_generation());
+        if before != after
+            && let Some(doc) = self.session.get(id)
+            && let Some(view) = self.views.iter_mut().find(|v| v.id == id)
+        {
+            view.document_changed(&doc.info);
+        }
+        true
     }
 
     /// Whether tab `index` has work that isn't saved: edits, or form typing not committed yet.
@@ -300,6 +348,7 @@ impl PdfCraftApp {
             || v.pending_edit.is_some()
             || v.content.blocked().is_some()
             || v.forms.focus.as_ref().is_some_and(|f| crate::forms_ui::draft_edit(f, &doc.form).is_some())
+            || v.fill_text.as_ref().is_some_and(|t| !t.text.trim().is_empty())
     }
 
     /// Save the active document. Returns `true` if it was written.
@@ -355,6 +404,9 @@ impl PdfCraftApp {
         #[cfg(target_arch = "wasm32")]
         {
             let _ = (target, path);
+            if !self.flatten_fill_sign_for_save(id) {
+                return false;
+            }
             let bytes = match self.session.save_bytes(id) {
                 Ok(b) => b,
                 Err(e) => {
@@ -385,7 +437,7 @@ impl PdfCraftApp {
     fn save_doc_to(&mut self, id: pdfcraft_engine::DocId, dest: &str) -> bool {
         // Save As answers on a later frame: commit what was typed meanwhile, too (#166), even
         // if another tab is active by then.
-        if !self.commit_typing_in(id) {
+        if !self.commit_typing_in(id) || !self.flatten_fill_sign_for_save(id) {
             return false;
         }
         let Some(name) = self.session.get(id).map(|d| d.name.clone()) else {
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 11982108..518f34ca 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -125,6 +125,8 @@
 	Display theme	Тема на показване
 	Side panels	Странични панели
 	Enable Acrobat JavaScript	Включи Acrobat JavaScript
+	Flatten Fill & Sign when saving	Сплескай „Попълни и подпиши“ при запазване
+	Text, marks and signatures become part of the page. Other comments stay editable.	Текстът, маркировките и подписите стават част от страницата. Другите коментари остават редактируеми.
 	OK	OK
 	Cancel	Отказ
 	Close	Затвори
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 01d601e2..0b6cb391 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -58,6 +58,8 @@
 	Display theme	Design
 	Side panels	Seitenleisten
 	Enable Acrobat JavaScript	Acrobat-JavaScript aktivieren
+	Flatten Fill & Sign when saving	Ausfüllen und unterschreiben beim Speichern reduzieren
+	Text, marks and signatures become part of the page. Other comments stay editable.	Text, Markierungen und Unterschriften werden Teil der Seite. Andere Kommentare bleiben bearbeitbar.
 	OK	OK
 	Join our Discord	Unserem Discord beitreten
 	Close	Schließen
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 251618fa..a6b5c08d 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -58,6 +58,8 @@
 	Display theme	Thème d'affichage
 	Side panels	Panneaux latéraux
 	Enable Acrobat JavaScript	Activer Acrobat JavaScript
+	Flatten Fill & Sign when saving	Aplatir Remplir et signer à l'enregistrement
+	Text, marks and signatures become part of the page. Other comments stay editable.	Le texte, les marques et les signatures deviennent partie de la page. Les autres commentaires restent modifiables.
 	OK	OK
 	Join our Discord	Rejoindre notre Discord
 	Close	Fermer
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index acb523c0..ef0a7306 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2088,3 +2088,8 @@ action wizard	Start	Indítás
 	Larger pages	Nagyobb oldalak
 	Smaller pages	Kisebb oldalak
 	Reset page size	Oldalméret visszaállítása
+	Larger pages	Nagyobb oldalak
+	Smaller pages	Kisebb oldalak
+	Reset page size	Oldalméret visszaállítása
+	Flatten Fill & Sign when saving	Kitöltés és aláírás beégetése mentéskor
+	Text, marks and signatures become part of the page. Other comments stay editable.	A szöveg, a jelek és az aláírások az oldal részévé válnak. A többi megjegyzés szerkeszthető marad.
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index d9a0995f..c7888b4f 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -79,6 +79,8 @@
 	Display theme	Тема оформления
 	Side panels	Боковые панели
 	Enable Acrobat JavaScript	Включить Acrobat JavaScript
+	Flatten Fill & Sign when saving	Расплющить «Заполнить и подписать» при сохранении
+	Text, marks and signatures become part of the page. Other comments stay editable.	Текст, пометки и подписи становятся частью страницы. Остальные комментарии можно по-прежнему править.
 	OK	OK
 	Join our Discord	Присоединяйтесь к нашему Discord
 	Close	Закрыть
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 084417c9..516562a5 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2110,3 +2110,8 @@ calendar date	December	грудня
 	Larger pages	Більші сторінки
 	Smaller pages	Менші сторінки
 	Reset page size	Скинути розмір сторінок
+	Larger pages	Більші сторінки
+	Smaller pages	Менші сторінки
+	Reset page size	Скинути розмір сторінок
+	Flatten Fill & Sign when saving	Звести «Заповнення й підпис» під час збереження
+	Text, marks and signatures become part of the page. Other comments stay editable.	Текст, позначки й підписи стають частиною сторінки. Інші коментарі залишаються редагованими.
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 19059258..f8b5233d 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -131,6 +131,8 @@
 	Display theme	显示主题
 	Side panels	侧边面板
 	Enable Acrobat JavaScript	启用 Acrobat JavaScript
+	Flatten Fill & Sign when saving	保存时拼合填写与签名
+	Text, marks and signatures become part of the page. Other comments stay editable.	文字、标记和签名会成为页面内容。其他注释仍可编辑。
 	OK	确定
 	Cancel	取消
 	Close	关闭
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index fb3059b1..f5015bed 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -307,6 +307,12 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
             .labelled_by(label.id);
     });
     ui.add_space(8.0);
+    ui.label(egui::RichText::new(tl!("Fill & Sign")).font(theme::semibold(13.0)));
+    ui.checkbox(&mut app.flatten_fill_sign_on_save, tl!("Flatten Fill & Sign when saving"));
+    ui.label(
+        egui::RichText::new(tl!("Text, marks and signatures become part of the page. Other comments stay editable.")).small().color(t.text_muted),
+    );
+    ui.add_space(8.0);
     ui.label(egui::RichText::new("JavaScript").font(theme::semibold(13.0)));
     egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
         ui.set_width(ui.available_width());
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 93c81a94..feb39e21 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -370,6 +370,8 @@ pub struct PdfCraftApp {
     pub theme_preference: ThemePreference,
     /// Interface language preference: `auto` (follow the system) or a code from [`i18n::LANGUAGES`].
     pub language: String,
+    /// Preferences: bake Fill & Sign marks into the page when saving. Off, so a normal save stays editable.
+    pub flatten_fill_sign_on_save: bool,
     pub dialog: Option<Dialog>,
     /// How to ask for the latest release (the desktop app sets it; see `updates`).
     pub update_source: Option<updates::UpdateSource>,
@@ -620,6 +622,7 @@ impl PdfCraftApp {
             theme: ThemeKind::Light,
             theme_preference: ThemePreference::Light,
             language: i18n::AUTO.to_string(),
+            flatten_fill_sign_on_save: false,
             dialog: None,
             update_source: None,
             updates: updates::Updates::default(),
@@ -1207,6 +1210,7 @@ impl PdfCraftApp {
             "default_zoom": self.view_defaults.zoom_name(),
             "highlight_fields": self.view_defaults.highlight_fields,
             "language": self.language,
+            "flatten_fill_sign": self.flatten_fill_sign_on_save,
             "author": self.comment_prefs.author,
             // Drawn signatures keep their original form (older settings read the same).
             "signature": match &self.signature { Some(fill_sign::SavedSig::Drawn(s)) => Some(s), _ => None },
@@ -1261,6 +1265,9 @@ impl PdfCraftApp {
         if let Some(language) = v["language"].as_str().and_then(i18n::normalize_pref) {
             self.language = language.to_string();
         }
+        if let Some(on) = v["flatten_fill_sign"].as_bool() {
+            self.flatten_fill_sign_on_save = on;
+        }
         // An empty or missing name keeps the login-name default; settings are untrusted, so the
         // name is cut to a sane length.
         if let Some(author) = v["author"].as_str().map(str::trim).filter(|a| !a.is_empty()) {
@@ -1506,6 +1513,13 @@ impl PdfCraftApp {
                 };
             }
             ("author", _) => self.comment_prefs.author = value.to_string(),
+            ("flatten-fill-sign", _) => {
+                self.flatten_fill_sign_on_save = match value {
+                    "true" => true,
+                    "false" => false,
+                    _ => return Err("flatten-fill-sign must be true or false".into()),
+                };
+            }
             ("comment", Some(v)) => {
                 // `--comment 2:4` selects the 4th annotation of page 2 (1-based, as comment_list reports).
                 let (p, i) = value.split_once(':').ok_or("comment: PAGE:INDEX")?;
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 9ba0cc55..96df83af 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -878,6 +878,65 @@ fn image_import_cancel_clear_and_errors_preserve_saved_signatures() {
     std::fs::remove_file(path).unwrap();
 }
 
+#[test]
+fn flatten_on_save_is_off_by_default_and_round_trips() {
+    let mut app = PdfCraftApp::new();
+    assert!(!app.flatten_fill_sign_on_save);
+    app.set_option("flatten-fill-sign", "true").unwrap();
+    assert!(app.set_option("flatten-fill-sign", "yes").is_err());
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&app.persist());
+    assert!(restored.flatten_fill_sign_on_save);
+    restored.set_option("flatten-fill-sign", "false").unwrap();
+    let mut again = PdfCraftApp::new();
+    again.restore(&restored.persist());
+    assert!(!again.flatten_fill_sign_on_save);
+}
+
+#[test]
+fn saving_flattens_fill_and_sign_only_when_the_preference_is_on() {
+    use pdfcraft_engine::{Edit, FillMark, NewAnnotation, Shape, Style};
+    use pdfcraft_ui_egui::SaveTarget;
+    use pdfcraft_ui_egui::fill_sign::TypeBox;
+
+    let dir = std::env::temp_dir().join(format!("pdfcraft-fill-flatten-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let mark = Edit::AddAnnotation(NewAnnotation {
+        page: 0,
+        shape: Shape::Mark { rect: [40.0, 80.0, 56.0, 96.0], mark: FillMark::Check },
+        style: Style::default_for(&Shape::Mark { rect: [0.0, 0.0, 12.0, 12.0], mark: FillMark::Check }),
+        contents: String::new(),
+        author: "Ada".into(),
+    });
+
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("form.pdf", None, FIXTURE.to_vec()).unwrap();
+    let id = app.views[0].id;
+    app.session.apply(id, mark).unwrap();
+    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), focus: false });
+    let kept = dir.join("kept.pdf");
+    app.save_override = Some(kept.to_string_lossy().into_owned());
+    assert!(app.save_active(SaveTarget::InPlace));
+    let mut reopened = PdfCraftApp::new();
+    reopened.open_bytes("kept.pdf", None, std::fs::read(&kept).unwrap()).unwrap();
+    let texts: Vec<String> =
+        reopened.session.get(reopened.views[0].id).unwrap().info.annotations.iter().map(|a| a.contents.clone().unwrap_or_default()).collect();
+    assert!(texts.iter().any(|t| t == "Typed"), "an open type box is saved: {texts:?}");
+    assert_eq!(reopened.session.get(reopened.views[0].id).unwrap().info.annotations.len(), 2, "the check mark stays too");
+
+    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 160.0], text: "More".into(), focus: false });
+    app.flatten_fill_sign_on_save = true;
+    let flat = dir.join("flat.pdf");
+    app.save_override = Some(flat.to_string_lossy().into_owned());
+    assert!(app.save_active(SaveTarget::InPlace));
+    let mut flattened = PdfCraftApp::new();
+    flattened.open_bytes("flat.pdf", None, std::fs::read(&flat).unwrap()).unwrap();
+    let left = &flattened.session.get(flattened.views[0].id).unwrap().info.annotations;
+    assert!(left.is_empty(), "text and the check mark are page content: {left:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// Issue #299: drawn and typed signatures and initials are upright as displayed on pages with
 /// `/Rotate` 90, 180 and 270, anchored at the displayed point, exactly as on an unturned page.
 #[test]
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index de7b83de..ab580ddb 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5235,11 +5235,11 @@ title = "Fill & Sign: flatten on save"
 area = "F"
 tier = "P0"
 milestone = "M5"
-status = "partial"
+status = "shipped"
 commands = ["comment.flatten"]
-tools = ["doc_flatten"]
-evidence = ["crates/edit/src/tests.rs::flattening_draws_appearances_into_the_page_and_removes_the_comments", "crates/engine/src/tests.rs::flattening_keeps_the_look_and_drops_the_objects", "crates/automation/tests/automation.rs::flattening_through_tools"]
-notes = "Flatten comments flattens Fill & Sign items; no flatten-on-save option yet"
+tools = ["doc_save", "doc_flatten"]
+evidence = ["crates/edit/src/tests.rs::fill_sign_flatten_bakes_marks_keeps_other_comments_and_does_not_reuse_pcfl0", "crates/engine/src/tests.rs::flattening_fill_and_sign_keeps_other_comments_fields_and_undoes", "crates/engine/src/tests.rs::flattening_fill_and_sign_is_refused_without_permission_to_change", "crates/automation/tests/automation.rs::saving_with_flatten_fill_sign_bakes_marks_and_leaves_other_comments", "crates/ui-egui/tests/fill_sign.rs::saving_flattens_fill_and_sign_only_when_the_preference_is_on"]
+notes = "Preferences ▸ Fill & Sign, and doc_save flatten_fill_sign, bake text, marks and signatures into the page. The option defaults off, so a normal save leaves them editable. Other comments and form fields stay. Flatten comments still flattens every comment."
 
 [[feature]]
 id = "form.autofill-profile"
@@ -9675,7 +9675,7 @@ status = "partial"
 commands = ["app.preferences"]
 tools = ["js_enabled"]
 evidence = ["crates/ui-egui/tests/javascript.rs::document_scripts_and_preferences", "crates/ui-egui/tests/ui.rs::preferences_selects_default_workspace_for_next_open", "crates/ui-egui/tests/control.rs::control_default_workspace_and_session_override"]
-notes = "Preferences dialog with Interface language, Documents and view (persistent default workspace with session override), Identity and JavaScript; other categories still live in their tools, and it isn't generated from a schema yet."
+notes = "Preferences dialog with Interface language, Documents and view (persistent default workspace with session override), Identity, Fill & Sign (flatten on save, off by default) and JavaScript; other categories still live in their tools, and it isn't generated from a schema yet."
 
 [[feature]]
 id = "misc.prefs-general"

From d592dbb9c42d9709d238d5cd3ca5f4c96a5279b8 Mon Sep 17 00:00:00 2001
From: kisst <github@kisst.net>
Date: Fri, 9 Oct 2026 20:26:29 +0200
Subject: [PATCH 109/149] Fill & Sign: date format and date language in
 Preferences (refs #158) (#505)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M5.7: date format and date language for Fill & Sign in the engine

* M5: flatten Fill & Sign marks when saving

Saving can now bake typed text, marks and signatures into the page, from Preferences or doc_save. The option defaults off, so a normal save still leaves them editable, and other comments and form fields stay.

* M4: zoom the Organize page grid

The page grid draws its pages at 50% to 300%: toolbar buttons with a
percentage that resets to 100%, trackpad pinch or Ctrl/⌘ + wheel about
the page under the pointer, and ⌘+ / ⌘− / ⌘0 (which no longer change the
hidden page view's zoom while the grid shows).

Thumbnails are re-rendered sharper in a few steps as the grid grows,
capped so one document's thumbnails stay within 256 MB. The page under
the pointer (or the first one in view) stays where it is across a zoom.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: zoomed grid pages are rendered at the size drawn

A zoomed page grid stretched 132 pt thumbnails, and the stepped detail
that was meant to help was capped by a memory budget, so a long document
stayed blurry at any zoom.

Pages drawn larger than their thumbnails now get a render at exactly the
size drawn while they are in view; the thumbnail stands in until it
arrives. Only pages in view keep one, so memory no longer depends on the
page count, and thumbnails go back to their one fixed size.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M5.7: fill_sign_date_format tool; format and language on fill_sign_add

* M5.7: Preferences ▸ Date format for Fill & Sign dates (refs #158)

* M5.7: refuse Fill & Sign dates the PDF text font can't hold

* M5.7: Spanish labels for Preferences ▸ Date format

* View: the middle button pans instead of drawing with markup tools

egui's drag responses accept every pointer button, so on Windows and macOS a
middle-button drag reached the page tools: with Draw (ink) selected it drew a
stroke, and other tools cropped, selected or moved. Linux was unaffected
because its middle-click auto-scroll already blocks page input.

Outside Linux a middle-button drag that starts in the viewport (document or
Organize Pages) now pans 1:1 while the button is held, with a Grabbing
cursor, and page input is blocked from the press through the release. Linux
keeps its latched auto-scroll.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: a short page gone to from the Pages panel stays current

The current page was whichever page showed most of itself. Going to a short
page (a cheque) above a tall one scrolls it to the top, where the tall page
below shows more, so the current page and the Pages panel's highlight moved
to the tall page instead of the one clicked. The page navigated to now stays
current while it is wholly on screen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: page operations from the Pages panel: context menu and drag to reorder

Right-clicking a thumbnail offers Extract pages, Cut, Copy and Paste after, on
the selection or on the page clicked (which becomes the selection), as the
organize grid does. Dragging thumbnails moves the selection, or the page
grabbed, to the gap it is dropped on: a bar marks the gap, the page count
follows the pointer, and the panel scrolls near its edges. The move is one
undoable step; the moved pages stay selected and the current page follows
its page. Documents that forbid assembly keep click-only thumbnails.

Parity: view.thumbnail-context-ops is shipped, with what it still lacks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Pages panel: only the primary button drags thumbnails; a drag left over after the panel closed or the document changed is dropped

* Fill & Sign dates: German, Bulgarian, Hungarian and Ukrainian month and weekday names, matching the interface languages

---------

Co-authored-by: Mark Bartalos <bartalos86@gmail.com>
Co-authored-by: samehelhawary <basio20044@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cody Vogt <Cody.Vogt@caltechsurveys.com>
Co-authored-by: William Max & Co. <info@williammax.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                      |  22 +-
 ROADMAP.md                            |   5 +
 crates/automation/src/comments.rs     |  36 +-
 crates/automation/src/lib.rs          |   1 +
 crates/automation/src/tools.rs        |   6 +-
 crates/automation/tests/automation.rs |  38 +-
 crates/engine/src/dates.rs            | 550 ++++++++++++++++++++++++++
 crates/engine/src/lib.rs              |   5 +
 crates/ui-egui/src/canvas.rs          |   9 +-
 crates/ui-egui/src/fill_sign.rs       |  18 +-
 crates/ui-egui/src/i18n/bg.tsv        |   7 +
 crates/ui-egui/src/i18n/de.tsv        |   7 +
 crates/ui-egui/src/i18n/es.tsv        |   7 +
 crates/ui-egui/src/i18n/fr.tsv        |   7 +
 crates/ui-egui/src/i18n/hu.tsv        |  10 +-
 crates/ui-egui/src/i18n/ja.tsv        |   7 +
 crates/ui-egui/src/i18n/mod.rs        |   8 +
 crates/ui-egui/src/i18n/ru.tsv        |   7 +
 crates/ui-egui/src/i18n/te.tsv        |   7 +
 crates/ui-egui/src/i18n/uk.tsv        |  10 +-
 crates/ui-egui/src/i18n/zh-hans.tsv   |   7 +
 crates/ui-egui/src/i18n/zh-hant.tsv   |   7 +
 crates/ui-egui/src/js_ui.rs           |  93 +++++
 crates/ui-egui/src/lib.rs             |  35 ++
 crates/ui-egui/tests/date_format.rs   | 160 ++++++++
 parity/acrobat-features.toml          |   6 +-
 26 files changed, 1042 insertions(+), 33 deletions(-)
 create mode 100644 crates/engine/src/dates.rs
 create mode 100644 crates/ui-egui/tests/date_format.rs

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 20866740..9ddd3c04 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5e6493d38917e6900f126d0a4fc9819b1b9a57e2d883207d03606d1c3e0c6d94"
+sha256 = "25a6a7ccbc113f8a64092b8962c9c0bfe64bfb6dc2000e2a6164881b492e8684"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e049f7df877d07137465cbe7ead240c9cd60daaaeb298f4877eb58974c728004"
+sha256 = "957b2ca722eb3ebb6c6303ff5e25245b850b3a3e6ddba094516174e804aa96c1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f47c19dcf7272068dc8b46a37eb692948f5571737f6c1c82e8282f1b7d64458d"
+sha256 = "4d139791454c1c3a00e2726e495b1170eb1f5be95f6cd5e12e7311c85aca0259"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e735d7f40fa5d34627209287d82a4ce2651d7a04a31bc1bbae1b8be0ffbed972"
+sha256 = "716fb1f47bc69c355a688f116715b819a03c59d99ba9e03d65db2dd79bbe11b9"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "97c6d0ef61a16419b8eb8807ad91a6544a5d7d9d3e20dfd35f33c39c105107a0"
+sha256 = "f78e4175753553fcb27d61697e64ab092cede8433a8ae68ca1f553879b4217dc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d3630f989e9725c22444dc27765142674b66f72436502ca969b2851fc38d703d"
+sha256 = "329b95966eca05438ea23deb2a48f61d9af9e984017d14942af06b3bb0799e4b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fb9e2120dab378f35110897e7d0ebc53fce331cc918df393946a1f96ad2335e3"
+sha256 = "50390d434fbebc5d6ed1a259db96d73d76be5678f4c87a8b04ddd1c38a4901f7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fd4281afd9a33a0e73bab937b9d05cb92200967eb1847d8f43709ca9cdabf080"
+sha256 = "4b7618b83b5b4479e5b8e4022a302689d8acf194a10368d7ef34302f8e19e299"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4de7b3bae615f5b8bc29e56cd69d932735ee82ed5b7bbdb713c8b5c0c47cea84"
+sha256 = "78053df6ec3de2d0b6a10338b57618302deb4ec8cfb794be5a4a4d2bdc2f950b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cba0c2ca8989a28aa41056b98eb1c8019e3a13e882ead246ea1d69f82c44e087"
+sha256 = "285d3d9c8fff269ceb032e6be67a1c33d596f2ed80c9d8677f5655fb014f43b5"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ca16d314028a95bd3b7eb73e9ea6c9d388a844f841e8c8811e340eb5a4161227"
+sha256 = "06e8584e6f16528598e311e1b0dbd167701967c6786e14701886285babb38c9f"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index 4c8e3dcf..dba0e114 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -135,6 +135,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
 
+- **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
@@ -145,6 +146,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
@@ -168,6 +171,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (community, M14, #503):** Ukrainian (Українська, `uk`) adds 2,047 original catalog entries covering commands, tools, dialogs, panels, notices, history and contributor controls. Auto resolves `uk`/`uk_UA`; the manual preference persists. Integer plurals distinguish one/few/many, including 11–14 and large counts; fixed-count templates use count-neutral wording. Calendar dates use genitive month names; Home cards fit wrapped text and the search hint keeps clear of its shortcut. Coverage checks scan UI literals, and font checks use bundled Inter and JetBrains Mono, including ґ/є/і/ї. Control tests check translated Preferences, command search, error framing and language switching with unsaved documents. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (community, M5, #158):** Fill & Sign date format. Preferences ▸ Date format sets the pattern Fill & Sign dates use: 12 presets or any pattern in Acrobat date letters (with `\` escapes), checked and previewed as typed, remembered, and settable through `fill_sign_date_format`, `fill_sign_add` `format`/`language` and `ui set date-format`/`date-language`. Month and weekday names come in the interface languages (Czech in the genitive after a day), following the interface language unless one is picked. Fill & Sign text is still Helvetica/WinAnsi, so a date with other letters (Czech ř, Japanese, Chinese) is refused with a warning rather than saved as "?". This goes past Acrobat, whose Fill & Sign has no format setting. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (community, Home pinned folders):** Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, M14, Telugu):** Telugu (తెలుగు, `te`) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; `te` and `te_IN` locales follow it. Telugu text is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index ebeab262..b7f83c2f 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -419,6 +419,35 @@ impl Automation {
         Ok(out)
     }
 
+    /// Preferences ▸ Date format: set it with `format` and its names' `language` (`auto`
+    /// follows the app's interface language, so English here), or read them.
+    pub(crate) fn fill_sign_date_format(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::dates;
+        let format = a.opt_str("format")?;
+        let language = a.opt_str("language")?.map(|l| Some(l).filter(|l| !l.trim().eq_ignore_ascii_case("auto")));
+        // Check the format before changing anything, so a bad one leaves both settings alone.
+        if let Some(f) = format {
+            dates::check_date_format(f).map_err(ToolError::InvalidArgs)?;
+        }
+        if let Some(l) = language {
+            self.session.set_date_language(l).map_err(ToolError::InvalidArgs)?;
+        }
+        if let Some(f) = format {
+            self.session.set_date_format(f).map_err(ToolError::InvalidArgs)?;
+        }
+        let today = self.session.today_text(None, None).map_err(ToolError::Failed)?;
+        let languages: Vec<Value> = dates::DATE_LANGUAGES.iter().map(|l| json!({ "code": l.code, "name": l.name })).collect();
+        Ok(json!({
+            "format": self.session.date_format(),
+            "language": self.session.date_language().unwrap_or("auto"),
+            // Characters Fill & Sign can't write into a PDF yet; dates with them are refused.
+            "unwritable": dates::unwritable(&today),
+            "today": today,
+            "presets": dates::DATE_FORMATS,
+            "languages": languages,
+        }))
+    }
+
     pub(crate) fn fill_sign_add(&mut self, a: &Args) -> Result<Value> {
         use pdfcraft_engine::FillMark;
         let page = self.page(a)?;
@@ -449,8 +478,11 @@ impl Automation {
                 (text_at(&t), t)
             }
             "date" => {
-                let (yy, m, d) = self.session.today();
-                let t = format!("{m}/{d}/{yy}");
+                let lang = a.opt_str("language")?;
+                if let Some(l) = lang.filter(|l| pdfcraft_engine::dates::date_language(l).is_none()) {
+                    return Err(ToolError::InvalidArgs(format!("unknown date language {l:?} (see fill_sign_date_format)")));
+                }
+                let t = self.session.today_text_for_pdf(a.opt_str("format")?, lang).map_err(ToolError::InvalidArgs)?;
                 (text_at(&t), t)
             }
             // A typed signature or initials in the script font, left edge at `at`, upright as displayed.
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 0315f58c..b3999c07 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -530,6 +530,7 @@ impl Automation {
             "doc_print" => self.doc_print(&a)?,
             "doc_remove_hidden" => self.doc_remove_hidden(&a)?,
             "fill_sign_add" => self.fill_sign_add(&a)?,
+            "fill_sign_date_format" => self.fill_sign_date_format(&a)?,
             "measure_distance" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Distance)?,
             "measure_perimeter" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Perimeter)?,
             "measure_area" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Area)?,
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 92f42e72..74eb2bbb 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -915,7 +915,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "fill_sign_add",
             "Fill & Sign: type text or place a mark",
-            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, 10 pt), place a check, cross, dot or line, today's date, or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 4 megapixels, preserving transparency). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations.",
+            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, 10 pt), place a check, cross, dot or line, today's date (in Preferences ▸ Date format, see fill_sign_date_format, or `format`), or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 4 megapixels, preserving transparency). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations.",
         )
         .cmd("sign.fill.text")
         .with(schema(
@@ -926,10 +926,14 @@ pub fn tools() -> Vec<ToolDef> {
                 "at": point(),
                 "text": { "type": "string", "minLength": 1 },
                 "path": { "type": "string", "description": "PNG or JPEG for signature/initials; pass either path or text." },
+                "format": { "type": "string", "description": "For type date: this pattern instead of the date-format preference, e.g. \"dd.mm.yyyy\"." },
+                "language": { "type": "string", "description": "For type date: month and weekday names in this language code (see fill_sign_date_format) instead of the preference." },
                 "author": { "type": "string" },
             }),
             &["doc", "page", "type", "at"],
         )),
+        t("fill_sign_date_format", "Date format for Fill & Sign", "Preferences ▸ Date format: the pattern Fill & Sign dates use (default m/d/yyyy). Set it with `format` (Acrobat date codes yyyy yy mmmm mmm mm m dddd ddd dd d, other runs of y, m or d are refused; H h M s t are time letters and need \\ before them; \\ shows the next character as is), or read it. `language` sets the language of month and weekday names (a code from `languages`, or `auto` to follow the app's interface language; English headless). Returns the format, the language, today in them, `unwritable` (characters of today's date that Fill & Sign can't write into a PDF yet, Western European only; fill_sign_add refuses such a date), the ready-made presets and the languages.")
+            .with(schema(json!({ "format": { "type": "string", "minLength": 1, "maxLength": 64 }, "language": { "type": "string" } }), &[])),
         t(
             "doc_create",
             "Create a PDF",
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index f42cbb6f..a3ba9976 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1375,8 +1375,44 @@ fn fill_and_sign_through_tools() {
     ));
     let texts = page_text(&mut a, doc);
     assert!(texts[0].contains("Ada Lovelace") && texts[0].contains("11/14/2023"), "{texts:?}");
+    // Preferences ▸ Date format, and a one-off pattern.
+    let f = ok(&mut a, "fill_sign_date_format", json!({}));
+    assert_eq!((f["format"].as_str(), f["today"].as_str()), (Some("m/d/yyyy"), Some("11/14/2023")), "{f}");
+    assert_eq!(ok(&mut a, "fill_sign_date_format", json!({ "format": "yyyy.mm.dd." }))["today"], "2023.11.14.");
+    ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": 1, "type": "date", "at": [20, 220] }));
+    ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": 1, "type": "date", "at": [20, 240], "format": "d \\de mmmm" }));
+    let texts = page_text(&mut a, doc);
+    assert!(texts[0].contains("2023.11.14.") && texts[0].contains("14 de November"), "{texts:?}");
+    assert!(matches!(a.call("fill_sign_date_format", &json!({ "format": "HH:MM" })), Err(ToolError::InvalidArgs(_))));
+    assert_eq!(ok(&mut a, "fill_sign_date_format", json!({}))["format"], "yyyy.mm.dd.", "a rejected format keeps the previous one");
+    // Month and weekday names in a chosen language, for the preference or one date.
+    let f = ok(&mut a, "fill_sign_date_format", json!({ "format": "d. mmmm yyyy", "language": "cs" }));
+    assert_eq!((f["language"].as_str(), f["today"].as_str()), (Some("cs"), Some("14. listopadu 2023")), "{f}");
+    assert_eq!(f["languages"].as_array().unwrap().len(), pdfcraft_engine::dates::DATE_LANGUAGES.len(), "every date language");
+    ok(&mut a, "fill_sign_add", json!({ "doc": doc, "page": 1, "type": "date", "at": [20, 280], "format": "d \\de mmmm", "language": "es" }));
+    assert!(page_text(&mut a, doc)[0].contains("14 de noviembre"));
+    assert!(matches!(a.call("fill_sign_date_format", &json!({ "format": "yyy" })), Err(ToolError::InvalidArgs(_))));
+    // A date the PDF's text font can't hold is refused, not saved as "?".
+    match a.call("fill_sign_add", &json!({ "doc": doc, "page": 1, "type": "date", "at": [20, 300], "format": "dddd", "language": "ja" })) {
+        Err(ToolError::InvalidArgs(e)) => assert!(e.contains("火曜日") && e.contains("can't be written into the PDF yet"), "{e}"),
+        other => panic!("expected a refusal, got {other:?}"),
+    }
+    let f = ok(&mut a, "fill_sign_date_format", json!({ "format": "dddd", "language": "ja" }));
+    assert_eq!((f["today"].as_str(), f["unwritable"].as_str()), (Some("火曜日"), Some("火曜日")));
+    ok(&mut a, "fill_sign_date_format", json!({ "format": "d. mmmm yyyy", "language": "cs" }));
+    assert!(matches!(a.call("fill_sign_date_format", &json!({ "format": "dd", "language": "xx" })), Err(ToolError::InvalidArgs(_))));
+    assert!(matches!(
+        a.call("fill_sign_add", &json!({ "doc": doc, "page": 1, "type": "date", "at": [20, 300], "language": "xx" })),
+        Err(ToolError::InvalidArgs(_))
+    ));
+    let f = ok(&mut a, "fill_sign_date_format", json!({ "language": "auto" }));
+    assert_eq!((f["format"].as_str(), f["language"].as_str(), f["today"].as_str()), (Some("d. mmmm yyyy"), Some("auto"), Some("14. November 2023")));
+    assert!(matches!(
+        a.call("fill_sign_add", &json!({ "doc": doc, "page": 1, "type": "date", "at": [20, 260], "format": "Year" })),
+        Err(ToolError::InvalidArgs(_))
+    ));
     let list = ok(&mut a, "comment_list", json!({ "doc": doc }));
-    assert_eq!(list["count"], 4);
+    assert_eq!(list["count"], 7);
     assert!(matches!(a.call("fill_sign_add", &json!({ "doc": doc, "page": 1, "type": "text", "at": [1, 1] })), Err(ToolError::InvalidArgs(_))));
 }
 
diff --git a/crates/engine/src/dates.rs b/crates/engine/src/dates.rs
new file mode 100644
index 00000000..fab1b5db
--- /dev/null
+++ b/crates/engine/src/dates.rs
@@ -0,0 +1,550 @@
+//! The date format Fill & Sign stamps (Preferences ▸ Date format), kept on the [`Session`] so
+//! the app and the automation tools write the same text. Acrobat's Fill & Sign has no such
+//! setting (only Acrobat Sign's account settings do); this one is per user and takes any
+//! pattern in Acrobat's date letters, not just a fixed list, with month and weekday names in
+//! any of [`DATE_LANGUAGES`].
+//!
+//! Patterns use `util.printd`'s date letters: `yyyy` `yy`, `mmmm` `mmm` `mm` `m`, `dddd` `ddd`
+//! `dd` `d`. `\` shows the next character as is (`d \de mmmm` → `8 de October`).
+
+use crate::Session;
+
+/// The format until the user picks one (Acrobat's: US month/day/year).
+pub const DEFAULT_DATE_FORMAT: &str = "m/d/yyyy";
+
+/// Ready-made formats for Preferences ▸ Date format. Any other valid pattern works too.
+pub const DATE_FORMATS: [&str; 12] = [
+    "m/d/yyyy",
+    "mm/dd/yyyy",
+    "d/m/yyyy",
+    "dd/mm/yyyy",
+    "dd.mm.yyyy",
+    "yyyy-mm-dd",
+    "yyyy.mm.dd.",
+    "d mmm yyyy",
+    "d mmmm yyyy",
+    "mmm d, yyyy",
+    "mmmm d, yyyy",
+    "dddd, mmmm d, yyyy",
+];
+
+/// The longest pattern kept (settings and tool arguments are untrusted).
+pub const MAX_DATE_FORMAT_CHARS: usize = 64;
+
+/// Month and weekday names in one language. Weekdays start on Sunday.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct DateLanguage {
+    /// The interface-language code where there is one (`en`, `cs`, `pt-br`, `zh-hans`, …).
+    pub code: &'static str,
+    /// Its name in itself, for pickers.
+    pub name: &'static str,
+    pub months: [&'static str; 12],
+    /// The month after a day number (`mmmm` when the pattern also shows `d` or `dd`), where
+    /// the language changes it: Czech `8. října`, Russian `8 октября`.
+    pub months_with_day: Option<[&'static str; 12]>,
+    pub months_short: [&'static str; 12],
+    pub days: [&'static str; 7],
+    pub days_short: [&'static str; 7],
+}
+
+const CJK_MONTHS: [&str; 12] = ["1月", "2月", "3月", "4月", "5月", "6月", "7月", "8月", "9月", "10月", "11月", "12月"];
+const ZH_MONTHS: [&str; 12] = ["一月", "二月", "三月", "四月", "五月", "六月", "七月", "八月", "九月", "十月", "十一月", "十二月"];
+const ZH_DAYS: [&str; 7] = ["星期日", "星期一", "星期二", "星期三", "星期四", "星期五", "星期六"];
+
+/// The languages month and weekday names can be written in (Preferences ▸ Date format ▸ Language):
+/// the interface languages, in the same order and with the same names.
+pub const DATE_LANGUAGES: [DateLanguage; 14] = [
+    DateLanguage {
+        code: "en",
+        name: "English",
+        months: ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"],
+        months_with_day: None,
+        months_short: ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"],
+        days: ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"],
+        days_short: ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"],
+    },
+    DateLanguage {
+        code: "ja",
+        name: "日本語",
+        months: CJK_MONTHS,
+        months_with_day: None,
+        months_short: CJK_MONTHS,
+        days: ["日曜日", "月曜日", "火曜日", "水曜日", "木曜日", "金曜日", "土曜日"],
+        days_short: ["日", "月", "火", "水", "木", "金", "土"],
+    },
+    DateLanguage {
+        code: "zh-hans",
+        name: "简体中文",
+        months: ZH_MONTHS,
+        months_with_day: None,
+        months_short: CJK_MONTHS,
+        days: ZH_DAYS,
+        days_short: ["周日", "周一", "周二", "周三", "周四", "周五", "周六"],
+    },
+    DateLanguage {
+        code: "zh-hant",
+        name: "繁體中文",
+        months: ZH_MONTHS,
+        months_with_day: None,
+        months_short: CJK_MONTHS,
+        days: ZH_DAYS,
+        days_short: ["週日", "週一", "週二", "週三", "週四", "週五", "週六"],
+    },
+    DateLanguage {
+        code: "cs",
+        name: "Čeština",
+        months: ["leden", "únor", "březen", "duben", "květen", "červen", "červenec", "srpen", "září", "říjen", "listopad", "prosinec"],
+        months_with_day: Some([
+            "ledna",
+            "února",
+            "března",
+            "dubna",
+            "května",
+            "června",
+            "července",
+            "srpna",
+            "září",
+            "října",
+            "listopadu",
+            "prosince",
+        ]),
+        months_short: ["led", "úno", "bře", "dub", "kvě", "čvn", "čvc", "srp", "zář", "říj", "lis", "pro"],
+        days: ["neděle", "pondělí", "úterý", "středa", "čtvrtek", "pátek", "sobota"],
+        days_short: ["ne", "po", "út", "st", "čt", "pá", "so"],
+    },
+    DateLanguage {
+        code: "pt-br",
+        name: "Português (Brasil)",
+        months: ["janeiro", "fevereiro", "março", "abril", "maio", "junho", "julho", "agosto", "setembro", "outubro", "novembro", "dezembro"],
+        months_with_day: None,
+        months_short: ["jan", "fev", "mar", "abr", "mai", "jun", "jul", "ago", "set", "out", "nov", "dez"],
+        days: ["domingo", "segunda-feira", "terça-feira", "quarta-feira", "quinta-feira", "sexta-feira", "sábado"],
+        days_short: ["dom", "seg", "ter", "qua", "qui", "sex", "sáb"],
+    },
+    DateLanguage {
+        code: "de",
+        name: "Deutsch",
+        months: ["Januar", "Februar", "März", "April", "Mai", "Juni", "Juli", "August", "September", "Oktober", "November", "Dezember"],
+        months_with_day: None,
+        months_short: ["Jan.", "Feb.", "März", "Apr.", "Mai", "Juni", "Juli", "Aug.", "Sept.", "Okt.", "Nov.", "Dez."],
+        days: ["Sonntag", "Montag", "Dienstag", "Mittwoch", "Donnerstag", "Freitag", "Samstag"],
+        days_short: ["So.", "Mo.", "Di.", "Mi.", "Do.", "Fr.", "Sa."],
+    },
+    DateLanguage {
+        code: "es",
+        name: "Español",
+        months: ["enero", "febrero", "marzo", "abril", "mayo", "junio", "julio", "agosto", "septiembre", "octubre", "noviembre", "diciembre"],
+        months_with_day: None,
+        months_short: ["ene", "feb", "mar", "abr", "may", "jun", "jul", "ago", "sept", "oct", "nov", "dic"],
+        days: ["domingo", "lunes", "martes", "miércoles", "jueves", "viernes", "sábado"],
+        days_short: ["dom", "lun", "mar", "mié", "jue", "vie", "sáb"],
+    },
+    DateLanguage {
+        code: "fr",
+        name: "Français",
+        months: ["janvier", "février", "mars", "avril", "mai", "juin", "juillet", "août", "septembre", "octobre", "novembre", "décembre"],
+        months_with_day: None,
+        months_short: ["janv.", "févr.", "mars", "avr.", "mai", "juin", "juil.", "août", "sept.", "oct.", "nov.", "déc."],
+        days: ["dimanche", "lundi", "mardi", "mercredi", "jeudi", "vendredi", "samedi"],
+        days_short: ["dim.", "lun.", "mar.", "mer.", "jeu.", "ven.", "sam."],
+    },
+    DateLanguage {
+        code: "ru",
+        name: "Русский",
+        months: ["январь", "февраль", "март", "апрель", "май", "июнь", "июль", "август", "сентябрь", "октябрь", "ноябрь", "декабрь"],
+        months_with_day: Some(["января", "февраля", "марта", "апреля", "мая", "июня", "июля", "августа", "сентября", "октября", "ноября", "декабря"]),
+        months_short: ["янв.", "февр.", "март", "апр.", "май", "июнь", "июль", "авг.", "сент.", "окт.", "нояб.", "дек."],
+        days: ["воскресенье", "понедельник", "вторник", "среда", "четверг", "пятница", "суббота"],
+        days_short: ["вс", "пн", "вт", "ср", "чт", "пт", "сб"],
+    },
+    DateLanguage {
+        code: "bg",
+        name: "Български",
+        months: ["януари", "февруари", "март", "април", "май", "юни", "юли", "август", "септември", "октомври", "ноември", "декември"],
+        months_with_day: None,
+        months_short: ["яну", "фев", "март", "апр", "май", "юни", "юли", "авг", "сеп", "окт", "ное", "дек"],
+        days: ["неделя", "понеделник", "вторник", "сряда", "четвъртък", "петък", "събота"],
+        days_short: ["нд", "пн", "вт", "ср", "чт", "пт", "сб"],
+    },
+    DateLanguage {
+        code: "te",
+        name: "తెలుగు",
+        months: ["జనవరి", "ఫిబ్రవరి", "మార్చి", "ఏప్రిల్", "మే", "జూన్", "జులై", "ఆగస్టు", "సెప్టెంబర్", "అక్టోబర్", "నవంబర్", "డిసెంబర్"],
+        months_with_day: None,
+        months_short: ["జన", "ఫిబ్ర", "మార్చి", "ఏప్రి", "మే", "జూన్", "జులై", "ఆగ", "సెప్టెం", "అక్టో", "నవం", "డిసెం"],
+        days: ["ఆదివారం", "సోమవారం", "మంగళవారం", "బుధవారం", "గురువారం", "శుక్రవారం", "శనివారం"],
+        days_short: ["ఆది", "సోమ", "మంగళ", "బుధ", "గురు", "శుక్ర", "శని"],
+    },
+    DateLanguage {
+        code: "hu",
+        name: "Magyar",
+        months: [
+            "január",
+            "február",
+            "március",
+            "április",
+            "május",
+            "június",
+            "július",
+            "augusztus",
+            "szeptember",
+            "október",
+            "november",
+            "december",
+        ],
+        months_with_day: None,
+        months_short: ["jan.", "febr.", "márc.", "ápr.", "máj.", "jún.", "júl.", "aug.", "szept.", "okt.", "nov.", "dec."],
+        days: ["vasárnap", "hétfő", "kedd", "szerda", "csütörtök", "péntek", "szombat"],
+        days_short: ["V", "H", "K", "Sze", "Cs", "P", "Szo"],
+    },
+    DateLanguage {
+        code: "uk",
+        name: "Українська",
+        months: ["січень", "лютий", "березень", "квітень", "травень", "червень", "липень", "серпень", "вересень", "жовтень", "листопад", "грудень"],
+        months_with_day: Some([
+            "січня",
+            "лютого",
+            "березня",
+            "квітня",
+            "травня",
+            "червня",
+            "липня",
+            "серпня",
+            "вересня",
+            "жовтня",
+            "листопада",
+            "грудня",
+        ]),
+        months_short: ["січ.", "лют.", "бер.", "квіт.", "трав.", "черв.", "лип.", "серп.", "вер.", "жовт.", "лист.", "груд."],
+        days: ["неділя", "понеділок", "вівторок", "середа", "четвер", "пʼятниця", "субота"],
+        days_short: ["нд", "пн", "вт", "ср", "чт", "пт", "сб"],
+    },
+];
+
+/// The date language for `code` (any case), or `None` when there's none.
+pub fn date_language(code: &str) -> Option<&'static DateLanguage> {
+    DATE_LANGUAGES.iter().find(|l| l.code.eq_ignore_ascii_case(code.trim()))
+}
+
+/// The characters of `text` that Fill & Sign can't write into a PDF yet, each once. Its text is
+/// drawn in Helvetica with WinAnsi encoding (Western European letters), so anything else (`ř`,
+/// Japanese, Chinese) would become `?` in the file.
+pub fn unwritable(text: &str) -> String {
+    let mut out = String::new();
+    for c in text.chars() {
+        let mut buf = [0u8; 4];
+        if c != '?' && pdfcraft_fonts::win_ansi(c.encode_utf8(&mut buf)) == b"?" && !out.contains(c) {
+            out.push(c);
+        }
+    }
+    out
+}
+
+/// `fmt` trimmed, when it's a usable date pattern: not too long, showing at least a year,
+/// month or day, and no time letters (`H h M s t`) unless escaped with `\`.
+pub fn check_date_format(fmt: &str) -> Result<&str, String> {
+    let fmt = fmt.trim();
+    if fmt.is_empty() {
+        return Err("the date format is empty".into());
+    }
+    if fmt.chars().count() > MAX_DATE_FORMAT_CHARS {
+        return Err(format!("the date format is longer than {MAX_DATE_FORMAT_CHARS} characters"));
+    }
+    let letters: String = unescaped(fmt).filter_map(|(c, escaped)| (!escaped).then_some(c)).collect();
+    if let Some(c) = letters.chars().find(|c| matches!(c, 'H' | 'h' | 'M' | 's' | 't')) {
+        return Err(format!("`{c}` is a time letter (H h M s t); put \\ before it to show it as is"));
+    }
+    if !letters.chars().any(|c| matches!(c, 'y' | 'm' | 'd')) {
+        return Err("the date format shows no year (y), month (m) or day (d)".into());
+    }
+    // Only whole codes: `yyy` or `mmmmm` would silently show something else.
+    for (c, n, _) in runs(fmt).into_iter().filter(|r| !r.2) {
+        let fits = match c {
+            'y' => n == 2 || n == 4,
+            'm' | 'd' => (1..=4).contains(&n),
+            _ => true,
+        };
+        if !fits {
+            let code: String = std::iter::repeat_n(c, n).collect();
+            let use_ = match c {
+                'y' => "yy or yyyy",
+                'm' => "m, mm, mmm or mmmm",
+                _ => "d, dd, ddd or dddd",
+            };
+            return Err(format!("`{code}` is not a date code; use {use_}"));
+        }
+    }
+    Ok(fmt)
+}
+
+/// `fmt` as runs of the same character with whether it's escaped: `dd.\mm` → (`d`, 2, no),
+/// (`.`, 1, no), (`m`, 1, yes), (`m`, 1, no). Escaped characters are never grouped.
+fn runs(fmt: &str) -> Vec<(char, usize, bool)> {
+    let mut runs: Vec<(char, usize, bool)> = Vec::new();
+    for (c, escaped) in unescaped(fmt) {
+        match runs.last_mut() {
+            Some((last, n, false)) if !escaped && *last == c => *n += 1,
+            _ => runs.push((c, 1, escaped)),
+        }
+    }
+    runs
+}
+
+/// The day `(year, month, day)` written in `fmt` with `lang`'s names. Anything but the date
+/// letters is copied as is; a month or day out of range shows as its number.
+pub fn format_day(fmt: &str, (y, m, d): (i64, u32, u32), lang: &DateLanguage) -> String {
+    let runs = runs(fmt);
+    let with_day = runs.iter().any(|&(c, n, escaped)| !escaped && c == 'd' && n <= 2);
+    let month = (m as usize).checked_sub(1);
+    let weekday = weekday(y, m, d);
+    let mut out = String::new();
+    for (c, n, escaped) in runs {
+        match (c, n) {
+            _ if escaped => out.push(c),
+            ('y', 4..) => out.push_str(&format!("{:04}", y.clamp(0, 9999))),
+            ('y', _) => out.push_str(&format!("{:02}", y.rem_euclid(100))),
+            ('m', 3..) => {
+                let names = if n >= 4 { lang.months_with_day.filter(|_| with_day).unwrap_or(lang.months) } else { lang.months_short };
+                match month.and_then(|i| names.get(i)) {
+                    Some(name) => out.push_str(name),
+                    None => out.push_str(&m.to_string()),
+                }
+            }
+            ('m', 2) => out.push_str(&format!("{m:02}")),
+            ('m', _) => out.push_str(&m.to_string()),
+            ('d', 3..) => {
+                let names = if n >= 4 { lang.days } else { lang.days_short };
+                match weekday.and_then(|w| names.get(w)) {
+                    Some(name) => out.push_str(name),
+                    None => out.push_str(&d.to_string()),
+                }
+            }
+            ('d', 2) => out.push_str(&format!("{d:02}")),
+            ('d', _) => out.push_str(&d.to_string()),
+            _ => out.extend(std::iter::repeat_n(c, n)),
+        }
+    }
+    out
+}
+
+/// The weekday (0 = Sunday) of a Gregorian date in years 1–9999, or `None` for an invalid one.
+fn weekday(y: i64, m: u32, d: u32) -> Option<usize> {
+    const T: [i64; 12] = [0, 3, 2, 5, 0, 3, 5, 1, 4, 6, 2, 4];
+    if !(1..=9999).contains(&y) || !(1..=31).contains(&d) {
+        return None;
+    }
+    let t = *T.get((m as usize).checked_sub(1)?)?;
+    let y = y - i64::from(m < 3);
+    Some((y + y / 4 - y / 100 + y / 400 + t + i64::from(d)).rem_euclid(7) as usize)
+}
+
+/// The characters of `fmt`, each with whether a `\` before it makes it literal.
+fn unescaped(fmt: &str) -> impl Iterator<Item = (char, bool)> + '_ {
+    let mut chars = fmt.chars();
+    std::iter::from_fn(move || match chars.next()? {
+        '\\' => Some(chars.next().map_or(('\\', true), |c| (c, true))),
+        c => Some((c, false)),
+    })
+}
+
+impl Session {
+    /// Preferences ▸ Date format: the pattern Fill & Sign dates use. Rejects unusable patterns
+    /// (see [`check_date_format`]) and keeps the previous one.
+    pub fn set_date_format(&mut self, fmt: &str) -> Result<(), String> {
+        let fmt = check_date_format(fmt)?;
+        self.date_format = (fmt != DEFAULT_DATE_FORMAT).then(|| fmt.to_string());
+        Ok(())
+    }
+
+    pub fn date_format(&self) -> &str {
+        self.date_format.as_deref().unwrap_or(DEFAULT_DATE_FORMAT)
+    }
+
+    /// Preferences ▸ Date format ▸ Language: the language of month and weekday names, or
+    /// `None` to follow the interface language. Rejects codes not in [`DATE_LANGUAGES`].
+    pub fn set_date_language(&mut self, code: Option<&str>) -> Result<(), String> {
+        self.date_language = match code {
+            None => None,
+            Some(c) => Some(date_language(c).map(|l| l.code.to_string()).ok_or_else(|| {
+                let codes: Vec<&str> = DATE_LANGUAGES.iter().map(|l| l.code).collect();
+                format!("unknown date language {c:?} (use one of {})", codes.join(", "))
+            })?),
+        };
+        Ok(())
+    }
+
+    pub fn date_language(&self) -> Option<&str> {
+        self.date_language.as_deref()
+    }
+
+    /// Today's local date in `fmt` (or the session's date format) with the names of `lang`
+    /// (or the session's date language; English when neither is set or known).
+    pub fn today_text(&self, fmt: Option<&str>, lang: Option<&str>) -> Result<String, String> {
+        let fmt = match fmt {
+            Some(f) => check_date_format(f)?,
+            None => self.date_format(),
+        };
+        let lang = lang.or(self.date_language()).and_then(date_language).unwrap_or(&DATE_LANGUAGES[0]);
+        Ok(format_day(fmt, self.today(), lang))
+    }
+
+    /// [`Session::today_text`] for writing into a PDF: refused when the date has characters
+    /// Fill & Sign can't write yet (see [`unwritable`]), rather than saving them as `?`.
+    pub fn today_text_for_pdf(&self, fmt: Option<&str>, lang: Option<&str>) -> Result<String, String> {
+        let text = self.today_text(fmt, lang)?;
+        match unwritable(&text) {
+            bad if bad.is_empty() => Ok(text),
+            bad => Err(format!(
+                "\"{text}\" can't be written into the PDF yet: Fill & Sign text is Western European only ({bad}); pick a numeric format such as dd.mm.yyyy"
+            )),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const DAY: (i64, u32, u32) = (2026, 3, 7);
+    const EN: &DateLanguage = &DATE_LANGUAGES[0];
+
+    fn in_lang(fmt: &str, code: &str) -> String {
+        format_day(fmt, DAY, date_language(code).unwrap())
+    }
+
+    #[test]
+    fn presets_write_the_day_in_their_own_order() {
+        let shown: Vec<String> = DATE_FORMATS.iter().map(|f| format_day(f, DAY, EN)).collect();
+        assert_eq!(
+            shown,
+            [
+                "3/7/2026",
+                "03/07/2026",
+                "7/3/2026",
+                "07/03/2026",
+                "07.03.2026",
+                "2026-03-07",
+                "2026.03.07.",
+                "7 Mar 2026",
+                "7 March 2026",
+                "Mar 7, 2026",
+                "March 7, 2026",
+                "Saturday, March 7, 2026",
+            ]
+        );
+        assert!(DATE_FORMATS.iter().all(|f| check_date_format(f).is_ok()));
+        assert_eq!(DATE_FORMATS[0], DEFAULT_DATE_FORMAT);
+    }
+
+    #[test]
+    fn escaped_letters_are_shown_as_is() {
+        assert_eq!(format_day("d \\de mmmm \\de yyyy", DAY, EN), "7 de March de 2026");
+        assert_eq!(format_day("yyyy\\", DAY, EN), "2026\\");
+        assert_eq!(check_date_format("d \\de mmmm"), Ok("d \\de mmmm"));
+    }
+
+    #[test]
+    fn unusable_patterns_are_rejected() {
+        assert!(check_date_format("   ").is_err());
+        assert!(check_date_format("Date: dd/mm").unwrap_err().contains("`t`"));
+        assert!(check_date_format("mm/dd HH:MM").is_err());
+        assert!(check_date_format("Year").is_err(), "no date letters");
+        assert!(check_date_format(&"d".repeat(MAX_DATE_FORMAT_CHARS + 1)).is_err());
+        assert_eq!(check_date_format("  yyyy-mm-dd "), Ok("yyyy-mm-dd"));
+    }
+
+    #[test]
+    fn only_whole_date_codes_are_accepted() {
+        for (fmt, code) in [("yyyyyyyy", "`yyyyyyyy`"), ("yyy", "`yyy`"), ("d/m/y", "`y`"), ("mmmmm d", "`mmmmm`"), ("ddddd", "`ddddd`")] {
+            let e = check_date_format(fmt).unwrap_err();
+            assert!(e.contains(code) && e.contains("is not a date code"), "{fmt}: {e}");
+        }
+        for fmt in ["yy", "yyyy", "m", "mm", "mmm", "mmmm", "d", "dd", "ddd", "dddd", r"\y\y\y yyyy"] {
+            assert!(check_date_format(fmt).is_ok(), "{fmt}");
+        }
+    }
+
+    #[test]
+    fn hostile_days_and_patterns_do_not_panic() {
+        for fmt in ["mmmm", "mmm", "dddd", "ddd", "\\", "yyyyyyyyy", "é d ü", "d. mmmm"] {
+            for day in [(i64::MAX, u32::MAX, u32::MAX), (i64::MIN, 0, 0), (2026, 13, 40), (0, 2, 29)] {
+                for lang in &DATE_LANGUAGES {
+                    let _ = format_day(fmt, day, lang);
+                }
+            }
+        }
+        assert_eq!(format_day("mmmm dddd", (2026, 13, 40), EN), "13 40", "out of range shows numbers");
+    }
+
+    #[test]
+    fn the_session_stamps_today_in_its_format() {
+        // 2023-11-14 (UTC) on the injected clock.
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        assert_eq!(s.date_format(), DEFAULT_DATE_FORMAT);
+        assert_eq!(s.today_text(None, None).as_deref(), Ok("11/14/2023"));
+        s.set_date_format("dd.mm.yyyy").unwrap();
+        assert_eq!(s.today_text(None, None).as_deref(), Ok("14.11.2023"));
+        assert_eq!(s.today_text(Some("yyyy-mm-dd"), None).as_deref(), Ok("2023-11-14"));
+        assert!(s.today_text(Some("HH"), None).is_err());
+        assert!(s.set_date_format("nothing").is_err());
+        assert_eq!(s.date_format(), "dd.mm.yyyy", "a rejected pattern keeps the previous one");
+    }
+
+    #[test]
+    fn names_follow_the_date_language() {
+        assert_eq!(in_lang("dddd, d \\de mmmm \\de yyyy", "es"), "sábado, 7 de marzo de 2026");
+        assert_eq!(in_lang("ddd d mmm", "pt-br"), "sáb 7 mar");
+        assert_eq!(in_lang("dddd d mmmm yyyy", "fr"), "samedi 7 mars 2026");
+        assert_eq!(in_lang("dddd, d mmmm", "te"), "శనివారం, 7 మార్చి");
+        assert_eq!(in_lang("yyyy\\年mmmmd\\日 dddd", "ja"), "2026年3月7日 土曜日");
+        assert_eq!(in_lang("yyyy\\年mmmmd\\日 dddd", "zh-hans"), "2026年三月7日 星期六");
+        assert_eq!(in_lang("ddd", "zh-hant"), "週六");
+        assert_eq!(date_language("PT-BR").map(|l| l.code), Some("pt-br"));
+        assert!(date_language("xx").is_none());
+        for l in &DATE_LANGUAGES {
+            assert!(l.months.iter().chain(&l.months_short).chain(&l.days).chain(&l.days_short).all(|n| !n.is_empty()), "{}", l.code);
+        }
+    }
+
+    #[test]
+    fn czech_and_russian_months_change_after_a_day() {
+        assert_eq!(in_lang("d. mmmm yyyy", "cs"), "7. března 2026");
+        assert_eq!(in_lang("mmmm yyyy", "cs"), "březen 2026");
+        assert_eq!(in_lang("d mmmm yyyy", "ru"), "7 марта 2026");
+        assert_eq!(in_lang("mmmm yyyy", "ru"), "март 2026");
+        // A weekday (dddd) is not a day number.
+        assert_eq!(in_lang("dddd, mmmm", "cs"), "sobota, březen");
+    }
+
+    #[test]
+    fn the_session_writes_names_in_its_date_language() {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        s.set_date_format("dddd d mmmm").unwrap();
+        assert_eq!(s.today_text(None, None).as_deref(), Ok("Tuesday 14 November"), "English by default");
+        assert_eq!(s.today_text(None, Some("es")).as_deref(), Ok("martes 14 noviembre"), "a caller's language");
+        s.set_date_language(Some("PT-BR")).unwrap();
+        assert_eq!(s.date_language(), Some("pt-br"));
+        assert_eq!(s.today_text(None, None).as_deref(), Ok("terça-feira 14 novembro"));
+        assert_eq!(s.today_text(Some("d mmmm"), Some("uk")).as_deref(), Ok("14 листопада"), "Ukrainian months after a day");
+        assert_eq!(s.today_text(Some("dddd d mmmm"), Some("de")).as_deref(), Ok("Dienstag 14 November"));
+        assert!(s.set_date_language(Some("it")).unwrap_err().contains("zh-hant"), "only the interface languages");
+        assert_eq!(s.date_language(), Some("pt-br"), "an unknown language keeps the previous one");
+        s.set_date_language(None).unwrap();
+        assert_eq!(s.date_language(), None);
+    }
+
+    #[test]
+    fn dates_the_pdf_cannot_hold_are_refused_not_damaged() {
+        assert_eq!(unwritable("8. října 2026"), "ř");
+        assert_eq!(unwritable("2026年10月8日"), "年月日");
+        assert_eq!(unwritable("sábado, 7 de março – 2026?"), "", "Western European, dashes and ? are fine");
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        s.set_date_format("d. mmmm yyyy").unwrap();
+        assert_eq!(s.today_text_for_pdf(None, Some("es")).as_deref(), Ok("14. noviembre 2023"));
+        assert_eq!(s.today_text_for_pdf(None, Some("cs")).as_deref(), Ok("14. listopadu 2023"), "no letter outside WinAnsi");
+        let e = s.today_text_for_pdf(Some("dddd"), Some("ja")).unwrap_err();
+        assert!(e.contains("火曜日") && e.contains("can't be written into the PDF yet"), "{e}");
+        assert!(s.today_text_for_pdf(Some("dd.mm.yyyy"), Some("ja")).is_ok(), "numbers are fine in any language");
+        assert!(s.today_text_for_pdf(Some("yyyy\\年mm\\月"), Some("ja")).unwrap_err().contains("年月"));
+    }
+}
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index fbd92be3..cbffb07a 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -16,6 +16,7 @@ pub mod actions;
 pub mod catalog;
 pub mod commands;
 pub mod compare;
+pub mod dates;
 pub mod export;
 pub mod js;
 pub mod links;
@@ -1898,6 +1899,10 @@ pub struct Session {
     trust: Arc<TrustStore>,
     /// Preferences ▸ JavaScript ▸ Enable Acrobat JavaScript, inverted (on by default).
     js_off: bool,
+    /// Preferences ▸ Date format, when not the default (see [`dates`]).
+    date_format: Option<String>,
+    /// Preferences ▸ Date format ▸ Language, when not following the interface language.
+    date_language: Option<String>,
 }
 
 /// Lay a dynamic XFA form out (pages and fields) and give its widgets appearances.
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index d0f6e953..504a613a 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1535,6 +1535,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let mut open_initials = false;
     let author = app.comment_prefs.author.clone();
     let today = app.session.today();
+    // In Preferences ▸ Date format, or why it can't be stamped into the PDF.
+    let date_text = crate::date_text_for_pdf(&app.session);
+    let mut refused: Option<String> = None;
     let by_line = app.session.stamp_by_line(&author);
     let mut stamp_placed = false;
     let mut image_action: Option<crate::edit_text_ui::ImageAction> = None;
@@ -1811,7 +1814,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     initials.as_ref(),
                     &mut app.signature_preview,
                     &author,
-                    today,
+                    &date_text,
                 ) {
                     Some(crate::fill_sign::FillAction::Edit(e)) => view.pending_edit = Some(*e),
                     Some(crate::fill_sign::FillAction::Signature(e)) => {
@@ -1820,6 +1823,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     }
                     Some(crate::fill_sign::FillAction::CreateSignature) => open_signature = true,
                     Some(crate::fill_sign::FillAction::CreateInitials) => open_initials = true,
+                    Some(crate::fill_sign::FillAction::Refused(why)) => refused = Some(why),
                     None => {}
                 }
             }
@@ -2345,6 +2349,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         Some(crate::edit_text_ui::ImageAction::Save(page, index)) => app.save_page_image(page, index),
         None => {}
     }
+    if let Some(why) = refused {
+        app.notify_error(why);
+    }
     if open_signature || open_initials {
         app.signature_draft = crate::fill_sign::SigDraft::new(open_initials, &app.comment_prefs.author);
         app.dialog = Some(crate::Dialog::Signature);
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index 825b9574..152fde4a 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -1,7 +1,7 @@
 //! Fill & Sign (Acrobat's Fill & Sign tool, execution plan M5.7): type text onto the page, place
-//! ✓ ✕ ● ─ marks and today's date, and sign with a drawn signature. Everything is an annotation
-//! (typewriter text, PdfCraft-drawn stamps, ink), so it can be moved, deleted and undone like
-//! any comment.
+//! ✓ ✕ ● ─ marks and today's date (in Preferences ▸ Date format), and sign with a drawn
+//! signature. Everything is an annotation (typewriter text, PdfCraft-drawn stamps, ink), so it
+//! can be moved, deleted and undone like any comment.
 
 use egui::{Color32, CornerRadius, Pos2, Sense, Stroke, pos2, vec2};
 use pdfcraft_engine::{Edit, FillMark, NewAnnotation, Shape, SignatureImage, Style};
@@ -379,7 +379,7 @@ pub(crate) fn page_input(
     initials: Option<&SavedSig>,
     preview: &mut Option<(SavedSig, egui::TextureHandle)>,
     author: &str,
-    today: (i64, u32, u32),
+    date_text: &Result<String, String>,
 ) -> Option<FillAction> {
     let pointer = ui.input(|i| i.pointer.hover_pos())?;
     if !resp.contains_pointer() || !xf.rect.contains(pointer) {
@@ -409,10 +409,10 @@ pub(crate) fn page_input(
             view.fill_text = Some(TypeBox { page, at: [at[0], at[1] + TEXT_SIZE * 0.6], text: String::new(), focus: true });
             None
         }
-        FillTool::Date => {
-            let (y, m, d) = today;
-            Some(FillAction::Edit(Box::new(typed(page, [at[0], at[1] + TEXT_SIZE * 0.6], &format!("{m}/{d}/{y}"), author))))
-        }
+        FillTool::Date => Some(match date_text {
+            Ok(text) => FillAction::Edit(Box::new(typed(page, [at[0], at[1] + TEXT_SIZE * 0.6], text, author))),
+            Err(why) => FillAction::Refused(why.clone()),
+        }),
         FillTool::Signature => match signature {
             Some(s) => place(page, p, at, s, false, author).map(|e| FillAction::Signature(Box::new(e))),
             None => Some(FillAction::CreateSignature),
@@ -440,6 +440,8 @@ pub enum FillAction {
     CreateSignature,
     /// No initials yet.
     CreateInitials,
+    /// Nothing placed, and why (today's date can't be written into the PDF yet).
+    Refused(String),
 }
 
 /// The in-place editor for typed text. Returns the edit once committed.
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 518f34ca..4f86638a 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2054,3 +2054,10 @@ action wizard	Start	Старт
 	Larger pages	По-големи страници
 	Smaller pages	По-малки страници
 	Reset page size	Възстанови размера на страниците
+	Date format	Формат на датата
+	Fill & Sign dates	Дати при попълване и подписване
+	Pattern	Шаблон
+	Today: {date}	Днес: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy или yy година · m или mm месец · mmm или mmmm име на месеца · d или dd ден · ddd или dddd ден от седмицата. H, h, M, s и t са букви за час и не могат да се използват самостоятелно: поставете {escape} пред буква, за да се покаже както е.
+	Same as interface ({language})	Като интерфейса ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} все още не може да се запише в PDF: текстът при попълване и подписване поддържа само западноевропейски знаци. Изберете числов формат, например dd.mm.yyyy.
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 0b6cb391..8bb47e79 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2092,3 +2092,10 @@ action wizard	Start	Starten
 	Larger pages	Größere Seiten
 	Smaller pages	Kleinere Seiten
 	Reset page size	Seitengröße zurücksetzen
+	Date format	Datumsformat
+	Fill & Sign dates	Datumsangaben beim Ausfüllen und Unterschreiben
+	Pattern	Muster
+	Today: {date}	Heute: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy oder yy Jahr · m oder mm Monat · mmm oder mmmm Monatsname · d oder dd Tag · ddd oder dddd Wochentag. H, h, M, s und t sind Zeitbuchstaben und können nicht allein verwendet werden: Setze {escape} vor einen Buchstaben, um ihn unverändert anzuzeigen.
+	Same as interface ({language})	Wie die Oberfläche ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} kann noch nicht in das PDF geschrieben werden: Text beim Ausfüllen und Unterschreiben ist auf westeuropäische Zeichen beschränkt. Wähle ein numerisches Format wie dd.mm.yyyy.
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 4973979b..5e817789 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2008,3 +2008,10 @@
 	Larger pages	Páginas más grandes
 	Smaller pages	Páginas más pequeñas
 	Reset page size	Restablecer el tamaño de las páginas
+	Date format	Formato de fecha
+	Fill & Sign dates	Fechas de Rellenar y firmar
+	Pattern	Patrón
+	Today: {date}	Hoy: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy o yy año · m o mm mes · mmm o mmmm nombre del mes · d o dd día · ddd o dddd día de la semana. H, h, M, s y t son letras de hora y no pueden usarse solas: pon {escape} delante de una letra para mostrarla tal cual.
+	Same as interface ({language})	Igual que la interfaz ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} todavía no se puede escribir en el PDF: el texto de Rellenar y firmar solo admite caracteres de Europa occidental. Elige un formato numérico como dd.mm.yyyy.
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index a6b5c08d..f4c97170 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2045,3 +2045,10 @@
 	Larger pages	Pages plus grandes
 	Smaller pages	Pages plus petites
 	Reset page size	Rétablir la taille des pages
+	Date format	Format de date
+	Fill & Sign dates	Dates de Remplir et signer
+	Pattern	Modèle
+	Today: {date}	Aujourd'hui : {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy ou yy année · m ou mm mois · mmm ou mmmm nom du mois · d ou dd jour · ddd ou dddd jour de la semaine. H, h, M, s et t sont des lettres d'heure et ne peuvent pas être utilisées seules : placez {escape} devant une lettre pour l'afficher telle quelle.
+	Same as interface ({language})	Comme l'interface ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} ne peut pas encore être écrit dans le PDF : le texte de Remplir et signer est limité aux caractères d'Europe occidentale. Choisissez un format numérique comme dd.mm.yyyy.
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index ef0a7306..1d395e26 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2088,8 +2088,12 @@ action wizard	Start	Indítás
 	Larger pages	Nagyobb oldalak
 	Smaller pages	Kisebb oldalak
 	Reset page size	Oldalméret visszaállítása
-	Larger pages	Nagyobb oldalak
-	Smaller pages	Kisebb oldalak
-	Reset page size	Oldalméret visszaállítása
 	Flatten Fill & Sign when saving	Kitöltés és aláírás beégetése mentéskor
 	Text, marks and signatures become part of the page. Other comments stay editable.	A szöveg, a jelek és az aláírások az oldal részévé válnak. A többi megjegyzés szerkeszthető marad.
+	Date format	Dátumformátum
+	Fill & Sign dates	Kitöltés és aláírás dátumai
+	Pattern	Minta
+	Today: {date}	Ma: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy vagy yy év · m vagy mm hónap · mmm vagy mmmm a hónap neve · d vagy dd nap · ddd vagy dddd a hét napja. A H, h, M, s és t időbetűk, önmagukban nem használhatók: tegyél {escape} jelet a betű elé, hogy változatlanul jelenjen meg.
+	Same as interface ({language})	Mint a felület ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} még nem írható a PDF-be: a kitöltés és aláírás szövege csak nyugat-európai karaktereket támogat. Válassz számokból álló formátumot, például dd.mm.yyyy.
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 341515b6..a34233e5 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1984,3 +1984,10 @@
 	Larger pages	ページを大きく表示
 	Smaller pages	ページを小さく表示
 	Reset page size	ページサイズをリセット
+	Date format	日付の形式
+	Fill & Sign dates	入力と署名の日付
+	Pattern	パターン
+	Today: {date}	今日: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy または yy 年 · m または mm 月 · mmm または mmmm 月名 · d または dd 日 · ddd または dddd 曜日。H、h、M、s、t は時刻の文字なので単独では使えません。文字をそのまま表示するには前に {escape} を付けます。
+	Same as interface ({language})	表示言語と同じ（{language}）
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} はまだ PDF に書き込めません。入力と署名のテキストは西ヨーロッパの文字のみに対応しています。dd.mm.yyyy などの数字の形式を選んでください。
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index e1939349..d9c8c419 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -1820,4 +1820,12 @@ mod tests {
             }
         }
     }
+
+    /// Preferences ▸ Date format ▸ Language offers exactly the interface languages, in order.
+    #[test]
+    fn date_languages_are_the_interface_languages() {
+        let interface: Vec<(&str, &str)> = Lang::all().map(|l| (l.code(), l.name())).collect();
+        let dates: Vec<(&str, &str)> = pdfcraft_engine::dates::DATE_LANGUAGES.iter().map(|l| (l.code, l.name)).collect();
+        assert_eq!(dates, interface);
+    }
 }
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index c7888b4f..6641c93c 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2006,3 +2006,10 @@
 	Larger pages	Крупнее страницы
 	Smaller pages	Мельче страницы
 	Reset page size	Сбросить размер страниц
+	Date format	Формат даты
+	Fill & Sign dates	Даты для «Заполнить и подписать»
+	Pattern	Шаблон
+	Today: {date}	Сегодня: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy или yy — год · m или mm — месяц · mmm или mmmm — название месяца · d или dd — день · ddd или dddd — день недели. H, h, M, s и t — буквы времени, их нельзя использовать отдельно: поставьте {escape} перед буквой, чтобы показать её как есть.
+	Same as interface ({language})	Как в интерфейсе ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} пока нельзя записать в PDF: текст «Заполнить и подписать» поддерживает только западноевропейские символы. Выберите числовой формат, например dd.mm.yyyy.
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 301d49a8..47db38dc 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2024,3 +2024,10 @@ action wizard	Start	ప్రారంభించు
 	Pin folder to Home…	ఫోల్డర్‌ను హోమ్‌కు పిన్ చేయి…
 	No recent files	ఇటీవలి ఫైళ్లు లేవు
 	Go to page…	పేజీకి వెళ్లు…
+	Date format	తేదీ ఫార్మాట్
+	Fill & Sign dates	నింపడం & సంతకం తేదీలు
+	Pattern	నమూనా
+	Today: {date}	ఈరోజు: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy లేదా yy సంవత్సరం · m లేదా mm నెల · mmm లేదా mmmm నెల పేరు · d లేదా dd రోజు · ddd లేదా dddd వారం రోజు. H, h, M, s, t సమయ అక్షరాలు, వాటిని ఒంటరిగా ఉపయోగించలేరు: అక్షరాన్ని యథాతథంగా చూపడానికి దాని ముందు {escape} పెట్టండి.
+	Same as interface ({language})	ఇంటర్‌ఫేస్ లాగానే ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} ను ఇంకా PDF లో రాయలేము: నింపడం & సంతకం టెక్స్ట్ పశ్చిమ యూరోపియన్ అక్షరాలకు మాత్రమే పరిమితం. dd.mm.yyyy వంటి సంఖ్యా ఫార్మాట్‌ను ఎంచుకోండి.
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 516562a5..0cdef4e2 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2110,8 +2110,12 @@ calendar date	December	грудня
 	Larger pages	Більші сторінки
 	Smaller pages	Менші сторінки
 	Reset page size	Скинути розмір сторінок
-	Larger pages	Більші сторінки
-	Smaller pages	Менші сторінки
-	Reset page size	Скинути розмір сторінок
 	Flatten Fill & Sign when saving	Звести «Заповнення й підпис» під час збереження
 	Text, marks and signatures become part of the page. Other comments stay editable.	Текст, позначки й підписи стають частиною сторінки. Інші коментарі залишаються редагованими.
+	Date format	Формат дати
+	Fill & Sign dates	Дати заповнення й підпису
+	Pattern	Шаблон
+	Today: {date}	Сьогодні: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy або yy рік · m або mm місяць · mmm або mmmm назва місяця · d або dd день · ddd або dddd день тижня. H, h, M, s і t — літери часу, їх не можна використовувати окремо: поставте {escape} перед літерою, щоб показати її як є.
+	Same as interface ({language})	Як в інтерфейсі ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} поки не можна записати в PDF: текст заповнення й підпису підтримує лише західноєвропейські символи. Виберіть числовий формат, наприклад dd.mm.yyyy.
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index f8b5233d..d8cdb1b5 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2056,3 +2056,10 @@
 	Larger pages	放大页面
 	Smaller pages	缩小页面
 	Reset page size	重置页面大小
+	Date format	日期格式
+	Fill & Sign dates	填写与签名的日期
+	Pattern	模式
+	Today: {date}	今天：{date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy 或 yy 年 · m 或 mm 月 · mmm 或 mmmm 月份名称 · d 或 dd 日 · ddd 或 dddd 星期。H、h、M、s 和 t 是时间字母，不能单独使用：在字母前加 {escape} 可按原样显示。
+	Same as interface ({language})	与界面相同（{language}）
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	暂时无法将 {chars} 写入 PDF：填写与签名的文字仅支持西欧字符。请选择数字格式，例如 dd.mm.yyyy。
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index c7982efa..e2b2403f 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1977,3 +1977,10 @@
 	Larger pages	放大頁面
 	Smaller pages	縮小頁面
 	Reset page size	重設頁面大小
+	Date format	日期格式
+	Fill & Sign dates	填寫與簽署的日期
+	Pattern	模式
+	Today: {date}	今天：{date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy 或 yy 年 · m 或 mm 月 · mmm 或 mmmm 月份名稱 · d 或 dd 日 · ddd 或 dddd 星期。H、h、M、s 和 t 是時間字母，不能單獨使用：在字母前加上 {escape} 即可照原樣顯示。
+	Same as interface ({language})	與介面相同（{language}）
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	暫時無法將 {chars} 寫入 PDF：填寫與簽署的文字僅支援西歐字元。請選擇數字格式，例如 dd.mm.yyyy。
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index f5015bed..d285372b 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -313,6 +313,8 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
         egui::RichText::new(tl!("Text, marks and signatures become part of the page. Other comments stay editable.")).small().color(t.text_muted),
     );
     ui.add_space(8.0);
+    date_format(ui, app, t);
+    ui.add_space(8.0);
     ui.label(egui::RichText::new("JavaScript").font(theme::semibold(13.0)));
     egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
         ui.set_width(ui.available_width());
@@ -329,3 +331,94 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     ui.add_space(10.0);
     buttons(ui, tl!("OK"), &[]).is_some()
 }
+
+/// Preferences ▸ Date format: a preset, or any pattern typed in, for Fill & Sign dates, and the
+/// language of its month and weekday names. A valid pattern applies as it's typed; an invalid
+/// one stays in the box with the reason, and the last valid one stays in use.
+fn date_format(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
+    use pdfcraft_engine::dates::{DATE_FORMATS, DATE_LANGUAGES, MAX_DATE_FORMAT_CHARS};
+    ui.label(egui::RichText::new(tl!("Date format")).font(theme::semibold(13.0)));
+    let sample = |app: &PdfCraftApp, f: &str| format!("{}   {f}", app.date_text(Some(f)).unwrap_or_default());
+    ui.horizontal(|ui| {
+        let label = ui.label(tl!("Fill & Sign dates"));
+        let current = app.session.date_format().to_string();
+        let selected = if DATE_FORMATS.contains(&current.as_str()) { sample(app, &current) } else { tl!("Custom").to_string() };
+        egui::ComboBox::from_id_salt("date-format")
+            .selected_text(selected)
+            .width(240.0)
+            .show_ui(ui, |ui| {
+                for f in DATE_FORMATS {
+                    if ui.selectable_label(current == f, sample(app, f)).clicked() && app.session.set_date_format(f).is_ok() {
+                        app.date_format_draft = None;
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label.id);
+    });
+    ui.horizontal(|ui| {
+        let label = ui.label(tl!("Pattern"));
+        let mut text = app.date_format_draft.clone().unwrap_or_else(|| app.session.date_format().to_string());
+        let edit = ui.add(egui::TextEdit::singleline(&mut text).desired_width(160.0).char_limit(MAX_DATE_FORMAT_CHARS)).labelled_by(label.id);
+        // The box keeps the text as typed (a trailing space included) while it has focus; the
+        // setting takes the trimmed pattern whenever it's valid.
+        if edit.changed() {
+            let _ = app.session.set_date_format(&text);
+            app.date_format_draft = Some(text.clone());
+        }
+        if !edit.has_focus() && pdfcraft_engine::dates::check_date_format(&text).is_ok() {
+            app.date_format_draft = None;
+        }
+        match app.date_text(Some(&text)) {
+            Ok(today) => ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Today: {date}"), &[("date", &today)])).color(t.text_muted)),
+            // The engine's reason, in English.
+            Err(e) => ui.label(egui::RichText::new(e).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B))),
+        };
+    });
+    // Fill & Sign refuses a date it would save as "?"; say so before anyone tries.
+    let bad = app.date_text(None).map(|today| pdfcraft_engine::dates::unwritable(&today)).unwrap_or_default();
+    if !bad.is_empty() {
+        ui.label(
+            egui::RichText::new(crate::i18n::fmt(
+                tl!(
+                    "{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy."
+                ),
+                &[("chars", &bad)],
+            ))
+            .color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B)),
+        );
+    }
+    ui.horizontal(|ui| {
+        let label = ui.label(tl!("Language"));
+        let interface = crate::i18n::current().name();
+        let follow = crate::i18n::fmt(tl!("Same as interface ({language})"), &[("language", interface)]);
+        let current = app.session.date_language().map(str::to_string);
+        let selected = DATE_LANGUAGES.iter().find(|l| current.as_deref() == Some(l.code)).map_or(follow.clone(), |l| l.name.to_string());
+        egui::ComboBox::from_id_salt("date-language")
+            .selected_text(selected)
+            .width(240.0)
+            .show_ui(ui, |ui| {
+                if ui.selectable_label(current.is_none(), follow).clicked() && app.session.set_date_language(None).is_ok() {
+                    ui.close();
+                }
+                for l in &DATE_LANGUAGES {
+                    if ui.selectable_label(current.as_deref() == Some(l.code), l.name).clicked()
+                        && app.session.set_date_language(Some(l.code)).is_ok()
+                    {
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label.id);
+    });
+    ui.label(
+        egui::RichText::new(crate::i18n::fmt(
+            tl!("yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is."),
+            &[("escape", "\\")],
+        ))
+        .small()
+        .color(t.text_muted),
+    );
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index feb39e21..5447c2cb 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -86,6 +86,19 @@ mod redact_ui;
 pub use redact_ui::{HiddenDraft, PagesDraft as RedactPagesDraft, RedactPrefs, SearchDraft as RedactSearchDraft};
 pub mod i18n;
 
+/// [`PdfCraftApp::date_text`] for callers that already borrow other parts of the app.
+pub(crate) fn date_text(session: &Session, fmt: Option<&str>) -> Result<String, String> {
+    let lang = session.date_language().unwrap_or(i18n::current().code());
+    session.today_text(fmt, Some(lang))
+}
+
+/// Today in Preferences ▸ Date format for stamping into a PDF; refused when it has characters
+/// Fill & Sign can't write yet (see [`pdfcraft_engine::dates::unwritable`]).
+pub(crate) fn date_text_for_pdf(session: &Session) -> Result<String, String> {
+    let lang = session.date_language().unwrap_or(i18n::current().code());
+    session.today_text_for_pdf(None, Some(lang))
+}
+
 /// The longest author name kept (Preferences ▸ Identity, restored settings).
 pub(crate) const MAX_AUTHOR_CHARS: usize = 200;
 pub mod portable;
@@ -352,6 +365,9 @@ pub struct PdfCraftApp {
     /// Documents and view). Continuous scrolling at fit width by default, which never snaps
     /// between pages.
     pub view_defaults: canvas::ViewDefaults,
+    /// The Preferences ▸ Date format box while it's being edited, or while it holds an invalid
+    /// pattern (the session keeps the last valid one).
+    pub date_format_draft: Option<String>,
     /// Explicit CLI/control mode lasts for this session and is never persisted.
     mode_override: Option<Mode>,
     pub left: LeftPanel,
@@ -611,6 +627,7 @@ impl PdfCraftApp {
             mode: Mode::AllTools,
             default_mode: Mode::AllTools,
             view_defaults: Default::default(),
+            date_format_draft: None,
             mode_override: None,
             left: LeftPanel::AllTools,
             left_open: true,
@@ -1172,6 +1189,12 @@ impl PdfCraftApp {
         self.notify_fmt("`{command}` {when}", &[("command", command), ("when", &when)]);
     }
 
+    /// Today in `fmt` (or Preferences ▸ Date format), with month and weekday names in the date
+    /// language, or the interface language when it follows that.
+    pub fn date_text(&self, fmt: Option<&str>) -> Result<String, String> {
+        date_text(&self.session, fmt)
+    }
+
     /// Select the workspace and its matching tool panel, just like the mode bar.
     pub(crate) fn select_mode(&mut self, mode: Mode) {
         self.mode = mode;
@@ -1211,6 +1234,9 @@ impl PdfCraftApp {
             "highlight_fields": self.view_defaults.highlight_fields,
             "language": self.language,
             "flatten_fill_sign": self.flatten_fill_sign_on_save,
+            "date_format": self.session.date_format(),
+            // Null follows the interface language.
+            "date_language": self.session.date_language(),
             "author": self.comment_prefs.author,
             // Drawn signatures keep their original form (older settings read the same).
             "signature": match &self.signature { Some(fill_sign::SavedSig::Drawn(s)) => Some(s), _ => None },
@@ -1268,6 +1294,13 @@ impl PdfCraftApp {
         if let Some(on) = v["flatten_fill_sign"].as_bool() {
             self.flatten_fill_sign_on_save = on;
         }
+        // Settings are untrusted: an unusable pattern keeps the default.
+        if let Some(f) = v["date_format"].as_str() {
+            let _ = self.session.set_date_format(f);
+        }
+        if let Some(l) = v["date_language"].as_str() {
+            let _ = self.session.set_date_language(Some(l));
+        }
         // An empty or missing name keeps the login-name default; settings are untrusted, so the
         // name is cut to a sane length.
         if let Some(author) = v["author"].as_str().map(str::trim).filter(|a| !a.is_empty()) {
@@ -1352,6 +1385,8 @@ impl PdfCraftApp {
             ("default-mode", _) => {
                 self.default_mode = Mode::parse(value).ok_or("default-mode must be all, read, edit, convert or sign")?;
             }
+            ("date-format", _) => self.session.set_date_format(value)?,
+            ("date-language", _) => self.session.set_date_language(Some(value).filter(|v| *v != "auto"))?,
             ("tool", _) => {
                 let g = pdfcraft_engine::catalog::group(value).ok_or_else(|| format!("unknown tool {value}"))?;
                 self.left = LeftPanel::Tool(g.id);
diff --git a/crates/ui-egui/tests/date_format.rs b/crates/ui-egui/tests/date_format.rs
new file mode 100644
index 00000000..161784c3
--- /dev/null
+++ b/crates/ui-egui/tests/date_format.rs
@@ -0,0 +1,160 @@
+//! Preferences ▸ Date format: the pattern Fill & Sign dates use.
+
+use egui::accesskit::Role;
+use egui::{Key, Modifiers, pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+const PDF: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// Some widget shows `text`, as its label or its value (a combo box shows its choice as a value).
+fn shows(h: &Harness<'static, PdfCraftApp>, text: &str) -> bool {
+    h.query_all_by(|n| n.label().is_some_and(|l| l.contains(text)) || n.value().is_some_and(|v| v.contains(text))).next().is_some()
+}
+
+fn retype(h: &mut Harness<'static, PdfCraftApp>, text: &str) {
+    h.get_by_role_and_label(Role::TextInput, "Pattern").click();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.get_by_role_and_label(Role::TextInput, "Pattern").type_text(text);
+    h.run_steps(2);
+}
+
+#[test]
+fn fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("form.pdf", None, PDF.to_vec()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("dialog", "preferences").unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert_eq!(h.state().session.date_format(), "m/d/yyyy");
+    // A valid pattern applies as it's typed, with a preview of today.
+    retype(&mut h, "d \\de mmmm yyyy");
+    assert_eq!(h.state().session.date_format(), "d \\de mmmm yyyy");
+    h.get_by_label_contains("Today: ");
+    // An invalid one stays in the box with the reason, and the last valid one is kept.
+    retype(&mut h, "dd/mm HH");
+    h.get_by_label_contains("is a time letter (H h M s t)");
+    assert_eq!(h.state().session.date_format(), "d \\de mmmm yyyy");
+    assert_eq!(h.state().date_format_draft.as_deref(), Some("dd/mm HH"));
+    // Typed a key at a time, spaces stay where they are typed (the box isn't trimmed under the cursor).
+    h.get_by_role_and_label(Role::TextInput, "Pattern").click();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    for c in "yyyy mm dd".chars() {
+        h.get_by_role_and_label(Role::TextInput, "Pattern").type_text(&c.to_string());
+        h.run_steps(1);
+    }
+    assert_eq!(h.state().date_format_draft.as_deref(), Some("yyyy mm dd"));
+    assert_eq!(h.state().session.date_format(), "yyyy mm dd");
+    // A letter group that isn't a date code is refused, not silently shortened.
+    retype(&mut h, "yyyyyyyy");
+    h.get_by_label_contains("`yyyyyyyy` is not a date code");
+    assert_eq!(h.state().session.date_format(), "yyyy mm dd");
+    retype(&mut h, "yyyy.mm.dd.");
+    assert_eq!(h.state().session.date_format(), "yyyy.mm.dd.");
+
+    // Fill & Sign ▸ Date stamps today in it.
+    h.state_mut().set_option("dialog", "none").unwrap();
+    h.run_steps(2);
+    assert!(h.state_mut().execute("sign.fill.date"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let p = pos2(r.left() + r.width() * 0.2, r.top() + r.height() * 0.2);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(4);
+    let expected = h.state().date_text(None).unwrap();
+    let s = h.state();
+    let dates: Vec<_> = s.session.get(s.views[0].id).unwrap().info.annotations.iter().filter_map(|a| a.contents.clone()).collect();
+    assert_eq!(dates, std::slice::from_ref(&expected));
+    assert!(expected.ends_with('.') && expected.matches('.').count() == 3, "{expected}");
+
+    // It survives a restart; an unusable saved pattern keeps the default; the control channel checks it too.
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&h.state().persist());
+    assert_eq!(restored.session.date_format(), "yyyy.mm.dd.");
+    let mut fresh = PdfCraftApp::new();
+    fresh.restore(&format!(r#"{{"date_format": "{}"}}"#, "d".repeat(10_000)));
+    fresh.restore(r#"{"date_format": "HH:MM"}"#);
+    assert_eq!(fresh.session.date_format(), "m/d/yyyy");
+    assert!(fresh.set_option("date-format", "Year").is_err());
+    fresh.set_option("date-format", "dd/mm/yyyy").unwrap();
+    assert_eq!(fresh.session.date_format(), "dd/mm/yyyy");
+}
+
+#[test]
+fn month_names_follow_the_date_language_or_else_the_interface_language() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("date-format", "d mmmm yyyy").unwrap();
+        app.set_option("language", "cs").unwrap();
+        app.set_option("dialog", "preferences").unwrap();
+        app
+    });
+    h.run_steps(3);
+    let text = |h: &Harness<'static, PdfCraftApp>| h.state().date_text(None).unwrap();
+    assert_eq!(text(&h), h.state().session.today_text(None, Some("cs")).unwrap(), "follows the interface (Czech)");
+    // The picker offers following the interface first, then the interface languages.
+    assert!(shows(&h, "Same as interface (Čeština)"));
+    h.state_mut().set_option("date-language", "es").unwrap();
+    h.run_steps(2);
+    assert_eq!(text(&h), h.state().session.today_text(None, Some("es")).unwrap());
+    assert!(shows(&h, "Español"));
+
+    // Remembered; an unknown saved language is ignored; auto follows the interface again.
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&h.state().persist());
+    assert_eq!(restored.session.date_language(), Some("es"));
+    let mut fresh = PdfCraftApp::new();
+    fresh.restore(r#"{"date_language": "klingon"}"#);
+    assert_eq!(fresh.session.date_language(), None);
+    assert!(fresh.set_option("date-language", "klingon").is_err());
+    h.state_mut().set_option("date-language", "auto").unwrap();
+    assert_eq!(h.state().session.date_language(), None);
+}
+
+#[test]
+fn a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("form.pdf", None, PDF.to_vec()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        // Japanese weekday names: Fill & Sign text can't hold them yet.
+        app.set_option("date-format", "dddd").unwrap();
+        app.set_option("date-language", "ja").unwrap();
+        app.set_option("dialog", "preferences").unwrap();
+        app
+    });
+    h.run_steps(3);
+    h.get_by_label_contains("can't be written into the PDF yet");
+
+    h.state_mut().set_option("dialog", "none").unwrap();
+    h.run_steps(2);
+    assert!(h.state_mut().execute("sign.fill.date"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let p = pos2(r.left() + r.width() * 0.2, r.top() + r.height() * 0.2);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(4);
+    let s = h.state();
+    assert!(s.session.get(s.views[0].id).unwrap().info.annotations.is_empty(), "nothing placed");
+    let toast = s.toast.as_ref().map(|t| t.0.clone()).unwrap_or_default();
+    assert!(toast.contains("can't be written into the PDF yet"), "{toast}");
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ab580ddb..4655479a 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5213,9 +5213,9 @@ tier = "P0"
 milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.date"]
-tools = ["fill_sign_add"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/automation/tests/automation.rs::fill_and_sign_through_tools"]
-notes = "local date, m/d/yyyy"
+tools = ["fill_sign_add", "fill_sign_date_format"]
+evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/date_format.rs::fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered", "crates/engine/src/dates.rs::presets_write_the_day_in_their_own_order", "crates/engine/src/dates.rs::names_follow_the_date_language", "crates/ui-egui/tests/date_format.rs::month_names_follow_the_date_language_or_else_the_interface_language", "crates/ui-egui/tests/date_format.rs::a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first"]
+notes = "local date in Preferences ▸ Date format (default m/d/yyyy; 12 presets or any pattern in Acrobat date letters with \\ escapes, checked and previewed as typed, remembered; only whole date codes accepted; month and weekday names in the interface languages, Czech months in the genitive after a day, following the interface language unless one is picked; fill_sign_add takes a one-off format and language). Beyond Acrobat: its Fill & Sign has no format setting (only Acrobat Sign accounts do). Missing: Fill & Sign text is Helvetica/WinAnsi, so a date with letters outside Western European (Czech ř, Japanese, Chinese names) is refused with a warning instead of being saved as ?; the OS locale's format isn't offered as a preset; names in languages without an interface translation"
 
 [[feature]]
 id = "form.fill-sign-signature"

From 75b31fb04db40ad054b9ca17b4a721d6e80eaa82 Mon Sep 17 00:00:00 2001
From: Dimitar <bulgaria_mitko@yahoo.com>
Date: Fri, 9 Oct 2026 21:27:02 +0300
Subject: [PATCH 110/149] =?UTF-8?q?M10:=20Print=20=E2=96=B8=20Properties?=
 =?UTF-8?q?=E2=80=A6=20opens=20the=20printer=20driver's=20own=20settings?=
 =?UTF-8?q?=20(#482)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M5.7: date format and date language for Fill & Sign in the engine

* M5: flatten Fill & Sign marks when saving

Saving can now bake typed text, marks and signatures into the page, from Preferences or doc_save. The option defaults off, so a normal save still leaves them editable, and other comments and form fields stay.

* M4: zoom the Organize page grid

The page grid draws its pages at 50% to 300%: toolbar buttons with a
percentage that resets to 100%, trackpad pinch or Ctrl/⌘ + wheel about
the page under the pointer, and ⌘+ / ⌘− / ⌘0 (which no longer change the
hidden page view's zoom while the grid shows).

Thumbnails are re-rendered sharper in a few steps as the grid grows,
capped so one document's thumbnails stay within 256 MB. The page under
the pointer (or the first one in view) stays where it is across a zoom.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: zoomed grid pages are rendered at the size drawn

A zoomed page grid stretched 132 pt thumbnails, and the stepped detail
that was meant to help was capped by a memory budget, so a long document
stayed blurry at any zoom.

Pages drawn larger than their thumbnails now get a render at exactly the
size drawn while they are in view; the thumbnail stands in until it
arrives. Only pages in view keep one, so memory no longer depends on the
page count, and thumbnails go back to their one fixed size.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M5.7: fill_sign_date_format tool; format and language on fill_sign_add

* M5.7: Preferences ▸ Date format for Fill & Sign dates (refs #158)

* M5.7: refuse Fill & Sign dates the PDF text font can't hold

* M5.7: Spanish labels for Preferences ▸ Date format

* M10: Print ▸ Properties… opens the printer driver's own settings

CUPS: the queue's PPD job options (with lpoptions defaults), grouped in the
Print dialog and sent with this job as lp -o key=value; installable options
and what the dialog sets itself are left out. Windows: the driver's Printing
Preferences window through printui (no unsafe FFI), saved as the printer's
per-user defaults. Headless: printer_options tool and doc_print options.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* View: the middle button pans instead of drawing with markup tools

egui's drag responses accept every pointer button, so on Windows and macOS a
middle-button drag reached the page tools: with Draw (ink) selected it drew a
stroke, and other tools cropped, selected or moved. Linux was unaffected
because its middle-click auto-scroll already blocks page input.

Outside Linux a middle-button drag that starts in the viewport (document or
Organize Pages) now pans 1:1 while the button is held, with a Grabbing
cursor, and page input is blocked from the press through the release. Linux
keeps its latched auto-scroll.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: a short page gone to from the Pages panel stays current

The current page was whichever page showed most of itself. Going to a short
page (a cheque) above a tall one scrolls it to the top, where the tall page
below shows more, so the current page and the Pages panel's highlight moved
to the tall page instead of the one clicked. The page navigated to now stays
current while it is wholly on screen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M4: page operations from the Pages panel: context menu and drag to reorder

Right-clicking a thumbnail offers Extract pages, Cut, Copy and Paste after, on
the selection or on the page clicked (which becomes the selection), as the
organize grid does. Dragging thumbnails moves the selection, or the page
grabbed, to the gap it is dropped on: a bar marks the gap, the page count
follows the pointer, and the panel scrolls near its edges. The move is one
undoable step; the moved pages stay selected and the current page follows
its page. Documents that forbid assembly keep click-only thumbnails.

Parity: view.thumbnail-context-ops is shipped, with what it still lacks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Pages panel: only the primary button drags thumbnails; a drag left over after the panel closed or the document changed is dropped

* Fill & Sign dates: German, Bulgarian, Hungarian and Ukrainian month and weekday names, matching the interface languages

* uk: keep the author's wording for the flatten setting

---------

Co-authored-by: KissT <github@kisst.net>
Co-authored-by: Mark Bartalos <bartalos86@gmail.com>
Co-authored-by: samehelhawary <basio20044@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cody Vogt <Cody.Vogt@caltechsurveys.com>
Co-authored-by: William Max & Co. <info@williammax.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                      |  22 +--
 ROADMAP.md                            |   3 +
 crates/automation/src/lib.rs          |   1 +
 crates/automation/src/printing.rs     |  23 +++
 crates/automation/src/tools.rs        |   6 +-
 crates/automation/tests/automation.rs |  11 ++
 crates/print/src/spool.rs             | 193 +++++++++++++++++++++++++-
 crates/print/src/tests.rs             |  90 +++++++++++-
 crates/ui-egui/src/i18n/bg.tsv        |   6 +
 crates/ui-egui/src/i18n/de.tsv        |   6 +
 crates/ui-egui/src/i18n/es.tsv        |   6 +
 crates/ui-egui/src/i18n/fr.tsv        |   6 +
 crates/ui-egui/src/i18n/hu.tsv        |   6 +
 crates/ui-egui/src/i18n/ja.tsv        |   6 +
 crates/ui-egui/src/i18n/ru.tsv        |   6 +
 crates/ui-egui/src/i18n/te.tsv        |   6 +
 crates/ui-egui/src/i18n/uk.tsv        |   6 +
 crates/ui-egui/src/i18n/zh-hans.tsv   |   6 +
 crates/ui-egui/src/i18n/zh-hant.tsv   |   6 +
 crates/ui-egui/src/print_ui.rs        | 115 ++++++++++++++-
 crates/ui-egui/tests/print.rs         |  38 +++++
 parity/acrobat-features.toml          |   6 +-
 22 files changed, 550 insertions(+), 24 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 9ddd3c04..26abaaa8 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "25a6a7ccbc113f8a64092b8962c9c0bfe64bfb6dc2000e2a6164881b492e8684"
+sha256 = "d1f4c7c71d2359e816878e8de837119649513e20b8cf1036276f4d18639398f5"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "957b2ca722eb3ebb6c6303ff5e25245b850b3a3e6ddba094516174e804aa96c1"
+sha256 = "1cac4789161502b2fc3c52ac0bc9a89fd714495a87c594ba7a4f04e49e5a6456"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4d139791454c1c3a00e2726e495b1170eb1f5be95f6cd5e12e7311c85aca0259"
+sha256 = "85a57e66f819e93c8c541548cd932ec98cd3dca888c25b62d5c973fb795eb78a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "716fb1f47bc69c355a688f116715b819a03c59d99ba9e03d65db2dd79bbe11b9"
+sha256 = "f005a60c77110251be379572e3eb6bf9a7907946788f5ce0f8689800f5cc7b76"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f78e4175753553fcb27d61697e64ab092cede8433a8ae68ca1f553879b4217dc"
+sha256 = "a53fb2b7d91a6f9cb37c5d7fcc77e0884b9b23a0f406569ba203062cff731be1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "329b95966eca05438ea23deb2a48f61d9af9e984017d14942af06b3bb0799e4b"
+sha256 = "affd4f7f2e7285abfb987625bbb726cf3d761f0a67ccaf00c18d986be3fa5f9d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "50390d434fbebc5d6ed1a259db96d73d76be5678f4c87a8b04ddd1c38a4901f7"
+sha256 = "88e402a8a16ba8ccd6f73e91326691ce4c4f86bf113cc484fb4c2af953ab3122"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4b7618b83b5b4479e5b8e4022a302689d8acf194a10368d7ef34302f8e19e299"
+sha256 = "6c2860945882f12af506be1830182ddb6c783a524f718ee0c0540bf781400641"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "78053df6ec3de2d0b6a10338b57618302deb4ec8cfb794be5a4a4d2bdc2f950b"
+sha256 = "af9bd7f0a2c9f64faaea928e219be50a9ce8a71d40ae4c13e84cfe1aed751f40"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "285d3d9c8fff269ceb032e6be67a1c33d596f2ed80c9d8677f5655fb014f43b5"
+sha256 = "b93836c384d11e5027b902f6f5a9fa389a5a793213bb77f6754e4cf71fdc28c8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "06e8584e6f16528598e311e1b0dbd167701967c6786e14701886285babb38c9f"
+sha256 = "750c7229170e1ffd96b140ed13f0ce85a7c04a5223ed2648a75c96e2c0d65140"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index dba0e114..3c149ccb 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -135,6 +135,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
 
+- **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
@@ -148,6 +149,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index b3999c07..bfbd90a9 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -516,6 +516,7 @@ impl Automation {
             "redact_clear" => self.redact_clear(&a)?,
             "doc_hidden_info" => self.doc_hidden_info(&a)?,
             "printers" => self.printers()?,
+            "printer_options" => self.printer_options(&a)?,
             "link_list" => self.link_list(&a)?,
             "link_add" => self.link_add(&a)?,
             "link_edit" => self.link_edit(&a)?,
diff --git a/crates/automation/src/printing.rs b/crates/automation/src/printing.rs
index a21fff04..6ba8b393 100644
--- a/crates/automation/src/printing.rs
+++ b/crates/automation/src/printing.rs
@@ -16,6 +16,18 @@ impl Automation {
         Ok(json!({ "count": list.len(), "printers": list }))
     }
 
+    pub(crate) fn printer_options(&self, a: &Args) -> Result<Value> {
+        let printer = a.str("printer")?;
+        let list: Vec<Value> = spool::printer_options(printer)
+            .into_iter()
+            .map(|o| {
+                let choices: Vec<Value> = o.choices.iter().map(|(value, label)| json!({ "value": value, "label": label })).collect();
+                json!({ "key": o.key, "label": o.label, "group": o.group, "default": o.default, "choices": choices })
+            })
+            .collect();
+        Ok(json!({ "printer": printer, "count": list.len(), "options": list }))
+    }
+
     pub(crate) fn doc_print(&mut self, a: &Args) -> Result<Value> {
         let doc = self.doc(a)?;
         let (id, count) = (doc.id, doc.info.pages.len());
@@ -122,6 +134,17 @@ impl Automation {
                     },
                     grayscale: a.opt_bool("grayscale")?.unwrap_or(false),
                     title: name,
+                    options: match a.get("options") {
+                        None => Vec::new(),
+                        Some(Value::Object(m)) => m
+                            .iter()
+                            .map(|(k, v)| match v.as_str() {
+                                Some(v) => Ok((k.clone(), v.to_string())),
+                                None => Err(bad(format!("options.{k} must be a string (a choice from printer_options)"))),
+                            })
+                            .collect::<Result<Vec<_>>>()?,
+                        Some(_) => return Err(bad("options must be an object of option keys and choices from printer_options")),
+                    },
                 };
                 out["job"] = json!(spool::submit(&bytes, &job).map_err(|e| failed(e.to_string()))?);
             }
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 74eb2bbb..5ca52700 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -395,10 +395,13 @@ pub fn tools() -> Vec<ToolDef> {
             &["doc"],
         )),
         t("printers", "List printers", "The printers the system's print spooler knows (CUPS on macOS and Linux), with the default marked.").ro().with(schema(json!({}), &[])),
+        t("printer_options", "List printer options", "A printer driver's own job options (CUPS: from its PPD), such as the paper tray, paper type or finishing: key, label, group, default and choices. Pass chosen values to doc_print as options. Empty on Windows, where the driver's preferences window holds them.")
+            .ro()
+            .with(schema(json!({ "printer": { "type": "string" } }), &["printer"])),
         t(
             "doc_print",
             "Print",
-            "Print with Acrobat's Print dialog options, or save the print-ready PDF. pages: a range such as \"1-3, 6, 9-\" (page labels allowed; default all); subset odd/even; reverse. layout: fit (default), actual, shrink, custom (scale %), multiple (per_sheet 2/4/6/9/16, order, border, auto_rotate; cut-stack order arranges single-sided sheets for cutting into piles and stacking left to right, top to bottom, keeping sheet order within each pile; duplex must be off), booklet (booklet_subset both/front/back, binding left/right), poster (scale %, overlap pt, cut_marks). orientation auto/portrait/landscape; comments_forms document / document-and-markups (default) / document-and-stamps / form-fields-only; paper Letter/Legal/Tabloid/A3/A4/A5. Then path (save) or printer (a name or \"default\") with copies, collate, duplex off/long-edge/short-edge, grayscale.",
+            "Print with Acrobat's Print dialog options, or save the print-ready PDF. pages: a range such as \"1-3, 6, 9-\" (page labels allowed; default all); subset odd/even; reverse. layout: fit (default), actual, shrink, custom (scale %), multiple (per_sheet 2/4/6/9/16, order, border, auto_rotate; cut-stack order arranges single-sided sheets for cutting into piles and stacking left to right, top to bottom, keeping sheet order within each pile; duplex must be off), booklet (booklet_subset both/front/back, binding left/right), poster (scale %, overlap pt, cut_marks). orientation auto/portrait/landscape; comments_forms document / document-and-markups (default) / document-and-stamps / form-fields-only; paper Letter/Legal/Tabloid/A3/A4/A5. Then path (save) or printer (a name or \"default\") with copies, collate, duplex off/long-edge/short-edge, grayscale, and options (driver options from printer_options, CUPS).",
         )
         .with(schema(
             json!({
@@ -425,6 +428,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "collate": { "type": "boolean" },
                 "duplex": { "type": "string", "enum": ["off", "long-edge", "short-edge"] },
                 "grayscale": { "type": "boolean" },
+                "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Printer driver options from printer_options: key → choice value." },
             }),
             &["doc"],
         )),
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index a3ba9976..cbda75f2 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1836,6 +1836,17 @@ fn printing_through_tools() {
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
     assert!(ok(&mut a, "printers", json!({}))["printers"].is_array());
+    let none = ok(&mut a, "printer_options", json!({ "printer": "No_Such_Queue_PdfCraft" }));
+    assert_eq!((none["count"].as_u64(), none["options"].as_array().map(Vec::len)), (Some(0), Some(0)));
+    assert!(matches!(a.call("printer_options", &json!({})), Err(ToolError::InvalidArgs(_))));
+    assert!(matches!(
+        a.call("doc_print", &json!({ "doc": doc, "printer": "default", "options": ["InputSlot"] })),
+        Err(ToolError::InvalidArgs(m)) if m.contains("printer_options")
+    ));
+    assert!(matches!(
+        a.call("doc_print", &json!({ "doc": doc, "printer": "default", "options": { "InputSlot": 2 } })),
+        Err(ToolError::InvalidArgs(m)) if m.contains("options.InputSlot")
+    ));
     let n = ok(&mut a, "doc_info", json!({ "doc": doc }))["document"]["pages"].as_u64().unwrap();
     let r = ok(&mut a, "doc_print", json!({ "doc": doc, "layout": "multiple", "per_sheet": 4, "path": "sheets.pdf" }));
     assert_eq!(r["sheets"].as_u64(), Some(n.div_ceil(4)));
diff --git a/crates/print/src/spool.rs b/crates/print/src/spool.rs
index 176b5a2d..86ebd9c5 100644
--- a/crates/print/src/spool.rs
+++ b/crates/print/src/spool.rs
@@ -27,11 +27,14 @@ pub struct Job {
     pub duplex: Duplex,
     pub grayscale: bool,
     pub title: String,
+    /// The printer driver's own job options (a PPD keyword and the chosen value), such as the
+    /// paper tray or paper type; see [`printer_options`]. CUPS only.
+    pub options: Vec<(String, String)>,
 }
 
 impl Default for Job {
     fn default() -> Self {
-        Job { printer: None, copies: 1, collate: true, duplex: Duplex::Off, grayscale: false, title: "PdfCraft".into() }
+        Job { printer: None, copies: 1, collate: true, duplex: Duplex::Off, grayscale: false, title: "PdfCraft".into(), options: Vec::new() }
     }
 }
 
@@ -65,9 +68,197 @@ pub fn lp_args(job: &Job) -> Vec<String> {
     }
     // The sheets are already laid out at their final size.
     opt("fit-to-page=false");
+    for (key, value) in &job.options {
+        // Driver options are PPD keywords; anything else is not something lp can be given.
+        if is_ppd_keyword(key) && is_ppd_keyword(value) && !HANDLED_OPTIONS.contains(&key.as_str()) {
+            a.extend(["-o".to_string(), format!("{key}={value}")]);
+        }
+    }
     a
 }
 
+/// One of the printer driver's job options (a PPD `OpenUI` entry), such as the paper tray.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PrinterOption {
+    /// The PPD keyword (`InputSlot`).
+    pub key: String,
+    /// What the driver calls it (`Paper tray`); the keyword when it gives no name.
+    pub label: String,
+    /// The driver's group (`Paper Handling`); empty outside a group.
+    pub group: String,
+    /// The choices: keyword and label (`Tray2`, `Tray 2`).
+    pub choices: Vec<(String, String)>,
+    /// The choice the printer uses when a job doesn't say.
+    pub default: String,
+}
+
+/// Options PdfCraft's Print dialog sets itself (paper, two-sided, collation), so the driver's
+/// copies of them are neither shown nor sent.
+pub const HANDLED_OPTIONS: &[&str] = &["PageSize", "PageRegion", "Duplex", "Collate", "ImageableArea", "PaperDimension"];
+
+/// Caps on what a PPD may make the dialog hold (PPDs are text files from the printer vendor).
+const MAX_OPTIONS: usize = 400;
+const MAX_CHOICES: usize = 400;
+
+/// A PPD keyword: printable ASCII without spaces, `/`, `:` or `=`.
+fn is_ppd_keyword(s: &str) -> bool {
+    !s.is_empty() && s.len() <= 64 && s.bytes().all(|b| b.is_ascii_graphic() && !matches!(b, b'/' | b':' | b'=' | b'"'))
+}
+
+/// `Name/Label` → (`Name`, `Label`), the label falling back to the name.
+fn name_label(s: &str) -> (&str, &str) {
+    match s.split_once('/') {
+        Some((n, l)) if !l.trim().is_empty() => (n.trim(), l.trim()),
+        Some((n, _)) => (n.trim(), n.trim()),
+        None => (s.trim(), s.trim()),
+    }
+}
+
+/// The job options a PPD offers, in file order, without the installable-hardware group and the
+/// options PdfCraft sets itself ([`HANDLED_OPTIONS`]). Lenient: malformed lines are skipped.
+pub fn parse_ppd(ppd: &str) -> Vec<PrinterOption> {
+    let mut out: Vec<PrinterOption> = Vec::new();
+    let (mut group, mut group_key) = (String::new(), String::new());
+    let mut open: Option<PrinterOption> = None;
+    for line in ppd.lines() {
+        let line = line.trim_end_matches('\r');
+        if let Some(rest) = line.strip_prefix("*OpenGroup:") {
+            let (k, l) = name_label(rest);
+            (group_key, group) = (k.to_string(), l.to_string());
+        } else if line.starts_with("*CloseGroup") {
+            (group_key, group) = (String::new(), String::new());
+        } else if let Some(rest) = line.strip_prefix("*OpenUI") {
+            let Some((head, _kind)) = rest.trim().rsplit_once(':') else { continue };
+            let (key, label) = name_label(head.trim().trim_start_matches('*'));
+            open = is_ppd_keyword(key).then(|| PrinterOption {
+                key: key.to_string(),
+                label: label.to_string(),
+                group: group.clone(),
+                choices: Vec::new(),
+                default: String::new(),
+            });
+        } else if line.starts_with("*CloseUI") {
+            if let Some(o) = open.take()
+                && !o.choices.is_empty()
+                && group_key != "InstallableOptions"
+                && !HANDLED_OPTIONS.contains(&o.key.as_str())
+                && out.len() < MAX_OPTIONS
+            {
+                out.push(o);
+            }
+        } else if let Some(o) = open.as_mut() {
+            let Some(rest) = line.strip_prefix('*') else { continue };
+            if let Some(value) = rest.strip_prefix("Default").and_then(|r| r.strip_prefix(o.key.as_str())).and_then(|r| r.strip_prefix(':')) {
+                o.default = value.trim().to_string();
+            } else if let Some(rest) = rest.strip_prefix(o.key.as_str()).and_then(|r| r.strip_prefix(' ')) {
+                // `*InputSlot Tray2/Tray 2: "<< ... >>"`; the code after the colon is the driver's.
+                let head = rest.split_once(':').map_or(rest, |(h, _)| h);
+                let (choice, label) = name_label(head);
+                if is_ppd_keyword(choice) && o.choices.len() < MAX_CHOICES && o.choices.iter().all(|(c, _)| c != choice) {
+                    o.choices.push((choice.to_string(), label.to_string()));
+                }
+            }
+        }
+    }
+    for o in &mut out {
+        if !o.choices.iter().any(|(c, _)| *c == o.default) {
+            o.default = o.choices.first().map(|(c, _)| c.clone()).unwrap_or_default();
+        }
+    }
+    out
+}
+
+/// The current choice of each option in `lpoptions -p NAME -l` output (`Key/Label: a *b c`): the
+/// queue's defaults, including the user's own (`~/.cups/lpoptions`).
+pub fn parse_lpoptions(out: &str) -> Vec<(String, String)> {
+    out.lines()
+        .filter_map(|l| {
+            let (head, choices) = l.split_once(':')?;
+            let (key, _) = name_label(head);
+            let current = choices.split_whitespace().find_map(|c| c.strip_prefix('*'))?;
+            Some((key.to_string(), current.to_string()))
+        })
+        .collect()
+}
+
+/// A PPD's text: UTF-8, or ISO Latin-1 (the PPD default) when it isn't valid UTF-8.
+pub fn ppd_text(bytes: &[u8]) -> String {
+    match std::str::from_utf8(bytes) {
+        Ok(s) => s.to_string(),
+        Err(_) => bytes.iter().map(|&b| char::from(b)).collect(),
+    }
+}
+
+/// The driver's job options for a printer (CUPS: its PPD, with the queue's current defaults);
+/// empty when it has none or on other platforms. Reads files and runs `lpoptions`, so call it
+/// when the user asks, not every frame.
+pub fn printer_options(printer: &str) -> Vec<PrinterOption> {
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    {
+        // Queue names never contain `/`; anything else is not a queue and not a path to follow.
+        if !is_ppd_keyword(printer) {
+            return Vec::new();
+        }
+        const PPD_CAP: u64 = 16 << 20;
+        let ppd = std::fs::File::open(format!("/etc/cups/ppd/{printer}.ppd")).ok().and_then(|f| {
+            use std::io::Read as _;
+            let mut bytes = Vec::new();
+            f.take(PPD_CAP).read_to_end(&mut bytes).ok().map(|_| bytes)
+        });
+        let mut options = ppd.map(|b| parse_ppd(&ppd_text(&b))).unwrap_or_default();
+        let current = std::process::Command::new("lpoptions")
+            .args(["-p", printer, "-l"])
+            .output()
+            .map(|o| parse_lpoptions(&String::from_utf8_lossy(&o.stdout)))
+            .unwrap_or_default();
+        for (key, value) in current {
+            if let Some(o) = options.iter_mut().find(|o| o.key == key)
+                && o.choices.iter().any(|(c, _)| *c == value)
+            {
+                o.default = value;
+            }
+        }
+        options
+    }
+    #[cfg(not(all(unix, not(target_arch = "wasm32"))))]
+    {
+        let _ = printer;
+        Vec::new()
+    }
+}
+
+/// Whether [`open_printer_preferences`] can show the driver's own settings window (Windows).
+pub const HAS_PRINTER_PREFERENCES: bool = cfg!(windows);
+
+/// Open the printer driver's Printing Preferences window (Windows: `printui.dll`). What the user
+/// sets there is saved as that printer's defaults for this Windows user, which every job starts
+/// from; the Print dialog's copies, two-sided, grayscale and paper still apply on top.
+pub fn open_printer_preferences(printer: &str) -> Result<(), PrintError> {
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        // printui takes the name in quotes; Windows printer names can't contain one anyway.
+        if printer.is_empty() || printer.contains('"') {
+            return Err(PrintError::Spool("not a printer name".into()));
+        }
+        let root = std::env::var_os("SystemRoot").unwrap_or_else(|| "C:\\Windows".into());
+        let rundll = std::path::Path::new(&root).join("System32").join("rundll32.exe");
+        std::process::Command::new(rundll)
+            .raw_arg("printui.dll,PrintUIEntry")
+            .raw_arg("/e")
+            .raw_arg("/n")
+            .raw_arg(format!("\"{printer}\""))
+            .spawn()
+            .map(|_| ())
+            .map_err(|e| PrintError::Spool(format!("the printer's preferences could not be opened: {e}")))
+    }
+    #[cfg(not(windows))]
+    {
+        let _ = printer;
+        Err(PrintError::Spool("printer preferences open only on Windows; use the printer's options instead".into()))
+    }
+}
+
 /// `lpstat -p -d`, forced to print untranslated messages so [`parse_lpstat`] can read them.
 ///
 /// `LC_ALL`/`LANG=C` is enough on Linux. macOS CUPS ignores them and follows the user's
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index 101e3d4c..cfdab70c 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -190,8 +190,15 @@ fn spooler_arguments_and_printer_list() {
         [spool::Printer { name: "Office_Laser".into(), default: true }, spool::Printer { name: "Label_Writer".into(), default: false }]
     );
     assert!(parse_lpstat("lpstat: No destinations added.\nno system default destination\n").is_empty());
-    let job =
-        Job { printer: Some("Office_Laser".into()), copies: 3, collate: false, duplex: Duplex::LongEdge, grayscale: true, title: "memo.pdf".into() };
+    let job = Job {
+        printer: Some("Office_Laser".into()),
+        copies: 3,
+        collate: false,
+        duplex: Duplex::LongEdge,
+        grayscale: true,
+        title: "memo.pdf".into(),
+        options: Vec::new(),
+    };
     assert_eq!(
         lp_args(&job).join(" "),
         "-d Office_Laser -n 3 -t memo.pdf -o collate=false -o sides=two-sided-long-edge -o print-color-mode=monochrome -o fit-to-page=false"
@@ -359,3 +366,82 @@ fn the_spoolers_reply_drops_the_file_count_of_a_job_sent_on_stdin() {
     );
     assert_eq!(spool::job_message(b""), "");
 }
+
+/// A PPD shaped like a Fiery's: installable options, multi-line PostScript in the choices, Latin-1
+/// labels, options the Print dialog sets itself.
+const FIERY_PPD: &[u8] = b"*PPD-Adobe: \"4.3\"\n\
+*LanguageEncoding: ISOLatin1\n\
+*OpenGroup: InstallableOptions/Installable Options\n\
+*OpenUI *EFFinisher/Finisher option: PickOne\n\
+*DefaultEFFinisher: False\n\
+*EFFinisher False/Not installed: \"\"\n\
+*EFFinisher SingleStapler/Single stapler: \"\"\n\
+*CloseUI: *EFFinisher\n\
+*CloseGroup: InstallableOptions\n\
+*OpenGroup: FPPaperSource/Media\n\
+*OpenUI *InputSlot/Paper tray: PickOne\n\
+*OrderDependency: 20.0 AnySetup *InputSlot\n\
+*DefaultInputSlot: AutoSelect\n\
+*InputSlot AutoSelect/Auto tray select: \"\n\
+userdict /XJXEFIsetpageproperties known\n\
+{ << /XJXsettrayselV2 [ 7 ] >> XJXEFIsetpageproperties } if\"\n\
+*End\n\
+*InputSlot ManualFeed/Bypass tray: \"\n\
+{ pop 2 XJXsettrayselV2 } if\"\n\
+*End\n\
+*InputSlot Tray2/Tray 2: \"\"\n\
+*fr.InputSlot Tray2/Bac 2: \"\"\n\
+*CloseUI: *InputSlot\n\
+*OpenUI *EFMediaType/Paper type: PickOne\n\
+*DefaultEFMediaType: Plain\n\
+*EFMediaType Plain/Plain: \"\"\n\
+*EFMediaType Heavy1/Thick 1 (106\xad163 g/m\xb2): \"\"\n\
+*CloseUI: *EFMediaType\n\
+*CloseGroup: FPPaperSource\n\
+*OpenUI *PageSize/Page size: PickOne\n\
+*DefaultPageSize: A4\n\
+*PageSize A4/A4: \"\"\n\
+*CloseUI: *PageSize\n\
+*OpenUI *EFRaster/Print queue action: PickOne\n\
+*DefaultEFRaster: Bogus\n\
+*EFRaster False/Print: \"\"\n\
+*EFRaster Hold: \"\"\n\
+*CloseUI: *EFRaster\n";
+
+#[test]
+fn printer_options_come_from_the_ppd() {
+    let options = spool::parse_ppd(&spool::ppd_text(FIERY_PPD));
+    let keys: Vec<&str> = options.iter().map(|o| o.key.as_str()).collect();
+    assert_eq!(keys, ["InputSlot", "EFMediaType", "EFRaster"], "no installable options, no PageSize");
+    let tray = &options[0];
+    assert_eq!((tray.label.as_str(), tray.group.as_str(), tray.default.as_str()), ("Paper tray", "Media", "AutoSelect"));
+    assert_eq!(
+        tray.choices,
+        [("AutoSelect".into(), "Auto tray select".into()), ("ManualFeed".into(), "Bypass tray".into()), ("Tray2".into(), "Tray 2".into())],
+        "PostScript lines and translations (*fr.InputSlot) are not choices"
+    );
+    assert_eq!(options[1].choices[1].1, "Thick 1 (106\u{ad}163 g/m²)", "Latin-1 labels");
+    // A default that isn't one of the choices falls back to the first; a choice without a label shows its keyword.
+    assert_eq!((options[2].default.as_str(), options[2].choices[1].1.as_str()), ("False", "Hold"));
+    assert!(spool::parse_ppd("*OpenUI *Broken\n*Broken A/B\n").is_empty(), "unclosed or malformed blocks are skipped");
+}
+
+#[test]
+fn printer_option_defaults_and_job_arguments() {
+    let current =
+        spool::parse_lpoptions("InputSlot/Paper tray: AutoSelect *Tray2 ManualFeed\nEFRaster/Print queue action: *False Hold\nbroken line\n");
+    assert_eq!(current, [("InputSlot".to_string(), "Tray2".to_string()), ("EFRaster".to_string(), "False".to_string())]);
+    let job = Job {
+        options: vec![
+            ("InputSlot".into(), "Tray2".into()),
+            ("EFMediaType".into(), "Heavy1".into()),
+            ("Duplex".into(), "DuplexTumble".into()),
+            ("Bad Key".into(), "x".into()),
+            ("EFRaster".into(), "a=b".into()),
+        ],
+        ..Job::default()
+    };
+    let args = lp_args(&job).join(" ");
+    assert!(args.ends_with("-o fit-to-page=false -o InputSlot=Tray2 -o EFMediaType=Heavy1"), "{args}");
+    assert!(spool::printer_options("../../etc/passwd").is_empty(), "not a queue name");
+}
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 4f86638a..cc047f5a 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2061,3 +2061,9 @@ action wizard	Start	Старт
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy или yy година · m или mm месец · mmm или mmmm име на месеца · d или dd ден · ddd или dddd ден от седмицата. H, h, M, s и t са букви за час и не могат да се използват самостоятелно: поставете {escape} пред буква, за да се покаже както е.
 	Same as interface ({language})	Като интерфейса ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} все още не може да се запише в PDF: текстът при попълване и подписване поддържа само западноевропейски знаци. Изберете числов формат, например dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Отваря предпочитанията на драйвера на принтера. Те се запазват за всеки печат от този компютър; избраните тук копия, двустранен печат, сива скала и хартия продължават да важат.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Собствените настройки на драйвера на принтера за този печат: тава за хартия, вид хартия, довършителна обработка и други.
+	Couldn't open the printer's preferences: {e}	Предпочитанията на принтера не можаха да се отворят: {e}
+	Printer properties	Свойства на принтера
+	Reset to printer defaults	Възстанови настройките по подразбиране на принтера
+	This printer offers no settings of its own.	Този принтер няма собствени настройки.
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8bb47e79..8aa85e06 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2099,3 +2099,9 @@ action wizard	Start	Starten
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy oder yy Jahr · m oder mm Monat · mmm oder mmmm Monatsname · d oder dd Tag · ddd oder dddd Wochentag. H, h, M, s und t sind Zeitbuchstaben und können nicht allein verwendet werden: Setze {escape} vor einen Buchstaben, um ihn unverändert anzuzeigen.
 	Same as interface ({language})	Wie die Oberfläche ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} kann noch nicht in das PDF geschrieben werden: Text beim Ausfüllen und Unterschreiben ist auf westeuropäische Zeichen beschränkt. Wähle ein numerisches Format wie dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Öffnet die Einstellungen des Druckertreibers. Sie gelten für jeden Druck von diesem Computer; die hier gewählten Kopien, Duplex, Graustufen und das Papier gelten weiterhin.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Die eigenen Einstellungen des Druckertreibers für diesen Druck: Papierfach, Papiersorte, Endverarbeitung und mehr.
+	Couldn't open the printer's preferences: {e}	Die Druckereinstellungen konnten nicht geöffnet werden: {e}
+	Printer properties	Druckereigenschaften
+	Reset to printer defaults	Auf Druckerstandard zurücksetzen
+	This printer offers no settings of its own.	Dieser Drucker bietet keine eigenen Einstellungen.
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 5e817789..079faac3 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2015,3 +2015,9 @@
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy o yy año · m o mm mes · mmm o mmmm nombre del mes · d o dd día · ddd o dddd día de la semana. H, h, M, s y t son letras de hora y no pueden usarse solas: pon {escape} delante de una letra para mostrarla tal cual.
 	Same as interface ({language})	Igual que la interfaz ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} todavía no se puede escribir en el PDF: el texto de Rellenar y firmar solo admite caracteres de Europa occidental. Elige un formato numérico como dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Abre las preferencias del controlador de la impresora. Se guardan para todas las impresiones de este equipo; las copias, la impresión a doble cara, la escala de grises y el papel elegidos aquí se siguen aplicando.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Los ajustes propios del controlador de la impresora para esta impresión: bandeja, tipo de papel, acabado y más.
+	Couldn't open the printer's preferences: {e}	No se pudieron abrir las preferencias de la impresora: {e}
+	Printer properties	Propiedades de la impresora
+	Reset to printer defaults	Restablecer los valores predeterminados de la impresora
+	This printer offers no settings of its own.	Esta impresora no ofrece ajustes propios.
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index f4c97170..e83f588c 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2052,3 +2052,9 @@
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy ou yy année · m ou mm mois · mmm ou mmmm nom du mois · d ou dd jour · ddd ou dddd jour de la semaine. H, h, M, s et t sont des lettres d'heure et ne peuvent pas être utilisées seules : placez {escape} devant une lettre pour l'afficher telle quelle.
 	Same as interface ({language})	Comme l'interface ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} ne peut pas encore être écrit dans le PDF : le texte de Remplir et signer est limité aux caractères d'Europe occidentale. Choisissez un format numérique comme dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Ouvre les préférences du pilote d'imprimante. Elles sont enregistrées pour toutes les impressions de cet ordinateur ; les copies, le recto verso, les niveaux de gris et le papier choisis ici s'appliquent toujours.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Les réglages propres au pilote d'imprimante pour cette impression : bac, type de papier, finition, etc.
+	Couldn't open the printer's preferences: {e}	Impossible d'ouvrir les préférences de l'imprimante : {e}
+	Printer properties	Propriétés de l'imprimante
+	Reset to printer defaults	Rétablir les réglages par défaut de l'imprimante
+	This printer offers no settings of its own.	Cette imprimante ne propose aucun réglage propre.
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 1d395e26..e2f73712 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2097,3 +2097,9 @@ action wizard	Start	Indítás
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy vagy yy év · m vagy mm hónap · mmm vagy mmmm a hónap neve · d vagy dd nap · ddd vagy dddd a hét napja. A H, h, M, s és t időbetűk, önmagukban nem használhatók: tegyél {escape} jelet a betű elé, hogy változatlanul jelenjen meg.
 	Same as interface ({language})	Mint a felület ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} még nem írható a PDF-be: a kitöltés és aláírás szövege csak nyugat-európai karaktereket támogat. Válassz számokból álló formátumot, például dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Megnyitja a nyomtató-illesztőprogram beállításait. Ezek a számítógépről indított minden nyomtatásra érvényesek; az itt választott példányszám, kétoldalas nyomtatás, szürkeárnyalat és papír továbbra is érvényes.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	A nyomtató-illesztőprogram saját beállításai ehhez a nyomtatáshoz: papírtálca, papírtípus, utófeldolgozás és egyebek.
+	Couldn't open the printer's preferences: {e}	Nem sikerült megnyitni a nyomtató beállításait: {e}
+	Printer properties	Nyomtató tulajdonságai
+	Reset to printer defaults	A nyomtató alapértékeinek visszaállítása
+	This printer offers no settings of its own.	Ennek a nyomtatónak nincsenek saját beállításai.
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index a34233e5..8d9d5511 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1991,3 +1991,9 @@
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy または yy 年 · m または mm 月 · mmm または mmmm 月名 · d または dd 日 · ddd または dddd 曜日。H、h、M、s、t は時刻の文字なので単独では使えません。文字をそのまま表示するには前に {escape} を付けます。
 	Same as interface ({language})	表示言語と同じ（{language}）
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} はまだ PDF に書き込めません。入力と署名のテキストは西ヨーロッパの文字のみに対応しています。dd.mm.yyyy などの数字の形式を選んでください。
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	プリンタードライバーの基本設定を開きます。設定はこのコンピューターからのすべての印刷に保存されます。ここで選んだ部数、両面、グレースケール、用紙は引き続き適用されます。
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	この印刷に使うプリンタードライバー独自の設定：給紙トレイ、用紙の種類、後処理など。
+	Couldn't open the printer's preferences: {e}	プリンターの基本設定を開けませんでした: {e}
+	Printer properties	プリンターのプロパティ
+	Reset to printer defaults	プリンターの初期設定に戻す
+	This printer offers no settings of its own.	このプリンターには独自の設定がありません。
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 6641c93c..12c8ef8c 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2013,3 +2013,9 @@
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy или yy — год · m или mm — месяц · mmm или mmmm — название месяца · d или dd — день · ddd или dddd — день недели. H, h, M, s и t — буквы времени, их нельзя использовать отдельно: поставьте {escape} перед буквой, чтобы показать её как есть.
 	Same as interface ({language})	Как в интерфейсе ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} пока нельзя записать в PDF: текст «Заполнить и подписать» поддерживает только западноевропейские символы. Выберите числовой формат, например dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Открывает настройки драйвера принтера. Они сохраняются для всей печати с этого компьютера; выбранные здесь копии, двусторонняя печать, оттенки серого и бумага по-прежнему применяются.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Собственные параметры драйвера принтера для этой печати: лоток, тип бумаги, финишная обработка и другое.
+	Couldn't open the printer's preferences: {e}	Не удалось открыть настройки принтера: {e}
+	Printer properties	Свойства принтера
+	Reset to printer defaults	Вернуть параметры принтера по умолчанию
+	This printer offers no settings of its own.	У этого принтера нет собственных параметров.
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 47db38dc..ebef861c 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2031,3 +2031,9 @@ action wizard	Start	ప్రారంభించు
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy లేదా yy సంవత్సరం · m లేదా mm నెల · mmm లేదా mmmm నెల పేరు · d లేదా dd రోజు · ddd లేదా dddd వారం రోజు. H, h, M, s, t సమయ అక్షరాలు, వాటిని ఒంటరిగా ఉపయోగించలేరు: అక్షరాన్ని యథాతథంగా చూపడానికి దాని ముందు {escape} పెట్టండి.
 	Same as interface ({language})	ఇంటర్‌ఫేస్ లాగానే ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} ను ఇంకా PDF లో రాయలేము: నింపడం & సంతకం టెక్స్ట్ పశ్చిమ యూరోపియన్ అక్షరాలకు మాత్రమే పరిమితం. dd.mm.yyyy వంటి సంఖ్యా ఫార్మాట్‌ను ఎంచుకోండి.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	ప్రింటర్ డ్రైవర్ ప్రాధాన్యతలను తెరుస్తుంది. అవి ఈ కంప్యూటర్ నుండి ప్రతి ముద్రణ కోసం సేవ్ అవుతాయి; ఇక్కడ ఎంచుకున్న కాపీలు, రెండు వైపులా, గ్రేస్కేల్ మరియు కాగితం ఇప్పటికీ వర్తిస్తాయి.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	ఈ ముద్రణ కోసం ప్రింటర్ డ్రైవర్ స్వంత సెట్టింగ్‌లు: కాగితపు ట్రే, కాగితం రకం, ఫినిషింగ్ మరియు మరిన్ని.
+	Couldn't open the printer's preferences: {e}	ప్రింటర్ ప్రాధాన్యతలను తెరవడం సాధ్యం కాలేదు: {e}
+	Printer properties	ప్రింటర్ లక్షణాలు
+	Reset to printer defaults	ప్రింటర్ డిఫాల్ట్‌లకు రీసెట్ చేయి
+	This printer offers no settings of its own.	ఈ ప్రింటర్‌కు దాని స్వంత సెట్టింగ్‌లు లేవు.
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 0cdef4e2..1dc65fc0 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2119,3 +2119,9 @@ calendar date	December	грудня
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy або yy рік · m або mm місяць · mmm або mmmm назва місяця · d або dd день · ddd або dddd день тижня. H, h, M, s і t — літери часу, їх не можна використовувати окремо: поставте {escape} перед літерою, щоб показати її як є.
 	Same as interface ({language})	Як в інтерфейсі ({language})
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} поки не можна записати в PDF: текст заповнення й підпису підтримує лише західноєвропейські символи. Виберіть числовий формат, наприклад dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Відкриває налаштування драйвера принтера. Вони зберігаються для кожного друку з цього комп’ютера; вибрані тут кількість копій, двосторонній друк, відтінки сірого й папір і далі діють.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Власні налаштування драйвера принтера для цього друку: лоток, тип паперу, післядрукова обробка тощо.
+	Couldn't open the printer's preferences: {e}	Не вдалося відкрити налаштування принтера: {e}
+	Printer properties	Властивості принтера
+	Reset to printer defaults	Скинути до налаштувань принтера за замовчуванням
+	This printer offers no settings of its own.	Цей принтер не має власних налаштувань.
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d8cdb1b5..3fdbc568 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2063,3 +2063,9 @@
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy 或 yy 年 · m 或 mm 月 · mmm 或 mmmm 月份名称 · d 或 dd 日 · ddd 或 dddd 星期。H、h、M、s 和 t 是时间字母，不能单独使用：在字母前加 {escape} 可按原样显示。
 	Same as interface ({language})	与界面相同（{language}）
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	暂时无法将 {chars} 写入 PDF：填写与签名的文字仅支持西欧字符。请选择数字格式，例如 dd.mm.yyyy。
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	打开打印机驱动程序的首选项。这些设置会保存并用于此电脑上的所有打印；此处选择的份数、双面、灰度和纸张仍然适用。
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	此次打印的打印机驱动程序专属设置：纸盒、纸张类型、装订整理等。
+	Couldn't open the printer's preferences: {e}	无法打开打印机首选项：{e}
+	Printer properties	打印机属性
+	Reset to printer defaults	恢复打印机默认设置
+	This printer offers no settings of its own.	此打印机没有专属设置。
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index e2b2403f..18fd9301 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1984,3 +1984,9 @@
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy 或 yy 年 · m 或 mm 月 · mmm 或 mmmm 月份名稱 · d 或 dd 日 · ddd 或 dddd 星期。H、h、M、s 和 t 是時間字母，不能單獨使用：在字母前加上 {escape} 即可照原樣顯示。
 	Same as interface ({language})	與介面相同（{language}）
 	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	暫時無法將 {chars} 寫入 PDF：填寫與簽署的文字僅支援西歐字元。請選擇數字格式，例如 dd.mm.yyyy。
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	開啟印表機驅動程式的喜好設定。這些設定會儲存並用於此電腦的所有列印；此處選擇的份數、雙面、灰階和紙張仍然適用。
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	此次列印的印表機驅動程式專屬設定：紙匣、紙張類型、裝訂整理等。
+	Couldn't open the printer's preferences: {e}	無法開啟印表機喜好設定：{e}
+	Printer properties	印表機內容
+	Reset to printer defaults	還原印表機預設值
+	This printer offers no settings of its own.	此印表機沒有專屬設定。
diff --git a/crates/ui-egui/src/print_ui.rs b/crates/ui-egui/src/print_ui.rs
index 951b1d31..88488ad6 100644
--- a/crates/ui-egui/src/print_ui.rs
+++ b/crates/ui-egui/src/print_ui.rs
@@ -59,6 +59,13 @@ pub struct PrintDraft {
     /// The sheet shown in the preview (0-based).
     pub sheet: usize,
     pub current_page: usize,
+    /// The printer driver's own options and the printer they were read for (Properties…, CUPS).
+    pub driver_options: Option<(String, Vec<spool::PrinterOption>)>,
+    /// Driver options set away from the printer's defaults, for `driver_options`' printer.
+    pub driver_choices: std::collections::BTreeMap<String, String>,
+    pub show_driver_options: bool,
+    /// Why the printer's preferences window didn't open (Windows).
+    pub driver_error: Option<String>,
 }
 
 impl Default for PrintDraft {
@@ -92,6 +99,10 @@ impl Default for PrintDraft {
             paper: 0,
             sheet: 0,
             current_page: 0,
+            driver_options: None,
+            driver_choices: Default::default(),
+            show_driver_options: false,
+            driver_error: None,
         }
     }
 }
@@ -139,6 +150,11 @@ impl PrintDraft {
             duplex: self.duplex,
             grayscale: self.grayscale,
             title: title.to_string(),
+            // Only for the printer the options were read from.
+            options: match (&self.printer, &self.driver_options) {
+                (Some(p), Some((read_for, _))) if p == read_for => self.driver_choices.iter().map(|(k, v)| (k.clone(), v.clone())).collect(),
+                _ => Vec::new(),
+            },
         }
     }
 }
@@ -253,6 +269,61 @@ impl PdfCraftApp {
     }
 }
 
+/// Properties… on CUPS: the driver's options for this print, grouped as the driver groups them.
+/// Only choices away from the printer's defaults are kept, and sent with the job.
+fn driver_options_panel(ui: &mut egui::Ui, d: &mut PrintDraft, t: &Tokens) {
+    let PrintDraft { driver_options: Some((_, options)), driver_choices: choices, show_driver_options: show, .. } = d else { return };
+    egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
+        ui.set_width(ui.available_width());
+        ui.horizontal(|ui| {
+            ui.label(egui::RichText::new(tl!("Printer properties")).font(theme::semibold(13.0)));
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if ui.button(tl!("Done")).clicked() {
+                    *show = false;
+                }
+                if ui.add_enabled(!choices.is_empty(), egui::Button::new(tl!("Reset to printer defaults"))).clicked() {
+                    choices.clear();
+                }
+            });
+        });
+        if options.is_empty() {
+            ui.label(egui::RichText::new(tl!("This printer offers no settings of its own.")).small().color(t.text_muted));
+            return;
+        }
+        egui::ScrollArea::vertical().id_salt("driver-options").max_height(240.0).show(ui, |ui| {
+            for (n, chunk) in options.chunk_by(|a, b| a.group == b.group).enumerate() {
+                let group = chunk.first().map_or("", |o| o.group.as_str());
+                if !group.is_empty() {
+                    ui.add_space(4.0);
+                    // Option and group names are the driver's own text.
+                    ui.label(egui::RichText::new(group).small().color(t.text_muted));
+                }
+                egui::Grid::new(("driver-group", n)).num_columns(2).spacing([10.0, 4.0]).show(ui, |ui| {
+                    for o in chunk {
+                        ui.label(&o.label);
+                        let current = choices.get(&o.key).cloned().unwrap_or_else(|| o.default.clone());
+                        let label_of = |c: &str| o.choices.iter().find(|(k, _)| k == c).map_or_else(|| c.to_string(), |(_, l)| l.clone());
+                        let mut pick = current.clone();
+                        egui::ComboBox::from_id_salt(("driver-option", &o.key)).selected_text(label_of(&current)).width(200.0).show_ui(ui, |ui| {
+                            for (k, l) in &o.choices {
+                                ui.selectable_value(&mut pick, k.clone(), l.as_str());
+                            }
+                        });
+                        if pick != current {
+                            if pick == o.default {
+                                choices.remove(&o.key);
+                            } else {
+                                choices.insert(o.key.clone(), pick);
+                            }
+                        }
+                        ui.end_row();
+                    }
+                });
+            }
+        });
+    });
+}
+
 fn combo<T: PartialEq + Copy>(ui: &mut egui::Ui, id: &str, value: &mut T, choices: &[(T, &str)], width: f32) {
     let shown = choices.iter().find(|c| c.0 == *value).map_or("", |c| c.1);
     egui::ComboBox::from_id_salt(id).selected_text(shown).width(width).show_ui(ui, |ui| {
@@ -284,14 +355,40 @@ pub(crate) fn body(
             ui.set_width(470.0);
             egui::Grid::new("print-top").num_columns(2).spacing([10.0, 8.0]).show(ui, |ui| {
                 ui.label(tl!("Printer:"));
-                let shown = d.printer.clone().unwrap_or_else(|| tl!("Save as PDF").to_string());
-                egui::ComboBox::from_id_salt("printer").selected_text(shown).width(260.0).show_ui(ui, |ui| {
-                    for p in &d.printers {
-                        let label = if p.default { crate::i18n::fmt(tl!("{name} (default)"), &[("name", &p.name)]) } else { p.name.clone() };
-                        ui.selectable_value(&mut d.printer, Some(p.name.clone()), label);
+                let before = d.printer.clone();
+                ui.horizontal(|ui| {
+                    let shown = d.printer.clone().unwrap_or_else(|| tl!("Save as PDF").to_string());
+                    egui::ComboBox::from_id_salt("printer").selected_text(shown).width(260.0).show_ui(ui, |ui| {
+                        for p in &d.printers {
+                            let label = if p.default { crate::i18n::fmt(tl!("{name} (default)"), &[("name", &p.name)]) } else { p.name.clone() };
+                            ui.selectable_value(&mut d.printer, Some(p.name.clone()), label);
+                        }
+                        ui.selectable_value(&mut d.printer, None, tl!("Save as PDF"));
+                    });
+                    let tip = if spool::HAS_PRINTER_PREFERENCES {
+                        tl!("Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.")
+                    } else {
+                        tl!("The printer driver's own settings for this print: paper tray, paper type, finishing and more.")
+                    };
+                    let properties = ui.add_enabled(d.printer.is_some(), egui::Button::new(tl!("Properties…"))).on_hover_text(tip);
+                    if properties.clicked()
+                        && let Some(p) = d.printer.clone()
+                    {
+                        if spool::HAS_PRINTER_PREFERENCES {
+                            d.driver_error = spool::open_printer_preferences(&p).err().map(|e| e.to_string());
+                        } else {
+                            if d.driver_options.as_ref().is_none_or(|(read_for, _)| *read_for != p) {
+                                d.driver_options = Some((p.clone(), spool::printer_options(&p)));
+                                d.driver_choices.clear();
+                            }
+                            d.show_driver_options = !d.show_driver_options;
+                        }
                     }
-                    ui.selectable_value(&mut d.printer, None, tl!("Save as PDF"));
                 });
+                if d.printer != before {
+                    d.show_driver_options = false;
+                    d.driver_error = None;
+                }
                 ui.end_row();
                 ui.label(tl!("Copies:"));
                 ui.horizontal(|ui| {
@@ -321,6 +418,12 @@ pub(crate) fn body(
                 });
                 ui.end_row();
             });
+            if let Some(e) = &d.driver_error {
+                ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Couldn't open the printer's preferences: {e}"), &[("e", e)])).small().color(t.text_muted));
+            }
+            if d.show_driver_options {
+                driver_options_panel(ui, d, t);
+            }
             ui.add_space(6.0);
             widgets::section_title(ui, tl!("Pages to Print"));
             ui.horizontal(|ui| {
diff --git a/crates/ui-egui/tests/print.rs b/crates/ui-egui/tests/print.rs
index 53ad1b86..82af1860 100644
--- a/crates/ui-egui/tests/print.rs
+++ b/crates/ui-egui/tests/print.rs
@@ -152,3 +152,41 @@ fn a_failed_save_as_pdf_keeps_the_dialog_open() {
     let toast = h.state().toast.as_ref().map(|(m, _)| m.clone()).unwrap_or_default();
     assert!(toast.contains("Could not save"), "the user is told why: {toast:?}");
 }
+
+/// Properties… shows the printer driver's own options (CUPS) and sends only those changed.
+#[test]
+fn print_dialog_shows_the_printer_driver_options() {
+    use pdfcraft_engine::print::spool;
+    let mut h = harness();
+    assert!(h.state_mut().execute("print.dialog"));
+    h.run_steps(3);
+    h.state_mut().print_draft.printer = None;
+    h.run_steps(1);
+    assert!(h.query_by(|n| n.label().as_deref() == Some("Properties…") && n.is_disabled()).is_some(), "Save as PDF has no driver");
+    let tray = spool::PrinterOption {
+        key: "InputSlot".into(),
+        label: "Paper tray".into(),
+        group: "Media".into(),
+        choices: vec![("AutoSelect".into(), "Auto tray select".into()), ("Tray2".into(), "Tray 2".into())],
+        default: "AutoSelect".into(),
+    };
+    {
+        let d = &mut h.state_mut().print_draft;
+        d.printer = Some("Test_Queue".into());
+        d.driver_options = Some(("Test_Queue".into(), vec![tray]));
+        d.driver_choices.insert("InputSlot".into(), "Tray2".into());
+        d.show_driver_options = true;
+    }
+    h.run_steps(2);
+    h.get_by_label("Printer properties");
+    h.get_by_label("Media");
+    h.get_by_label("Paper tray");
+    assert_eq!(h.state().print_draft.job("form.pdf").options, [("InputSlot".to_string(), "Tray2".to_string())]);
+    h.get_by_label("Reset to printer defaults").click();
+    h.run_steps(2);
+    assert!(h.state().print_draft.job("form.pdf").options.is_empty(), "defaults are not sent");
+    // Options read for another printer never go with this one's job.
+    h.state_mut().print_draft.driver_choices.insert("InputSlot".into(), "Tray2".into());
+    h.state_mut().print_draft.printer = Some("Other_Queue".into());
+    assert!(h.state().print_draft.job("form.pdf").options.is_empty());
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 4655479a..685b19da 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7829,9 +7829,9 @@ tier = "P0"
 milestone = "M10"
 status = "shipped"
 commands = ["print.dialog"]
-tools = ["printers", "doc_print"]
-evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list"]
-notes = "CUPS printers via lpstat; Save as PDF; Windows spooler pending"
+tools = ["printers", "printer_options", "doc_print"]
+evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list", "crates/print/src/tests.rs::printer_options_come_from_the_ppd", "crates/print/src/tests.rs::printer_option_defaults_and_job_arguments", "crates/ui-egui/tests/print.rs::print_dialog_shows_the_printer_driver_options"]
+notes = "CUPS printers via lpstat; Save as PDF; Windows spooler pending. Properties…: on CUPS the driver's own PPD job options (tray, paper type, finishing …, not installable options or what the dialog sets) for this job, sent as lp -o; on Windows the driver's Printing Preferences window (printui), saved as that printer's per-user defaults rather than per job"
 
 [[feature]]
 id = "print.copies-collate"

From dbd07481772aa15a6f5c46f271a369ea6500dffe Mon Sep 17 00:00:00 2001
From: skylar taylor-barrick <hi@skylar.cc>
Date: Fri, 9 Oct 2026 12:38:01 -0600
Subject: [PATCH 111/149] Reduce large-PDF memory growth (#307) (#419)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M14: bound large-PDF memory use (#307)

Inspect large documents lazily, share parser/resource metadata, bound full-save
and raster retention, and cache signature candidate discovery safely.

Preserve upstream rendering deduplication, pixel alignment, signature previews,
and organizer insertion behavior, with regression coverage for their interaction.

Validated with 1,336 workspace tests, 193 parser tests, strict workspace Clippy,
30 WASM crate checks, 1x/2x GUI protocols, and same-PDF workflow comparisons.

* cos: drop the writer cache-policy probe and its test-only hooks in production paths

* cos: the temporary reader keeps parsed objects until a count or owned-bytes budget

Since #552 a stream read from the file is a view into the input, so clearing the whole parse
cache after every read saved little memory and cost most of the full-save slowdown (every
object parsed twice, indirect /Length objects re-parsed per stream). Clear only past
OBJECTS entries or STREAM_BYTES of data of the cache's own (decrypted streams, strings).

* cos: the writers refuse a document opened with a stream limit (read-only inspection)

* cos: a full save fails rather than writing null when an object reads differently the second time

* render: parsing is not timed by the watchdog; timing tests with wide margins

A slow first parse (a huge or damaged file) made the whole pool fail every page for its
lifetime. Parsing, shared or private, is now its own untimed stage, as on main before the
shared parser; rendering is timed from when parsing ends. The init-timeout tests become one
deterministic test (a 2 s parse against a 10 ms limit, shared and private). Watchdog tests
use limits and injected delays ~10x apart instead of 25-50 ms against real renders. Also:
saturating retired-worker count, main's stop-flag test runs on private parsers (the first
shared timeout is a private retry), set_queue documents that unlisted results are dropped,
and retire() documents the permanent per-worker-parser fallback.

* render: page numbers in the lazy page tree use checked conversion

* render: the lazy inspector is compared with lopdf on named destinations and object streams too

* ui: on-screen pages always render; pages turned back to stay cached; stable thumbnail tags

- Visible pages and tiles are always admitted and uploaded (the viewport bounds them); the
  byte and count limits decide only how much prefetch fits. A HiDPI two-up view or a 5K
  viewport left pages on 'Rendering...' for good.
- Pages no longer demanded stay cached, nearest the current page first, while the 128 MiB
  allowance and the 24-page count have room: paging back no longer re-renders.
- Thumbnail density follows the demand count rounded up to a power of two, so rows scrolling
  in and out of an organize grid don't change every thumbnail's tag and re-render it.
- A suspended (background) tab drains its pool's finished results instead of holding them.
- Organize drag-and-drop ends on the primary button only.
- Tests: the stale-result test uses valid pixels and checks nothing was uploaded; the
  organizer wheel test runs 40 steps; regressions for the first three fixes.

* vendor: mark the hayro-syntax lock and SegmentList patches and list them as (8) and (9); clippy 1.99 as_chunks in a raster test

* render: clippy 1.99 — contains over iter().any() in a raster test

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                             |  24 +-
 crates/cos/src/bytes.rs                |   5 +
 crates/cos/src/document.rs             | 342 ++++++++-
 crates/cos/src/lib.rs                  |   4 +-
 crates/cos/src/writer.rs               | 235 +++++--
 crates/cos/tests/bounded_writer.rs     | 236 +++++++
 crates/render/src/inspect.rs           |  65 +-
 crates/render/src/lib.rs               |   7 +-
 crates/render/src/pixels.rs            |  12 +
 crates/render/src/raster.rs            | 921 +++++++++++++++++++++----
 crates/render/src/raster/work_queue.rs | 499 ++++++++++++++
 crates/render/src/structure.rs         | 239 +++++++
 crates/sign/src/pdf.rs                 | 118 +++-
 crates/sign/src/pdf_discovery_tests.rs | 352 ++++++++++
 crates/sign/tests/pdf.rs               |  67 ++
 crates/ui-egui/src/canvas.rs           | 816 ++++++++++++++++++----
 crates/ui-egui/src/control.rs          |   1 +
 crates/ui-egui/src/dialogs.rs          |   8 +-
 crates/ui-egui/src/lib.rs              |  32 +-
 crates/ui-egui/src/panels.rs           |   3 +
 crates/ui-egui/src/print_ui.rs         |   2 +-
 crates/ui-egui/tests/control.rs        |  62 +-
 vendor/README.md                       |   2 +-
 vendor/hayro-syntax/src/data.rs        | 181 ++++-
 vendor/hayro-syntax/src/object/dict.rs | 258 ++++++-
 vendor/hayro-syntax/src/object/name.rs |  10 +
 vendor/hayro-syntax/src/sync.rs        |  28 +-
 vendor/hayro-syntax/src/util.rs        |  46 +-
 vendor/hayro-syntax/src/xref.rs        | 256 ++++++-
 29 files changed, 4357 insertions(+), 474 deletions(-)
 create mode 100644 crates/cos/tests/bounded_writer.rs
 create mode 100644 crates/render/src/raster/work_queue.rs
 create mode 100644 crates/render/src/structure.rs
 create mode 100644 crates/sign/src/pdf_discovery_tests.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 3c149ccb..b8193f72 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -42,7 +42,7 @@ Read this before choosing work. The feature table above counts what exists; this
 |---|---|---|
 | Feature count | 51.0% shipped (P0 88%, P1 53%, P2 8%, P3 2%) | A typical viewer, annotator, form-filler or page organizer is mostly covered |
 | Effort | ≈ 30–35% | The remaining work is the hardest: M2 15%, M7 17%, M11 18%, M12 23%, M14 0% |
-| Foundations | Weakest | Rendering is still the bootstrap `hayro`; the inspector is `lopdf`; 18 vendored patches carried |
+| Foundations | Weakest | Rendering is still the bootstrap `hayro`; the local #307 candidate reads inspector data lazily through COS with `lopdf` compatibility logic; vendored patches are still carried |
 | Robustness | Early beta | Each 15-minute fuzz run found new out-of-memory crashes or hangs until 2026-10-05 |
 | Acrobat fidelity | Unmeasured | No systematic side-by-side comparison with Acrobat, visual or behavioural |
 | Product readiness | 0.2.1 | No code signing, performance budgets or keyboard-only operation yet; localization has its catalog system (English, partial Japanese) but few strings go through it |
@@ -106,8 +106,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 165–290 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 23% | 155–295 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 33–66 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, German, Spanish and French catalogs have ≈1,800 entries each; Simplified Chinese, French and German coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog. Missing: more catalogs filled in, installers, performance budgets |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Spanish, French and Ukrainian catalogs have ≈1,800–2,000 entries each; Simplified Chinese, French and Ukrainian coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog; Ukrainian locales (`uk`, `uk_UA`) follow the Ukrainian one. Missing: more catalogs filled in, installers, performance budgets |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Hungarian and Ukrainian catalogs have ≈1,800–2,000 entries each; Simplified Chinese, French, German, Hungarian and Ukrainian coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog; Ukrainian locales (`uk`, `uk_UA`) follow the Ukrainian one. #307 (bounded large-PDF memory): share resource indexes and native parser metadata, inspect structure lazily, bound scan/full-save caches and raster storage, and reuse signature discovery safely. Three Linux trials retain full-save workflow RSS at 1.06 GiB (previously 3.69 GiB); rebased engine navigation uses 821 MiB (previously 997 MiB). With the RSS guard removed, the unmodified baseline was kernel OOM-killed in a 15 GiB container; rebased optimized inspection completed at 497.7 MiB in 1.78 s. Strict Clippy, 1,336 workspace tests and 30 WASM crate checks pass. The larger-host follow-up is closed. File-backed input, global memory budgets and Windows validation remain pending. Missing: more catalogs filled in, installers, performance budgets |
 | | **Total (original plan sizing)** | **2,085–3,840** | **≈ 35%** | **≈ 1,350–2,500 at the planned rate; ≈ 600–1,100 at the measured rate** | |
 
 **Overall progress: about 30–35% of the effort (51.0% of features shipped).** The viewer and the core are far ahead of the editing features, because the viewer was built first so progress could be seen; rendering itself is still borrowed from `hayro`. See [Honest assessment](#honest-assessment-2026-10-05).
@@ -135,8 +134,6 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
 
-- **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
-- **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
@@ -145,11 +142,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
 
-- **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
+- **2026-10-08 (M14, #307, upstream integration):** Rebased the local candidate onto main `a6bc63a`, preserving render-request deduplication, pixel-aligned rasters, signature editing and organizer insertion controls. Regressions cover inactive signature-preview cleanup, insertion gaps under virtualization, and canceled/reintroduced render requests. All 1,336 workspace tests pass (6 ignored), 193 parser tests pass (2 missing-fixture tests filtered), strict workspace/all-target Clippy passes without allowances, and 30 WASM crate checks pass. All 1,010 navigation frames, 12 workflow artifacts and eight 100-page external PDF checks match; 1×/2× desktop protocols pass again. Inspection is 497.7 MiB / 1.78 s, full-save 1.06 GiB / 29.64 s, and fresh desktop navigation/close/reopen 877 MiB. The desktop result is higher than the pre-rebase 832 MiB, while remaining 21.9% below the earlier bounded-writer stage. Windows, cold-start latency and global memory budgets remain open; no milestone percentage increase.
 
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
@@ -157,6 +150,17 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-08 (M5.7, signature placement):** Image signatures and initials preview at the pointer at their actual page size, including zoom and document/view rotation. A successful placement switches to Select with the new annotation selected; stamp resize handles use the existing engine edit, automation tool and undo history while preserving the appearance. Synthetic rendered UI and automation tests verify positioning, one placement per selection, resizing, undo/redo and save/reopen. Milestone and overall effort estimates unchanged.
 - **2026-10-08 (M5.7, image signatures):** Fill & Sign imports local PNG/JPEG signatures and initials through the Image tab, with previews, local persistence and undoable placement. The shared engine validates bounded images and preserves transparency and orientation; `fill_sign_add` accepts an image path. Synthetic UI and automation tests cover cancellation, invalid input, settings, undo/redo and save/reopen rendering. Overall effort estimate unchanged (about 30–35%).
+- **2026-10-08 (M14, #307, confirmed baseline OOM):** Removed the benchmark RSS guard and ran the frozen original and optimized CLI binaries in separate containers with a verified 15 GiB kernel memory limit, no swap and four CPUs. The unmodified baseline was kernel OOM-killed after 20.06 s with 14.97 GiB observed RSS; Docker recorded `OOMKilled=true`, exit 137 and an `oom` event. The optimized build completed the same 9,156-page inspection at 497.5 MiB in 1.75 s with unchanged metadata and no warnings. The original RSS remains a lower bound and elapsed time is time to failure. The kernel limit still constrains this experiment; no remote run was needed. No product changes or milestone percentage increase.
+
+- **2026-10-08 (M14, #307, original-baseline cutoff):** Repeated original unmodified CLI inspection with a 14 GiB RSS guard, up from 10 GiB, on the unchanged 9,156-page PDF. It reached 14,682,080 KiB and was stopped after 48.21 s before completion; no cgroup OOM kill occurred. The optimized build completed the same inspection at 495.7 MiB in 1.70 s. The original measurement is a lower bound, not a completed peak or timing. This guarded run failed before completion without an OS OOM kill. The user closed the larger-host follow-up; the prepared benchmark is retained as evidence. The later local guard-free experiment is recorded above. No product changes or milestone percentage increase.
+
+- **2026-10-08 (M14, #307, shared parsing and raster budgets):** Native render workers share a lazily initialized parser after cold-load/repair concurrency and watchdog recovery fixes, while retaining private render caches. Pages, organizer and Print request current visible thumbnails; retained active-view textures are limited to 24/128/128 MiB for thumbnails/pages/tiles and completed raster storage to 32 MiB/32 results, allowing one oversized result alone. Signature discovery uses a bounded source/edit-aware cache; the writer borrows unchanged objects and reuses xref rows. Engine navigation drops from 997 to 807 MiB with all 1,010 frame hashes unchanged. Three-trial full/incremental-save workflow times improve to 29.92/16.35 s at unchanged 1.06/1.08 GiB peaks; full serialization remains slower than before bounded saving, and the single mixed workflow takes 67.99 s versus 65.52 s. All 1,158 workspace tests pass (6 ignored in the regular run), 193 vendor tests pass (2 missing-fixture tests filtered), eight outputs pass 100-page external checks, and 29 WASM crate checks pass. Existing strict workspace Clippy warnings remain; UI lint validation explicitly allows the existing collapsible-match category. Fresh desktop navigation/close/reopen falls from 1,123 to 832 MiB; 1x/2x GUI runs pass visible-demand and texture-budget checks on original 10,000-page fixtures and the real file. Output-capacity and LRU experiments did not justify production changes. These are local Linux results and specific storage budgets, not global RAM limits or Windows validation. No parity or milestone percentage increase.
+
+- **2026-10-08 (M14, #307, bounded saving):** Full rewriting now uses private temporary caches and packs objects in batches limited by count and serialized bytes, preserving unknown objects, reference identity and encryption behavior without populating undo snapshots. Native render workers initialize only on a live request, avoiding unused parser copies during refresh/rebase. Three same-file Linux trials reduce rotate/full-save/close/reopen peak RSS from 3.69 to 1.06 GiB (35.53 to 32.51 s); incremental workflow RSS falls from 1.56 to 1.08 GiB. All 1,114 workspace tests pass (4 ignored); eight saved outputs pass external text/raster checks on 100 sampled pages each, and 1,010 navigation frames match. First use of each worker now pays parser initialization; steady-state viewing remains about 1 GiB. Single oversized objects, whole source/output buffers, and Windows behavior remain outside a global budget claim. No parity or milestone percentage increase.
+
+- **2026-10-08 (M14, #307, research/comparison):** Added a local external-reference suite outside the repository, using the same 9,156-page PDF with MuPDF, PDFium, Poppler and qpdf. Three Linux trials put the candidate's single-renderer 102-frame peak at 392 MiB, versus 348/347 MiB for MuPDF/PDFium with whole-file bytes (164/163 MiB with file input). The rotate/full-save/close/reopen workflow peaks at 3.69 GiB during serialization; incremental saving peaks at 1.56 GiB during rebasing. Different UI features, input/cache policies and writer compression settings prevent treating these as app rankings. Next targets are bounded object-stream packing, parsed-object lifetimes, snapshot overlap and file-backed input. No further runtime optimization or milestone percentage increase in this research step.
+
+- **2026-10-08 (M14, #307, local candidate):** Validated the 192.9 MB, 9,156-page VMware document in Linux. The original CLI exceeded a 10 GiB measurement cutoff before finishing inspection; the candidate inspects in about 1.8 s at 496 MiB and a 1,000-page navigation/close/reopen probe peaks at 990 MiB. It shares validated large resource indexes within each parser, reads panel structure on demand through COS with the previous inspector as a compatibility fallback, and scans standalone timestamps with temporary caches instead of retaining every object in the editor. Inspection output and 104 common sampled page renders match the handoff candidate. This is a different PDF revision from the original Windows issue; Windows GUI private memory and responsiveness remain unverified. No parity or milestone percentage increase.
 
 - **2026-10-08 (M9, #179):** Windows Current User Personal certificate store identities join file-based digital IDs, signing through CNG without exporting keys. RSA-2048 and ECDSA P-256 round trips use temporary certificates with cleanup guards; enumeration, missing identities, automation errors and the password-free UI have regression coverage. Smart cards and PKCS #11 remain planned; overall effort estimate unchanged.
 
diff --git a/crates/cos/src/bytes.rs b/crates/cos/src/bytes.rs
index d2dcf238..f6ad1b8e 100644
--- a/crates/cos/src/bytes.rs
+++ b/crates/cos/src/bytes.rs
@@ -23,6 +23,11 @@ impl Bytes {
         self.range.len() < self.buf.len() && !Arc::ptr_eq(&self.buf, owner)
     }
 
+    /// Whether these bytes are (a view into) `buf`, holding no memory of their own.
+    pub(crate) fn shares(&self, buf: &Arc<Vec<u8>>) -> bool {
+        Arc::ptr_eq(&self.buf, buf)
+    }
+
     /// The same bytes, in a buffer of their own.
     pub(crate) fn detached(&self) -> Self {
         Self::from(self.to_vec())
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 665bebe5..3ad5b678 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -6,7 +6,7 @@
 //! the file (full save).
 
 use std::collections::{BTreeMap, HashMap, HashSet};
-use std::sync::{Arc, Mutex};
+use std::sync::{Arc, Mutex, Weak};
 
 use crate::CosError;
 use crate::object::{Dict, ObjRef, Object};
@@ -84,15 +84,31 @@ enum Slot {
     Freed(u16),
 }
 
+/// An immutable input/decode context shared by document clones. Holding this identity
+/// retains neither the input bytes nor the parsed document. Weak ownership prevents an
+/// expired identity from matching a later allocation at the same address.
+#[derive(Clone, Debug)]
+pub struct SourceIdentity(Weak<()>);
+
+impl PartialEq for SourceIdentity {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.ptr_eq(&other.0)
+    }
+}
+
+impl Eq for SourceIdentity {}
+
 #[derive(Clone)]
 pub struct Document {
     data: Arc<Vec<u8>>,
+    source_identity: Arc<()>,
     entries: Arc<BTreeMap<u32, XrefEntry>>,
     trailer: Dict,
     revisions: Arc<Vec<Revision>>,
     repair_log: Arc<Vec<String>>,
     cache: Arc<Mutex<HashMap<u32, Arc<Object>>>>,
     objstms: Arc<Mutex<HashMap<u32, Arc<ObjStm>>>>,
+    stream_limit: usize,
     overlay: BTreeMap<u32, Slot>,
     next_num: u32,
     /// Position of the `%PDF-` header (some files have junk before it).
@@ -111,6 +127,80 @@ pub struct Document {
     out_encrypt_num: Option<u32>,
 }
 
+/// A temporary reader for whole-document work. Its caches never populate the editor or
+/// undo snapshots. Returned objects survive cache eviction; a stream read from the file is a
+/// view into the input bytes (it keeps the whole input alive while held, not a copy).
+pub(crate) struct ObjectReader {
+    pub(crate) document: Document,
+    decoded_count: usize,
+}
+
+impl ObjectReader {
+    const OBJECTS: usize = 128;
+    const STREAM_BYTES: usize = 8 * 1024 * 1024;
+
+    pub(crate) fn get(&mut self, reference: ObjRef) -> Arc<Object> {
+        self.try_get(reference).unwrap_or_else(|_| Arc::new(Object::Null))
+    }
+
+    pub(crate) fn try_get(&mut self, reference: ObjRef) -> Result<Arc<Object>, CosError> {
+        let object = self.document.try_get(reference.num);
+        if let Ok(mut streams) = self.document.objstms.lock() {
+            // Only insertion changes this private cache between reads. Most neighboring
+            // objects reuse a decoded stream: do not sum the whole store for every object.
+            if streams.len() != self.decoded_count {
+                let bytes = streams.values().fold(0usize, |bytes, stream| {
+                    bytes
+                        .saturating_add(stream.data.capacity())
+                        .saturating_add(stream.index.capacity().saturating_mul(std::mem::size_of::<(u32, usize)>()))
+                });
+                if bytes > Self::STREAM_BYTES || streams.len() >= Self::OBJECTS {
+                    // Retain one oversized active stream so its next object does not require
+                    // decoding it again. That stream still obeys the document's decode cap.
+                    let current = match self.document.xref_entry(reference.num) {
+                        Some(XrefEntry::InStream { stream, .. }) => Some(stream),
+                        _ => None,
+                    };
+                    streams.retain(|num, _| Some(*num) == current);
+                }
+                self.decoded_count = streams.len();
+            }
+        }
+        // Parsed objects stay cached (an indirect /Length or a dictionary read again costs a
+        // lookup, not a parse) until the cache passes its object count or holds more than
+        // STREAM_BYTES of data of its own. Streams read from the file are views into the
+        // input bytes, which the document keeps anyway, so they don't count; decrypted
+        // streams and strings do. Checked after failed loads too: resolving a /Length may
+        // have cached large objects.
+        if let Ok(mut cache) = self.document.cache.lock() {
+            let data = &self.document.data;
+            if cache.len() >= Self::OBJECTS || cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, data, 0))) > Self::STREAM_BYTES {
+                cache.clear();
+            }
+        }
+        object
+    }
+}
+
+/// Bytes `object` holds of its own: string and stream data that is not a view into `data`
+/// (the input file), nested a few levels deep (deeper data is rare and still bounded by the
+/// reader's object count).
+fn owned_bytes(object: &Object, data: &Arc<Vec<u8>>, depth: usize) -> usize {
+    if depth > 4 {
+        return 0;
+    }
+    match object {
+        Object::String(s) => s.bytes.len(),
+        Object::Stream(s) => {
+            let own = if s.raw.shares(data) { 0 } else { s.raw.len() };
+            s.dict.iter().fold(own, |n, (_, v)| n.saturating_add(owned_bytes(v, data, depth + 1)))
+        }
+        Object::Array(a) => a.iter().fold(0usize, |n, v| n.saturating_add(owned_bytes(v, data, depth + 1))),
+        Object::Dict(d) => d.iter().fold(0usize, |n, (_, v)| n.saturating_add(owned_bytes(v, data, depth + 1))),
+        _ => 0,
+    }
+}
+
 impl std::fmt::Debug for Document {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.debug_struct("Document").field("bytes", &self.data.len()).field("objects", &self.entries.len()).field("edits", &self.overlay.len()).finish()
@@ -123,12 +213,14 @@ impl Document {
     pub fn new_empty() -> Self {
         let mut doc = Document {
             data: Arc::new(Vec::new()),
+            source_identity: Arc::new(()),
             entries: Arc::new(BTreeMap::new()),
             trailer: Dict::new(),
             revisions: Arc::new(Vec::new()),
             repair_log: Arc::new(Vec::new()),
             cache: Arc::default(),
             objstms: Arc::default(),
+            stream_limit: crate::object::MAX_DECODED,
             overlay: BTreeMap::new(),
             next_num: 1,
             header_offset: 0,
@@ -162,6 +254,14 @@ impl Document {
     /// Parse a document, authenticating encrypted ones with `password` (owner or user; `None`
     /// tries the empty password). Fails with `NeedsPassword` / `WrongPassword` as appropriate.
     pub fn open_with_password(data: Arc<Vec<u8>>, password: Option<&str>) -> Result<Self, CosError> {
+        Self::open_with_stream_limit(data, password, crate::object::MAX_DECODED)
+    }
+
+    /// Open with a tighter decompression bound for object and cross-reference streams.
+    /// Inspection can use this without changing the editing reader's default limit. Such a
+    /// document is read-only: objects in a larger object stream read as missing, so the
+    /// writers refuse to save it ([`CosError::ReadOnlyLimit`]).
+    pub fn open_with_stream_limit(data: Arc<Vec<u8>>, password: Option<&str>, stream_limit: usize) -> Result<Self, CosError> {
         // Viewers accept files whose header is missing or damaged as long as the body looks
         // like PDF; so do we (a note goes to the repair log).
         let header = find(&data, b"%PDF-", 0, 1024);
@@ -176,12 +276,14 @@ impl Document {
         };
         let mut doc = Document {
             data,
+            source_identity: Arc::new(()),
             entries: Arc::new(BTreeMap::new()),
             trailer: Dict::new(),
             revisions: Arc::new(Vec::new()),
             repair_log: Arc::new(Vec::new()),
             cache: Arc::default(),
             objstms: Arc::default(),
+            stream_limit: stream_limit.min(crate::object::MAX_DECODED),
             overlay: BTreeMap::new(),
             next_num: 1,
             header_offset,
@@ -237,6 +339,8 @@ impl Document {
     }
 
     fn authenticate(&mut self, enc: &Object, password: Option<&str>) -> Result<(), CosError> {
+        // Authentication can change how the same input is decoded.
+        self.source_identity = Arc::new(());
         let (num, dict) = match enc {
             Object::Ref(r) => (Some(r.num), self.get(*r).as_dict().cloned()),
             Object::Dict(d) => (None, Some(d.clone())),
@@ -388,6 +492,12 @@ impl Document {
         &self.data
     }
 
+    /// Identity of the original bytes, xref and authenticated decode context. Edits and
+    /// clones preserve it; reopening (including after any save) produces a new identity.
+    pub fn source_identity(&self) -> SourceIdentity {
+        SourceIdentity(Arc::downgrade(&self.source_identity))
+    }
+
     pub fn version(&self) -> &str {
         &self.version
     }
@@ -493,6 +603,59 @@ impl Document {
         Ok(obj)
     }
 
+    /// Visit every current object without filling this document's editing cache.
+    ///
+    /// Full-document searches (for example, standalone timestamps) need to inspect objects
+    /// that may never be used again. Keep their parse caches private and release them in
+    /// batches. Returned objects own their data and remain valid after the next batch.
+    pub fn scan_objects(&self) -> impl Iterator<Item = (ObjRef, Arc<Object>)> + use<> {
+        let numbers = self.object_numbers();
+        let mut reader = self.object_reader();
+        numbers.into_iter().map(move |num| {
+            let reference = ObjRef::new(num, reader.document.generation(num));
+            (reference, reader.get(reference))
+        })
+    }
+
+    /// Like [`Self::scan_objects`], preserving read errors for callers that must distinguish
+    /// incomplete discovery from an actual null object. Caches remain private and bounded.
+    pub fn scan_objects_checked(&self) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
+        self.scan_objects_subset(self.object_numbers())
+    }
+
+    /// Inspect selected current objects with the same bounded cache as a whole-file scan.
+    /// Missing/freed numbers yield `Null`; malformed objects return their read error.
+    pub fn scan_objects_subset(&self, numbers: Vec<u32>) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
+        let mut reader = self.object_reader();
+        numbers.into_iter().map(move |num| {
+            let reference = ObjRef::new(num, reader.document.generation(num));
+            (reference, reader.try_get(reference))
+        })
+    }
+
+    /// Inspect selected objects in the immutable source, ignoring all unsaved edits. This
+    /// allows a consumer to check an edit's dependencies without retaining an old document.
+    pub fn scan_original_objects_subset(&self, numbers: Vec<u32>) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
+        let mut reader = self.object_reader();
+        reader.document.overlay.clear();
+        numbers.into_iter().map(move |num| {
+            let reference = ObjRef::new(num, reader.document.generation(num));
+            (reference, reader.try_get(reference))
+        })
+    }
+
+    /// Opened with a tighter stream limit than editing uses ([`Document::open_with_stream_limit`]).
+    pub(crate) fn stream_limited(&self) -> bool {
+        self.stream_limit < crate::object::MAX_DECODED
+    }
+
+    pub(crate) fn object_reader(&self) -> ObjectReader {
+        let mut document = self.clone();
+        document.cache = Arc::default();
+        document.objstms = Arc::default();
+        ObjectReader { document, decoded_count: 0 }
+    }
+
     fn load(&self, num: u32, depth: u32) -> Result<Object, CosError> {
         if depth > 16 {
             return Err(CosError::Syntax { offset: 0, detail: "reference cycle while loading".into() });
@@ -541,7 +704,7 @@ impl Document {
         let Object::Stream(s) = &*self.try_get(num)? else { return Err(CosError::MissingObject(num)) };
         let n = s.dict.int(b"N").unwrap_or(0).clamp(0, 1_000_000) as usize;
         let first = s.dict.int(b"First").unwrap_or(0).max(0) as usize;
-        let data = s.decoded()?;
+        let data = s.decoded_within(self.stream_limit)?;
         let mut lx = Lexer::new(&data, 0);
         let mut index = Vec::with_capacity(n);
         for _ in 0..n {
@@ -645,16 +808,27 @@ impl Document {
 
     /// All object numbers known (file and overlay), excluding freed ones.
     pub fn object_numbers(&self) -> Vec<u32> {
-        let mut set: HashSet<u32> = self.entries.iter().filter(|(_, e)| !matches!(e, XrefEntry::Free { .. })).map(|(n, _)| *n).collect();
-        for (n, s) in &self.overlay {
-            match s {
-                Slot::Set(..) => set.insert(*n),
-                Slot::Freed(_) => set.remove(n),
-            };
+        // Both maps are ordered. Overlay slots replace source slots, including frees;
+        // merge them directly without a second set and a sort of every object number.
+        let mut numbers = Vec::with_capacity(self.entries.len().max(self.overlay.len()));
+        let mut source = self.entries.iter().peekable();
+        for (&num, slot) in &self.overlay {
+            while source.peek().is_some_and(|(n, _)| **n < num) {
+                if let Some((&n, entry)) = source.next()
+                    && !matches!(entry, XrefEntry::Free { .. })
+                {
+                    numbers.push(n);
+                }
+            }
+            if source.peek().is_some_and(|(n, _)| **n == num) {
+                source.next();
+            }
+            if matches!(slot, Slot::Set(..)) {
+                numbers.push(num);
+            }
         }
-        let mut v: Vec<u32> = set.into_iter().collect();
-        v.sort_unstable();
-        v
+        numbers.extend(source.filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)));
+        numbers
     }
 
     /// Rebase this document on bytes written by the writer (after a save): edits become part of
@@ -807,7 +981,7 @@ impl Document {
         // One row per object, and a document has at most 8,388,607 indirect objects (the classic
         // implementation limit): decoding more than that (about 200 MB at the widest rows) is a
         // decompression bomb, not cross-reference data. The section is then reconstructed.
-        let raw = s.decoded_within(MAX_XREF_OBJECTS.saturating_mul(row))?;
+        let raw = s.decoded_within(MAX_XREF_OBJECTS.saturating_mul(row).min(self.stream_limit))?;
         let field = |r: &[u8], from: usize, len: usize, default: u64| -> u64 {
             if len == 0 {
                 return default;
@@ -1056,6 +1230,150 @@ mod tests {
         assert!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().get(b"Lang").is_none());
     }
 
+    #[test]
+    fn object_numbers_merge_source_and_overlay_in_order() {
+        let mut doc = Document::new_empty();
+        doc.overlay.clear();
+        doc.entries = Arc::new(BTreeMap::from([
+            (0, XrefEntry::Free { next_generation: 65535 }),
+            (2, XrefEntry::InFile { offset: 10, generation: 7 }),
+            (4, XrefEntry::Free { next_generation: 9 }),
+            (6, XrefEntry::InStream { stream: 80, index: 1 }),
+            (8, XrefEntry::InFile { offset: 20, generation: 5 }),
+            (10, XrefEntry::InFile { offset: 30, generation: 3 }),
+            (u32::MAX, XrefEntry::InFile { offset: 40, generation: 1 }),
+        ]));
+        doc.set(ObjRef::new(1, 2), Object::Int(1)); // before the first live source slot
+        doc.set(ObjRef::new(2, 8), Object::Int(2)); // override, without duplication
+        doc.set(ObjRef::new(4, 9), Object::Int(4)); // reuse a source free slot
+        doc.free(ObjRef::new(6, 0)); // remove a compressed source object
+        doc.free(ObjRef::new(7, 2)); // free a number absent from the source
+        doc.free(ObjRef::new(10, 3));
+        doc.set(ObjRef::new(11, 4), Object::Int(11));
+        assert_eq!(doc.object_numbers(), vec![1, 2, 4, 8, 11, u32::MAX]);
+        assert_eq!(doc.generation(2), 8);
+        assert_eq!(doc.generation(4), 9);
+        assert_eq!(doc.generation(6), 1);
+        assert_eq!(doc.generation(8), 5);
+        assert_eq!(doc.generation(10), 4);
+        doc.overlay.clear();
+        assert_eq!(doc.object_numbers(), vec![2, 6, 8, 10, u32::MAX]);
+        doc.entries = Arc::default();
+        assert!(doc.object_numbers().is_empty());
+        doc.set(ObjRef::new(5, 7), Object::Int(5));
+        assert_eq!(doc.object_numbers(), vec![5]);
+    }
+
+    #[test]
+    fn full_object_scans_preserve_edits_without_retaining_the_scan() {
+        let mut bodies = vec!["<< /Type /Catalog /Pages 2 0 R >>".to_owned(), "<< /Type /Pages /Kids [] /Count 0 >>".to_owned()];
+        bodies.extend((0..400).map(|i| format!("<< /Value {i} >>")));
+        let refs: Vec<_> = bodies.iter().map(String::as_str).collect();
+        let mut doc = Document::open(Arc::new(build(&refs, "/Root 1 0 R"))).unwrap();
+        doc.set(ObjRef::new(3, 0), Object::Int(900));
+        doc.free(ObjRef::new(4, 0));
+        let added = doc.add(Object::Int(901));
+        let cached = doc.cache.lock().unwrap().len();
+        let held: Vec<_> = doc.scan_objects().collect();
+        assert_eq!(held.len(), 402);
+        assert_eq!(doc.cache.lock().unwrap().len(), cached, "scanning must not populate the editor cache");
+        assert!(doc.objstms.lock().unwrap().is_empty());
+        assert!(!held.iter().any(|(r, _)| r.num == 4));
+        assert_eq!(held.iter().find(|(r, _)| r.num == 3).unwrap().1.as_int(), Some(900));
+        assert_eq!(held.iter().find(|(r, _)| *r == added).unwrap().1.as_int(), Some(901));
+        assert_eq!(held.iter().find(|(r, _)| r.num == 400).unwrap().1.as_dict().unwrap().int(b"Value"), Some(397));
+        // Previously returned objects survive cache eviction and dropping the source.
+        drop(doc);
+        assert_eq!(held.iter().find(|(r, _)| r.num == 128).unwrap().1.as_dict().unwrap().int(b"Value"), Some(125));
+    }
+
+    #[test]
+    fn temporary_reader_keeps_file_views_and_evicts_data_of_its_own() {
+        // A stream read from the file is a view into the input: caching it costs no copy, so
+        // even a large one stays cached (its /Length object too) instead of being re-parsed.
+        let body = "x".repeat(ObjectReader::STREAM_BYTES + 1);
+        let stream = format!("<< /Length 4 0 R >>\nstream\n{body}\nendstream");
+        let length = body.len().to_string();
+        let bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", &stream, &length], "/Root 1 0 R");
+        let doc = Document::open(Arc::new(bytes)).unwrap();
+        let mut reader = doc.object_reader();
+        let read = reader.get(ObjRef::new(3, 0));
+        let Object::Stream(s) = &*read else { panic!("stream") };
+        assert!(s.raw.shares(&reader.document.data), "no copy of the file's bytes");
+        assert!(reader.document.cache.lock().unwrap().contains_key(&3), "a view costs nothing to keep");
+        // Data of its own (decrypted streams, strings) counts: past the budget the cache is
+        // cleared after the next read, including a failed one.
+        let owned = Object::Stream(crate::Stream::from_raw(Dict::new(), vec![b'y'; ObjectReader::STREAM_BYTES + 1]));
+        reader.document.cache.lock().unwrap().insert(3, Arc::new(owned));
+        assert_eq!(*reader.get(ObjRef::new(99, 0)), Object::Null);
+        assert!(reader.document.cache.lock().unwrap().is_empty(), "owned data over budget is evicted");
+    }
+
+    #[test]
+    fn temporary_reader_and_full_save_do_not_fill_snapshot_caches() {
+        let mut source = Document::new_empty();
+        let objects: Vec<_> = (0..260)
+            .map(|i| {
+                let mut value = vec![b'x'; 48 * 1024];
+                value[..4].copy_from_slice(&(i as u32).to_le_bytes());
+                Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
+            })
+            .collect();
+        source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
+        let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
+        let doc = Document::open(bytes).unwrap();
+        let root = doc.get(doc.root().unwrap());
+        let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap();
+        let snapshot = doc.clone();
+        let cached = doc.cache.lock().unwrap().len();
+        let streams = doc.objstms.lock().unwrap().len();
+        let mut reader = doc.object_reader();
+        let mut held = None;
+        for (i, reference) in references.iter().enumerate() {
+            let Object::Ref(reference) = reference else { panic!("indirect object") };
+            let object = reader.get(*reference);
+            assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
+            if i == 0 {
+                held = Some(object);
+            }
+            assert!(reader.document.cache.lock().unwrap().len() < ObjectReader::OBJECTS);
+            let decoded = reader.document.objstms.lock().unwrap();
+            assert!(decoded.len() < ObjectReader::OBJECTS);
+            let bytes: usize = decoded.values().map(|s| s.data.capacity() + s.index.capacity() * std::mem::size_of::<(u32, usize)>()).sum();
+            assert!(bytes <= ObjectReader::STREAM_BYTES || decoded.len() == 1, "only one oversized stream may remain");
+        }
+        drop(reader);
+        assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes(), "owned results survive evictions");
+        for object_streams in [false, true] {
+            let saved = crate::write_full(&doc, &crate::SaveOptions { object_streams, ..Default::default() }).unwrap();
+            assert!(Document::open(Arc::new(saved)).unwrap().repair_log().is_empty());
+            assert_eq!(doc.cache.lock().unwrap().len(), cached, "full saves must not fill the editor cache");
+            assert_eq!(doc.objstms.lock().unwrap().len(), streams);
+            assert!(Arc::ptr_eq(&doc.cache, &snapshot.cache), "do not detach or clear caller snapshots");
+        }
+    }
+
+    #[test]
+    fn a_stream_limited_document_cannot_be_saved() {
+        let bytes = Arc::new(crate::write_full(&Document::new_empty(), &crate::SaveOptions::default()).unwrap());
+        let doc = Document::open_with_stream_limit(bytes.clone(), None, 1 << 20).unwrap();
+        for saved in [crate::write_full(&doc, &crate::SaveOptions::default()), crate::write_incremental(&doc, &crate::SaveOptions::default())] {
+            assert!(matches!(saved, Err(CosError::ReadOnlyLimit)), "{saved:?}");
+        }
+        let doc = Document::open(bytes).unwrap();
+        assert!(crate::write_full(&doc, &crate::SaveOptions::default()).is_ok());
+    }
+
+    #[test]
+    fn inspection_stream_limit_applies_before_loading_compressed_objects() {
+        let mut doc = Document::new_empty();
+        let large = doc.add(Object::String(crate::PdfString::literal(vec![b'x'; 4096])));
+        doc.update_dict(doc.root().unwrap(), |catalog| catalog.set(b"Extension".to_vec(), Object::Ref(large))).unwrap();
+        let bytes = Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap());
+        assert!(Document::open(bytes.clone()).is_ok());
+        assert!(Document::open_with_stream_limit(bytes, None, 512).is_err());
+    }
+
     /// A /Prev chain that loops back on itself stops at the loop (and says so).
     #[test]
     fn looping_revision_chains_stop() {
diff --git a/crates/cos/src/lib.rs b/crates/cos/src/lib.rs
index e7b6406c..2a534eca 100644
--- a/crates/cos/src/lib.rs
+++ b/crates/cos/src/lib.rs
@@ -20,7 +20,7 @@ mod security;
 mod writer;
 
 pub use bytes::Bytes;
-pub use document::{Document, Revision, XrefEntry};
+pub use document::{Document, Revision, SourceIdentity, XrefEntry};
 pub use object::{Dict, MAX_DECODED, Name, ObjRef, Object, PdfString, Stream};
 pub use parser::{Lexer, parse_indirect};
 pub use pdfcraft_crypt::{Algorithm, Auth, Method as CryptMethod, NewEncryption, Permissions, SecurityHandler};
@@ -46,4 +46,6 @@ pub enum CosError {
     Security(String),
     #[error("internal lock poisoned")]
     Poisoned,
+    #[error("this document was opened read-only with a decode limit and cannot be saved")]
+    ReadOnlyLimit,
 }
diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index 418891b3..c8e2e004 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -4,13 +4,14 @@
 //!   as the file's last one (table or stream) and a trailer with `/Prev`. The original bytes are
 //!   never modified, which keeps digital signatures over earlier revisions valid.
 //! * `write_full` writes only objects reachable from the trailer, renumbered densely, with a
-//!   classic cross-reference table — the "Save As" / garbage-collecting path.
+//!   cross-reference table or stream — the "Save As" / garbage-collecting path.
 
+use std::borrow::Cow;
 use std::collections::{BTreeMap, HashMap, VecDeque};
 use std::io::Write;
 
 use crate::CosError;
-use crate::document::Document;
+use crate::document::{Document, ObjectReader};
 use crate::object::{Dict, ObjRef, Object, PdfString, Stream};
 
 /// Serialize one object. Deterministic: same object → same bytes.
@@ -122,10 +123,10 @@ fn write_stream(s: &Stream, out: &mut Vec<u8>) {
 
 /// The object as written: encrypted with its (output) number when the document is encrypted,
 /// except the `/Encrypt` dictionary itself (`source_num` is its number in the source document).
-fn prepared(doc: &Document, source_num: u32, num: u32, generation: u16, o: &Object) -> Object {
+fn prepared<'a>(doc: &Document, source_num: u32, num: u32, generation: u16, o: &'a Object) -> Cow<'a, Object> {
     match doc.output_security() {
-        (Some(h), encrypt_num) if Some(source_num) != encrypt_num => crate::security::transform(h, o, num, generation, false),
-        _ => o.clone(),
+        (Some(h), encrypt_num) if Some(source_num) != encrypt_num => Cow::Owned(crate::security::transform(h, o, num, generation, false)),
+        _ => Cow::Borrowed(o),
     }
 }
 
@@ -155,6 +156,9 @@ impl Default for SaveOptions {
 
 /// Objects per object stream (Acrobat and qpdf use 100–200).
 const OBJSTM_SIZE: usize = 100;
+/// Keep a batch's serialized body small as well as limiting its object count. One object
+/// may exceed this target; it is emitted in its own object stream without retaining a batch.
+const OBJSTM_BYTES: usize = 8 * 1024 * 1024;
 
 /// Where an object lives, for the cross-reference section.
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -173,6 +177,9 @@ enum Row {
 /// incrementally — other readers would follow the broken chain — so it is rewritten in full,
 /// which also repairs the file (what users expect after "the file was damaged and repaired").
 pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosError> {
+    if doc.stream_limited() {
+        return Err(CosError::ReadOnlyLimit);
+    }
     // Reconstructed files have no chain to append to; added or removed encryption must
     // rewrite every object; redaction must not leave the old revision behind. All need a full save.
     if doc.revisions().is_empty() || doc.encryption_changed() || doc.full_save_required() {
@@ -188,7 +195,7 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     let base = (original.len() + usize::from(newline)) as u64;
     let mut out = Vec::new();
     let mut offsets: BTreeMap<u32, (u64, u16, bool)> = BTreeMap::new(); // num → (offset, gen, in use)
-    for (num, generation, obj) in doc.overlay_entries().collect::<Vec<_>>() {
+    for (num, generation, obj) in doc.overlay_entries() {
         match obj {
             Some(o) => {
                 offsets.insert(num, (base + out.len() as u64, generation, true));
@@ -229,14 +236,20 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     Ok(file)
 }
 
-/// Write only reachable objects, renumbered from 1, with a classic cross-reference table.
+/// Write only reachable objects, renumbered from 1, with a table or cross-reference stream.
 pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosError> {
-    let mut doc = doc.clone();
-    stamp_mod_date(&mut doc, opts);
-    let trailer_in = doc.trailer().clone();
+    if doc.stream_limited() {
+        return Err(CosError::ReadOnlyLimit);
+    }
+    // A full traversal must not fill the editor's shared caches (which undo snapshots also
+    // own). Parsed objects and decoded object streams are temporary working data here.
+    let mut reader = doc.object_reader();
+    stamp_mod_date(&mut reader.document, opts);
+    let trailer_in = reader.document.trailer().clone();
     // Breadth-first walk from the trailer, assigning new numbers in visit order.
     let mut map: HashMap<ObjRef, u32> = HashMap::new();
-    let mut order: Vec<ObjRef> = Vec::new();
+    // Record the type while traversing so classifying packed objects needs no second parse.
+    let mut order: Vec<(ObjRef, bool)> = Vec::new();
     let mut queue: VecDeque<ObjRef> = VecDeque::new();
     let visit_refs = |o: &Object, queue: &mut VecDeque<ObjRef>| collect_refs(o, &mut |r| queue.push_back(r));
     for key in [&b"Root"[..], b"Info", b"Encrypt"] {
@@ -248,15 +261,15 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
         if map.contains_key(&r) {
             continue;
         }
-        let o = doc.get(r);
+        let o = reader.get(r);
         if matches!(*o, Object::Null) {
             continue; // dangling reference: written as null by renumbering below
         }
-        map.insert(r, (order.len() + 1) as u32);
-        order.push(r);
+        map.insert(r, output_number(order.len())?);
+        order.push((r, matches!(*o, Object::Stream(_))));
         visit_refs(&o, &mut queue);
     }
-    let version = doc.version().chars().take(3).collect::<String>();
+    let version = reader.document.version().chars().take(3).collect::<String>();
     let version = if opts.object_streams && version.as_str() < "1.5" { "1.5".to_string() } else { version };
     let mut out = Vec::new();
     let _ = writeln!(out, "%PDF-{version}");
@@ -268,46 +281,45 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
     let mut pending: Vec<ObjRef> = trailer_in.reference(b"Encrypt").into_iter().collect();
     while let Some(r) = pending.pop() {
         if encryption_objects.insert(r) {
-            collect_refs(&doc.get(r), &mut |x| pending.push(x));
+            collect_refs(&reader.get(r), &mut |x| pending.push(x));
         }
     }
     let mut rows: BTreeMap<u32, Row> = BTreeMap::new();
-    let mut packed: Vec<(u32, Object)> = Vec::new(); // objects bound for object streams
-    for (i, r) in order.iter().enumerate() {
-        let num = (i + 1) as u32;
-        let o = renumber(&doc.get(*r), &map);
-        let in_stream = opts.object_streams && !matches!(o, Object::Stream(_)) && !encryption_objects.contains(r);
+    // Keep only references, not renamed copies of the entire object graph. Standalone
+    // objects still precede object streams, preserving the established output order.
+    let mut packed: Vec<(u32, ObjRef)> = Vec::new();
+    for (i, (r, is_stream)) in order.iter().enumerate() {
+        let num = output_number(i)?;
+        let in_stream = opts.object_streams && !is_stream && !encryption_objects.contains(r);
         if in_stream {
-            packed.push((num, o));
+            packed.push((num, *r));
         } else {
+            let o = renumber(&*reread(&mut reader, *r, *is_stream)?, &map);
             rows.insert(num, Row::InFile(out.len() as u64, 0));
-            write_indirect(num, 0, &prepared(&doc, r.num, num, 0, &o), &mut out);
+            write_indirect(num, 0, &prepared(&reader.document, r.num, num, 0, &o), &mut out);
         }
     }
     // Object streams take the numbers after the last object. Their contents are not encrypted
     // individually: the whole stream is (§7.5.7, §7.6.2).
-    let mut next = order.len() as u32 + 1;
-    for chunk in packed.chunks(OBJSTM_SIZE) {
-        let stm_num = next;
-        next += 1;
-        let mut header = Vec::new();
-        let mut body = Vec::new();
-        for (index, (num, o)) in chunk.iter().enumerate() {
-            let _ = write!(header, "{} {} ", num, body.len());
-            serialize(o, &mut body);
-            body.push(b'\n');
-            rows.insert(*num, Row::InStream(stm_num, index as u32));
+    let mut next = output_number(order.len())?;
+    let mut batch = ObjectStreamBatch::default();
+    for (num, reference) in packed {
+        let mut encoded = Vec::new();
+        serialize(&renumber(&*reread(&mut reader, reference, false)?, &map), &mut encoded);
+        if batch.count > 0 && batch.body.len().saturating_add(encoded.len()).saturating_add(1) > OBJSTM_BYTES {
+            batch.flush(&reader.document, &mut next, &mut rows, &mut out)?;
+        }
+        let _ = write!(batch.header, "{} {} ", num, batch.body.len());
+        batch.body.extend_from_slice(&encoded);
+        batch.body.push(b'\n');
+        drop(encoded);
+        rows.insert(num, Row::InStream(next, batch.count as u32));
+        batch.count += 1;
+        if batch.count == OBJSTM_SIZE || batch.body.len() >= OBJSTM_BYTES {
+            batch.flush(&reader.document, &mut next, &mut rows, &mut out)?;
         }
-        let first = header.len();
-        header.extend_from_slice(&body);
-        let mut d = Dict::new();
-        d.set(b"Type".to_vec(), Object::name("ObjStm"));
-        d.set(b"N".to_vec(), Object::Int(chunk.len() as i64));
-        d.set(b"First".to_vec(), Object::Int(first as i64));
-        let stm = Object::Stream(Stream::flate(d, &header));
-        rows.insert(stm_num, Row::InFile(out.len() as u64, 0));
-        write_indirect(stm_num, 0, &prepared(&doc, u32::MAX, stm_num, 0, &stm), &mut out);
     }
+    batch.flush(&reader.document, &mut next, &mut rows, &mut out)?;
     let mut trailer = Dict::new();
     for key in [&b"Root"[..], b"Info", b"Encrypt"] {
         if let Some(r) = trailer_in.reference(key).and_then(|r| map.get(&r)) {
@@ -320,8 +332,8 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
     if let Some(id) = trailer_in.get(b"ID") {
         trailer.set(b"ID".to_vec(), id.clone());
     }
-    if doc.output_security().0.is_none() {
-        ensure_id(&mut trailer, opts, doc.bytes());
+    if reader.document.output_security().0.is_none() {
+        ensure_id(&mut trailer, opts, reader.document.bytes());
     }
     if opts.object_streams {
         write_xref_stream(&mut out, 0, &mut trailer, rows, next);
@@ -341,6 +353,52 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
     Ok(out)
 }
 
+/// Object `r` read again for writing. The traversal read it once and only kept its number, so
+/// a second read that fails, finds nothing or finds a different kind of object must fail the
+/// save rather than write `null` in its place.
+fn reread(reader: &mut ObjectReader, r: ObjRef, is_stream: bool) -> Result<std::sync::Arc<Object>, CosError> {
+    let o = reader.try_get(r)?;
+    if matches!(*o, Object::Null) || matches!(*o, Object::Stream(_)) != is_stream {
+        return Err(CosError::Syntax { offset: 0, detail: format!("object {} read differently while saving; nothing was written", r.num) });
+    }
+    Ok(o)
+}
+
+#[derive(Default)]
+struct ObjectStreamBatch {
+    header: Vec<u8>,
+    body: Vec<u8>,
+    count: usize,
+}
+
+impl ObjectStreamBatch {
+    fn flush(&mut self, doc: &Document, next: &mut u32, rows: &mut BTreeMap<u32, Row>, out: &mut Vec<u8>) -> Result<(), CosError> {
+        if self.count == 0 {
+            return Ok(());
+        }
+        let following = next.checked_add(1).ok_or_else(|| CosError::Syntax { offset: 0, detail: "too many objects to save".into() })?;
+        // Release capacity after each batch too: an unusually large object must not leave
+        // a large scratch buffer alive for the rest of the save.
+        let Self { mut header, body, count } = std::mem::take(self);
+        let first = header.len();
+        header.extend_from_slice(&body);
+        drop(body);
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("ObjStm"));
+        d.set(b"N".to_vec(), Object::Int(count as i64));
+        d.set(b"First".to_vec(), Object::Int(first as i64));
+        let stm = Object::Stream(Stream::flate(d, &header));
+        rows.insert(*next, Row::InFile(out.len() as u64, 0));
+        write_indirect(*next, 0, &prepared(doc, u32::MAX, *next, 0, &stm), out);
+        *next = following;
+        Ok(())
+    }
+}
+
+fn output_number(index: usize) -> Result<u32, CosError> {
+    u32::try_from(index).ok().and_then(|n| n.checked_add(1)).ok_or_else(|| CosError::Syntax { offset: 0, detail: "too many objects to save".into() })
+}
+
 fn collect_refs(o: &Object, f: &mut impl FnMut(ObjRef)) {
     match o {
         Object::Ref(r) => f(*r),
@@ -401,27 +459,33 @@ fn write_xref_stream(out: &mut Vec<u8>, base: u64, trailer: &mut Dict, mut rows:
     let (w2, w3) = rows.values().map(fields).fold((1, 1), |(a, b), (_, x, y)| (width(x).max(a), width(y).max(b)));
     let cols = 1 + w2 + w3;
     let mut index = Vec::new();
-    let nums: Vec<u32> = rows.keys().copied().collect();
-    let mut i = 0;
-    while i < nums.len() {
-        let mut j = i;
-        while j + 1 < nums.len() && nums[j + 1] == nums[j] + 1 {
-            j += 1;
+    let mut numbers = rows.keys().copied().peekable();
+    while let Some(start) = numbers.next() {
+        let mut last = start;
+        let mut count = 1i64;
+        while numbers.peek().copied().is_some_and(|next| last.checked_add(1) == Some(next)) {
+            if let Some(next) = numbers.next() {
+                last = next;
+                count += 1;
+            }
         }
-        index.push(Object::Int(nums[i] as i64));
-        index.push(Object::Int((j - i + 1) as i64));
-        i = j + 1;
+        index.push(Object::Int(i64::from(start)));
+        index.push(Object::Int(count));
     }
-    let mut data = Vec::with_capacity(rows.len() * (cols + 1));
-    let mut prev = vec![0u8; cols];
+    let mut data = Vec::with_capacity(rows.len().saturating_mul(cols + 1));
+    // Type is one byte, and each remaining field is at most one u64. Reuse the
+    // predictor row on the stack instead of allocating a Vec for every xref entry.
+    let mut prev = [0u8; 17];
     for r in rows.values() {
         let (t, a, b) = fields(r);
-        let mut row = vec![t as u8];
-        row.extend_from_slice(&a.to_be_bytes()[8 - w2..]);
-        row.extend_from_slice(&b.to_be_bytes()[8 - w3..]);
+        let a = a.to_be_bytes();
+        let b = b.to_be_bytes();
+        let fields = std::iter::once(t as u8).chain(a.into_iter().skip(8 - w2)).chain(b.into_iter().skip(8 - w3));
         data.push(2); // PNG "Up"
-        data.extend(row.iter().zip(&prev).map(|(c, p)| c.wrapping_sub(*p)));
-        prev = row;
+        for (value, previous) in fields.zip(&mut prev) {
+            data.push(value.wrapping_sub(*previous));
+            *previous = value;
+        }
     }
     let mut d = trailer.clone();
     d.set(b"Type".to_vec(), Object::name("XRef"));
@@ -503,6 +567,55 @@ mod tests {
         Lexer::new(&out, 0).object().expect("parses")
     }
 
+    #[test]
+    fn a_second_read_that_differs_fails_the_save_instead_of_writing_null() {
+        let mut doc = Document::new_empty();
+        let dict = doc.add(Object::Dict(Dict::new()));
+        let mut reader = doc.object_reader();
+        assert!(reread(&mut reader, dict, false).is_ok());
+        assert!(reread(&mut reader, dict, true).is_err(), "a dictionary where a stream was traversed");
+        assert!(reread(&mut reader, ObjRef::new(9999, 0), false).is_err(), "nothing where an object was traversed");
+    }
+
+    #[test]
+    fn xref_predictor_rows_preserve_variable_width_fields_and_sparse_runs() {
+        for offset in [0, 255, 256, 65535, 65536, u32::MAX as u64, u32::MAX as u64 + 1, u64::MAX] {
+            for index in [0, 255, 256, u32::MAX] {
+                for incremental in [false, true] {
+                    let mut trailer = Dict::new();
+                    if incremental {
+                        trailer.set(b"Prev".to_vec(), Object::Int(17));
+                    }
+                    let rows = BTreeMap::from([(1, Row::InFile(offset, 32768)), (2, Row::Free(65535)), (4, Row::InStream(65536, index))]);
+                    let mut bytes = Vec::new();
+                    write_xref_stream(&mut bytes, 0, &mut trailer, rows, 5);
+                    let (_, object) = crate::parser::parse_indirect(&bytes, 0, &|_| None).unwrap();
+                    let Object::Stream(stream) = object else { panic!("xref stream") };
+                    let widths: Vec<_> = stream.dict.get(b"W").unwrap().as_array().unwrap().iter().map(|o| o.as_int().unwrap() as usize).collect();
+                    assert_eq!(widths[0], 1);
+                    assert!((3..=8).contains(&widths[1]));
+                    assert!((2..=4).contains(&widths[2]));
+                    let runs: Vec<_> = stream.dict.get(b"Index").unwrap().as_array().unwrap().iter().map(|o| o.as_int().unwrap()).collect();
+                    assert_eq!(runs, if incremental { vec![1, 2, 4, 2] } else { vec![0, 3, 4, 2] });
+                    let mut expected = vec![(1, offset, 32768), (0, 0, 65535), (2, 65536, u64::from(index)), (1, 0, 0)];
+                    if !incremental {
+                        expected.insert(0, (0, 0, 65535));
+                    }
+                    let decoded = stream.decoded().unwrap();
+                    let columns: usize = widths.iter().sum();
+                    assert_eq!(decoded.len(), columns * expected.len());
+                    for (row, (kind, first, second)) in decoded.chunks_exact(columns).zip(expected) {
+                        let values: Vec<_> = [0..1, 1..1 + widths[1], 1 + widths[1]..columns]
+                            .into_iter()
+                            .map(|range| row[range].iter().fold(0u64, |value, byte| value * 256 + u64::from(*byte)))
+                            .collect();
+                        assert_eq!(values, vec![kind, first, second]);
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn reals_keep_full_precision_without_exponents() {
         for r in [0.1, -0.000_000_123_456_789, 1e-12, 123_456.789_012_345, 1.0 / 3.0, -2.5e7 + 0.25] {
diff --git a/crates/cos/tests/bounded_writer.rs b/crates/cos/tests/bounded_writer.rs
new file mode 100644
index 00000000..0c8bfc77
--- /dev/null
+++ b/crates/cos/tests/bounded_writer.rs
@@ -0,0 +1,236 @@
+//! Full rewrites must preserve the graph when temporary parse/packing caches are evicted.
+//! Fixtures are generated here; no third-party PDF assets are used.
+
+use std::collections::{BTreeMap, HashSet};
+use std::sync::Arc;
+
+use pdfcraft_cos::{Algorithm, Dict, Document, NewEncryption, ObjRef, Object, PdfString, SaveOptions, XrefEntry, write_full};
+
+const NODES: usize = 260;
+const EDITED: usize = 129;
+
+fn node(i: usize) -> ObjRef {
+    ObjRef::new(301 + i as u32, (i % 5 + 1) as u16)
+}
+
+fn stream_body(i: usize) -> Vec<u8> {
+    format!("opaque stream {i}: preserve these bytes\n").into_bytes()
+}
+
+/// Nonzero generations, sparse numbers, shared references, a cycle and interleaved streams.
+/// A raw classic xref avoids depending on the writer under test to construct the input.
+fn fixture() -> Vec<u8> {
+    let mut objects = vec![
+        (ObjRef::new(10, 2), format!("<< /Type /Catalog /Pages 20 0 R /Extension {} /Shared 42 3 R /Freed 43 8 R /Missing 9000 0 R >>", node(0))),
+        (ObjRef::new(20, 0), "<< /Type /Pages /Kids [] /Count 0 >>".into()),
+        (ObjRef::new(42, 3), "<< /Token (shared extension value) >>".into()),
+        (ObjRef::new(43, 8), "<< /Token (deleted extension value) >>".into()),
+        (ObjRef::new(70, 4), "<< /Title (original title) >>".into()),
+    ];
+    for i in 0..NODES {
+        let fields = format!("/Value {i} /Next {} /Shared 42 3 R /Opaque << /Nested [42 3 R (retained data)] >>", node((i + 1) % NODES));
+        let body = if i % 19 == 0 {
+            let raw = stream_body(i);
+            format!("<< {fields} /Length {} >>\nstream\n{}endstream", raw.len(), String::from_utf8(raw).unwrap())
+        } else {
+            format!("<< {fields} >>")
+        };
+        objects.push((node(i), body));
+    }
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = BTreeMap::new();
+    for (reference, body) in objects {
+        offsets.insert(reference.num, (bytes.len(), reference.generation));
+        bytes.extend_from_slice(format!("{} {} obj\n{body}\nendobj\n", reference.num, reference.generation).as_bytes());
+    }
+    let size = offsets.last_key_value().unwrap().0 + 1;
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {size}\n").as_bytes());
+    for n in 0..size {
+        match offsets.get(&n) {
+            Some((offset, generation)) => bytes.extend_from_slice(format!("{offset:010} {generation:05} n \n").as_bytes()),
+            None => bytes.extend_from_slice(b"0000000000 65535 f \n"),
+        }
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {size} /Root 10 2 R /Info 70 4 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    bytes
+}
+
+fn edited_document() -> Document {
+    let mut doc = Document::open(Arc::new(fixture())).unwrap();
+    assert!(doc.repair_log().is_empty());
+    assert_eq!(doc.root(), Some(ObjRef::new(10, 2)));
+    assert_eq!(doc.generation(node(EDITED).num), node(EDITED).generation);
+    doc.update_dict(node(EDITED), |d| d.set(b"Value".to_vec(), Object::Int(8129))).unwrap();
+    doc.free(ObjRef::new(43, 8));
+    let added = doc.add(Object::String(PdfString::text("added extension value")));
+    doc.update_dict(doc.root().unwrap(), |d| d.set(b"Added".to_vec(), Object::Ref(added))).unwrap();
+    doc
+}
+
+fn check_graph(doc: &Document) {
+    assert!(doc.repair_log().is_empty(), "{:?}", doc.repair_log());
+    let catalog = doc.get(doc.root().unwrap());
+    let catalog = catalog.as_dict().unwrap();
+    let shared = catalog.reference(b"Shared").unwrap();
+    let shared_object = doc.get(shared);
+    assert_eq!(shared_object.as_dict().unwrap().get(b"Token").unwrap().as_string().unwrap().to_text(), "shared extension value");
+    assert_eq!(catalog.get(b"Freed"), Some(&Object::Null));
+    assert_eq!(catalog.get(b"Missing"), Some(&Object::Null));
+    assert_eq!(doc.resolve(catalog.get(b"Added").unwrap()).as_string().unwrap().to_text(), "added extension value");
+    let first = catalog.reference(b"Extension").unwrap();
+    let mut current = first;
+    let mut visited = HashSet::new();
+    for i in 0..NODES {
+        assert!(visited.insert(current), "cycle closed before node {i}");
+        let object = doc.get(current);
+        let dict = object.as_dict().unwrap();
+        assert_eq!(dict.int(b"Value"), Some(if i == EDITED { 8129 } else { i as i64 }));
+        assert_eq!(dict.reference(b"Shared"), Some(shared));
+        let opaque = dict.get(b"Opaque").unwrap().as_dict().unwrap().get(b"Nested").unwrap().as_array().unwrap();
+        assert_eq!(opaque.first(), Some(&Object::Ref(shared)));
+        assert_eq!(opaque.get(1).unwrap().as_string().unwrap().to_text(), "retained data");
+        if i % 19 == 0 {
+            let Object::Stream(stream) = object.as_ref() else { panic!("node {i} lost its stream") };
+            assert_eq!(stream.decoded().unwrap(), stream_body(i));
+        } else {
+            assert!(matches!(object.as_ref(), Object::Dict(_)));
+        }
+        current = dict.reference(b"Next").unwrap();
+    }
+    assert_eq!(current, first, "the extension cycle is preserved");
+    assert!(doc.object_numbers().into_iter().all(|n| doc.generation(n) == 0));
+}
+
+#[test]
+fn full_rewrites_preserve_graph_across_multiple_object_streams_and_evictions() {
+    for object_streams in [false, true] {
+        let doc = edited_document();
+        let opts = SaveOptions { object_streams, mod_date: Some("D:20261008000000Z".into()), ..SaveOptions::default() };
+        let saved = write_full(&doc, &opts).unwrap();
+        assert_eq!(saved, write_full(&doc, &opts).unwrap(), "unchanged inputs produce identical bytes");
+        let back = Document::open(Arc::new(saved)).unwrap();
+        check_graph(&back);
+        let info = back.resolve(back.trailer().get(b"Info").unwrap());
+        let info = info.as_dict().unwrap();
+        assert_eq!(info.get(b"Title").unwrap().as_string().unwrap().to_text(), "original title");
+        assert_eq!(info.get(b"ModDate").unwrap().as_string().unwrap().to_text(), "D:20261008000000Z");
+        let containers: HashSet<_> = back
+            .object_numbers()
+            .into_iter()
+            .filter_map(|num| match back.xref_entry(num) {
+                Some(XrefEntry::InStream { stream, .. }) => Some(stream),
+                _ => None,
+            })
+            .collect();
+        if object_streams {
+            assert!(containers.len() >= 3, "fixture must span multiple packed-object chunks");
+        } else {
+            assert!(containers.is_empty());
+        }
+        // Read an already packed input as well: eviction must not lose decoded ObjStm data.
+        check_graph(&Document::open(Arc::new(write_full(&back, &opts).unwrap())).unwrap());
+        // Writing must not apply the date stamp or consume the caller's edits.
+        let original_info = doc.resolve(doc.trailer().get(b"Info").unwrap());
+        assert!(!original_info.as_dict().unwrap().contains(b"ModDate"));
+        assert!(doc.is_modified());
+        assert_eq!(doc.get(node(EDITED)).as_dict().unwrap().int(b"Value"), Some(8129));
+    }
+}
+
+fn protect(doc: &mut Document, algorithm: Algorithm) {
+    doc.set_encryption(&NewEncryption {
+        algorithm,
+        user_password: "user",
+        owner_password: "owner",
+        permissions: -4,
+        encrypt_metadata: true,
+        seed: [23; 32],
+    })
+    .unwrap();
+}
+
+#[test]
+fn encrypted_full_rewrites_preserve_data_across_evictions() {
+    for algorithm in [Algorithm::Rc4_40, Algorithm::Rc4_128, Algorithm::Aes128, Algorithm::Aes256] {
+        let mut doc = edited_document();
+        protect(&mut doc, algorithm);
+        let encrypted = Arc::new(write_full(&doc, &SaveOptions::default()).unwrap());
+        let cold = Document::open_with_password(encrypted, Some("user")).unwrap();
+        // The second rewrite must decrypt lazily from the input, then encrypt the new streams.
+        let rewritten = Arc::new(write_full(&cold, &SaveOptions::default()).unwrap());
+        assert!(Document::open_with_password(rewritten.clone(), Some("wrong")).is_err());
+        let back = Document::open_with_password(rewritten, Some("owner")).unwrap();
+        assert!(back.security().is_some());
+        check_graph(&back);
+    }
+}
+
+#[test]
+fn encryption_dependencies_stay_outside_object_streams_across_evictions() {
+    let mut doc = edited_document();
+    protect(&mut doc, Algorithm::Aes256);
+    let encrypt = doc.trailer().reference(b"Encrypt").unwrap();
+    let filters = doc.get(encrypt).as_dict().unwrap().get(b"CF").cloned().unwrap();
+    let filters = doc.add(filters);
+    let mut next = filters;
+    for i in (0..140).rev() {
+        let mut dict = Dict::new();
+        dict.set(b"Value".to_vec(), Object::Int(i));
+        dict.set(b"Next".to_vec(), Object::Ref(next));
+        next = doc.add(dict);
+    }
+    doc.update_dict(encrypt, |dict| {
+        dict.set(b"CF".to_vec(), Object::Ref(filters));
+        dict.set(b"PrivateChain".to_vec(), Object::Ref(next));
+    })
+    .unwrap();
+    let saved = Arc::new(write_full(&doc, &SaveOptions::default()).unwrap());
+    let cold = Document::open_with_password(saved, Some("user")).unwrap();
+    let rewritten = Arc::new(write_full(&cold, &SaveOptions::default()).unwrap());
+    let back = Document::open_with_password(rewritten, Some("user")).unwrap();
+    check_graph(&back);
+    let encrypt = back.trailer().reference(b"Encrypt").unwrap();
+    assert!(matches!(back.xref_entry(encrypt.num), Some(XrefEntry::InFile { .. })));
+    let encrypt = back.get(encrypt);
+    let encrypt = encrypt.as_dict().unwrap();
+    let filters = encrypt.reference(b"CF").unwrap();
+    assert!(matches!(back.xref_entry(filters.num), Some(XrefEntry::InFile { .. })));
+    let mut current = encrypt.reference(b"PrivateChain").unwrap();
+    for i in 0..140 {
+        assert!(matches!(back.xref_entry(current.num), Some(XrefEntry::InFile { .. })));
+        let object = back.get(current);
+        let dict = object.as_dict().unwrap();
+        assert_eq!(dict.int(b"Value"), Some(i));
+        current = dict.reference(b"Next").unwrap();
+    }
+    assert_eq!(current, filters);
+}
+
+#[test]
+fn large_packed_strings_round_trip_across_byte_limited_batches() {
+    let mut doc = Document::new_empty();
+    let mut references = Vec::new();
+    // More than 8 MiB in fewer than 100 objects: a byte cap may flush before the count cap.
+    for i in 0..70u8 {
+        let mut bytes = vec![b'a' + i % 26; 192 * 1024];
+        bytes[0] = i;
+        references.push(Object::Ref(doc.add(Object::String(PdfString::literal(bytes)))));
+    }
+    doc.update_dict(doc.root().unwrap(), |dict| dict.set(b"Extension".to_vec(), Object::Array(references))).unwrap();
+    let source = Arc::new(write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap());
+    drop(doc);
+    let cold = Document::open(source).unwrap();
+    let back = Document::open(Arc::new(write_full(&cold, &SaveOptions::default()).unwrap())).unwrap();
+    assert!(back.repair_log().is_empty());
+    let catalog = back.get(back.root().unwrap());
+    let values = catalog.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap();
+    assert_eq!(values.len(), 70);
+    for (i, reference) in values.iter().enumerate() {
+        let value = back.resolve(reference);
+        let bytes = &value.as_string().unwrap().bytes;
+        assert_eq!(bytes.len(), 192 * 1024);
+        assert_eq!(bytes[0], i as u8);
+        assert!(bytes[1..].iter().all(|&b| b == b'a' + i as u8 % 26));
+    }
+}
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 1fc315fa..fa744a8a 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -1,8 +1,9 @@
 //! Document inspection: everything panels need that is not pixels.
 //!
 //! Page geometry comes from hayro (which resolves inheritance and rotation); the rest comes from
-//! lopdf (bootstrap, replaced by `pdfcraft-model` in M2). Inspection is *tolerant*: when lopdf
-//! cannot load a file that hayro can render, panels are simply empty and `warnings` says why.
+//! the lazy COS reader through a read-only lopdf object adapter. The original lopdf loader
+//! remains the compatibility fallback. When neither can inspect a renderable file, panels
+//! are empty and `warnings` says why.
 
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::Arc;
@@ -16,6 +17,7 @@ use lopdf::{Dictionary, Document, LoadOptions, Object, ObjectId};
 use pdfcraft_cos::page_labels::{MAX_LABEL_BYTES, MAX_LABEL_TOTAL_BYTES, MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_WORK, MAX_PREFIX_BYTES, alpha, roman};
 
 use crate::OpenError;
+use crate::structure::{LazyStructure, Structure};
 
 /// lopdf decodes object and cross-reference streams while it loads, with no limit unless one is
 /// set: a few hundred bytes of nested FlateDecode then inflate to gigabytes. Real object and
@@ -372,7 +374,28 @@ pub fn inspect(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Result<DocInfo, O
         Err(p) => return Err(OpenError::Invalid(format!("the page tree could not be read: {}", crate::raster::panic_message(&p)))),
     }
     let options = load_options(password);
+    // Geometry no longer needs the renderer parser. Do not overlap its allocations with
+    // structural inspection, including the compatibility fallback for damaged files.
+    drop(pdf);
     inspect_structure(&mut info, |tmp| {
+        // The lazy reader first; lopdf's repair/tolerance path when it can't expose the same
+        // page tree or an object a panel needs. No partial result is published.
+        let lazy = catch_unwind(AssertUnwindSafe(|| {
+            let doc = LazyStructure::new(bytes.clone(), password).ok()?;
+            let mut t = DocInfo { pages: tmp.pages.clone(), ..Default::default() };
+            let inspector = Inspector::new(&doc);
+            if inspector.page_index.len() != t.pages.len() {
+                return None;
+            }
+            inspector.fill(&mut t);
+            (!doc.failed()).then_some(t)
+        }))
+        .ok()
+        .flatten();
+        if let Some(t) = lazy {
+            *tmp = t;
+            return Ok(());
+        }
         let doc = Document::load_mem_with_options(&bytes, options).map_err(|e| e.to_string())?;
         Inspector::new(&doc).fill(tmp);
         Ok(())
@@ -404,7 +427,7 @@ fn inspect_structure(info: &mut DocInfo, fill: impl FnOnce(&mut DocInfo) -> Resu
 }
 
 struct Inspector<'a> {
-    doc: &'a Document,
+    doc: &'a dyn Structure,
     page_index: HashMap<ObjectId, usize>,
     /// Named destinations (`/Names /Dests` tree), keyed by raw string bytes, built once.
     /// Looking each name up by walking the tree was O(links × names): minutes on manuals.
@@ -412,7 +435,7 @@ struct Inspector<'a> {
 }
 
 impl<'a> Inspector<'a> {
-    fn new(doc: &'a Document) -> Self {
+    fn new(doc: &'a dyn Structure) -> Self {
         let page_index = doc.get_pages().into_iter().map(|(n, id)| (id, n as usize - 1)).collect();
         let mut me = Self { doc, page_index, named: HashMap::new() };
         let mut named = HashMap::new();
@@ -427,8 +450,8 @@ impl<'a> Inspector<'a> {
 
     fn fill(&self, info: &mut DocInfo) {
         // lopdf drops /Encrypt from the trailer once it has decrypted the file.
-        info.encrypted = self.doc.is_encrypted() || self.doc.was_encrypted() || self.doc.trailer.get(b"Encrypt").is_ok();
-        if let Some(d) = self.doc.trailer.get(b"Info").ok().and_then(|o| self.dict(o)) {
+        info.encrypted = self.doc.encrypted();
+        if let Some(d) = self.doc.trailer().get(b"Info").ok().and_then(|o| self.dict(o)) {
             info.title = self.text(d, b"Title");
             info.author = self.text(d, b"Author");
             info.subject = self.text(d, b"Subject");
@@ -1493,6 +1516,36 @@ trailer << /Root 1 0 R >>
         assert_eq!(info.layer_groups, [vec![(5, 0), (6, 0)], vec![(6, 0), (7, 0)]]);
     }
 
+    #[test]
+    fn lazy_structure_matches_the_compatibility_inspector() {
+        // Each fixture as lopdf writes it, and with its objects in object streams.
+        let packed = |bytes: &[u8]| {
+            let doc = pdfcraft_cos::Document::open(Arc::new(bytes.to_vec())).unwrap();
+            pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions { object_streams: true, ..Default::default() }).unwrap()
+        };
+        let fixtures = [ATTACHMENTS, LAYERS, DESTS].into_iter().flat_map(|bytes| {
+            let mut original = Document::load_mem(bytes).unwrap();
+            let mut plain = Vec::new();
+            original.save_to(&mut plain).unwrap();
+            let stm = packed(&plain);
+            [plain, stm]
+        });
+        for bytes in fixtures {
+            let lazy = LazyStructure::new(Arc::new(bytes.clone()), None).unwrap();
+            let eager = Document::load_mem(&bytes).unwrap();
+            let mut a = inspect(Arc::new(bytes), None).unwrap();
+            let mut b = DocInfo { pages: a.pages.clone(), ..Default::default() };
+            let mut c = DocInfo { pages: a.pages.clone(), ..Default::default() };
+            Inspector::new(&lazy).fill(&mut b);
+            Inspector::new(&eager).fill(&mut c);
+            assert!(!lazy.failed());
+            assert_eq!(format!("{b:?}"), format!("{c:?}"));
+            a.file_size = 0;
+            a.pdf_version.clear();
+            assert_eq!(format!("{a:?}"), format!("{c:?}"));
+        }
+    }
+
     #[test]
     fn links_read_set_layer_actions() {
         let info = inspect(Arc::new(LAYERS.to_vec()), None).expect("opens");
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index 12e3a6d6..747f6e35 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -1,9 +1,9 @@
 //! pdfcraft-render — page rasterization and document inspection.
 //!
 //! **Bootstrap status (see ADR-0004):** rasterization goes straight through the `hayro` crate
-//! (hayro-interpret + vello_cpu), and inspection (outline, annotations, fields, layers,
-//! attachments, metadata) uses `lopdf`. Both are replaced by our own `cos`/`model` crates and the
-//! DisplayList device design in M1–M2. The public API here is what the engine and UI rely on, so
+//! (hayro-interpret + vello_cpu). Inspection uses the lazy `cos` reader with a read-only lopdf
+//! object adapter and retains `lopdf` loading for compatibility repairs. The renderer and that
+//! adapter are replaced by `model` and the DisplayList design in M1–M2. The public API is what the engine and UI rely on, so
 //! the swap stays internal to this crate.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
@@ -11,6 +11,7 @@
 mod inspect;
 mod pixels;
 mod raster;
+mod structure;
 pub mod text;
 
 pub use inspect::{
diff --git a/crates/render/src/pixels.rs b/crates/render/src/pixels.rs
index 0864803a..1fc11286 100644
--- a/crates/render/src/pixels.rs
+++ b/crates/render/src/pixels.rs
@@ -24,6 +24,18 @@ impl Pixels {
     pub fn into_words(self) -> Vec<u32> {
         self.0
     }
+
+    /// Bytes the buffer holds allocated (its capacity), for memory budgets.
+    pub(crate) fn byte_capacity(&self) -> usize {
+        self.0.capacity().saturating_mul(4)
+    }
+}
+
+/// Pixels from words, one per pixel, its bytes in R, G, B, A memory order.
+impl From<Vec<u32>> for Pixels {
+    fn from(words: Vec<u32>) -> Self {
+        Self(words)
+    }
 }
 
 impl Deref for Pixels {
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 08fa3906..7eec3ad6 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1,17 +1,24 @@
 //! Background page rasterization.
 //!
-//! A `RenderPool` owns N worker threads. Each worker parses the shared bytes once (hayro's parser
-//! is lazy, so this is cheap) and keeps its own render cache. Requests carry a caller tag that is
-//! echoed back; the UI drops results for stale tags (e.g. after a zoom change).
+//! A `RenderPool` parses lazily once and shares that immutable parser between workers. Render
+//! caches stay worker-local. Requests carry a caller tag that is echoed back.
 //!
 //! **Robustness:** every page render runs under `catch_unwind`. A panic inside the renderer on a
-//! malformed page yields a `RenderedPage` with `error` set, and the worker rebuilds its parser and
-//! cache before continuing, so one bad page can never take down the app or poison later pages.
+//! malformed page yields an error and permanently retires the pool's shared parser generation.
+//! Workers discard its caches/results and fall back to private parsers. There is no shared
+//! rebuild loop, and a timed-out shared initialization is never started again in that pool.
 
 use std::panic::{AssertUnwindSafe, catch_unwind};
-use std::sync::mpsc::{Receiver, Sender, channel};
+#[cfg(not(target_arch = "wasm32"))]
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::SyncSender;
+#[cfg(not(target_arch = "wasm32"))]
+use std::sync::mpsc::{Receiver, sync_channel};
+
+mod work_queue;
 use std::sync::{Arc, Mutex};
 use std::thread::JoinHandle;
+use work_queue::{ResultReceiver, WorkQueue};
 
 use hayro::hayro_interpret::InterpreterSettings;
 use hayro::hayro_interpret::font::{FontData, FontQuery};
@@ -287,19 +294,33 @@ pub(crate) fn panic_message(p: &Box<dyn std::any::Any + Send>) -> String {
 /// How long one page may render before the pool gives up on it (the watchdog).
 pub const STUCK_AFTER: std::time::Duration = std::time::Duration::from_secs(20);
 
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum BusyStage {
+    /// Parsing the document, shared or private. Not timed: a huge or damaged file is slow to
+    /// open, not stuck, and giving up on it would fail every page of the pool. (Parsing has
+    /// its own limits.) Rendering is timed from the moment parsing ends.
+    Parsing,
+    SharedRender,
+    Private,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Clone, Copy)]
+struct Busy {
+    request: RenderRequest,
+    since: std::time::Instant,
+    stage: BusyStage,
+}
+
 /// State shared by the pool and its workers.
 #[derive(Default)]
 struct Shared {
-    /// Pending requests, most urgent last (workers pop from the end).
-    queue: Mutex<Vec<RenderRequest>>,
-    /// Requests a worker has taken whose answer `try_recv` has not handed out yet. Callers keep
-    /// listing the requests they're still waiting for in each new queue, so a queued request
-    /// equal to one of these is dropped instead of being rendered a second time. Lock `queue`
-    /// first when holding both.
-    taken: Mutex<Vec<RenderRequest>>,
+    /// Desired requests, active jobs and bounded completed results share one deduplication key.
+    queue: Arc<WorkQueue>,
     /// Per worker id: the request it is rendering and since when.
     #[cfg(not(target_arch = "wasm32"))]
-    busy: Mutex<Vec<Option<(RenderRequest, std::time::Instant)>>>,
+    busy: Mutex<Vec<Option<Busy>>>,
     /// Pages (and request kinds) the watchdog gave up on: answered with an error at once, so a
     /// pathological page cannot trap every worker in turn.
     stuck: Mutex<std::collections::HashSet<(usize, RequestKind)>>,
@@ -310,53 +331,147 @@ struct Shared {
     /// Test hook: make one page slow.
     #[cfg(test)]
     slow_page: Mutex<Option<(usize, std::time::Duration)>>,
+    /// Test hook: count parser initializations, including failed parses.
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    parses: std::sync::atomic::AtomicUsize,
+    #[cfg(not(target_arch = "wasm32"))]
+    parser: PoolParser,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    panic_page: Mutex<Option<usize>>,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    slow_parse: Mutex<Option<std::time::Duration>>,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    render_started: std::sync::atomic::AtomicUsize,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    shared_render_delay: Mutex<Option<std::time::Duration>>,
 }
 
 fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
     m.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
 }
 
-/// Whether two requests ask for the same answer (the scale compared bit for bit, so that a NaN
-/// request still matches itself and leaves `taken` when answered).
-fn same(a: &RenderRequest, b: &RenderRequest) -> bool {
-    (a.page, a.kind, a.tile, a.scale.to_bits(), a.tag) == (b.page, b.kind, b.tile, b.scale.to_bits(), b.tag)
+#[cfg(not(target_arch = "wasm32"))]
+fn set_busy_stage(shared: &Shared, id: usize, stage: BusyStage) -> bool {
+    let mut slots = lock(&shared.busy);
+    let Some(Some(busy)) = slots.get_mut(id) else { return false };
+    if busy.stage != stage {
+        busy.stage = stage;
+        busy.since = std::time::Instant::now();
+    }
+    true
 }
 
-/// Pop the most urgent queued request that isn't already taken, and mark it taken.
 #[cfg(not(target_arch = "wasm32"))]
-fn take_next(shared: &Shared) -> Option<RenderRequest> {
-    let mut queue = lock(&shared.queue);
-    let mut taken = lock(&shared.taken);
-    while let Some(req) = queue.pop() {
-        if !taken.iter().any(|t| same(t, &req)) {
-            taken.push(req);
-            return Some(req);
-        }
+#[derive(Default)]
+enum ParserState {
+    #[default]
+    Empty,
+    Loading,
+    Ready(Option<Arc<Pdf>>),
+    /// A page failed after initialization: isolate subsequent work per worker.
+    Private,
+    /// Retired before it became ready (defensive: parsing is not timed, and only a shared
+    /// render retires the parser). Retrying it on every worker cannot help.
+    Failed,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+struct PoolParser {
+    state: Mutex<ParserState>,
+    ready: std::sync::Condvar,
+    valid: Arc<AtomicBool>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Default for PoolParser {
+    fn default() -> Self {
+        Self { state: Mutex::default(), ready: std::sync::Condvar::new(), valid: Arc::new(AtomicBool::new(true)) }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl PoolParser {
+    /// `None` means use a private parser. `Some(None)` is a terminal parse failure.
+    fn acquire(&self, load: impl FnOnce() -> Option<Pdf>, cancelled: impl Fn() -> bool) -> Option<Option<Arc<Pdf>>> {
+        let mut state = lock(&self.state);
+        loop {
+            if cancelled() {
+                return Some(None);
+            }
+            match &*state {
+                ParserState::Ready(pdf) => return Some(pdf.clone()),
+                ParserState::Private => return None,
+                ParserState::Failed => return Some(None),
+                ParserState::Loading => {
+                    // Drop never joins a parser. A waiting worker must still notice
+                    // its pool's disconnected wake channel while another thread is
+                    // stuck in initialization and cannot signal this condition.
+                    state = self.ready.wait_timeout(state, std::time::Duration::from_millis(50)).unwrap_or_else(|p| p.into_inner()).0;
+                }
+                ParserState::Empty => {
+                    *state = ParserState::Loading;
+                    break;
+                }
+            }
+        }
+        drop(state);
+        // Parsing cannot hold the lifecycle mutex: watchdog/drop must remain nonblocking.
+        // Even a panic in initialization publishes one terminal failure and wakes waiters.
+        let pdf = catch_unwind(AssertUnwindSafe(load)).ok().flatten().map(Arc::new);
+        let mut state = lock(&self.state);
+        let result = match &*state {
+            ParserState::Loading => {
+                *state = ParserState::Ready(pdf.clone());
+                Some(pdf)
+            }
+            ParserState::Private => None,
+            _ => Some(None), // the watchdog retired initialization while it ran
+        };
+        self.ready.notify_all();
+        result
+    }
+
+    fn abandon(&self) {
+        self.retire();
+    }
+
+    /// After a shared render failed or timed out: later work parses privately, per worker
+    /// (for the rest of the pool's life: the old one-parser-per-worker memory use). A parser
+    /// that never became ready stays failed.
+    fn retire(&self) {
+        let mut state = lock(&self.state);
+        self.valid.store(false, Ordering::Release);
+        *state = match &*state {
+            ParserState::Loading | ParserState::Empty | ParserState::Failed => ParserState::Failed,
+            _ => ParserState::Private,
+        };
+        self.ready.notify_all();
     }
-    None
 }
 
 /// Renders pages on worker threads, most urgent request first.
 ///
-/// **Watchdog:** a render running longer than `stuck_after` (default [`STUCK_AFTER`]) is reported
-/// as an error for that page, the page is not attempted again, and a replacement worker takes
-/// the stuck one's place (threads cannot be killed: the stuck one is told to stop at its next
-/// content operator, exits when its render returns, and its late result is dropped; a single
-/// long operator, such as decoding a huge image, still runs to its end). At most `threads`
-/// replacements are started per pool, so a document full of pathological pages cannot spawn
-/// threads without bound.
+/// **Watchdog:** a render running longer than `stuck_after` (default [`STUCK_AFTER`]) is given
+/// up on. A timed-out *shared* render retires that parser and retries still-desired work
+/// privately: the page may only have been waiting behind another page's decode. A private
+/// timeout is reported as an error for that page and the page is not attempted again. Threads
+/// cannot be killed: the stuck worker is told to stop at its next content operator, exits when
+/// its render returns, and its late result is dropped; a single long operator, such as decoding
+/// a huge image, still runs to its end. At most `threads` replacements are started per pool, so
+/// a document full of pathological pages cannot spawn threads without bound. If every worker is
+/// retired after that budget is spent, pending and future requests fail explicitly instead of
+/// waiting forever.
 pub struct RenderPool {
     shared: Arc<Shared>,
-    wake: Mutex<Vec<Sender<()>>>,
-    results: Receiver<RenderedPage>,
-    results_tx: Sender<RenderedPage>,
+    wake: Mutex<Vec<SyncSender<()>>>,
+    results: ResultReceiver,
+    results_tx: Arc<WorkQueue>,
     bytes: Arc<Vec<u8>>,
     config: RenderConfig,
     _workers: Mutex<Vec<JoinHandle<()>>>,
-    /// Errors produced by the watchdog, handed out by `try_recv`.
-    abandoned: Mutex<Vec<RenderedPage>>,
     stuck_after: std::time::Duration,
     replacements_left: Mutex<usize>,
+    retired_workers: Mutex<usize>,
     /// Used when threads are unavailable (wasm32 without atomics, or spawn failure): requests are
     /// rendered on the calling thread inside `try_recv`, one per call.
     inline: Option<std::cell::RefCell<PageRenderer>>,
@@ -364,19 +479,25 @@ pub struct RenderPool {
 
 impl RenderPool {
     pub fn new(bytes: Arc<Vec<u8>>, threads: usize, config: RenderConfig) -> Self {
-        let (results_tx, results) = channel();
-        let threads = if cfg!(target_arch = "wasm32") { 0 } else { threads.max(1) };
+        Self::with_mode(bytes, threads, config, false)
+    }
+
+    fn with_mode(bytes: Arc<Vec<u8>>, threads: usize, config: RenderConfig, inline: bool) -> Self {
+        let threads = if inline || cfg!(target_arch = "wasm32") { 0 } else { threads.max(1) };
+        let shared = Arc::new(Shared::default());
+        let results_tx = shared.queue.clone();
+        let results = ResultReceiver(shared.queue.clone());
         let mut pool = Self {
-            shared: Arc::default(),
+            shared,
             wake: Mutex::new(Vec::new()),
             results,
             results_tx,
             bytes: bytes.clone(),
             config: config.clone(),
             _workers: Mutex::new(Vec::new()),
-            abandoned: Mutex::new(Vec::new()),
             stuck_after: STUCK_AFTER,
             replacements_left: Mutex::new(threads),
+            retired_workers: Mutex::new(0),
             inline: None,
         };
         for _ in 0..threads {
@@ -401,7 +522,7 @@ impl RenderPool {
                 lock(&self.shared.stop).push(stop.clone());
                 (busy.len() - 1, stop)
             };
-            let (wtx, wrx) = channel::<()>();
+            let (wtx, wrx) = sync_channel::<()>(1);
             let (shared, out, bytes, config) = (self.shared.clone(), self.results_tx.clone(), self.bytes.clone(), self.config.clone());
             match std::thread::Builder::new().name(format!("pdfcraft-render-{id}")).spawn(move || worker(id, bytes, config, shared, wrx, out, stop)) {
                 Ok(h) => {
@@ -419,15 +540,7 @@ impl RenderPool {
 
     /// A pool without worker threads: renders inside `try_recv` (the web path; also used in tests).
     pub fn new_inline(bytes: Arc<Vec<u8>>, config: RenderConfig) -> Self {
-        let mut pool = Self::new(bytes.clone(), 0, config.clone());
-        if pool.inline.is_none() {
-            // Native `new` always spawns at least one worker; drop to inline explicitly.
-            pool.shared = Arc::default();
-            pool.wake = Mutex::new(Vec::new());
-            pool._workers = Mutex::new(Vec::new());
-            pool.inline = Some(std::cell::RefCell::new(PageRenderer::new(bytes, config)));
-        }
-        pool
+        Self::with_mode(bytes, 0, config, true)
     }
 
     /// `true` when rendering happens on the caller's thread (no worker threads available).
@@ -440,32 +553,55 @@ impl RenderPool {
         self.stuck_after = limit;
     }
 
-    /// Replace the pending queue (most urgent first). In-flight renders are not interrupted, and a
-    /// request equal to one already taken (rendering, or answered but not yet received through
-    /// `try_recv`) is skipped rather than rendered twice.
-    pub fn set_queue(&self, mut requests: Vec<RenderRequest>) {
-        requests.reverse(); // workers pop from the end
-        *lock(&self.shared.queue) = requests;
+    /// Replace desired work (most urgent first), retaining matching in-flight/completed jobs.
+    /// Obsolete results are released before they reach the caller. In-flight work is not killed.
+    ///
+    /// The contract: a result is delivered only while its request is in the latest queue.
+    /// A caller still waiting for a page (or text, or a thumbnail) must keep listing it in
+    /// every call, or the finished result is dropped to save memory.
+    pub fn set_queue(&self, requests: Vec<RenderRequest>) {
+        self.shared.queue.replace(requests);
+        self.wake_workers();
+    }
+
+    fn wake_workers(&self) {
         for w in lock(&self.wake).iter() {
-            let _ = w.send(());
+            // One pending wakeup is sufficient; UI polling must not grow wake channels.
+            let _ = w.try_send(());
         }
     }
 
     pub fn try_recv(&self) -> Option<RenderedPage> {
         if let Some(r) = &self.inline {
-            let next = lock(&self.shared.queue).pop();
-            return next.map(|req| r.borrow_mut().render(req));
+            let req = self.shared.queue.pop()?;
+            let page = r.borrow_mut().render(req);
+            self.shared.queue.finish_inline(req);
+            return Some(page);
         }
         self.watchdog();
-        let page = lock(&self.abandoned).pop().or_else(|| self.results.try_recv().ok())?;
-        // Copies of the request queued while it rendered are answered too.
-        let mut queue = lock(&self.shared.queue);
-        queue.retain(|q| !same(q, &page.request));
-        let mut taken = lock(&self.shared.taken);
-        if let Some(i) = taken.iter().position(|t| same(t, &page.request)) {
-            taken.swap_remove(i);
-        }
-        Some(page)
+        let page = self.results.try_recv().ok();
+        // Consuming a result releases byte/count capacity. An invalid parser generation
+        // can also requeue work without returning a page, so wake in both cases.
+        self.wake_workers();
+        page.or_else(|| {
+            let workers = lock(&self._workers).len();
+            if workers == 0 || *lock(&self.retired_workers) < workers {
+                return None;
+            }
+            // Count successful handles, not reserved busy slots: thread spawning
+            // can fail. No worker remains able to service these pending requests.
+            let request = self.shared.queue.pop()?;
+            self.shared.queue.finish_inline(request);
+            Some(RenderedPage {
+                request,
+                width: 0,
+                height: 0,
+                rgba: Pixels::default(),
+                error: Some("all render workers exceeded their time limits; close and reopen the document to try again".into()),
+                text: None,
+                millis: 0,
+            })
+        })
     }
 
     /// Give up on renders that exceeded `stuck_after` (see the type docs).
@@ -475,36 +611,52 @@ impl RenderPool {
             let mut gave_up = Vec::new();
             {
                 let mut busy = lock(&self.shared.busy);
+                // Lock order: `busy`, then `stop`.
                 let stop = lock(&self.shared.stop);
                 for (id, slot) in busy.iter_mut().enumerate() {
-                    if let Some((req, since)) = *slot
-                        && since.elapsed() > self.stuck_after
+                    if let Some(busy) = *slot
+                        && busy.stage != BusyStage::Parsing
+                        && busy.since.elapsed() > self.stuck_after
                     {
                         *slot = None; // the worker sees this and exits when it returns
+                        // Told to stop at its next operator; its replacement retries the page.
                         if let Some(s) = stop.get(id) {
                             s.store(true, std::sync::atomic::Ordering::Relaxed);
                         }
-                        gave_up.push(req);
+                        gave_up.push(busy);
                     }
                 }
             }
-            for req in gave_up {
-                lock(&self.shared.stuck).insert((req.page, req.kind));
-                let what = if req.kind == RequestKind::Text { "text extraction for page" } else { "page" };
-                let error = format!(
-                    "{what} {} took longer than {:.0} s and was skipped; the page may be damaged or extremely complex",
-                    req.page + 1,
-                    self.stuck_after.as_secs_f32().max(1.0)
-                );
-                lock(&self.abandoned).push(RenderedPage {
-                    request: req,
-                    width: 0,
-                    height: 0,
-                    rgba: Pixels::default(),
-                    error: Some(error),
-                    text: None,
-                    millis: 0,
-                });
+            {
+                let mut retired = lock(&self.retired_workers);
+                *retired = retired.saturating_add(gave_up.len());
+            }
+            for busy in gave_up {
+                let req = busy.request;
+                self.shared.parser.retire();
+                if busy.stage == BusyStage::SharedRender {
+                    // The shared cold-decode gate can make a healthy page wait
+                    // behind another page. Only its private retry can attribute
+                    // the timeout to this page; do not blacklist it here.
+                    self.shared.queue.retry(req);
+                } else {
+                    lock(&self.shared.stuck).insert((req.page, req.kind));
+                    let what = if req.kind == RequestKind::Text { "text extraction for page" } else { "page" };
+                    let error = format!(
+                        "{what} {} took longer than {:.0} s and was skipped; the page may be damaged or extremely complex",
+                        req.page + 1,
+                        self.stuck_after.as_secs_f32().max(1.0)
+                    );
+                    self.shared.queue.abandon(RenderedPage {
+                        request: req,
+                        width: 0,
+                        height: 0,
+                        rgba: Pixels::default(),
+                        error: Some(error),
+                        text: None,
+                        millis: 0,
+                    });
+                }
                 let mut left = lock(&self.replacements_left);
                 if *left > 0 && self.spawn_worker() {
                     *left -= 1;
@@ -535,71 +687,505 @@ fn worker(
     config: RenderConfig,
     shared: Arc<Shared>,
     wake: Receiver<()>,
-    out: Sender<RenderedPage>,
+    out: Arc<WorkQueue>,
     stop: Arc<std::sync::atomic::AtomicBool>,
 ) {
     let settings = worker_settings(&config, &stop);
-    // Outer loop: (re)build parser + cache; rebuilt after a renderer panic.
+    // A local cell keeps Pdf borrows used by RenderCache stable. Drop both on an
+    // epoch change/panic before publishing an error or taking another request.
     loop {
-        let pdf = parse(&bytes, config.password.as_deref());
-        let cache = RenderCache::new();
-        loop {
-            let next = take_next(&shared);
-            let Some(req) = next else {
-                if wake.recv().is_err() {
-                    return; // pool dropped
+        let reset_result = {
+            let parsed = std::cell::OnceCell::new();
+            loop {
+                if parsed.get().is_some_and(|(_, _, shared_generation)| *shared_generation) && !shared.parser.valid.load(Ordering::Acquire) {
+                    break None;
                 }
-                continue;
-            };
-            if lock(&shared.stuck).contains(&(req.page, req.kind)) {
-                let error = format!("page {} was skipped earlier because it took too long to render", req.page + 1);
-                let page = RenderedPage { request: req, width: 0, height: 0, rgba: Pixels::default(), error: Some(error), text: None, millis: 0 };
-                if out.send(page).is_err() {
+                let next = shared.queue.pop();
+                let Some(req) = next else {
+                    if wake.recv().is_err() {
+                        return; // pool dropped
+                    }
+                    continue;
+                };
+                if shared.queue.cancel_obsolete(req) {
+                    continue;
+                }
+                if lock(&shared.stuck).contains(&(req.page, req.kind)) {
+                    let error = format!("page {} was skipped earlier because rendering failed or took too long", req.page + 1);
+                    let page = RenderedPage { request: req, width: 0, height: 0, rgba: Pixels::default(), error: Some(error), text: None, millis: 0 };
+                    if out.send_valid(page, None).is_err() {
+                        return;
+                    }
+                    continue;
+                }
+                let start = Stopwatch::start();
+                let stage = parsed.get().map_or(
+                    BusyStage::Parsing,
+                    |(_, _, shared_generation)| {
+                        if *shared_generation { BusyStage::SharedRender } else { BusyStage::Private }
+                    },
+                );
+                if let Some(slot) = lock(&shared.busy).get_mut(id) {
+                    *slot = Some(Busy { request: req, since: std::time::Instant::now(), stage });
+                }
+                let (pdf, cache, shared_generation) = parsed.get_or_init(|| {
+                    let load = || {
+                        #[cfg(test)]
+                        {
+                            shared.parses.fetch_add(1, Ordering::Relaxed);
+                            let delay = *lock(&shared.slow_parse);
+                            if let Some(delay) = delay {
+                                std::thread::sleep(delay);
+                            }
+                        }
+                        parse(&bytes, config.password.as_deref())
+                    };
+                    match shared.parser.acquire(load, || matches!(wake.try_recv(), Err(std::sync::mpsc::TryRecvError::Disconnected))) {
+                        Some(pdf) => {
+                            let shared_generation = pdf.is_some();
+                            (pdf, RenderCache::new(), shared_generation)
+                        }
+                        None => {
+                            let pdf = if set_busy_stage(&shared, id, BusyStage::Parsing) { load().map(Arc::new) } else { None };
+                            (pdf, RenderCache::new(), false)
+                        }
+                    }
+                });
+                // Acquisition may have waited or parsed privately after shared
+                // fallback. Retire before any render work if the watchdog gave
+                // this request to a replacement while initialization ran.
+                let stage = if *shared_generation { BusyStage::SharedRender } else { BusyStage::Private };
+                if !set_busy_stage(&shared, id, stage) {
                     return;
                 }
-                continue;
-            }
-            let start = Stopwatch::start();
-            if let Some(slot) = lock(&shared.busy).get_mut(id) {
-                *slot = Some((req, std::time::Instant::now()));
-            }
-            #[cfg(test)]
-            {
-                // Copy out first: a guard held in the `if let` would block the other workers.
-                let slow = *lock(&shared.slow_page);
-                if let Some((page, delay)) = slow
-                    && page == req.page
+                if shared.queue.cancel_obsolete(req) {
+                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
+                        return;
+                    }
+                    continue;
+                }
+                if *shared_generation && !shared.parser.valid.load(Ordering::Acquire) {
+                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
+                        return;
+                    }
+                    break Some((finish(req, start, Err(("the shared parser was retired".into(), false))), Some(shared.parser.valid.clone())));
+                }
+                #[cfg(test)]
                 {
-                    std::thread::sleep(delay);
+                    shared.render_started.fetch_add(1, Ordering::Relaxed);
+                    let shared_delay = *lock(&shared.shared_render_delay);
+                    if *shared_generation && let Some(delay) = shared_delay {
+                        std::thread::sleep(delay);
+                    }
+                    // Copy out first: a guard held in the `if let` would block the other workers.
+                    let slow = *lock(&shared.slow_page);
+                    if let Some((page, delay)) = slow
+                        && page == req.page
+                    {
+                        std::thread::sleep(delay);
+                    }
+                }
+                let r = catch_unwind(AssertUnwindSafe(|| {
+                    #[cfg(test)]
+                    if *lock(&shared.panic_page) == Some(req.page) {
+                        panic!("injected page panic");
+                    }
+                    match pdf {
+                        Some(pdf) => render_page(pdf, cache, &settings, req),
+                        None => Err(("the document could not be parsed".into(), false)),
+                    }
+                }))
+                .unwrap_or_else(|panic| Err((format!("renderer crashed on page {}: {}", req.page + 1, panic_message(&panic)), true)));
+                // If the watchdog cleared our slot meanwhile, it already answered for this request
+                // and started a replacement: drop the late result and retire.
+                let abandoned = lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none());
+                if abandoned {
+                    return;
+                }
+                let panicked = matches!(r, Err((_, true)));
+                if panicked {
+                    shared.parser.abandon();
+                    lock(&shared.stuck).insert((req.page, req.kind));
+                    break Some((finish(req, start, r), None));
+                }
+                let valid = shared_generation.then(|| shared.parser.valid.clone());
+                if *shared_generation && !shared.parser.valid.load(Ordering::Acquire) {
+                    break Some((finish(req, start, r), valid));
+                }
+                if out.send_valid(finish(req, start, r), valid).is_err() {
+                    return;
                 }
             }
-            let r = match &pdf {
-                Some(pdf) => render_page(pdf, &cache, &settings, req),
-                None => Err(("the document could not be parsed".into(), false)),
-            };
-            // If the watchdog cleared our slot meanwhile, it already answered for this request
-            // and started a replacement: drop the late result and retire.
-            let abandoned = lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none());
-            if abandoned {
-                return;
-            }
-            let panicked = matches!(r, Err((_, true)));
-            if out.send(finish(req, start, r)).is_err() {
-                return;
-            }
-            if panicked {
-                break;
-            }
+        }; // drop the parser and its borrowing cache before delivering reset_result
+        if let Some((page, valid)) = reset_result
+            && out.send_valid(page, valid).is_err()
+        {
+            return;
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
+    #[cfg(not(target_arch = "wasm32"))]
+    fn receive_before_deadline(pool: &RenderPool) -> RenderedPage {
+        // Generous: a loaded CI machine runs many render tests at once.
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+        loop {
+            if let Some(page) = pool.try_recv() {
+                return page;
+            }
+            assert!(std::time::Instant::now() < deadline, "no worker result");
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn shared_parser_is_lazy_and_initializes_once_under_contention() {
+        use std::sync::{Barrier, atomic::AtomicUsize};
+        let parser = Arc::new(PoolParser::default());
+        let loads = Arc::new(AtomicUsize::new(0));
+        let barrier = Arc::new(Barrier::new(16));
+        assert_eq!(loads.load(Ordering::Relaxed), 0);
+        let jobs: Vec<_> = (0..16)
+            .map(|_| {
+                let (parser, loads, barrier) = (parser.clone(), loads.clone(), barrier.clone());
+                std::thread::spawn(move || {
+                    barrier.wait();
+                    parser
+                        .acquire(
+                            || {
+                                loads.fetch_add(1, Ordering::Relaxed);
+                                Pdf::new(ONE_PAGE.to_vec()).ok()
+                            },
+                            || false,
+                        )
+                        .unwrap()
+                        .unwrap()
+                })
+            })
+            .collect();
+        let pdfs: Vec<_> = jobs.into_iter().map(|job| job.join().unwrap()).collect();
+        assert_eq!(loads.load(Ordering::Relaxed), 1);
+        assert!(pdfs.iter().all(|pdf| Arc::ptr_eq(pdf, &pdfs[0])));
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn initializer_panic_publishes_one_failure_and_wakes_waiters() {
+        use std::sync::{Barrier, atomic::AtomicUsize};
+        let parser = Arc::new(PoolParser::default());
+        let loads = Arc::new(AtomicUsize::new(0));
+        let barrier = Arc::new(Barrier::new(8));
+        let jobs: Vec<_> = (0..8)
+            .map(|_| {
+                let (parser, loads, barrier) = (parser.clone(), loads.clone(), barrier.clone());
+                std::thread::spawn(move || {
+                    barrier.wait();
+                    assert!(
+                        parser
+                            .acquire(
+                                || {
+                                    loads.fetch_add(1, Ordering::Relaxed);
+                                    panic!("injected parser panic");
+                                },
+                                || false
+                            )
+                            .unwrap()
+                            .is_none()
+                    );
+                })
+            })
+            .collect();
+        for job in jobs {
+            job.join().unwrap();
+        }
+        assert_eq!(loads.load(Ordering::Relaxed), 1);
+        assert!(parser.acquire(|| panic!("must not retry"), || false).unwrap().is_none());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn waiting_worker_can_cancel_before_initializer_returns() {
+        use std::{
+            sync::{atomic::AtomicUsize, mpsc},
+            time::Duration,
+        };
+        let parser = Arc::new(PoolParser::default());
+        let (started_tx, started_rx) = mpsc::channel();
+        let (release_tx, release_rx) = mpsc::channel();
+        let initializer = {
+            let parser = parser.clone();
+            std::thread::spawn(move || {
+                parser.acquire(
+                    || {
+                        started_tx.send(()).unwrap();
+                        release_rx.recv().unwrap();
+                        Pdf::new(ONE_PAGE.to_vec()).ok()
+                    },
+                    || false,
+                )
+            })
+        };
+        started_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+        let cancelled = Arc::new(AtomicBool::new(false));
+        let checks = Arc::new(AtomicUsize::new(0));
+        let (done_tx, done_rx) = mpsc::channel();
+        let waiter = {
+            let (parser, cancelled, checks) = (parser.clone(), cancelled.clone(), checks.clone());
+            std::thread::spawn(move || {
+                let result = parser.acquire(
+                    || panic!("must not initialize twice"),
+                    || {
+                        checks.fetch_add(1, Ordering::Relaxed);
+                        cancelled.load(Ordering::Acquire)
+                    },
+                );
+                done_tx.send(result.unwrap().is_none()).unwrap();
+            })
+        };
+        let deadline = std::time::Instant::now() + Duration::from_secs(2);
+        while checks.load(Ordering::Relaxed) == 0 {
+            assert!(std::time::Instant::now() < deadline);
+            std::thread::yield_now();
+        }
+        cancelled.store(true, Ordering::Release);
+        assert!(done_rx.recv_timeout(Duration::from_secs(2)).unwrap());
+        waiter.join().unwrap();
+        release_tx.send(()).unwrap();
+        assert!(initializer.join().unwrap().unwrap().is_some());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn page_panic_retires_shared_generation_and_healthy_pages_use_private_parsers() {
+        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 3, RenderConfig::default());
+        *lock(&pool.shared.panic_page) = Some(0);
+        *lock(&pool.shared.slow_page) = Some((1, std::time::Duration::from_millis(50)));
+        pool.set_queue(vec![
+            RenderRequest { page: 0, scale: 1.0, ..Default::default() },
+            RenderRequest { page: 1, scale: 1.0, ..Default::default() },
+        ]);
+        let mut pages = [receive_before_deadline(&pool), receive_before_deadline(&pool)];
+        pages.sort_by_key(|page| page.request.page);
+        assert!(pages[0].error.as_deref().is_some_and(|message| message.contains("crashed")));
+        assert!(pages[1].error.is_none(), "{:?}", pages[1].error);
+        assert_eq!((pages[1].width, pages[1].height), (100, 50));
+        assert!(!pool.shared.parser.valid.load(Ordering::Acquire));
+        assert!(matches!(*lock(&pool.shared.parser.state), ParserState::Private));
+        assert!((2..=4).contains(&pool.shared.parses.load(Ordering::Relaxed)));
+        let before = pool.shared.parses.load(Ordering::Relaxed);
+        pool.set_queue(vec![RenderRequest { page: 0, tag: 1, scale: 1.0, ..Default::default() }]);
+        assert!(receive_before_deadline(&pool).error.is_some());
+        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), before, "a failed page does not trigger repeated parsing");
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn results_queued_before_invalidation_are_retried_privately() {
+        let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
+        pool.set_queue(vec![RenderRequest { tag: 77, scale: 1.0, ..Default::default() }]);
+        let mut old = pool.results.recv_timeout(std::time::Duration::from_secs(8)).unwrap();
+        old.width = 999; // a stale surface must never reach the caller
+        pool.shared.parser.abandon();
+        pool.results_tx.send_valid(old, Some(pool.shared.parser.valid.clone())).unwrap();
+        let page = receive_before_deadline(&pool);
+        assert_eq!((page.width, page.height, page.request.tag), (100, 50, 77));
+        assert!(page.error.is_none());
+        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2);
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_slow_parse_is_not_a_timeout_and_its_pages_render() {
+        use std::time::{Duration, Instant};
+        // Shared, then the private parsers used after a shared failure.
+        for private in [false, true] {
+            let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
+            if private {
+                *lock(&pool.shared.parser.state) = ParserState::Private;
+                pool.shared.parser.valid.store(false, Ordering::Release);
+            }
+            // The parse takes 2 s against a 10 ms limit: the watchdog must leave it alone.
+            *lock(&pool.shared.slow_parse) = Some(Duration::from_secs(2));
+            pool.set_stuck_after(Duration::from_millis(10));
+            pool.set_queue(vec![
+                RenderRequest { page: 0, scale: 1.0, tag: 60, ..Default::default() },
+                RenderRequest { page: 1, scale: 1.0, tag: 61, ..Default::default() },
+            ]);
+            let started = Instant::now();
+            while pool.shared.parses.load(Ordering::Relaxed) == 0 {
+                assert!(started.elapsed() < Duration::from_secs(5), "parsing did not start");
+                std::thread::sleep(Duration::from_millis(2));
+            }
+            // Run the watchdog well past its limit while the parse is still sleeping.
+            for _ in 0..20 {
+                assert!(pool.try_recv().is_none(), "nothing may be given up on while parsing");
+                std::thread::sleep(Duration::from_millis(10));
+            }
+            assert!(lock(&pool.shared.stuck).is_empty());
+            assert_eq!(*lock(&pool.retired_workers), 0);
+            assert!(!matches!(*lock(&pool.shared.parser.state), ParserState::Failed));
+            // Rendering is timed from the end of parsing: give it a limit it can't miss.
+            pool.set_stuck_after(Duration::from_secs(60));
+            let mut pages = [receive_before_deadline(&pool), receive_before_deadline(&pool)];
+            pages.sort_by_key(|page| page.request.page);
+            for (page, tag) in pages.iter().zip([60, 61]) {
+                assert!(page.error.is_none(), "{:?}", page.error);
+                assert_eq!((page.width, page.height, page.request.tag), (100, 50, tag));
+            }
+            if !private {
+                assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 1, "one shared parse");
+                assert!(matches!(*lock(&pool.shared.parser.state), ParserState::Ready(Some(_))));
+            }
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn shared_timeouts_retry_healthy_pages_privately_before_blacklisting() {
+        use std::time::Duration;
+        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
+        // Limits and delays far apart, so a loaded machine can't flip the outcome: a healthy
+        // page renders privately well within 1 s, the injected delays are 3 s and 6 s.
+        pool.set_stuck_after(Duration::from_secs(1));
+        // Both shared workers wait as if behind the same cold decode. Only page0
+        // remains pathological in an independent parser; page1 must recover.
+        *lock(&pool.shared.shared_render_delay) = Some(Duration::from_secs(3));
+        *lock(&pool.shared.slow_page) = Some((0, Duration::from_secs(6)));
+        pool.set_queue(vec![
+            RenderRequest { page: 0, scale: 1.0, tag: 40, ..Default::default() },
+            RenderRequest { page: 1, scale: 1.0, tag: 41, ..Default::default() },
+        ]);
+        let mut pages = [receive_before_deadline(&pool), receive_before_deadline(&pool)];
+        pages.sort_by_key(|page| page.request.page);
+        assert!(pages[0].error.as_deref().is_some_and(|message| message.contains("took longer")));
+        assert!(pages[1].error.is_none(), "{:?}", pages[1].error);
+        assert_eq!((pages[1].width, pages[1].height, pages[1].request.tag), (100, 50, 41));
+        assert!(lock(&pool.shared.stuck).contains(&(0, RequestKind::Pixels)));
+        assert!(!lock(&pool.shared.stuck).contains(&(1, RequestKind::Pixels)));
+        assert!((2..=3).contains(&pool.shared.parses.load(Ordering::Relaxed)), "one shared parser and one or two reusable private parsers");
+        assert!(lock(&pool._workers).len() <= 4, "the existing replacement cap is unchanged");
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn exhausted_private_retry_budget_reports_pending_and_future_requests() {
+        use std::time::Duration;
+        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+        pool.set_stuck_after(Duration::from_millis(300));
+        *lock(&pool.shared.slow_page) = Some((0, Duration::from_secs(3)));
+        let bad = RenderRequest { page: 0, scale: 1.0, tag: 50, ..Default::default() };
+        let healthy = RenderRequest { page: 1, scale: 1.0, tag: 51, ..Default::default() };
+        pool.set_queue(vec![bad, healthy]);
+        let bad_result = receive_before_deadline(&pool);
+        assert_eq!(bad_result.request, bad);
+        assert!(bad_result.error.as_deref().is_some_and(|message| message.contains("took longer")));
+        let exhausted = receive_before_deadline(&pool);
+        assert_eq!(exhausted.request, healthy);
+        assert!(exhausted.error.as_deref().is_some_and(|message| message.contains("all render workers") && message.contains("reopen")));
+        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2);
+        assert_eq!(lock(&pool._workers).len(), 2, "no threads beyond the original replacement cap");
+        assert!(!lock(&pool.shared.stuck).contains(&(1, RequestKind::Pixels)), "the healthy page itself is not blacklisted");
+        let later = RenderRequest { tag: 52, ..healthy };
+        pool.set_queue(vec![later]);
+        let result = receive_before_deadline(&pool);
+        assert_eq!(result.request, later);
+        assert!(result.error.as_deref().is_some_and(|message| message.contains("all render workers")));
+        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2, "exhaustion performs no parser work on the consumer");
+        let workers = std::mem::take(&mut *lock(&pool._workers));
+        for worker in workers {
+            worker.join().unwrap();
+        }
+        assert!(pool.try_recv().is_none());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn replacing_a_request_during_initialization_skips_its_obsolete_render() {
+        use std::time::{Duration, Instant};
+        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+        *lock(&pool.shared.slow_parse) = Some(Duration::from_millis(200));
+        *lock(&pool.shared.slow_page) = Some((0, Duration::from_secs(10)));
+        pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, tag: 10, ..Default::default() }]);
+        let deadline = Instant::now() + Duration::from_secs(2);
+        while pool.shared.parses.load(Ordering::Relaxed) == 0 {
+            assert!(Instant::now() < deadline, "first request did not start parsing");
+            std::thread::sleep(Duration::from_millis(2));
+        }
+        let replaced = Instant::now();
+        pool.set_queue(vec![RenderRequest { page: 1, scale: 1.0, tag: 11, ..Default::default() }]);
+        let page = receive_before_deadline(&pool);
+        assert_eq!((page.request.page, page.request.tag), (1, 11));
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (100, 50));
+        assert!(replaced.elapsed() < Duration::from_secs(8), "obsolete page (10 s) delayed the replacement request");
+        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 1, "the useful parser is retained");
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn idle_and_skipped_workers_release_source_without_parsing() {
+        for skipped in [false, true] {
+            let shared = Arc::new(Shared::default());
+            if skipped {
+                let req = RenderRequest { page: 0, ..Default::default() };
+                shared.queue.replace(vec![req]);
+                lock(&shared.stuck).insert((req.page, req.kind));
+            }
+            let bytes = Arc::new(ONE_PAGE.to_vec());
+            let source = Arc::downgrade(&bytes);
+            let (wake_tx, wake_rx) = sync_channel(1);
+            let out = shared.queue.clone();
+            let results = ResultReceiver(shared.queue.clone());
+            // A dropped pool disconnects this channel. Running synchronously makes this check
+            // deterministic even when a worker starts after the pool has already been replaced.
+            drop(wake_tx);
+            worker(0, bytes, RenderConfig::default(), shared.clone(), wake_rx, out, Arc::new(std::sync::atomic::AtomicBool::new(false)));
+            assert_eq!(shared.parses.load(std::sync::atomic::Ordering::Relaxed), 0);
+            assert!(source.upgrade().is_none(), "retired workers release their source bytes");
+            if skipped {
+                assert!(results.try_recv().unwrap().error.as_deref().is_some_and(|e| e.contains("skipped earlier")));
+            }
+            assert!(results.try_recv().is_err());
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn worker_reuses_parser_and_releases_source_after_rendering() {
+        let bytes = Arc::new(ONE_PAGE.to_vec());
+        let source = Arc::downgrade(&bytes);
+        let pool = RenderPool::new(bytes, 1, RenderConfig::default());
+        assert!(!pool.is_inline(), "the lifecycle check needs a native worker");
+        for (tag, kind) in [RequestKind::Pixels, RequestKind::Text, RequestKind::Pixels].into_iter().enumerate() {
+            pool.set_queue(vec![RenderRequest { page: 0, kind, scale: 1.0, tag: tag as u64, ..Default::default() }]);
+            let page = pool.results.recv_timeout(std::time::Duration::from_secs(8)).expect("worker result");
+            assert!(page.error.is_none(), "{:?}", page.error);
+            assert_eq!(page.request.tag, tag as u64);
+            match kind {
+                RequestKind::Pixels => assert_eq!((page.width, page.height), (100, 50)),
+                RequestKind::Text => assert!(page.text.is_some()),
+            }
+            assert_eq!(pool.shared.parses.load(std::sync::atomic::Ordering::Relaxed), 1, "requests reuse one parser");
+        }
+        drop(pool);
+        let until = std::time::Instant::now() + std::time::Duration::from_secs(8);
+        while source.upgrade().is_some() {
+            assert!(std::time::Instant::now() < until, "dropped pools retire their workers and release the source");
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    }
+
     #[test]
     fn watchdog_skips_a_stuck_page_and_keeps_rendering() {
         use super::*;
         let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+        // Exercise the original private-worker replacement guarantee. Shared
+        // contention gets one isolated attempt, covered by the tests above.
+        *lock(&pool.shared.parser.state) = ParserState::Private;
+        pool.shared.parser.valid.store(false, Ordering::Release);
         pool.set_stuck_after(std::time::Duration::from_millis(1000));
         *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_secs(4)));
         let req = |page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0 };
@@ -639,7 +1225,7 @@ mod tests {
         let req = |page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0 };
         pool.set_queue(vec![req(0)]);
         let t = std::time::Instant::now();
-        while !lock(&pool.shared.busy).iter().flatten().any(|(r, _)| r.page == 0) {
+        while !lock(&pool.shared.busy).iter().flatten().any(|busy| busy.request.page == 0) {
             assert!(t.elapsed() < std::time::Duration::from_secs(8), "page 1 never started");
             std::thread::sleep(std::time::Duration::from_millis(1));
         }
@@ -660,7 +1246,7 @@ mod tests {
         }
         // Page 2 went to the idle worker instead of waiting behind a second copy of page 1.
         assert_eq!(answers, vec![1, 0]);
-        assert!(lock(&pool.shared.taken).is_empty());
+        assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 2, "each page rendered once");
     }
 
     #[test]
@@ -702,6 +1288,7 @@ mod tests {
             got[p.request.page] += 1;
         }
         assert_eq!(got, vec![1; pages]);
+        assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), pages, "no duplicated work was hidden by delivery filtering");
     }
 
     #[test]
@@ -738,6 +1325,56 @@ endstream endobj
 trailer << /Root 1 0 R >>
 %%EOF";
 
+    #[test]
+    fn large_resource_indexes_preserve_pixels_and_text() {
+        // #307: opening pages used to retain a hash table for every large resource
+        // dictionary on every page, even before rendering. The vendored lazy index
+        // must still resolve late keys, inherited resources and repeated renders.
+        fn fixture(large: bool) -> Vec<u8> {
+            let mut fonts = String::new();
+            let mut forms = String::new();
+            if large {
+                for i in 0..100 {
+                    fonts.push_str(&format!("/UnusedFont{i} 6 0 R "));
+                    forms.push_str(&format!("/UnusedForm{i} 7 0 R "));
+                }
+            }
+            let body = "BT /F1 12 Tf 10 55 Td (Shared resources) Tj ET q 1 0 0 1 10 10 cm /Last Do Q";
+            let form = "0 0 1 rg 0 0 30 20 re f";
+            format!(
+                "%PDF-1.7\n\
+                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R 8 0 R] /Count 2 /MediaBox [0 0 150 100] /Resources 5 0 R >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{body}\nendstream endobj\n\
+                 5 0 obj << /Font << {fonts}/F1 6 0 R >> /XObject << {forms}/Last 7 0 R >> >> endobj\n\
+                 6 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n\
+                 7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 20] /Length {} >> stream\n{form}\nendstream endobj\n\
+                 8 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources 5 0 R /Rotate 90 >> endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+                body.len(),
+                form.len()
+            )
+            .into_bytes()
+        }
+        let mut small = PageRenderer::new(Arc::new(fixture(false)), RenderConfig::default());
+        let mut large = PageRenderer::new(Arc::new(fixture(true)), RenderConfig::default());
+        for page in [0, 1, 0] {
+            for scale in [1.0, 2.0] {
+                let req = RenderRequest { page, scale, ..Default::default() };
+                let (a, b) = (small.render(req), large.render(req));
+                assert!(a.error.is_none() && b.error.is_none());
+                assert_eq!((a.width, a.height, &a.rgba), (b.width, b.height, &b.rgba));
+                assert!(b.rgba.as_chunks::<4>().0.contains(&[0, 0, 255, 255]));
+            }
+            let req = RenderRequest { page, kind: RequestKind::Text, ..Default::default() };
+            let (a, b) = (small.render(req), large.render(req));
+            assert!(a.error.is_none() && b.error.is_none());
+            assert_eq!(a.text.as_ref().unwrap().plain_text(), b.text.as_ref().unwrap().plain_text());
+            assert!(b.text.as_ref().unwrap().plain_text().contains("Shared resources"));
+        }
+    }
+
     #[test]
     fn renders_a_blue_rectangle() {
         let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
@@ -1214,6 +1851,10 @@ trailer << /Root 1 0 R >>
     #[test]
     fn the_watchdog_stops_the_render_it_gives_up_on() {
         let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+        // Private parsers: a shared render's first timeout is retried privately, which would
+        // give up on (and stop) a second worker too.
+        *lock(&pool.shared.parser.state) = ParserState::Private;
+        pool.shared.parser.valid.store(false, Ordering::Release);
         pool.set_stuck_after(std::time::Duration::from_millis(100));
         *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_millis(1500)));
         pool.set_queue(vec![RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0 }]);
@@ -1222,7 +1863,7 @@ trailer << /Root 1 0 R >>
             if let Some(p) = pool.try_recv() {
                 break p;
             }
-            assert!(t.elapsed() < std::time::Duration::from_secs(8), "no answer");
+            assert!(t.elapsed() < std::time::Duration::from_secs(30), "no answer");
             std::thread::sleep(std::time::Duration::from_millis(5));
         };
         assert!(first.error.as_deref().is_some_and(|e| e.contains("took longer")), "{:?}", first.error);
diff --git a/crates/render/src/raster/work_queue.rs b/crates/render/src/raster/work_queue.rs
new file mode 100644
index 00000000..fd4d40f4
--- /dev/null
+++ b/crates/render/src/raster/work_queue.rs
@@ -0,0 +1,499 @@
+//! Pending work and bounded completed results. Pixels already being rendered are outside
+//! this storage budget; at most one oversized completed result is admitted by itself.
+
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Condvar, Mutex};
+#[cfg(any(test, not(target_arch = "wasm32")))]
+use std::time::Duration;
+
+use super::{RenderRequest, RenderedPage, RequestKind, Tile, lock};
+
+const RESULT_BYTES: usize = 32 * 1024 * 1024;
+const RESULT_COUNT: usize = 32;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+struct Key {
+    page: usize,
+    kind: RequestKind,
+    tile: Option<Tile>,
+    scale: u32,
+    tag: u64,
+}
+
+impl From<RenderRequest> for Key {
+    fn from(r: RenderRequest) -> Self {
+        Self { page: r.page, kind: r.kind, tile: r.tile, scale: r.scale.to_bits(), tag: r.tag }
+    }
+}
+
+struct Completed {
+    page: RenderedPage,
+    bytes: usize,
+    valid: Option<Arc<AtomicBool>>,
+}
+
+fn valid(token: &Option<Arc<AtomicBool>>) -> bool {
+    token.as_ref().is_none_or(|v| v.load(Ordering::Acquire))
+}
+
+#[cfg(any(test, not(target_arch = "wasm32")))]
+fn result_bytes(page: &RenderedPage) -> usize {
+    let mut bytes = std::mem::size_of::<RenderedPage>().saturating_add(page.rgba.byte_capacity());
+    if let Some(error) = &page.error {
+        bytes = bytes.saturating_add(error.capacity());
+    }
+    if let Some(text) = &page.text {
+        bytes = bytes
+            .saturating_add(std::mem::size_of_val(&**text))
+            .saturating_add(text.glyphs.capacity().saturating_mul(std::mem::size_of::<crate::TextGlyph>()))
+            .saturating_add(text.line_of.capacity().saturating_mul(std::mem::size_of::<u32>()))
+            .saturating_add(text.space_before.capacity());
+        for glyph in &text.glyphs {
+            bytes = bytes.saturating_add(glyph.text.capacity());
+        }
+    }
+    bytes
+}
+
+#[derive(Default)]
+struct State {
+    /// Most urgent last, so a worker can pop in constant time.
+    pending: Vec<RenderRequest>,
+    /// Current consumer priority: zero is the most urgent visible request.
+    desired: HashMap<Key, usize>,
+    active: HashSet<Key>,
+    results: VecDeque<Completed>,
+    bytes: usize,
+    closed: bool,
+}
+
+impl State {
+    fn retry(&mut self, req: RenderRequest) {
+        let key = Key::from(req);
+        self.active.remove(&key);
+        if !self.closed
+            && let Some(&priority) = self.desired.get(&key)
+            && !self.pending.iter().any(|r| Key::from(*r) == key)
+        {
+            // Preserve reverse demand order: the pop end belongs to visible work, even
+            // when an older background completion needs retrying after parser retirement.
+            let index = self.pending.partition_point(|r| self.desired.get(&Key::from(*r)).copied().unwrap_or(usize::MAX) > priority);
+            self.pending.insert(index, req);
+        }
+    }
+
+    fn take(&mut self) -> Option<RenderedPage> {
+        while !self.results.is_empty() {
+            // Completion order can differ from demand order, especially after a page jump
+            // while search results are buffered. Look up current priority at delivery so
+            // arrivals after replace() also put visible pixels ahead of background work.
+            let index = self
+                .results
+                .iter()
+                .enumerate()
+                .min_by_key(|(_, r)| self.desired.get(&Key::from(r.page.request)).copied().unwrap_or(usize::MAX))
+                .map(|(index, _)| index)?;
+            let done = self.results.remove(index)?;
+            self.bytes = self.bytes.saturating_sub(done.bytes);
+            let key = Key::from(done.page.request);
+            if !self.desired.contains_key(&key) {
+                continue;
+            }
+            if !valid(&done.valid) {
+                self.retry(done.page.request);
+                continue;
+            }
+            return Some(done.page);
+        }
+        None
+    }
+}
+
+pub(super) struct WorkQueue {
+    state: Mutex<State>,
+    changed: Condvar,
+    max_bytes: usize,
+    max_count: usize,
+}
+
+impl Default for WorkQueue {
+    fn default() -> Self {
+        Self { state: Mutex::default(), changed: Condvar::new(), max_bytes: RESULT_BYTES, max_count: RESULT_COUNT }
+    }
+}
+
+impl WorkQueue {
+    pub(super) fn replace(&self, requests: Vec<RenderRequest>) {
+        let mut state = lock(&self.state);
+        if state.closed {
+            return;
+        }
+        let mut desired = HashSet::with_capacity(requests.len());
+        let requests: Vec<_> = requests.into_iter().filter(|r| desired.insert(Key::from(*r))).collect();
+        state.results.retain(|r| desired.contains(&Key::from(r.page.request)) && valid(&r.valid));
+        state.bytes = state.results.iter().fold(0usize, |n, r| n.saturating_add(r.bytes));
+        let completed: HashSet<_> = state.results.iter().map(|r| Key::from(r.page.request)).collect();
+        state.desired = requests.iter().enumerate().map(|(priority, req)| (Key::from(*req), priority)).collect();
+        state.pending =
+            requests.into_iter().rev().filter(|r| !state.active.contains(&Key::from(*r)) && !completed.contains(&Key::from(*r))).collect();
+        drop(state);
+        self.changed.notify_all();
+    }
+
+    pub(super) fn pop(&self) -> Option<RenderRequest> {
+        let mut state = lock(&self.state);
+        if state.closed || state.results.len() >= self.max_count || state.bytes >= self.max_bytes {
+            return None;
+        }
+        let req = state.pending.pop()?;
+        state.active.insert(Key::from(req));
+        Some(req)
+    }
+
+    /// Skip an obsolete request before entering the next expensive stage. Work already
+    /// executing cannot be interrupted, but cancelled parsing need not start a raster.
+    #[cfg(any(test, not(target_arch = "wasm32")))]
+    pub(super) fn cancel_obsolete(&self, req: RenderRequest) -> bool {
+        let mut state = lock(&self.state);
+        let key = Key::from(req);
+        if state.closed || !state.desired.contains_key(&key) {
+            state.active.remove(&key);
+            true
+        } else {
+            false
+        }
+    }
+
+    /// Inline rendering has no completed buffer. Remove its in-flight identity on return.
+    pub(super) fn finish_inline(&self, req: RenderRequest) {
+        lock(&self.state).active.remove(&Key::from(req));
+    }
+
+    #[cfg(test)]
+    pub(super) fn send(&self, page: RenderedPage) -> Result<(), ()> {
+        self.send_valid(page, None)
+    }
+
+    /// A failed shared parser invalidates its token. Such results are retried by a worker
+    /// using the pool's fallback parser, including when failure occurs after enqueueing.
+    #[cfg(any(test, not(target_arch = "wasm32")))]
+    pub(super) fn send_valid(&self, page: RenderedPage, token: Option<Arc<AtomicBool>>) -> Result<(), ()> {
+        let key = Key::from(page.request);
+        let bytes = result_bytes(&page);
+        let mut state = lock(&self.state);
+        loop {
+            if state.closed {
+                state.active.remove(&key);
+                return Err(());
+            }
+            if !state.desired.contains_key(&key) {
+                state.active.remove(&key);
+                return Ok(());
+            }
+            if !valid(&token) {
+                state.retry(page.request);
+                self.changed.notify_all();
+                return Ok(());
+            }
+            if state.results.len() < self.max_count && (state.results.is_empty() || state.bytes.saturating_add(bytes) <= self.max_bytes) {
+                state.active.remove(&key);
+                state.bytes = state.bytes.saturating_add(bytes);
+                state.results.push_back(Completed { page, bytes, valid: token });
+                drop(state);
+                self.changed.notify_all();
+                return Ok(());
+            }
+            // The parser validity token can change independently of this queue. Bound the
+            // wait so failed generations are released even while the consumer is paused.
+            state = self.changed.wait_timeout(state, Duration::from_millis(25)).unwrap_or_else(|p| p.into_inner()).0;
+        }
+    }
+
+    /// A shared-parser timeout may belong to another page holding a cold-load gate.
+    /// Retry still-current demand after the pool switches permanently to private parsers.
+    #[cfg(any(test, not(target_arch = "wasm32")))]
+    pub(super) fn retry(&self, request: RenderRequest) {
+        lock(&self.state).retry(request);
+        self.changed.notify_all();
+    }
+
+    /// Watchdog errors contain no page payload. They must never block the UI thread behind
+    /// a full result buffer; evict/retry one completed request if necessary.
+    #[cfg(any(test, not(target_arch = "wasm32")))]
+    pub(super) fn abandon(&self, page: RenderedPage) {
+        let mut state = lock(&self.state);
+        let req = page.request;
+        state.active.remove(&Key::from(req));
+        if state.closed || !state.desired.contains_key(&Key::from(req)) {
+            return;
+        }
+        let bytes = result_bytes(&page);
+        while !state.results.is_empty() && (state.results.len() >= self.max_count || state.bytes.saturating_add(bytes) > self.max_bytes) {
+            if let Some(old) = state.results.pop_back() {
+                state.bytes = state.bytes.saturating_sub(old.bytes);
+                state.retry(old.page.request);
+            }
+        }
+        state.bytes = state.bytes.saturating_add(bytes);
+        state.results.push_front(Completed { page, bytes, valid: None });
+        drop(state);
+        self.changed.notify_all();
+    }
+
+    fn close(&self) {
+        let mut state = lock(&self.state);
+        state.closed = true;
+        state.pending.clear();
+        state.desired.clear();
+        state.results.clear();
+        state.bytes = 0;
+        drop(state);
+        self.changed.notify_all();
+    }
+}
+
+pub(super) struct ResultReceiver(pub(super) Arc<WorkQueue>);
+
+impl ResultReceiver {
+    pub(super) fn try_recv(&self) -> Result<RenderedPage, std::sync::mpsc::TryRecvError> {
+        let mut state = lock(&self.0.state);
+        let result = state.take();
+        let closed = state.closed;
+        drop(state);
+        self.0.changed.notify_all();
+        result.ok_or(if closed { std::sync::mpsc::TryRecvError::Disconnected } else { std::sync::mpsc::TryRecvError::Empty })
+    }
+
+    #[cfg(test)]
+    pub(super) fn recv_timeout(&self, timeout: Duration) -> Result<RenderedPage, std::sync::mpsc::RecvTimeoutError> {
+        let start = std::time::Instant::now();
+        loop {
+            if let Ok(page) = self.try_recv() {
+                return Ok(page);
+            }
+            if start.elapsed() >= timeout {
+                return Err(std::sync::mpsc::RecvTimeoutError::Timeout);
+            }
+            std::thread::sleep(Duration::from_millis(2));
+        }
+    }
+}
+
+impl Drop for ResultReceiver {
+    fn drop(&mut self) {
+        self.0.close();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::Pixels;
+
+    fn req(page: usize) -> RenderRequest {
+        RenderRequest { page, scale: 1.0, ..Default::default() }
+    }
+
+    fn page(req: RenderRequest, bytes: usize) -> RenderedPage {
+        RenderedPage { request: req, width: 1, height: 1, rgba: Pixels::from(vec![0u32; bytes / 4]), error: None, text: None, millis: 0 }
+    }
+
+    #[test]
+    fn replacing_demands_deduplicates_active_and_completed_then_allows_eviction_retry() {
+        let q = Arc::new(WorkQueue::default());
+        let recv = ResultReceiver(q.clone());
+        q.replace(vec![req(0), req(0), req(1)]);
+        assert_eq!(q.pop(), Some(req(0)));
+        q.replace(vec![req(0), req(1)]);
+        assert_eq!(q.pop(), Some(req(1)));
+        q.send(page(req(0), 4)).unwrap();
+        q.replace(vec![req(0), req(1)]);
+        assert!(q.pop().is_none());
+        assert_eq!(recv.try_recv().unwrap().request, req(0));
+        q.replace(vec![req(1)]);
+        q.send(page(req(1), 4)).unwrap();
+        q.replace(vec![req(0)]);
+        assert!(recv.try_recv().is_err(), "obsolete completion released before delivery");
+        assert_eq!(q.pop(), Some(req(0)), "evicted UI textures can request the same key again");
+    }
+
+    #[test]
+    fn request_identity_preserves_distinct_work_and_deduplicates_nan_scales() {
+        // Keep #400's bitwise scale identity: NaN must match itself while rendering and
+        // awaiting delivery, without conflating different pages, kinds, tiles or tags.
+        let q = Arc::new(WorkQueue::default());
+        let recv = ResultReceiver(q.clone());
+        let base = RenderRequest { scale: f32::from_bits(0x7fc0_0001), ..req(0) };
+        let requests = [
+            base,
+            RenderRequest { page: 1, ..base },
+            RenderRequest { kind: RequestKind::Text, ..base },
+            RenderRequest { tile: Some(Tile { x: 0, y: 0, w: 1, h: 1 }), ..base },
+            RenderRequest { scale: f32::from_bits(0x7fc0_0002), ..base },
+            RenderRequest { tag: 1, ..base },
+        ];
+        let repeated = || requests.into_iter().flat_map(|r| [r, r]).collect();
+        q.replace(repeated());
+        for request in requests {
+            assert_eq!(q.pop().map(Key::from), Some(Key::from(request)));
+        }
+        q.replace(repeated());
+        assert!(q.pop().is_none(), "active requests are not rendered twice");
+        for request in requests {
+            q.send(page(request, 4)).unwrap();
+        }
+        q.replace(repeated());
+        assert!(q.pop().is_none(), "completed requests remain deduplicated until delivery");
+        for request in requests {
+            assert_eq!(Key::from(recv.try_recv().unwrap().request), Key::from(request));
+        }
+        assert!(recv.try_recv().is_err());
+        q.replace(vec![base]);
+        assert_eq!(q.pop().map(Key::from), Some(Key::from(base)), "delivery releases even a NaN request for a later retry");
+    }
+
+    #[test]
+    fn returning_to_active_work_reuses_it_but_cancellation_allows_a_fresh_request() {
+        let q = Arc::new(WorkQueue::default());
+        let recv = ResultReceiver(q.clone());
+        q.replace(vec![req(0)]);
+        assert_eq!(q.pop(), Some(req(0)));
+        q.replace(Vec::new());
+        q.replace(vec![req(0)]);
+        assert!(q.pop().is_none(), "returning to a page reuses its in-flight render");
+        q.send(page(req(0), 4)).unwrap();
+        assert_eq!(recv.try_recv().unwrap().request, req(0));
+        assert!(recv.try_recv().is_err());
+
+        q.replace(vec![req(0)]);
+        assert_eq!(q.pop(), Some(req(0)));
+        q.replace(Vec::new());
+        assert!(q.cancel_obsolete(req(0)), "a worker can cancel before rasterization");
+        q.replace(vec![req(0)]);
+        assert_eq!(q.pop(), Some(req(0)), "a cancelled render must not suppress later demand");
+    }
+
+    #[test]
+    fn delivery_uses_current_priority_for_buffered_and_later_completions() {
+        let q = Arc::new(WorkQueue::default());
+        let recv = ResultReceiver(q.clone());
+        let text = RenderRequest { kind: RequestKind::Text, ..req(0) };
+        let thumbnail = RenderRequest { tag: 1 << 63, ..req(1) };
+        let visible = req(2);
+        q.replace(vec![text, thumbnail, visible]);
+        for _ in 0..3 {
+            assert!(q.pop().is_some());
+        }
+        q.send(page(text, 4)).unwrap();
+        q.send(page(thumbnail, 4)).unwrap();
+        // A newly visible main page takes priority even though the other work is still
+        // desired, already completed, and was requested first in an earlier frame.
+        q.replace(vec![visible, thumbnail, text]);
+        q.send(page(visible, 4)).unwrap();
+        assert_eq!(recv.try_recv().unwrap().request, visible);
+        assert_eq!(recv.try_recv().unwrap().request, thumbnail);
+        assert_eq!(recv.try_recv().unwrap().request, text);
+        assert!(recv.try_recv().is_err());
+        assert_eq!(lock(&q.state).bytes, 0);
+        assert!(q.pop().is_none(), "priority changes must not duplicate completed work");
+    }
+
+    #[test]
+    fn invalid_background_completion_retries_after_pending_visible_work() {
+        let q = Arc::new(WorkQueue::default());
+        let recv = ResultReceiver(q.clone());
+        let token = Arc::new(AtomicBool::new(true));
+        let text = RenderRequest { kind: RequestKind::Text, ..req(0) };
+        let visible = req(1);
+        q.replace(vec![text]);
+        assert_eq!(q.pop(), Some(text));
+        q.send_valid(page(text, 4), Some(token.clone())).unwrap();
+        q.replace(vec![visible, text]);
+        token.store(false, Ordering::Release);
+        assert!(recv.try_recv().is_err());
+        assert_eq!(q.pop(), Some(visible));
+        assert_eq!(q.pop(), Some(text));
+        assert!(q.pop().is_none());
+    }
+
+    #[test]
+    fn watchdog_eviction_retries_background_work_after_visible_work() {
+        let q = Arc::new(WorkQueue { max_count: 1, ..Default::default() });
+        let recv = ResultReceiver(q.clone());
+        let text = RenderRequest { kind: RequestKind::Text, ..req(0) };
+        let stuck = req(1);
+        let visible = req(2);
+        q.replace(vec![text, stuck]);
+        assert_eq!(q.pop(), Some(text));
+        assert_eq!(q.pop(), Some(stuck));
+        q.send(page(text, 4)).unwrap();
+        q.replace(vec![visible, text, stuck]);
+        let mut error = page(stuck, 0);
+        error.error = Some("watchdog".into());
+        q.abandon(error);
+        assert_eq!(recv.try_recv().unwrap().request, stuck);
+        assert_eq!(q.pop(), Some(visible));
+        assert_eq!(q.pop(), Some(text));
+        assert!(q.pop().is_none());
+    }
+
+    #[test]
+    fn stalled_consumer_bounds_storage_and_drop_unblocks_publishers() {
+        let q = Arc::new(WorkQueue { max_bytes: 1024, max_count: 2, ..Default::default() });
+        let recv = ResultReceiver(q.clone());
+        q.replace(vec![req(0), req(1), req(2)]);
+        assert!(q.pop().is_some());
+        assert!(q.pop().is_some());
+        q.send(page(req(0), 700)).unwrap();
+        let blocked = q.clone();
+        let (tx, rx) = std::sync::mpsc::channel();
+        let worker = std::thread::spawn(move || {
+            tx.send(blocked.send(page(req(1), 700))).unwrap();
+        });
+        assert!(rx.recv_timeout(Duration::from_millis(30)).is_err());
+        assert!(lock(&q.state).bytes <= 1024);
+        drop(recv);
+        assert!(rx.recv_timeout(Duration::from_secs(2)).unwrap().is_err());
+        worker.join().unwrap();
+    }
+
+    #[test]
+    fn oversized_completion_is_admitted_alone_and_cancellation_releases_waiters() {
+        let q = Arc::new(WorkQueue { max_bytes: 512, max_count: 2, ..Default::default() });
+        let recv = ResultReceiver(q.clone());
+        q.replace(vec![req(0), req(1)]);
+        q.pop();
+        q.pop();
+        q.send(page(req(0), 1024)).unwrap();
+        let producer = q.clone();
+        let (tx, rx) = std::sync::mpsc::channel();
+        let worker = std::thread::spawn(move || {
+            tx.send(producer.send(page(req(1), 1024))).unwrap();
+        });
+        assert!(rx.recv_timeout(Duration::from_millis(30)).is_err());
+        assert_eq!(lock(&q.state).results.len(), 1);
+        q.replace(Vec::new());
+        assert!(rx.recv_timeout(Duration::from_secs(2)).unwrap().is_ok());
+        worker.join().unwrap();
+        assert!(recv.try_recv().is_err());
+        assert_eq!(lock(&q.state).bytes, 0);
+    }
+
+    #[test]
+    fn invalid_parser_generations_are_retried_before_or_after_publication() {
+        let q = Arc::new(WorkQueue::default());
+        let recv = ResultReceiver(q.clone());
+        let token = Arc::new(AtomicBool::new(true));
+        q.replace(vec![req(0)]);
+        q.pop();
+        q.send_valid(page(req(0), 4), Some(token.clone())).unwrap();
+        token.store(false, Ordering::Release);
+        assert!(recv.try_recv().is_err());
+        assert_eq!(q.pop(), Some(req(0)));
+        q.send_valid(page(req(0), 4), Some(token)).unwrap();
+        assert_eq!(q.pop(), Some(req(0)), "invalid pre-publication result retries too");
+        q.send(page(req(0), 4)).unwrap();
+        assert!(recv.try_recv().unwrap().error.is_none());
+    }
+}
diff --git a/crates/render/src/structure.rs b/crates/render/src/structure.rs
new file mode 100644
index 00000000..79ff3159
--- /dev/null
+++ b/crates/render/src/structure.rs
@@ -0,0 +1,239 @@
+//! Read-only structure inspection backed by the lazy COS reader. Keep the existing
+//! inspector's lopdf object vocabulary while loading only the objects its queries use.
+
+use std::collections::{BTreeMap, HashSet};
+use std::sync::{
+    Arc, OnceLock,
+    atomic::{AtomicBool, Ordering},
+};
+
+use lopdf::{Dictionary, Error, Object, ObjectId, Result};
+use pdfcraft_cos::{Document, Object as CosObject};
+
+pub(crate) trait Structure {
+    fn trailer(&self) -> &Dictionary;
+    fn get_object(&self, id: ObjectId) -> Result<&Object>;
+    fn encrypted(&self) -> bool;
+
+    fn dereference<'a>(&'a self, mut object: &'a Object) -> Result<(Option<ObjectId>, &'a Object)> {
+        let mut id = None;
+        for _ in 0..128 {
+            match object {
+                Object::Reference(reference) => {
+                    id = Some(*reference);
+                    object = self.get_object(*reference)?;
+                }
+                _ => return Ok((id, object)),
+            }
+        }
+        Err(Error::ReferenceLimit)
+    }
+
+    fn get_dictionary(&self, id: ObjectId) -> Result<&Dictionary> {
+        self.get_object(id).and_then(|o| self.dereference(o)).and_then(|(_, o)| o.as_dict())
+    }
+
+    fn catalog(&self) -> Result<&Dictionary> {
+        self.trailer().get(b"Root").and_then(Object::as_reference).and_then(|id| self.get_dictionary(id))
+    }
+
+    fn get_pages(&self) -> BTreeMap<u32, ObjectId> {
+        let mut pages = BTreeMap::new();
+        let Ok(root) = self.catalog().and_then(|c| c.get(b"Pages")).and_then(Object::as_reference) else { return pages };
+        let mut pending = vec![(root, 0usize)];
+        let mut seen = HashSet::new();
+        while let Some((id, depth)) = pending.pop() {
+            if depth > 256 || !seen.insert(id) {
+                continue;
+            }
+            let Ok(dict) = self.get_dictionary(id) else { continue };
+            match dict.get_type() {
+                Ok(b"Page") => {
+                    // Page numbers are 1-based u32s; a tree past u32::MAX pages stops there.
+                    let Some(number) = u32::try_from(pages.len()).ok().and_then(|n| n.checked_add(1)) else { return pages };
+                    pages.insert(number, id);
+                }
+                Ok(b"Pages") => {
+                    if let Ok(kids) = dict.get(b"Kids").and_then(|o| self.dereference(o)).and_then(|(_, o)| o.as_array()) {
+                        pending.extend(kids.iter().rev().filter_map(|k| k.as_reference().ok()).map(|id| (id, depth + 1)));
+                    }
+                }
+                _ => {}
+            }
+        }
+        pages
+    }
+
+    // Match lopdf's font-resource precedence: a page's direct resources, then its
+    // indirect resources and ancestors. Stop cycles and excessive inheritance depth.
+    fn get_page_fonts(&self, page: ObjectId) -> Result<BTreeMap<Vec<u8>, &Dictionary>> {
+        let mut resources = Vec::new();
+        let mut current = Some(page);
+        let mut seen = HashSet::new();
+        while let Some(id) = current {
+            if !seen.insert(id) {
+                return Err(Error::ReferenceCycle(id));
+            }
+            if seen.len() > 100 {
+                return Err(Error::RecursionLimit);
+            }
+            let dict = self.get_dictionary(id)?;
+            if let Ok(resource) = dict.get(b"Resources") {
+                match resource {
+                    Object::Dictionary(dict) if id == page => resources.push(dict),
+                    Object::Reference(id) => {
+                        if let Ok(dict) = self.get_dictionary(*id) {
+                            resources.push(dict);
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            current = dict.get(b"Parent").and_then(Object::as_reference).ok();
+        }
+        let mut fonts = BTreeMap::new();
+        for resources in resources {
+            if let Ok(dict) = resources.get(b"Font").and_then(|o| self.dereference(o)).and_then(|(_, o)| o.as_dict()) {
+                for (name, font) in dict.iter() {
+                    if let Ok(font) = self.dereference(font).and_then(|(_, o)| o.as_dict()) {
+                        fonts.entry(name.clone()).or_insert(font);
+                    }
+                }
+            }
+        }
+        Ok(fonts)
+    }
+}
+
+impl Structure for lopdf::Document {
+    fn trailer(&self) -> &Dictionary {
+        &self.trailer
+    }
+    fn get_object(&self, id: ObjectId) -> Result<&Object> {
+        self.get_object(id)
+    }
+    fn encrypted(&self) -> bool {
+        self.is_encrypted() || self.was_encrypted() || self.trailer.has(b"Encrypt")
+    }
+    fn get_pages(&self) -> BTreeMap<u32, ObjectId> {
+        self.get_pages()
+    }
+    fn get_page_fonts(&self, page: ObjectId) -> Result<BTreeMap<Vec<u8>, &Dictionary>> {
+        self.get_page_fonts(page)
+    }
+}
+
+type Slot = (u32, OnceLock<Option<Box<Object>>>);
+
+pub(crate) struct LazyStructure {
+    source: Document,
+    trailer: Dictionary,
+    // Sorted slots keep returned references stable, without allocating by the largest
+    // input object number (which can be sparse or hostile). Only queried objects fill slots.
+    objects: Vec<Slot>,
+    failed: AtomicBool,
+}
+
+impl LazyStructure {
+    pub(crate) fn new(bytes: Arc<Vec<u8>>, password: Option<&str>) -> std::result::Result<Self, String> {
+        let source = Document::open_with_stream_limit(bytes, password, 256 << 20).map_err(|e| e.to_string())?;
+        if !source.repair_log().is_empty() {
+            return Err("the structure requires compatibility repair".into());
+        }
+        let trailer = convert_dict(source.trailer(), 0).map_err(|e| e.to_string())?;
+        let objects = source.object_numbers().into_iter().map(|n| (n, OnceLock::new())).collect();
+        Ok(Self { source, trailer, objects, failed: AtomicBool::new(false) })
+    }
+
+    pub(crate) fn failed(&self) -> bool {
+        self.failed.load(Ordering::Relaxed)
+    }
+}
+
+impl Structure for LazyStructure {
+    fn trailer(&self) -> &Dictionary {
+        &self.trailer
+    }
+    fn encrypted(&self) -> bool {
+        self.source.security().is_some() || self.trailer.has(b"Encrypt")
+    }
+    fn get_object(&self, id: ObjectId) -> Result<&Object> {
+        let missing = || Error::ObjectNotFound(id);
+        let slot = self.objects.binary_search_by_key(&id.0, |(n, _)| *n).ok().and_then(|i| self.objects.get(i)).ok_or_else(missing)?;
+        if self.source.generation(id.0) != id.1 {
+            return Err(missing());
+        }
+        slot.1
+            .get_or_init(|| {
+                let result = self.source.try_get(id.0).ok().and_then(|o| convert(&o, 0).ok()).map(Box::new);
+                if result.is_none() {
+                    self.failed.store(true, Ordering::Relaxed);
+                }
+                result
+            })
+            .as_deref()
+            .ok_or_else(missing)
+    }
+}
+
+fn convert_dict(dict: &pdfcraft_cos::Dict, depth: usize) -> Result<Dictionary> {
+    if depth > 100 {
+        return Err(Error::RecursionLimit);
+    }
+    dict.iter().map(|(key, value)| Ok((key.clone(), convert(value, depth + 1)?))).collect::<Result<Vec<_>>>().map(|items| items.into_iter().collect())
+}
+
+fn convert(object: &CosObject, depth: usize) -> Result<Object> {
+    if depth > 100 {
+        return Err(Error::RecursionLimit);
+    }
+    Ok(match object {
+        CosObject::Null => Object::Null,
+        CosObject::Bool(value) => Object::Boolean(*value),
+        CosObject::Int(value) => Object::Integer(*value),
+        CosObject::Real(value) => Object::Real(*value as f32),
+        CosObject::Name(value) => Object::Name(value.clone()),
+        CosObject::String(value) => {
+            Object::String(value.bytes.clone(), if value.hex { lopdf::StringFormat::Hexadecimal } else { lopdf::StringFormat::Literal })
+        }
+        CosObject::Ref(value) => Object::Reference((value.num, value.generation)),
+        CosObject::Array(value) => Object::Array(value.iter().map(|o| convert(o, depth + 1)).collect::<Result<_>>()?),
+        CosObject::Dict(value) => Object::Dictionary(convert_dict(value, depth + 1)?),
+        CosObject::Stream(value) => Object::Stream(lopdf::Stream::new(convert_dict(&value.dict, depth + 1)?, value.raw.to_vec())),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn inspection_loads_only_requested_objects_in_a_compressed_document() {
+        let mut source = lopdf::Document::with_version("1.7");
+        let catalog = source.add_object(lopdf::dictionary! { "Type" => "Catalog", "Pages" => (2, 0) });
+        source.add_object(lopdf::dictionary! { "Type" => "Pages", "Kids" => vec![Object::Reference((3, 0))], "Count" => 1 });
+        source
+            .add_object(lopdf::dictionary! { "Type" => "Page", "Parent" => (2, 0), "MediaBox" => vec![0.into(), 0.into(), 100.into(), 100.into()] });
+        source.trailer.set("Root", catalog);
+        let unused: Vec<_> = (0..300).map(|i| Object::Reference(source.add_object(lopdf::dictionary! { "Unused" => i }))).collect();
+        // Keep these objects reachable when the full writer removes orphan objects,
+        // through a catalog extension that the panel inspector has no reason to read.
+        source.get_dictionary_mut(catalog).unwrap().set("Uninspected", unused);
+        let mut bytes = Vec::new();
+        source.save_to(&mut bytes).unwrap();
+        let cos = Document::open(Arc::new(bytes)).unwrap();
+        let compressed = pdfcraft_cos::write_full(&cos, &pdfcraft_cos::SaveOptions::default()).unwrap();
+        let expected = lopdf::Document::load_mem(&compressed).unwrap().get_pages();
+        let view = LazyStructure::new(Arc::new(compressed), None).unwrap();
+        assert_eq!(view.get_pages().len(), 1);
+        assert_eq!(view.get_pages(), expected);
+        assert!(!view.failed());
+        assert!(
+            view.objects.iter().filter(|(_, slot)| slot.get().is_some()).count() <= 3,
+            "unused objects must not be materialized to inspect a page tree"
+        );
+        let unused = view.catalog().unwrap().get(b"Uninspected").unwrap().as_array().unwrap();
+        let last = unused.last().unwrap().as_reference().unwrap();
+        assert!(matches!(view.get_dictionary(last).unwrap().get(b"Unused"), Ok(Object::Integer(299))));
+    }
+}
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index a701a4df..d10475ae 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -23,6 +23,10 @@ use crate::keys::DigestAlg;
 use crate::pkcs12::DigitalId;
 use crate::x509::{Certificate, build_chain};
 
+#[cfg(test)]
+#[path = "pdf_discovery_tests.rs"]
+mod discovery_tests;
+
 /// Digests of signed byte ranges (and parsed signed revisions), kept across revalidations of
 /// one document: incremental edits only append to the file, so the signed bytes and their
 /// digest don't change, and rehashing a large file on every edit was the expensive part of
@@ -34,6 +38,50 @@ pub struct DigestCache {
     map: std::sync::Mutex<HashMap<RangeKey, Vec<u8>>>,
     /// Signed revisions opened for change classification, by length and fingerprint.
     revisions: std::sync::Mutex<HashMap<(usize, [u8; 32]), Document>>,
+    /// Candidate identities only: validation still uses current bytes and current trust.
+    discovery: std::sync::Mutex<Option<TimestampCandidates>>,
+    #[cfg(test)]
+    discovery_scans: std::sync::atomic::AtomicUsize,
+}
+
+/// Keep only the most recently visited source/overlay. In particular, this must not retain
+/// a Document, its bytes, or parsed signature dictionaries across edits and saves.
+#[derive(Debug)]
+struct TimestampCandidates {
+    source: pdfcraft_cos::SourceIdentity,
+    modified: Vec<u32>,
+    candidates: Vec<ObjRef>,
+}
+
+const DISCOVERY_CACHE_LIMIT: usize = 4096;
+
+fn is_document_timestamp(object: &Object) -> bool {
+    object.as_dict().is_some_and(|d| d.name(b"Type") == Some(b"Sig") && d.name(b"SubFilter") == Some(b"ETSI.RFC3161") && d.contains(b"ByteRange"))
+}
+
+/// Only dictionary/null edits have a local effect on candidate membership. Changes to an
+/// object stream or a scalar used as an indirect /Length can affect unedited objects too.
+/// Checking both the original and current objects also covers freeing those dependencies.
+/// Unsupported or unreadable edits deliberately fall back to the complete bounded scan.
+fn changed_timestamp_candidates(doc: &Document, numbers: &[u32]) -> Option<Vec<ObjRef>> {
+    for (reference, object) in doc.scan_original_objects_subset(numbers.to_vec()) {
+        match object.ok()?.as_ref() {
+            Object::Dict(_) => {}
+            Object::Null if matches!(doc.xref_entry(reference.num), None | Some(pdfcraft_cos::XrefEntry::Free { .. })) => {}
+            _ => return None,
+        }
+    }
+    let mut candidates = Vec::new();
+    for (reference, object) in doc.scan_objects_subset(numbers.to_vec()) {
+        let object = object.ok()?;
+        if !matches!(object.as_ref(), Object::Dict(_) | Object::Null) {
+            return None;
+        }
+        if is_document_timestamp(&object) {
+            candidates.push(reference);
+        }
+    }
+    Some(candidates)
 }
 
 /// (end of first range, start of second, end of second, algorithm, fingerprint).
@@ -53,6 +101,61 @@ fn fingerprint(covered: &[u8]) -> [u8; 32] {
 }
 
 impl DigestCache {
+    fn timestamp_candidates(&self, doc: &Document) -> Vec<ObjRef> {
+        let mut slot = self.discovery.lock().ok();
+        let previous = slot.as_mut().and_then(|slot| slot.take());
+        let source = doc.source_identity();
+        let modified = doc.modified_objects();
+        // Reconstructed/unknown input and output-security changes take the original path.
+        let eligible = slot.is_some()
+            && doc.repair_log().is_empty()
+            && !doc.revisions().is_empty()
+            && !doc.encryption_changed()
+            && modified.len() <= DISCOVERY_CACHE_LIMIT;
+        if eligible && let Some(previous) = previous.filter(|previous| previous.source == source) {
+            // Undo/redo can remove overlays as well as add them. Revisit the union so an
+            // original candidate replaced or freed in the last snapshot can reappear.
+            let mut changed = previous.modified;
+            changed.extend_from_slice(&modified);
+            changed.sort_unstable();
+            changed.dedup();
+            if changed.len() <= DISCOVERY_CACHE_LIMIT
+                && let Some(mut candidates) = changed_timestamp_candidates(doc, &changed)
+            {
+                candidates.extend(previous.candidates.into_iter().filter(|r| changed.binary_search(&r.num).is_err()));
+                candidates.sort_unstable_by_key(|r| r.num);
+                if candidates.len() <= DISCOVERY_CACHE_LIMIT
+                    && let Some(slot) = slot.as_mut()
+                {
+                    **slot = Some(TimestampCandidates { source, modified, candidates: candidates.clone() });
+                }
+                return candidates;
+            }
+        }
+        #[cfg(test)]
+        self.discovery_scans.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let mut complete = true;
+        let candidates: Vec<_> = doc
+            .scan_objects_checked()
+            .filter_map(|(reference, object)| match object {
+                Ok(object) => is_document_timestamp(&object).then_some(reference),
+                Err(_) => {
+                    complete = false;
+                    None
+                }
+            })
+            .collect();
+        if eligible
+            && complete
+            && candidates.len() <= DISCOVERY_CACHE_LIMIT
+            && changed_timestamp_candidates(doc, &modified).is_some()
+            && let Some(slot) = slot.as_mut()
+        {
+            **slot = Some(TimestampCandidates { source, modified, candidates: candidates.clone() });
+        }
+        candidates
+    }
+
     /// The signed revision `bytes[..end]`, parsed (and kept).
     fn revision(&self, bytes: &[u8], end: usize) -> Option<Document> {
         let key = (end, fingerprint(&bytes[..end]));
@@ -261,7 +364,8 @@ pub fn list(doc: &Document, bytes: &[u8], trust: &TrustStore) -> Vec<SignatureIn
     list_cached(doc, bytes, trust, &DigestCache::default())
 }
 
-/// [`list`], reusing digests from `cache`.
+/// [`list`], reusing digests and standalone-timestamp discovery from `cache`. Field/widget
+/// structure and validation against `bytes` and `trust` are read again on every call.
 pub fn list_cached(doc: &Document, bytes: &[u8], trust: &TrustStore, cache: &DigestCache) -> Vec<SignatureInfo> {
     let pages = annot_pages(doc);
     let mut out = Vec::new();
@@ -311,14 +415,14 @@ pub fn list_cached(doc: &Document, bytes: &[u8], trust: &TrustStore, cache: &Dig
         out.push(info);
     }
     // Standalone document timestamps (ISO 32000-2 §12.8.2.2) live outside AcroForm fields.
-    for num in doc.object_numbers() {
-        let r = ObjRef { num, generation: doc.generation(num) };
+    let candidates = cache.timestamp_candidates(doc).into_iter().map(|r| r.num).collect();
+    for (r, o) in doc.scan_objects_subset(candidates) {
         if field_values.contains(&r) {
             continue;
         }
-        let o = doc.get(r);
+        let Ok(o) = o else { continue };
         let Some(d) = o.as_dict() else { continue };
-        if d.name(b"Type") != Some(b"Sig") || d.name(b"SubFilter") != Some(b"ETSI.RFC3161") || !d.contains(b"ByteRange") {
+        if !is_document_timestamp(&o) {
             continue;
         }
         let mut info = SignatureInfo {
@@ -707,9 +811,7 @@ pub(crate) fn signature_contents(doc: &Document) -> Vec<Vec<u8>> {
             }
         }
     }
-    for num in doc.object_numbers() {
-        let r = ObjRef { num, generation: doc.generation(num) };
-        let o = doc.get(r);
+    for (r, o) in doc.scan_objects() {
         let Some(d) = o.as_dict() else { continue };
         if d.name(b"Type") == Some(b"Sig") && d.name(b"SubFilter") == Some(b"ETSI.RFC3161") {
             add(d, Some(r));
diff --git a/crates/sign/src/pdf_discovery_tests.rs b/crates/sign/src/pdf_discovery_tests.rs
new file mode 100644
index 00000000..1798e76b
--- /dev/null
+++ b/crates/sign/src/pdf_discovery_tests.rs
@@ -0,0 +1,352 @@
+use super::*;
+use pdfcraft_cos::{Algorithm, NewEncryption, XrefEntry, write_full, write_incremental};
+use std::sync::atomic::Ordering;
+
+const STAMP: &str = "<< /Type /Sig /SubFilter /ETSI.RFC3161 /ByteRange [0 1 2 1] >>";
+
+fn fixture(extra: &[&str]) -> Document {
+    let mut objects = vec!["<< /Type /Catalog /Pages 2 0 R /Unknown 3 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"];
+    objects.extend_from_slice(extra);
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    Document::open(Arc::new(bytes)).unwrap()
+}
+
+fn stamp() -> Dict {
+    pdfcraft_cos::Lexer::new(STAMP.as_bytes(), 0).object().unwrap().as_dict().unwrap().clone()
+}
+
+fn scans(cache: &DigestCache) -> usize {
+    cache.discovery_scans.load(Ordering::Relaxed)
+}
+
+#[test]
+fn unchanged_source_and_clones_skip_the_full_discovery_scan() {
+    let doc = fixture(&[STAMP]);
+    let cache = DigestCache::default();
+    let expected = vec![ObjRef::new(3, 0)];
+    assert_eq!(cache.timestamp_candidates(&doc), expected);
+    assert_eq!(cache.timestamp_candidates(&doc), expected);
+    assert_eq!(cache.timestamp_candidates(&doc.clone()), expected);
+    assert_eq!(scans(&cache), 1);
+    let listed = list_cached(&doc, doc.bytes(), &TrustStore::default(), &cache);
+    assert_eq!(listed.len(), 1, "a timestamp needs no AcroForm");
+    assert!(listed[0].doc_timestamp);
+    assert_eq!(scans(&cache), 1);
+}
+
+#[test]
+fn empty_discovery_is_cached_until_an_unknown_dictionary_becomes_a_timestamp() {
+    let mut doc = fixture(&["<< /Unknown /Preserved >>"]);
+    let cache = DigestCache::default();
+    assert!(cache.timestamp_candidates(&doc).is_empty());
+    assert!(cache.timestamp_candidates(&doc).is_empty());
+    doc.update_dict(ObjRef::new(2, 0), |d| d.set(b"Rotate".to_vec(), Object::Int(90))).unwrap();
+    assert!(cache.timestamp_candidates(&doc).is_empty());
+    doc.set(ObjRef::new(3, 0), stamp());
+    assert_eq!(cache.timestamp_candidates(&doc), vec![ObjRef::new(3, 0)]);
+    assert_eq!(scans(&cache), 1);
+}
+
+#[test]
+fn dictionary_edits_additions_frees_and_undo_redo_reconcile_candidates() {
+    let original = fixture(&[STAMP, "<< /Unknown /Preserved >>"]);
+    let cache = DigestCache::default();
+    let old = ObjRef::new(3, 0);
+    let unknown = ObjRef::new(4, 0);
+    assert_eq!(cache.timestamp_candidates(&original), vec![old]);
+    let mut edited = original.clone();
+    edited.update_dict(ObjRef::new(2, 0), |d| d.set(b"Rotate".to_vec(), Object::Int(90))).unwrap();
+    assert_eq!(cache.timestamp_candidates(&edited), vec![old]);
+    edited
+        .update_dict(old, |d| {
+            d.remove(b"ByteRange");
+        })
+        .unwrap();
+    edited.set(unknown, stamp());
+    let added = edited.add(stamp());
+    assert_eq!(cache.timestamp_candidates(&edited), vec![unknown, added]);
+    let before_free = edited.clone();
+    edited.free(unknown);
+    edited.free(added);
+    assert!(cache.timestamp_candidates(&edited).is_empty());
+    assert_eq!(cache.timestamp_candidates(&before_free), vec![unknown, added]);
+    assert_eq!(cache.timestamp_candidates(&original), vec![old]);
+    assert!(cache.timestamp_candidates(&edited).is_empty());
+    assert_eq!(scans(&cache), 1);
+}
+
+#[test]
+fn first_discovery_on_an_edited_snapshot_does_not_hide_original_candidates() {
+    let original = fixture(&[STAMP]);
+    let mut edited = original.clone();
+    edited.free(ObjRef::new(3, 0));
+    let cache = DigestCache::default();
+    assert!(cache.timestamp_candidates(&edited).is_empty());
+    assert_eq!(cache.timestamp_candidates(&original), vec![ObjRef::new(3, 0)]);
+    assert_eq!(scans(&cache), 1);
+}
+
+#[test]
+fn field_membership_is_refreshed_even_when_discovery_is_cached() {
+    let mut doc = fixture(&[STAMP]);
+    let cache = DigestCache::default();
+    assert!(list_cached(&doc, doc.bytes(), &TrustStore::default(), &cache)[0].doc_timestamp);
+    let mut field = Dict::new();
+    field.set(b"FT".to_vec(), Object::name("Sig"));
+    field.set(b"T".to_vec(), Object::String(PdfString::literal("Approval")));
+    field.set(b"V".to_vec(), Object::Ref(ObjRef::new(3, 0)));
+    let field = doc.add(field);
+    let mut form = Dict::new();
+    form.set(b"Fields".to_vec(), Object::Array(vec![Object::Ref(field)]));
+    doc.update_dict(doc.root().unwrap(), |d| d.set(b"AcroForm".to_vec(), Object::Dict(form))).unwrap();
+    let listed = list_cached(&doc, doc.bytes(), &TrustStore::default(), &cache);
+    assert_eq!(listed.len(), 1, "field values must not be duplicated as standalone timestamps");
+    assert_eq!(listed[0].field, "Approval");
+    assert!(!listed[0].doc_timestamp);
+    doc.update_dict(doc.root().unwrap(), |d| {
+        d.remove(b"AcroForm");
+    })
+    .unwrap();
+    assert!(list_cached(&doc, doc.bytes(), &TrustStore::default(), &cache)[0].doc_timestamp);
+    assert_eq!(scans(&cache), 1);
+}
+
+#[test]
+fn reopened_incremental_and_renumbered_sources_get_fresh_discovery() {
+    let mut doc = fixture(&["<< /Ignored true >>", STAMP]);
+    doc.update_dict(doc.root().unwrap(), |d| d.set(b"Unknown".to_vec(), Object::Ref(ObjRef::new(4, 0)))).unwrap();
+    let cache = DigestCache::default();
+    assert_eq!(cache.timestamp_candidates(&doc), vec![ObjRef::new(4, 0)]);
+    let incremental = Document::open(Arc::new(write_incremental(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    assert_ne!(doc.source_identity(), incremental.source_identity());
+    assert_eq!(cache.timestamp_candidates(&incremental), vec![ObjRef::new(4, 0)]);
+    let full = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    let renumbered = full.get(full.root().unwrap()).as_dict().unwrap().reference(b"Unknown").unwrap();
+    assert_ne!(renumbered.num, 4);
+    assert_eq!(cache.timestamp_candidates(&full), vec![renumbered]);
+    let reopened_same_bytes = Document::open(full.bytes().clone()).unwrap();
+    assert_ne!(full.source_identity(), reopened_same_bytes.source_identity());
+    assert_eq!(cache.timestamp_candidates(&reopened_same_bytes), vec![renumbered]);
+    assert_eq!(scans(&cache), 4);
+}
+
+#[test]
+fn discovery_retains_neither_document_bytes_nor_old_sources() {
+    let cache = DigestCache::default();
+    let doc = fixture(&[STAMP]);
+    let bytes = Arc::downgrade(doc.bytes());
+    let source = doc.source_identity();
+    cache.timestamp_candidates(&doc);
+    drop(doc);
+    assert!(bytes.upgrade().is_none());
+    for _ in 0..64 {
+        let next = fixture(&["<< /Unknown true >>"]);
+        assert_ne!(source, next.source_identity());
+        assert!(cache.timestamp_candidates(&next).is_empty());
+    }
+    assert_eq!(scans(&cache), 65);
+}
+
+#[test]
+fn reconstructed_and_unreadable_objects_are_not_cached_as_complete() {
+    let doc = fixture(&[STAMP]);
+    let mut damaged = doc.bytes().as_ref().clone();
+    damaged[0] = b'!';
+    let repaired = Document::open(Arc::new(damaged)).unwrap();
+    assert!(!repaired.repair_log().is_empty());
+    let cache = DigestCache::default();
+    for _ in 0..2 {
+        assert_eq!(cache.timestamp_candidates(&repaired), vec![ObjRef::new(3, 0)]);
+    }
+    // A single invalid keyword immediately before endobj is deliberately recovered as
+    // Null by parse_indirect. Use a stream without endstream to exercise a real read error.
+    let unreadable = fixture(&[STAMP, "<< /Length 0 >>\nstream\nunterminated"]);
+    assert!(unreadable.repair_log().is_empty());
+    assert!(unreadable.try_get(4).is_err());
+    assert!(unreadable.scan_objects_checked().any(|(r, object)| r.num == 4 && object.is_err()));
+    for _ in 0..2 {
+        assert_eq!(cache.timestamp_candidates(&unreadable), vec![ObjRef::new(3, 0)]);
+        assert!(cache.discovery.lock().unwrap().is_none(), "incomplete discovery must not be published");
+    }
+    assert_eq!(scans(&cache), 4);
+    assert!(cache.discovery.lock().unwrap().is_none());
+}
+
+#[test]
+fn indirect_length_edits_and_frees_take_the_full_scan_fallback() {
+    let original = fixture(&[STAMP, "<< /Length 5 0 R >>\nstream\nabc\nendstream", "3"]);
+    let cache = DigestCache::default();
+    assert_eq!(cache.timestamp_candidates(&original), vec![ObjRef::new(3, 0)]);
+    let mut edited = original.clone();
+    edited.set(ObjRef::new(5, 0), Object::Int(0));
+    assert_eq!(cache.timestamp_candidates(&edited), vec![ObjRef::new(3, 0)]);
+    assert!(cache.discovery.lock().unwrap().is_none());
+    edited.free(ObjRef::new(5, 0));
+    assert_eq!(cache.timestamp_candidates(&edited), vec![ObjRef::new(3, 0)]);
+    assert_eq!(cache.timestamp_candidates(&original), vec![ObjRef::new(3, 0)]);
+    assert_eq!(scans(&cache), 4);
+}
+
+#[test]
+fn object_stream_changes_cannot_reuse_old_candidate_membership() {
+    let original = fixture(&[STAMP]);
+    let original = Document::open(Arc::new(write_full(&original, &SaveOptions::default()).unwrap())).unwrap();
+    let cache = DigestCache::default();
+    let candidates = cache.timestamp_candidates(&original);
+    assert_eq!(candidates.len(), 1);
+    let Some(XrefEntry::InStream { stream, .. }) = original.xref_entry(candidates[0].num) else { panic!("fixture must pack the timestamp") };
+    let stream_ref = ObjRef::new(stream, original.generation(stream));
+    let old_stream = original.get(stream_ref);
+    let Object::Stream(old_stream) = old_stream.as_ref() else { panic!("missing object stream") };
+    let mut decoded = old_stream.decoded().unwrap();
+    let at = decoded.windows(b"ETSI.RFC3161".len()).position(|s| s == b"ETSI.RFC3161").unwrap();
+    decoded[at] = b'X';
+    let mut edited = original.clone();
+    edited.set(stream_ref, Stream::flate(old_stream.dict.clone(), &decoded));
+    assert!(cache.timestamp_candidates(&edited).is_empty());
+    assert!(cache.discovery.lock().unwrap().is_none());
+    edited.free(stream_ref);
+    assert!(cache.timestamp_candidates(&edited).is_empty());
+    assert_eq!(cache.timestamp_candidates(&original), candidates);
+    assert_eq!(scans(&cache), 4);
+}
+
+#[test]
+fn decode_limits_and_password_contexts_cannot_share_discovery() {
+    let mut doc = fixture(&[STAMP]);
+    doc.set_encryption(&NewEncryption {
+        algorithm: Algorithm::Aes128,
+        user_password: "user",
+        owner_password: "owner",
+        permissions: -1,
+        encrypt_metadata: true,
+        seed: [29; 32],
+    })
+    .unwrap();
+    let bytes = Arc::new(write_full(&doc, &SaveOptions::default()).unwrap());
+    assert!(Document::open_with_password(bytes.clone(), Some("wrong")).is_err());
+    let user = Document::open_with_password(bytes.clone(), Some("user")).unwrap();
+    let owner = Document::open_with_password(bytes.clone(), Some("owner")).unwrap();
+    let limited = Document::open_with_stream_limit(bytes, Some("owner"), 1024 * 1024).unwrap();
+    assert_ne!(user.source_identity(), owner.source_identity());
+    assert_ne!(owner.source_identity(), limited.source_identity());
+    let cache = DigestCache::default();
+    for opened in [&user, &owner, &limited] {
+        assert_eq!(cache.timestamp_candidates(opened).len(), 1);
+        assert_eq!(cache.timestamp_candidates(opened).len(), 1);
+    }
+    assert_eq!(scans(&cache), 3);
+    let mut unprotected = owner.clone();
+    unprotected.remove_encryption();
+    assert_eq!(cache.timestamp_candidates(&unprotected).len(), 1);
+    assert!(cache.discovery.lock().unwrap().is_none());
+    let reopened = Document::open(Arc::new(write_full(&unprotected, &SaveOptions::default()).unwrap())).unwrap();
+    assert_eq!(cache.timestamp_candidates(&reopened).len(), 1);
+    assert_eq!(scans(&cache), 5);
+}
+
+#[test]
+fn candidate_cache_is_bounded_without_truncating_results() {
+    let extras = vec![STAMP; DISCOVERY_CACHE_LIMIT + 1];
+    let doc = fixture(&extras);
+    let cache = DigestCache::default();
+    for _ in 0..2 {
+        assert_eq!(cache.timestamp_candidates(&doc).len(), extras.len());
+        assert!(cache.discovery.lock().unwrap().is_none());
+    }
+    assert_eq!(scans(&cache), 2);
+}
+
+#[test]
+fn overlay_cache_is_bounded_and_new_documents_take_the_fallback() {
+    let mut doc = fixture(&[STAMP]);
+    for _ in 0..=DISCOVERY_CACHE_LIMIT {
+        doc.add(Dict::new());
+    }
+    let cache = DigestCache::default();
+    for _ in 0..2 {
+        assert_eq!(cache.timestamp_candidates(&doc), vec![ObjRef::new(3, 0)]);
+        assert!(cache.discovery.lock().unwrap().is_none());
+    }
+    let mut fresh = Document::new_empty();
+    let timestamp = fresh.add(stamp());
+    for _ in 0..2 {
+        assert_eq!(cache.timestamp_candidates(&fresh), vec![timestamp]);
+        assert!(cache.discovery.lock().unwrap().is_none());
+    }
+    assert_eq!(scans(&cache), 4);
+}
+
+/// Local, read-only corpus diagnostic; intentionally separate from ordinary timing.
+/// The source PDF is never copied into the repository or written by this probe.
+#[test]
+#[ignore = "set PDFCRAFT_SIGNATURE_PROBE_SOURCE to a local PDF; parent coordinates resource use"]
+fn real_file_discovery_cache_diagnostic() {
+    let path = std::env::var_os("PDFCRAFT_SIGNATURE_PROBE_SOURCE").expect("PDFCRAFT_SIGNATURE_PROBE_SOURCE");
+    let bytes = Arc::new(std::fs::read(path).unwrap());
+    let doc = Document::open(bytes.clone()).unwrap();
+    let mut objects = 0usize;
+    let mut candidates = 0usize;
+    let mut read_errors = 0usize;
+    let mut failed_numbers = Vec::new();
+    for (reference, object) in doc.scan_objects_checked() {
+        objects += 1;
+        match object {
+            Ok(object) => candidates += usize::from(is_document_timestamp(&object)),
+            Err(_) => {
+                read_errors += 1;
+                if failed_numbers.len() < 8 {
+                    failed_numbers.push(reference.num);
+                }
+            }
+        }
+    }
+    eprintln!(
+        "signature-discovery-input\tbytes={}\tobjects={objects}\tcandidates={candidates}\tread_errors={read_errors}\tfirst_failed_numbers={failed_numbers:?}\trepairs={}\trevisions={}",
+        bytes.len(),
+        doc.repair_log().len(),
+        doc.revisions().len()
+    );
+    let cache = DigestCache::default();
+    let trust = TrustStore::default();
+    let first = list_cached(&doc, &bytes, &trust, &cache);
+    let cached_candidates = cache.discovery.lock().unwrap().as_ref().map(|entry| entry.candidates.len());
+    eprintln!("signature-discovery-initial\tfull_scans={}\tcached_candidates={cached_candidates:?}\tsignatures={}", scans(&cache), first.len());
+    assert_eq!(read_errors, 0, "input has unreadable objects; complete discovery must not be published");
+    assert_eq!(cached_candidates, Some(candidates), "input did not qualify for discovery caching");
+    assert_eq!(scans(&cache), 1);
+    for _ in 0..3 {
+        assert_eq!(list_cached(&doc, &bytes, &trust, &cache).len(), first.len());
+    }
+    eprintln!("signature-discovery-unchanged\tfull_scans={}", scans(&cache));
+    assert_eq!(scans(&cache), 1);
+    let mut edited = doc.clone();
+    edited.update_dict(edited.root().unwrap(), |d| d.set(b"PdfcraftSignatureCacheProbe".to_vec(), Object::Int(1))).unwrap();
+    assert_eq!(list_cached(&edited, &bytes, &trust, &cache).len(), first.len());
+    assert_eq!(list_cached(&doc, &bytes, &trust, &cache).len(), first.len());
+    assert_eq!(list_cached(&edited, &bytes, &trust, &cache).len(), first.len());
+    eprintln!("signature-discovery-edit-undo-redo\tfull_scans={}", scans(&cache));
+    assert_eq!(scans(&cache), 1);
+    let added = edited.add(stamp());
+    assert_eq!(list_cached(&edited, &bytes, &trust, &cache).len(), first.len() + 1);
+    edited.free(added);
+    assert_eq!(list_cached(&edited, &bytes, &trust, &cache).len(), first.len());
+    assert_eq!(list_cached(&doc, &bytes, &trust, &cache).len(), first.len());
+    eprintln!("signature-discovery-add-free-undo\tfull_scans={}", scans(&cache));
+    assert_eq!(scans(&cache), 1);
+    let reopened = Document::open(bytes.clone()).unwrap();
+    assert_eq!(list_cached(&reopened, &bytes, &trust, &cache).len(), first.len());
+    eprintln!("signature-discovery-reopen\tfull_scans={}", scans(&cache));
+    assert_eq!(scans(&cache), 2);
+}
diff --git a/crates/sign/tests/pdf.rs b/crates/sign/tests/pdf.rs
index aa44d0f7..132787bf 100644
--- a/crates/sign/tests/pdf.rs
+++ b/crates/sign/tests/pdf.rs
@@ -40,6 +40,29 @@ fn open(b: &[u8]) -> Document {
     Document::open(Arc::new(b.to_vec())).unwrap()
 }
 
+#[test]
+fn standalone_timestamp_scan_survives_cache_batches_and_object_streams() {
+    let mut doc = open(&fixture());
+    let filler: Vec<_> = (0..300).map(|i| Object::Ref(doc.add(Object::Int(i)))).collect();
+    let mut stamp = pdfcraft_cos::Dict::new();
+    stamp.set(b"Type".to_vec(), Object::name("Sig"));
+    stamp.set(b"SubFilter".to_vec(), Object::name("ETSI.RFC3161"));
+    stamp.set(b"ByteRange".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(1), Object::Int(2), Object::Int(1)]));
+    stamp.set(b"Contents".to_vec(), Object::String(PdfString::literal("invalid-token")));
+    let stamp = doc.add(Object::Dict(stamp));
+    doc.update_dict(doc.root().unwrap(), |catalog| {
+        catalog.set(b"UninspectedObjects".to_vec(), Object::Array(filler));
+        catalog.set(b"UninspectedTimestamp".to_vec(), Object::Ref(stamp));
+    })
+    .unwrap();
+    let bytes = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+    let doc = open(&bytes);
+    assert!(doc.object_numbers().len() > 300);
+    let listed = signatures(&doc, &bytes, &TrustStore::default());
+    assert!(listed.iter().any(|s| s.doc_timestamp && s.status != Status::Valid));
+    assert!(listed.iter().any(|s| s.field == "Approval" && !s.signed));
+}
+
 fn opts() -> SignOptions {
     SignOptions {
         page: 0,
@@ -270,6 +293,50 @@ fn a_document_timestamp_covers_the_file_and_validates() {
     assert_eq!(stamp.status, Status::Valid, "{:?}", stamp.details);
 }
 
+#[test]
+fn cached_discovery_still_validates_current_timestamp_bytes_ranges_and_trust() {
+    let tsa = TestTsa {
+        id: pkcs12::open(&data("rsa-aes.p12"), "test").unwrap(),
+        time: Time { year: 2026, month: 10, day: 6, hour: 12, minute: 0, second: 0 },
+    };
+    let mut source = open(&fixture());
+    source
+        .update_dict(source.root().unwrap(), |d| {
+            d.remove(b"AcroForm");
+        })
+        .unwrap();
+    let bytes = pdfcraft_sign::timestamp_document(&source, &tsa, "D:20261006120000Z").unwrap();
+    let doc = open(&bytes);
+    let cache = pdfcraft_sign::DigestCache::default();
+    let trusted = TrustStore { certs: vec![tsa.id.certificate.clone()] };
+    let check = |doc: &Document, bytes: &[u8], trust: &TrustStore| {
+        let listed = pdfcraft_sign::pdf::list_cached(doc, bytes, trust, &cache);
+        assert_eq!(listed.len(), 1);
+        assert!(listed[0].doc_timestamp);
+        listed.into_iter().next().unwrap()
+    };
+    assert_eq!(check(&doc, &bytes, &TrustStore::default()).status, Status::Unknown);
+    assert_eq!(check(&doc, &bytes, &trusted).status, Status::Valid);
+    assert_eq!(check(&doc, &bytes, &TrustStore::default()).status, Status::Unknown);
+    let mut tampered = bytes.clone();
+    let at = tampered.windows(13).position(|w| w == b"Contract text").unwrap();
+    tampered[at] = b'K';
+    assert_eq!(check(&doc, &tampered, &trusted).status, Status::Invalid);
+    assert_eq!(check(&doc, &[], &trusted).status, Status::Invalid);
+    let stamp = doc.scan_objects().find(|(_, o)| o.as_dict().is_some_and(|d| d.name(b"SubFilter") == Some(b"ETSI.RFC3161"))).unwrap().0;
+    let mut edited = doc.clone();
+    edited.update_dict(stamp, |d| d.set(b"ByteRange".to_vec(), Object::Array(vec![Object::Int(-1)]))).unwrap();
+    assert_eq!(check(&edited, &bytes, &trusted).status, Status::Invalid);
+    assert_eq!(check(&doc, &bytes, &trusted).status, Status::Valid);
+    // Even a malformed token in the same byte ranges must be read again after discovery.
+    let br = doc.get(stamp).as_dict().unwrap().get(b"ByteRange").unwrap().as_array().unwrap().clone();
+    let gap_start = br[1].as_int().unwrap() as usize;
+    tampered = bytes.clone();
+    tampered[gap_start + 1] = b'F';
+    tampered[gap_start + 2] = b'F';
+    assert_eq!(check(&doc, &tampered, &trusted).status, Status::Invalid);
+}
+
 #[test]
 fn embedding_ltv_evidence_adds_a_dss_and_keeps_signatures_valid() {
     use pdfcraft_sign::dss::{self, Evidence};
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 504a613a..e1747b99 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -33,6 +33,33 @@ const TILE: u32 = 1024;
 /// Longest side of the low-resolution backdrop drawn under tiles.
 const BASE_SIDE: f32 = 2048.0;
 const THUMB_W: f32 = 132.0;
+const THUMB_H: f32 = 176.0;
+const THUMB_BYTES: usize = 24 * 1024 * 1024;
+const PAGE_BYTES: usize = 128 * 1024 * 1024;
+const TILE_BYTES: usize = 128 * 1024 * 1024;
+const UPLOAD_BYTES_PER_FRAME: usize = 16 * 1024 * 1024;
+const RESULTS_PER_FRAME: usize = 8;
+/// A defensive ceiling for unusually large viewports / n-up previews.
+const MAX_THUMB_DEMAND: usize = 256;
+/// At most this many whole-page rasters are cached beyond the ones on screen.
+const MAX_CACHED_PAGES: usize = 24;
+
+fn rgba_bytes(width: usize, height: usize) -> usize {
+    width.saturating_mul(height).saturating_mul(4)
+}
+
+fn texture_bytes(tex: &TextureHandle) -> usize {
+    let [w, h] = tex.size();
+    rgba_bytes(w, h)
+}
+
+/// Visible grid rows, plus one adjacent row in either direction. Work is independent of
+/// document length, including after a large scroll jump.
+fn thumbnail_rows(top: f32, bottom: f32, row_height: f32, rows: usize) -> Range<usize> {
+    let first = (top.max(0.0) / row_height).floor() as usize;
+    let end = (bottom.max(0.0) / row_height).ceil() as usize;
+    first.saturating_sub(1).min(rows)..end.saturating_add(1).min(rows)
+}
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Fit {
@@ -183,6 +210,21 @@ struct PageTex {
     tex: TextureHandle,
 }
 
+/// Retained RGBA texture accounting for automation and performance regressions. These
+/// surface bytes exclude driver overhead and temporary upload buffers; they are not RSS.
+#[derive(Clone, Copy, Debug, Default, serde::Serialize)]
+pub struct RasterMemory {
+    pub thumbnail_count: usize,
+    pub thumbnail_bytes: usize,
+    pub page_count: usize,
+    pub page_bytes: usize,
+    pub tile_count: usize,
+    pub tile_bytes: usize,
+    pub thumbnail_demand: usize,
+    /// Last submitted missing results; workers may have completed some since submission.
+    pub pending_requests: usize,
+}
+
 pub struct DocView {
     pub id: DocId,
     pub zoom: f32,
@@ -221,7 +263,13 @@ pub struct DocView {
     errors: HashMap<usize, String>,
     /// When each still-missing page was first shown, to flag unusually slow renders.
     waiting_since: HashMap<usize, f64>,
-    thumbs: HashMap<usize, TextureHandle>,
+    thumbs: HashMap<usize, PageTex>,
+    /// This frame's consumers, with visible cells ahead of prefetch.
+    thumb_demand: HashMap<usize, bool>,
+    frame_queue: Vec<RenderRequest>,
+    /// Pages on screen this frame. Their rasters and tiles are always admitted: the viewport
+    /// bounds them, and the byte and count limits apply to prefetch only.
+    frame_visible: HashSet<usize>,
     /// Thumbnails that are out of date (still shown until their replacement arrives).
     stale_thumbs: HashSet<usize>,
     /// Sharp tiles of large pages: (page, scale tag, tile x, tile y) → texture. Tiles of an
@@ -349,6 +397,19 @@ pub enum ViewAction {
 }
 
 impl DocView {
+    pub fn raster_memory(&self) -> RasterMemory {
+        RasterMemory {
+            thumbnail_count: self.thumbs.len(),
+            thumbnail_bytes: self.thumbs.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex))),
+            page_count: self.pages.len(),
+            page_bytes: self.pages.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex))),
+            tile_count: self.tiles.len(),
+            tile_bytes: self.tiles.values().fold(0usize, |n, tex| n.saturating_add(texture_bytes(tex))),
+            thumbnail_demand: self.thumb_demand.len(),
+            pending_requests: self.last_queue.len(),
+        }
+    }
+
     /// Where `page` is drawn on screen this frame (`None` when it is not on screen).
     pub fn page_screen_rect(&self, page: usize) -> Option<Rect> {
         self.screen_xforms.iter().find(|(p, _)| *p == page).map(|(_, xf)| xf.rect)
@@ -403,6 +464,9 @@ impl DocView {
             errors: HashMap::new(),
             waiting_since: HashMap::new(),
             thumbs: HashMap::new(),
+            thumb_demand: HashMap::new(),
+            frame_queue: Vec::new(),
+            frame_visible: HashSet::new(),
             stale_thumbs: HashSet::new(),
             tiles: HashMap::new(),
             texts: HashMap::new(),
@@ -597,7 +661,7 @@ impl DocView {
 
     /// A page's thumbnail texture, when rendered (the print preview uses them).
     pub(crate) fn thumb_id(&self, page: usize) -> Option<egui::TextureId> {
-        self.thumbs.get(&page).map(|t| t.id())
+        self.thumbs.get(&page).map(|t| t.tex.id())
     }
 
     pub(crate) fn page_text(&self, page: usize) -> Option<Arc<PageText>> {
@@ -705,7 +769,7 @@ impl DocView {
     }
 
     pub fn thumb(&self, page: usize) -> Option<&TextureHandle> {
-        self.thumbs.get(&page)
+        self.thumbs.get(&page).map(|t| &t.tex)
     }
 
     pub fn go_to_page(&mut self, page: usize) {
@@ -980,58 +1044,263 @@ impl DocView {
         }
     }
 
-    /// Pull finished renders into textures.
-    pub fn receive(&mut self, ctx: &egui::Context, pool: &RenderPool) {
-        let mut got = false;
-        // Inline (single-threaded, e.g. web) rendering happens inside try_recv: one page per frame.
-        let budget = if pool.is_inline() { 1 } else { usize::MAX };
-        let mut n = 0;
-        while n < budget
-            && let Some(r) = pool.try_recv()
-        {
-            n += 1;
-            got = true;
-            if r.request.kind == RequestKind::Text {
-                match r.text {
-                    Some(t) => {
-                        self.texts.insert(r.request.page, t);
-                        self.refresh_find_page(r.request.page);
-                    }
-                    None => {
-                        log::warn!("page {} text: {}", r.request.page + 1, r.error.unwrap_or_default());
-                        self.text_failed.insert(r.request.page);
-                    }
+    /// Start collecting demand from every consumer before scheduling or uploading results.
+    pub(crate) fn begin_render_frame(&mut self) {
+        self.thumb_demand.clear();
+        self.frame_queue.clear();
+        self.frame_visible.clear();
+    }
+
+    pub(crate) fn need_thumbnail(&mut self, page: usize, visible: bool) {
+        if page >= self.page_count {
+            return;
+        }
+        if let Some(priority) = self.thumb_demand.get_mut(&page) {
+            *priority |= visible;
+        } else if self.thumb_demand.len() < MAX_THUMB_DEMAND {
+            self.thumb_demand.insert(page, visible);
+        } else if visible && let Some(prefetch) = self.thumb_demand.iter().find_map(|(&p, &v)| (!v).then_some(p)) {
+            self.thumb_demand.remove(&prefetch);
+            self.thumb_demand.insert(page, true);
+        }
+    }
+
+    /// Only the displayed document owns raster textures. Tabs keep their document and view
+    /// state, but do not each retain a separate full application texture allowance.
+    pub(crate) fn suspend_rendering(&mut self, pool: &RenderPool) {
+        self.begin_render_frame();
+        self.pages.clear();
+        self.tiles.clear();
+        self.thumbs.clear();
+        self.grid_pages.clear();
+        self.stale_thumbs.clear();
+        self.waiting_since.clear();
+        // Signature previews own a separate renderer and image/background textures.
+        self.signature_drag = Default::default();
+        if !self.last_queue.is_empty() {
+            pool.set_queue(Vec::new());
+            self.last_queue.clear();
+        }
+        // Results already finished for this tab would otherwise sit in its pool, rasters and
+        // all, until the tab is shown again. (An inline pool renders inside try_recv: skip it.)
+        if !pool.is_inline() {
+            while pool.try_recv().is_some() {}
+        }
+    }
+
+    fn thumbnail_requests(&self, info: &DocInfo, ppp: f32) -> Vec<RenderRequest> {
+        let mut pages: Vec<_> = self.thumb_demand.iter().map(|(&p, &visible)| (p, visible)).collect();
+        pages.sort_unstable_by_key(|&(p, visible)| (!visible, p));
+        // At high DPI or in a very large viewport every demanded cell still fits the same
+        // byte allowance. Both dimensions are capped, including tall/wide page boxes.
+        // The count is rounded up to a power of two: the scale is part of each request's tag,
+        // so a density that followed every row scrolling in or out would re-render them all.
+        let per_thumb = THUMB_BYTES / pages.len().max(1).next_power_of_two();
+        let density = ppp.clamp(0.25, 4.0).min((per_thumb as f32 / (4.0 * THUMB_W * THUMB_H)).sqrt() * 0.98);
+        pages
+            .into_iter()
+            .filter_map(|(page, _)| {
+                let p = info.pages.get(page)?;
+                let scale = (THUMB_W / p.width.max(1.0)).min(THUMB_H / p.height.max(1.0)) * density;
+                Some(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag: THUMB_TAG | u64::from(scale.to_bits()) })
+            })
+            .collect()
+    }
+
+    /// Admit current demand within explicit byte limits. Cached and pending surfaces share
+    /// the allowance, so an evicted page can be requested again without a permanent done set.
+    fn prepare_render_queue(&mut self, info: &DocInfo, ppp: f32) -> Vec<RenderRequest> {
+        let requests = std::mem::take(&mut self.frame_queue);
+        let mut queue = Vec::new();
+        let mut pages = HashSet::new();
+        let mut tiles = HashSet::new();
+        let mut tile_tags = HashSet::new();
+        let mut grid = Vec::new();
+        let (mut page_bytes, mut tile_bytes) = (0usize, 0usize);
+        for req in requests.iter().filter(|r| r.kind == RequestKind::Pixels) {
+            let Some(p) = info.pages.get(req.page) else { continue };
+            // Organize-grid renders: only the cells in view that need one (organize_grid).
+            if req.tag & GRID_TAG != 0 {
+                grid.push(*req);
+                continue;
+            }
+            // On-screen work is always admitted (the viewport bounds it); the limits only
+            // decide how much prefetch fits beside it.
+            let visible = self.frame_visible.contains(&req.page);
+            if let Some(tile) = req.tile {
+                let key = (req.page, req.tag, tile.x / TILE, tile.y / TILE);
+                let bytes = rgba_bytes(tile.w as usize, tile.h as usize);
+                if (!visible && tile_bytes.saturating_add(bytes) > TILE_BYTES) || !tiles.insert(key) {
+                    continue;
+                }
+                tile_bytes = tile_bytes.saturating_add(bytes);
+                tile_tags.insert(req.tag);
+                if !self.tiles.contains_key(&key) {
+                    queue.push(*req);
                 }
-                continue;
-            }
-            if let Some(e) = r.error {
-                log::warn!("page {}: {e}", r.request.page + 1);
-                self.errors.insert(r.request.page, e);
-                continue;
-            }
-            let img = texture_image([r.width as usize, r.height as usize], r.rgba);
-            let page = r.request.page;
-            if let Some(t) = r.request.tile {
-                let tex = ctx.load_texture(format!("tile-{:?}-{page}-{}-{}", self.id, t.x, t.y), img, TextureOptions::LINEAR);
-                self.tiles.insert((page, r.request.tag, t.x / TILE, t.y / TILE), tex);
-                continue;
-            }
-            if r.request.tag & GRID_TAG != 0 {
-                let tex = ctx.load_texture(format!("grid-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
-                self.grid_pages.insert(page, (r.width, tex));
-            } else if r.request.tag & THUMB_TAG != 0 {
-                let tex = ctx.load_texture(format!("thumb-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
-                self.thumbs.insert(page, tex);
-                self.stale_thumbs.remove(&page);
             } else {
-                let tex = ctx.load_texture(format!("page-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
-                self.pages.insert(page, PageTex { tag: r.request.tag, tex });
-                self.signature_drag.page_received(page);
-                self.waiting_since.remove(&page);
+                let bytes = rgba_bytes(device_pixels(p.width, req.scale) as usize, device_pixels(p.height, req.scale) as usize);
+                if (!visible && (page_bytes.saturating_add(bytes) > PAGE_BYTES || pages.len() >= MAX_CACHED_PAGES)) || !pages.insert(req.page) {
+                    continue;
+                }
+                page_bytes = page_bytes.saturating_add(bytes);
+                if self.pages.get(&req.page).is_none_or(|p| p.tag != req.tag) {
+                    queue.push(*req);
+                }
             }
         }
-        if got {
-            ctx.request_repaint();
+        // Pages no longer demanded stay cached while the allowance has room, nearest to the
+        // current page first, so turning back a page shows it at once instead of rendering.
+        let mut undemanded: Vec<usize> = self.pages.keys().copied().filter(|p| !pages.contains(p)).collect();
+        undemanded.sort_by_key(|p| p.abs_diff(self.current));
+        let mut kept = pages.len();
+        for page in undemanded {
+            let bytes = self.pages.get(&page).map_or(0, |p| texture_bytes(&p.tex));
+            if kept < MAX_CACHED_PAGES && page_bytes.saturating_add(bytes) <= PAGE_BYTES {
+                page_bytes = page_bytes.saturating_add(bytes);
+                kept += 1;
+                pages.insert(page);
+            }
+        }
+        self.pages.retain(|p, _| pages.contains(p));
+        // Tiles of an earlier zoom (not a demanded scale) stay while the canvas keeps them, a
+        // bounded few under a page whose current tiles are still missing (OLD_TILES).
+        self.tiles.retain(|key, _| tiles.contains(key) || !tile_tags.contains(&key.1));
+        queue.extend(grid);
+        let thumbs = self.thumbnail_requests(info, ppp);
+        let mut thumb_bytes = 0usize;
+        let mut admitted = HashSet::new();
+        for req in thumbs {
+            let Some(p) = info.pages.get(req.page) else { continue };
+            let bytes = rgba_bytes(device_pixels(p.width, req.scale) as usize, device_pixels(p.height, req.scale) as usize);
+            if thumb_bytes.saturating_add(bytes) > THUMB_BYTES || self.errors.contains_key(&req.page) {
+                continue;
+            }
+            thumb_bytes += bytes;
+            admitted.insert(req.page);
+            if self.thumbs.get(&req.page).is_none_or(|t| t.tag != req.tag) || self.stale_thumbs.contains(&req.page) {
+                queue.push(req);
+            }
+        }
+        self.thumbs.retain(|p, _| admitted.contains(p));
+        self.stale_thumbs.retain(|p| admitted.contains(p));
+        // Visible main pages and thumbnails take precedence over background search work.
+        queue.extend(requests.into_iter().filter(|r| r.kind == RequestKind::Text));
+        queue
+    }
+
+    pub(crate) fn finish_render_frame(&mut self, ctx: &egui::Context, info: &DocInfo, pool: &RenderPool) {
+        let queue = self.prepare_render_queue(info, ctx.pixels_per_point());
+        if queue != self.last_queue {
+            pool.set_queue(queue.clone());
+            self.last_queue = queue;
+        }
+        self.receive(ctx, pool);
+        if !self.last_queue.is_empty() {
+            ctx.request_repaint_after(std::time::Duration::from_millis(30));
+        }
+    }
+
+    /// Pull a bounded batch of current results into textures. Demand is committed first, so
+    /// offscreen results and obsolete scale/configuration tags never allocate a ColorImage.
+    pub fn receive(&mut self, ctx: &egui::Context, pool: &RenderPool) {
+        let budget = if pool.is_inline() { 1 } else { RESULTS_PER_FRAME };
+        let mut uploaded = 0usize;
+        #[cfg(not(target_arch = "wasm32"))]
+        let started = std::time::Instant::now();
+        for _ in 0..budget {
+            let Some(r) = pool.try_recv() else { break };
+            uploaded = uploaded.saturating_add(self.receive_result(ctx, r));
+            // One whole-page upload may exceed the frame allowance; it must still progress.
+            if uploaded >= UPLOAD_BYTES_PER_FRAME {
+                break;
+            }
+            #[cfg(not(target_arch = "wasm32"))]
+            if started.elapsed() >= std::time::Duration::from_millis(4) {
+                break;
+            }
+        }
+    }
+
+    fn receive_result(&mut self, ctx: &egui::Context, r: pdfcraft_render::RenderedPage) -> usize {
+        if !self.last_queue.contains(&r.request) {
+            return 0;
+        }
+        ctx.request_repaint();
+        if r.request.kind == RequestKind::Text {
+            match r.text {
+                Some(t) => {
+                    self.texts.insert(r.request.page, t);
+                    self.refresh_find_page(r.request.page);
+                }
+                None => {
+                    log::warn!("page {} text: {}", r.request.page + 1, r.error.unwrap_or_default());
+                    self.text_failed.insert(r.request.page);
+                }
+            }
+            return 0;
+        }
+        if let Some(e) = r.error {
+            log::warn!("page {}: {e}", r.request.page + 1);
+            self.errors.insert(r.request.page, e);
+            return 0;
+        }
+        let page = r.request.page;
+        let bytes = rgba_bytes(r.width as usize, r.height as usize);
+        if bytes != r.rgba.len() || !self.admit_texture(r.request, bytes) {
+            return 0;
+        }
+        // The length was checked above, so the renderer's buffer becomes the texture data as is.
+        let img = texture_image([r.width as usize, r.height as usize], r.rgba);
+        if let Some(t) = r.request.tile {
+            let tex = ctx.load_texture(format!("tile-{:?}-{page}-{}-{}", self.id, t.x, t.y), img, TextureOptions::LINEAR);
+            self.tiles.insert((page, r.request.tag, t.x / TILE, t.y / TILE), tex);
+        } else if r.request.tag & GRID_TAG != 0 {
+            let tex = ctx.load_texture(format!("grid-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+            self.grid_pages.insert(page, (r.width, tex));
+        } else if r.request.tag & THUMB_TAG != 0 {
+            let tex = ctx.load_texture(format!("thumb-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+            self.thumbs.insert(page, PageTex { tag: r.request.tag, tex });
+            self.stale_thumbs.remove(&page);
+        } else {
+            let tex = ctx.load_texture(format!("page-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+            self.pages.insert(page, PageTex { tag: r.request.tag, tex });
+            self.signature_drag.page_received(page);
+            self.waiting_since.remove(&page);
+        }
+        bytes
+    }
+
+    /// Check real dimensions before conversion, including stale textures kept during edits.
+    /// Dropping an old handle releases its backend allocation after the current frame.
+    fn admit_texture(&mut self, req: RenderRequest, bytes: usize) -> bool {
+        // An on-screen page or tile is always taken (the viewport bounds it): it may evict
+        // off-screen rasters but never another on-screen one, and is never refused.
+        let visible = req.tag & THUMB_TAG == 0 && self.frame_visible.contains(&req.page);
+        // Organize-grid renders are bounded by the cells in view (organize_grid).
+        if req.tag & GRID_TAG != 0 {
+            return true;
+        }
+        if let Some(t) = req.tile {
+            let key = (req.page, req.tag, t.x / TILE, t.y / TILE);
+            self.tiles.remove(&key);
+            let retained = self.tiles.values().fold(0usize, |n, tex| n.saturating_add(texture_bytes(tex)));
+            visible || bytes <= TILE_BYTES.saturating_sub(retained)
+        } else {
+            let thumb = req.tag & THUMB_TAG != 0;
+            let (cache, limit) = if thumb { (&mut self.thumbs, THUMB_BYTES) } else { (&mut self.pages, PAGE_BYTES) };
+            cache.remove(&req.page);
+            let mut retained = cache.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex)));
+            // A zoom/DPI change can temporarily retain larger stale images than the new
+            // demand estimates. Evict those first, then let the current demand refill them.
+            let on_screen = |p: &usize| !thumb && self.frame_visible.contains(p);
+            while retained.saturating_add(bytes) > limit {
+                let Some(page) = cache.keys().copied().filter(|p| !on_screen(p)).max_by_key(|p| p.abs_diff(self.current)) else { break };
+                if let Some(old) = cache.remove(&page) {
+                    retained = retained.saturating_sub(texture_bytes(&old.tex));
+                }
+            }
+            visible || bytes <= limit.saturating_sub(retained)
         }
     }
 
@@ -1382,7 +1651,6 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         ui.centered_and_justified(|ui| ui.label(tl!("This document has no pages.")));
         return;
     }
-    let want_thumbs = app.right == Some(RightPanel::Pages) || app.views[index].organize || app.dialog == Some(crate::Dialog::Print);
     // The Prepare a form panel is open (or a field tool is picked): fields are edited, not filled.
     let preparing = app.is_preparing();
     // Edit a PDF: added text and images can be selected, moved and edited.
@@ -1402,7 +1670,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     // No dialog, close prompt or palette over the page: only then does page input count.
     let unobstructed = app.dialog.is_none() && app.close_request.is_none() && !app.palette_open;
     if view.organize {
-        organize_grid(view, info, &doc.renderer, doc.allows_assembly(), doc.dirty, unobstructed, ui, &t);
+        organize_grid(view, info, doc.allows_assembly(), doc.dirty, unobstructed, ui, &t);
         return;
     }
 
@@ -1671,6 +1939,12 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 } else {
                     (scale, tag)
                 };
+                // Under tiles, a whole-page raster sharper than the backdrop (from before the page
+                // grew past the tiling size) is a better backdrop: keep demanding it as it is.
+                match view.pages.get(&i).filter(|p| tiled && p.tag != STALE_TAG && tag_scale(p.tag) >= want_scale) {
+                    Some(p) => wanted.push((i, tag_scale(p.tag), p.tag, None)),
+                    None => wanted.push((i, want_scale, want_tag, None)),
+                }
                 match view.pages.get(&i) {
                     Some(p) => {
                         if !tiled && p.tag == want_tag {
@@ -1679,15 +1953,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             // A backdrop, or a raster at an older scale until the new one arrives.
                             xf.paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
                         }
-                        // Under tiles, a whole-page raster sharper than the backdrop (from before
-                        // the page grew past the tiling size) is a better backdrop: keep it.
-                        let sharper = tiled && p.tag != STALE_TAG && tag_scale(p.tag) >= want_scale;
-                        if p.tag != want_tag && !sharper {
-                            wanted.push((i, want_scale, want_tag, None));
-                        }
                     }
                     None => {
-                        wanted.push((i, want_scale, want_tag, None));
                         let now = ui.input(|inp| inp.time);
                         let since = *view.waiting_since.entry(i).or_insert(now);
                         let msg = if now - since > 6.0 { "Still rendering — this page is unusually complex…" } else { "Rendering…" };
@@ -1727,19 +1994,17 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             if w == 0 || h == 0 {
                                 continue;
                             }
-                            match view.tiles.get(&(i, tag, tx, ty)) {
-                                Some(tex) => {
-                                    let (fw, fh) = (dw as f32, dh as f32);
-                                    xf.texel_aligned([dw as usize, dh as usize], ppp).paint_image(
-                                        painter,
-                                        tex.id(),
-                                        x as f32 / fw,
-                                        y as f32 / fh,
-                                        (x + w) as f32 / fw,
-                                        (y + h) as f32 / fh,
-                                    );
-                                }
-                                _ => wanted.push((i, scale, tag, Some(Tile { x, y, w, h }))),
+                            wanted.push((i, scale, tag, Some(Tile { x, y, w, h })));
+                            if let Some(tex) = view.tiles.get(&(i, tag, tx, ty)) {
+                                let (fw, fh) = (dw as f32, dh as f32);
+                                xf.texel_aligned([dw as usize, dh as usize], ppp).paint_image(
+                                    painter,
+                                    tex.id(),
+                                    x as f32 / fw,
+                                    y as f32 / fh,
+                                    (x + w) as f32 / fw,
+                                    (y + h) as f32 / fh,
+                                );
                             }
                         }
                     }
@@ -2157,16 +2422,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
 
     view.auto_scroll.paint(ui, avail);
 
-    // Bound texture memory: keep sharp rasters only near the current page.
-    if view.pages.len() > 24 {
-        let cur = view.current;
-        view.pages.retain(|&p, _| p.abs_diff(cur) <= 8);
-    }
-    // Schedule renders: visible pages first (nearest the current page), then thumbnails.
+    // Collect all main-page demand, including cached surfaces, for byte admission later.
     let (mut wanted, visible_now) = out.inner;
     let cur = view.current;
-    // Nearest pages first; for each page, the backdrop before its tiles.
-    wanted.sort_by_key(|w| ((w.0 as isize - cur as isize).unsigned_abs(), w.3.is_some()));
+    wanted.sort_by_key(|w| (!visible_now.contains(&w.0), w.0.abs_diff(cur), w.3.is_some()));
     // Tiles of far-away pages are useless: free them. Tiles of other zooms stay only while a
     // current tile of their page is still missing, at most `OLD_TILES` of them, nearest scale first.
     let missing: HashSet<usize> = wanted.iter().filter(|w| w.3.is_some()).map(|w| w.0).collect();
@@ -2190,21 +2449,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         text_pages.extend(rest);
     }
     queue.extend(text_pages.into_iter().map(|page| RenderRequest { page, kind: RequestKind::Text, tile: None, scale: 1.0, tag: TEXT_TAG }));
-    if want_thumbs {
-        let s = THUMB_W * ppp / info.pages.iter().map(|p| p.width).fold(1.0, f32::max);
-        for page in 0..info.pages.len() {
-            if (!view.thumbs.contains_key(&page) || view.stale_thumbs.contains(&page)) && !view.errors.contains_key(&page) {
-                queue.push(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: s, tag: THUMB_TAG });
-            }
-        }
-    }
-    if queue != view.last_queue {
-        doc.renderer.set_queue(queue.clone());
-        view.last_queue = queue;
-    }
-    if !view.last_queue.is_empty() {
-        ui.ctx().request_repaint_after(std::time::Duration::from_millis(30));
-    }
+    view.frame_queue = queue;
+    view.frame_visible = visible_now.iter().copied().collect();
 
     if let Some((pos, text)) = hover_text {
         egui::Area::new(egui::Id::new("canvas-hover")).order(egui::Order::Tooltip).fixed_pos(pos + vec2(14.0, 16.0)).show(ui.ctx(), |ui| {
@@ -2985,17 +3231,7 @@ fn gap_button(ui: &mut egui::Ui, gap: usize, at: Pos2, height: f32, label: Strin
     resp.on_hover_text(label).clicked()
 }
 
-#[allow(clippy::too_many_arguments)]
-fn organize_grid(
-    view: &mut DocView,
-    info: &DocInfo,
-    pool: &RenderPool,
-    editable: bool,
-    dirty: bool,
-    auto_scroll_enabled: bool,
-    ui: &mut egui::Ui,
-    t: &Tokens,
-) {
+fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, auto_scroll_enabled: bool, ui: &mut egui::Ui, t: &Tokens) {
     let ppp = ui.ctx().pixels_per_point();
     // The page image scales with the zoom; the padding and the page number don't.
     let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 56.0);
@@ -3011,12 +3247,13 @@ fn organize_grid(
         Vec2::ZERO
     };
     let middle_gesture = view.auto_scroll.blocks_input();
-    let mut cells: Vec<(usize, Rect)> = Vec::with_capacity(info.pages.len());
+    let mut cells: Vec<(usize, Rect)> = Vec::new();
     // The pages in view that are drawn larger than their thumbnails, and those of them that
     // need a sharper render than they have.
     let (mut in_view, mut sharper): (Vec<usize>, Vec<RenderRequest>) = (Vec::new(), Vec::new());
-    let mut drop = false;
-    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+    // The source cell can scroll out of the virtualized rows during a drag.
+    let mut drop = view.org_drag.is_some() && ui.input(|i| i.pointer.primary_released());
+    egui::ScrollArea::vertical().auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
         if middle_gesture {
             let opacity = ui.opacity();
             ui.disable();
@@ -3029,12 +3266,14 @@ fn organize_grid(
         let cols = ((ui.available_width() - 40.0) / cell.x).floor().max(1.0) as usize;
         let rows = info.pages.len().div_ceil(cols);
         let left = (ui.available_width() - cols as f32 * cell.x) / 2.0;
-        for row in 0..rows {
-            let (row_rect, _) = ui.allocate_exact_size(vec2(ui.available_width(), cell.y), Sense::hover());
+        let (grid, _) = ui.allocate_exact_size(vec2(ui.available_width(), rows as f32 * cell.y), Sense::hover());
+        for row in thumbnail_rows(clip.top() - 20.0, clip.bottom() - 20.0, cell.y, rows) {
+            let row_rect = Rect::from_min_size(grid.min + vec2(0.0, row as f32 * cell.y), vec2(grid.width(), cell.y));
             for col in 0..cols {
                 let i = row * cols + col;
                 let Some(p) = info.pages.get(i) else { break };
                 let c = Rect::from_min_size(pos2(row_rect.left() + left + col as f32 * cell.x, row_rect.top()), cell);
+                view.need_thumbnail(i, c.intersects(ui.clip_rect()));
                 let resp = ui.interact(c, ui.id().with(("org", i)), if editable { Sense::click_and_drag() } else { Sense::click() });
                 cells.push((i, c));
                 if let Some((_, above)) = anchor.filter(|(page, _)| *page == i) {
@@ -3070,7 +3309,7 @@ fn organize_grid(
                 // A page drawn larger than its thumbnail gets a render at the size drawn, while
                 // it is in view; until that arrives the thumbnail stands in.
                 let want = size.x * ppp;
-                let thumb = view.thumbs.get(&i);
+                let thumb = view.thumbs.get(&i).map(|t| &t.tex);
                 let thumb_ok = thumb.is_some_and(|t| t.size()[0] as f32 >= want * GRID_SHARP.start());
                 let sharp = view.grid_pages.get(&i).filter(|_| !thumb_ok);
                 if !thumb_ok && ui.is_rect_visible(c) {
@@ -3127,6 +3366,7 @@ fn organize_grid(
                 }
             }
             if let Some((i, c)) = cells.last()
+                && i + 1 == info.pages.len()
                 && gap_button(ui, i + 1, pos2(c.right(), mid(c)), cell.y - 56.0, tl!("Insert a file at the end").to_string(), t)
             {
                 view.pending_action = Some(ViewAction::InsertFromFileAt(i + 1));
@@ -3207,15 +3447,8 @@ fn organize_grid(
     // Sharp renders are kept only for the pages in view, so their memory stays small however
     // long the document is. They come first; the thumbnails of the other pages follow.
     view.grid_pages.retain(|page, _| in_view.contains(page));
-    let s = THUMB_W * ppp / info.pages.iter().map(|p| p.width).fold(1.0, f32::max);
-    let thumbs = (0..info.pages.len())
-        .filter(|p| (!view.thumbs.contains_key(p) || view.stale_thumbs.contains(p)) && !view.errors.contains_key(p))
-        .map(|page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: s, tag: THUMB_TAG });
-    let queue: Vec<RenderRequest> = sharper.into_iter().chain(thumbs).collect();
-    if queue != view.last_queue {
-        pool.set_queue(queue.clone());
-        view.last_queue = queue;
-    }
+    // Sharp renders of the pages in view join this frame's demand ahead of the thumbnails.
+    view.frame_queue.extend(sharper);
     if let Some(p) = open_page {
         view.organize = false;
         view.go_to_page(p);
@@ -3285,6 +3518,345 @@ trailer << /Root 1 0 R >>
         DocView::new(DocId(1), &info, ViewDefaults { layout, ..Default::default() })
     }
 
+    fn thumbnail_info(count: usize) -> DocInfo {
+        DocInfo {
+            pages: (0..count)
+                .map(|i| {
+                    let (width, height) = match i % 3 {
+                        0 => (612.0, 792.0),
+                        1 => (200.0, 4000.0),
+                        _ => (4000.0, 200.0),
+                    };
+                    pdfcraft_render::PageInfo { width, height, label: (i + 1).to_string(), crop: [0.0, 0.0, width, height], rotation: 0 }
+                })
+                .collect(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn ten_thousand_pages_only_demand_viewport_and_prefetch_at_both_densities() {
+        let info = thumbnail_info(10_000);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        let cols = 4;
+        let rows = info.pages.len().div_ceil(cols);
+        for ppp in [1.0, 2.0] {
+            for row in [0, 1234, rows - 1] {
+                v.begin_render_frame();
+                let range = thumbnail_rows(row as f32 * 250.0, row as f32 * 250.0 + 750.0, 250.0, rows);
+                for p in range.start * cols..(range.end * cols).min(info.pages.len()) {
+                    v.need_thumbnail(p, p / cols == row);
+                }
+                let queue = v.prepare_render_queue(&info, ppp);
+                assert!(queue.len() <= 5 * cols, "only three visible rows and two prefetch rows");
+                assert_eq!(queue.first().unwrap().page / cols, row, "visible cells precede prefetch");
+                let bytes: usize = queue
+                    .iter()
+                    .map(|r| {
+                        let p = &info.pages[r.page];
+                        let (w, h) = (device_pixels(p.width, r.scale), device_pixels(p.height, r.scale));
+                        assert!(w <= (THUMB_W * ppp).ceil() as u32);
+                        assert!(h <= (THUMB_H * ppp).ceil() as u32);
+                        rgba_bytes(w as usize, h as usize)
+                    })
+                    .sum();
+                assert!(bytes <= THUMB_BYTES);
+                assert_eq!(queue, v.prepare_render_queue(&info, ppp), "unchanged demand reconstructs the same work");
+            }
+        }
+    }
+
+    #[test]
+    fn oversized_thumbnail_viewport_scales_all_admitted_cells_to_one_budget() {
+        let info = thumbnail_info(10_000);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        for page in 0..MAX_THUMB_DEMAND {
+            v.need_thumbnail(page, true);
+        }
+        let queue = v.prepare_render_queue(&info, 2.0);
+        assert_eq!(queue.len(), MAX_THUMB_DEMAND);
+        let bytes: usize = queue
+            .iter()
+            .map(|r| {
+                let p = &info.pages[r.page];
+                rgba_bytes(device_pixels(p.width, r.scale) as usize, device_pixels(p.height, r.scale) as usize)
+            })
+            .sum();
+        assert!(bytes <= THUMB_BYTES);
+    }
+
+    fn solid_result(request: RenderRequest, w: u32, h: u32) -> pdfcraft_render::RenderedPage {
+        pdfcraft_render::RenderedPage {
+            request,
+            width: w,
+            height: h,
+            rgba: pdfcraft_render::Pixels::from(vec![u32::MAX; rgba_bytes(w as usize, h as usize) / 4]),
+            text: None,
+            error: None,
+            millis: 0,
+        }
+    }
+
+    #[test]
+    fn thumbnails_release_on_scroll_panel_close_and_request_again_after_eviction() {
+        let ctx = egui::Context::default();
+        let info = thumbnail_info(10_000);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        v.need_thumbnail(0, true);
+        let first = v.prepare_render_queue(&info, 1.0);
+        v.last_queue = first.clone();
+        assert_eq!(v.receive_result(&ctx, solid_result(first[0], 132, 171)), 132 * 171 * 4);
+        assert!(v.prepare_render_queue(&info, 1.0).is_empty());
+        v.begin_render_frame();
+        v.need_thumbnail(9999, true);
+        v.prepare_render_queue(&info, 1.0);
+        assert!(v.thumbs.is_empty(), "jump releases old handles");
+        v.begin_render_frame();
+        v.need_thumbnail(0, true);
+        assert_eq!(v.prepare_render_queue(&info, 1.0), first, "an evicted result must be requested again");
+        v.begin_render_frame();
+        assert!(v.prepare_render_queue(&info, 1.0).is_empty(), "closing consumers cancels thumbnail work");
+    }
+
+    #[test]
+    fn stale_results_are_rejected_before_conversion_after_dpi_invalidation_and_suspend() {
+        let ctx = egui::Context::default();
+        let info = thumbnail_info(1);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        v.need_thumbnail(0, true);
+        let first = v.prepare_render_queue(&info, 1.0)[0];
+        v.last_queue = v.prepare_render_queue(&info, 2.0);
+        // Valid pixels: only the request gate can keep these out (a size check can't).
+        let obsolete = || solid_result(first, 132, 171);
+        assert_eq!(v.receive_result(&ctx, obsolete()), 0);
+        assert!(v.thumbs.is_empty(), "a result for the old DPI is not uploaded");
+        // The same result is uploaded while its request is current.
+        v.last_queue = vec![first];
+        assert_eq!(v.receive_result(&ctx, obsolete()), 132 * 171 * 4);
+        v.thumbs.clear();
+        v.invalidate_content();
+        assert_eq!(v.receive_result(&ctx, obsolete()), 0);
+        assert!(v.thumbs.is_empty(), "nor after the content changed");
+        let pool = RenderPool::new_inline(Arc::new(Vec::new()), Default::default());
+        v.last_queue = vec![first];
+        v.suspend_rendering(&pool);
+        assert_eq!(v.receive_result(&ctx, obsolete()), 0);
+        assert!(v.thumbs.is_empty(), "nor after the tab was suspended");
+    }
+
+    #[test]
+    fn editing_after_layout_preserves_stale_page_until_replacement() {
+        let ctx = egui::Context::default();
+        let info = thumbnail_info(1);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        let req = RenderRequest { scale: 1.0, tag: 1000, ..Default::default() };
+        v.last_queue = vec![req];
+        v.receive_result(&ctx, solid_result(req, 10, 10));
+        v.frame_queue = vec![req];
+        v.page_changed(0);
+        assert_eq!(v.prepare_render_queue(&info, 1.0), vec![req]);
+        assert_eq!(v.pages.get(&0).unwrap().tag, STALE_TAG);
+    }
+
+    #[test]
+    fn page_and_tile_admission_accounts_for_bytes_before_count_limits() {
+        let mut info = thumbnail_info(40);
+        for p in &mut info.pages {
+            p.width = 4000.0;
+            p.height = 4000.0;
+        }
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        v.frame_queue = (0..40).map(|page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() }).collect();
+        let queue = v.prepare_render_queue(&info, 1.0);
+        assert_eq!(queue.len(), 2, "128 MiB admits two 4000-square pages, not 24");
+        v.frame_queue = (0..40)
+            .map(|page| RenderRequest { page, scale: 1.0, tag: 1000, tile: Some(Tile { x: 0, y: 0, w: 1024, h: 1024 }), ..Default::default() })
+            .collect();
+        assert_eq!(v.prepare_render_queue(&info, 1.0).len(), 32);
+        assert!(!v.admit_texture(RenderRequest::default(), PAGE_BYTES + 1));
+    }
+
+    #[test]
+    fn on_screen_pages_and_tiles_are_admitted_beyond_the_prefetch_allowance() {
+        let ctx = egui::Context::default();
+        let mut info = thumbnail_info(40);
+        for p in &mut info.pages {
+            p.width = 2000.0;
+            p.height = 2000.0;
+        }
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        // Ten 16 MB pages on screen (a zoomed-out HiDPI view) exceed the 128 MiB allowance.
+        v.frame_visible = (0..10).collect();
+        v.frame_queue = (0..40).map(|page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() }).collect();
+        let queue = v.prepare_render_queue(&info, 1.0);
+        let pages: Vec<usize> = queue.iter().map(|r| r.page).collect();
+        assert_eq!(pages, (0..10).collect::<Vec<_>>(), "every on-screen page, and no prefetch past the allowance");
+        v.last_queue = queue.clone();
+        for req in &queue {
+            assert!(v.receive_result(&ctx, solid_result(*req, 2000, 2000)) > 0, "on-screen page {} uploaded", req.page);
+        }
+        assert_eq!(v.pages.len(), 10, "none evicted another on-screen page");
+        // A 5K viewport needs more 1024-pixel tiles than the tile allowance holds.
+        v.frame_queue = (0..40)
+            .map(|x| RenderRequest { page: 0, scale: 1.0, tag: 1000, tile: Some(Tile { x: x * TILE, y: 0, w: 1024, h: 1024 }), ..Default::default() })
+            .collect();
+        assert_eq!(v.prepare_render_queue(&info, 1.0).len(), 40);
+    }
+
+    #[test]
+    fn a_page_turned_back_to_is_still_cached() {
+        let ctx = egui::Context::default();
+        let info = thumbnail_info(10);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        let req = |page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() };
+        v.frame_visible = [0].into();
+        v.frame_queue = vec![req(0)];
+        v.last_queue = v.prepare_render_queue(&info, 1.0);
+        v.receive_result(&ctx, solid_result(req(0), 100, 130));
+        // Single-page view moves on to page 1: page 0 is no longer demanded.
+        v.begin_render_frame();
+        v.current = 1;
+        v.frame_visible = [1].into();
+        v.frame_queue = vec![req(1)];
+        assert_eq!(v.prepare_render_queue(&info, 1.0), vec![req(1)]);
+        assert!(v.pages.contains_key(&0), "kept while the allowance has room");
+        // And back: nothing to render.
+        v.begin_render_frame();
+        v.current = 0;
+        v.frame_visible = [0].into();
+        v.frame_queue = vec![req(0)];
+        assert!(v.prepare_render_queue(&info, 1.0).is_empty());
+    }
+
+    #[test]
+    fn thumbnail_tags_do_not_change_as_a_row_scrolls_in_or_out() {
+        let info = thumbnail_info(10_000);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        let tags = |v: &mut DocView, cells: usize| {
+            v.begin_render_frame();
+            for page in 0..cells {
+                v.need_thumbnail(page, true);
+            }
+            v.thumbnail_requests(&info, 2.0).into_iter().map(|r| (r.page, r.tag)).collect::<HashMap<_, _>>()
+        };
+        // 2x on a large screen: about 70 cells, give or take a row of six.
+        let (a, b) = (tags(&mut v, 70), tags(&mut v, 76));
+        assert!((0..70).all(|p| a[&p] == b[&p]), "a row more or less re-renders nothing");
+    }
+
+    #[test]
+    fn many_open_documents_share_one_raster_allowance_and_close_releases_handles() {
+        let ctx = egui::Context::default();
+        let mut app = PdfCraftApp::new();
+        let bytes = app.session.create_blank(612.0, 792.0, 1).unwrap();
+        for index in 0..6 {
+            app.open_bytes(&format!("synthetic-{index}.pdf"), None, bytes.as_ref().clone()).unwrap();
+            let view = app.views.last_mut().unwrap();
+            let request = RenderRequest { tag: THUMB_TAG, ..Default::default() };
+            view.last_queue = vec![request];
+            view.receive_result(&ctx, solid_result(request, 132, 171));
+            view.need_thumbnail(0, true);
+        }
+        app.finish_render_frame(&ctx);
+        let total: usize = app.views.iter().map(|v| v.thumbs.values().map(|p| texture_bytes(&p.tex)).sum::<usize>()).sum();
+        assert!(total <= 132 * 171 * 4);
+        assert!(app.views.iter().take(5).all(|v| v.thumbs.is_empty() && v.last_queue.is_empty()));
+        app.close_tab(5);
+        assert!(app.views.iter().all(|v| v.thumbs.is_empty()));
+    }
+
+    #[test]
+    fn suspended_signature_preview_releases_layers_and_rebuilds_without_editing() {
+        let ctx = egui::Context::default();
+        let mut png = std::io::Cursor::new(Vec::new());
+        image::RgbaImage::from_pixel(12, 4, image::Rgba([20, 30, 40, 255])).write_to(&mut png, image::ImageFormat::Png).unwrap();
+        let image = pdfcraft_engine::SignatureImage::from_bytes(png.get_ref()).unwrap();
+        let mut session = pdfcraft_engine::Session::new();
+        let blank = session.create_blank(300.0, 400.0, 1).unwrap();
+        let id = session.open_new("signature-preview.pdf", blank).unwrap();
+        let info = session.get(id).unwrap().info.pages[0].clone();
+        session.apply(id, image.edit(0, &info, [20.0, 100.0], false, "Test").unwrap()).unwrap();
+        let doc = session.get(id).unwrap();
+        let bytes = doc.bytes.clone();
+        let generation = doc.edit_generation();
+        let mut v = DocView::new(id, &doc.info, ViewDefaults::default());
+        v.comments.selected = Some((0, 0));
+        v.signature_drag.prepare(&ctx, doc, v.comments.selected, 1.0);
+        assert!(v.signature_drag.contains(0, 0));
+
+        v.suspend_rendering(&doc.renderer);
+        assert!(!v.signature_drag.contains(0, 0), "inactive tabs release the preview pool and textures");
+        assert_eq!(v.comments.selected, Some((0, 0)), "the user's selection survives suspension");
+        v.signature_drag.prepare(&ctx, doc, v.comments.selected, 1.0);
+        assert!(v.signature_drag.contains(0, 0), "reactivating the view rebuilds the selected image's preview");
+        assert!(Arc::ptr_eq(&bytes, &doc.bytes));
+        assert_eq!(doc.edit_generation(), generation);
+        assert_eq!(doc.can_undo(), Some("Add signature"));
+        assert!(doc.dirty);
+    }
+
+    #[test]
+    fn virtualized_organizer_keeps_insert_gaps_at_document_positions() {
+        use egui_kittest::kittest::Queryable;
+
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
+            let mut app = PdfCraftApp::new();
+            let bytes = app.session.create_blank(300.0, 400.0, 100).unwrap();
+            app.open_bytes("organize-gaps.pdf", None, bytes.as_ref().clone()).unwrap();
+            app.views[0].organize = true;
+            app
+        });
+        h.run_steps(4);
+        assert!(h.state().views[0].thumb_demand.len() < 50);
+        assert_eq!(h.query_all_by_label("Insert a file at the end").count(), 0, "the last virtualized cell is not the final page");
+        let center = h.state().views[0].viewport_rect().center();
+        h.hover_at(center);
+        h.event(egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, -100_000.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+        });
+        // Well past egui's longest scroll animation (about 0.3 s).
+        h.run_steps(40);
+        h.get_by_label("Insert a file at the end");
+        let before_last = h.get_by_label("Insert a file before page 100").rect().center();
+        h.hover_at(before_last);
+        h.run_steps(2);
+        assert_eq!(h.state().views[0].grid_gap, Some(99), "external drops use the document index after virtualized scrolling");
+        assert!(h.state().views[0].thumb_demand.len() < 50);
+    }
+
+    #[test]
+    fn real_shell_pages_organizer_and_print_only_collect_current_thumbnail_consumers() {
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
+            let mut app = PdfCraftApp::new();
+            let bytes = app.session.create_blank(612.0, 792.0, 10_000).unwrap();
+            app.open_bytes("synthetic-ten-thousand.pdf", None, bytes.as_ref().clone()).unwrap();
+            app.right = Some(RightPanel::Pages);
+            app
+        });
+        h.run_steps(4);
+        assert!((1..20).contains(&h.state().views[0].thumb_demand.len()));
+        h.state_mut().right = None;
+        h.state_mut().views[0].organize = true;
+        h.run_steps(2);
+        assert!((1..50).contains(&h.state().views[0].thumb_demand.len()));
+        h.state_mut().views[0].organize = false;
+        h.state_mut().dialog = Some(crate::Dialog::Print);
+        h.state_mut().print_draft.sheet = 9999;
+        h.run_steps(2);
+        assert_eq!(h.state().views[0].thumb_demand.keys().copied().collect::<Vec<_>>(), vec![9999]);
+        h.state_mut().print_draft.handling = crate::PrintHandling::Booklet;
+        h.state_mut().print_draft.sheet = 0;
+        h.run_steps(2);
+        assert_eq!(h.state().views[0].thumb_demand.len(), 2, "booklet only needs its two placed pages");
+        h.state_mut().dialog = None;
+        h.run_steps(2);
+        assert!(h.state().views[0].thumb_demand.is_empty());
+        assert!(h.state().views[0].thumbs.is_empty());
+    }
+
     /// One mouse-wheel notch (a line) at `at` seconds.
     fn notch(v: &mut DocView, dy: f32, at: f64) -> bool {
         v.single_page_wheel(egui::MouseWheelUnit::Line, dy, egui::TouchPhase::Move, at, true)
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 37bdb425..4e80e52d 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -557,6 +557,7 @@ impl Host for crate::PdfCraftApp {
                 // Pages picked in the organize grid or the Pages panel (empty: the current page).
                 "selected_pages": v.selected.iter().map(|p| p + 1).collect::<Vec<_>>(),
                 "auto_scrolling": v.auto_scrolling(),
+                "raster_memory": v.raster_memory(),
                 "viewport": [v.viewport_rect().min.x, v.viewport_rect().min.y, v.viewport_rect().max.x, v.viewport_rect().max.y],
                 "find_open": v.find.is_some(),
                 "page_errors": v.page_errors().iter().map(|(p, e)| json!({ "page": p + 1, "error": e })).collect::<Vec<_>>(),
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index dd9a7889..914bec30 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -774,9 +774,11 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 let Some(doc) = app.session.get(id) else { return };
                 let sizes: Vec<(f64, f64)> = doc.info.pages.iter().map(|p| (p.width as f64, p.height as f64)).collect();
                 let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
-                let thumbs: std::collections::HashMap<usize, egui::TextureId> =
-                    (0..sizes.len()).filter_map(|p| app.views[i].thumb_id(p).map(|t| (p, t))).collect();
-                let (go, cancel) = crate::print_ui::body(ui, &mut app.print_draft, &t, &sizes, &labels, &|p| thumbs.get(&p).copied());
+                let view = &mut app.views[i];
+                let (go, cancel) = crate::print_ui::body(ui, &mut app.print_draft, &t, &sizes, &labels, &mut |p| {
+                    view.need_thumbnail(p, true);
+                    view.thumb_id(p)
+                });
                 print_go = go;
                 close = go || cancel;
                 return;
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 5447c2cb..6694c4f4 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -113,7 +113,7 @@ mod widgets;
 
 use pdfcraft_engine::{DocId, Session};
 
-pub use canvas::DocView;
+pub use canvas::{DocView, RasterMemory};
 pub use editing::{CloseRequest, SaveTarget};
 pub use files::{ExtractDraft, FilePurpose, FileRequest, RotateDraft, SplitDraft, SplitMode, SplitPlan};
 pub use recovery::{AUTOSAVE_SECS, RecoveryMeta, RecoveryStore};
@@ -1762,12 +1762,6 @@ impl eframe::App for PdfCraftApp {
         self.process_file_requests();
         #[cfg(not(target_arch = "wasm32"))]
         self.process_picked();
-        // Pull finished renders into textures for every open document.
-        for view in &mut self.views {
-            if let Some(doc) = self.session.get(view.id) {
-                view.receive(ctx, &doc.renderer);
-            }
-        }
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
@@ -1778,6 +1772,9 @@ impl eframe::App for PdfCraftApp {
             ctx.request_repaint();
             return;
         }
+        for view in &mut self.views {
+            view.begin_render_frame();
+        }
         // The window shows the active document's name (or title, if it asks for that).
         let title = self
             .active
@@ -1804,6 +1801,7 @@ impl eframe::App for PdfCraftApp {
             // Notices too: a refused field value or a failed save must be seen in full screen.
             self.show_progress(&ctx);
             widgets::toast(self, &ctx);
+            self.finish_render_frame(&ctx);
             return;
         }
         chrome::tab_strip(self, ui);
@@ -1828,5 +1826,25 @@ impl eframe::App for PdfCraftApp {
         dialogs::show(self, &ctx);
         self.show_progress(&ctx);
         widgets::toast(self, &ctx);
+        self.finish_render_frame(&ctx);
+    }
+}
+
+impl PdfCraftApp {
+    fn finish_render_frame(&mut self, ctx: &egui::Context) {
+        // Retire hidden documents before admitting the visible document's textures, so the
+        // three cache limits apply to the application, regardless of how many tabs are open.
+        for (i, view) in self.views.iter_mut().enumerate() {
+            if Some(i) != self.active
+                && let Some(doc) = self.session.get(view.id)
+            {
+                view.suspend_rendering(&doc.renderer);
+            }
+        }
+        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
+            && let Some(doc) = self.session.get(view.id)
+        {
+            view.finish_render_frame(ctx, &doc.info, &doc.renderer);
+        }
     }
 }
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 738d61de..010e9588 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -917,6 +917,9 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
             let sense = if editable { Sense::click_and_drag() } else { Sense::click() };
             let (rect, resp) = ui.allocate_exact_size(vec2(w + 16.0, h + 16.0), sense);
             rows.push(rect);
+            if rect.intersects(ui.clip_rect().expand(200.0)) {
+                view.need_thumbnail(i, rect.intersects(ui.clip_rect()));
+            }
             // Only the primary button drags pages (the middle button scrolls, the secondary one opens the menu).
             if resp.drag_started_by(egui::PointerButton::Primary) {
                 if !view.target_pages().contains(&i) {
diff --git a/crates/ui-egui/src/print_ui.rs b/crates/ui-egui/src/print_ui.rs
index 88488ad6..1d6a3efd 100644
--- a/crates/ui-egui/src/print_ui.rs
+++ b/crates/ui-egui/src/print_ui.rs
@@ -341,7 +341,7 @@ pub(crate) fn body(
     t: &Tokens,
     sizes: &[(f64, f64)],
     labels: &[String],
-    thumb: &dyn Fn(usize) -> Option<egui::TextureId>,
+    thumb: &mut dyn FnMut(usize) -> Option<egui::TextureId>,
 ) -> (bool, bool) {
     ui.set_width(820.0);
     ui.label(egui::RichText::new(tl!("Print")).font(theme::semibold(18.0)));
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 28f62419..e4833f62 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -163,6 +163,50 @@ fn start_autoscroll(h: &mut Harness<'static, PdfCraftApp>, c: &ControlClient) ->
     p
 }
 
+/// Measure document movement from rendered geometry without requiring an offscreen grid
+/// cell to remain instantiated. Learn the grid's column count and row pitch before scrolling;
+/// any currently rendered cell then identifies the same content origin. This tests actual
+/// layout displacement, independently of the autoscroll velocity calculation.
+#[cfg(target_os = "linux")]
+struct CanvasPosition {
+    grid: Option<(usize, f32)>,
+}
+
+#[cfg(target_os = "linux")]
+impl CanvasPosition {
+    fn new(h: &Harness<'static, PdfCraftApp>) -> Self {
+        let grid = h.state().views[0].organize.then(|| {
+            let first = h.get_by_label("Page 1").rect().top();
+            let (page, next_row) = Self::grid_cells(h).into_iter().find(|(_, top)| *top > first + 1.0).expect("a second grid row");
+            (page - 1, next_row - first)
+        });
+        Self { grid }
+    }
+
+    fn grid_cells(h: &Harness<'static, PdfCraftApp>) -> Vec<(usize, f32)> {
+        use egui_kittest::kittest::NodeT;
+        let mut cells: Vec<_> = h
+            .query_all_by_label_contains("Page ")
+            .filter_map(|node| {
+                let page = node.accesskit_node().label()?.strip_prefix("Page ")?.parse::<usize>().ok()?;
+                Some((page, node.rect().top()))
+            })
+            .collect();
+        cells.sort_unstable_by_key(|(page, _)| *page);
+        cells
+    }
+
+    fn top(&self, h: &Harness<'static, PdfCraftApp>) -> f32 {
+        match self.grid {
+            Some((columns, row_pitch)) => {
+                let (page, top) = Self::grid_cells(h).into_iter().next().expect("a rendered grid cell");
+                top - ((page - 1) / columns) as f32 * row_pitch
+            }
+            None => h.state().views[0].page_screen_rect(0).expect("the zoomed viewer page remains visible").top(),
+        }
+    }
+}
+
 #[cfg(target_os = "linux")]
 #[test]
 fn middle_click_autoscroll_latches_has_a_dead_zone_and_scrolls_both_directions() {
@@ -245,14 +289,12 @@ fn autoscroll_uses_the_initial_click_position_when_input_arrives_in_one_frame()
 #[cfg(target_os = "linux")]
 #[test]
 fn farther_from_the_click_scrolls_faster_in_the_viewer_and_page_grid() {
-    use egui_kittest::kittest::Queryable;
     for organize in [false, true] {
         let (mut h, c) = harness_pages(40);
         h.state_mut().views[0].organize = organize;
         h.run_steps(3);
-        let top = |h: &Harness<'static, PdfCraftApp>| {
-            if organize { h.get_by_label("Page 1").rect().top() } else { h.state().views[0].page_screen_rect(0).unwrap().top() }
-        };
+        let position = CanvasPosition::new(&h);
+        let top = |h: &Harness<'static, PdfCraftApp>| position.top(h);
         let p = start_autoscroll(&mut h, &c);
         ok(&mut h, &c, "ui.move", json!({ "x": p.x, "y": p.y + 30.0 }));
         let before_near = top(&h);
@@ -276,7 +318,6 @@ fn farther_from_the_click_scrolls_faster_in_the_viewer_and_page_grid() {
 #[cfg(target_os = "linux")]
 #[test]
 fn autoscroll_uses_elapsed_frame_time_and_preserves_fractional_motion_in_both_views() {
-    use egui_kittest::kittest::Queryable;
     for (organize, scale, zoom) in [(false, 1.0, "100"), (false, 2.0, "100"), (false, 1.0, "400"), (true, 1.0, "100"), (true, 2.0, "100")] {
         for frames in [30, 60, 120, 144] {
             let (mut h, c) = harness_pages(40);
@@ -285,9 +326,8 @@ fn autoscroll_uses_elapsed_frame_time_and_preserves_fractional_motion_in_both_vi
             h.state_mut().views[0].organize = organize;
             h.run_steps(3);
             assert_eq!(h.ctx.pixels_per_point(), scale);
-            let top = |h: &Harness<'static, PdfCraftApp>| {
-                if organize { h.get_by_label("Page 1").rect().top() } else { h.state().views[0].page_screen_rect(0).unwrap().top() }
-            };
+            let position = CanvasPosition::new(&h);
+            let top = |h: &Harness<'static, PdfCraftApp>| position.top(h);
             let step = |h: &mut Harness<'static, PdfCraftApp>| {
                 // Deliberately differ from the harness's predicted frame interval: scrolling
                 // must follow the elapsed time rather than the display's predicted rate.
@@ -421,15 +461,15 @@ fn the_click_that_stops_autoscroll_preserves_the_page_selection() {
 #[cfg(target_os = "linux")]
 #[test]
 fn organize_pages_supports_autoscroll_without_selecting_or_reordering_pages() {
-    use egui_kittest::kittest::Queryable;
     let (mut h, c) = harness_pages(40);
     h.state_mut().execute("page.organize");
     h.run_steps(3);
-    let top = h.get_by_label("Page 1").rect().top();
+    let position = CanvasPosition::new(&h);
+    let top = position.top(&h);
     let p = start_autoscroll(&mut h, &c);
     ok(&mut h, &c, "ui.move", json!({ "x": p.x, "y": p.y + 80.0 }));
     h.run_steps(8);
-    assert!(h.get_by_label("Page 1").rect().top() < top - 30.0, "the organize grid scrolls");
+    assert!(position.top(&h) < top - 30.0, "the organize grid scrolls");
     assert!(h.state().views[0].selected.is_empty());
     assert!(h.state().views[0].org_drag.is_none());
     ok(&mut h, &c, "ui.key", json!({ "key": "Escape" }));
diff --git a/vendor/README.md b/vendor/README.md
index 636f6029..6c06cdcd 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -12,7 +12,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite) | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax) |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices` |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
diff --git a/vendor/hayro-syntax/src/data.rs b/vendor/hayro-syntax/src/data.rs
index 5c5a6b44..9d5e2030 100644
--- a/vendor/hayro-syntax/src/data.rs
+++ b/vendor/hayro-syntax/src/data.rs
@@ -67,6 +67,7 @@ pub(crate) struct Data {
     // 32 segments are more than enough as we can't have more objects than this.
     decoded: SegmentList<Option<Vec<u8>>, 32>,
     map: Mutex<HashMap<ObjectIdentifier, usize>>,
+    loading: LoadGate,
 }
 
 impl Debug for Data {
@@ -82,6 +83,7 @@ impl Data {
             data,
             decoded: SegmentList::new(),
             map: Mutex::new(HashMap::new()),
+            loading: LoadGate::default(),
         }
     }
 
@@ -92,22 +94,171 @@ impl Data {
 
     /// Get access to the data of a decoded object stream.
     pub(crate) fn get_with(&self, id: ObjectIdentifier, ctx: &ReaderContext<'_>) -> Option<&[u8]> {
-        if let Some(&idx) = self.map.get().get(&id) {
-            self.decoded.get(idx)?.as_deref()
-        } else {
-            // Block scope to keep the lock short-lived.
-            let idx = {
-                let mut locked = self.map.get();
-                let idx = locked.len();
-                locked.insert(id, idx);
-                idx
-            };
-            self.decoded
-                .get_or_init(idx, || {
-                    let stream = ctx.xref().get_with::<Stream<'_>>(id, ctx)?;
-                    stream.decoded().ok().map(Cow::into_owned)
+        // PdfCraft patch: (#307, see vendor/README.md hayro-syntax (10)) register exactly once:
+        // racing misses must not allocate different slots
+        // for the same id (or reuse the resulting hole for another stream).
+        let idx = {
+            let mut map = self.map.get();
+            let next = map.len();
+            *map.entry(id).or_insert(next)
+        };
+        if let Some(decoded) = self.decoded.get(idx) {
+            return decoded.as_deref();
+        }
+        // Only cold initialization is serialized. Nested streams may depend on
+        // one another; the gate rejects cycles without blocking on our own cell.
+        let _loading = self.loading.enter(id)?;
+        self.decoded
+            .get_or_init(idx, || {
+                let stream = ctx.xref().get_with::<Stream<'_>>(id, ctx)?;
+                stream.decoded().ok().map(Cow::into_owned)
+            })?
+            .as_deref()
+    }
+}
+
+/// PdfCraft patch: (#307) one cold initializer at a time prevents cross-thread dependency deadlocks.
+/// The owner may recursively load different streams, up to a fixed depth. No
+/// state mutex is held while parsing or decoding input. no_std is single-threaded
+/// (its Arc/locks are Rc/RefCell), so it needs the same cycle/depth checks only.
+#[derive(Default)]
+struct LoadGate {
+    state: Mutex<LoadState>,
+    #[cfg(feature = "std")]
+    ready: std::sync::Condvar,
+}
+
+#[derive(Default)]
+struct LoadState {
+    active: Vec<ObjectIdentifier>,
+    #[cfg(feature = "std")]
+    owner: Option<std::thread::ThreadId>,
+    failed: bool,
+}
+
+impl LoadGate {
+    fn enter(&self, id: ObjectIdentifier) -> Option<LoadGuard<'_>> {
+        let mut state = self.state.get();
+        #[cfg(feature = "std")]
+        while !state.failed
+            && state
+                .owner
+                .is_some_and(|owner| owner != std::thread::current().id())
+        {
+            state = self.ready.wait(state).unwrap_or_else(|p| p.into_inner());
+        }
+        if state.failed || state.active.len() >= 64 || state.active.contains(&id) {
+            return None;
+        }
+        #[cfg(feature = "std")]
+        {
+            state.owner = Some(std::thread::current().id());
+        }
+        state.active.push(id);
+        Some(LoadGuard(self))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn recursive_loads_reject_cycles_and_limit_depth() {
+        let gate = LoadGate::default();
+        let mut guards = Vec::new();
+        for n in 0..64 {
+            guards.push(
+                gate.enter(ObjectIdentifier::new(n, 0))
+                    .expect("nested distinct stream"),
+            );
+        }
+        assert!(gate.enter(ObjectIdentifier::new(64, 0)).is_none());
+        assert!(gate.enter(ObjectIdentifier::new(0, 0)).is_none());
+        while guards.pop().is_some() {}
+        assert!(gate.enter(ObjectIdentifier::new(0, 0)).is_some());
+    }
+
+    #[cfg(feature = "std")]
+    #[test]
+    fn competing_dependency_chains_cannot_wait_on_each_other() {
+        let gate = Arc::new(LoadGate::default());
+        let barrier = Arc::new(std::sync::Barrier::new(16));
+        let jobs: Vec<_> = (0..16)
+            .map(|n| {
+                let gate = gate.clone();
+                let barrier = barrier.clone();
+                std::thread::spawn(move || {
+                    barrier.wait();
+                    let (a, b) = (
+                        ObjectIdentifier::new(n % 2, 0),
+                        ObjectIdentifier::new(1 - n % 2, 0),
+                    );
+                    let _a = gate.enter(a).unwrap();
+                    let _b = gate.enter(b).unwrap();
+                    assert!(gate.enter(a).is_none());
                 })
-                .as_deref()
+            })
+            .collect();
+        for job in jobs {
+            job.join().unwrap();
+        }
+    }
+
+    #[cfg(feature = "std")]
+    #[test]
+    fn panicking_initializer_wakes_waiters_and_prevents_retries() {
+        use std::{
+            panic::{AssertUnwindSafe, catch_unwind},
+            sync::mpsc,
+            time::Duration,
+        };
+        let gate = Arc::new(LoadGate::default());
+        let (ready_tx, ready_rx) = mpsc::channel();
+        let (done_tx, done_rx) = mpsc::channel();
+        let mut jobs = Vec::new();
+        let result = catch_unwind(AssertUnwindSafe(|| {
+            let _guard = gate.enter(ObjectIdentifier::new(1, 0)).unwrap();
+            for _ in 0..8 {
+                let (gate, ready, done) = (gate.clone(), ready_tx.clone(), done_tx.clone());
+                jobs.push(std::thread::spawn(move || {
+                    ready.send(()).unwrap();
+                    done.send(gate.enter(ObjectIdentifier::new(2, 0)).is_none())
+                        .unwrap();
+                }));
+            }
+            for _ in 0..8 {
+                ready_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+            }
+            panic!("injected decode failure");
+        }));
+        assert!(result.is_err());
+        for _ in 0..8 {
+            assert!(done_rx.recv_timeout(Duration::from_secs(2)).unwrap());
+        }
+        for job in jobs {
+            job.join().unwrap();
+        }
+        assert!(gate.enter(ObjectIdentifier::new(1, 0)).is_none());
+        assert!(gate.enter(ObjectIdentifier::new(3, 0)).is_none());
+    }
+}
+
+struct LoadGuard<'a>(&'a LoadGate);
+
+impl Drop for LoadGuard<'_> {
+    fn drop(&mut self) {
+        let mut state = self.0.state.get();
+        state.active.pop();
+        #[cfg(feature = "std")]
+        {
+            // OnceLock itself permits a retry after a panic. The parser does not:
+            // wake all waiters and fail closed until the caller replaces the Pdf.
+            state.failed |= std::thread::panicking();
+            if state.active.is_empty() {
+                state.owner = None;
+            }
+            self.0.ready.notify_all();
         }
     }
 }
diff --git a/vendor/hayro-syntax/src/object/dict.rs b/vendor/hayro-syntax/src/object/dict.rs
index 10424eda..55ea355e 100644
--- a/vendor/hayro-syntax/src/object/dict.rs
+++ b/vendor/hayro-syntax/src/object/dict.rs
@@ -6,8 +6,9 @@ use crate::object::{Name, ObjectIdentifier};
 use crate::object::{Object, ObjectLike};
 use crate::reader::Reader;
 use crate::reader::{Readable, ReaderContext, ReaderExt, Skippable};
-use crate::sync::Arc;
 use crate::sync::FxHashMap;
+use crate::sync::{Arc, OnceLock};
+use alloc::boxed::Box;
 use alloc::format;
 use alloc::vec::Vec;
 use core::fmt::{Debug, Formatter};
@@ -128,10 +129,27 @@ impl<'a> Dict<'a> {
         }
     }
 
-    fn offsets(&self) -> Option<&FxHashMap<Name<'a>, usize>> {
+    fn offsets(&self) -> Option<&FxHashMap<Name<'static>, usize>> {
         match &self.0 {
             Inner::Empty => None,
-            Inner::Some(repr) => Some(&repr.offsets),
+            Inner::Some(repr) => Some(repr.offsets.get_or_init(|| {
+                // PdfCraft patch: (#307) large resource dictionaries are read for every
+                // page at open, but most are never looked up. Index them only on demand.
+                // The first pass already validated the same immutable bytes with this
+                // context. Keep the same parser, including duplicate-key and repair rules.
+                let mut offsets = new_offsets();
+                let mut reader = Reader::new(repr.data);
+                let (start, end): (Option<&[u8]>, &[u8]) = if repr.inline {
+                    (None, b"ID")
+                } else {
+                    (Some(b"<<"), b">>")
+                };
+                let _ = parse_dict_with(&mut reader, &repr.ctx, start, end, |name, offset, _| {
+                    offsets.insert(name.into_owned(), offset);
+                    Some(())
+                });
+                offsets
+            })),
         }
     }
 }
@@ -190,36 +208,114 @@ impl<'a> Readable<'a> for Dict<'a> {
     }
 }
 
+// PdfCraft patch: (#307) retain the fast single-pass index for ordinary small
+// dictionaries. Above this entry count, validate without retaining a hash table.
+const EAGER_DICT_ENTRIES: usize = 32;
+
+fn new_offsets() -> FxHashMap<Name<'static>, usize> {
+    #[cfg(feature = "std")]
+    return FxHashMap::with_capacity_and_hasher(8, rustc_hash::FxBuildHasher);
+    #[cfg(not(feature = "std"))]
+    FxHashMap::new()
+}
+
+pub(crate) type SharedIndex = Arc<OnceLock<FxHashMap<Name<'static>, usize>>>;
+
+#[derive(Debug)]
+pub(crate) struct CachedDict {
+    data: Box<[u8]>,
+    offsets: SharedIndex,
+}
+
+// PdfCraft patch: share a validated large dictionary's index across pages. The cache
+// belongs to the xref, owns its keys, and is bounded even on documents with many unique
+// dictionaries. Comparing the bytes also makes address reuse harmless. No reader context
+// is cached: decryption, object identity and reference-cycle tracking stay with each read.
+#[derive(Debug, Default)]
+pub(crate) struct DictCache {
+    entries: FxHashMap<usize, Arc<CachedDict>>,
+    bytes: usize,
+}
+
+impl DictCache {
+    fn get(&self, data: &[u8]) -> Option<Arc<CachedDict>> {
+        self.entries
+            .get(&(data.as_ptr() as usize))
+            .filter(|cached| data.starts_with(&cached.data))
+            .cloned()
+    }
+
+    fn insert(&mut self, data: &[u8], offsets: SharedIndex) {
+        const MAX_BYTES: usize = 8 << 20;
+        if self.entries.len() < 256 && data.len() <= MAX_BYTES.saturating_sub(self.bytes) {
+            self.bytes += data.len();
+            self.entries.insert(
+                data.as_ptr() as usize,
+                Arc::new(CachedDict {
+                    data: data.into(),
+                    offsets,
+                }),
+            );
+        }
+    }
+}
+
 fn read_inner<'a>(
     r: &mut Reader<'a>,
     ctx: &ReaderContext<'a>,
     start_tag: Option<&[u8]>,
     end_tag: &[u8],
 ) -> Option<Dict<'a>> {
-    // TODO: Figure out how to
-    // 1) Make dictionaries easily cloneable without wrapping in Arc.
-    // 2) Maybe have an efficient per-document allocator pool for hashmaps
-    // that can be reused.
-    #[cfg(feature = "std")]
-    let mut offsets = FxHashMap::with_capacity_and_hasher(8, rustc_hash::FxBuildHasher);
-    #[cfg(not(feature = "std"))]
-    let mut offsets = FxHashMap::new();
+    let cacheable = start_tag.is_some() && !ctx.in_content_stream();
+    if cacheable {
+        let tail = r.tail()?;
+        if let Some(cached) = ctx
+            .xref()
+            .with_dict_cache(|cache| cache.get(tail))
+            .flatten()
+        {
+            let data = r.read_bytes(cached.data.len())?;
+            return Some(Dict(Inner::Some(Arc::new(Repr {
+                data,
+                offsets: cached.offsets.clone(),
+                inline: false,
+                ctx: ctx.clone(),
+            }))));
+        }
+    }
+    let mut offsets = Some(new_offsets());
 
-    let data = parse_dict_with(
+    let (data, repaired) = parse_dict_with(
         r,
         ctx,
         start_tag,
         end_tag,
         #[inline]
         |name, offset, _| {
-            offsets.insert(name, offset);
+            if let Some(index) = &mut offsets {
+                index.insert(name.into_owned(), offset);
+                if index.len() > EAGER_DICT_ENTRIES {
+                    offsets = None;
+                }
+            }
             Some(())
         },
     )?;
 
+    let index = Arc::new(OnceLock::new());
+    if let Some(offsets) = offsets {
+        let _ = index.set(offsets);
+    }
+    // Repair may read objects through the current reference context; only cache the
+    // context-independent validating path. Inline/content dictionaries stay uncached.
+    if cacheable && !repaired && data.len() >= 1024 {
+        ctx.xref()
+            .with_dict_cache(|cache| cache.insert(data, index.clone()));
+    }
     Some(Dict(Inner::Some(Arc::new(Repr {
         data,
-        offsets,
+        offsets: index,
+        inline: start_tag.is_none(),
         ctx: ctx.clone(),
     }))))
 }
@@ -242,7 +338,7 @@ pub(crate) fn probe_dict<'a>(
     let mut has_root = false;
     let mut has_type = false;
 
-    let data = parse_dict_with(
+    let (data, _) = parse_dict_with(
         r,
         ctx,
         start_tag,
@@ -272,12 +368,13 @@ fn parse_dict_with<'a, F>(
     start_tag: Option<&[u8]>,
     end_tag: &[u8],
     mut on_entry: F,
-) -> Option<&'a [u8]>
+) -> Option<(&'a [u8], bool)>
 where
     F: FnMut(Name<'a>, usize, &Reader<'a>) -> Option<()>,
 {
     let dict_data = r.tail()?;
     let start_offset = r.offset();
+    let mut repaired = false;
 
     // Inline image dictionaries don't start with '<<'.
     if let Some(start_tag) = start_tag {
@@ -292,13 +389,14 @@ where
             r.forward_tag(end_tag)?;
             let end_offset = r.offset() - start_offset;
 
-            break Some(&dict_data[..end_offset]);
+            break Some((&dict_data[..end_offset], repaired));
         } else {
             let Some(name) = r.read_without_context::<Name<'_>>() else {
                 if start_tag.is_some() {
                     // In case there is garbage in-between, be lenient and just try to skip it.
                     // But only do this if we are parsing a proper dictionary as opposed to an
                     // inline dictionary.
+                    repaired = true;
                     r.read::<Object<'_>>(ctx)?;
                     continue;
                 } else {
@@ -330,7 +428,8 @@ object!(Dict<'a>, Dict);
 
 struct Repr<'a> {
     data: &'a [u8],
-    offsets: FxHashMap<Name<'a>, usize>,
+    offsets: SharedIndex,
+    inline: bool,
     ctx: ReaderContext<'a>,
 }
 
@@ -348,6 +447,129 @@ impl<'a> Readable<'a> for InlineImageDict<'a> {
     }
 }
 
+#[cfg(test)]
+mod lazy_index_tests {
+    use super::*;
+    use crate::object::{Array, FromBytes};
+    use alloc::string::String;
+
+    fn entries() -> String {
+        let mut data = String::new();
+        for i in 0..100 {
+            data.push_str(&format!("/Key{i} {i} "));
+        }
+        // Escaped and long names, duplicate keys, null and nested values keep
+        // exactly the same semantics after the second (index-building) pass.
+        data.push_str("/Key99 123 /Esc#61ped 7 /ThisNameIsLongerThanTheInlineNameBuffer 9 /Nil null /Nested << /N [1 2 3] >> ");
+        data
+    }
+
+    #[test]
+    fn large_indexes_are_deferred_and_clones_share_the_result() {
+        let data = format!("<< {} >>", entries());
+        let dict = Dict::from_bytes(data.as_bytes()).unwrap();
+        let Inner::Some(repr) = &dict.0 else {
+            panic!("nonempty")
+        };
+        assert!(repr.offsets.get().is_none());
+        let cloned = dict.clone();
+        assert_eq!(cloned.get::<i32>(b"Key99"), Some(123));
+        assert!(repr.offsets.get().is_some());
+        assert_eq!(dict.len(), 104);
+        assert_eq!(dict.get::<i32>(b"Escaped"), Some(7));
+        assert_eq!(
+            dict.get::<i32>(b"ThisNameIsLongerThanTheInlineNameBuffer"),
+            Some(9)
+        );
+        assert!(dict.contains_key(b"Nil"));
+        assert!(!dict.contains_key(b"Missing"));
+        assert_eq!(
+            dict.get::<Dict<'_>>(b"Nested")
+                .unwrap()
+                .get::<Array<'_>>(b"N")
+                .unwrap()
+                .iter::<i32>()
+                .collect::<Vec<_>>(),
+            [1, 2, 3]
+        );
+        assert_eq!(dict.keys().count(), dict.len());
+        assert_eq!(dict.entries().count(), dict.len());
+        assert!(core::ptr::eq(
+            dict.offsets().unwrap(),
+            cloned.offsets().unwrap()
+        ));
+    }
+
+    #[test]
+    fn small_indexes_stay_eager_and_large_inline_dicts_work() {
+        let dict = Dict::from_bytes(b"<< /Key 42 >>").unwrap();
+        let Inner::Some(repr) = &dict.0 else {
+            panic!("nonempty")
+        };
+        assert!(repr.offsets.get().is_some());
+        assert_eq!(dict.get::<i32>(b"Key"), Some(42));
+        let data = format!("{} ID", entries());
+        let mut reader = Reader::new(data.as_bytes());
+        let inline = InlineImageDict::read(&mut reader, &ReaderContext::dummy()).unwrap();
+        assert_eq!(inline.0.get::<i32>(b"Key99"), Some(123));
+        assert_eq!(inline.0.len(), 104);
+    }
+
+    #[test]
+    fn large_dicts_are_still_validated_before_any_lookup() {
+        let data = format!("<< {} /Broken [", entries());
+        assert!(Dict::from_bytes(data.as_bytes()).is_none());
+    }
+
+    #[test]
+    fn repeated_resource_reads_share_indexes_but_keep_object_context() {
+        let data = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Resources 5 0 R >> endobj\n4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Resources 5 0 R >> endobj\n5 0 obj << /XObject << {} >> >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+            entries()
+        );
+        let pdf = crate::Pdf::new(data.into_bytes()).unwrap();
+        let a = pdf
+            .xref()
+            .get::<Dict<'_>>(ObjectIdentifier::new(5, 0))
+            .unwrap()
+            .get::<Dict<'_>>(b"XObject")
+            .unwrap();
+        let b = pdf
+            .xref()
+            .get::<Dict<'_>>(ObjectIdentifier::new(5, 0))
+            .unwrap()
+            .get::<Dict<'_>>(b"XObject")
+            .unwrap();
+        let (Inner::Some(a_repr), Inner::Some(b_repr)) = (&a.0, &b.0) else {
+            panic!("nonempty")
+        };
+        assert!(Arc::ptr_eq(&a_repr.offsets, &b_repr.offsets));
+        assert_eq!(a.obj_id(), Some(ObjectIdentifier::new(5, 0)));
+        assert_eq!(a.get::<i32>(b"Key99"), Some(123));
+        assert_eq!(b.get::<i32>(b"Escaped"), Some(7));
+        assert!(core::ptr::eq(a.offsets().unwrap(), b.offsets().unwrap()));
+    }
+
+    #[test]
+    fn index_cache_is_bounded_and_rejects_changed_or_truncated_bytes() {
+        let mut cache = DictCache::default();
+        let mut data = format!("<< {} >>", entries()).into_bytes();
+        cache.insert(&data, Arc::new(OnceLock::new()));
+        assert!(cache.get(&data).is_some());
+        assert!(cache.get(&data[..data.len() - 1]).is_none());
+        data[3] = b'Z';
+        assert!(cache.get(&data).is_none());
+        let buffers: Vec<_> = (0..300)
+            .map(|i| format!("<< /Key{i} 1 >>").into_bytes())
+            .collect();
+        for data in &buffers {
+            cache.insert(data, Arc::new(OnceLock::new()));
+        }
+        assert_eq!(cache.entries.len(), 256);
+        assert!(cache.bytes <= 8 << 20);
+    }
+}
+
 /// A collection of possible keys in a PDF dictionary. Copied and adapted from `PDFBox`.
 #[allow(missing_docs)]
 pub mod keys {
diff --git a/vendor/hayro-syntax/src/object/name.rs b/vendor/hayro-syntax/src/object/name.rs
index 39d9e498..892d4d4f 100644
--- a/vendor/hayro-syntax/src/object/name.rs
+++ b/vendor/hayro-syntax/src/object/name.rs
@@ -72,6 +72,16 @@ impl Ord for Name<'_> {
 }
 
 impl<'a> Name<'a> {
+    // PdfCraft patch: (#307) lazy dictionary indexes cannot borrow through a
+    // OnceLock without making the enclosing PDF pages invariant in their lifetime.
+    // Ordinary PDF keys fit inline, so owning these bytes needs no allocation.
+    pub(crate) fn into_owned(self) -> Name<'static> {
+        Name(NameInner::Owned(match self.0 {
+            NameInner::Borrowed(data) => SmallVec::from_slice(data),
+            NameInner::Owned(data) => data,
+        }))
+    }
+
     /// Create a new name from a sequence of bytes.
     #[inline]
     pub fn new(data: &'a [u8]) -> Option<Self> {
diff --git a/vendor/hayro-syntax/src/sync.rs b/vendor/hayro-syntax/src/sync.rs
index dd4d93ce..7991b0b5 100644
--- a/vendor/hayro-syntax/src/sync.rs
+++ b/vendor/hayro-syntax/src/sync.rs
@@ -60,7 +60,9 @@ pub(crate) trait MutexExt<T> {
 #[cfg(feature = "std")]
 impl<T> MutexExt<T> for Mutex<T> {
     fn get(&self) -> MutexGuard<'_, T> {
-        self.lock().unwrap()
+        // PdfCraft patch: (#307) cached values remain owned after an unwinding caller; do not cascade a
+        // worker panic into unrelated readers. Initialization has its own failure state.
+        self.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
     }
 }
 
@@ -73,22 +75,20 @@ impl<T> MutexExt<T> for Mutex<T> {
 
 pub(crate) trait RwLockExt<T> {
     fn get(&self) -> RwLockReadGuard<'_, T>;
-    fn try_get(&self) -> Option<RwLockReadGuard<'_, T>>;
-    fn try_put(&self) -> Option<RwLockWriteGuard<'_, T>>;
+    fn put(&self) -> RwLockWriteGuard<'_, T>;
 }
 
 #[cfg(feature = "std")]
 impl<T> RwLockExt<T> for RwLock<T> {
+    // PdfCraft patch: (#307) poisoned locks are recovered rather than unwrapped, and the
+    // non-blocking try_get/try_put (which repair asserted could not fail) become blocking.
     fn get(&self) -> RwLockReadGuard<'_, T> {
-        self.read().unwrap()
+        self.read().unwrap_or_else(|poisoned| poisoned.into_inner())
     }
 
-    fn try_get(&self) -> Option<RwLockReadGuard<'_, T>> {
-        self.try_read().ok()
-    }
-
-    fn try_put(&self) -> Option<RwLockWriteGuard<'_, T>> {
-        self.try_write().ok()
+    fn put(&self) -> RwLockWriteGuard<'_, T> {
+        self.write()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
     }
 }
 
@@ -98,11 +98,7 @@ impl<T> RwLockExt<T> for RwLock<T> {
         self.borrow()
     }
 
-    fn try_get(&self) -> Option<RwLockReadGuard<'_, T>> {
-        Some(self.borrow())
-    }
-
-    fn try_put(&self) -> Option<RwLockWriteGuard<'_, T>> {
-        Some(self.borrow_mut())
+    fn put(&self) -> RwLockWriteGuard<'_, T> {
+        self.borrow_mut()
     }
 }
diff --git a/vendor/hayro-syntax/src/util.rs b/vendor/hayro-syntax/src/util.rs
index ec04b39a..4b7b0d0c 100644
--- a/vendor/hayro-syntax/src/util.rs
+++ b/vendor/hayro-syntax/src/util.rs
@@ -139,8 +139,8 @@ pub(crate) fn findr_needle(haystack: &[u8], needle: &[u8]) -> Option<usize> {
 /// Indices should be used in order. Usage of higher indices implies more memory
 /// usage (even if lower indices are not in use).
 ///
-/// The capacity is limited at 2^C - 1. Calling `get_or_init` with a higher
-/// index will lead to a panic.
+/// The capacity is limited at 2^C - 1. Out-of-range indices return `None` (PdfCraft patch:
+/// upstream panics; #307 reaches this with object-stream slot numbers from the file).
 pub(crate) struct SegmentList<T, const C: usize>([OnceLock<Box<[OnceLock<T>]>>; C]);
 
 impl<T, const C: usize> SegmentList<T, C> {
@@ -149,32 +149,28 @@ impl<T, const C: usize> SegmentList<T, C> {
     }
 
     pub(crate) fn get(&self, i: usize) -> Option<&T> {
-        let (s, k) = self.locate(i);
-        let segment = self.0[s as usize].get()?;
+        let (s, k) = self.locate(i)?;
+        let segment = self.0.get(s as usize)?.get()?;
         segment.get(k)?.get()
     }
 
     #[track_caller]
-    pub(crate) fn get_or_init(&self, i: usize, f: impl FnOnce() -> T) -> &T {
-        let (s, k) = self.locate(i);
-        let segment = self
-            .0
-            .get(s as usize)
-            .expect("segment list is out of capacity")
-            .get_or_init(|| {
-                (0..2_usize.pow(s))
-                    .map(|_| OnceLock::new())
-                    .collect::<Vec<_>>()
-                    .into_boxed_slice()
-            });
-        segment[k].get_or_init(f)
+    pub(crate) fn get_or_init(&self, i: usize, f: impl FnOnce() -> T) -> Option<&T> {
+        let (s, k) = self.locate(i)?;
+        let segment = self.0.get(s as usize)?.get_or_init(|| {
+            (0..2_usize.pow(s))
+                .map(|_| OnceLock::new())
+                .collect::<Vec<_>>()
+                .into_boxed_slice()
+        });
+        Some(segment.get(k)?.get_or_init(f))
     }
 
-    fn locate(&self, i: usize) -> (u32, usize) {
-        let power = (i + 2).next_power_of_two() / 2;
+    fn locate(&self, i: usize) -> Option<(u32, usize)> {
+        let power = i.checked_add(2)?.checked_next_power_of_two()? / 2;
         let s = power.trailing_zeros();
         let k = i - ((1 << s) - 1);
-        (s, k)
+        Some((s, k))
     }
 }
 
@@ -201,6 +197,16 @@ mod tests {
         }
     }
 
+    #[test]
+    fn segment_list_rejects_out_of_range_indices() {
+        let list = SegmentList::<u8, 2>::new();
+        assert_eq!(list.get_or_init(2, || 7), Some(&7));
+        for index in [3, 20, usize::MAX - 1, usize::MAX] {
+            assert_eq!(list.get(index), None);
+            assert_eq!(list.get_or_init(index, || 9), None);
+        }
+    }
+
     #[test]
     fn test_findr_needle() {
         assert_eq!(findr_needle(b"abc foo def foo xyz", b"foo"), Some(12));
diff --git a/vendor/hayro-syntax/src/xref.rs b/vendor/hayro-syntax/src/xref.rs
index 0b3d5fa8..20e33a41 100644
--- a/vendor/hayro-syntax/src/xref.rs
+++ b/vendor/hayro-syntax/src/xref.rs
@@ -10,7 +10,7 @@ use crate::object::dict::keys::{
     AUTHOR, CREATION_DATE, CREATOR, ENCRYPT, FIRST, ID, INDEX, INFO, KEYWORDS, MOD_DATE, N,
     OCPROPERTIES, PAGES, PREV, PRODUCER, ROOT, SIZE, SUBJECT, TITLE, TYPE, VERSION, W, XREF_STM,
 };
-use crate::object::dict::probe_dict;
+use crate::object::dict::{DictCache, probe_dict};
 use crate::object::indirect::IndirectObject;
 use crate::object::{Array, MaybeRef};
 use crate::object::{DateTime, Dict};
@@ -18,7 +18,7 @@ use crate::object::{Object, ObjectLike};
 use crate::pdf::PdfVersion;
 use crate::reader::Reader;
 use crate::reader::{Readable, ReaderContext, ReaderExt};
-use crate::sync::{Arc, FxHashMap, RwLock, RwLockExt};
+use crate::sync::{Arc, FxHashMap, Mutex, RwLock, RwLockExt};
 use crate::trivia::is_white_space_character;
 use crate::util::findr_needle;
 use crate::{PdfData, object};
@@ -274,6 +274,21 @@ const DUMMY_XREF: XRef = XRef(Inner::Dummy);
 pub struct XRef(Inner);
 
 impl XRef {
+    // PdfCraft patch: keep the bounded dictionary-index cache local to this PDF.
+    pub(crate) fn with_dict_cache<T>(&self, f: impl FnOnce(&mut DictCache) -> T) -> Option<T> {
+        let Inner::Some(repr) = &self.0 else {
+            return None;
+        };
+        #[cfg(feature = "std")]
+        let mut cache = repr
+            .dict_cache
+            .lock()
+            .unwrap_or_else(|poison| poison.into_inner());
+        #[cfg(not(feature = "std"))]
+        let mut cache = repr.dict_cache.try_borrow_mut().ok()?;
+        Some(f(&mut cache))
+    }
+
     fn new(
         data: PdfData,
         xref_map: XrefMap,
@@ -294,6 +309,7 @@ impl XRef {
             metadata: Arc::new(Metadata::default()),
             trailer_data,
             password: password.to_vec(),
+            dict_cache: Arc::new(Mutex::new(DictCache::default())),
         })));
 
         // We read the trailer twice, once to determine the encryption used and then a second
@@ -381,16 +397,6 @@ impl XRef {
         Ok(xref)
     }
 
-    fn is_repaired(&self) -> bool {
-        match &self.0 {
-            Inner::Dummy => false,
-            Inner::Some(r) => {
-                let locked = r.map.get();
-                locked.repaired
-            }
-        }
-    }
-
     pub(crate) fn dummy() -> &'static Self {
         &DUMMY_XREF
     }
@@ -479,15 +485,21 @@ impl XRef {
 
     pub(crate) fn repair(&self) {
         let Inner::Some(r) = &self.0 else {
-            unreachable!();
+            return;
         };
 
-        let mut locked = r.map.try_put().unwrap();
-        assert!(!locked.repaired);
-
+        // All callers release read guards before following references/repairing.
+        // Fallback reconstruction uses its own dummy/temporary xref, never this
+        // locked map. Serialize the one repair and let concurrent readers wait.
+        let mut locked = r.map.put();
+        if locked.repaired {
+            return;
+        }
+        // Set first so an unwinding fallback cannot trigger a reparse storm.
+        // Assignment below publishes a complete replacement atomically.
+        locked.repaired = true;
         let (xref_map, _) = fallback_xref_map(r.data.get(), &r.password);
         locked.xref_map = xref_map;
-        locked.repaired = true;
     }
 
     #[inline]
@@ -541,7 +553,7 @@ impl XRef {
             return None;
         };
 
-        let locked = repr.map.try_get().unwrap();
+        let locked = repr.map.get();
 
         let mut r = Reader::new(repr.data.get().as_ref());
 
@@ -550,6 +562,7 @@ impl XRef {
             // shall be treated as a reference to the null object.
             None
         })?;
+        let repaired = locked.repaired;
         drop(locked);
 
         let mut ctx = ctx.clone();
@@ -574,7 +587,7 @@ impl XRef {
                 };
 
                 // The xref table is broken, try to repair if not already repaired.
-                if self.is_repaired() {
+                if repaired {
                     error!(
                         "attempt was made at repairing xref, but object {id:?} still couldn't be read"
                     );
@@ -599,6 +612,16 @@ impl XRef {
                     return None;
                 }
 
+                // Stream objects cannot themselves be stored in object streams
+                // (PDF 7.5.7). Reject malformed chains before recursively loading
+                // them, including A-in-B/B-in-A and arbitrarily deep chains.
+                if !matches!(
+                    repr.map.get().xref_map.get(&obj_stream_id),
+                    Some(EntryType::Normal(_))
+                ) {
+                    return None;
+                }
+
                 let stream = self.get_with::<Stream<'_>>(obj_stream_id, &ctx)?;
                 let data = repr.data.get_with(obj_stream_id, &ctx)?;
                 let object_stream = ObjectStream::new(stream, data, &ctx)?;
@@ -674,6 +697,7 @@ impl TrailerData {
 
 #[derive(Debug, Clone)]
 struct SomeRepr {
+    dict_cache: Arc<Mutex<DictCache>>,
     data: Arc<Data>,
     map: Arc<RwLock<MapRepr>>,
     metadata: Arc<Metadata>,
@@ -1119,6 +1143,200 @@ fn parse_metadata(info_dict: &Dict<'_>) -> Metadata {
 mod tests {
     use super::*;
 
+    // Contributor-original, MIT OR Apache-2.0. Matches the bounded, uncompressed
+    // synthetic regression used to reproduce the cold-publication race. A second
+    // stream optionally checks that racing registration never aliases two ids.
+    fn object_stream_fixture(second: bool) -> Vec<u8> {
+        let mut out = b"%PDF-1.5\n".to_vec();
+        let mut offsets = alloc::collections::BTreeMap::new();
+        fn object(
+            out: &mut Vec<u8>,
+            offsets: &mut alloc::collections::BTreeMap<u32, usize>,
+            n: u32,
+            body: &[u8],
+        ) {
+            offsets.insert(n, out.len());
+            out.extend_from_slice(format!("{n} 0 obj\n").as_bytes());
+            out.extend_from_slice(body);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        object(
+            &mut out,
+            &mut offsets,
+            1,
+            b"<< /Type /Catalog /Pages 2 0 R >>",
+        );
+        object(
+            &mut out,
+            &mut offsets,
+            2,
+            b"<< /Type /Pages /Count 1 /Kids [3 0 R] >>",
+        );
+        object(
+            &mut out,
+            &mut offsets,
+            3,
+            b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] >>",
+        );
+        let mut payload = b"20 0 << /Marker 123 >>".to_vec();
+        payload.resize(payload.len() + 4 * 1024 * 1024, b' ');
+        let mut stream = format!(
+            "<< /Type /ObjStm /N 1 /First 5 /Length {} >>\nstream\n",
+            payload.len()
+        )
+        .into_bytes();
+        stream.extend(payload);
+        stream.extend_from_slice(b"\nendstream");
+        object(&mut out, &mut offsets, 10, &stream);
+        if second {
+            let payload = b"21 0 << /Marker 456 >>";
+            let mut stream = format!(
+                "<< /Type /ObjStm /N 1 /First 5 /Length {} >>\nstream\n",
+                payload.len()
+            )
+            .into_bytes();
+            stream.extend_from_slice(payload);
+            stream.extend_from_slice(b"\nendstream");
+            object(&mut out, &mut offsets, 12, &stream);
+        }
+        let xref = out.len();
+        offsets.insert(11, xref);
+        let size = if second { 22 } else { 21 };
+        let mut rows = Vec::new();
+        for number in 0..size {
+            let (kind, a, b): (u8, u32, u16) = match number {
+                20 => (2, 10, 0),
+                21 => (2, 12, 0),
+                n => offsets
+                    .get(&n)
+                    .map_or((0, 0, 65535), |offset| (1, *offset as u32, 0)),
+            };
+            rows.push(kind);
+            rows.extend_from_slice(&a.to_be_bytes());
+            rows.extend_from_slice(&b.to_be_bytes());
+        }
+        let mut stream = format!(
+            "<< /Type /XRef /Size {size} /Root 1 0 R /W [1 4 2] /Length {} >>\nstream\n",
+            rows.len()
+        )
+        .into_bytes();
+        stream.extend(rows);
+        stream.extend_from_slice(b"\nendstream");
+        object(&mut out, &mut offsets, 11, &stream);
+        out.extend_from_slice(format!("startxref\n{xref}\n%%EOF\n").as_bytes());
+        out
+    }
+
+    #[cfg(feature = "std")]
+    #[test]
+    fn concurrent_cold_object_stream_reads_all_succeed() {
+        use std::sync::Barrier;
+        let bytes = Arc::new(object_stream_fixture(true));
+        for _ in 0..10 {
+            let pdf = Arc::new(crate::Pdf::new(bytes.clone()).unwrap());
+            let barrier = Arc::new(Barrier::new(16));
+            let jobs: Vec<_> = (0..16)
+                .map(|_| {
+                    let (pdf, barrier) = (pdf.clone(), barrier.clone());
+                    std::thread::spawn(move || {
+                        barrier.wait();
+                        for (id, marker) in [(20, 123), (21, 456), (20, 123)] {
+                            let dict = pdf
+                                .xref()
+                                .get::<Dict<'_>>(ObjectIdentifier::new(id, 0))
+                                .unwrap();
+                            assert_eq!(dict.get::<i32>(b"Marker"), Some(marker));
+                        }
+                    })
+                })
+                .collect();
+            for job in jobs {
+                job.join().unwrap();
+            }
+        }
+    }
+
+    #[test]
+    fn recursive_object_stream_locations_fail_without_recursing() {
+        let pdf = crate::Pdf::new(object_stream_fixture(true)).unwrap();
+        let Inner::Some(repr) = &pdf.xref().0 else {
+            panic!("real xref")
+        };
+        {
+            let mut map = repr.map.put();
+            map.xref_map
+                .insert(ObjectIdentifier::new(10, 0), EntryType::ObjStream(12, 0));
+            map.xref_map
+                .insert(ObjectIdentifier::new(12, 0), EntryType::ObjStream(10, 0));
+        }
+        for id in [10, 12, 20, 21] {
+            assert!(
+                pdf.xref()
+                    .get::<Dict<'_>>(ObjectIdentifier::new(id, 0))
+                    .is_none()
+            );
+        }
+    }
+
+    #[cfg(feature = "std")]
+    #[test]
+    fn concurrent_repair_and_read_retries_the_repaired_map() {
+        let pdf = Arc::new(crate::Pdf::new(object_stream_fixture(false)).unwrap());
+        let Inner::Some(repr) = &pdf.xref().0 else {
+            panic!("real xref")
+        };
+        repr.map
+            .put()
+            .xref_map
+            .insert(ObjectIdentifier::new(1, 0), EntryType::Normal(0));
+        let barrier = Arc::new(std::sync::Barrier::new(16));
+        let jobs: Vec<_> = (0..16)
+            .map(|_| {
+                let (pdf, barrier) = (pdf.clone(), barrier.clone());
+                std::thread::spawn(move || {
+                    barrier.wait();
+                    for _ in 0..8 {
+                        let root = pdf
+                            .xref()
+                            .get::<Dict<'_>>(ObjectIdentifier::new(1, 0))
+                            .unwrap();
+                        assert!(root.get_ref(PAGES).is_some());
+                        pdf.xref().repair(); // already repaired is an idempotent no-op
+                    }
+                })
+            })
+            .collect();
+        for job in jobs {
+            job.join().unwrap();
+        }
+        assert!(repr.map.get().repaired);
+    }
+
+    #[cfg(feature = "std")]
+    #[test]
+    fn poisoned_repair_lock_does_not_cascade_or_retry_repair() {
+        use std::panic::{AssertUnwindSafe, catch_unwind};
+        let pdf = crate::Pdf::new(object_stream_fixture(false)).unwrap();
+        let Inner::Some(repr) = &pdf.xref().0 else {
+            panic!("real xref")
+        };
+        assert!(
+            catch_unwind(AssertUnwindSafe(|| {
+                let mut map = repr.map.put();
+                map.repaired = true; // same state as an unwinding fallback before publication
+                panic!("injected repair failure");
+            }))
+            .is_err()
+        );
+        pdf.xref().repair();
+        assert!(
+            pdf.xref()
+                .get::<Dict<'_>>(ObjectIdentifier::new(1, 0))
+                .is_some()
+        );
+        assert!(repr.map.get().repaired);
+    }
+
     #[test]
     fn circular_prev_chain() {
         let mut pdf = b"%PDF-1.0\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n".to_vec();

From fce60eacb4b147f5240c8476e2e1a8ddb203d9ba Mon Sep 17 00:00:00 2001
From: LloydNicholson <34131158+LloydNicholson@users.noreply.github.com>
Date: Fri, 9 Oct 2026 20:44:11 +0200
Subject: [PATCH 112/149] pdfcraft-cli --help lists `mcp` only when the build
 has it (#574)

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 apps/pdfcraft-cli/src/main.rs   | 30 ++++++++++++++++++++++++++----
 apps/pdfcraft-cli/tests/help.rs | 21 +++++++++++++++++++++
 2 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index e3f1c7a3..1940d63e 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -26,8 +26,26 @@ use std::time::{Duration, Instant};
 use pdfcraft_engine::export::ImageFormat;
 use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind, inspect};
 
+/// The `mcp` lines of [`USAGE`]: only a build with the `mcp` feature has the command.
+#[cfg(feature = "mcp")]
+macro_rules! mcp_usage {
+    () => {
+        "\
+pdfcraft-cli mcp    [--root DIR] [--compact]              MCP server on stdin/stdout (opt-in)
+                                                           --compact lists a core set of tools plus tool_search and tool_call
+"
+    };
+}
+#[cfg(not(feature = "mcp"))]
+macro_rules! mcp_usage {
+    () => {
+        ""
+    };
+}
+
 /// The full usage, printed by `--help` (also after a command, e.g. `render --help`).
-const USAGE: &str = "\
+const USAGE: &str = concat!(
+    "\
 pdfcraft-cli info   <file.pdf> [--password PW]            document summary as JSON
 pdfcraft-cli render <file.pdf> --page N [--dpi 96] --out x.png   (.png, .jpg, .tif or .pam)
 pdfcraft-cli text   <file.pdf> [--page N]                  extracted text (pages separated by form feeds)
@@ -40,11 +58,13 @@ pdfcraft-cli check  <files or dirs…> [--timeout 20] [--dpi 36] [--json out.jso
 pdfcraft-cli tools                                       automation tools and their JSON Schemas
 pdfcraft-cli run    <tool> [key=value …] [--root DIR] [--out image.png]
 pdfcraft-cli run    --script steps.json [--root DIR]      [{\"tool\": \"doc_open\", \"args\": {…}}, …]
-pdfcraft-cli mcp    [--root DIR] [--compact]              MCP server on stdin/stdout (opt-in)
-                                                           --compact lists a core set of tools plus tool_search and tool_call
+",
+    mcp_usage!(),
+    "\
 pdfcraft-cli ui     --control FILE <method> [key=value …] [--out shot.png]
                                                            drive a running app started with --control FILE
-help and feedback: https://discord.gg/artcraft";
+help and feedback: https://discord.gg/artcraft"
+);
 
 fn main() -> ExitCode {
     let args: Vec<String> = std::env::args().skip(1).collect();
@@ -70,6 +90,8 @@ fn main() -> ExitCode {
         Some("ui") => ui(&args[1..]),
         #[cfg(feature = "mcp")]
         Some("mcp") => mcp(&args[1..]),
+        #[cfg(not(feature = "mcp"))]
+        Some("mcp") => Err("mcp: this build leaves out the MCP server (built without the `mcp` feature)".into()),
         Some("--version") => version(),
         Some(other) => Err(format!("unknown command '{other}'; see pdfcraft-cli --help").into()),
     };
diff --git a/apps/pdfcraft-cli/tests/help.rs b/apps/pdfcraft-cli/tests/help.rs
index 3a124322..9a86150f 100644
--- a/apps/pdfcraft-cli/tests/help.rs
+++ b/apps/pdfcraft-cli/tests/help.rs
@@ -34,6 +34,27 @@ fn no_command_fails_with_usage_on_stderr() {
     assert!(text(&out.stderr).contains("pdfcraft-cli render <file.pdf> --page N"));
 }
 
+/// `mcp` is listed only when the build has it (`--no-default-features` leaves it out).
+#[test]
+fn usage_lists_mcp_only_when_built_with_it() {
+    let out = run(&["--help"]);
+    let stdout = text(&out.stdout);
+    assert_eq!(stdout.contains("pdfcraft-cli mcp"), cfg!(feature = "mcp"), "{stdout}");
+    assert_eq!(stdout.contains("--compact"), cfg!(feature = "mcp"), "{stdout}");
+    // The lines around it are still there.
+    assert!(stdout.contains("pdfcraft-cli run    --script steps.json"), "{stdout}");
+    assert!(stdout.contains("pdfcraft-cli ui     --control FILE"), "{stdout}");
+}
+
+#[cfg(not(feature = "mcp"))]
+#[test]
+fn mcp_without_the_feature_says_it_was_left_out() {
+    let out = run(&["mcp"]);
+    assert!(!out.status.success());
+    let stderr = text(&out.stderr);
+    assert!(stderr.contains("without the `mcp` feature"), "{stderr}");
+}
+
 #[test]
 fn unknown_command_names_it_and_points_to_help() {
     let out = run(&["frobnicate"]);

From 025b79b515326a7aab11c1f1069f21e7c4082bc0 Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Fri, 9 Oct 2026 20:44:24 +0200
Subject: [PATCH 113/149] M14: honor Windows display language with neutral
 launcher locales (#567)

* M14: let neutral Windows locales fall through to display language

Co-authored-by: Codex <codex@openai.com>

* pdfcraft-cli --help lists `mcp` only when the build has it

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex <codex@openai.com>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                     |  2 ++
 crates/ui-egui/src/i18n/mod.rs | 27 ++++++++++++++++++++++++++-
 docs/localization.md           |  2 +-
 parity/acrobat-features.toml   |  4 ++--
 4 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index b8193f72..a0d9246c 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -171,6 +171,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, M14, Hungarian):** Magyar (`hu`) is a complete interface catalog (2,036 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `hu` and `hu_HU`, and from Preferences. Informal "te"; commands are nouns (Mentés, Megnyitás). After a numeral the noun stays singular, so both plural forms match. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover Hungarian diacritics including ő and ű. Overall estimate unchanged (about 30–35%).
+- **2026-10-09 (M14, Windows Auto):** Neutral launcher locales (`C`, `C.UTF-8`, `POSIX`) no longer select English ahead of the Windows preferred display-language list. Explicit supported locale overrides retain their priority. Regression tests use existing catalogs and cover neutral/mixed overrides, unsupported first display tags and multiple preferred Windows languages. Catalogs and other platforms are unchanged; overall effort estimate remains about 30–35%.
+
 - **2026-10-09 (community, M14, German):** Deutsch (`de`) is a complete interface catalog (2,035 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `de`, `de_DE`, `de_AT`, `de_CH` and other German locales, and from Preferences. Informal "du", infinitive for commands. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover umlauts, ß and German quotes. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, M7, Arabic added text):** Add text writes Arabic into the PDF instead of `?`. The text is shaped with the craft-fonts `Arab` face through harfrust (already in the tree via egui): joining forms, ligatures and mark positions. Each line is laid out in display order by the Unicode bidirectional algorithm, so Arabic mixed with Latin words, European or Arabic-Indic digits and brackets reads correctly; justified right-to-left paragraphs end at the right edge. Each cluster (a letter with its dots or marks) becomes one glyph of a Type 3 font built from the face's outlines, with a ToUnicode entry, so `text_extract`, copy and search get every letter once and no font file is embedded. Wrapping measures shaped words. Each item has its own fonts under names free on the page (a full save renumbers objects but not resource names); updating or deleting the item removes them. Without the face, adding Arabic text returns a clear error and changes nothing, while an existing item holding Arabic still moves and retypes, drawn as `?` as before. Tests cover shaping, display order, ToUnicode, font names and clean-up on one page, and odd input (empty lines, direction controls, lone marks, 18,000 characters). Not yet: bold/italic Arabic, Hebrew, right-to-left typing in the box (misc.rtl-ui), editing existing Arabic text (edit.rtl-cjk-editing). The craft-fonts revision pinned for releases predates its Arabic face, so release builds report the missing font until the pin moves. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index d9c8c419..da944c6e 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -252,7 +252,7 @@ pub fn system_lang() -> Lang {
 #[cfg(not(target_arch = "wasm32"))]
 fn detect_system_lang() -> Lang {
     for var in ["LC_ALL", "LC_MESSAGES", "LANG"] {
-        if let Some(l) = std::env::var(var).ok().filter(|v| !v.is_empty()).and_then(|v| lang_from_tag(&v)) {
+        if let Some(l) = std::env::var(var).ok().and_then(|v| language_override(&v)) {
             return l;
         }
     }
@@ -272,6 +272,17 @@ fn detect_system_lang() -> Lang {
     Lang::EN
 }
 
+/// A named locale can override the display language. On Windows, the neutral
+/// C/POSIX locale inherited from a launcher says nothing about the user's UI language.
+#[cfg(not(target_arch = "wasm32"))]
+fn language_override(tag: &str) -> Option<Lang> {
+    let tag = tag.trim();
+    if cfg!(target_os = "windows") && matches!(candidates(tag).first().map(String::as_str), Some("c" | "posix")) {
+        return None;
+    }
+    lang_from_tag(tag)
+}
+
 /// The Windows display languages in preference order, one tag per line, queried once when Auto
 /// first resolves. `sys-locale` asks Windows directly (`GetUserPreferredUILanguages`), so no
 /// process is started.
@@ -476,6 +487,20 @@ mod tests {
         assert_eq!(first_supported("\r\n"), None);
     }
 
+    #[cfg(target_os = "windows")]
+    #[test]
+    fn neutral_locale_does_not_override_display_language() {
+        let fr = Lang::from_code("fr").unwrap();
+        for tag in ["C", "C.UTF-8", "POSIX", "posix.UTF-8", "", "  C.UTF-8  ", "unsupported"] {
+            assert_eq!(language_override(tag), None, "{tag}");
+            assert_eq!(language_override(tag).or_else(|| first_supported("unsupported-XY\nfr-FR\nen-US")), Some(fr));
+        }
+        assert_eq!(["C.UTF-8", "POSIX", "fr_FR.UTF-8"].into_iter().find_map(language_override), Some(fr));
+        assert_eq!(language_override("fr_FR.UTF-8"), Some(fr));
+        assert_eq!(language_override("en_US.UTF-8"), Some(Lang::EN));
+        assert_eq!(language_override("ja_JP.UTF-8"), Some(JA()));
+    }
+
     #[cfg(target_os = "windows")]
     #[test]
     fn windows_display_language_query_returns_a_locale_tag() {
diff --git a/docs/localization.md b/docs/localization.md
index 801bb260..43f77e38 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -2,7 +2,7 @@
 
 Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **తెలుగు**, **Magyar** or **Українська**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. Neutral `C`/`POSIX` locale values (including `C.UTF-8`) inherited from a launcher do not override the Windows display language; explicitly named supported locales such as `fr_FR.UTF-8` still do. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 685b19da..a503dd19 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9818,8 +9818,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values"]
-notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after locale environment overrides, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
+evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values"]
+notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Missing: Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"

From 2d40d85450653702ecbf0c65c8a2166abd57564e Mon Sep 17 00:00:00 2001
From: Tanish Manku <tmanku.dev@gmail.com>
Date: Fri, 9 Oct 2026 11:44:37 -0700
Subject: [PATCH 114/149] D5: READMEs for cos and engine (#332)

* D5: README for cos and engine, and an honest cos status line

Thirteen crates have no README, although the session protocol tells every session to read the README of the crate it is touching. These are the two biggest: cos is where every hostile file lands first, and engine is the whole API surface a frontend gets.

Each states its layer and the rules that bind it, sketches the API against the real signatures, and ends with what is deliberately not done. The cos README spells out the clone-is-a-snapshot property and why both writers return bytes rather than taking a sink; the engine README spells out the four-step editing model that makes what you see what Save writes.

Also corrects the module doc on cos/src/lib.rs, which still said encryption and object-stream output for full saves were not done. Both shipped: security.rs handles R2-R6 with crypt filters and /EFF, and SaveOptions::object_streams defaults to true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* M14: let neutral Windows locales fall through to display language

Co-authored-by: Codex <codex@openai.com>

* pdfcraft-cli --help lists `mcp` only when the build has it

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* engine README: the execution plan is local-only, so don't link a path that doesn't exist

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/cos/README.md    | 91 +++++++++++++++++++++++++++++++++++++++++
 crates/cos/src/lib.rs   |  8 ++--
 crates/engine/README.md | 80 ++++++++++++++++++++++++++++++++++++
 3 files changed, 176 insertions(+), 3 deletions(-)
 create mode 100644 crates/cos/README.md
 create mode 100644 crates/engine/README.md

diff --git a/crates/cos/README.md b/crates/cos/README.md
new file mode 100644
index 00000000..b3ac964d
--- /dev/null
+++ b/crates/cos/README.md
@@ -0,0 +1,91 @@
+# pdfcraft-cos
+
+The PDF object layer (ISO 32000-2 §7): the COS object graph, parsed lazily and tolerantly, edited
+through a copy-on-write overlay, and written back incrementally or as a full rewrite.
+
+- **Layer:** L1, standalone. The layering table lets it use only `pdfcraft-filters`,
+  `pdfcraft-crypt` and `pdfcraft-geom` (`xtask/src/layers.rs::STANDALONE_DEPS`); it currently uses
+  the first two. That keeps the parser and the crypto independently auditable and reusable.
+- `#![forbid(unsafe_code)]`, and the crate denies `unwrap`/`expect`/`panic!`/`todo!`. Builds for
+  `wasm32-unknown-unknown`.
+
+**The object graph is the document model.** Nothing is lifted into a tidier representation and
+written back out, because that is how data gets silently dropped. Typed views live above, in
+`pdfcraft-model`.
+
+## API
+
+```rust
+let doc = Document::open(bytes)?;                               // Arc<Vec<u8>>
+let doc = Document::open_with_password(bytes, Some("owner"))?;  // encrypted files
+
+let root = doc.root();                               // Option<ObjRef> — the catalog
+let obj  = doc.get(ObjRef { num: 12, gen: 0 });      // load (and cache): Arc<Object>
+let real = doc.resolve(&obj);                        // follow one indirect reference
+let d    = doc.dict(&obj);                           // Option<Dict>, resolving first
+let data = stream.decoded()?;                        // filters applied on demand
+
+doc.set(r, Object::Dict(d));                         // edit: lands in the overlay
+let r = doc.add(obj);                                // append a new object
+doc.free(r);
+
+let bytes = write_incremental(&doc, &SaveOptions::default())?;  // append a revision
+let bytes = write_full(&doc, &SaveOptions::default())?;         // garbage-collected rewrite
+```
+
+Both writers **return the bytes**; the caller decides where they go, which is what lets the engine
+produce a working file in memory after every edit and keep saving atomic.
+
+Useful alongside: `doc.repair_log()` (what was reconstructed), `doc.revisions()` and
+`doc.revision_ends()` (the incremental history), `doc.is_edited(num)` and `doc.modified_objects()`,
+`doc.permissions()` and `doc.security()`, `doc.set_encryption()` / `doc.remove_encryption()`, and
+`doc.require_full_save()` for edits that cannot be expressed incrementally.
+
+`Document` is **cheap to clone**: the original bytes, the xref index and the parse caches are
+shared, so a clone is a snapshot. Undo/redo and background jobs hold clones while the UI edits
+another. Edits never touch the original bytes.
+
+## Reading
+
+- **Every cross-reference form:** classic tables with their quirky subsections, cross-reference
+  streams, hybrid-reference files (`/XRefStm`), and object streams.
+- **Repair.** A file whose xref is wrong or missing is reconstructed by scanning for `obj`
+  headers. Repairs are *recorded*, never silent, so the UI can say the file was damaged.
+- **Tolerant, never fatal.** The lexer works on a byte slice and a position; it allocates nothing
+  for skipped data, bounds-checks every index, and caps nesting depth. Malformed input yields
+  `CosError`, never a panic — this crate is the first thing a hostile file meets.
+- **Lazy.** Objects are parsed on first use and cached. (Whole-file buffering is still the case;
+  `ByteSource` streaming is `core.lazy-loading`, not yet done.)
+- **Encryption** is handled on load and save through `pdfcraft-crypt`: every standard-security
+  revision R2–R6 (RC4, AES-128/256), crypt filters, `/EFF` embedded-file encryption, and
+  `/EncryptMetadata`. `security.rs` knows what the spec exempts — the `/Encrypt` dictionary, xref
+  streams, the trailer `/ID`, and objects inside an object stream (the stream is encrypted whole).
+
+## Writing
+
+`write_incremental` appends only the edited objects, a cross-reference section **in the same
+style as the file's last one**, and a trailer with `/Prev`. The original bytes are never modified,
+which is what keeps a signature over an earlier revision valid.
+
+`write_full` writes only what the trailer can reach, renumbered densely — the Save As and
+garbage-collecting path. By default (`SaveOptions::object_streams`) it packs non-stream objects
+into compressed object streams with a cross-reference stream (PDF 1.5+); turning that off writes a
+classic table any reader accepts.
+
+Dictionaries keep their key order and streams keep their *encoded* bytes, so rewritten objects stay
+recognisable in a diff and byte-stable when re-serialized.
+
+## Errors
+
+`CosError`: `NotPdf`, `Syntax { offset, detail }`, `MissingObject`, `NotADictionary`, `Filter`,
+`NeedsPassword`, `WrongPassword`, `Security`, `Poisoned`.
+
+## Not done here
+
+- Streaming very large files within a memory budget (`ByteSource`, `core.lazy-loading`); files are
+  read whole today.
+- Linearized output, Fast Web View (`core.linearization`, M11).
+- Structural validation against the Arlington model (`core.arlington-validation`), which will live
+  in the reserved `arlington` crate.
+- Image codecs. `pdfcraft-filters` carries the non-image filters; DCT, JPX, JBIG2 and CCITT are
+  still decoded through the bootstrap renderer (`core.image-filters`, M2.6).
diff --git a/crates/cos/src/lib.rs b/crates/cos/src/lib.rs
index 2a534eca..7aa56079 100644
--- a/crates/cos/src/lib.rs
+++ b/crates/cos/src/lib.rs
@@ -5,9 +5,11 @@
 //! untouched) or as a full, garbage-collected rewrite. The PDF object graph *is* PdfCraft's
 //! document model (plan/architecture.md §5, ADR-0010).
 //!
-//! Status (M1 in progress): parsing of all xref forms, object streams, repair by scanning,
-//! incremental and full writing. Not yet: encryption (M1.6), object-stream / xref-stream output
-//! for full saves, linearization (M11).
+//! Done: every cross-reference form (tables, streams, hybrid `/XRefStm`), object streams, repair
+//! by scanning, encryption on load and save (R2–R6, crypt filters, `/EFF`), incremental writing,
+//! and full saves that pack objects into compressed object streams with a cross-reference stream.
+//! Not yet: streaming very large files within a memory budget (`ByteSource`,
+//! `core.lazy-loading`), and linearized output (`core.linearization`, M11). See the README.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
diff --git a/crates/engine/README.md b/crates/engine/README.md
new file mode 100644
index 00000000..c0553769
--- /dev/null
+++ b/crates/engine/README.md
@@ -0,0 +1,80 @@
+# pdfcraft-engine
+
+The façade every frontend talks to. It holds the open documents, their edit history and the tool
+catalogue; frontends never reach past it into the parsing, rendering or editing crates.
+
+- **Layer:** L6. It depends on most of L1–L4 and on nothing above itself. **No UI toolkit** —
+  `egui`, `winit`, `eframe` and `rfd` are forbidden below L7, and `xtask layers` enforces it.
+- The crate denies `unwrap`/`expect`/`panic!`/`todo!`. Entry points that run untrusted-document
+  code keep a last-resort `catch_unwind` guard so an escaped panic becomes an error and the user
+  keeps their document.
+
+Two frontends exist on top of it today: `pdfcraft-ui-egui` (desktop and web) and
+`pdfcraft-automation` (headless tools, the CLI and MCP). Anything one can do, the other must be
+able to do — see AGENTS.md §3.
+
+## The editing model
+
+Each open document holds a `pdfcraft_cos::Document`: the object graph plus a copy-on-write overlay.
+
+1. An edit runs **on a clone**. On success the previous state is pushed onto the undo stack. Clones
+   share all unchanged data, so a snapshot is cheap — this is what makes 100 levels of undo
+   affordable on a 200 MB file.
+2. After every edit the **working file** is produced by an incremental write: the original bytes
+   plus one appended revision.
+3. The view is refreshed from those bytes, so **what you see is exactly what Save will write**.
+4. Saving rebases onto the written bytes, so the next save appends only new edits.
+
+Consequences worth preserving: the original bytes of an opened file are never rewritten in place; a
+full rewrite happens only where it must (redaction, PDF/A conversion, print imposition, a changed
+password); and unknown data survives a round trip because nothing is reconstructed that wasn't
+understood.
+
+## API
+
+```rust
+let mut s = Session::new();
+let id = s.open("report.pdf", Some(path), bytes, None)?;   // -> DocId
+
+s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 })?;
+let label = s.undo(id)?;                                    // "Rotate pages"
+s.redo(id)?;
+
+let doc = s.get(id).ok_or("gone")?;                         // &Document: queries, never edits
+doc.can_undo(); doc.editable(); doc.allows_printing();
+doc.text_blocks(page); doc.page_boxes(page); doc.security_summary();
+
+let bytes = s.save_bytes(id)?;        // incremental: keeps signatures over earlier revisions valid
+let bytes = s.save_full_bytes(id)?;   // full rewrite, garbage-collected
+s.mark_saved(id, bytes.clone(), path)?;
+```
+
+`Edit` is one enum of 75 variants — every undoable change in the product, from
+`RotatePages` to `AddAnnotation`, `SetFieldValue`, `ApplyRedactions` and `AddWatermark`. Adding a
+feature means adding a variant and handling it in `apply`, which is what keeps undo, the dirty
+flag, autosave and the automation tools consistent for free.
+
+`Session` also owns the operations that produce a *new* document rather than editing one:
+`create_blank`, `create_from_images`, `create_from_text`, `combine`, `extract`, `split`,
+`split_by_size`, `reduced_bytes`, `optimized_bytes`, `print_pdf`, `export_data`, and the signing
+family (`sign`, `sign_with_timestamp`, `timestamp_document`, `embed_ltv`).
+
+## Modules
+
+| Module | What it holds |
+|---|---|
+| `commands` | The command registry: id, label, menu, shortcut, and a `Needs` precondition encoding document security. Menus, the ⌘K palette, shortcuts and the control channel all read it, so every surface agrees on what exists and when it is enabled |
+| `catalog` | Acrobat's "All tools" information architecture as data — groups, sections, icons, hues, and an `Availability` of `Ready`, `Planned(milestone)` or `Provider`. The UI renders what is *not* built yet, honestly |
+| `actions` | PDF action dispatch (go-to, URI, named, set-layer-state, JavaScript) |
+| `links` | Link creation, properties, and finding URLs in page text |
+| `js` | The bridge to `pdfcraft-js`. `forms` never depends on `js` directly; the engine injects it, so a build without JavaScript is possible |
+| `xfa`, `ocr`, `compare`, `export` | Façades over the L3/L4 crates of the same names |
+
+## Not done here
+
+- **Rendering is still borrowed.** `pdfcraft-render` wraps `hayro` and inspects through `lopdf`
+  (ADR-0004). The engine only sees `inspect() -> DocInfo`, `RenderPool` and `text::PageText`, and
+  that API stays frozen while M2 replaces what is behind it.
+- Performance budgets (`misc.performance-budgets`) are not set or enforced.
+- Some shipped features are still reachable only from the UI, not through an `automation` tool;
+  `cargo xtask parity` lists them; closing that gap is tracked in the execution plan (D4).

From 9a529a4fbeaae19417b4e9e66e0e8e71fe089ea8 Mon Sep 17 00:00:00 2001
From: sanyamsingh001 <sanyamsingh001@duck.com>
Date: Fri, 9 Oct 2026 18:45:32 +0000
Subject: [PATCH 115/149] Preserve alternate appearances and indirect
 push-button values on redraw (#417)

* D5: README for cos and engine, and an honest cos status line

Thirteen crates have no README, although the session protocol tells every session to read the README of the crate it is touching. These are the two biggest: cos is where every hostile file lands first, and engine is the whole API surface a frontend gets.

Each states its layer and the rules that bind it, sketches the API against the real signatures, and ends with what is deliberately not done. The cos README spells out the clone-is-a-snapshot property and why both writers return bytes rather than taking a sink; the engine README spells out the four-step editing model that makes what you see what Save writes.

Also corrects the module doc on cos/src/lib.rs, which still said encryption and object-stream output for full saves were not done. Both shipped: security.rs handles R2-R6 with crypt filters and /EFF, and SaveOptions::object_streams defaults to true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Preserve alternate appearances and indirect push-button values

Keep rollover, down and custom appearance entries when normal appearances are regenerated, without modifying shared dictionaries. Resolve indirect button caption and layout values. Cover full and incremental saved output, and wait for raster readiness in the existing Linux scroll test.

Co-authored-by: Codex <codex@openai.com>

* M14: let neutral Windows locales fall through to display language

Co-authored-by: Codex <codex@openai.com>

* pdfcraft-cli --help lists `mcp` only when the build has it

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* engine README: the execution plan is local-only, so don't link a path that doesn't exist

---------

Co-authored-by: Tanish Manku <tmanku.dev@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/annot/src/lib.rs      |   6 +-
 crates/annot/src/tests.rs    |  69 +++++++++++-
 crates/forms/src/author.rs   |   7 +-
 crates/forms/src/lib.rs      |  48 +++++++-
 crates/forms/src/tests.rs    | 206 +++++++++++++++++++++++++++++++++++
 crates/ui-egui/tests/view.rs |  24 +++-
 6 files changed, 351 insertions(+), 9 deletions(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index f6d6add1..6b14dfaa 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -1265,7 +1265,11 @@ pub fn set_appearance(doc: &mut Document, r: ObjRef) -> Result<(), AnnotError> {
         }
     }
     let ap = doc.add(Object::Stream(stream));
-    let mut apd = Dict::new();
+    // A copy (a shared /AP is left alone) that keeps unknown entries; the old down and rollover
+    // appearances would show the previous look on press or hover, so they go with the old /N.
+    let mut apd = d.get(b"AP").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned()).unwrap_or_default();
+    apd.remove(b"D");
+    apd.remove(b"R");
     apd.set(b"N".to_vec(), Object::Ref(ap));
     doc.update_dict(r, |d| {
         d.set(b"AP".to_vec(), Object::Dict(apd));
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index de75b323..5990e0d0 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -60,7 +60,7 @@ fn list(doc: &Document, page: usize) -> Vec<Dict> {
 }
 
 fn ap_content(doc: &Document, d: &Dict) -> String {
-    let n = d.get(b"AP").and_then(|a| a.as_dict()).and_then(|a| a.reference(b"N")).expect("has /AP /N");
+    let n = d.get(b"AP").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().and_then(|a| a.reference(b"N"))).expect("has /AP /N");
     let obj = doc.get(n);
     let Object::Stream(s) = &*obj else { panic!("AP is not a stream") };
     String::from_utf8_lossy(&s.decoded().unwrap()).into_owned()
@@ -852,3 +852,70 @@ fn every_line_ending_is_drawn() {
     assert!(appearance::build(&line_dict([f64::NAN, 0.0, 10.0, 0.0], "OpenArrow")).is_none(), "a non-finite endpoint is rejected");
     assert!(appearance::build(&line_dict([0.0, 0.0, 10.0, 0.0], "Foo")).is_none(), "an unknown ending is not replaced");
 }
+
+#[test]
+fn redraw_keeps_shared_annotation_appearances_and_drops_stale_alternates() {
+    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
+    for indirect in [false, true] {
+        let mut doc = fixture();
+        let first = add_annotation(&mut doc, &new(0, Shape::Rectangle { rect: [10.0, 10.0, 110.0, 60.0] }), &meta("first")).unwrap();
+        let other = add_annotation(&mut doc, &new(0, Shape::Rectangle { rect: [120.0, 10.0, 220.0, 60.0] }), &meta("other")).unwrap();
+        let (_, first_ref) = annot_ref(&mut doc, 0, first).unwrap();
+        let (_, other_ref) = annot_ref(&mut doc, 0, other).unwrap();
+        let mut entries = annot_dict(&doc, first_ref).get(b"AP").unwrap().as_dict().unwrap().clone();
+        for (key, bytes) in alternates {
+            let mut d = Dict::new();
+            d.set(b"Type".to_vec(), Object::name("XObject"));
+            d.set(b"Subtype".to_vec(), Object::name("Form"));
+            d.set(b"BBox".to_vec(), num_array(&[0.0, 0.0, 20.0, 10.0]));
+            let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
+            entries.set(key.to_vec(), Object::Ref(r));
+        }
+        entries.set(b"VendorState".to_vec(), Object::name("Retained"));
+        let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
+        for r in [first_ref, other_ref] {
+            doc.update_dict(r, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
+        }
+        let mut doc = reopen(&doc);
+        let other_dict = list(&doc, 0)[other].clone();
+        let source = other_dict.get(b"AP").unwrap();
+        let before = doc.resolve(source);
+        set_style(&mut doc, 0, first, Some([1.0, 0.0, 0.0]), None, None, None, &meta("")).unwrap();
+        assert_eq!(doc.resolve(source), before, "a shared AP must not change");
+        for full in [false, true] {
+            let bytes = if full {
+                pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
+            } else {
+                assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+                assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+                let original = doc.bytes();
+                let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+                assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+                assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+                bytes
+            };
+            hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+            let doc = Document::open(Arc::new(bytes)).unwrap();
+            let all = list(&doc, 0);
+            let first_ap = doc.resolve(all[first].get(b"AP").unwrap());
+            let other_ap = doc.resolve(all[other].get(b"AP").unwrap());
+            let first_ap = first_ap.as_dict().unwrap();
+            let other_ap = other_ap.as_dict().unwrap();
+            assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"));
+            // The restyled annotation keeps unknown entries, but not down/rollover looks in its
+            // old colour.
+            assert_eq!(first_ap.len(), 2);
+            assert_eq!(other_ap.len(), 4);
+            for (key, bytes) in alternates {
+                assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
+                let object = doc.resolve(other_ap.get(key).unwrap());
+                let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
+                assert_eq!(stream.decoded().unwrap(), bytes);
+            }
+            assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+            assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+            assert!(ap_content(&doc, &all[first]).contains("1 0 0 RG"));
+            assert!(ap_content(&doc, &all[other]).contains("0 0.4 1 RG"));
+        }
+    }
+}
diff --git a/crates/forms/src/author.rs b/crates/forms/src/author.rs
index edf5294c..53af944a 100644
--- a/crates/forms/src/author.rs
+++ b/crates/forms/src/author.rs
@@ -574,7 +574,8 @@ pub fn redraw_field(doc: &mut Document, name: &str) -> Result<(), FormError> {
                 d
             }
         };
-        doc.update_dict(w.obj, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
+        let existing = crate::merged_appearance(doc, w.obj, &ap);
+        doc.update_dict(w.obj, |d| d.set(b"AP".to_vec(), Object::Dict(existing)))?;
     }
     Ok(())
 }
@@ -616,8 +617,8 @@ fn button_appearance(doc: &Document, w: &Widget) -> Stream {
     let (width, height) = (place.layout_w, place.layout_h);
     let wobj = doc.get(w.obj);
     let mk = wobj.as_dict().and_then(|d| d.get(b"MK")).map(|m| doc.resolve(m)).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
-    let caption = mk.get(b"CA").and_then(|c| c.as_string()).map(|s| s.to_text()).unwrap_or_default();
-    let icon_only = mk.int(b"TP") == Some(1);
+    let caption = mk.get(b"CA").map(|c| doc.resolve(c)).and_then(|c| c.as_string().map(|s| s.to_text())).unwrap_or_default();
+    let icon_only = mk.get(b"TP").and_then(|t| doc.resolve(t).as_int()) == Some(1);
     let mut content = std::mem::take(&mut c).into_bytes();
     let mut xobjects = Dict::new();
     if let Some(icon) = mk.get(b"I").and_then(Object::as_ref)
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index 041c2480..0fadb236 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -952,6 +952,49 @@ fn set_states(doc: &mut Document, f: &Field, on: Option<&str>) -> Result<(), For
     Ok(())
 }
 
+/// Copy an existing appearance dictionary before replacing its normal appearance.
+fn appearance_dict(doc: &Document, widget: ObjRef) -> Dict {
+    doc.get(widget).as_dict().and_then(|d| d.get(b"AP").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned()).unwrap_or_default()
+}
+
+/// `widget`'s appearance dictionary (a copy, so a shared one is left alone) with the freshly
+/// drawn entries of `fresh` (its `/N`). Other entries are kept, but the old down and rollover
+/// appearances (`/D`, `/R`) would show the old value, caption or colour on press or hover, so
+/// they go — except, for check boxes and radio buttons (whose `/N` is a dictionary of states),
+/// the states the new `/N` still draws under the same names.
+pub(crate) fn merged_appearance(doc: &Document, widget: ObjRef, fresh: &Dict) -> Dict {
+    let mut apd = appearance_dict(doc, widget);
+    // Only a dictionary of states counts (`as_dict` would also see a stream's own dictionary).
+    let states_of = |o: &Object| match &*doc.resolve(o) {
+        Object::Dict(d) => Some(d.clone()),
+        _ => None,
+    };
+    let states: Option<Vec<Vec<u8>>> = fresh.get(b"N").and_then(states_of).map(|d| d.iter().map(|(k, _)| k.clone()).collect());
+    for key in [&b"D"[..], &b"R"[..]] {
+        if fresh.contains(key) {
+            continue;
+        }
+        let kept = states.as_ref().and_then(|names| {
+            let old = apd.get(key).and_then(states_of)?;
+            let mut d = Dict::new();
+            for (k, v) in old.iter().filter(|(k, _)| names.contains(k)) {
+                d.set(k.clone(), v.clone());
+            }
+            (!d.is_empty()).then_some(d)
+        });
+        match kept {
+            Some(d) => apd.set(key.to_vec(), Object::Dict(d)),
+            None => {
+                apd.remove(key);
+            }
+        }
+    }
+    for (k, v) in fresh.iter() {
+        apd.set(k.clone(), v.clone());
+    }
+    apd
+}
+
 /// Regenerate the normal appearance of every widget of a text or choice field.
 fn redraw(doc: &mut Document, f: &Field, values: &[String], scripts: &mut dyn Scripts) -> Result<(), FormError> {
     let shown = match values {
@@ -964,8 +1007,9 @@ fn redraw(doc: &mut Document, f: &Field, values: &[String], scripts: &mut dyn Sc
             None => appearance::field_appearance(doc, f, w, values),
         };
         let ap = doc.add(Object::Stream(stream));
-        let mut apd = Dict::new();
-        apd.set(b"N".to_vec(), Object::Ref(ap));
+        let mut fresh = Dict::new();
+        fresh.set(b"N".to_vec(), Object::Ref(ap));
+        let apd = merged_appearance(doc, w.obj, &fresh);
         doc.update_dict(w.obj, |d| {
             d.set(b"AP".to_vec(), Object::Dict(apd));
             d.remove(b"AS");
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index af1a8529..94255eab 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1062,3 +1062,209 @@ fn a_rotation_refused_as_too_small_changes_nothing_else() {
     assert_eq!(f.tooltip, None, "the tooltip was written before the rotation was refused");
     assert_eq!(f.widgets[0].rotation, 0);
 }
+
+#[test]
+fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
+    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
+    let cases = [
+        (NewField::Text { multiline: false }, true),
+        (NewField::Text { multiline: false }, false),
+        (NewField::CheckBox, false),
+        (NewField::Button { caption: "Button".into() }, false),
+        (NewField::Signature, false),
+    ];
+    for (kind, fill) in cases {
+        for indirect in [false, true] {
+            let mut doc = one_page();
+            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
+            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
+            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
+            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+            for (key, bytes) in alternates {
+                let mut d = Dict::new();
+                d.set(b"Type".to_vec(), Object::name("XObject"));
+                d.set(b"Subtype".to_vec(), Object::name("Form"));
+                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
+                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
+                entries.set(key.to_vec(), Object::Ref(r));
+            }
+            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
+            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
+            for widget in [first_widget, other_widget] {
+                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
+            }
+            let original = reopen(&doc);
+            for full in [false, true] {
+                let mut doc = original.clone();
+                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
+                let before = doc.resolve(&source);
+                if fill {
+                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
+                } else {
+                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
+                }
+                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
+                let bytes = if full {
+                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
+                } else {
+                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+                    let original = doc.bytes();
+                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+                    bytes
+                };
+                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+                let doc = Document::open(Arc::new(bytes)).unwrap();
+                let all = fields(&doc);
+                let first = field(&all, &first);
+                let other = field(&all, &other);
+                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let first_ap = first_ap.as_dict().unwrap();
+                let other_ap = other_ap.as_dict().unwrap();
+                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
+                assert_eq!(other_ap.len(), 4);
+                // The redrawn widget keeps unknown entries, but not down/rollover looks that
+                // would show its old value or caption on press or hover.
+                assert_eq!(
+                    first_ap.len(),
+                    2,
+                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
+                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
+                );
+                for (key, bytes) in alternates {
+                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
+                    let object = doc.resolve(other_ap.get(key).unwrap());
+                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
+                    assert_eq!(stream.decoded().unwrap(), bytes);
+                }
+                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                if fill {
+                    assert_eq!(first.value, ["Updated value"]);
+                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
+                    assert!(other.value.is_empty());
+                } else {
+                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
+                    assert_eq!(other.tooltip, None);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
+    fn saved(doc: &Document, full: bool) -> Document {
+        let bytes = if full {
+            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
+        } else {
+            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+            let original = doc.bytes();
+            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+            bytes
+        };
+        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+        Document::open(Arc::new(bytes)).unwrap()
+    }
+
+    for indirect_caption in [false, true] {
+        for indirect_layout in [false, true] {
+            for icon_only in [false, true] {
+                let mut doc = one_page();
+                let name =
+                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
+                        .unwrap();
+                let widget = field(&fields(&doc), &name).widgets[0].obj;
+                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
+                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
+                let layout = Object::Int(i64::from(icon_only));
+                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
+                let mut icon_dict = Dict::new();
+                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
+                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
+                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
+                let icon_bytes = b"0 0 4 2 re f\n";
+                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
+                let mut mk = Dict::new();
+                mk.set(b"CA".to_vec(), caption);
+                mk.set(b"TP".to_vec(), layout);
+                mk.set(b"I".to_vec(), Object::Ref(icon));
+                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
+                let mk = doc.add(Object::Dict(mk));
+                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
+
+                // Import the operands from a real saved file before an unrelated public edit.
+                let original = saved(&doc, true);
+                for full in [false, true] {
+                    let mut doc = original.clone();
+                    let widget = field(&fields(&doc), &name).widgets[0].obj;
+                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
+                    let original_mk = doc.resolve(&mk_before);
+                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
+                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
+                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
+                    let doc = saved(&doc, full);
+                    let f = field(&fields(&doc), &name).clone();
+                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
+                    let w = &f.widgets[0];
+                    let wd = doc.get(w.obj);
+                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
+                    let mk = mk_object.as_dict().unwrap();
+                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
+                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
+                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
+                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
+                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
+                    let appearance = ap(&doc, w);
+                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
+                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
+                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
+                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+                    let appearance_object = doc.get(n);
+                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
+                    let resource_icon =
+                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
+                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
+                    let icon_object = doc.resolve(resource_icon);
+                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
+                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
+                }
+            }
+        }
+    }
+}
+
+/// A check box's down appearances survive a redraw for the states it still draws (same names),
+/// and a down appearance for a state it no longer has is dropped rather than left stale.
+#[test]
+fn check_box_redraw_keeps_down_states_it_still_draws() {
+    let mut doc = one_page();
+    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
+    let widget = field(&fields(&doc), &name).widgets[0].obj;
+    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
+    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+    let mut down = Dict::new();
+    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Form"));
+        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
+        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
+        down.set(state.to_vec(), Object::Ref(r));
+    }
+    ap.set(b"D".to_vec(), Object::Dict(down));
+    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
+    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
+    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
+    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
+    let d = d.as_dict().unwrap();
+    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
+    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
+}
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index 479c58b7..222df48a 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -92,9 +92,25 @@ fn middle_button_scrolling_keeps_page_colours_in_both_themes() {
             let mut h = harness(&[("zoom", "50")]);
             h.state_mut().set_option("theme", theme).unwrap();
             h.state_mut().set_option("organize", if organize { "on" } else { "off" }).unwrap();
-            for _ in 0..100 {
+            let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+            loop {
+                assert!(
+                    std::time::Instant::now() < deadline,
+                    "render readiness timed out: theme={theme}, organize={organize}, errors={:?}",
+                    h.state().views[0].page_errors()
+                );
                 h.run_steps(2);
                 if !h.state().render_pending() {
+                    // Paint one fresh frame after all requested rasters have arrived.
+                    h.run_steps(1);
+                    if h.state().render_pending() {
+                        continue;
+                    }
+                    assert!(
+                        h.state().views[0].page_errors().is_empty(),
+                        "page render errors: theme={theme}, organize={organize}, errors={:?}",
+                        h.state().views[0].page_errors()
+                    );
                     break;
                 }
                 std::thread::sleep(std::time::Duration::from_millis(5));
@@ -103,7 +119,11 @@ fn middle_button_scrolling_keeps_page_colours_in_both_themes() {
             let at = page.center();
             let ppp = h.ctx.pixels_per_point();
             let before = *h.render().unwrap().get_pixel((at.x * ppp) as u32, (at.y * ppp) as u32);
-            assert_eq!(before, image::Rgba([255, 255, 255, 255]), "the synthetic page is white");
+            assert_eq!(
+                before,
+                image::Rgba([255, 255, 255, 255]),
+                "the synthetic page is white: theme={theme}, organize={organize}, page={page:?}, ppp={ppp}"
+            );
             let anchor = h.state().views[0].viewport_rect().center();
             h.event(egui::Event::PointerMoved(anchor));
             h.event(egui::Event::PointerButton { pos: anchor, button: egui::PointerButton::Middle, pressed: true, modifiers: Modifiers::NONE });

From 37076662a79af6221f6dd23a3268a1bafa636ee4 Mon Sep 17 00:00:00 2001
From: Flowershangfromthebranches
 <152056395+Flowershangfromthebranches@users.noreply.github.com>
Date: Sat, 10 Oct 2026 02:45:49 +0800
Subject: [PATCH 116/149] M7: select and edit grouped PDF figures (Form
 XObjects) (#450)

* D5: README for cos and engine, and an honest cos status line

Thirteen crates have no README, although the session protocol tells every session to read the README of the crate it is touching. These are the two biggest: cos is where every hostile file lands first, and engine is the whole API surface a frontend gets.

Each states its layer and the rules that bind it, sketches the API against the real signatures, and ends with what is deliberately not done. The cos README spells out the clone-is-a-snapshot property and why both writers return bytes rather than taking a sink; the engine README spells out the four-step editing model that makes what you see what Save writes.

Also corrects the module doc on cos/src/lib.rs, which still said encryption and object-stream output for full saves were not done. Both shipped: security.rs handles R2-R6 with crypt filters and /EFF, and SaveOptions::object_streams defaults to true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Preserve alternate appearances and indirect push-button values

Keep rollover, down and custom appearance entries when normal appearances are regenerated, without modifying shared dictionaries. Resolve indirect button caption and layout values. Cover full and incremental saved output, and wait for raster readiness in the existing Linux scroll test.

Co-authored-by: Codex <codex@openai.com>

* M7: select and edit grouped Form XObject figures

Co-Authored-By: Codex <noreply@openai.com>

* M14: let neutral Windows locales fall through to display language

Co-authored-by: Codex <codex@openai.com>

* pdfcraft-cli --help lists `mcp` only when the build has it

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* engine README: the execution plan is local-only, so don't link a path that doesn't exist

---------

Co-authored-by: Tanish Manku <tmanku.dev@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                            |   1 +
 ROADMAP.md                            |   2 +
 crates/automation/Cargo.toml          |   1 +
 crates/automation/src/lib.rs          |   2 +-
 crates/automation/src/tools.rs        |   6 +-
 crates/automation/tests/automation.rs |  45 ++++++
 crates/edit/src/images.rs             |  92 +++++++++---
 crates/edit/src/tests.rs              |  50 +++++++
 crates/engine/src/lib.rs              |  12 +-
 crates/forms/src/tests.rs             | 206 ++++++++++++++++++++++++++
 crates/ui-egui/src/edit_text_ui.rs    |   5 +-
 crates/ui-egui/tests/editing.rs       |  28 +++-
 docs/editing-images.md                |  23 +++
 parity/acrobat-features.toml          |   6 +-
 14 files changed, 447 insertions(+), 32 deletions(-)
 create mode 100644 docs/editing-images.md

diff --git a/Cargo.lock b/Cargo.lock
index ad0ef873..a00258ae 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3489,6 +3489,7 @@ dependencies = [
  "image",
  "pdfcraft-cos",
  "pdfcraft-engine",
+ "pdfcraft-model",
  "pdfcraft-organize",
  "pdfcraft-platform",
  "pdfcraft-render",
diff --git a/ROADMAP.md b/ROADMAP.md
index a0d9246c..74f6df25 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -144,6 +144,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-08 (M14, #307, upstream integration):** Rebased the local candidate onto main `a6bc63a`, preserving render-request deduplication, pixel-aligned rasters, signature editing and organizer insertion controls. Regressions cover inactive signature-preview cleanup, insertion gaps under virtualization, and canceled/reintroduced render requests. All 1,336 workspace tests pass (6 ignored), 193 parser tests pass (2 missing-fixture tests filtered), strict workspace/all-target Clippy passes without allowances, and 30 WASM crate checks pass. All 1,010 navigation frames, 12 workflow artifacts and eight 100-page external PDF checks match; 1×/2× desktop protocols pass again. Inspection is 497.7 MiB / 1.78 s, full-save 1.06 GiB / 29.64 s, and fresh desktop navigation/close/reopen 877 MiB. The desktop result is higher than the pre-rebase 832 MiB, while remaining 21.9% below the earlier bounded-writer stage. Windows, cold-start latency and global memory budgets remain open; no milestone percentage increase.
 
+- **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index 74d90c04..3f8d63e2 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -25,5 +25,6 @@ mcp = ["dep:base64"]
 
 [dev-dependencies]
 pdfcraft-cos = { workspace = true }
+pdfcraft-model = { workspace = true }
 pdfcraft-xfa = { workspace = true }
 image = { version = "0.25", default-features = false, features = ["jpeg"] }
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index bfbd90a9..ddb78956 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -332,7 +332,7 @@ impl Automation {
                     .enumerate()
                     .map(|(i, im)| {
                         let (u, v) = (info.user_to_view(im.rect[0] as f32, im.rect[1] as f32), info.user_to_view(im.rect[2] as f32, im.rect[3] as f32));
-                        json!({ "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name })
+                        json!({ "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
                     })
                     .collect();
                 json!({ "page": page + 1, "count": list.len(), "images": list })
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 5ca52700..14d7dcf4 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -987,11 +987,11 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("page_images", "List page images", "The images a page draws (Edit a PDF): number, box (top-left-origin points), pixel size and resource name.")
+        t("page_images", "List page images", "The raster images and grouped Form artwork a page draws (Edit a PDF): number, box (top-left-origin points), kind (image/form), pixel size ([0,0] for forms) and resource name. Forms include nested graphics and are edited as a whole. Numbers count forms and images together in drawing order, so a page with forms numbers its images differently than before forms were listed: always take numbers from a fresh page_images call.")
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new box in top-left-origin points), rotate (quarters clockwise, default 1), flip_horizontal, flip_vertical, replace (path: an image file, drawn in the same place) or delete. Undoable.")
+        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new box in top-left-origin points), rotate (quarters clockwise, default 1), flip_horizontal, flip_vertical, replace (path: an image file, drawn in the same place) or delete. Undoable. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
             .cmd("edit.edit_text")
             .with(schema(
                 json!({
@@ -1005,7 +1005,7 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc", "page", "image", "action"],
             )),
-        t("image_save", "Save image as", "Write one of a page's images to path: JPEG images unchanged, others as PNG (the extension is added when missing).")
+        t("image_save", "Save image as", "Write one of a page's raster images (number from page_images; forms are refused) to path: JPEG images unchanged, others as PNG (the extension is added when missing).")
             .destructive()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "image": { "type": "integer", "minimum": 1 }, "path": { "type": "string" } }), &["doc", "page", "image", "path"])),
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index cbda75f2..a900d303 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1327,6 +1327,51 @@ fn editing_page_images_through_tools() {
     assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "delete" })), Err(ToolError::InvalidArgs(_))));
 }
 
+#[test]
+fn editing_form_artwork_through_tools() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let dir = workdir("form-artwork");
+    let mut cos = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&cos)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 80, 40].map(Object::Int).to_vec()));
+    let artwork = cos.add(Object::Stream(Stream::flate(form, b"0.2 0.5 0.9 rg 0 0 80 40 re f")));
+    let contents = cos.add(Object::Stream(Stream::flate(Dict::new(), b"q 1 0 0 1 20 240 cm /Figure Do Q")));
+    cos.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"Figure".to_vec(), Object::Ref(artwork));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    std::fs::write(dir.join("figure.pdf"), write_incremental(&cos, &SaveOptions::default()).unwrap()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({"path": "figure.pdf"}))["doc"].as_u64().unwrap();
+    let before = ok(&mut a, "page_images", json!({"doc": doc, "page": 1}))["images"][0].clone();
+    assert_eq!(before["kind"], "form");
+    assert_eq!(before["pixels"], json!([0, 0]));
+    assert_eq!(before["rect"], json!([20.0, 20.0, 100.0, 60.0]));
+    let rendered_before = a.call("page_render", &json!({"doc": doc, "page": 1, "dpi": 72})).unwrap();
+    assert!(a.call("image_save", &json!({"doc": doc, "page": 1, "image": 1, "path": "out/figure"})).is_err());
+    ok(&mut a, "image_edit", json!({"doc": doc, "page": 1, "image": 1, "action": "move", "rect": [40, 50, 120, 90]}));
+    assert_eq!(ok(&mut a, "page_images", json!({"doc": doc, "page": 1}))["images"][0]["rect"], json!([40.0, 50.0, 120.0, 90.0]));
+    let rendered_moved = a.call("page_render", &json!({"doc": doc, "page": 1, "dpi": 72})).unwrap();
+    assert_ne!(rendered_before, rendered_moved, "the rendered artwork actually moves");
+    ok(&mut a, "doc_save", json!({"doc": doc, "path": "out/moved.pdf"}));
+    let re = ok(&mut a, "doc_open", json!({"path": "out/moved.pdf"}))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "page_images", json!({"doc": re, "page": 1}))["images"][0]["rect"], json!([40.0, 50.0, 120.0, 90.0]));
+    ok(&mut a, "image_edit", json!({"doc": re, "page": 1, "image": 1, "action": "delete"}));
+    assert_eq!(ok(&mut a, "page_images", json!({"doc": re, "page": 1}))["count"], 0);
+    ok(&mut a, "edit_undo", json!({"doc": re}));
+    assert_eq!(ok(&mut a, "page_images", json!({"doc": re, "page": 1}))["count"], 1);
+    ok(&mut a, "edit_undo", json!({"doc": doc}));
+    assert_eq!(ok(&mut a, "page_images", json!({"doc": doc, "page": 1}))["images"][0], before);
+    assert_eq!(a.call("page_render", &json!({"doc": doc, "page": 1, "dpi": 72})).unwrap(), rendered_before);
+}
+
 #[test]
 fn auditing_space_through_tools() {
     let dir = workdir("audit");
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index ff6f5494..7f3a2a69 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -1,4 +1,4 @@
-//! Edit a PDF ▸ edit existing images: the images a page draws (image XObjects painted by `Do`
+//! Edit a PDF ▸ edit existing images and grouped artwork (Image/Form XObjects painted by `Do`
 //! in its own content streams), and changing one: move/resize/rotate/flip (the `Do` is wrapped in
 //! `q … cm … Q` with the extra transform), replace (it draws another XObject in the same place),
 //! or delete. Only the stream that draws it is rewritten, as a new object.
@@ -13,16 +13,20 @@ use crate::EditError;
 pub struct PageImage {
     /// Its box in user space.
     pub rect: [f64; 4],
-    /// The placement: the unit square → user space.
+    /// The placement: image unit square or Form coordinates → user space.
     pub matrix: [f64; 6],
     /// The XObject resource name and object.
     pub name: String,
     pub object: Option<ObjRef>,
-    /// Pixel size.
+    /// Whether this is grouped Form artwork, edited as a whole (including its nested content).
+    pub is_form: bool,
+    /// Pixel size; zero for vector/grouped Form artwork.
     pub width: u32,
     pub height: u32,
     stream: usize,
     op: usize,
+    /// CTM before `Do`, excluding a Form's own Matrix.
+    draw_matrix: [f64; 6],
 }
 
 fn streams(doc: &Document, page: &Dict) -> Vec<(Object, Vec<u8>)> {
@@ -55,7 +59,8 @@ fn xobjects(doc: &Document, page: &Dict) -> Dict {
         .unwrap_or_default()
 }
 
-/// The images page `page` (0-based) draws, in drawing order.
+/// The images and Form artwork page `page` (0-based) draws, in drawing order.
+/// Forms stay intact: no traversal or rewriting of their internal objects is needed.
 pub fn page_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, EditError> {
     let p = page_of(doc, page)?;
     let xo = xobjects(doc, &p.dict);
@@ -75,21 +80,59 @@ pub fn page_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, EditEr
                 }
                 b"Do" => {
                     let Some(name) = op.name(0) else { continue };
-                    let Some(r) = xo.get(name).and_then(Object::as_ref) else { continue };
-                    let obj = doc.get(r);
+                    let Some(resource) = xo.get(name) else { continue };
+                    let obj = doc.resolve(resource);
                     let Object::Stream(s) = &*obj else { continue };
-                    if s.dict.name(b"Subtype") != Some(b"Image") {
+                    let is_form = s.dict.name(b"Subtype") == Some(b"Form");
+                    let (matrix, bounds) = if is_form {
+                        let Some(bounds) = s.dict.get(b"BBox").map(|v| doc.resolve(v)).and_then(|v| {
+                            v.as_array().and_then(|a| {
+                                if a.len() != 4 {
+                                    return None;
+                                }
+                                let mut b = [0.0; 4];
+                                for (n, v) in b.iter_mut().zip(a) {
+                                    *n = v.as_f64()?;
+                                }
+                                Some(b)
+                            })
+                        }) else {
+                            continue;
+                        };
+                        let matrix = match s.dict.get(b"Matrix") {
+                            Some(v) => {
+                                let v = doc.resolve(v);
+                                let Some(m) = v.as_array().and_then(|a| Matrix::from_operands(a)) else { continue };
+                                m
+                            }
+                            None => Matrix::IDENTITY,
+                        };
+                        (matrix.then(&ctm), bounds)
+                    } else if s.dict.name(b"Subtype") == Some(b"Image") {
+                        (ctm, [0.0, 0.0, 1.0, 1.0])
+                    } else {
+                        continue;
+                    };
+                    let rect = matrix.bbox(bounds);
+                    if !bounds.iter().chain(matrix.0.iter()).chain(rect.iter()).all(|v| v.is_finite())
+                        || bounds[2] <= bounds[0]
+                        || bounds[3] <= bounds[1]
+                        || rect[2] <= rect[0]
+                        || rect[3] <= rect[1]
+                    {
                         continue;
                     }
                     out.push(PageImage {
-                        rect: ctm.bbox([0.0, 0.0, 1.0, 1.0]),
-                        matrix: ctm.0,
+                        rect,
+                        matrix: matrix.0,
                         name: String::from_utf8_lossy(name).into_owned(),
-                        object: Some(r),
-                        width: s.dict.int(b"Width").unwrap_or(0).max(0) as u32,
-                        height: s.dict.int(b"Height").unwrap_or(0).max(0) as u32,
+                        object: resource.as_ref(),
+                        is_form,
+                        width: if is_form { 0 } else { s.dict.int(b"Width").unwrap_or(0).clamp(0, u32::MAX as i64) as u32 },
+                        height: if is_form { 0 } else { s.dict.int(b"Height").unwrap_or(0).clamp(0, u32::MAX as i64) as u32 },
                         stream: si,
                         op: i,
+                        draw_matrix: ctm.0,
                     });
                 }
                 _ => {}
@@ -137,24 +180,31 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
     let img = images.get(index).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1)))?;
     let p = page_of(doc, page)?;
     let all = streams(doc, &p.dict);
-    let (obj, data) = all[img.stream].clone();
+    let (obj, data) = all.get(img.stream).cloned().ok_or_else(|| EditError::Invalid("the image stream is missing".into()))?;
     let mut ops = parse(&data).ops;
+    let original = ops.get(img.op).cloned().ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
     let mut resources = None;
     let replacement: Vec<Op> = match change {
         ImageChange::Delete => Vec::new(),
         ImageChange::Transform(t) => {
+            if !t.iter().all(|v| v.is_finite()) {
+                return Err(EditError::Invalid("the image transform must be finite".into()));
+            }
             // New CTM = placement × T; as a `cm` before the Do: M = P · T · P⁻¹.
-            let pm = Matrix(img.matrix);
+            let pm = Matrix(img.draw_matrix);
             let inv = pm.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
             let m = pm.then(&Matrix(*t)).then(&inv);
-            vec![
-                Op::new("q", vec![]),
-                Op::new("cm", m.0.iter().map(|v| pdfcraft_content::num(*v)).collect()),
-                ops[img.op].clone(),
-                Op::new("Q", vec![]),
-            ]
+            if !m.0.iter().all(|v| v.is_finite()) {
+                return Err(EditError::Invalid("the image transform is too large".into()));
+            }
+            vec![Op::new("q", vec![]), Op::new("cm", m.0.iter().map(|v| pdfcraft_content::num(*v)).collect()), original, Op::new("Q", vec![])]
         }
         ImageChange::Replace(r) => {
+            if img.is_form {
+                return Err(EditError::Invalid(
+                    "grouped Form artwork can be moved, resized, rotated, flipped or deleted; replacing it with a bitmap is not supported".into(),
+                ));
+            }
             let name = format!("PCImg{}", r.num);
             let mut res = p.dict.get(b"Resources").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
             let mut xo = res.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
@@ -173,7 +223,7 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
     let new = doc.add(Object::Stream(Stream::flate(dict, &serialize_ops(&ops))));
     let contents: Vec<Object> = all.iter().enumerate().map(|(i, (o, _))| if i == img.stream { Object::Ref(new) } else { o.clone() }).collect();
     doc.update_dict(p.obj, |d| {
-        d.set(b"Contents".to_vec(), if contents.len() == 1 { contents[0].clone() } else { Object::Array(contents) });
+        d.set(b"Contents".to_vec(), if let [one] = contents.as_slice() { one.clone() } else { Object::Array(contents) });
         if let Some(res) = resources {
             d.set(b"Resources".to_vec(), Object::Dict(res));
         }
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 2ef3b48a..e0e69f3a 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -953,6 +953,56 @@ fn page_images_move_turn_replace_and_delete() {
     assert!(images::change_image(&mut doc, 0, 0, &images::ImageChange::Delete).is_err());
 }
 
+#[test]
+fn form_artwork_edits_only_the_selected_placement() {
+    let mut doc = fixture(); // three pages share resources; pages 0 and 1 also share contents
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([10, 20, 110, 70].map(Object::Int).to_vec()));
+    form.set(b"Matrix".to_vec(), Object::Array([2, 0, 0, 3, -20, -60].map(Object::Int).to_vec()));
+    let artwork = doc.add(Object::Stream(Stream::flate(form, b"1 0 0 rg 10 20 100 50 re f")));
+    doc.update_dict(pdfcraft_cos::ObjRef::new(6, 0), |d| {
+        let mut xo = Dict::new();
+        xo.set(b"Figure".to_vec(), Object::Ref(artwork));
+        d.set(b"XObject".to_vec(), Object::Dict(xo));
+    })
+    .unwrap();
+    let content = b"q 1 0 0 1 40 80 cm /Figure Do Q q 1 0 0 1 300 400 cm /Figure Do Q BT /F1 9 Tf (Caption) Tj ET";
+    doc.set(pdfcraft_cos::ObjRef::new(7, 0), Object::Stream(Stream::flate(Dict::new(), content)));
+    let mut doc = reopen(&doc);
+    let original = doc.get(artwork);
+    let imgs = images::page_images(&doc, 0).unwrap();
+    assert_eq!(imgs.len(), 2);
+    assert!(imgs[0].is_form);
+    assert_eq!((imgs[0].width, imgs[0].height), (0, 0));
+    assert!(close(imgs[0].rect, [40.0, 80.0, 240.0, 230.0]));
+    let target = [60.0, 100.0, 160.0, 175.0];
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(images::rect_to_rect(imgs[0].rect, target))).unwrap();
+    let mut doc = reopen(&doc);
+    let moved = images::page_images(&doc, 0).unwrap();
+    assert!(close(moved[0].rect, target));
+    assert_eq!(moved[1].rect, imgs[1].rect);
+    assert_eq!(images::page_images(&doc, 1).unwrap()[0].rect, imgs[0].rect);
+    assert_eq!(*doc.get(artwork), *original, "the shared Form and its unknown data are untouched");
+    assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Caption");
+    let t = images::turn_about_centre(target, 1, false, false);
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(t)).unwrap();
+    assert!(close(images::page_images(&doc, 0).unwrap()[0].rect, [72.5, 87.5, 147.5, 187.5]));
+    assert!(images::change_image(&mut doc, 0, 0, &images::ImageChange::Replace(artwork)).is_err());
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Delete).unwrap();
+    let doc = reopen(&doc);
+    assert_eq!(images::page_images(&doc, 0).unwrap().len(), 1);
+    assert_eq!(images::page_images(&doc, 1).unwrap().len(), 2);
+    // Invalid bounds are skipped without interpreting the Form stream.
+    let mut doc = doc;
+    let mut broken = (*doc.get(artwork)).clone();
+    if let Object::Stream(s) = &mut broken {
+        s.dict.set(b"BBox".to_vec(), Object::Array(vec![Object::Int(0)]));
+    }
+    doc.set(artwork, broken);
+    assert!(images::page_images(&doc, 0).unwrap().is_empty());
+}
+
 #[test]
 fn paragraphs_take_new_formatting() {
     let mut doc = text_page("BT /F1 10 Tf 12 TL 100 700 Td (One two three four five six seven) Tj T* (eight nine ten eleven twelve) Tj ET");
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index cbffb07a..878d98e8 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -269,6 +269,9 @@ impl Document {
     pub fn page_image_file(&self, page: usize, index: usize) -> Result<(&'static str, Vec<u8>), String> {
         let editor = self.editor.as_ref().ok_or("the document can't be read")?;
         let img = self.page_images(page).into_iter().nth(index).ok_or_else(|| format!("page {} has no image {}", page + 1, index + 1))?;
+        if img.is_form {
+            return Err("grouped Form artwork is not a bitmap; Save Image As is only available for raster images".into());
+        }
         pdfcraft_create::image_file(&editor.cos, img.object.ok_or("the image has no object")?)
     }
 
@@ -1582,7 +1585,14 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
                 ImageEdit::Flip { horizontal } => {
                     pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.rect, 0, *horizontal, !*horizontal))
                 }
-                ImageEdit::Replace { name, bytes } => pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0),
+                ImageEdit::Replace { name, bytes } => {
+                    if img.is_form {
+                        return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
+                            "grouped Form artwork cannot be replaced with a bitmap".into(),
+                        )));
+                    }
+                    pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
+                }
                 ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
             };
             pdfcraft_edit::change_image(doc, *page, *index, &c)?;
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 94255eab..a5953681 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1268,3 +1268,209 @@ fn check_box_redraw_keeps_down_states_it_still_draws() {
     assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
     assert!(!d.contains(b"Gone"), "a state the box no longer draws");
 }
+
+#[test]
+fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
+    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
+    let cases = [
+        (NewField::Text { multiline: false }, true),
+        (NewField::Text { multiline: false }, false),
+        (NewField::CheckBox, false),
+        (NewField::Button { caption: "Button".into() }, false),
+        (NewField::Signature, false),
+    ];
+    for (kind, fill) in cases {
+        for indirect in [false, true] {
+            let mut doc = one_page();
+            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
+            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
+            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
+            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+            for (key, bytes) in alternates {
+                let mut d = Dict::new();
+                d.set(b"Type".to_vec(), Object::name("XObject"));
+                d.set(b"Subtype".to_vec(), Object::name("Form"));
+                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
+                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
+                entries.set(key.to_vec(), Object::Ref(r));
+            }
+            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
+            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
+            for widget in [first_widget, other_widget] {
+                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
+            }
+            let original = reopen(&doc);
+            for full in [false, true] {
+                let mut doc = original.clone();
+                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
+                let before = doc.resolve(&source);
+                if fill {
+                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
+                } else {
+                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
+                }
+                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
+                let bytes = if full {
+                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
+                } else {
+                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+                    let original = doc.bytes();
+                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+                    bytes
+                };
+                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+                let doc = Document::open(Arc::new(bytes)).unwrap();
+                let all = fields(&doc);
+                let first = field(&all, &first);
+                let other = field(&all, &other);
+                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let first_ap = first_ap.as_dict().unwrap();
+                let other_ap = other_ap.as_dict().unwrap();
+                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
+                assert_eq!(other_ap.len(), 4);
+                // The redrawn widget keeps unknown entries, but not down/rollover looks that
+                // would show its old value or caption on press or hover.
+                assert_eq!(
+                    first_ap.len(),
+                    2,
+                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
+                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
+                );
+                for (key, bytes) in alternates {
+                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
+                    let object = doc.resolve(other_ap.get(key).unwrap());
+                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
+                    assert_eq!(stream.decoded().unwrap(), bytes);
+                }
+                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                if fill {
+                    assert_eq!(first.value, ["Updated value"]);
+                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
+                    assert!(other.value.is_empty());
+                } else {
+                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
+                    assert_eq!(other.tooltip, None);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
+    fn saved(doc: &Document, full: bool) -> Document {
+        let bytes = if full {
+            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
+        } else {
+            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+            let original = doc.bytes();
+            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+            bytes
+        };
+        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+        Document::open(Arc::new(bytes)).unwrap()
+    }
+
+    for indirect_caption in [false, true] {
+        for indirect_layout in [false, true] {
+            for icon_only in [false, true] {
+                let mut doc = one_page();
+                let name =
+                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
+                        .unwrap();
+                let widget = field(&fields(&doc), &name).widgets[0].obj;
+                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
+                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
+                let layout = Object::Int(i64::from(icon_only));
+                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
+                let mut icon_dict = Dict::new();
+                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
+                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
+                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
+                let icon_bytes = b"0 0 4 2 re f\n";
+                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
+                let mut mk = Dict::new();
+                mk.set(b"CA".to_vec(), caption);
+                mk.set(b"TP".to_vec(), layout);
+                mk.set(b"I".to_vec(), Object::Ref(icon));
+                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
+                let mk = doc.add(Object::Dict(mk));
+                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
+
+                // Import the operands from a real saved file before an unrelated public edit.
+                let original = saved(&doc, true);
+                for full in [false, true] {
+                    let mut doc = original.clone();
+                    let widget = field(&fields(&doc), &name).widgets[0].obj;
+                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
+                    let original_mk = doc.resolve(&mk_before);
+                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
+                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
+                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
+                    let doc = saved(&doc, full);
+                    let f = field(&fields(&doc), &name).clone();
+                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
+                    let w = &f.widgets[0];
+                    let wd = doc.get(w.obj);
+                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
+                    let mk = mk_object.as_dict().unwrap();
+                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
+                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
+                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
+                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
+                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
+                    let appearance = ap(&doc, w);
+                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
+                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
+                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
+                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+                    let appearance_object = doc.get(n);
+                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
+                    let resource_icon =
+                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
+                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
+                    let icon_object = doc.resolve(resource_icon);
+                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
+                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
+                }
+            }
+        }
+    }
+}
+
+/// A check box's down appearances survive a redraw for the states it still draws (same names),
+/// and a down appearance for a state it no longer has is dropped rather than left stale.
+#[test]
+fn check_box_redraw_keeps_down_states_it_still_draws() {
+    let mut doc = one_page();
+    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
+    let widget = field(&fields(&doc), &name).widgets[0].obj;
+    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
+    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+    let mut down = Dict::new();
+    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Form"));
+        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
+        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
+        down.set(state.to_vec(), Object::Ref(r));
+    }
+    ap.set(b"D".to_vec(), Object::Dict(down));
+    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
+    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
+    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
+    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
+    let d = d.as_dict().unwrap();
+    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
+    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
+}
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 6cab5466..f5d53071 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -353,11 +353,12 @@ pub(crate) fn image_input(
                     ui.close();
                 }
             }
-            if ui.button(tl!("Replace Image…")).clicked() {
+            let raster = images.get(hit).is_some_and(|image| !image.is_form);
+            if ui.add_enabled(raster, egui::Button::new(tl!("Replace Image…"))).clicked() {
                 *action = Some(ImageAction::Replace(page, hit));
                 ui.close();
             }
-            if ui.button(tl!("Save Image As…")).clicked() {
+            if ui.add_enabled(raster, egui::Button::new(tl!("Save Image As…"))).clicked() {
                 *action = Some(ImageAction::Save(page, hit));
                 ui.close();
             }
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index a0d02e84..668852bb 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -1733,10 +1733,36 @@ fn editing_existing_images_on_the_page() {
     // A page made from a 40 × 20 image (at 72 dpi: a 40 × 20 pt page filled by it).
     let mut png = Vec::new();
     image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    check_existing_artwork("picture.png", png);
+}
+
+#[test]
+fn editing_existing_form_artwork_on_the_page() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 200, 300].map(Object::Int).to_vec()));
+    let artwork = doc.add(Object::Stream(Stream::flate(form, b"0.2 0.5 0.9 rg 20 20 160 260 re f")));
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), b"/Figure Do")));
+    doc.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"Figure".to_vec(), Object::Ref(artwork));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    check_existing_artwork("figure.pdf", write_incremental(&doc, &SaveOptions::default()).unwrap());
+}
+
+fn check_existing_artwork(name: &'static str, bytes: Vec<u8>) {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
-        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app.open_bytes(name, None, bytes.clone()).expect("opens");
         app
     });
     h.run_steps(4);
diff --git a/docs/editing-images.md b/docs/editing-images.md
new file mode 100644
index 00000000..86a01c72
--- /dev/null
+++ b/docs/editing-images.md
@@ -0,0 +1,23 @@
+# Editing existing images and figures
+
+In **Edit a PDF → Edit text and images**, click a figure to select it. Drag the selected
+figure to move it, drag a corner to resize it proportionally, or press Delete to remove
+that placement. The context menu also rotates or flips it. Changes support undo and
+survive saving/reopening.
+
+PDF figures are not always bitmap images. Imported diagrams often use a **Form XObject**,
+which packages text, vector paths, and nested images into one object. PdfCraft selects
+this object using its `BBox` and optional `Matrix` and edits it as a whole. Its original
+content, resources, clipping box, and transparency settings remain intact. Moving or
+deleting one use of a shared figure does not alter its other placements or pages.
+
+**Replace Image** and **Save Image As** apply only to raster Image XObjects; these menu
+items are disabled for grouped Form artwork. The tool does not ungroup Forms, edit their
+individual internal elements, select arbitrary ungrouped vector paths, or edit inline
+images (`BI`/`ID`/`EI`). A Form's bounding box may include whitespace.
+
+For automation, `page_images` lists both kinds with `kind: "image"` or `kind: "form"`.
+Forms have `pixels: [0, 0]`, since they have no single bitmap resolution. Use the returned
+number with `image_edit` (move, rotate, flip_horizontal, flip_vertical, delete).
+Coordinates are top-left-origin page points. `image_save` and `image_edit`'s replace action
+return a clear error for Form artwork.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index a503dd19..4d8be6d5 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2047,7 +2047,7 @@ status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["image_edit"]
 evidence = ["crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/automation.rs::editing_page_images_through_tools"]
-notes = "existing page images: rotate either way about the centre, flip horizontally or vertically (a q/cm/Q wrapper); added images too"
+notes = "existing raster images and grouped Form artwork: rotate either way about the centre, flip horizontally or vertically (a q/cm/Q wrapper); Forms stay intact as groups; added images too"
 
 [[feature]]
 id = "edit.image-move-resize"
@@ -2058,8 +2058,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["image_edit"]
-evidence = ["crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/automation.rs::editing_page_images_through_tools"]
-notes = "existing page images: select, drag to move, drag a corner to resize keeping proportions; Delete removes; added images too"
+evidence = ["crates/edit/src/tests.rs::form_artwork_edits_only_the_selected_placement", "crates/ui-egui/tests/editing.rs::editing_existing_form_artwork_on_the_page", "crates/automation/tests/automation.rs::editing_form_artwork_through_tools", "crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/automation.rs::editing_page_images_through_tools"]
+notes = "existing raster images and grouped Form artwork: select, drag to move, drag a corner to resize keeping proportions; Delete removes one placement. Forms include their nested content as a group; individual internal elements and inline images are not supported. See docs/editing-images.md; added images too"
 
 [[feature]]
 id = "edit.image-extract"

From 1ba8b194b2c21882b9c1cc55c5977619671eb754 Mon Sep 17 00:00:00 2001
From: ysrdevs <32823553+ysrdevs@users.noreply.github.com>
Date: Fri, 9 Oct 2026 13:46:07 -0500
Subject: [PATCH 117/149] XFA: choice lists, signature, password, image and
 barcode fields; PNG and GIF pictures (#414)

* XFA: choice lists, signature, password, image and barcode fields; PNG and GIF pictures

The xfa crate lays out the field kinds that were left blank or shown as
text fields:

- Choice lists become combo boxes (editable with textEntry) or list
  boxes (open="always"; multi-select with open="multiSelect"), with the
  shown items and the saved values of <items save="1"> as /Opt pairs,
  /V, /I and /DV as saved values, several on separate lines in the
  data. Field::saved_value maps shown text to saved values for the
  layout and the script tree alike, so scripts read what is saved.
- Password fields are password text fields; signature fields are /Sig
  fields the app can sign.
- Image fields show the picture the data (base64) or the template
  holds; barcode fields show their value as text, with a warning that
  no bars are drawn.
- PNG and GIF pictures (fields and draws) are decoded to Flate image
  XObjects with a soft mask for transparency; JPEGs stay as they were.
  Sizes come from the headers, so layout never decodes; decoding is
  capped at 40 million pixels and failures are warnings, not errors.

Engine: multi-select list values from scripts and data are one per
line. README and parity notes updated (form.xfa-dynamic).

Hardened after an adversarial review pass: picture sizes refused from
the header past 20 million pixels or 65,535 a side, the GIF decoder
given limits (a frame far larger than its screen is refused before
allocation), template pictures read whole up to 32 MB, pictures
decoded once and remembered in the catalog by content hash so
re-layouts reuse them, data pictures that aren't images reported by
field; choice values matched against saved values first, several
values deduplicated and capped, /I ascending and unique, /DV through
the same mapping, <value> children read, the item cap reported; the
reopen path takes another viewer's choice values (several per line);
CMYK JPEGs inverted only with Adobe APP14.

* D5: README for cos and engine, and an honest cos status line

Thirteen crates have no README, although the session protocol tells every session to read the README of the crate it is touching. These are the two biggest: cos is where every hostile file lands first, and engine is the whole API surface a frontend gets.

Each states its layer and the rules that bind it, sketches the API against the real signatures, and ends with what is deliberately not done. The cos README spells out the clone-is-a-snapshot property and why both writers return bytes rather than taking a sink; the engine README spells out the four-step editing model that makes what you see what Save writes.

Also corrects the module doc on cos/src/lib.rs, which still said encryption and object-stream output for full saves were not done. Both shipped: security.rs handles R2-R6 with crypt filters and /EFF, and SaveOptions::object_streams defaults to true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Preserve alternate appearances and indirect push-button values

Keep rollover, down and custom appearance entries when normal appearances are regenerated, without modifying shared dictionaries. Resolve indirect button caption and layout values. Cover full and incremental saved output, and wait for raster readiness in the existing Linux scroll test.

Co-authored-by: Codex <codex@openai.com>

* M7: select and edit grouped Form XObject figures

Co-Authored-By: Codex <noreply@openai.com>

* M14: let neutral Windows locales fall through to display language

Co-authored-by: Codex <codex@openai.com>

* pdfcraft-cli --help lists `mcp` only when the build has it

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* engine README: the execution plan is local-only, so don't link a path that doesn't exist

* Merge land/450 into land/414; XFA pictures are found again by a SHA-256 on their XObject

The image cache was a /PCXfaImages map in the catalog, keyed by DefaultHasher
(not stable across Rust releases) and read back from the file. Each image
XObject now records the SHA-256 of its picture's bytes, and a re-layout finds
the XObjects on the pages it replaces by that hash; nothing goes in the catalog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Tanish Manku <tmanku.dev@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Flowershangfromthebranches <152056395+Flowershangfromthebranches@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                   |   3 +
 ROADMAP.md                   |   2 +
 crates/engine/src/lib.rs     |  11 ++
 crates/engine/src/tests.rs   |  62 ++++++++
 crates/engine/src/xfa.rs     |   7 +-
 crates/forms/src/tests.rs    | 206 +++++++++++++++++++++++++
 crates/xfa/Cargo.toml        |   3 +
 crates/xfa/README.md         |  13 +-
 crates/xfa/src/data.rs       |  10 ++
 crates/xfa/src/fixtures.rs   |  56 +++++++
 crates/xfa/src/image.rs      | 144 ++++++++++++++++++
 crates/xfa/src/layout.rs     | 130 ++++++++++++----
 crates/xfa/src/lib.rs        |   1 +
 crates/xfa/src/model.rs      |  55 ++++++-
 crates/xfa/src/parse.rs      |  74 ++++++++-
 crates/xfa/src/pdf.rs        | 251 +++++++++++++++++++++++++++----
 crates/xfa/src/script.rs     |   6 +-
 crates/xfa/src/tests.rs      | 281 ++++++++++++++++++++++++++++++++++-
 parity/acrobat-features.toml |   4 +-
 19 files changed, 1243 insertions(+), 76 deletions(-)
 create mode 100644 crates/xfa/src/image.rs

diff --git a/Cargo.lock b/Cargo.lock
index a00258ae..05523a30 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3845,9 +3845,12 @@ name = "pdfcraft-xfa"
 version = "0.4.0"
 dependencies = [
  "base64 0.22.1",
+ "image",
  "pdfcraft-cos",
  "pdfcraft-fonts",
+ "png 0.18.1",
  "roxmltree",
+ "sha2",
  "thiserror 2.0.21",
 ]
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 74f6df25..720f829e 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -146,6 +146,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 878d98e8..084c065a 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -1979,6 +1979,17 @@ fn xfa_values_from_datasets(doc: &mut pdfcraft_cos::Document) -> Result<Vec<Stri
     for (name, value) in pdfcraft_xfa::read_values(doc, &data) {
         let Some(f) = fields.iter().find(|f| f.name == name) else { continue };
         let new = match value {
+            pdfcraft_xfa::FieldData::Text(t) if matches!(f.kind, pdfcraft_forms::FieldKind::Combo | pdfcraft_forms::FieldKind::List) => {
+                // Saved values, one per line for a multi-select list; shown text stands for
+                // its saved value (an older viewer may have written it).
+                let saved = |v: &str| f.options.iter().find(|(e, s)| e == v || s == v).map_or(v.to_string(), |(e, _)| e.clone());
+                let picked: Vec<String> = if f.has(pdfcraft_forms::flags::MULTI_SELECT) {
+                    t.lines().map(str::trim).filter(|l| !l.is_empty()).map(saved).collect()
+                } else {
+                    vec![saved(t.trim())]
+                };
+                (f.value != picked).then_some(FieldValue::Choice(picked))
+            }
             pdfcraft_xfa::FieldData::Text(t) => (f.value.join("\n") != t).then_some(FieldValue::Text(t)),
             pdfcraft_xfa::FieldData::Check(on) => (f.value.is_empty() == on).then_some(FieldValue::Check(on)),
             pdfcraft_xfa::FieldData::Radio(sel) => (f.value.first() != sel.as_ref()).then_some(FieldValue::Radio(sel)),
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index d560effa..ad7e0806 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1964,6 +1964,68 @@ fn xfa_data_no_field_binds_to_survives_an_edit_and_save() {
     assert!(doc.xfa_warnings.iter().any(|w| w.contains("structured content")));
 }
 
+#[test]
+fn xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save() {
+    let data = "<form><page1><country>Japan</country><langs>English\nSpanish</langs></page1></form>";
+    let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::fields_template(data)));
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("fields.pdf", None, bytes, None).expect("opens");
+    let field = |s: &Session, n: &str| s.get(id).unwrap().form.iter().find(|f| f.name == n).cloned().unwrap_or_else(|| panic!("no field {n}"));
+    use pdfcraft_forms::FieldKind as K;
+    // The forms layer sees a combo box with its options and the data's saved value, a
+    // multi-select list with both picks, an editable combo, a password field and a signature.
+    let country = field(&s, "country");
+    assert_eq!((country.kind, country.value.clone()), (K::Combo, vec!["JP".to_string()]));
+    assert_eq!(country.options, vec![("CA".into(), "Canada".into()), ("FR".into(), "France".into()), ("JP".into(), "Japan".into())]);
+    let langs = field(&s, "langs");
+    assert_eq!(langs.kind, K::List);
+    assert!(langs.has(pdfcraft_forms::flags::MULTI_SELECT));
+    assert_eq!(langs.value, vec!["English".to_string(), "Spanish".to_string()]);
+    assert!(field(&s, "other").has(pdfcraft_forms::flags::EDIT));
+    assert!(field(&s, "pin").has(pdfcraft_forms::flags::PASSWORD));
+    assert_eq!(field(&s, "sign").kind, K::Signature);
+    // Scripts read a choice list's saved value.
+    assert_eq!(field(&s, "summary").value, vec!["Country: JP".to_string()], "{:?}", s.take_js_output(id));
+    // Choosing another item recalculates; the list takes several values; a typed value is kept
+    // in the editable list and refused in the fixed one.
+    s.apply(id, Edit::SetFieldValue { name: "country".into(), value: FieldValue::Choice(vec!["CA".into()]) }).unwrap();
+    assert_eq!(field(&s, "summary").value, vec!["Country: CA".to_string()]);
+    s.apply(id, Edit::SetFieldValue { name: "langs".into(), value: FieldValue::Choice(vec!["French".into(), "Spanish".into()]) }).unwrap();
+    s.apply(id, Edit::SetFieldValue { name: "other".into(), value: FieldValue::Text("typed".into()) }).unwrap();
+    assert!(s.apply(id, Edit::SetFieldValue { name: "country".into(), value: FieldValue::Choice(vec!["Mars".into()]) }).is_err());
+    // Saved: the datasets hold the saved values, several on separate lines; reopened, the
+    // fields and the calculation are what they were.
+    let saved = s.save_bytes(id).unwrap();
+    let cos = pdfcraft_cos::Document::open(saved.clone()).unwrap();
+    let d = pdfcraft_xfa::data_of(&cos).unwrap();
+    assert_eq!(d.text_at(&pdfcraft_xfa::som_to_path("form[0].page1[0].country[0]")), Some("CA"));
+    assert_eq!(d.text_at(&pdfcraft_xfa::som_to_path("form[0].page1[0].langs[0]")), Some("French\nSpanish"));
+    assert_eq!(d.text_at(&pdfcraft_xfa::som_to_path("form[0].page1[0].other[0]")), Some("typed"));
+    let id2 = s.open("again.pdf", None, saved.clone(), None).unwrap();
+    let d2 = s.get(id2).unwrap();
+    let f2 = |n: &str| d2.form.iter().find(|f| f.name == n).unwrap().value.clone();
+    assert_eq!(f2("country"), vec!["CA".to_string()]);
+    assert_eq!(f2("langs"), vec!["French".to_string(), "Spanish".to_string()]);
+    assert_eq!(f2("summary"), vec!["Country: CA".to_string()]);
+    // The PNG of the image field and the GIF of the draw are pictures on the page.
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 2);
+    // Filled in by another viewer since: saved values, several on separate lines, and shown
+    // text (an older viewer's), are taken on reopen; shown text that means the current value
+    // is not a change.
+    let mut cos = pdfcraft_cos::Document::open(saved).unwrap();
+    pdfcraft_xfa::write_data_value(&mut cos, &pdfcraft_xfa::som_to_path("form[0].page1[0].langs[0]"), "English\nSpanish").unwrap();
+    pdfcraft_xfa::write_data_value(&mut cos, &pdfcraft_xfa::som_to_path("form[0].page1[0].country[0]"), "Canada").unwrap();
+    let edited = Arc::new(pdfcraft_cos::write_incremental(&cos, &pdfcraft_cos::SaveOptions::default()).unwrap());
+    let id3 = s.open("elsewhere.pdf", None, edited, None).unwrap();
+    let d3 = s.get(id3).unwrap();
+    let f3 = |n: &str| d3.form.iter().find(|f| f.name == n).unwrap().value.clone();
+    assert_eq!(f3("langs"), vec!["English".to_string(), "Spanish".to_string()]);
+    assert_eq!(f3("country"), vec!["CA".to_string()]);
+    let taken: Vec<&String> = d3.info.warnings.iter().filter(|w| w.contains("another viewer")).collect();
+    assert_eq!(taken.len(), 1, "{:?}", d3.info.warnings);
+    assert!(taken[0].contains("langs") && !taken[0].contains("country"), "{}", taken[0]);
+}
+
 #[test]
 fn xfa_scripts_initialize_calculate_validate_toggle_and_add_rows() {
     let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::scripted_template()));
diff --git a/crates/engine/src/xfa.rs b/crates/engine/src/xfa.rs
index 50fdec2a..f8ef3fd2 100644
--- a/crates/engine/src/xfa.rs
+++ b/crates/engine/src/xfa.rs
@@ -208,6 +208,8 @@ struct FieldInfo {
     kind: pdfcraft_forms::FieldKind,
     value: Vec<String>,
     on_state: String,
+    /// List boxes that take several values (one per line in the data).
+    multi: bool,
 }
 
 fn field_infos(doc: &pdfcraft_cos::Document) -> HashMap<String, FieldInfo> {
@@ -215,7 +217,8 @@ fn field_infos(doc: &pdfcraft_cos::Document) -> HashMap<String, FieldInfo> {
         .into_iter()
         .map(|f| {
             let on_state = f.widgets.first().and_then(|w| w.on_state.clone()).unwrap_or_else(|| "1".into());
-            (f.name, FieldInfo { kind: f.kind, value: f.value, on_state })
+            let multi = f.kind == pdfcraft_forms::FieldKind::List && f.has(pdfcraft_forms::flags::MULTI_SELECT);
+            (f.name, FieldInfo { kind: f.kind, value: f.value, on_state, multi })
         })
         .collect()
 }
@@ -380,11 +383,13 @@ impl<'a, 'b> Runner<'a, 'b> {
             }
             // Read-only fields still take values from scripts (calculated totals are read-only).
             K::PushButton | K::Signature => return false,
+            K::List if info.multi => value.lines().map(str::trim).filter(|l| !l.is_empty()).map(str::to_string).collect(),
             _ => vec![value.to_string()],
         };
         let same = match info.kind {
             K::CheckBox => info.value.is_empty() == new_value.is_empty(),
             K::Radio => info.value.first() == new_value.first(),
+            K::List if info.multi => info.value == new_value,
             _ => info.value.first().map_or(value.is_empty(), |v| v == value),
         };
         if same {
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index a5953681..a33fb5bd 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1474,3 +1474,209 @@ fn check_box_redraw_keeps_down_states_it_still_draws() {
     assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
     assert!(!d.contains(b"Gone"), "a state the box no longer draws");
 }
+
+#[test]
+fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
+    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
+    let cases = [
+        (NewField::Text { multiline: false }, true),
+        (NewField::Text { multiline: false }, false),
+        (NewField::CheckBox, false),
+        (NewField::Button { caption: "Button".into() }, false),
+        (NewField::Signature, false),
+    ];
+    for (kind, fill) in cases {
+        for indirect in [false, true] {
+            let mut doc = one_page();
+            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
+            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
+            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
+            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+            for (key, bytes) in alternates {
+                let mut d = Dict::new();
+                d.set(b"Type".to_vec(), Object::name("XObject"));
+                d.set(b"Subtype".to_vec(), Object::name("Form"));
+                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
+                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
+                entries.set(key.to_vec(), Object::Ref(r));
+            }
+            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
+            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
+            for widget in [first_widget, other_widget] {
+                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
+            }
+            let original = reopen(&doc);
+            for full in [false, true] {
+                let mut doc = original.clone();
+                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
+                let before = doc.resolve(&source);
+                if fill {
+                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
+                } else {
+                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
+                }
+                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
+                let bytes = if full {
+                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
+                } else {
+                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+                    let original = doc.bytes();
+                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+                    bytes
+                };
+                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+                let doc = Document::open(Arc::new(bytes)).unwrap();
+                let all = fields(&doc);
+                let first = field(&all, &first);
+                let other = field(&all, &other);
+                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let first_ap = first_ap.as_dict().unwrap();
+                let other_ap = other_ap.as_dict().unwrap();
+                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
+                assert_eq!(other_ap.len(), 4);
+                // The redrawn widget keeps unknown entries, but not down/rollover looks that
+                // would show its old value or caption on press or hover.
+                assert_eq!(
+                    first_ap.len(),
+                    2,
+                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
+                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
+                );
+                for (key, bytes) in alternates {
+                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
+                    let object = doc.resolve(other_ap.get(key).unwrap());
+                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
+                    assert_eq!(stream.decoded().unwrap(), bytes);
+                }
+                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                if fill {
+                    assert_eq!(first.value, ["Updated value"]);
+                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
+                    assert!(other.value.is_empty());
+                } else {
+                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
+                    assert_eq!(other.tooltip, None);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
+    fn saved(doc: &Document, full: bool) -> Document {
+        let bytes = if full {
+            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
+        } else {
+            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+            let original = doc.bytes();
+            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+            bytes
+        };
+        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+        Document::open(Arc::new(bytes)).unwrap()
+    }
+
+    for indirect_caption in [false, true] {
+        for indirect_layout in [false, true] {
+            for icon_only in [false, true] {
+                let mut doc = one_page();
+                let name =
+                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
+                        .unwrap();
+                let widget = field(&fields(&doc), &name).widgets[0].obj;
+                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
+                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
+                let layout = Object::Int(i64::from(icon_only));
+                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
+                let mut icon_dict = Dict::new();
+                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
+                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
+                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
+                let icon_bytes = b"0 0 4 2 re f\n";
+                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
+                let mut mk = Dict::new();
+                mk.set(b"CA".to_vec(), caption);
+                mk.set(b"TP".to_vec(), layout);
+                mk.set(b"I".to_vec(), Object::Ref(icon));
+                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
+                let mk = doc.add(Object::Dict(mk));
+                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
+
+                // Import the operands from a real saved file before an unrelated public edit.
+                let original = saved(&doc, true);
+                for full in [false, true] {
+                    let mut doc = original.clone();
+                    let widget = field(&fields(&doc), &name).widgets[0].obj;
+                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
+                    let original_mk = doc.resolve(&mk_before);
+                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
+                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
+                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
+                    let doc = saved(&doc, full);
+                    let f = field(&fields(&doc), &name).clone();
+                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
+                    let w = &f.widgets[0];
+                    let wd = doc.get(w.obj);
+                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
+                    let mk = mk_object.as_dict().unwrap();
+                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
+                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
+                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
+                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
+                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
+                    let appearance = ap(&doc, w);
+                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
+                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
+                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
+                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+                    let appearance_object = doc.get(n);
+                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
+                    let resource_icon =
+                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
+                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
+                    let icon_object = doc.resolve(resource_icon);
+                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
+                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
+                }
+            }
+        }
+    }
+}
+
+/// A check box's down appearances survive a redraw for the states it still draws (same names),
+/// and a down appearance for a state it no longer has is dropped rather than left stale.
+#[test]
+fn check_box_redraw_keeps_down_states_it_still_draws() {
+    let mut doc = one_page();
+    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
+    let widget = field(&fields(&doc), &name).widgets[0].obj;
+    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
+    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+    let mut down = Dict::new();
+    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Form"));
+        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
+        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
+        down.set(state.to_vec(), Object::Ref(r));
+    }
+    ap.set(b"D".to_vec(), Object::Dict(down));
+    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
+    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
+    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
+    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
+    let d = d.as_dict().unwrap();
+    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
+    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
+}
diff --git a/crates/xfa/Cargo.toml b/crates/xfa/Cargo.toml
index 6bb4707d..29032d89 100644
--- a/crates/xfa/Cargo.toml
+++ b/crates/xfa/Cargo.toml
@@ -15,4 +15,7 @@ pdfcraft-cos = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 roxmltree = "0.20"
 base64 = "0.22"
+png = "0.18"
+sha2 = "0.11"
+image = { version = "0.25", default-features = false, features = ["gif"] }
 thiserror = { workspace = true }
diff --git a/crates/xfa/README.md b/crates/xfa/README.md
index cfb2dacb..c32f0df0 100644
--- a/crates/xfa/README.md
+++ b/crates/xfa/README.md
@@ -17,7 +17,7 @@ the automation tools) works on it unchanged. The engine does this when it opens
   page areas, content areas and media; measurements in mm, cm, in, pt and px; fonts, paragraphs,
   margins, borders (edge order rules), captions with reserves, check-button items, pictures,
   rich text (`exData` XHTML: paragraphs, `br`, bold/italic/underline/size spans, embedded fields),
-  inline JPEG images, lines, rectangles, occurrences, `breakBefore`/`breakAfter`, overflow
+  inline JPEG, PNG and GIF images, lines, rectangles, occurrences, `breakBefore`/`breakAfter`, overflow
   leaders, `columnWidths` and `colSpan`.
 - **Layout** (`layout`): positioned, `tb`, `lr-tb`/`rl-tb`, `table` and `row` layouts; a
   container without a width is as wide as its content; flow across content areas and pages with
@@ -112,8 +112,13 @@ let form = pdfcraft_xfa::layout_xml(template_xml)?;       // pages of items, for
   allocates is not capped (the same holds for AcroForm JavaScript).
 - **Static XFA forms** (`/NeedsRendering` absent, AcroForm fields present) keep their AcroForm;
   only their data is read and written.
-- Choice lists are text fields; signature, image, barcode and password fields are left blank;
-  PNG and GIF images, `keep` constraints, `subformSet` relations, `rl-tb` is mirrored `lr-tb`,
-  font metrics are the approximate Helvetica ones, and line heights are 1.15 × size.
+- **Field kinds.** Choice lists become combo boxes (editable with `textEntry`) or list boxes
+  (`open="always"`, multi-select with `open="multiSelect"`), with the shown items and the saved
+  values of `<items save="1">` as the options; the data holds saved values, several on
+  separate lines. Password fields are password text fields. Signature fields are `/Sig` fields
+  the app can sign. Image fields show the picture the data or template holds (JPEG, PNG, GIF)
+  but a new picture can't be chosen; barcode fields show their value as text, not as bars.
+- Missing: `keep` constraints, `subformSet` relations, `rl-tb` is mirrored `lr-tb`, font
+  metrics are the approximate Helvetica ones, and line heights are 1.15 × size.
 - Acrobat cannot be an oracle here (clean-room rules): layout follows the specification, and
   fidelity has been checked by eye on real government forms, not pixel-compared.
diff --git a/crates/xfa/src/data.rs b/crates/xfa/src/data.rs
index ba1ebc89..78b0cc9e 100644
--- a/crates/xfa/src/data.rs
+++ b/crates/xfa/src/data.rs
@@ -47,6 +47,16 @@ impl DataNode {
     pub fn text_at(&self, path: &[(String, usize)]) -> Option<&str> {
         self.get(path).map(|n| n.text.as_str())
     }
+
+    /// The value at `path`: its text, or, for a container whose children are all `value`
+    /// elements (one way a multi-select list's picks are stored), those on separate lines.
+    pub fn value_at(&self, path: &[(String, usize)]) -> Option<String> {
+        let n = self.get(path)?;
+        if n.children.is_empty() || !n.children.iter().all(|c| c.name == "value") {
+            return Some(n.text.clone());
+        }
+        Some(n.children.iter().map(|c| c.text.trim()).filter(|t| !t.is_empty()).take(1000).collect::<Vec<_>>().join("\n"))
+    }
 }
 
 fn to_node(n: roxmltree::Node, depth: usize) -> DataNode {
diff --git a/crates/xfa/src/fixtures.rs b/crates/xfa/src/fixtures.rs
index 64b88469..b42a3d2b 100644
--- a/crates/xfa/src/fixtures.rs
+++ b/crates/xfa/src/fixtures.rs
@@ -208,6 +208,62 @@ endif</script></event></field>
     .to_string()
 }
 
+/// A 2 × 2 RGBA PNG: red, green / blue, transparent.
+pub fn tiny_png() -> Vec<u8> {
+    TINY_PNG.to_vec()
+}
+
+const TINY_PNG: &[u8] = b"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52\x00\x00\x00\x02\x00\x00\x00\x02\x08\x06\x00\x00\x00\x72\xb6\x0d\x24\x00\x00\x00\x13\x49\x44\x41\x54\x78\xda\x63\xf8\xcf\xc0\xf0\x1f\x0c\x81\x34\x88\x60\x00\x00\x3f\xd2\x05\xfb\x7f\xe6\x6a\x2b\x00\x00\x00\x00\x49\x45\x4e\x44\xae\x42\x60\x82";
+
+/// A 1 × 1 white GIF.
+pub const TINY_GIF: &[u8] = b"GIF89a\x01\x00\x01\x00\x80\x00\x00\xff\xff\xff\x00\x00\x00,\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02D\x01\x00;";
+
+/// A form with the other field kinds: `country`, a drop-down whose shown names save as codes
+/// (`Canada`/`CA`, `France`/`FR`, `Japan`/`JP`; default `FR`); `langs`, a multi-select list
+/// box (`English`, `French`, `Spanish`); `other`, an editable drop-down (`A`, `B`); `pin`, a
+/// password field; `sign`, a signature field; `photo`, an image field whose template picture
+/// is [`tiny_png`]; `code`, a barcode field with value `12345`; `logo`, a draw showing
+/// [`TINY_GIF`]; `summary`, calculated (JavaScript) from `country`. `data` is the children of
+/// `xfa:data` (empty for none).
+pub fn fields_template(data: &str) -> String {
+    use base64::Engine;
+    let png = base64::engine::general_purpose::STANDARD.encode(tiny_png());
+    let gif = base64::engine::general_purpose::STANDARD.encode(TINY_GIF);
+    let datasets = if data.is_empty() {
+        String::new()
+    } else {
+        format!("<xfa:datasets xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\"><xfa:data>{data}</xfa:data></xfa:datasets>")
+    };
+    format!(
+        r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="front"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <subform name="page1" layout="tb">
+  <field name="country" w="3in" h="0.3in"><ui><choiceList/></ui><caption placement="left" reserve="1in"><value><text>Country</text></value></caption>
+   <items><text>Canada</text><text>France</text><text>Japan</text></items>
+   <items save="1" presence="hidden"><text>CA</text><text>FR</text><text>JP</text></items>
+   <value><text>FR</text></value></field>
+  <field name="langs" w="3in" h="0.8in"><ui><choiceList open="multiSelect"/></ui><caption placement="left" reserve="1in"><value><text>Languages</text></value></caption>
+   <items><text>English</text><text>French</text><text>Spanish</text></items></field>
+  <field name="other" w="3in" h="0.3in"><ui><choiceList open="onEntry" textEntry="1"/></ui><items><text>A</text><text>B</text></items></field>
+  <field name="pin" w="2in" h="0.3in"><ui><passwordEdit/></ui><caption placement="left" reserve="0.5in"><value><text>PIN</text></value></caption></field>
+  <field name="sign" w="3in" h="0.6in"><ui><signature/></ui><caption placement="top" reserve="0.2in"><value><text>Sign here</text></value></caption><border><edge/></border></field>
+  <field name="photo" w="1in" h="1in"><ui><imageEdit/></ui><value><image contentType="image/png">{png}</image></value></field>
+  <field name="code" w="2in" h="0.5in"><ui><barcode type="code128A"/></ui><value><text>12345</text></value><border><edge/></border></field>
+  <draw name="logo" w="0.5in" h="0.5in"><value><image contentType="image/gif">{gif}</image></value></draw>
+  <field name="summary" w="3in" h="0.3in" access="readOnly"><ui><textEdit/></ui>
+   <calculate><script contentType="application/x-javascript">"Country: " + (country.rawValue || "none")</script></calculate></field>
+ </subform>
+</subform>
+</template>
+{datasets}
+</xdp:xdp>
+"##
+    )
+}
+
 /// A PDF shell around `xdp`: one placeholder page, `/NeedsRendering true`, no fields.
 pub fn shell(xdp: &str) -> Vec<u8> {
     let objs: Vec<Vec<u8>> = vec![
diff --git a/crates/xfa/src/image.rs b/crates/xfa/src/image.rs
new file mode 100644
index 00000000..24ae77f5
--- /dev/null
+++ b/crates/xfa/src/image.rs
@@ -0,0 +1,144 @@
+//! Pictures in templates and data: JPEG (embedded as is), PNG and GIF (decoded to 8-bit
+//! samples with a soft mask for transparency). Sizes are read from the headers without
+//! decoding, so layout stays cheap; decoding happens once, when the PDF is written.
+
+/// Most pixels an image may have once decoded: decoding keeps up to 8 bytes per pixel alive
+/// (the decoder's buffer, the colour samples and the coverage), so this is 160 MB at most.
+pub const MAX_PIXELS: u64 = 20_000_000;
+/// Widest or tallest an image may be (PNG headers can claim billions).
+const MAX_SIDE: u32 = 65_535;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Kind {
+    Jpeg,
+    Png,
+    Gif,
+}
+
+/// What the bytes are, by their signature (the declared content type is often wrong).
+pub fn kind(data: &[u8]) -> Option<Kind> {
+    if data.starts_with(&[0xFF, 0xD8]) {
+        Some(Kind::Jpeg)
+    } else if data.starts_with(b"\x89PNG\r\n\x1a\n") {
+        Some(Kind::Png)
+    } else if data.starts_with(b"GIF87a") || data.starts_with(b"GIF89a") {
+        Some(Kind::Gif)
+    } else {
+        None
+    }
+}
+
+/// The pixel size, from the header alone; `None` when it can't be read or the image is bigger
+/// than can be decoded (so layout gives such a picture its box, not a page-high strip).
+pub fn size(data: &[u8]) -> Option<(u32, u32)> {
+    header_size(data).filter(|&(w, h)| fits(w, h))
+}
+
+fn fits(w: u32, h: u32) -> bool {
+    w <= MAX_SIDE && h <= MAX_SIDE && u64::from(w) * u64::from(h) <= MAX_PIXELS
+}
+
+/// What the header claims, unchecked.
+fn header_size(data: &[u8]) -> Option<(u32, u32)> {
+    match kind(data)? {
+        Kind::Jpeg => crate::pdf::jpeg_size(data),
+        Kind::Png => {
+            // The IHDR chunk is first: length, "IHDR", width, height (big-endian).
+            if data.get(12..16)? != b"IHDR" {
+                return None;
+            }
+            let be = |at: usize| data.get(at..at + 4).map(|b| u32::from_be_bytes([b[0], b[1], b[2], b[3]]));
+            let (w, h) = (be(16)?, be(20)?);
+            (w > 0 && h > 0).then_some((w, h))
+        }
+        Kind::Gif => {
+            let le = |at: usize| data.get(at..at + 2).map(|b| u32::from(u16::from_le_bytes([b[0], b[1]])));
+            let (w, h) = (le(6)?, le(8)?);
+            (w > 0 && h > 0).then_some((w, h))
+        }
+    }
+}
+
+/// Samples ready for an image XObject.
+#[derive(Debug)]
+pub struct Decoded {
+    pub width: u32,
+    pub height: u32,
+    /// `DeviceGray` or `DeviceRGB`.
+    pub color_space: &'static str,
+    /// 8-bit samples, row by row.
+    pub samples: Vec<u8>,
+    /// 8-bit coverage per pixel when any pixel is not opaque.
+    pub alpha: Option<Vec<u8>>,
+}
+
+fn too_big() -> String {
+    format!("an image has more than {} million pixels and is left out", MAX_PIXELS / 1_000_000)
+}
+
+/// Decode a PNG or GIF (its first frame). JPEGs are embedded as they are and are not decoded
+/// here. The error is the warning to show.
+pub fn decode(data: &[u8]) -> Result<Decoded, String> {
+    let bad = |m: String| format!("an image could not be decoded and is left out: {m}");
+    let (w, h) = header_size(data).ok_or_else(|| bad("unreadable header".into()))?;
+    if !fits(w, h) {
+        return Err(too_big());
+    }
+    match kind(data) {
+        Some(Kind::Png) => {
+            let mut dec = png::Decoder::new(std::io::Cursor::new(data));
+            dec.set_transformations(png::Transformations::EXPAND | png::Transformations::STRIP_16);
+            let mut reader = dec.read_info().map_err(|e| bad(e.to_string()))?;
+            // The header's size is what the buffer is sized by: checked above.
+            let (fw, fh) = (reader.info().width, reader.info().height);
+            if !fits(fw, fh) {
+                return Err(too_big());
+            }
+            let mut buf = vec![0; reader.output_buffer_size().ok_or_else(|| bad("image too large".into()))?];
+            let frame = reader.next_frame(&mut buf).map_err(|e| bad(e.to_string()))?;
+            let samples = buf.get(..frame.buffer_size()).ok_or_else(|| bad("short image data".into()))?;
+            let (channels, color_space) = match frame.color_type {
+                png::ColorType::Grayscale => (1, "DeviceGray"),
+                png::ColorType::GrayscaleAlpha => (2, "DeviceGray"),
+                png::ColorType::Rgb => (3, "DeviceRGB"),
+                png::ColorType::Rgba => (4, "DeviceRGB"),
+                png::ColorType::Indexed => return Err(bad("unexpected palette output".into())),
+            };
+            let has_alpha = channels == 2 || channels == 4;
+            let colour_n = channels - usize::from(has_alpha);
+            let mut colour = Vec::with_capacity(samples.len() / channels * colour_n);
+            let mut alpha = Vec::with_capacity(if has_alpha { samples.len() / channels } else { 0 });
+            for px in samples.chunks_exact(channels) {
+                colour.extend_from_slice(px.get(..colour_n).unwrap_or_default());
+                if has_alpha && let Some(&a) = px.get(colour_n) {
+                    alpha.push(a);
+                }
+            }
+            let alpha = (has_alpha && alpha.iter().any(|a| *a != 255)).then_some(alpha);
+            Ok(Decoded { width: frame.width, height: frame.height, color_space, samples: colour, alpha })
+        }
+        Some(Kind::Gif) => {
+            // The frame may be larger than the logical screen the header gives: the decoder is
+            // told the limits, so it refuses before allocating.
+            let mut reader = image::ImageReader::new(std::io::Cursor::new(data));
+            reader.set_format(image::ImageFormat::Gif);
+            let mut limits = image::Limits::default();
+            limits.max_image_width = Some(MAX_SIDE);
+            limits.max_image_height = Some(MAX_SIDE);
+            limits.max_alloc = Some(MAX_PIXELS * 4);
+            reader.limits(limits);
+            let img = reader.decode().map_err(|e| if matches!(e, image::ImageError::Limits(_)) { too_big() } else { bad(e.to_string()) })?;
+            let rgba = img.into_rgba8();
+            let (width, height) = rgba.dimensions();
+            if !fits(width, height) {
+                return Err(too_big());
+            }
+            let px = rgba.as_raw().as_chunks::<4>().0;
+            let gray = px.iter().all(|p| p[0] == p[1] && p[1] == p[2]);
+            let samples: Vec<u8> = if gray { px.iter().map(|p| p[0]).collect() } else { px.iter().flat_map(|p| [p[0], p[1], p[2]]).collect() };
+            let alpha = px.iter().any(|p| p[3] != 255).then(|| px.iter().map(|p| p[3]).collect());
+            Ok(Decoded { width, height, color_space: if gray { "DeviceGray" } else { "DeviceRGB" }, samples, alpha })
+        }
+        Some(Kind::Jpeg) | None => Err(bad("not a PNG or GIF".into())),
+    }
+}
diff --git a/crates/xfa/src/layout.rs b/crates/xfa/src/layout.rs
index 19b3143a..fa501136 100644
--- a/crates/xfa/src/layout.rs
+++ b/crates/xfa/src/layout.rs
@@ -10,6 +10,8 @@ use std::collections::{HashMap, HashSet};
 use std::rc::Rc;
 use std::sync::Arc;
 
+use base64::Engine;
+
 use crate::XfaError;
 use crate::data::{DataNode, is_on, iso_to_pattern, som_to_path};
 use crate::model::*;
@@ -26,6 +28,8 @@ const MAX_DEPTH: usize = 64;
 const MAX_MEASURES: usize = 2_000_000;
 /// Most initial instances of one repeating subform.
 const MAX_INSTANCES: usize = 50;
+/// Largest picture taken from the data (decoded bytes), as for template pictures.
+const MAX_DATA_IMAGE: usize = 32 << 20;
 /// Placeholder for the page count in text laid out before the count is known.
 const PAGE_COUNT_MARK: char = '\u{E000}';
 
@@ -41,6 +45,17 @@ pub enum Item {
 #[derive(Clone, Debug, PartialEq)]
 pub enum WidgetKind {
     Text,
+    /// A text field whose characters are shown as asterisks.
+    Password,
+    /// A drop-down (`list_box` false) or list box: `options` are (saved value, shown text).
+    Choice {
+        options: Vec<(String, String)>,
+        list_box: bool,
+        multi: bool,
+        editable: bool,
+    },
+    /// A signature field, to be signed in the app.
+    Signature,
     /// A date field with its Acrobat format pattern (`yyyy-mm-dd`).
     Date(String),
     CheckBox {
@@ -98,6 +113,7 @@ pub struct Widget {
     pub max_chars: Option<usize>,
     pub read_only: bool,
     pub border: WidgetBorder,
+    /// The field's value: saved (bound) values for choice lists, newline-separated when several.
     pub value: Option<String>,
     /// The template's default value (what a reset restores); data values are not defaults.
     pub default: Option<String>,
@@ -727,7 +743,7 @@ impl Layouter<'_> {
         match v {
             Value::Text(t) => text::measure_height(&text::plain(t), w, &ctx.para, &Face::of(&ctx.font), &|id| self.embed(id)),
             Value::Rich(r) => text::measure_height(r, w, &ctx.para, &Face::of(&ctx.font), &|id| self.embed(id)),
-            Value::Image { data, .. } => crate::pdf::jpeg_size(data).map_or(w, |(iw, ih)| if iw > 0 { w * ih as f64 / iw as f64 } else { w }),
+            Value::Image { data, .. } => crate::image::size(data).map_or(w, |(iw, ih)| if iw > 0 { w * ih as f64 / iw as f64 } else { w }),
             Value::Line { .. } | Value::Rectangle(_) | Value::Empty => 0.0,
         }
     }
@@ -1021,16 +1037,7 @@ impl Layouter<'_> {
         let inner = rect.inset(&d.common.margin);
         match &d.value {
             Value::Text(_) | Value::Rich(_) => self.draw_value_text(&d.value, inner, &ctx.font, &ctx.para),
-            Value::Image { content_type, data } => {
-                let fitted = match crate::pdf::jpeg_size(data) {
-                    Some((iw, ih)) if iw > 0 && ih > 0 && inner.w > 0.0 && inner.h > 0.0 => {
-                        let k = (inner.w / iw as f64).min(inner.h / ih as f64);
-                        Rect::new(inner.x, inner.y, iw as f64 * k, ih as f64 * k)
-                    }
-                    _ => inner,
-                };
-                self.push(Item::Image { rect: fitted, data: Arc::new(data.clone()), content_type: content_type.clone() })
-            }
+            Value::Image { content_type, data } => self.draw_image(data, content_type, inner),
             Value::Line { slope_up, edge } => {
                 if !edge.visible() {
                     return Ok(());
@@ -1095,6 +1102,18 @@ impl Layouter<'_> {
         Ok(())
     }
 
+    /// A picture scaled to fit `inner`, keeping its shape, from its top left.
+    fn draw_image(&mut self, data: &[u8], content_type: &str, inner: Rect) -> Result<(), XfaError> {
+        let fitted = match crate::image::size(data) {
+            Some((iw, ih)) if iw > 0 && ih > 0 && inner.w > 0.0 && inner.h > 0.0 => {
+                let k = (inner.w / iw as f64).min(inner.h / ih as f64);
+                Rect::new(inner.x, inner.y, iw as f64 * k, ih as f64 * k)
+            }
+            _ => inner,
+        };
+        self.push(Item::Image { rect: fitted, data: Arc::new(data.to_vec()), content_type: content_type.to_string() })
+    }
+
     fn unique_name(&mut self, base: &str) -> String {
         let base = clean_name(base);
         let n = self.names.entry(base.clone()).or_insert(0);
@@ -1146,9 +1165,63 @@ impl Layouter<'_> {
             let para = ctx.para.apply(&cap.para);
             self.draw_value_text(&cap.value, cr, &font, &para)?;
         }
+        let som_path = || {
+            if fctx.som.is_empty() {
+                format!("{}[{sib}]", f.common.name.as_deref().unwrap_or("field"))
+            } else {
+                format!("{}.{}[{sib}]", fctx.som, f.common.name.as_deref().unwrap_or("field"))
+            }
+        };
         match f.ui {
-            Ui::Signature | Ui::ImageEdit | Ui::Barcode | Ui::Unknown => {
-                self.warn_once(format!("{:?} fields are not supported yet and are left blank", f.ui));
+            Ui::Unknown => {
+                self.warn_once("a field of an unknown kind is left blank");
+                return Ok(());
+            }
+            Ui::ImageEdit => {
+                // The picture the data holds (base64, as Designer saves it) or the template's.
+                let field_name = f.common.name.clone().unwrap_or_else(|| "an image field".into());
+                let text: Vec<u8> = self
+                    .data
+                    .and_then(|d| d.text_at(&som_to_path(&som_path())))
+                    .map(|t| t.bytes().filter(|b| !b.is_ascii_whitespace()).collect())
+                    .unwrap_or_default();
+                let from_data = if text.is_empty() {
+                    None
+                } else if text.len() > MAX_DATA_IMAGE / 3 * 4 + 4 {
+                    self.warn_once(format!("{field_name}: the picture in the data is larger than 32 MB and is left out"));
+                    None
+                } else {
+                    match base64::engine::general_purpose::STANDARD.decode(&text) {
+                        Ok(d) if crate::image::kind(&d).is_some() => Some(d),
+                        Ok(_) => {
+                            self.warn_once(format!("{field_name}: the picture in the data is not a JPEG, PNG or GIF and is left out"));
+                            None
+                        }
+                        Err(_) => {
+                            self.warn_once(format!("{field_name}: the data holds no readable picture (not base64) and is left out"));
+                            None
+                        }
+                    }
+                };
+                let box_ = ui.inset(&f.ui_margin);
+                match (&from_data, &f.value) {
+                    (Some(d), _) => self.draw_image(d, "", box_)?,
+                    (None, Value::Image { content_type, data }) => self.draw_image(data, content_type, box_)?,
+                    _ => {}
+                }
+                self.warn_once("image fields show their picture; a new picture can't be chosen yet");
+                return Ok(());
+            }
+            Ui::Barcode => {
+                // The value as text, where the bars would be.
+                self.warn_once("barcode fields show their value as text, not as bars");
+                let value =
+                    self.data.and_then(|d| d.text_at(&som_to_path(&som_path()))).map(str::to_string).or_else(|| f.value.plain()).unwrap_or_default();
+                if !value.trim().is_empty() {
+                    let mut para = fctx.para.clone();
+                    para.h_align = HAlign::Center;
+                    self.draw_value_text(&Value::Text(value), ui.inset(&f.ui_margin), &fctx.font, &para)?;
+                }
                 return Ok(());
             }
             _ => {}
@@ -1167,16 +1240,13 @@ impl Layouter<'_> {
             _ => fctx.para.h_align,
         };
         let name = self.unique_name(f.common.name.as_deref().unwrap_or("field"));
-        let som = if fctx.som.is_empty() {
-            format!("{}[{sib}]", f.common.name.as_deref().unwrap_or("field"))
-        } else {
-            format!("{}.{}[{sib}]", fctx.som, f.common.name.as_deref().unwrap_or("field"))
-        };
+        let som = som_path();
         let read_only = matches!(f.access, Access::ReadOnly | Access::Protected);
         // The data's value wins over the template's default.
         let data_value: Option<String> =
-            self.data.and_then(|d| d.text_at(&som_to_path(&som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
-        let template_default = f.value.plain().map(|v| v.trim().to_string()).filter(|v| !v.is_empty());
+            self.data.and_then(|d| d.value_at(&som_to_path(&som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+        // A choice list's default is a saved value too.
+        let template_default = f.value.plain().map(|v| f.saved_value(v.trim())).filter(|v| !v.is_empty());
         let plain_value = data_value.clone().or_else(|| template_default.clone());
         let (kind, rect, border, value, tooltip) = match f.ui {
             Ui::CheckButton => {
@@ -1219,12 +1289,22 @@ impl Layouter<'_> {
                 let shown = plain_value.as_ref().map(|v| if data_value.is_some() { iso_to_pattern(v, &pattern) } else { v.clone() });
                 (WidgetKind::Date(pattern), ui, widget_border(f.ui_border.as_ref(), false), shown, f.tooltip.clone())
             }
-            _ => {
-                if f.ui == Ui::ChoiceList {
-                    self.warn_once("drop-down lists are shown as text fields");
-                }
-                (WidgetKind::Text, ui, widget_border(f.ui_border.as_ref(), false), plain_value, f.tooltip.clone())
+            Ui::ChoiceList => {
+                let options: Vec<(String, String)> = f
+                    .items
+                    .iter()
+                    .enumerate()
+                    .map(|(i, shown)| (f.item_values.get(i).cloned().unwrap_or_else(|| shown.clone()), shown.clone()))
+                    .collect();
+                // The data holds saved values (several on separate lines); shown text is taken
+                // too, as a user typing into an editable list leaves it.
+                let value = plain_value.as_ref().map(|v| f.saved_value(v));
+                let kind = WidgetKind::Choice { options, list_box: f.choice.list_box, multi: f.choice.multi, editable: f.choice.editable };
+                (kind, ui, widget_border(f.ui_border.as_ref(), false), value, f.tooltip.clone())
             }
+            Ui::Signature => (WidgetKind::Signature, ui, widget_border(f.ui_border.as_ref(), false), None, f.tooltip.clone()),
+            Ui::PasswordEdit => (WidgetKind::Password, ui, widget_border(f.ui_border.as_ref(), false), plain_value, f.tooltip.clone()),
+            _ => (WidgetKind::Text, ui, widget_border(f.ui_border.as_ref(), false), plain_value, f.tooltip.clone()),
         };
         if rect.w < 1.0 || rect.h < 1.0 {
             return Ok(());
diff --git a/crates/xfa/src/lib.rs b/crates/xfa/src/lib.rs
index 115fc50f..6b4e31d4 100644
--- a/crates/xfa/src/lib.rs
+++ b/crates/xfa/src/lib.rs
@@ -9,6 +9,7 @@
 
 pub mod data;
 pub mod fixtures;
+pub mod image;
 pub mod layout;
 pub mod model;
 pub mod packets;
diff --git a/crates/xfa/src/model.rs b/crates/xfa/src/model.rs
index d4332faa..9b4bdc6d 100644
--- a/crates/xfa/src/model.rs
+++ b/crates/xfa/src/model.rs
@@ -378,6 +378,17 @@ pub enum Ui {
     Unknown,
 }
 
+/// How a `<choiceList>` presents its items.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct ChoiceList {
+    /// `open="always"` or `"multiSelect"`: a list box that shows its items; else a drop-down.
+    pub list_box: bool,
+    /// `open="multiSelect"`: several items may be chosen (newline-separated in the data).
+    pub multi: bool,
+    /// `textEntry="1"`: the user may type a value that is not an item.
+    pub editable: bool,
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub struct Script {
     pub activity: String,
@@ -408,8 +419,13 @@ pub struct Field {
     pub multiline: bool,
     pub caption: Option<Caption>,
     pub value: Value,
-    /// Check buttons: the on value then the off value; choice lists: the items.
+    /// Check buttons: the on value then the off value; choice lists: the items as shown.
     pub items: Vec<String>,
+    /// Choice lists: the bound values saved to the data (`<items save="1">`), one per shown
+    /// item; empty when the shown text is the value.
+    pub item_values: Vec<String>,
+    /// Choice lists: how the list opens.
+    pub choice: ChoiceList,
     pub max_chars: Option<usize>,
     pub tooltip: Option<String>,
     pub access: Access,
@@ -427,6 +443,43 @@ pub struct Field {
     pub numeric: bool,
 }
 
+impl Field {
+    /// A choice list's value as saved to the data: an item's shown text becomes its saved
+    /// value (an editable list keeps typed text); several values stay on separate lines.
+    /// Other fields keep `v`.
+    pub fn saved_value(&self, v: &str) -> String {
+        if self.ui != Ui::ChoiceList {
+            return v.to_string();
+        }
+        // The data holds saved values: one of those is itself, even when another item shows
+        // the same text (Designer's "specify item values" lists often show 0, 1, 2 and save
+        // 1, 2, 3).
+        let saved = |one: &str| {
+            if self.item_values.is_empty() || self.item_values.iter().any(|s| s == one) {
+                return one.to_string();
+            }
+            self.items.iter().position(|shown| shown == one).and_then(|i| self.item_values.get(i)).cloned().unwrap_or_else(|| one.to_string())
+        };
+        if self.choice.multi {
+            // Each value once, and never more than there are items.
+            let mut out: Vec<String> = Vec::new();
+            for l in v.lines().map(str::trim).filter(|l| !l.is_empty()) {
+                let s = saved(l);
+                if !out.contains(&s) {
+                    out.push(s);
+                }
+                if out.len() >= self.items.len().max(1) {
+                    break;
+                }
+            }
+            out.join("\n")
+        } else {
+            // One value: the first line, should the data hold several.
+            saved(v.lines().map(str::trim).find(|l| !l.is_empty()).unwrap_or(""))
+        }
+    }
+}
+
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct Draw {
     pub common: Common,
diff --git a/crates/xfa/src/parse.rs b/crates/xfa/src/parse.rs
index 6fded48e..0bf90081 100644
--- a/crates/xfa/src/parse.rs
+++ b/crates/xfa/src/parse.rs
@@ -13,6 +13,8 @@ const MAX_DEPTH: usize = 64;
 const MAX_NODES: u32 = 2_000_000;
 /// Largest decoded inline image.
 const MAX_IMAGE: usize = 32 << 20;
+/// Most items a choice list keeps.
+const MAX_ITEMS: usize = 1000;
 /// Longest text run kept.
 const MAX_TEXT: usize = 1 << 20;
 
@@ -50,6 +52,23 @@ fn children<'a, 'd>(n: XmlNode<'a, 'd>, name: &'a str) -> impl Iterator<Item = X
     n.children().filter(move |c| c.is_element() && c.tag_name().name() == name)
 }
 
+/// The text of an image element: base64 is read whole up to the image cap (`text_of` stops at
+/// 1 MiB, which would cut a photo short).
+fn image_text_of(n: XmlNode) -> Option<Vec<u8>> {
+    let mut out = Vec::new();
+    for d in n.descendants() {
+        if d.is_text()
+            && let Some(t) = d.text()
+        {
+            out.extend(t.bytes().filter(|b| !b.is_ascii_whitespace()));
+            if out.len() > MAX_IMAGE / 3 * 4 + 4 {
+                return None;
+            }
+        }
+    }
+    Some(out)
+}
+
 fn text_of(n: XmlNode) -> String {
     let mut s = String::new();
     for d in n.descendants() {
@@ -302,7 +321,10 @@ fn parse_value(n: Option<XmlNode>, warnings: &mut Vec<String>) -> Value {
                 return Value::Text(text_of(c));
             }
             "image" => {
-                let raw: Vec<u8> = text_of(c).bytes().filter(|b| !b.is_ascii_whitespace()).collect();
+                let Some(raw) = image_text_of(c) else {
+                    warnings.push("an image is larger than 32 MB; it is left out".into());
+                    return Value::Empty;
+                };
                 let data = if c.attribute("transferEncoding").is_none_or(|e| e == "base64") {
                     match base64::engine::general_purpose::STANDARD.decode(&raw) {
                         Ok(d) => d,
@@ -353,13 +375,35 @@ fn parse_caption(n: Option<XmlNode>, warnings: &mut Vec<String>) -> Option<Capti
     })
 }
 
-fn parse_items(n: XmlNode) -> Vec<String> {
-    // Several <items> lists may exist (display and bound values); the first one is what the
-    // widget shows / the check button's on and off values.
-    let Some(items) = children(n, "items").find(|i| i.attribute("presence") != Some("hidden")).or_else(|| child(n, "items")) else {
-        return Vec::new();
+/// The field's item lists: what is shown (the first `<items>` that is not the saved values,
+/// also a check button's on and off values) and, for choice lists, the values saved to the
+/// data (`<items save="1">`, usually hidden), empty when the shown text is the value.
+fn parse_items(n: XmlNode, warnings: &mut Vec<String>) -> (Vec<String>, Vec<String>) {
+    let lists: Vec<XmlNode> = children(n, "items").collect();
+    let is_saved = |i: &XmlNode| i.attribute("save") == Some("1") || i.attribute("presence") == Some("hidden");
+    let mut over = false;
+    let mut texts = |i: &XmlNode| -> Vec<String> {
+        let all: Vec<String> = i.children().filter(|c| c.is_element()).map(text_of).take(MAX_ITEMS + 1).collect();
+        if all.len() > MAX_ITEMS {
+            over = true;
+        }
+        all.into_iter().take(MAX_ITEMS).collect()
     };
-    items.children().filter(|c| c.is_element()).map(text_of).take(1000).collect()
+    let shown = lists.iter().find(|i| !is_saved(i)).or(lists.first());
+    let saved = lists.iter().find(|i| is_saved(i) && shown.is_none_or(|s| s != *i));
+    let shown: Vec<String> = shown.map(&mut texts).unwrap_or_default();
+    let mut saved: Vec<String> = saved.map(&mut texts).unwrap_or_default();
+    if over && warnings.len() < 100 {
+        warnings.push(format!(
+            "{} has more than {MAX_ITEMS} items; the rest are left out",
+            n.attribute("name").map_or_else(|| "a choice list".to_string(), |name| format!("the choice list {name}"))
+        ));
+    }
+    // A saved list shorter than the shown one is padded with the shown text.
+    if !saved.is_empty() && saved.len() < shown.len() {
+        saved.extend(shown.iter().skip(saved.len()).cloned());
+    }
+    (shown, saved)
 }
 
 fn parse_field(n: XmlNode, warnings: &mut Vec<String>) -> Field {
@@ -384,6 +428,18 @@ fn parse_field(n: XmlNode, warnings: &mut Vec<String>) -> Field {
     let scripts = parse_events(n);
     let numeric = matches!(kind, Ui::NumericEdit)
         || value_el.is_some_and(|v| v.children().any(|c| c.is_element() && matches!(c.tag_name().name(), "decimal" | "integer" | "float")));
+    let (items, item_values) = parse_items(n, warnings);
+    let choice = match (kind == Ui::ChoiceList, ui_el) {
+        (true, Some(e)) => {
+            let open = e.attribute("open").unwrap_or("onEntry");
+            ChoiceList {
+                list_box: matches!(open, "always" | "multiSelect"),
+                multi: open == "multiSelect",
+                editable: e.attribute("textEntry").is_some_and(|t| t == "1" || t == "true"),
+            }
+        }
+        _ => ChoiceList::default(),
+    };
     let validate_el = child(n, "validate");
     let validate_message = validate_el
         .and_then(|v| child(v, "message"))
@@ -401,7 +457,9 @@ fn parse_field(n: XmlNode, warnings: &mut Vec<String>) -> Field {
         multiline: ui_el.is_some_and(|e| e.attribute("multiLine").is_some_and(|m| m == "1" || m == "true")),
         caption: parse_caption(child(n, "caption"), warnings),
         value: parse_value(value_el, warnings),
-        items: parse_items(n),
+        items,
+        item_values,
+        choice,
         max_chars,
         tooltip: child(n, "assist").and_then(|a| child(a, "toolTip")).map(text_of).map(|t| t.trim().to_string()).filter(|t| !t.is_empty()),
         access: match n.attribute("access") {
diff --git a/crates/xfa/src/pdf.rs b/crates/xfa/src/pdf.rs
index 538dc214..811ac326 100644
--- a/crates/xfa/src/pdf.rs
+++ b/crates/xfa/src/pdf.rs
@@ -29,11 +29,39 @@ pub fn jpeg_size(data: &[u8]) -> Option<(u32, u32)> {
 }
 
 fn jpeg_frame(data: &[u8]) -> Option<(u32, u32, u8)> {
+    jpeg_info(data).map(|(w, h, c, _)| (w, h, c))
+}
+
+/// The SHA-256 of a picture's bytes, to find its XObject again.
+fn content_hash(data: &[u8]) -> [u8; 32] {
+    use sha2::Digest;
+    sha2::Sha256::digest(data).into()
+}
+
+fn hex32(h: &[u8; 32]) -> Vec<u8> {
+    h.iter().flat_map(|b| format!("{b:02x}").into_bytes()).collect()
+}
+
+fn parse_hex32(s: &[u8]) -> Option<[u8; 32]> {
+    let mut out = [0u8; 32];
+    if s.len() != 64 {
+        return None;
+    }
+    for (o, pair) in out.iter_mut().zip(s.as_chunks::<2>().0) {
+        *o = u8::from_str_radix(std::str::from_utf8(pair).ok()?, 16).ok()?;
+    }
+    Some(out)
+}
+
+/// Width, height, components and whether an Adobe APP14 segment is present (such CMYK JPEGs
+/// store inverted values).
+fn jpeg_info(data: &[u8]) -> Option<(u32, u32, u8, bool)> {
     if data.get(0..2)? != [0xFF, 0xD8] {
         return None;
     }
     let mut i = 2usize;
     let mut guard = 0;
+    let mut adobe = false;
     while i + 4 <= data.len() && guard < 10_000 {
         guard += 1;
         if *data.get(i)? != 0xFF {
@@ -50,12 +78,15 @@ fn jpeg_frame(data: &[u8]) -> Option<(u32, u32, u8)> {
             continue;
         }
         let len = u16::from_be_bytes([*data.get(i + 2)?, *data.get(i + 3)?]) as usize;
+        if marker == 0xEE && data.get(i + 4..i + 9) == Some(b"Adobe") {
+            adobe = true;
+        }
         let sof = matches!(marker, 0xC0..=0xCF) && !matches!(marker, 0xC4 | 0xC8 | 0xCC);
         if sof {
             let h = u16::from_be_bytes([*data.get(i + 5)?, *data.get(i + 6)?]) as u32;
             let w = u16::from_be_bytes([*data.get(i + 7)?, *data.get(i + 8)?]) as u32;
             let comps = *data.get(i + 9)?;
-            return (w > 0 && h > 0).then_some((w, h, comps));
+            return (w > 0 && h > 0).then_some((w, h, comps, adobe));
         }
         i = i.checked_add(2)?.checked_add(len.max(2))?;
     }
@@ -125,8 +156,20 @@ pub struct Written {
     pub warnings: Vec<String>,
 }
 
+/// On an image XObject written for a picture: the SHA-256 (hex) of the picture's bytes. A
+/// re-layout (after every script event) finds the XObjects on the pages it replaces by this,
+/// and reuses them instead of decoding and embedding the same picture again. Nothing is kept
+/// in the catalog, and a match is by the picture's own hash, never by a map read from the file.
+const IMAGE_SHA_KEY: &[u8] = b"PCXfaSHA256";
+/// Most pages searched for earlier pictures.
+const MAX_PAGES_SEARCHED: usize = 10_000;
+/// Most pictures remembered.
+const MAX_REMEMBERED_IMAGES: usize = 1000;
+
 struct Emitter<'a> {
     doc: &'a mut Document,
+    /// Image XObjects by content hash: those from earlier passes, then this one's.
+    images: HashMap<[u8; 32], ObjRef>,
     fields: Vec<ObjRef>,
     radio_groups: HashMap<String, (ObjRef, Vec<ObjRef>)>,
     /// The on state selected in each radio group, from the data.
@@ -173,11 +216,14 @@ impl Emitter<'_> {
         }
         let mut top_level = true;
         match &w.kind {
-            WidgetKind::Text | WidgetKind::Date(_) => {
+            WidgetKind::Text | WidgetKind::Date(_) | WidgetKind::Password => {
                 d.set(b"FT".to_vec(), Object::name("Tx"));
                 if w.multiline {
                     ff |= 1 << 12;
                 }
+                if w.kind == WidgetKind::Password {
+                    ff |= 1 << 13;
+                }
                 if let Some(m) = w.max_chars {
                     d.set(b"MaxLen".to_vec(), Object::Int(m.min(100_000) as i64));
                 }
@@ -202,6 +248,63 @@ impl Emitter<'_> {
                     d.set(b"AA".to_vec(), Object::Dict(aa));
                 }
             }
+            WidgetKind::Choice { options, list_box, multi, editable } => {
+                d.set(b"FT".to_vec(), Object::name("Ch"));
+                if !list_box {
+                    ff |= 1 << 17;
+                    if *editable {
+                        ff |= 1 << 18;
+                    }
+                }
+                if *multi {
+                    ff |= 1 << 21;
+                }
+                let opt: Vec<Object> = options
+                    .iter()
+                    .map(|(saved, shown)| {
+                        if saved == shown {
+                            Object::String(PdfString::text(shown))
+                        } else {
+                            Object::Array(vec![Object::String(PdfString::text(saved)), Object::String(PdfString::text(shown))])
+                        }
+                    })
+                    .collect();
+                d.set(b"Opt".to_vec(), Object::Array(opt));
+                let q = match w.h_align {
+                    crate::model::HAlign::Center => 1,
+                    crate::model::HAlign::Right => 2,
+                    _ => 0,
+                };
+                if q != 0 {
+                    d.set(b"Q".to_vec(), Object::Int(q));
+                }
+                let values = |v: &str| -> Object {
+                    let picked: Vec<&str> = if *multi { v.lines().filter(|l| !l.is_empty()).collect() } else { vec![v] };
+                    match picked.as_slice() {
+                        [one] => Object::String(PdfString::text(one)),
+                        many => Object::Array(many.iter().map(|s| Object::String(PdfString::text(s))).collect()),
+                    }
+                };
+                if let Some(v) = &w.value {
+                    d.set(b"V".to_vec(), values(v));
+                    // The selected indices (ISO 32000-2 Table 231): ascending, each once. Where
+                    // two options save the same value the first is meant; the data can't say.
+                    let picked: Vec<&str> = if *multi { v.lines().filter(|l| !l.is_empty()).collect() } else { vec![v.as_str()] };
+                    let mut idx: Vec<usize> = picked.iter().filter_map(|p| options.iter().position(|(saved, _)| saved == p)).collect();
+                    idx.sort_unstable();
+                    idx.dedup();
+                    if !idx.is_empty() {
+                        d.set(b"I".to_vec(), Object::Array(idx.into_iter().map(|i| Object::Int(i as i64)).collect()));
+                    }
+                }
+                if let Some(v) = &w.default {
+                    // Already a saved value (the layout maps defaults as it maps data).
+                    d.set(b"DV".to_vec(), values(v));
+                }
+            }
+            WidgetKind::Signature => {
+                d.set(b"FT".to_vec(), Object::name("Sig"));
+            }
             WidgetKind::CheckBox { on, .. } => {
                 d.set(b"FT".to_vec(), Object::name("Btn"));
                 let on = state_name(on);
@@ -309,6 +412,85 @@ impl Emitter<'_> {
         Ok(Some(r))
     }
 
+    /// An image XObject for a picture: JPEGs as they are (`DCTDecode`), PNGs and GIFs decoded
+    /// to samples (`FlateDecode`, with a soft mask for transparency). `None`, with a warning,
+    /// for anything else.
+    fn image_xobject(&mut self, data: &[u8], content_type: &str) -> Option<ObjRef> {
+        let hash = content_hash(data);
+        if let Some(&r) = self.images.get(&hash)
+            && let Object::Stream(s) = &*self.doc.get(r)
+            && s.dict.name(b"Subtype") == Some(b"Image")
+        {
+            return Some(r);
+        }
+        let r = self.new_image_xobject(data, content_type, &hash)?;
+        if self.images.len() < MAX_REMEMBERED_IMAGES {
+            self.images.insert(hash, r);
+        }
+        Some(r)
+    }
+
+    fn new_image_xobject(&mut self, data: &[u8], content_type: &str, hash: &[u8; 32]) -> Option<ObjRef> {
+        let what = if content_type.is_empty() { "picture" } else { content_type };
+        let mut d = Dict::new();
+        d.set(IMAGE_SHA_KEY.to_vec(), Object::String(PdfString::literal(hex32(hash))));
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        match crate::image::kind(data) {
+            Some(crate::image::Kind::Jpeg) => {
+                let Some((iw, ih, comps, adobe)) = jpeg_info(data) else {
+                    self.warnings.push(format!("a {what} image is not a readable JPEG and is left out"));
+                    return None;
+                };
+                d.set(b"Width".to_vec(), Object::Int(i64::from(iw)));
+                d.set(b"Height".to_vec(), Object::Int(i64::from(ih)));
+                d.set(
+                    b"ColorSpace".to_vec(),
+                    Object::name(match comps {
+                        1 => "DeviceGray",
+                        4 => "DeviceCMYK",
+                        _ => "DeviceRGB",
+                    }),
+                );
+                if comps == 4 && adobe {
+                    // Adobe APP14 JPEGs store inverted CMYK.
+                    d.set(b"Decode".to_vec(), Object::Array([1, 0, 1, 0, 1, 0, 1, 0].iter().map(|v| Object::Int(*v)).collect()));
+                }
+                d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+                Some(self.doc.add(Object::Stream(Stream::from_raw(d, data.to_vec()))))
+            }
+            Some(crate::image::Kind::Png | crate::image::Kind::Gif) => {
+                let img = match crate::image::decode(data) {
+                    Ok(img) => img,
+                    Err(why) => {
+                        self.warnings.push(why);
+                        return None;
+                    }
+                };
+                d.set(b"Width".to_vec(), Object::Int(i64::from(img.width)));
+                d.set(b"Height".to_vec(), Object::Int(i64::from(img.height)));
+                d.set(b"ColorSpace".to_vec(), Object::name(img.color_space));
+                if let Some(alpha) = &img.alpha {
+                    let mut m = Dict::new();
+                    m.set(b"Type".to_vec(), Object::name("XObject"));
+                    m.set(b"Subtype".to_vec(), Object::name("Image"));
+                    m.set(b"Width".to_vec(), Object::Int(i64::from(img.width)));
+                    m.set(b"Height".to_vec(), Object::Int(i64::from(img.height)));
+                    m.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+                    m.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+                    let mr = self.doc.add(Object::Stream(Stream::flate(m, alpha)));
+                    d.set(b"SMask".to_vec(), Object::Ref(mr));
+                }
+                Some(self.doc.add(Object::Stream(Stream::flate(d, &img.samples))))
+            }
+            None => {
+                self.warnings.push(format!("a {what} image is not a JPEG, PNG or GIF and is left out"));
+                None
+            }
+        }
+    }
+
     fn page(&mut self, page: &Page, pages_ref: ObjRef) -> Result<ObjRef, XfaError> {
         let page_ref = self.doc.add(Object::Dict(Dict::new()));
         let mut content: Vec<u8> = Vec::new();
@@ -346,33 +528,7 @@ impl Emitter<'_> {
                     content.extend_from_slice(b" Tj ET\n");
                 }
                 Item::Image { rect, data, content_type } => {
-                    let Some((iw, ih, comps)) = jpeg_frame(data) else {
-                        self.warnings.push(format!(
-                            "a {} image is not a JPEG and is left out",
-                            if content_type.is_empty() { "picture" } else { content_type.as_str() }
-                        ));
-                        continue;
-                    };
-                    let mut d = Dict::new();
-                    d.set(b"Type".to_vec(), Object::name("XObject"));
-                    d.set(b"Subtype".to_vec(), Object::name("Image"));
-                    d.set(b"Width".to_vec(), Object::Int(i64::from(iw)));
-                    d.set(b"Height".to_vec(), Object::Int(i64::from(ih)));
-                    d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
-                    d.set(
-                        b"ColorSpace".to_vec(),
-                        Object::name(match comps {
-                            1 => "DeviceGray",
-                            4 => "DeviceCMYK",
-                            _ => "DeviceRGB",
-                        }),
-                    );
-                    if comps == 4 {
-                        // Adobe APP14 JPEGs store inverted CMYK.
-                        d.set(b"Decode".to_vec(), Object::Array([1, 0, 1, 0, 1, 0, 1, 0].iter().map(|v| Object::Int(*v)).collect()));
-                    }
-                    d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
-                    let r = self.doc.add(Object::Stream(Stream::from_raw(d, data.as_ref().clone())));
+                    let Some(r) = self.image_xobject(data, content_type) else { continue };
                     let name = format!("Im{i}");
                     xobjects.set(name.clone().into_bytes(), Object::Ref(r));
                     content.extend(format!("q {} 0 0 {} {} {} cm /{name} Do Q\n", n(rect.w), n(rect.h), n(rect.x), n(h - rect.bottom())).bytes());
@@ -413,6 +569,30 @@ impl Emitter<'_> {
 
 /// Replace the document's pages with the laid-out form and add its fields to the AcroForm. The
 /// XFA packets and everything else in the catalog stay.
+/// The image XObjects earlier passes wrote for pictures, by the SHA-256 each records: those on
+/// the pages under `pages` (the flat page list [`write_form`] writes).
+fn earlier_images(doc: &Document, pages: ObjRef) -> HashMap<[u8; 32], ObjRef> {
+    let mut out = HashMap::new();
+    let kids = doc.get(pages).as_dict().and_then(|d| d.get(b"Kids").map(|k| doc.resolve(k))).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+    for page in kids.iter().filter_map(Object::as_ref).take(MAX_PAGES_SEARCHED) {
+        let page = doc.get(page);
+        let Some(resources) = page.as_dict().and_then(|p| p.get(b"Resources")).map(|r| doc.resolve(r)) else { continue };
+        let Some(xobjects) = resources.as_dict().and_then(|r| r.get(b"XObject")).map(|x| doc.resolve(x)) else { continue };
+        for r in xobjects.as_dict().into_iter().flat_map(|x| x.iter()).filter_map(|(_, v)| v.as_ref()) {
+            if out.len() >= MAX_REMEMBERED_IMAGES {
+                return out;
+            }
+            if let Object::Stream(s) = &*doc.get(r)
+                && s.dict.name(b"Subtype") == Some(b"Image")
+                && let Some(hash) = s.dict.get(IMAGE_SHA_KEY).and_then(Object::as_string).and_then(|h| parse_hex32(&h.bytes))
+            {
+                out.insert(hash, r);
+            }
+        }
+    }
+    out
+}
+
 pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError> {
     let catalog_ref = doc.root().ok_or_else(|| XfaError::Malformed("the document has no catalog".into()))?;
     let mut catalog = doc.get(catalog_ref).as_dict().cloned().ok_or_else(|| XfaError::Malformed("the catalog is not a dictionary".into()))?;
@@ -428,8 +608,17 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
             r
         }
     };
-    let mut em =
-        Emitter { doc, fields: Vec::new(), radio_groups: HashMap::new(), radio_selected: HashMap::new(), field_count: 0, warnings: Vec::new() };
+    // Pictures embedded by earlier passes, from the pages this pass replaces.
+    let images = earlier_images(doc, pages_ref);
+    let mut em = Emitter {
+        doc,
+        images,
+        fields: Vec::new(),
+        radio_groups: HashMap::new(),
+        radio_selected: HashMap::new(),
+        field_count: 0,
+        warnings: Vec::new(),
+    };
     let mut kids = Vec::new();
     for page in &form.pages {
         kids.push(Object::Ref(em.page(page, pages_ref)?));
diff --git a/crates/xfa/src/script.rs b/crates/xfa/src/script.rs
index 53b2cf50..c2088dee 100644
--- a/crates/xfa/src/script.rs
+++ b/crates/xfa/src/script.rs
@@ -241,15 +241,15 @@ impl Walker<'_> {
 
     fn field(&mut self, f: &Field, parent_som: &str, index: usize, radio: Option<&str>) -> FormNode {
         let som = child_som(parent_som, f.common.name.as_deref().or(Some("field")), index);
-        let data_value = self.data.and_then(|d| d.text_at(&som_to_path(&som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+        let data_value = self.data.and_then(|d| d.value_at(&som_to_path(&som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
         let value = match (radio, data_value) {
             // A radio button's value is its on value when the group picked it.
             (Some(selected), _) => {
                 let on = f.items.first().cloned().unwrap_or_default();
                 if selected == on { on } else { String::new() }
             }
-            (None, Some(v)) => v,
-            (None, None) => f.value.plain().map(|v| v.trim().to_string()).unwrap_or_default(),
+            (None, Some(v)) => f.saved_value(&v),
+            (None, None) => f.value.plain().map(|v| f.saved_value(v.trim())).unwrap_or_default(),
         };
         self.push_events(&som, &f.scripts, f.calculate.as_ref(), f.validate.as_ref(), f.validate_message.as_deref());
         FormNode {
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index d067b14d..4a4d8ad5 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -7,8 +7,9 @@ use crate::data::{
     DatasetsWrite, FieldData, FieldDatum, build_data, iso_to_pattern, parse_datasets, pattern_to_iso, read_values, som_to_path, write_datasets,
 };
 use crate::data::{add_data_instances, remove_data_instance, write_data_value};
-use crate::fixtures::{scripted_template, shell, static_shell, template, template_with_data};
+use crate::fixtures::{TINY_GIF, fields_template, scripted_template, shell, static_shell, template, template_with_data, tiny_png};
 use crate::layout::Item;
+use crate::layout::WidgetKind;
 use crate::model::*;
 use crate::script::{NodeKind, Overrides, apply_overrides, fields_by_som, form_tree, overrides, rerender, set_overrides};
 
@@ -762,3 +763,281 @@ fn top_fields(doc: &Document) -> Vec<(String, pdfcraft_cos::Dict)> {
         })
         .collect()
 }
+
+#[test]
+fn choice_lists_signatures_passwords_and_pictures_become_fields_and_images() {
+    let form = layout_xml(&fields_template("")).unwrap();
+    let p1 = &form.pages[0];
+    let w = widgets(p1);
+    let country = w.iter().find(|w| w.name == "country").unwrap();
+    assert_eq!(
+        country.kind,
+        WidgetKind::Choice {
+            options: vec![("CA".into(), "Canada".into()), ("FR".into(), "France".into()), ("JP".into(), "Japan".into())],
+            list_box: false,
+            multi: false,
+            editable: false,
+        }
+    );
+    assert_eq!(country.value.as_deref(), Some("FR"), "the template default, as a saved value");
+    let langs = w.iter().find(|w| w.name == "langs").unwrap();
+    assert!(
+        matches!(&langs.kind, WidgetKind::Choice { options, list_box: true, multi: true, editable: false } if options.len() == 3 && options[0] == ("English".into(), "English".into()))
+    );
+    let other = w.iter().find(|w| w.name == "other").unwrap();
+    assert!(matches!(&other.kind, WidgetKind::Choice { list_box: false, multi: false, editable: true, .. }));
+    assert_eq!(w.iter().find(|w| w.name == "pin").unwrap().kind, WidgetKind::Password);
+    assert_eq!(w.iter().find(|w| w.name == "sign").unwrap().kind, WidgetKind::Signature);
+    assert!(w.iter().all(|w| w.name != "photo" && w.name != "code"), "image and barcode fields make no widget");
+    // The PNG in the image field and the GIF in the draw are pictures, fitted to their boxes.
+    let images: Vec<(&Rect, usize)> =
+        p1.items.iter().filter_map(|i| if let Item::Image { rect, data, .. } = i { Some((rect, data.len())) } else { None }).collect();
+    assert_eq!(images.len(), 2, "{images:?}");
+    assert!((images[0].0.w - 72.0).abs() < 0.01 && (images[0].0.h - 72.0).abs() < 0.01, "a square picture fills a 1in square: {:?}", images[0].0);
+    assert_eq!(images[1].1, TINY_GIF.len());
+    let t = texts(p1);
+    assert!(t.iter().any(|s| s == "12345"), "the barcode's value as text: {t:?}");
+    assert!(form.warnings.iter().any(|w| w.contains("barcode")) && form.warnings.iter().any(|w| w.contains("image fields")), "{:?}", form.warnings);
+
+    // Written into the PDF: /Ch fields with their options and flags, a /Sig field, a password
+    // field, and Flate images (the PNG with a soft mask).
+    let mut doc = Document::open(Arc::new(shell(&fields_template("")))).unwrap();
+    let report = render_into(&mut doc).unwrap();
+    assert_eq!(report.fields, 6, "country, langs, other, pin, sign, summary");
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let fields = pdfcraft_forms_free_fields(&doc);
+    let field = |n: &str| fields.iter().find(|(name, _)| name == n).map(|(_, d)| d.clone()).unwrap_or_else(|| panic!("no field {n}"));
+    let country = field("country");
+    assert_eq!(country.name(b"FT"), Some(b"Ch".as_slice()));
+    assert_eq!(country.int(b"Ff"), Some(1 << 17), "a combo box");
+    let opt = doc.resolve(country.get(b"Opt").unwrap()).as_array().unwrap().clone();
+    assert_eq!(opt.len(), 3);
+    let pair = doc.resolve(&opt[1]).as_array().unwrap().clone();
+    assert_eq!(pair[0].as_string().unwrap().to_text(), "FR");
+    assert_eq!(pair[1].as_string().unwrap().to_text(), "France");
+    assert_eq!(country.get(b"V").and_then(|v| v.as_string()).map(|s| s.to_text()).as_deref(), Some("FR"));
+    assert_eq!(country.get(b"DV").and_then(|v| v.as_string()).map(|s| s.to_text()).as_deref(), Some("FR"));
+    let langs = field("langs");
+    assert_eq!(langs.int(b"Ff"), Some(1 << 21), "a multi-select list box");
+    let opt = doc.resolve(langs.get(b"Opt").unwrap()).as_array().unwrap().clone();
+    assert_eq!(opt[0].as_string().unwrap().to_text(), "English", "same shown text and value: a plain string");
+    assert_eq!(field("other").int(b"Ff"), Some((1 << 17) | (1 << 18)), "an editable combo box");
+    assert_eq!(field("pin").int(b"Ff"), Some(1 << 13), "a password field");
+    assert_eq!(field("sign").name(b"FT"), Some(b"Sig".as_slice()));
+    let streams: Vec<pdfcraft_cos::Stream> = doc
+        .object_numbers()
+        .into_iter()
+        .filter_map(|n| if let Object::Stream(st) = &*doc.get(pdfcraft_cos::ObjRef { num: n, generation: 0 }) { Some(st.clone()) } else { None })
+        .filter(|s| s.dict.name(b"Subtype") == Some(b"Image"))
+        .collect();
+    assert_eq!(streams.len(), 3, "the PNG, its soft mask, the GIF");
+    let png = streams.iter().find(|s| s.dict.contains(b"SMask")).expect("the PNG has a soft mask");
+    assert_eq!(png.dict.name(b"ColorSpace"), Some(b"DeviceRGB".as_slice()));
+    assert_eq!(png.dict.name(b"Filter"), Some(b"FlateDecode".as_slice()));
+    assert_eq!(png.decoded().unwrap().len(), 12, "2 × 2 RGB samples");
+    let gif = streams.iter().find(|s| s.dict.int(b"Width") == Some(1)).expect("the 1 × 1 GIF");
+    assert_eq!(gif.dict.name(b"ColorSpace"), Some(b"DeviceGray".as_slice()), "a white pixel is gray");
+    assert_eq!(gif.decoded().unwrap(), vec![255]);
+}
+
+/// The terminal field dictionaries by name (one level: this fixture has no hierarchy).
+fn pdfcraft_forms_free_fields(doc: &Document) -> Vec<(String, pdfcraft_cos::Dict)> {
+    let root = doc.get(doc.root().unwrap());
+    let acro = doc.resolve(root.as_dict().unwrap().get(b"AcroForm").unwrap());
+    let fields = doc.resolve(acro.as_dict().unwrap().get(b"Fields").unwrap()).as_array().unwrap().clone();
+    fields
+        .iter()
+        .filter_map(|f| {
+            let d = doc.resolve(f).as_dict()?.clone();
+            let name = d.get(b"T").map(|t| doc.resolve(t)).and_then(|t| t.as_string().map(|s| s.to_text()))?;
+            Some((name, d))
+        })
+        .collect()
+}
+
+#[test]
+fn choice_values_come_from_the_data_as_saved_values_and_several_for_lists() {
+    // Shown text in the data is taken too (an editable list the user typed into saves text).
+    let xml = fields_template("<form><page1><country>Japan</country><langs>English\nSpanish</langs><other>typed</other></page1></form>");
+    let form = layout_xml(&xml).unwrap();
+    let w = widgets(&form.pages[0]);
+    assert_eq!(w.iter().find(|w| w.name == "country").unwrap().value.as_deref(), Some("JP"));
+    assert_eq!(w.iter().find(|w| w.name == "langs").unwrap().value.as_deref(), Some("English\nSpanish"));
+    assert_eq!(w.iter().find(|w| w.name == "other").unwrap().value.as_deref(), Some("typed"));
+    let mut doc = Document::open(Arc::new(shell(&xml))).unwrap();
+    render_into(&mut doc).unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let fields = pdfcraft_forms_free_fields(&doc);
+    let langs = &fields.iter().find(|(n, _)| n == "langs").unwrap().1;
+    let v = doc.resolve(langs.get(b"V").unwrap()).as_array().unwrap().clone();
+    assert_eq!(v.iter().map(|s| s.as_string().unwrap().to_text()).collect::<Vec<_>>(), vec!["English", "Spanish"]);
+    let i = doc.resolve(langs.get(b"I").unwrap()).as_array().unwrap().clone();
+    assert_eq!(i.iter().map(|o| o.as_int().unwrap()).collect::<Vec<_>>(), vec![0, 2]);
+}
+
+#[test]
+fn pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated() {
+    use crate::image::{Kind, decode, kind, size};
+    assert_eq!(kind(&tiny_png()), Some(Kind::Png));
+    assert_eq!(size(&tiny_png()), Some((2, 2)));
+    assert_eq!(kind(TINY_GIF), Some(Kind::Gif));
+    assert_eq!(size(TINY_GIF), Some((1, 1)));
+    assert_eq!(kind(b"BM..."), None);
+    assert_eq!(size(b"\x89PNG\r\n\x1a\n\0\0\0\rIHDR"), None, "a header cut short");
+    let decoded = decode(&tiny_png()).unwrap();
+    assert_eq!((decoded.width, decoded.height, decoded.color_space), (2, 2, "DeviceRGB"));
+    assert_eq!(decoded.samples, vec![255, 0, 0, 0, 255, 0, 0, 0, 255, 0, 0, 0]);
+    assert_eq!(decoded.alpha, Some(vec![255, 255, 255, 0]));
+    assert_eq!(decode(TINY_GIF).unwrap().samples, vec![255]);
+    // A PNG claiming 100,000 × 100,000 pixels is refused from its header, before any buffer.
+    let mut huge = tiny_png();
+    huge[16..20].copy_from_slice(&100_000u32.to_be_bytes());
+    huge[20..24].copy_from_slice(&100_000u32.to_be_bytes());
+    assert_eq!(size(&huge), None, "no size for layout: the box is used");
+    assert!(decode(&huge).unwrap_err().contains("million pixels"));
+    // Truncated and corrupt data are errors, not panics.
+    let cut = &tiny_png()[..30];
+    assert!(decode(cut).is_err());
+    let mut bad = tiny_png();
+    for b in bad.iter_mut().skip(40) {
+        *b ^= 0x55;
+    }
+    assert!(decode(&bad).is_err() || decode(&bad).is_ok());
+    let mut gif = TINY_GIF.to_vec();
+    gif.truncate(12);
+    assert!(decode(&gif).is_err());
+    // A form whose picture is broken still lays out, with a warning, and keeps the rest.
+    let xml = fields_template("")
+        .replace("image/gif", "image/gif\" transferEncoding=\"none")
+        .replace("<image contentType=\"image/png\">", "<image contentType=\"image/png\">AAAA");
+    let mut doc = Document::open(Arc::new(shell(&xml))).unwrap();
+    let report = render_into(&mut doc).unwrap();
+    assert_eq!(report.fields, 6);
+    assert!(report.warnings.iter().any(|w| w.contains("image")), "{:?}", report.warnings);
+}
+
+#[test]
+fn choice_values_are_saved_values_first_deduplicated_and_defaults_are_saved_values_too() {
+    // Designer's "specify item values": shown 0..3, saved 1..4. The data's 1 means the item
+    // shown as 0, not the item shown as 1.
+    let tpl = fields_template("<form><page1><country>1</country></page1></form>")
+        .replace("<text>Canada</text><text>France</text><text>Japan</text>", "<text>0</text><text>1</text><text>2</text><text>3</text>")
+        .replace("<text>CA</text><text>FR</text><text>JP</text>", "<text>1</text><text>2</text><text>3</text><text>4</text>")
+        .replace("<value><text>FR</text></value></field>", "<value><text>1</text></value></field>");
+    let form = layout_xml(&tpl).unwrap();
+    let w = widgets(&form.pages[0]);
+    assert_eq!(w.iter().find(|w| w.name == "country").unwrap().value.as_deref(), Some("1"));
+    let (t, _) = parse(&tpl).unwrap();
+    let tree = form_tree(&t, parse_datasets(&tpl).as_ref(), &Overrides::default());
+    let node = tree.root.children.iter().find(|n| n.name == "page1").unwrap().children.iter().find(|n| n.name == "country").unwrap();
+    assert_eq!(node.value, "1", "scripts read the saved value");
+    // Several values: each once, never more than there are items, written as ascending indices;
+    // a single-select list takes the first line; defaults are saved values.
+    let tpl = fields_template("<form><page1><country>Japan\nCanada</country><langs>Spanish\nEnglish\nEnglish\nSpanish</langs></page1></form>")
+        .replace("<value><text>FR</text></value></field>", "<value><text>France</text></value></field>")
+        .replace(
+            "<items><text>English</text><text>French</text><text>Spanish</text></items>",
+            "<items><text>English</text><text>French</text><text>Spanish</text></items><value><text>English\nFrench</text></value>",
+        );
+    let form = layout_xml(&tpl).unwrap();
+    let w = widgets(&form.pages[0]);
+    assert_eq!(w.iter().find(|w| w.name == "langs").unwrap().value.as_deref(), Some("Spanish\nEnglish"));
+    assert_eq!(w.iter().find(|w| w.name == "country").unwrap().value.as_deref(), Some("JP"));
+    assert_eq!(w.iter().find(|w| w.name == "country").unwrap().default.as_deref(), Some("FR"));
+    let mut doc = Document::open(Arc::new(shell(&tpl))).unwrap();
+    render_into(&mut doc).unwrap();
+    let doc = Document::open(Arc::new(write_incremental(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    let fields = pdfcraft_forms_free_fields(&doc);
+    let langs = &fields.iter().find(|(n, _)| n == "langs").unwrap().1;
+    let i = doc.resolve(langs.get(b"I").unwrap()).as_array().unwrap().clone();
+    assert_eq!(i.iter().map(|o| o.as_int().unwrap()).collect::<Vec<_>>(), vec![0, 2]);
+    let dv = doc.resolve(langs.get(b"DV").unwrap()).as_array().unwrap().clone();
+    assert_eq!(dv.iter().map(|s| s.as_string().unwrap().to_text()).collect::<Vec<_>>(), vec!["English", "French"]);
+    let country = &fields.iter().find(|(n, _)| n == "country").unwrap().1;
+    assert_eq!(country.get(b"DV").and_then(|v| v.as_string()).map(|s| s.to_text()).as_deref(), Some("FR"));
+    assert_eq!(doc.resolve(country.get(b"I").unwrap()).as_array().unwrap().len(), 1);
+    // Picks stored as <value> children are read too.
+    let tpl = fields_template("<form><page1><langs><value>English</value><value>Spanish</value></langs></page1></form>");
+    let form = layout_xml(&tpl).unwrap();
+    assert_eq!(widgets(&form.pages[0]).iter().find(|w| w.name == "langs").unwrap().value.as_deref(), Some("English\nSpanish"));
+    // More items than the cap: kept to the cap, and said so.
+    let many: String = (0..1500).map(|i| format!("<text>i{i}</text>")).collect();
+    let tpl = fields_template("").replace("<items><text>A</text><text>B</text></items>", &format!("<items>{many}</items>"));
+    let form = layout_xml(&tpl).unwrap();
+    let other = widgets(&form.pages[0]).into_iter().find(|w| w.name == "other").unwrap();
+    assert!(matches!(&other.kind, WidgetKind::Choice { options, .. } if options.len() == 1000));
+    assert!(form.warnings.iter().any(|w| w.contains("other") && w.contains("1000 items")), "{:?}", form.warnings);
+}
+
+#[test]
+fn pictures_are_embedded_once_across_relayouts_and_bad_data_pictures_are_reported() {
+    use crate::image::{decode, size};
+    let tpl = fields_template("<form><page1><country>JP</country></page1></form>");
+    let mut doc = Document::open(Arc::new(shell(&tpl))).unwrap();
+    render_into(&mut doc).unwrap();
+    let (t, _) = parse(&tpl).unwrap();
+    rerender(&mut doc, &t).unwrap();
+    rerender(&mut doc, &t).unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let images = doc
+        .object_numbers()
+        .into_iter()
+        .filter(
+            |n| matches!(&*doc.get(pdfcraft_cos::ObjRef { num: *n, generation: 0 }), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image")),
+        )
+        .count();
+    assert_eq!(images, 3, "the PNG, its soft mask and the GIF, however many times the form was laid out");
+    // No private map in the catalog: earlier pictures are found on the pages, by their hash.
+    let root = doc.get(doc.root().unwrap());
+    assert!(!root.as_dict().unwrap().contains(b"PCXfaImages"));
+    // Pictures in the data that aren't pictures: a warning naming the field, the template's
+    // picture shown instead.
+    for (data, what) in [("Qk0AAAAA", "not a JPEG, PNG or GIF"), ("not base64!", "not base64")] {
+        let tpl = fields_template(&format!("<form><page1><photo>{data}</photo></page1></form>"));
+        let form = layout_xml(&tpl).unwrap();
+        assert!(form.warnings.iter().any(|w| w.contains("photo") && w.contains(what)), "{what}: {:?}", form.warnings);
+        assert_eq!(form.pages[0].items.iter().filter(|i| matches!(i, Item::Image { .. })).count(), 2);
+    }
+    // A hostile PNG header: no size for layout (the draw keeps its box), refused at decode.
+    let mut tall = tiny_png();
+    tall[16..20].copy_from_slice(&1u32.to_be_bytes());
+    tall[20..24].copy_from_slice(&4_000_000_000u32.to_be_bytes());
+    assert_eq!(size(&tall), None);
+    assert!(decode(&tall).unwrap_err().contains("million pixels"));
+    use base64::Engine;
+    let b64 = base64::engine::general_purpose::STANDARD.encode(&tall);
+    let tpl = fields_template("").replace(
+        r#"<draw name="logo" w="0.5in" h="0.5in">"#,
+        &format!(
+            r#"<draw name="tall" w="2in"><value><image contentType="image/png">{b64}</image></value></draw><draw name="logo" w="0.5in" h="0.5in">"#
+        ),
+    );
+    let form = layout_xml(&tpl).unwrap();
+    assert_eq!(form.pages.len(), 1, "a picture of unknown size takes its box, not a page");
+    // A GIF whose frame is far larger than its 1 × 1 screen is refused before it is allocated.
+    let mut gif = b"GIF89a\x01\x00\x01\x00\x80\x00\x00\xff\xff\xff\x00\x00\x00,\x00\x00\x00\x00".to_vec();
+    gif.extend_from_slice(&11_000u16.to_le_bytes());
+    gif.extend_from_slice(&11_000u16.to_le_bytes());
+    gif.extend_from_slice(b"\x00\x02\x02D\x01\x00;");
+    let started = std::time::Instant::now();
+    assert!(decode(&gif).unwrap_err().contains("million pixels"));
+    assert!(started.elapsed() < std::time::Duration::from_secs(2));
+    // A template picture over 1 MiB is read whole (text is cut at 1 MiB, pictures are not).
+    let big = "A".repeat(1_600_000);
+    let tpl = fields_template("").replace(r#"<image contentType="image/gif">"#, &format!(r#"<image contentType="image/gif">{big}"#));
+    let (t, _) = parse(&tpl).unwrap();
+    fn find_image(nodes: &[Node]) -> Option<usize> {
+        nodes.iter().find_map(|n| match n {
+            Node::Draw(d) => match &d.value {
+                Value::Image { data, .. } => Some(data.len()),
+                _ => None,
+            },
+            Node::Subform(s) => find_image(&s.children),
+            _ => None,
+        })
+    }
+    assert!(find_image(&t.root.children).is_some_and(|n| n > 1_200_000));
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 4d8be6d5..02d60ad7 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5142,8 +5142,8 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open"]
 tools = ["doc_open", "doc_info", "form_fields", "form_fill", "js_run"]
-evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/automation/tests/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite"]
-notes = "laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters, breaks, repeated header rows, captions, rich text, JPEG images) into real pages and AcroForm fields (text, date with AFDate formats, check boxes, radio groups, buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; doc_info reports xfa_layout. XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off) and what open-time scripts changed is noted. Missing: loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; choice lists are text fields; signature, image and barcode fields are blank; PNG images; keep rules; metrics are approximate and Acrobat fidelity is eyeballed on real forms, not measured (#60)"
+evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/automation/tests/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save"]
+notes = "laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters, breaks, repeated header rows, captions, rich text, JPEG/PNG/GIF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes, radio groups, drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields, image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; doc_info reports xfa_layout. XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off) and what open-time scripts changed is noted. Missing: loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; choosing a new picture for an image field; barcodes are drawn as their text, not bars; keep rules; metrics are approximate and Acrobat fidelity is eyeballed on real forms, not measured (#60)"
 
 [[feature]]
 id = "form.xfa-formcalc"

From db1b3d065d4adab8eb14aa82ad6466a1b27046f4 Mon Sep 17 00:00:00 2001
From: storybored379 <storybored379@gmail.com>
Date: Fri, 9 Oct 2026 11:46:24 -0700
Subject: [PATCH 118/149] MCP: common command tools, session resources and
 client hints (#451)

* XFA: choice lists, signature, password, image and barcode fields; PNG and GIF pictures

The xfa crate lays out the field kinds that were left blank or shown as
text fields:

- Choice lists become combo boxes (editable with textEntry) or list
  boxes (open="always"; multi-select with open="multiSelect"), with the
  shown items and the saved values of <items save="1"> as /Opt pairs,
  /V, /I and /DV as saved values, several on separate lines in the
  data. Field::saved_value maps shown text to saved values for the
  layout and the script tree alike, so scripts read what is saved.
- Password fields are password text fields; signature fields are /Sig
  fields the app can sign.
- Image fields show the picture the data (base64) or the template
  holds; barcode fields show their value as text, with a warning that
  no bars are drawn.
- PNG and GIF pictures (fields and draws) are decoded to Flate image
  XObjects with a soft mask for transparency; JPEGs stay as they were.
  Sizes come from the headers, so layout never decodes; decoding is
  capped at 40 million pixels and failures are warnings, not errors.

Engine: multi-select list values from scripts and data are one per
line. README and parity notes updated (form.xfa-dynamic).

Hardened after an adversarial review pass: picture sizes refused from
the header past 20 million pixels or 65,535 a side, the GIF decoder
given limits (a frame far larger than its screen is refused before
allocation), template pictures read whole up to 32 MB, pictures
decoded once and remembered in the catalog by content hash so
re-layouts reuse them, data pictures that aren't images reported by
field; choice values matched against saved values first, several
values deduplicated and capped, /I ascending and unique, /DV through
the same mapping, <value> children read, the item cap reported; the
reopen path takes another viewer's choice values (several per line);
CMYK JPEGs inverted only with Adobe APP14.

* D5: README for cos and engine, and an honest cos status line

Thirteen crates have no README, although the session protocol tells every session to read the README of the crate it is touching. These are the two biggest: cos is where every hostile file lands first, and engine is the whole API surface a frontend gets.

Each states its layer and the rules that bind it, sketches the API against the real signatures, and ends with what is deliberately not done. The cos README spells out the clone-is-a-snapshot property and why both writers return bytes rather than taking a sink; the engine README spells out the four-step editing model that makes what you see what Save writes.

Also corrects the module doc on cos/src/lib.rs, which still said encryption and object-stream output for full saves were not done. Both shipped: security.rs handles R2-R6 with crypt filters and /EFF, and SaveOptions::object_streams defaults to true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Preserve alternate appearances and indirect push-button values

Keep rollover, down and custom appearance entries when normal appearances are regenerated, without modifying shared dictionaries. Resolve indirect button caption and layout values. Cover full and incremental saved output, and wait for raster readiness in the existing Linux scroll test.

Co-authored-by: Codex <codex@openai.com>

* M13: common MCP tools through the confined automation path

Preserve task tools and compact mode, add complete hints and strict argument-key errors, and catch escaped tool panics.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* M13: session resources and version-aware MCP result hints

Keep per-document resources and legacy response shapes; add document/command resources and private cache hints for modern clients.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* M7: select and edit grouped Form XObject figures

Co-Authored-By: Codex <noreply@openai.com>

* M14: let neutral Windows locales fall through to display language

Co-authored-by: Codex <codex@openai.com>

* pdfcraft-cli --help lists `mcp` only when the build has it

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* engine README: the execution plan is local-only, so don't link a path that doesn't exist

* Merge land/450 into land/414; XFA pictures are found again by a SHA-256 on their XObject

The image cache was a /PCXfaImages map in the catalog, keyed by DefaultHasher
(not stable across Rust releases) and read back from the file. Each image
XObject now records the SHA-256 of its picture's bytes, and a re-layout finds
the XObjects on the pages it replaces by that hash; nothing goes in the catalog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Merge land/414 into land/451; keep main's MCP protocol versions, cap command_batch at 1000 steps

The 2026-07-28 revision and its resultType/ttlMs/cacheScope fields are dropped:
main doesn't advertise them and they couldn't be checked against the spec.
command_batch refuses more than 1000 steps. docs/mcp.md says that unknown
argument keys are now refused with -32602 (a behaviour change for clients that
sent extra keys).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Yuvraj Singh <singh.yuvraj31@icloud.com>
Co-authored-by: Tanish Manku <tmanku.dev@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: storybored379 <storybored379@users.noreply.github.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>
Co-authored-by: Flowershangfromthebranches <152056395+Flowershangfromthebranches@users.noreply.github.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                             |   4 +
 apps/pdfcraft-cli/tests/mcp_compact.rs |   2 +-
 crates/automation/README.md            |  28 +++-
 crates/automation/src/conventions.rs   | 124 +++++++++++++++
 crates/automation/src/lib.rs           |  16 ++
 crates/automation/src/mcp.rs           |  93 +++++++++--
 crates/automation/src/tools.rs         |  10 +-
 crates/automation/tests/automation.rs  | 117 ++++++++++++--
 crates/forms/src/tests.rs              | 206 +++++++++++++++++++++++++
 docs/mcp.md                            |  45 ++++++
 parity/acrobat-features.toml           |   6 +-
 11 files changed, 627 insertions(+), 24 deletions(-)
 create mode 100644 crates/automation/src/conventions.rs
 create mode 100644 docs/mcp.md

diff --git a/ROADMAP.md b/ROADMAP.md
index 720f829e..72e582c2 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -148,6 +148,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
@@ -301,3 +303,5 @@ Newest first. One line per session: the date, what moved, and the new overall pe
   - Robustness sweep (963 of 983 files open, 0 crashes), text layer, find and select, tiles, web build, polish.
   - Overall ≈ 3–4%.
 - **2026-09-30 (session 1):** planning complete; viewer vertical slice.
+
+- M13: common command, batch, inspection and bounded preview tools share the existing confined automation path. MCP tools carry complete hints and reject unknown top-level keys as invalid parameters.
diff --git a/apps/pdfcraft-cli/tests/mcp_compact.rs b/apps/pdfcraft-cli/tests/mcp_compact.rs
index 8c12152a..48692068 100644
--- a/apps/pdfcraft-cli/tests/mcp_compact.rs
+++ b/apps/pdfcraft-cli/tests/mcp_compact.rs
@@ -41,7 +41,7 @@ fn listed_tools(flags: &[&str]) -> Vec<String> {
 fn compact_flag_shortens_the_tool_list() {
     let full = listed_tools(&[]);
     let compact = listed_tools(&["--compact"]);
-    assert_eq!(compact.len(), 12, "{compact:?}");
+    assert_eq!(compact.len(), 17, "{compact:?}");
     assert!(compact.iter().any(|n| n == "tool_search") && compact.iter().any(|n| n == "tool_call"));
     assert!(compact.iter().all(|n| full.contains(n) || n == "tool_search" || n == "tool_call"));
     assert!(full.len() > 100 && !full.iter().any(|n| n == "tool_search"), "{} tools", full.len());
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 29e9eb9e..3e220b67 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -32,7 +32,7 @@ mcp::McpServer::new(a).serve(stdin, stdout)?             // newline-delimited JS
 
 **Opt-in only.** Nothing starts it automatically, and it opens no port. It runs while `pdfcraft-cli mcp [--root DIR]` runs, normally launched by an agent from its MCP configuration. It stops when stdin closes. The CLI's `mcp` Cargo feature (on by default) compiles it out entirely when disabled.
 
-`pdfcraft-cli mcp --compact` (or `McpServer::with_compact(true)`) keeps `tools/list` short for agents with small context budgets. It lists only the core tools (`mcp::COMPACT_CORE_TOOLS`: open, info, save, close, render, text extract and find, combine, split, undo) plus two meta tools: `tool_search` (optional `query` and `category`, the name prefix; or `name` for one tool's full `input_schema`) and `tool_call` (`name` and `arguments`, run through the same `Automation::call`). `tools/call` by name keeps working for every tool, and the server instructions mention the meta tools. Without the flag nothing changes.
+`pdfcraft-cli mcp --compact` (or `McpServer::with_compact(true)`) keeps `tools/list` short for agents with small context budgets. It lists only the core tools (`mcp::COMPACT_CORE_TOOLS`: open, info, save, close, render, text extract and find, combine, split, undo) plus the common command/inspection/preview tools and two meta tools: `tool_search` (optional `query` and `category`, the name prefix; or `name` for one tool's full `input_schema`) and `tool_call` (`name` and `arguments`, run through the same `Automation::call`). `tools/call` by name keeps working for every tool, and the server instructions mention the meta tools. Without the flag nothing changes.
 
 Implemented: `initialize` (protocol 2025-06-18, 2025-03-26, 2024-11-05), `ping`, `tools/list` (with `readOnlyHint`/`destructiveHint` annotations), `tools/call` (JSON results also returned as `structuredContent`; images as `image/png`), and `resources/list`, `resources/templates/list` and `resources/read`. The resources expose the open documents read-only: `pdfcraft://doc/{doc}/info` (JSON), `…/text`, `…/page/{page}/text` and `…/page/{page}/image{?dpi}` (PNG, 1–600 dpi). Tool failures come back as `isError: true` results, so the agent can read and recover from them.
 
@@ -42,3 +42,29 @@ Implemented: `initialize` (protocol 2025-06-18, 2025-03-26, 2024-11-05), `ping`,
 2. Add a `ToolDef` in `src/tools.rs`: a precise description, the schema, `ro()`/`destructive()`, and `cmd()` if a registry command exists.
 3. Handle it in `Automation::call`, validating pages and positions with the existing helpers.
 4. Add an end-to-end test in `tests/automation.rs`. `tool_table_is_well_formed` checks names, schemas and command links.
+
+
+## Common command tools
+
+Following FilmCraft's MCP conventions, `command_list {doc?, filter?, enabled_only?}` keeps its
+`{commands: [...]}` result and adds each mapped tool's parameter schema. `command_run {id, params?}`
+runs that command through its existing headless tool: include `doc` and other tool arguments in
+`params`. Commands without a headless mapping return a tool error. Unknown parameter keys are
+ignored with a `warnings` array; required values and paths still go through the original validation.
+
+`command_batch {steps: [{id, params?}], stop_on_error?}` returns `completed`, `failed`, and per-step
+`{ok, result?, error?}` entries. The default is to stop at the first error; earlier edits remain.
+MCP marks a batch with any failed steps as `isError`, including through compact `tool_call`.
+`doc_inspect {doc?}` returns one document's info, or `{documents: [...]}` for all open documents.
+`render_preview {doc?, page?, max_side?}` returns a PNG (page defaults to 1, maximum side defaults
+to 1024, allowed 1–4096). Omit `doc` only when exactly one document is open.
+
+All task tools remain available; compact mode includes the five common tools. Every MCP tool has
+all four annotation hints. Unknown top-level argument keys return JSON-RPC `-32602` with the
+accepted keys; failures in the invoked tool remain `isError` results. An escaped tool panic is
+reported as an internal tool error, and the server continues serving.
+
+Exports complete synchronously. `progressToken` and cancellation notifications are harmlessly
+ignored; no background-job or cancellation behavior is added.
+
+Session resources `pdfcraft://document` and `pdfcraft://commands`, and the refusal of unknown argument keys, are described in [docs/mcp.md](../../docs/mcp.md).
diff --git a/crates/automation/src/conventions.rs b/crates/automation/src/conventions.rs
new file mode 100644
index 00000000..62153082
--- /dev/null
+++ b/crates/automation/src/conventions.rs
@@ -0,0 +1,124 @@
+//! Shared command/inspection/preview entry points, using the existing confined tool path.
+use serde_json::{Value, json};
+
+use crate::{Args, Automation, Content, Result, ToolError, encode_png, failed, info, tools};
+use pdfcraft_render::{RenderRequest, RequestKind};
+
+/// The most steps one `command_batch` runs.
+pub(crate) const MAX_BATCH_STEPS: usize = 1000;
+
+impl Automation {
+    pub(crate) fn command_run(&mut self, args: &Args) -> Result<Vec<Content>> {
+        let id = args.str("id")?;
+        let tool = tools::tool_for_command(id).ok_or_else(|| failed(format!("command {id:?} has no headless tool; see command_list")))?;
+        let def = tools::find(tool).ok_or_else(|| failed("command tool is unavailable"))?;
+        let mut params = match args.get("params") {
+            None | Some(Value::Null) => serde_json::Map::new(),
+            Some(Value::Object(params)) => params.clone(),
+            Some(_) => return Err(ToolError::InvalidArgs("params must be an object".into())),
+        };
+        let props = def.input_schema.get("properties").and_then(Value::as_object).ok_or_else(|| failed("tool has no parameter schema"))?;
+        let accepted = props.keys().map(String::as_str).collect::<Vec<_>>().join(", ");
+        let mut warnings = Vec::new();
+        params.retain(|key, _| {
+            if props.contains_key(key) {
+                return true;
+            }
+            warnings.push(format!("unknown param {key:?} for {id} (accepted: {accepted})"));
+            false
+        });
+        // This preserves the task tool's validation, atomic writes and --root confinement.
+        let mut content = self.call(tool, &Value::Object(params))?;
+        if !warnings.is_empty() {
+            if let Some(object) = content.iter_mut().find_map(|c| match c {
+                Content::Json(v) => v.as_object_mut(),
+                _ => None,
+            }) {
+                let mut all = match object.remove("warnings") {
+                    Some(Value::Array(old)) => old,
+                    Some(old) => vec![old],
+                    None => Vec::new(),
+                };
+                all.extend(warnings.into_iter().map(Value::String));
+                object.insert("warnings".into(), Value::Array(all));
+            } else {
+                content.push(Content::Json(json!({"warnings":warnings})));
+            }
+        }
+        Ok(content)
+    }
+
+    pub(crate) fn command_batch(&mut self, args: &Args) -> Result<Value> {
+        let steps = args.get("steps").and_then(Value::as_array).ok_or_else(|| ToolError::InvalidArgs("steps must be an array".into()))?;
+        if steps.len() > MAX_BATCH_STEPS {
+            return Err(ToolError::InvalidArgs(format!("a batch has at most {MAX_BATCH_STEPS} steps ({} given); split it", steps.len())));
+        }
+        // Check every envelope before applying any edit.
+        for step in steps {
+            let a = Args(step);
+            a.str("id")?;
+            if a.get("params").is_some_and(|p| !p.is_object() && !p.is_null()) {
+                return Err(ToolError::InvalidArgs("step params must be an object".into()));
+            }
+        }
+        let stop = args.opt_bool("stop_on_error")?.unwrap_or(true);
+        let (mut completed, mut failed, mut results) = (0usize, 0usize, Vec::new());
+        for step in steps {
+            match self.command_run(&Args(step)) {
+                Ok(content) => {
+                    completed += 1;
+                    let result = content.into_iter().find_map(|c| match c {
+                        Content::Json(v) => Some(v),
+                        _ => None,
+                    });
+                    results.push(json!({"ok":true,"result":result}));
+                }
+                Err(e) => {
+                    failed += 1;
+                    results.push(json!({"ok":false,"error":e.to_string()}));
+                    if stop {
+                        break;
+                    }
+                }
+            }
+        }
+        Ok(json!({"completed":completed,"failed":failed,"results":results}))
+    }
+
+    pub(crate) fn doc_inspect(&self, args: &Args) -> Result<Value> {
+        if args.opt_int("doc")?.is_some() {
+            return Ok(info(self.doc(args)?));
+        }
+        Ok(json!({"documents":self.session.docs().iter().map(info).collect::<Vec<_>>()}))
+    }
+
+    pub(crate) fn render_preview(&mut self, args: &Args) -> Result<Content> {
+        let id = if args.opt_int("doc")?.is_some() {
+            self.doc(args)?.id
+        } else {
+            match self.session.docs() {
+                [doc] => doc.id,
+                _ => return Err(failed("give doc from doc_list (a single open document is selected automatically)")),
+            }
+        };
+        let page = args.opt_int("page")?.unwrap_or(1);
+        let max = args.opt_int("max_side")?.unwrap_or(1024);
+        if !(1..=4096).contains(&max) {
+            return Err(ToolError::InvalidArgs("max_side must be between 1 and 4096".into()));
+        }
+        let page = usize::try_from(page).ok().and_then(|p| p.checked_sub(1)).ok_or_else(|| failed("page must be at least 1"))?;
+        let doc = self.session.get(id).ok_or_else(|| failed("no such document"))?;
+        let size = doc.info.pages.get(page).ok_or_else(|| failed("page is out of range"))?;
+        let side = size.width.max(size.height);
+        if !side.is_finite() || side <= 0.0 {
+            return Err(failed("page has invalid dimensions"));
+        }
+        let scale = (max as f32 / side).min(1.0);
+        let out = self.renderer(id)?.render(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag: 0 });
+        if let Some(error) = out.error {
+            return Err(failed(error));
+        }
+        let data = encode_png(out.width, out.height, &out.rgba)?;
+        Ok(Content::Png { data, width: out.width, height: out.height })
+    }
+}
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index ddb78956..93fecaa3 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -14,6 +14,7 @@
 mod a11y;
 mod comments;
 mod content;
+mod conventions;
 mod forms;
 mod links;
 #[cfg(feature = "mcp")]
@@ -215,6 +216,10 @@ impl Automation {
                 json!({ "redone": label, "document": summary(self.doc(&a)?) })
             }
             "command_list" => self.command_list(&a)?,
+            "command_run" => return self.command_run(&a),
+            "command_batch" => self.command_batch(&a)?,
+            "doc_inspect" => self.doc_inspect(&a)?,
+            "render_preview" => return self.render_preview(&a).map(|c| vec![c]),
             "page_number" => {
                 use pdfcraft_organize::LabelStyle as L;
                 let n = self.doc(&a)?.info.pages.len();
@@ -1439,6 +1444,8 @@ impl Automation {
             Some(_) => Some(self.doc(a)?.id),
             None => None,
         };
+        let filter = a.opt_str("filter")?.unwrap_or("").to_lowercase();
+        let enabled_only = a.opt_bool("enabled_only")?.unwrap_or(false);
         let list: Vec<Value> = commands::COMMANDS
             .iter()
             .map(|c| {
@@ -1449,9 +1456,18 @@ impl Automation {
                     "shortcut": c.shortcut.map(|s| s.label(cfg!(target_os = "macos"))),
                     "enabled": commands::is_enabled(c, &self.session, active),
                     "tool": tools::tool_for_command(c.id),
+                    "params": tools::tool_for_command(c.id).and_then(tools::find).map(|t| &t.input_schema),
                 })
             })
             .collect();
+        let list: Vec<Value> = list
+            .into_iter()
+            .filter(|c| {
+                (!enabled_only || c.get("enabled").and_then(Value::as_bool) == Some(true))
+                    && (filter.is_empty()
+                        || ["id", "label", "menu"].iter().any(|k| c.get(k).is_some_and(|v| v.to_string().to_lowercase().contains(&filter))))
+            })
+            .collect();
         Ok(json!({ "commands": list }))
     }
 
diff --git a/crates/automation/src/mcp.rs b/crates/automation/src/mcp.rs
index 14519093..d114ea6d 100644
--- a/crates/automation/src/mcp.rs
+++ b/crates/automation/src/mcp.rs
@@ -29,15 +29,32 @@ const INVALID_PARAMS: i64 = -32602;
 const INSTRUCTIONS: &str = "PdfCraft edits PDFs. Open a file with doc_open to get a document id, then inspect \
 (doc_info, text_extract, text_find, page_render) or edit it (page_*, doc_set_info). Edits are undoable \
 (edit_undo) and stay in memory until doc_save. Page numbers are 1-based. Open documents are also \
-resources: pdfcraft://doc/{doc}/info, /text, /page/{page}/text and /page/{page}/image.";
+resources: pdfcraft://doc/{doc}/info, /text, /page/{page}/text and /page/{page}/image. \
+command_list discovers command ids and tool schemas; command_run executes one, command_batch runs several. \
+doc_inspect returns open document state; render_preview returns a bounded PNG.";
 
 /// Appended to the instructions in compact mode.
 const COMPACT_INSTRUCTIONS: &str = " Only a core set of tools is listed. Every other tool is still available: find it with \
 tool_search (optional query and category, or name for its full input schema) and run it with tool_call.";
 
 /// The tools `tools/list` returns in compact mode, besides the two meta tools.
-pub const COMPACT_CORE_TOOLS: &[&str] =
-    &["doc_open", "doc_info", "doc_save", "doc_close", "page_render", "text_extract", "text_find", "doc_combine", "doc_split", "edit_undo"];
+pub const COMPACT_CORE_TOOLS: &[&str] = &[
+    "doc_open",
+    "doc_info",
+    "doc_save",
+    "doc_close",
+    "page_render",
+    "text_extract",
+    "text_find",
+    "doc_combine",
+    "doc_split",
+    "edit_undo",
+    "command_list",
+    "command_run",
+    "command_batch",
+    "doc_inspect",
+    "render_preview",
+];
 
 /// Meta tools that exist only in compact mode.
 const TOOL_SEARCH: &str = "tool_search";
@@ -99,7 +116,8 @@ impl McpServer {
         };
         let params = obj.get("params").cloned().unwrap_or(Value::Null);
         let id = id?; // notifications/initialized, notifications/cancelled, …: nothing to answer
-        Some(match self.dispatch(method, &params) {
+        let result = if method == "tools/call" { guarded_tool(|| self.dispatch(method, &params)) } else { self.dispatch(method, &params) };
+        Some(match result {
             Ok(result) => json!({ "jsonrpc": "2.0", "id": id, "result": result }),
             Err((code, message)) => error(id, code, &message),
         })
@@ -123,24 +141,35 @@ impl McpServer {
                 let name = params.get("name").and_then(Value::as_str).ok_or((INVALID_PARAMS, "tools/call needs a tool name".to_string()))?;
                 let args = params.get("arguments").cloned().unwrap_or(Value::Null);
                 if self.compact && name == TOOL_SEARCH {
+                    check_keys(name, &args, &["query", "category", "name"]).map_err(|e| (INVALID_PARAMS, e))?;
                     return Ok(match search_tools(&args) {
                         Ok(found) => call_result(vec![Content::Json(found)]),
                         Err(message) => tool_error(&message),
                     });
                 }
                 if self.compact && name == TOOL_CALL {
+                    check_keys(name, &args, &["name", "arguments"]).map_err(|e| (INVALID_PARAMS, e))?;
                     let (inner, inner_args) = match unwrap_tool_call(&args) {
                         Ok(pair) => pair,
                         Err(message) => return Ok(tool_error(&message)),
                     };
                     return Ok(match self.automation.call(&inner, &inner_args) {
-                        Ok(content) => call_result(content),
+                        Ok(content) => tool_content(&inner, content),
                         Err(ToolError::UnknownTool(t)) => tool_error(&format!("unknown tool {t:?}; use tool_search to find the right name")),
                         Err(e) => tool_error(&e.to_string()),
                     });
                 }
+                if let Some(def) = crate::tools::find(name) {
+                    let keys: Vec<&str> = def
+                        .input_schema
+                        .get("properties")
+                        .and_then(Value::as_object)
+                        .map(|p| p.keys().map(String::as_str).collect())
+                        .unwrap_or_default();
+                    check_keys(name, &args, &keys).map_err(|e| (INVALID_PARAMS, e))?;
+                }
                 match self.automation.call(name, &args) {
-                    Ok(content) => Ok(call_result(content)),
+                    Ok(content) => Ok(tool_content(name, content)),
                     Err(ToolError::UnknownTool(t)) => Err((INVALID_PARAMS, format!("unknown tool {t:?}"))),
                     Err(e) => Ok(tool_error(&e.to_string())),
                 }
@@ -188,7 +217,7 @@ fn meta_tools() -> [Value; 2] {
                 "required": [],
                 "additionalProperties": false,
             },
-            "annotations": { "title": "Find PdfCraft tools", "readOnlyHint": true, "destructiveHint": false, "openWorldHint": false },
+            "annotations": { "title": "Find PdfCraft tools", "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false },
         }),
         json!({
             "name": TOOL_CALL,
@@ -204,7 +233,7 @@ fn meta_tools() -> [Value; 2] {
                 "required": ["name"],
                 "additionalProperties": false,
             },
-            "annotations": { "title": "Run any PdfCraft tool", "readOnlyHint": false, "destructiveHint": true, "openWorldHint": false },
+            "annotations": { "title": "Run any PdfCraft tool", "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": false },
         }),
     ]
 }
@@ -294,6 +323,24 @@ fn unwrap_tool_call(args: &Value) -> Result<(String, Value), String> {
     Ok((name.to_owned(), inner))
 }
 
+/// Last-resort boundary shared by every tools/call route, including compact dispatch.
+fn guarded_tool(f: impl FnOnce() -> Result<Value, (i64, String)>) -> Result<Value, (i64, String)> {
+    pdfcraft_engine::guard(f).unwrap_or_else(|message| Ok(tool_error(&format!("internal error: {message}"))))
+}
+
+fn tool_content(name: &str, content: Vec<Content>) -> Value {
+    let failed = name == "command_batch"
+        && content.iter().any(|c| match c {
+            Content::Json(v) => v.get("failed").and_then(Value::as_u64).is_some_and(|n| n > 0),
+            _ => false,
+        });
+    let mut result = call_result(content);
+    if let Some(object) = result.as_object_mut() {
+        object.insert("isError".into(), json!(failed));
+    }
+    result
+}
+
 /// A failed tool call, as the agent should read it.
 fn tool_error(message: &str) -> Value {
     json!({ "content": [{ "type": "text", "text": message }], "isError": true })
@@ -357,10 +404,29 @@ impl McpServer {
                 }
             }
         }
+        out.extend([
+            json!({"uri":"pdfcraft://document","name":"Open documents","mimeType":"application/json","description":"Session document state, as doc_inspect without arguments."}),
+            json!({"uri":"pdfcraft://commands","name":"Command catalog","mimeType":"application/json","description":"Commands and mapped tool schemas, as command_list without arguments."}),
+        ]);
         out
     }
 
     fn read_resource(&mut self, uri: &str) -> Result<Value, (i64, String)> {
+        if let Some(tool) = match uri {
+            "pdfcraft://document" => Some("doc_inspect"),
+            "pdfcraft://commands" => Some("command_list"),
+            _ => None,
+        } {
+            let content = self.automation.call(tool, &json!({})).map_err(|e| (INVALID_PARAMS, e.to_string()))?;
+            let value = content
+                .into_iter()
+                .find_map(|c| match c {
+                    Content::Json(v) => Some(v),
+                    _ => None,
+                })
+                .ok_or((INVALID_PARAMS, "resource returned no JSON".into()))?;
+            return Ok(json!({"uri":uri,"mimeType":"application/json","text":value.to_string()}));
+        }
         let r = parse_uri(uri).ok_or((INVALID_PARAMS, format!("unknown resource {uri:?}")))?;
         let call = |a: &mut Automation, tool: &str, args: Value| a.call(tool, &args).map_err(|e| (INVALID_PARAMS, e.to_string()));
         let json_of = |c: Vec<Content>| c.into_iter().find_map(|c| if let Content::Json(v) = c { Some(v) } else { None }).unwrap_or(Value::Null);
@@ -413,7 +479,7 @@ fn tool_json(t: &crate::ToolDef) -> Value {
         "title": t.title,
         "description": t.description,
         "inputSchema": t.input_schema,
-        "annotations": { "title": t.title, "readOnlyHint": t.read_only, "destructiveHint": t.destructive, "openWorldHint": false },
+        "annotations": { "title": t.title, "readOnlyHint": t.read_only, "destructiveHint": t.destructive, "idempotentHint": t.read_only || matches!(t.name, "doc_save" | "doc_optimize" | "doc_export_data" | "measure_export" | "doc_export_images" | "doc_export_office" | "doc_export_all_images" | "doc_export_text" | "image_save"), "openWorldHint": false },
     })
 }
 
@@ -445,6 +511,15 @@ fn call_result(content: Vec<Content>) -> Value {
 mod tests {
     use super::{Resource, first_sentence, parse_uri};
 
+    #[test]
+    fn conventions_panic_is_a_tool_error() {
+        let r = super::guarded_tool(|| panic!("synthetic tool failure")).unwrap();
+        assert_eq!(r["isError"], true);
+        assert!(r["content"][0]["text"].as_str().unwrap().contains("synthetic tool failure"));
+        let next = super::guarded_tool(|| Ok(serde_json::json!({"ok":true}))).unwrap();
+        assert_eq!(next["ok"], true);
+    }
+
     #[test]
     fn first_sentence_skips_abbreviations() {
         assert_eq!(first_sentence("Rotate pages. Undoable."), "Rotate pages.");
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 14d7dcf4..8eb2fa03 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1064,7 +1064,15 @@ pub fn tools() -> Vec<ToolDef> {
         t("edit_redo", "Redo", "Redo the last undone edit of a document.").cmd("edit.redo").with(schema(json!({ "doc": doc() }), &["doc"])),
         t("command_list", "List commands", "Every registered PdfCraft command with its menu, shortcut, whether it is enabled now, and the tool that automates it.")
             .ro()
-            .with(schema(json!({ "doc": doc() }), &[])),
+            .with(schema(json!({ "doc": doc(), "filter":{"type":"string"}, "enabled_only":{"type":"boolean"} }), &[])),
+        t("command_run", "Run a command", "Run a registry command through its headless tool. Pass that tool's arguments in params (see command_list). Unknown params are ignored with warnings; path confinement still applies.")
+            .destructive().with(schema(json!({"id":{"type":"string"},"params":{"type":"object"}}), &["id"])),
+        t("command_batch", "Run several commands", "Run steps in order (at most 1000). Returns completed/failed counts and per-step ok/result/error; stop_on_error defaults to true.")
+            .destructive().with(schema(json!({"steps":{"type":"array","items":schema(json!({"id":{"type":"string"},"params":{"type":"object"}}), &["id"])},"stop_on_error":{"type":"boolean"}}), &["steps"])),
+        t("doc_inspect", "Inspect open documents", "With doc, return doc_info; otherwise return information for every open document (empty documents array when none are open).")
+            .ro().with(schema(json!({"doc":doc()}), &[])),
+        t("render_preview", "Render a preview", "Render a PNG bounded by max_side (default 1024), without changing or saving the document. Page defaults to 1; doc may be omitted when exactly one document is open.")
+            .ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},"max_side":{"type":"integer","minimum":1,"maximum":4096}}), &[])),
     ]
 }
 
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index a900d303..582e7a47 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -570,11 +570,11 @@ fn mcp_resources_expose_open_documents() {
     let dir = workdir("mcp-resources");
     let mut s = McpServer::new(auto(&dir));
     assert!(rpc(&mut s, 1, "initialize", json!({}))["result"]["capabilities"]["resources"].is_object());
-    assert_eq!(rpc(&mut s, 2, "resources/list", json!({}))["result"]["resources"], json!([]));
+    assert_eq!(rpc(&mut s, 2, "resources/list", json!({}))["result"]["resources"].as_array().unwrap().len(), 2);
     assert_eq!(rpc(&mut s, 3, "resources/templates/list", json!({}))["result"]["resourceTemplates"].as_array().unwrap().len(), 4);
     rpc(&mut s, 4, "tools/call", json!({ "name": "doc_open", "arguments": { "path": "a.pdf" } }));
     let list = rpc(&mut s, 5, "resources/list", json!({}))["result"]["resources"].as_array().cloned().unwrap();
-    assert_eq!(list.len(), 2 + 3, "info, text and three page images");
+    assert_eq!(list.len(), 2 + 3 + 2, "info, text, three page images and two session resources");
     assert_eq!(list[0]["uri"], "pdfcraft://doc/1/info");
     let read = |s: &mut McpServer, uri: &str| rpc(s, 6, "resources/read", json!({ "uri": uri }))["result"]["contents"][0].clone();
     let text = read(&mut s, "pdfcraft://doc/1/text");
@@ -636,7 +636,7 @@ fn mcp_compact_lists_the_core_tools_and_two_meta_tools() {
     let core_open = list["result"]["tools"][0].clone();
     assert_eq!(Some(&core_open), full["result"]["tools"].as_array().unwrap().iter().find(|t| t["name"] == "doc_open"));
     assert!(list.to_string().len() * 5 < full.to_string().len(), "compact {} vs full {}", list.to_string().len(), full.to_string().len());
-    for meta in &list["result"]["tools"].as_array().unwrap()[10..] {
+    for meta in &list["result"]["tools"].as_array().unwrap()[pdfcraft_automation::mcp::COMPACT_CORE_TOOLS.len()..] {
         assert_eq!(meta["inputSchema"]["type"], "object");
     }
     let instructions = rpc(&mut s, 3, "initialize", json!({}))["result"]["instructions"].as_str().unwrap().to_string();
@@ -795,28 +795,28 @@ fn mcp_compact_meta_tools_reject_unknown_arguments() {
     let dir = workdir("mcp-compact-keys");
     let mut s = compact_server(&dir);
     let list = rpc(&mut s, 1, "tools/list", json!({}));
-    let metas = &list["result"]["tools"].as_array().unwrap()[10..];
+    let metas = &list["result"]["tools"].as_array().unwrap()[pdfcraft_automation::mcp::COMPACT_CORE_TOOLS.len()..];
     assert_eq!(metas.len(), 2);
     for meta in metas {
         assert_eq!(meta["inputSchema"]["additionalProperties"], false, "{}", meta["name"]);
     }
-    let text = |r: &Value| r["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+    let text = |r: &Value| r["error"]["message"].as_str().or_else(|| r["result"]["content"][0]["text"].as_str()).unwrap_or_default().to_string();
 
     // A misspelled filter is an error, not an unfiltered listing.
     let typo = rpc(&mut s, 2, "tools/call", json!({ "name": "tool_search", "arguments": { "qurey": "rotate" } }));
-    assert_eq!(typo["result"]["isError"], true, "{typo}");
+    assert_eq!(typo["error"]["code"], -32602, "{typo}");
     assert!(text(&typo).contains("\"qurey\"") && text(&typo).contains("query"), "{}", text(&typo));
     let extra = rpc(&mut s, 3, "tools/call", json!({ "name": "tool_search", "arguments": { "query": "rotate", "extra": 1 } }));
-    assert_eq!(extra["result"]["isError"], true, "{extra}");
+    assert_eq!(extra["error"]["code"], -32602, "{extra}");
     assert!(text(&extra).contains("\"extra\""), "{}", text(&extra));
 
     // tool_call rejects extra outer keys before running anything.
     let misspelled =
         rpc(&mut s, 4, "tools/call", json!({ "name": "tool_call", "arguments": { "name": "doc_open", "argumentz": { "path": "a.pdf" } } }));
-    assert_eq!(misspelled["result"]["isError"], true, "{misspelled}");
+    assert_eq!(misspelled["error"]["code"], -32602, "{misspelled}");
     assert!(text(&misspelled).contains("\"argumentz\""), "{}", text(&misspelled));
     let extra = rpc(&mut s, 5, "tools/call", json!({ "name": "tool_call", "arguments": { "name": "doc_list", "unexpected": "value" } }));
-    assert_eq!(extra["result"]["isError"], true, "{extra}");
+    assert_eq!(extra["error"]["code"], -32602, "{extra}");
     assert!(text(&extra).contains("\"unexpected\""), "{}", text(&extra));
     assert_eq!(rpc(&mut s, 6, "tools/call", json!({ "name": "doc_list", "arguments": {} }))["result"]["structuredContent"]["documents"], json!([]));
 
@@ -3279,3 +3279,102 @@ mod combine_argument_tests {
         }
     }
 }
+
+#[cfg(feature = "mcp")]
+#[test]
+fn conventions_core_tools_preserve_root_and_batch_errors() {
+    let dir = workdir("conventions-core");
+    let mut s = McpServer::new(auto(&dir));
+    let run = |s: &mut McpServer, name: &str, args: Value| rpc(s, 1, "tools/call", json!({"name":name,"arguments":args}));
+    assert_eq!(run(&mut s, "doc_inspect", json!({}))["result"]["structuredContent"]["documents"], json!([]));
+    let opened = run(&mut s, "command_run", json!({"id":"file.open","params":{"path":"a.pdf"}}));
+    assert_eq!(opened["result"]["isError"], false, "{opened}");
+    let doc = opened["result"]["structuredContent"]["doc"].as_u64().unwrap();
+    let filtered = run(&mut s, "command_list", json!({"doc":doc,"filter":"rotate","enabled_only":true}));
+    let commands = filtered["result"]["structuredContent"]["commands"].as_array().unwrap();
+    assert!(!commands.is_empty());
+    assert!(commands.iter().all(|c| c["enabled"] == true));
+    assert!(commands.iter().find(|c| c["id"] == "page.rotate").unwrap()["params"].is_object());
+    for stop in [true, false] {
+        let r = run(
+            &mut s,
+            "command_batch",
+            json!({"steps":[{"id":"page.rotate","params":{"doc":doc,"degrees":90}},{"id":"no.such.command"},{"id":"page.rotate","params":{"doc":doc,"degrees":90}}],"stop_on_error":stop}),
+        );
+        assert_eq!(r["result"]["isError"], true, "{r}");
+        assert_eq!(r["result"]["structuredContent"]["completed"], if stop { 1 } else { 2 });
+        assert_eq!(r["result"]["structuredContent"]["failed"], 1);
+    }
+    let r = run(&mut s, "command_run", json!({"id":"file.save","params":{"doc":doc,"path":"../escaped.pdf"}}));
+    assert_eq!(r["result"]["isError"], true);
+    assert!(r["result"]["content"][0]["text"].as_str().unwrap().contains("outside the allowed directory"));
+    let r = run(&mut s, "command_run", json!({"id":"page.rotate","params":{"doc":doc,"degrees":90,"typo":1}}));
+    assert_eq!(r["result"]["isError"], false);
+    assert!(r["result"]["structuredContent"]["warnings"][0].as_str().unwrap().contains("typo"));
+    let before = run(&mut s, "doc_info", json!({"doc":doc}));
+    let r = run(&mut s, "render_preview", json!({"doc":doc,"page":1,"max_side":64}));
+    assert_eq!(r["result"]["isError"], false, "{r}");
+    use base64::Engine as _;
+    let png = base64::engine::general_purpose::STANDARD.decode(r["result"]["content"][0]["data"].as_str().unwrap()).unwrap();
+    let image = image::load_from_memory(&png).unwrap();
+    assert!(image.width().max(image.height()) <= 64);
+    assert_eq!(before["result"], run(&mut s, "doc_info", json!({"doc":doc}))["result"]);
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn conventions_annotations_and_strict_keys_in_both_modes() {
+    for compact in [false, true] {
+        let mut s = McpServer::new(Automation::new()).with_compact(compact);
+        let r = rpc(&mut s, 1, "tools/list", json!({}));
+        let tools = r["result"]["tools"].as_array().unwrap();
+        for name in ["command_list", "command_run", "command_batch", "doc_inspect", "render_preview"] {
+            assert!(tools.iter().any(|t| t["name"] == name), "missing {name}");
+        }
+        for tool in tools {
+            for hint in ["readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint"] {
+                assert!(tool["annotations"][hint].is_boolean(), "{}: {hint}", tool["name"]);
+            }
+            let r = rpc(&mut s, 2, "tools/call", json!({"name":tool["name"],"arguments":{"bogus_arg":1}}));
+            assert_eq!(r["error"]["code"], -32602, "{}", tool["name"]);
+            let message = r["error"]["message"].as_str().unwrap();
+            assert!(message.contains("bogus_arg") && message.contains("expected:"));
+        }
+    }
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn conventions_resources() {
+    let dir = workdir("conventions-resources");
+    let mut s = McpServer::new(auto(&dir));
+    let read = |s: &mut McpServer, uri: &str| {
+        let r = rpc(s, 1, "resources/read", json!({"uri":uri}));
+        serde_json::from_str::<Value>(r["result"]["contents"][0]["text"].as_str().expect("JSON resource")).unwrap()
+    };
+    assert_eq!(read(&mut s, "pdfcraft://document"), json!({"documents":[]}));
+    rpc(&mut s, 2, "tools/call", json!({"name":"doc_open","arguments":{"path":"a.pdf"}}));
+    let doc = rpc(&mut s, 3, "tools/call", json!({"name":"doc_inspect","arguments":{}}));
+    assert_eq!(read(&mut s, "pdfcraft://document"), doc["result"]["structuredContent"]);
+    let commands = rpc(&mut s, 4, "tools/call", json!({"name":"command_list","arguments":{}}));
+    assert_eq!(read(&mut s, "pdfcraft://commands"), commands["result"]["structuredContent"]);
+    // Responses keep the shape every supported protocol revision expects: no cache hints.
+    for (method, params) in [("tools/list", json!({})), ("resources/list", json!({})), ("resources/read", json!({"uri":"pdfcraft://document"}))] {
+        assert!(rpc(&mut s, 5, method, params)["result"].get("resultType").is_none());
+    }
+    assert_eq!(rpc(&mut s, 7, "initialize", json!({"protocolVersion":"2026-07-28"}))["result"]["protocolVersion"], "2025-06-18");
+    assert!(s.handle_line(r#"{"jsonrpc":"2.0","method":"notifications/cancelled","params":{"requestId":999}}"#).is_none());
+    assert_eq!(
+        rpc(&mut s, 9, "tools/call", json!({"name":"doc_inspect","arguments":{},"_meta":{"progressToken":"quick"}}))["result"]["isError"],
+        false
+    );
+}
+
+#[test]
+fn command_batch_refuses_more_than_a_thousand_steps() {
+    let dir = workdir("batch-cap");
+    let mut a = auto(&dir);
+    let steps: Vec<Value> = (0..1001).map(|_| json!({"id":"no.such.command"})).collect();
+    let err = a.call("command_batch", &json!({"steps": steps})).unwrap_err();
+    assert!(err.to_string().contains("at most 1000 steps"), "{err}");
+}
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index a33fb5bd..319bc3ef 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1680,3 +1680,209 @@ fn check_box_redraw_keeps_down_states_it_still_draws() {
     assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
     assert!(!d.contains(b"Gone"), "a state the box no longer draws");
 }
+
+#[test]
+fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
+    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
+    let cases = [
+        (NewField::Text { multiline: false }, true),
+        (NewField::Text { multiline: false }, false),
+        (NewField::CheckBox, false),
+        (NewField::Button { caption: "Button".into() }, false),
+        (NewField::Signature, false),
+    ];
+    for (kind, fill) in cases {
+        for indirect in [false, true] {
+            let mut doc = one_page();
+            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
+            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
+            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
+            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+            for (key, bytes) in alternates {
+                let mut d = Dict::new();
+                d.set(b"Type".to_vec(), Object::name("XObject"));
+                d.set(b"Subtype".to_vec(), Object::name("Form"));
+                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
+                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
+                entries.set(key.to_vec(), Object::Ref(r));
+            }
+            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
+            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
+            for widget in [first_widget, other_widget] {
+                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
+            }
+            let original = reopen(&doc);
+            for full in [false, true] {
+                let mut doc = original.clone();
+                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
+                let before = doc.resolve(&source);
+                if fill {
+                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
+                } else {
+                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
+                }
+                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
+                let bytes = if full {
+                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
+                } else {
+                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+                    let original = doc.bytes();
+                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+                    bytes
+                };
+                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+                let doc = Document::open(Arc::new(bytes)).unwrap();
+                let all = fields(&doc);
+                let first = field(&all, &first);
+                let other = field(&all, &other);
+                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let first_ap = first_ap.as_dict().unwrap();
+                let other_ap = other_ap.as_dict().unwrap();
+                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
+                assert_eq!(other_ap.len(), 4);
+                // The redrawn widget keeps unknown entries, but not down/rollover looks that
+                // would show its old value or caption on press or hover.
+                assert_eq!(
+                    first_ap.len(),
+                    2,
+                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
+                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
+                );
+                for (key, bytes) in alternates {
+                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
+                    let object = doc.resolve(other_ap.get(key).unwrap());
+                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
+                    assert_eq!(stream.decoded().unwrap(), bytes);
+                }
+                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                if fill {
+                    assert_eq!(first.value, ["Updated value"]);
+                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
+                    assert!(other.value.is_empty());
+                } else {
+                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
+                    assert_eq!(other.tooltip, None);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
+    fn saved(doc: &Document, full: bool) -> Document {
+        let bytes = if full {
+            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
+        } else {
+            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+            let original = doc.bytes();
+            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+            bytes
+        };
+        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+        Document::open(Arc::new(bytes)).unwrap()
+    }
+
+    for indirect_caption in [false, true] {
+        for indirect_layout in [false, true] {
+            for icon_only in [false, true] {
+                let mut doc = one_page();
+                let name =
+                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
+                        .unwrap();
+                let widget = field(&fields(&doc), &name).widgets[0].obj;
+                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
+                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
+                let layout = Object::Int(i64::from(icon_only));
+                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
+                let mut icon_dict = Dict::new();
+                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
+                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
+                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
+                let icon_bytes = b"0 0 4 2 re f\n";
+                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
+                let mut mk = Dict::new();
+                mk.set(b"CA".to_vec(), caption);
+                mk.set(b"TP".to_vec(), layout);
+                mk.set(b"I".to_vec(), Object::Ref(icon));
+                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
+                let mk = doc.add(Object::Dict(mk));
+                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
+
+                // Import the operands from a real saved file before an unrelated public edit.
+                let original = saved(&doc, true);
+                for full in [false, true] {
+                    let mut doc = original.clone();
+                    let widget = field(&fields(&doc), &name).widgets[0].obj;
+                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
+                    let original_mk = doc.resolve(&mk_before);
+                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
+                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
+                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
+                    let doc = saved(&doc, full);
+                    let f = field(&fields(&doc), &name).clone();
+                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
+                    let w = &f.widgets[0];
+                    let wd = doc.get(w.obj);
+                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
+                    let mk = mk_object.as_dict().unwrap();
+                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
+                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
+                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
+                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
+                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
+                    let appearance = ap(&doc, w);
+                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
+                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
+                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
+                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+                    let appearance_object = doc.get(n);
+                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
+                    let resource_icon =
+                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
+                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
+                    let icon_object = doc.resolve(resource_icon);
+                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
+                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
+                }
+            }
+        }
+    }
+}
+
+/// A check box's down appearances survive a redraw for the states it still draws (same names),
+/// and a down appearance for a state it no longer has is dropped rather than left stale.
+#[test]
+fn check_box_redraw_keeps_down_states_it_still_draws() {
+    let mut doc = one_page();
+    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
+    let widget = field(&fields(&doc), &name).widgets[0].obj;
+    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
+    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+    let mut down = Dict::new();
+    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Form"));
+        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
+        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
+        down.set(state.to_vec(), Object::Ref(r));
+    }
+    ap.set(b"D".to_vec(), Object::Dict(down));
+    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
+    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
+    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
+    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
+    let d = d.as_dict().unwrap();
+    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
+    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
+}
diff --git a/docs/mcp.md b/docs/mcp.md
new file mode 100644
index 00000000..5465c5b9
--- /dev/null
+++ b/docs/mcp.md
@@ -0,0 +1,45 @@
+# MCP conventions
+
+Start explicitly with `pdfcraft-cli mcp [--root DIR] [--compact]`. The server uses JSON lines on
+stdin/stdout, opens no port, and stops on EOF. `--root` confines all reads and writes, including
+commands invoked through the common tools. Logs stay on stderr.
+
+| Tool | Arguments |
+|---|---|
+| `command_list` | `doc?`, `filter?`, `enabled_only?`; returns `{commands: [...]}` with mapped tool schemas |
+| `command_run` | `id`, `params?` (the mapped task tool's arguments, including `doc` when required) |
+| `command_batch` | `steps: [{id, params?}]`, `stop_on_error?` (default true) |
+| `doc_inspect` | `doc?`; one document's info or `{documents: [...]}` for the session |
+| `render_preview` | `doc?`, `page?` (1-based, default 1), `max_side?` (1–4096, default 1024) |
+
+All existing task tools remain available. Compact mode lists these five tools alongside its
+existing core set and `tool_search` / `tool_call`. There are no legacy-name aliases. The full
+[automation guide](../crates/automation/README.md) describes the tools, resources, coordinate
+system, root confinement, and errors.
+
+```text
+command_run   {"id":"file.open","params":{"path":"input.pdf"}}
+              → {"doc":1,...}
+command_list  {"doc":1,"filter":"rotate"}
+command_run   {"id":"page.rotate","params":{"doc":1,"degrees":90}}
+render_preview {"doc":1,"page":1,"max_side":512}
+```
+
+Every tool has a title and the four MCP annotation hints. Unknown top-level argument keys return
+JSON-RPC `-32602`; command parameter keys that do not belong to the mapped task tool are ignored
+with warnings. Task failures and escaped tool panics return `isError: true`, and the server keeps
+serving. A failed batch includes per-step errors and is marked `isError: true`.
+
+Exports complete synchronously. A call's `progressToken` and cancellation notifications are
+harmlessly ignored; the server does not provide background export progress or cancellation.
+
+## Resources and protocol versions
+
+`pdfcraft://document` returns the session's document information (as `doc_inspect` without
+arguments), including an empty `documents` array before any PDF is opened. `pdfcraft://commands`
+returns the command catalog (as `command_list`). Existing per-document info, text and page-image
+resources and their templates are preserved.
+
+Unknown top-level argument keys are refused with JSON-RPC `-32602` (invalid params) instead of
+being ignored, so a misspelled argument is reported rather than silently dropped. Clients that
+sent extra keys before get an error now.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 02d60ad7..6a83d48f 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9349,8 +9349,8 @@ tier = "P0"
 milestone = "M13"
 status = "shipped"
 commands = []
-tools = []
-evidence = ["crates/automation/tests/automation.rs::mcp_session_over_stdio", "crates/automation/tests/automation.rs::mcp_errors"]
+tools = ["command_list", "command_run", "command_batch", "doc_inspect", "render_preview"]
+evidence = ["crates/automation/tests/automation.rs::mcp_session_over_stdio", "crates/automation/tests/automation.rs::mcp_errors", "crates/automation/tests/automation.rs::conventions_core_tools_preserve_root_and_batch_errors", "crates/automation/tests/automation.rs::conventions_annotations_and_strict_keys_in_both_modes"]
 notes = ""
 
 [[feature]]
@@ -9374,7 +9374,7 @@ milestone = "M13"
 status = "shipped"
 commands = []
 tools = ["doc_info", "text_extract", "page_render"]
-evidence = ["crates/automation/tests/automation.rs::mcp_resources_expose_open_documents", "crates/automation/src/mcp.rs::resource_uris_parse"]
+evidence = ["crates/automation/tests/automation.rs::mcp_resources_expose_open_documents", "crates/automation/src/mcp.rs::resource_uris_parse", "crates/automation/tests/automation.rs::conventions_resources_and_modern_results"]
 notes = "resources/list, resources/templates/list and resources/read: pdfcraft://doc/{doc}/info (JSON), /text, /page/{page}/text, /page/{page}/image?dpi= (PNG)"
 
 [[feature]]

From cecbfad0aec3dcef283e526df82726a7f5048fed Mon Sep 17 00:00:00 2001
From: Tanish Manku <tmanku.dev@gmail.com>
Date: Fri, 9 Oct 2026 11:46:42 -0700
Subject: [PATCH 119/149] D2, D3: fuzz every tool's arguments, and prove root
 confinement (#351)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* XFA: choice lists, signature, password, image and barcode fields; PNG and GIF pictures

The xfa crate lays out the field kinds that were left blank or shown as
text fields:

- Choice lists become combo boxes (editable with textEntry) or list
  boxes (open="always"; multi-select with open="multiSelect"), with the
  shown items and the saved values of <items save="1"> as /Opt pairs,
  /V, /I and /DV as saved values, several on separate lines in the
  data. Field::saved_value maps shown text to saved values for the
  layout and the script tree alike, so scripts read what is saved.
- Password fields are password text fields; signature fields are /Sig
  fields the app can sign.
- Image fields show the picture the data (base64) or the template
  holds; barcode fields show their value as text, with a warning that
  no bars are drawn.
- PNG and GIF pictures (fields and draws) are decoded to Flate image
  XObjects with a soft mask for transparency; JPEGs stay as they were.
  Sizes come from the headers, so layout never decodes; decoding is
  capped at 40 million pixels and failures are warnings, not errors.

Engine: multi-select list values from scripts and data are one per
line. README and parity notes updated (form.xfa-dynamic).

Hardened after an adversarial review pass: picture sizes refused from
the header past 20 million pixels or 65,535 a side, the GIF decoder
given limits (a frame far larger than its screen is refused before
allocation), template pictures read whole up to 32 MB, pictures
decoded once and remembered in the catalog by content hash so
re-layouts reuse them, data pictures that aren't images reported by
field; choice values matched against saved values first, several
values deduplicated and capped, /I ascending and unique, /DV through
the same mapping, <value> children read, the item cap reported; the
reopen path takes another viewer's choice values (several per line);
CMYK JPEGs inverted only with Adobe APP14.

* D5: README for cos and engine, and an honest cos status line

Thirteen crates have no README, although the session protocol tells every session to read the README of the crate it is touching. These are the two biggest: cos is where every hostile file lands first, and engine is the whole API surface a frontend gets.

Each states its layer and the rules that bind it, sketches the API against the real signatures, and ends with what is deliberately not done. The cos README spells out the clone-is-a-snapshot property and why both writers return bytes rather than taking a sink; the engine README spells out the four-step editing model that makes what you see what Save writes.

Also corrects the module doc on cos/src/lib.rs, which still said encryption and object-stream output for full saves were not done. Both shipped: security.rs handles R2-R6 with crypt filters and /EFF, and SaveOptions::object_streams defaults to true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* D2, D3: fuzz every tool's arguments, and prove root confinement

AGENTS.md §3 and §4 treat tool arguments as untrusted, but nothing fed hostile arguments to the tool table: xtask fuzz mutates PDFs only. And tools::check_args validates shape alone (object, no unknown keys, required present), not types or ranges, so a string where an integer belongs or i64::MIN where a page number belongs reaches the handler.

Two tests. The first calls every tool with a zoo of wrong types, numeric extremes, empty and 100,000-character strings, NUL and right-to-left-override names, mistyped and deeply nested containers: 19,299 calls over 132 tools, each required to return Ok or a readable ToolError rather than panic. The second is the D3 audit mechanized: every path argument is tried with .. traversal, absolute, drive and UNC paths, and a planted symbolic link, and must be refused; 451 attempts, all refused.

Reading the code says every handler resolves its own paths and that no tool dispatches another internally, so the PhotoCraft hole does not exist here. A test keeps that true as tools are added; a written finding would not.

Both were proved to fail before passing. An out-of-bounds index in page_rotate is reported as: page_rotate panicked on {"degrees":-1,"doc":1}. Disabling resolve() is reported as 82 leaks naming the tool and path, including doc_save writing through ../ and through the symbolic link.

The first draft of the confinement test did not catch a fully disabled resolve(): almost every tool failed on a non-existent document id before it ever looked at a path, and a file-listing diff cannot see a read. It now opens a real document first so handlers reach their path arguments, and asserts each call is refused rather than only diffing the filesystem.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Preserve alternate appearances and indirect push-button values

Keep rollover, down and custom appearance entries when normal appearances are regenerated, without modifying shared dictionaries. Resolve indirect button caption and layout values. Cover full and incremental saved output, and wait for raster readiness in the existing Linux scroll test.

Co-authored-by: Codex <codex@openai.com>

* M13: common MCP tools through the confined automation path

Preserve task tools and compact mode, add complete hints and strict argument-key errors, and catch escaped tool panics.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* M13: session resources and version-aware MCP result hints

Keep per-document resources and legacy response shapes; add document/command resources and private cache hints for modern clients.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* M7: select and edit grouped Form XObject figures

Co-Authored-By: Codex <noreply@openai.com>

* M14: let neutral Windows locales fall through to display language

Co-authored-by: Codex <codex@openai.com>

* pdfcraft-cli --help lists `mcp` only when the build has it

Follow-up to #540: a build without the `mcp` feature (`--no-default-features`) still listed
`pdfcraft-cli mcp` in its usage, and `pdfcraft-cli mcp` then said "unknown command".

USAGE is now put together with `concat!`, and its `mcp` lines come from a macro that is empty
without the feature. In such a build `pdfcraft-cli mcp` says the MCP server was left out instead
of calling it an unknown command.

- tests/help.rs: usage_lists_mcp_only_when_built_with_it (runs in both feature sets) and
  mcp_without_the_feature_says_it_was_left_out (without the feature)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* engine README: the execution plan is local-only, so don't link a path that doesn't exist

* Merge land/450 into land/414; XFA pictures are found again by a SHA-256 on their XObject

The image cache was a /PCXfaImages map in the catalog, keyed by DefaultHasher
(not stable across Rust releases) and read back from the file. Each image
XObject now records the SHA-256 of its picture's bytes, and a re-layout finds
the XObjects on the pages it replaces by that hash; nothing goes in the catalog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Merge land/414 into land/451; keep main's MCP protocol versions, cap command_batch at 1000 steps

The 2026-07-28 revision and its resultType/ttlMs/cacheScope fields are dropped:
main doesn't advertise them and they couldn't be checked against the spec.
command_batch refuses more than 1000 steps. docs/mcp.md says that unknown
argument keys are now refused with -32602 (a behaviour change for clients that
sent extra keys).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Merge land/451 into land/351; escape targets stay in the test's temp dir, and out/image paths are tried

Absolute escape targets are now paths under the test's own temp base instead of
/etc/passwd, C:\Windows\… and a UNC share, so a confinement bug can only touch
files the test made. String 'out' and 'image' properties (and any described as a
file path) are tried too. The backslash traversal runs only on Windows: elsewhere
it is an ordinary file name inside the root.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Yuvraj Singh <singh.yuvraj31@icloud.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: sanyamsingh001 <314051937+sanyamsingh001@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: storybored379 <storybored379@users.noreply.github.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>
Co-authored-by: Flowershangfromthebranches <152056395+Flowershangfromthebranches@users.noreply.github.com>
Co-authored-by: Streetblock <github@streetblock.de>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                              |   2 +
 crates/automation/tests/hostile_args.rs | 314 ++++++++++++++++++++++++
 crates/forms/src/tests.rs               | 206 ++++++++++++++++
 3 files changed, 522 insertions(+)
 create mode 100644 crates/automation/tests/hostile_args.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 72e582c2..15d38f94 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -150,6 +150,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/automation/tests/hostile_args.rs b/crates/automation/tests/hostile_args.rs
new file mode 100644
index 00000000..08b51b6a
--- /dev/null
+++ b/crates/automation/tests/hostile_args.rs
@@ -0,0 +1,314 @@
+//! Every tool, called with hostile arguments (D2) and with paths that try to leave `--root` (D3).
+//!
+//! AGENTS.md §3 and §4 treat tool arguments as untrusted — they are the MCP attack surface, and an
+//! agent can send any JSON at all. But `tools::check_args` only checks the *shape* of an argument
+//! object: that it is an object, that it has no unknown keys, and that the required keys are
+//! present and not null. **Types and ranges are not validated there**, so a string where an
+//! integer belongs, `i64::MIN` where a page number belongs, or a 100,000-character path all reach
+//! the handler. Each handler has to cope on its own, and nothing checked that they all did.
+//!
+//! These tests call every tool in the table with a zoo of hostile values and require two things:
+//!
+//! 1. **Nothing panics.** A panic in a tool is a crashed MCP server or CLI (AGENTS.md §4), so
+//!    every call must come back as `Ok` or as a `ToolError` the agent can read.
+//! 2. **Nothing escapes `--root`.** Every path argument is tried with `..` traversal, absolute
+//!    paths, Windows drive and UNC paths, and a planted symbolic link. The call must fail, and
+//!    afterwards nothing outside the root may have been created.
+//!
+//! The second is the mechanized form of the D3 audit. Reading the code says every handler resolves
+//! its own paths and that no tool dispatches another internally; this keeps that true as tools are
+//! added, which a written finding would not.
+
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::path::{Path, PathBuf};
+
+use pdfcraft_automation::{Automation, ToolError, tools};
+use serde_json::{Value, json};
+
+/// A fresh empty directory for one test.
+fn tmp(name: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("pdfcraft-hostile-{}-{name}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).expect("temp dir");
+    d
+}
+
+/// Values chosen to break assumptions: wrong types, the ends of the numeric ranges, strings that
+/// are empty, enormous, or full of separators and control characters, and containers that are
+/// empty, mistyped or deeply nested.
+fn zoo() -> Vec<Value> {
+    let deep = {
+        let mut v = json!(0);
+        for _ in 0..64 {
+            v = json!([v]);
+        }
+        v
+    };
+    vec![
+        Value::Null,
+        json!(true),
+        json!(false),
+        json!(0),
+        json!(-1),
+        json!(1),
+        json!(i64::MAX),
+        json!(i64::MIN),
+        json!(u64::MAX),
+        json!(0.5),
+        json!(-0.0),
+        json!(1e308),
+        json!(-1e308),
+        json!(""),
+        json!(" "),
+        json!("0"),
+        json!("-1"),
+        json!("null"),
+        json!("\0"),
+        json!("\u{202E}gnp.txe"), // right-to-left override: a name that displays reversed
+        json!("💥🙈"),
+        json!("%n%s%p"),
+        json!("a".repeat(100_000)),
+        json!("../".repeat(64)),
+        json!([]),
+        json!([null]),
+        json!([i64::MIN, i64::MAX]),
+        json!(["", "../.."]),
+        json!({}),
+        json!({ "unexpected": 1 }),
+        deep,
+    ]
+}
+
+/// Paths that must never resolve inside the root. Absolute ones point into the test's own temp
+/// `base` (the root's parent), never at real system files or network shares, so a confinement
+/// bug can only touch what the test made.
+fn escapes(base: &std::path::Path) -> Vec<String> {
+    let mut out: Vec<String> = vec![
+        "../outside.pdf".into(),
+        "../../outside.pdf".into(),
+        "../".repeat(40) + "outside.pdf",
+        "sub/../../outside.pdf".into(),
+        "./././../outside.pdf".into(),
+        base.join("outside.pdf").to_string_lossy().into_owned(),
+        base.join("new-outside.pdf").to_string_lossy().into_owned(),
+        base.join("sub").join("new-outside.pdf").to_string_lossy().into_owned(),
+        "link-out/outside.pdf".into(), // through a planted symbolic link, when the system allows one
+    ];
+    // Backslashes separate only on Windows; elsewhere this is an ordinary file name in the root.
+    if cfg!(windows) {
+        out.push(r"..\..\outside.pdf".into());
+    }
+    out
+}
+
+/// The properties of `def` whose values are paths, by name and whether they are a list.
+fn path_props(def: &pdfcraft_automation::ToolDef) -> Vec<(String, bool)> {
+    let Some(props) = def.input_schema["properties"].as_object() else { return Vec::new() };
+    props
+        .iter()
+        .filter(|(name, spec)| {
+            // `out` (an output file) and `image` (a picture to place) are paths when they are
+            // strings; `image` is an image number elsewhere, which the integer check skips.
+            let is_pathish = matches!(name.as_str(), "path" | "paths" | "folder" | "out_dir" | "file" | "out" | "image")
+                || spec["description"].as_str().is_some_and(|d| d.starts_with("A file path"));
+            // `file_page` is a page number inside a file, not a path.
+            is_pathish && spec["type"] != "integer"
+        })
+        .map(|(name, spec)| (name.clone(), spec["type"] == "array"))
+        .collect()
+}
+
+/// An arguments object giving every required property a plausible value, so a hostile value for
+/// one property is not masked by a "missing argument" error for another.
+///
+/// `doc` gets a **real** open document when one is given. Without that, almost every tool fails at
+/// `self.doc()` before it ever looks at a path, and a confinement test would pass vacuously — as
+/// an earlier version of this file did, even with `resolve` disabled entirely.
+fn plausible_with(def: &pdfcraft_automation::ToolDef, doc: Option<u64>) -> serde_json::Map<String, Value> {
+    let mut obj = plausible(def);
+    if let Some(id) = doc
+        && def.input_schema["properties"].as_object().is_some_and(|p| p.contains_key("doc"))
+    {
+        obj.insert("doc".into(), json!(id));
+    }
+    obj
+}
+
+fn plausible(def: &pdfcraft_automation::ToolDef) -> serde_json::Map<String, Value> {
+    let mut obj = serde_json::Map::new();
+    let props = def.input_schema["properties"].as_object().cloned().unwrap_or_default();
+    for req in def.input_schema["required"].as_array().into_iter().flatten().filter_map(Value::as_str) {
+        let spec = props.get(req).cloned().unwrap_or(Value::Null);
+        let value = match spec["type"].as_str() {
+            Some("integer") => json!(1),
+            Some("number") => json!(1.0),
+            Some("boolean") => json!(false),
+            Some("array") => json!([]),
+            Some("object") => json!({}),
+            _ => json!("in.pdf"),
+        };
+        obj.insert(req.to_string(), value);
+    }
+    obj
+}
+
+/// Run `call`, turning a panic into a message instead of unwinding out of the test.
+fn guarded(a: &mut Automation, tool: &str, args: &Value) -> std::result::Result<(), String> {
+    let result = catch_unwind(AssertUnwindSafe(|| a.call(tool, args)));
+    match result {
+        Ok(Ok(_)) => Ok(()),
+        // Any ToolError is a good outcome: the agent is told what was wrong.
+        Ok(Err(ToolError::UnknownTool(_) | ToolError::InvalidArgs(_) | ToolError::Failed(_))) => Ok(()),
+        Err(panic) => {
+            let what = panic
+                .downcast_ref::<&str>()
+                .map(|s| (*s).to_string())
+                .or_else(|| panic.downcast_ref::<String>().cloned())
+                .unwrap_or_else(|| "panic".into());
+            Err(format!("{tool} panicked on {args}: {what}"))
+        }
+    }
+}
+
+#[test]
+fn no_tool_panics_on_hostile_arguments() {
+    let root = tmp("args");
+    let mut a = Automation::new().with_root(&root).expect("root");
+    let values = zoo();
+    let mut failures = Vec::new();
+    let mut calls = 0usize;
+
+    for def in tools() {
+        // The whole arguments object, not just its properties.
+        for bad in [json!(null), json!([]), json!("string"), json!(7), json!(true), json!({})] {
+            calls += 1;
+            if let Err(e) = guarded(&mut a, def.name, &bad) {
+                failures.push(e);
+            }
+        }
+        let props: Vec<String> = def.input_schema["properties"].as_object().map(|p| p.keys().cloned().collect()).unwrap_or_default();
+        for prop in &props {
+            for value in &values {
+                let mut obj = plausible(&def);
+                obj.insert(prop.clone(), value.clone());
+                calls += 1;
+                if let Err(e) = guarded(&mut a, def.name, &Value::Object(obj)) {
+                    failures.push(e);
+                }
+            }
+        }
+    }
+
+    eprintln!("hostile arguments: {calls} calls over {} tools, {} panics", tools().len(), failures.len());
+    for f in failures.iter().take(20) {
+        eprintln!("  {f}");
+    }
+    let _ = std::fs::remove_dir_all(&root);
+    assert!(failures.is_empty(), "{} tool call(s) panicked; the first is: {}", failures.len(), failures.first().map_or("", String::as_str));
+}
+
+#[test]
+fn no_tool_escapes_the_root() {
+    let base = tmp("escape");
+    let root = base.join("root");
+    std::fs::create_dir_all(&root).expect("root");
+    // What a traversal would reach, and the state we require to be unchanged afterwards.
+    let outside = base.join("outside.pdf");
+    std::fs::write(
+        &outside,
+        b"%PDF-1.7
+% not yours
+",
+    )
+    .expect("outside file");
+    let before = listing(&base);
+
+    // A link inside the root pointing out of it, where the system allows one to be made.
+    #[cfg(unix)]
+    let _ = std::os::unix::fs::symlink(&base, root.join("link-out"));
+    #[cfg(windows)]
+    let _ = std::os::windows::fs::symlink_dir(&base, root.join("link-out"));
+
+    let mut a = Automation::new().with_root(&root).expect("root");
+
+    // A real document, so tools reach their path arguments instead of failing on `doc` first.
+    let created = a.call("doc_create", &json!({ "from": "blank", "pages": 1 })).expect("create a blank document");
+    let doc = created
+        .into_iter()
+        .find_map(|c| match c {
+            pdfcraft_automation::Content::Json(v) => v["doc"].as_u64(),
+            pdfcraft_automation::Content::Png { .. } => None,
+        })
+        .expect("the new document has an id");
+
+    let mut leaked = Vec::new();
+    let mut tried = 0usize;
+    let mut refused = 0usize;
+
+    for def in tools() {
+        for (prop, is_list) in path_props(&def) {
+            for escape in escapes(&base) {
+                let mut obj = plausible_with(&def, Some(doc));
+                obj.insert(prop.clone(), if is_list { json!([escape]) } else { json!(escape) });
+                let args = Value::Object(obj);
+                tried += 1;
+                match catch_unwind(AssertUnwindSafe(|| a.call(def.name, &args))) {
+                    // A path that leaves the root must be refused. Succeeding means the tool
+                    // either used it or ignored an argument it declares — both are faults.
+                    Ok(Ok(_)) => leaked.push(format!("{} accepted {prop}={escape:?}", def.name)),
+                    Ok(Err(_)) => refused += 1,
+                    Err(_) => leaked.push(format!("{} panicked on {prop}={escape:?}", def.name)),
+                }
+            }
+        }
+    }
+
+    // Second net: nothing outside the root may have appeared, vanished or changed.
+    let after = listing(&base);
+    for (path, size) in &after {
+        if path.starts_with(&root) {
+            continue;
+        }
+        match before.iter().find(|(p, _)| p == path) {
+            Some((_, was)) if was == size => {}
+            Some(_) => leaked.push(format!("{} was modified outside the root", path.display())),
+            None => leaked.push(format!("{} was created outside the root", path.display())),
+        }
+    }
+    for (path, _) in &before {
+        if !path.starts_with(&root) && !after.iter().any(|(p, _)| p == path) {
+            leaked.push(format!("{} was deleted outside the root", path.display()));
+        }
+    }
+
+    eprintln!("root confinement: {tried} escape attempts over {} tools, {refused} refused, {} leaks", tools().len(), leaked.len());
+    for l in leaked.iter().take(20) {
+        eprintln!("  {l}");
+    }
+    let _ = std::fs::remove_dir_all(&base);
+    assert!(tried > 100, "only {tried} escape attempts: the path properties are not being found");
+    assert!(leaked.is_empty(), "{} confinement failure(s); the first is: {}", leaked.len(), leaked.first().map_or("", String::as_str));
+}
+
+/// Every regular file under `dir` with its size, not following symbolic links.
+fn listing(dir: &Path) -> Vec<(PathBuf, u64)> {
+    let mut out = Vec::new();
+    let mut stack = vec![dir.to_path_buf()];
+    while let Some(d) = stack.pop() {
+        let Ok(entries) = std::fs::read_dir(&d) else { continue };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            let Ok(meta) = std::fs::symlink_metadata(&path) else { continue };
+            if meta.file_type().is_symlink() {
+                continue; // do not walk through a link we planted
+            }
+            if meta.is_dir() {
+                stack.push(path);
+            } else if meta.is_file() {
+                out.push((path, meta.len()));
+            }
+        }
+    }
+    out.sort();
+    out
+}
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 319bc3ef..481b07c5 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1886,3 +1886,209 @@ fn check_box_redraw_keeps_down_states_it_still_draws() {
     assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
     assert!(!d.contains(b"Gone"), "a state the box no longer draws");
 }
+
+#[test]
+fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
+    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
+    let cases = [
+        (NewField::Text { multiline: false }, true),
+        (NewField::Text { multiline: false }, false),
+        (NewField::CheckBox, false),
+        (NewField::Button { caption: "Button".into() }, false),
+        (NewField::Signature, false),
+    ];
+    for (kind, fill) in cases {
+        for indirect in [false, true] {
+            let mut doc = one_page();
+            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
+            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
+            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
+            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+            for (key, bytes) in alternates {
+                let mut d = Dict::new();
+                d.set(b"Type".to_vec(), Object::name("XObject"));
+                d.set(b"Subtype".to_vec(), Object::name("Form"));
+                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
+                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
+                entries.set(key.to_vec(), Object::Ref(r));
+            }
+            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
+            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
+            for widget in [first_widget, other_widget] {
+                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
+            }
+            let original = reopen(&doc);
+            for full in [false, true] {
+                let mut doc = original.clone();
+                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
+                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
+                let before = doc.resolve(&source);
+                if fill {
+                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
+                } else {
+                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
+                }
+                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
+                let bytes = if full {
+                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
+                } else {
+                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+                    let original = doc.bytes();
+                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+                    bytes
+                };
+                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+                let doc = Document::open(Arc::new(bytes)).unwrap();
+                let all = fields(&doc);
+                let first = field(&all, &first);
+                let other = field(&all, &other);
+                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
+                let first_ap = first_ap.as_dict().unwrap();
+                let other_ap = other_ap.as_dict().unwrap();
+                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
+                assert_eq!(other_ap.len(), 4);
+                // The redrawn widget keeps unknown entries, but not down/rollover looks that
+                // would show its old value or caption on press or hover.
+                assert_eq!(
+                    first_ap.len(),
+                    2,
+                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
+                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
+                );
+                for (key, bytes) in alternates {
+                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
+                    let object = doc.resolve(other_ap.get(key).unwrap());
+                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
+                    assert_eq!(stream.decoded().unwrap(), bytes);
+                }
+                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
+                if fill {
+                    assert_eq!(first.value, ["Updated value"]);
+                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
+                    assert!(other.value.is_empty());
+                } else {
+                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
+                    assert_eq!(other.tooltip, None);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
+    fn saved(doc: &Document, full: bool) -> Document {
+        let bytes = if full {
+            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
+        } else {
+            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
+            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
+            let original = doc.bytes();
+            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
+            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
+            bytes
+        };
+        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+        Document::open(Arc::new(bytes)).unwrap()
+    }
+
+    for indirect_caption in [false, true] {
+        for indirect_layout in [false, true] {
+            for icon_only in [false, true] {
+                let mut doc = one_page();
+                let name =
+                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
+                        .unwrap();
+                let widget = field(&fields(&doc), &name).widgets[0].obj;
+                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
+                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
+                let layout = Object::Int(i64::from(icon_only));
+                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
+                let mut icon_dict = Dict::new();
+                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
+                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
+                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
+                let icon_bytes = b"0 0 4 2 re f\n";
+                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
+                let mut mk = Dict::new();
+                mk.set(b"CA".to_vec(), caption);
+                mk.set(b"TP".to_vec(), layout);
+                mk.set(b"I".to_vec(), Object::Ref(icon));
+                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
+                let mk = doc.add(Object::Dict(mk));
+                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
+
+                // Import the operands from a real saved file before an unrelated public edit.
+                let original = saved(&doc, true);
+                for full in [false, true] {
+                    let mut doc = original.clone();
+                    let widget = field(&fields(&doc), &name).widgets[0].obj;
+                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
+                    let original_mk = doc.resolve(&mk_before);
+                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
+                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
+                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
+                    let doc = saved(&doc, full);
+                    let f = field(&fields(&doc), &name).clone();
+                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
+                    let w = &f.widgets[0];
+                    let wd = doc.get(w.obj);
+                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
+                    let mk = mk_object.as_dict().unwrap();
+                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
+                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
+                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
+                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
+                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
+                    let appearance = ap(&doc, w);
+                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
+                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
+                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
+                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+                    let appearance_object = doc.get(n);
+                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
+                    let resource_icon =
+                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
+                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
+                    let icon_object = doc.resolve(resource_icon);
+                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
+                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
+                }
+            }
+        }
+    }
+}
+
+/// A check box's down appearances survive a redraw for the states it still draws (same names),
+/// and a down appearance for a state it no longer has is dropped rather than left stale.
+#[test]
+fn check_box_redraw_keeps_down_states_it_still_draws() {
+    let mut doc = one_page();
+    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
+    let widget = field(&fields(&doc), &name).widgets[0].obj;
+    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
+    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
+    let mut down = Dict::new();
+    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Form"));
+        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
+        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
+        down.set(state.to_vec(), Object::Ref(r));
+    }
+    ap.set(b"D".to_vec(), Object::Dict(down));
+    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
+    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
+    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
+    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
+    let d = d.as_dict().unwrap();
+    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
+    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
+}

From f34ee9388cc8aa4f1c76fbcfeff93fa503830546 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 15:42:10 -0400
Subject: [PATCH 120/149] Fix main CI: drop four duplicate copies of the forms
 redraw tests (#605)

Four squash merges in a row (#450, #414, #451, #351) each re-added the
same 206-line block from #417 to crates/forms/src/tests.rs, so the crate's
tests no longer compiled (E0428: three test functions defined five times)
and main went red on every platform. Keep the first copy. The same merges
repeated one ROADMAP log line four times; keep one.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                |   6 -
 crates/forms/src/tests.rs | 824 --------------------------------------
 2 files changed, 830 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 15d38f94..b3b29ad1 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -146,12 +146,6 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
 
-- **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
 - **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
 - **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 481b07c5..94255eab 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1268,827 +1268,3 @@ fn check_box_redraw_keeps_down_states_it_still_draws() {
     assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
     assert!(!d.contains(b"Gone"), "a state the box no longer draws");
 }
-
-#[test]
-fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
-    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
-    let cases = [
-        (NewField::Text { multiline: false }, true),
-        (NewField::Text { multiline: false }, false),
-        (NewField::CheckBox, false),
-        (NewField::Button { caption: "Button".into() }, false),
-        (NewField::Signature, false),
-    ];
-    for (kind, fill) in cases {
-        for indirect in [false, true] {
-            let mut doc = one_page();
-            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
-            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
-            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
-            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-            for (key, bytes) in alternates {
-                let mut d = Dict::new();
-                d.set(b"Type".to_vec(), Object::name("XObject"));
-                d.set(b"Subtype".to_vec(), Object::name("Form"));
-                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
-                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
-                entries.set(key.to_vec(), Object::Ref(r));
-            }
-            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
-            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
-            for widget in [first_widget, other_widget] {
-                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
-            }
-            let original = reopen(&doc);
-            for full in [false, true] {
-                let mut doc = original.clone();
-                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
-                let before = doc.resolve(&source);
-                if fill {
-                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
-                } else {
-                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
-                }
-                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
-                let bytes = if full {
-                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
-                } else {
-                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-                    let original = doc.bytes();
-                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
-                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-                    bytes
-                };
-                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-                let doc = Document::open(Arc::new(bytes)).unwrap();
-                let all = fields(&doc);
-                let first = field(&all, &first);
-                let other = field(&all, &other);
-                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let first_ap = first_ap.as_dict().unwrap();
-                let other_ap = other_ap.as_dict().unwrap();
-                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
-                assert_eq!(other_ap.len(), 4);
-                // The redrawn widget keeps unknown entries, but not down/rollover looks that
-                // would show its old value or caption on press or hover.
-                assert_eq!(
-                    first_ap.len(),
-                    2,
-                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
-                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
-                );
-                for (key, bytes) in alternates {
-                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
-                    let object = doc.resolve(other_ap.get(key).unwrap());
-                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
-                    assert_eq!(stream.decoded().unwrap(), bytes);
-                }
-                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                if fill {
-                    assert_eq!(first.value, ["Updated value"]);
-                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
-                    assert!(other.value.is_empty());
-                } else {
-                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
-                    assert_eq!(other.tooltip, None);
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
-    fn saved(doc: &Document, full: bool) -> Document {
-        let bytes = if full {
-            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
-        } else {
-            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-            let original = doc.bytes();
-            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
-            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-            bytes
-        };
-        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-        Document::open(Arc::new(bytes)).unwrap()
-    }
-
-    for indirect_caption in [false, true] {
-        for indirect_layout in [false, true] {
-            for icon_only in [false, true] {
-                let mut doc = one_page();
-                let name =
-                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
-                        .unwrap();
-                let widget = field(&fields(&doc), &name).widgets[0].obj;
-                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
-                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
-                let layout = Object::Int(i64::from(icon_only));
-                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
-                let mut icon_dict = Dict::new();
-                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
-                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
-                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
-                let icon_bytes = b"0 0 4 2 re f\n";
-                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
-                let mut mk = Dict::new();
-                mk.set(b"CA".to_vec(), caption);
-                mk.set(b"TP".to_vec(), layout);
-                mk.set(b"I".to_vec(), Object::Ref(icon));
-                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
-                let mk = doc.add(Object::Dict(mk));
-                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
-
-                // Import the operands from a real saved file before an unrelated public edit.
-                let original = saved(&doc, true);
-                for full in [false, true] {
-                    let mut doc = original.clone();
-                    let widget = field(&fields(&doc), &name).widgets[0].obj;
-                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
-                    let original_mk = doc.resolve(&mk_before);
-                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
-                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
-                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
-                    let doc = saved(&doc, full);
-                    let f = field(&fields(&doc), &name).clone();
-                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
-                    let w = &f.widgets[0];
-                    let wd = doc.get(w.obj);
-                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
-                    let mk = mk_object.as_dict().unwrap();
-                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
-                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
-                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
-                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
-                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
-                    let appearance = ap(&doc, w);
-                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
-                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
-                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
-                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
-                    let appearance_object = doc.get(n);
-                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
-                    let resource_icon =
-                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
-                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
-                    let icon_object = doc.resolve(resource_icon);
-                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
-                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
-                }
-            }
-        }
-    }
-}
-
-/// A check box's down appearances survive a redraw for the states it still draws (same names),
-/// and a down appearance for a state it no longer has is dropped rather than left stale.
-#[test]
-fn check_box_redraw_keeps_down_states_it_still_draws() {
-    let mut doc = one_page();
-    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
-    let widget = field(&fields(&doc), &name).widgets[0].obj;
-    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
-    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-    let mut down = Dict::new();
-    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
-        let mut d = Dict::new();
-        d.set(b"Subtype".to_vec(), Object::name("Form"));
-        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
-        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
-        down.set(state.to_vec(), Object::Ref(r));
-    }
-    ap.set(b"D".to_vec(), Object::Dict(down));
-    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
-    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
-    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
-    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
-    let d = d.as_dict().unwrap();
-    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
-    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
-}
-
-#[test]
-fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
-    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
-    let cases = [
-        (NewField::Text { multiline: false }, true),
-        (NewField::Text { multiline: false }, false),
-        (NewField::CheckBox, false),
-        (NewField::Button { caption: "Button".into() }, false),
-        (NewField::Signature, false),
-    ];
-    for (kind, fill) in cases {
-        for indirect in [false, true] {
-            let mut doc = one_page();
-            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
-            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
-            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
-            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-            for (key, bytes) in alternates {
-                let mut d = Dict::new();
-                d.set(b"Type".to_vec(), Object::name("XObject"));
-                d.set(b"Subtype".to_vec(), Object::name("Form"));
-                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
-                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
-                entries.set(key.to_vec(), Object::Ref(r));
-            }
-            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
-            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
-            for widget in [first_widget, other_widget] {
-                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
-            }
-            let original = reopen(&doc);
-            for full in [false, true] {
-                let mut doc = original.clone();
-                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
-                let before = doc.resolve(&source);
-                if fill {
-                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
-                } else {
-                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
-                }
-                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
-                let bytes = if full {
-                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
-                } else {
-                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-                    let original = doc.bytes();
-                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
-                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-                    bytes
-                };
-                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-                let doc = Document::open(Arc::new(bytes)).unwrap();
-                let all = fields(&doc);
-                let first = field(&all, &first);
-                let other = field(&all, &other);
-                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let first_ap = first_ap.as_dict().unwrap();
-                let other_ap = other_ap.as_dict().unwrap();
-                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
-                assert_eq!(other_ap.len(), 4);
-                // The redrawn widget keeps unknown entries, but not down/rollover looks that
-                // would show its old value or caption on press or hover.
-                assert_eq!(
-                    first_ap.len(),
-                    2,
-                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
-                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
-                );
-                for (key, bytes) in alternates {
-                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
-                    let object = doc.resolve(other_ap.get(key).unwrap());
-                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
-                    assert_eq!(stream.decoded().unwrap(), bytes);
-                }
-                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                if fill {
-                    assert_eq!(first.value, ["Updated value"]);
-                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
-                    assert!(other.value.is_empty());
-                } else {
-                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
-                    assert_eq!(other.tooltip, None);
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
-    fn saved(doc: &Document, full: bool) -> Document {
-        let bytes = if full {
-            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
-        } else {
-            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-            let original = doc.bytes();
-            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
-            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-            bytes
-        };
-        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-        Document::open(Arc::new(bytes)).unwrap()
-    }
-
-    for indirect_caption in [false, true] {
-        for indirect_layout in [false, true] {
-            for icon_only in [false, true] {
-                let mut doc = one_page();
-                let name =
-                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
-                        .unwrap();
-                let widget = field(&fields(&doc), &name).widgets[0].obj;
-                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
-                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
-                let layout = Object::Int(i64::from(icon_only));
-                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
-                let mut icon_dict = Dict::new();
-                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
-                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
-                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
-                let icon_bytes = b"0 0 4 2 re f\n";
-                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
-                let mut mk = Dict::new();
-                mk.set(b"CA".to_vec(), caption);
-                mk.set(b"TP".to_vec(), layout);
-                mk.set(b"I".to_vec(), Object::Ref(icon));
-                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
-                let mk = doc.add(Object::Dict(mk));
-                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
-
-                // Import the operands from a real saved file before an unrelated public edit.
-                let original = saved(&doc, true);
-                for full in [false, true] {
-                    let mut doc = original.clone();
-                    let widget = field(&fields(&doc), &name).widgets[0].obj;
-                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
-                    let original_mk = doc.resolve(&mk_before);
-                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
-                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
-                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
-                    let doc = saved(&doc, full);
-                    let f = field(&fields(&doc), &name).clone();
-                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
-                    let w = &f.widgets[0];
-                    let wd = doc.get(w.obj);
-                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
-                    let mk = mk_object.as_dict().unwrap();
-                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
-                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
-                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
-                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
-                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
-                    let appearance = ap(&doc, w);
-                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
-                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
-                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
-                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
-                    let appearance_object = doc.get(n);
-                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
-                    let resource_icon =
-                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
-                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
-                    let icon_object = doc.resolve(resource_icon);
-                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
-                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
-                }
-            }
-        }
-    }
-}
-
-/// A check box's down appearances survive a redraw for the states it still draws (same names),
-/// and a down appearance for a state it no longer has is dropped rather than left stale.
-#[test]
-fn check_box_redraw_keeps_down_states_it_still_draws() {
-    let mut doc = one_page();
-    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
-    let widget = field(&fields(&doc), &name).widgets[0].obj;
-    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
-    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-    let mut down = Dict::new();
-    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
-        let mut d = Dict::new();
-        d.set(b"Subtype".to_vec(), Object::name("Form"));
-        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
-        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
-        down.set(state.to_vec(), Object::Ref(r));
-    }
-    ap.set(b"D".to_vec(), Object::Dict(down));
-    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
-    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
-    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
-    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
-    let d = d.as_dict().unwrap();
-    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
-    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
-}
-
-#[test]
-fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
-    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
-    let cases = [
-        (NewField::Text { multiline: false }, true),
-        (NewField::Text { multiline: false }, false),
-        (NewField::CheckBox, false),
-        (NewField::Button { caption: "Button".into() }, false),
-        (NewField::Signature, false),
-    ];
-    for (kind, fill) in cases {
-        for indirect in [false, true] {
-            let mut doc = one_page();
-            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
-            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
-            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
-            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-            for (key, bytes) in alternates {
-                let mut d = Dict::new();
-                d.set(b"Type".to_vec(), Object::name("XObject"));
-                d.set(b"Subtype".to_vec(), Object::name("Form"));
-                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
-                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
-                entries.set(key.to_vec(), Object::Ref(r));
-            }
-            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
-            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
-            for widget in [first_widget, other_widget] {
-                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
-            }
-            let original = reopen(&doc);
-            for full in [false, true] {
-                let mut doc = original.clone();
-                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
-                let before = doc.resolve(&source);
-                if fill {
-                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
-                } else {
-                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
-                }
-                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
-                let bytes = if full {
-                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
-                } else {
-                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-                    let original = doc.bytes();
-                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
-                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-                    bytes
-                };
-                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-                let doc = Document::open(Arc::new(bytes)).unwrap();
-                let all = fields(&doc);
-                let first = field(&all, &first);
-                let other = field(&all, &other);
-                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let first_ap = first_ap.as_dict().unwrap();
-                let other_ap = other_ap.as_dict().unwrap();
-                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
-                assert_eq!(other_ap.len(), 4);
-                // The redrawn widget keeps unknown entries, but not down/rollover looks that
-                // would show its old value or caption on press or hover.
-                assert_eq!(
-                    first_ap.len(),
-                    2,
-                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
-                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
-                );
-                for (key, bytes) in alternates {
-                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
-                    let object = doc.resolve(other_ap.get(key).unwrap());
-                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
-                    assert_eq!(stream.decoded().unwrap(), bytes);
-                }
-                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                if fill {
-                    assert_eq!(first.value, ["Updated value"]);
-                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
-                    assert!(other.value.is_empty());
-                } else {
-                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
-                    assert_eq!(other.tooltip, None);
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
-    fn saved(doc: &Document, full: bool) -> Document {
-        let bytes = if full {
-            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
-        } else {
-            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-            let original = doc.bytes();
-            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
-            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-            bytes
-        };
-        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-        Document::open(Arc::new(bytes)).unwrap()
-    }
-
-    for indirect_caption in [false, true] {
-        for indirect_layout in [false, true] {
-            for icon_only in [false, true] {
-                let mut doc = one_page();
-                let name =
-                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
-                        .unwrap();
-                let widget = field(&fields(&doc), &name).widgets[0].obj;
-                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
-                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
-                let layout = Object::Int(i64::from(icon_only));
-                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
-                let mut icon_dict = Dict::new();
-                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
-                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
-                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
-                let icon_bytes = b"0 0 4 2 re f\n";
-                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
-                let mut mk = Dict::new();
-                mk.set(b"CA".to_vec(), caption);
-                mk.set(b"TP".to_vec(), layout);
-                mk.set(b"I".to_vec(), Object::Ref(icon));
-                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
-                let mk = doc.add(Object::Dict(mk));
-                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
-
-                // Import the operands from a real saved file before an unrelated public edit.
-                let original = saved(&doc, true);
-                for full in [false, true] {
-                    let mut doc = original.clone();
-                    let widget = field(&fields(&doc), &name).widgets[0].obj;
-                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
-                    let original_mk = doc.resolve(&mk_before);
-                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
-                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
-                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
-                    let doc = saved(&doc, full);
-                    let f = field(&fields(&doc), &name).clone();
-                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
-                    let w = &f.widgets[0];
-                    let wd = doc.get(w.obj);
-                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
-                    let mk = mk_object.as_dict().unwrap();
-                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
-                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
-                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
-                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
-                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
-                    let appearance = ap(&doc, w);
-                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
-                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
-                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
-                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
-                    let appearance_object = doc.get(n);
-                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
-                    let resource_icon =
-                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
-                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
-                    let icon_object = doc.resolve(resource_icon);
-                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
-                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
-                }
-            }
-        }
-    }
-}
-
-/// A check box's down appearances survive a redraw for the states it still draws (same names),
-/// and a down appearance for a state it no longer has is dropped rather than left stale.
-#[test]
-fn check_box_redraw_keeps_down_states_it_still_draws() {
-    let mut doc = one_page();
-    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
-    let widget = field(&fields(&doc), &name).widgets[0].obj;
-    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
-    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-    let mut down = Dict::new();
-    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
-        let mut d = Dict::new();
-        d.set(b"Subtype".to_vec(), Object::name("Form"));
-        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
-        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
-        down.set(state.to_vec(), Object::Ref(r));
-    }
-    ap.set(b"D".to_vec(), Object::Dict(down));
-    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
-    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
-    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
-    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
-    let d = d.as_dict().unwrap();
-    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
-    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
-}
-
-#[test]
-fn filling_and_authoring_keep_shared_appearances_and_drop_stale_alternates() {
-    let alternates: [(&[u8], &[u8]); 2] = [(b"R", b"0 0 20 10 re f\n"), (b"D", b"1 1 18 8 re S\n")];
-    let cases = [
-        (NewField::Text { multiline: false }, true),
-        (NewField::Text { multiline: false }, false),
-        (NewField::CheckBox, false),
-        (NewField::Button { caption: "Button".into() }, false),
-        (NewField::Signature, false),
-    ];
-    for (kind, fill) in cases {
-        for indirect in [false, true] {
-            let mut doc = one_page();
-            let first = add_field(&mut doc, 0, [50.0, 600.0, 250.0, 630.0], &kind, Some("First")).unwrap();
-            let other = add_field(&mut doc, 0, [50.0, 550.0, 250.0, 580.0], &kind, Some("Other")).unwrap();
-            let first_widget = field(&fields(&doc), &first).widgets[0].obj;
-            let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-            let mut entries = doc.get(first_widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-            for (key, bytes) in alternates {
-                let mut d = Dict::new();
-                d.set(b"Type".to_vec(), Object::name("XObject"));
-                d.set(b"Subtype".to_vec(), Object::name("Form"));
-                d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 10.into()]));
-                let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, bytes.to_vec())));
-                entries.set(key.to_vec(), Object::Ref(r));
-            }
-            entries.set(b"VendorState".to_vec(), Object::name("Retained"));
-            let shared = if indirect { Object::Ref(doc.add(Object::Dict(entries))) } else { Object::Dict(entries) };
-            for widget in [first_widget, other_widget] {
-                doc.update_dict(widget, |d| d.set(b"AP".to_vec(), shared.clone())).unwrap();
-            }
-            let original = reopen(&doc);
-            for full in [false, true] {
-                let mut doc = original.clone();
-                let other_widget = field(&fields(&doc), &other).widgets[0].obj;
-                let source = doc.get(other_widget).as_dict().unwrap().get(b"AP").unwrap().clone();
-                let before = doc.resolve(&source);
-                if fill {
-                    set_value(&mut doc, &first, &FieldValue::Text("Updated value".into())).unwrap();
-                } else {
-                    set_props(&mut doc, &first, &FieldProps { tooltip: Some("Updated help".into()), ..FieldProps::default() }).unwrap();
-                }
-                assert_eq!(doc.resolve(&source), before, "a shared AP must not change");
-                let bytes = if full {
-                    pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap()
-                } else {
-                    assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-                    assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-                    let original = doc.bytes();
-                    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
-                    assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-                    assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-                    bytes
-                };
-                hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-                let doc = Document::open(Arc::new(bytes)).unwrap();
-                let all = fields(&doc);
-                let first = field(&all, &first);
-                let other = field(&all, &other);
-                let first_ap = doc.resolve(doc.get(first.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let other_ap = doc.resolve(doc.get(other.widgets[0].obj).as_dict().unwrap().get(b"AP").unwrap());
-                let first_ap = first_ap.as_dict().unwrap();
-                let other_ap = other_ap.as_dict().unwrap();
-                assert_ne!(first_ap.get(b"N"), other_ap.get(b"N"), "normal appearance was regenerated");
-                assert_eq!(other_ap.len(), 4);
-                // The redrawn widget keeps unknown entries, but not down/rollover looks that
-                // would show its old value or caption on press or hover.
-                assert_eq!(
-                    first_ap.len(),
-                    2,
-                    "{kind:?} fill={fill} indirect={indirect} full={full}: {:?}",
-                    first_ap.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect::<Vec<_>>()
-                );
-                for (key, bytes) in alternates {
-                    assert!(first_ap.get(key).is_none(), "stale /{}", String::from_utf8_lossy(key));
-                    let object = doc.resolve(other_ap.get(key).unwrap());
-                    let Object::Stream(stream) = &*object else { panic!("alternate appearance") };
-                    assert_eq!(stream.decoded().unwrap(), bytes);
-                }
-                assert_eq!(first_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                assert_eq!(other_ap.name(b"VendorState"), Some(&b"Retained"[..]));
-                if fill {
-                    assert_eq!(first.value, ["Updated value"]);
-                    assert!(ap(&doc, &first.widgets[0]).contains("(Updated value) Tj"));
-                    assert!(other.value.is_empty());
-                } else {
-                    assert_eq!(first.tooltip.as_deref(), Some("Updated help"));
-                    assert_eq!(other.tooltip, None);
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn pushbutton_redraw_resolves_caption_and_layout_after_save_and_reopen() {
-    fn saved(doc: &Document, full: bool) -> Document {
-        let bytes = if full {
-            pdfcraft_cos::write_full(doc, &SaveOptions::default()).unwrap()
-        } else {
-            assert!(!doc.revisions().is_empty(), "incremental save needs an existing revision");
-            assert!(!doc.encryption_changed() && !doc.full_save_required(), "this edit must not require a full rewrite");
-            let original = doc.bytes();
-            let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
-            assert!(bytes.len() > original.len(), "incremental save appends the changed appearance");
-            assert!(bytes.starts_with(original.as_slice()), "incremental save preserves the complete original prefix");
-            bytes
-        };
-        hayro_syntax::Pdf::new(bytes.clone()).unwrap();
-        Document::open(Arc::new(bytes)).unwrap()
-    }
-
-    for indirect_caption in [false, true] {
-        for indirect_layout in [false, true] {
-            for icon_only in [false, true] {
-                let mut doc = one_page();
-                let name =
-                    add_field(&mut doc, 0, [50.0, 600.0, 250.0, 650.0], &NewField::Button { caption: "Original caption".into() }, Some("Picture"))
-                        .unwrap();
-                let widget = field(&fields(&doc), &name).widgets[0].obj;
-                let caption = Object::String(pdfcraft_cos::PdfString::literal(b"Original caption".to_vec()));
-                let caption = if indirect_caption { Object::Ref(doc.add(caption)) } else { caption };
-                let layout = Object::Int(i64::from(icon_only));
-                let layout = if indirect_layout { Object::Ref(doc.add(layout)) } else { layout };
-                let mut icon_dict = Dict::new();
-                icon_dict.set(b"Type".to_vec(), Object::name("XObject"));
-                icon_dict.set(b"Subtype".to_vec(), Object::name("Form"));
-                icon_dict.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 4.into(), 2.into()]));
-                let icon_bytes = b"0 0 4 2 re f\n";
-                let icon = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(icon_dict, icon_bytes.to_vec())));
-                let mut mk = Dict::new();
-                mk.set(b"CA".to_vec(), caption);
-                mk.set(b"TP".to_vec(), layout);
-                mk.set(b"I".to_vec(), Object::Ref(icon));
-                mk.set(b"VendorNote".to_vec(), Object::name("Retained"));
-                let mk = doc.add(Object::Dict(mk));
-                doc.update_dict(widget, |d| d.set(b"MK".to_vec(), Object::Ref(mk))).unwrap();
-
-                // Import the operands from a real saved file before an unrelated public edit.
-                let original = saved(&doc, true);
-                for full in [false, true] {
-                    let mut doc = original.clone();
-                    let widget = field(&fields(&doc), &name).widgets[0].obj;
-                    let mk_before = doc.get(widget).as_dict().unwrap().get(b"MK").unwrap().clone();
-                    let original_mk = doc.resolve(&mk_before);
-                    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Picture help".into()), ..FieldProps::default() }).unwrap();
-                    assert_eq!(doc.get(widget).as_dict().unwrap().get(b"MK"), Some(&mk_before));
-                    assert_eq!(doc.resolve(&mk_before), original_mk, "redraw must not rewrite the source MK");
-                    let doc = saved(&doc, full);
-                    let f = field(&fields(&doc), &name).clone();
-                    assert_eq!(f.tooltip.as_deref(), Some("Picture help"));
-                    let w = &f.widgets[0];
-                    let wd = doc.get(w.obj);
-                    let mk_object = doc.resolve(wd.as_dict().unwrap().get(b"MK").unwrap());
-                    let mk = mk_object.as_dict().unwrap();
-                    assert_eq!(mk.get(b"CA").unwrap().as_ref().is_some(), indirect_caption);
-                    assert_eq!(doc.resolve(mk.get(b"CA").unwrap()).as_string().unwrap().bytes, b"Original caption");
-                    assert_eq!(mk.get(b"TP").unwrap().as_ref().is_some(), indirect_layout);
-                    assert_eq!(doc.resolve(mk.get(b"TP").unwrap()).as_int(), Some(i64::from(icon_only)));
-                    assert_eq!(mk.name(b"VendorNote"), Some(&b"Retained"[..]));
-                    let appearance = ap(&doc, w);
-                    assert_eq!(appearance.contains("(Original caption) Tj"), !icon_only, "{appearance}");
-                    assert_eq!(appearance.matches("/Icon Do").count(), 1, "{appearance}");
-                    assert!(appearance.contains("24.000000 0 0 24.000000 52.000 1.000 cm"), "{appearance}");
-                    let n = wd.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
-                    let appearance_object = doc.get(n);
-                    let Object::Stream(stream) = &*appearance_object else { panic!("appearance") };
-                    let resource_icon =
-                        stream.dict.get(b"Resources").unwrap().as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().get(b"Icon").unwrap();
-                    assert_eq!(resource_icon, mk.get(b"I").unwrap());
-                    let icon_object = doc.resolve(resource_icon);
-                    let Object::Stream(icon) = &*icon_object else { panic!("icon") };
-                    assert_eq!(icon.decoded().unwrap(), icon_bytes);
-                }
-            }
-        }
-    }
-}
-
-/// A check box's down appearances survive a redraw for the states it still draws (same names),
-/// and a down appearance for a state it no longer has is dropped rather than left stale.
-#[test]
-fn check_box_redraw_keeps_down_states_it_still_draws() {
-    let mut doc = one_page();
-    let name = add_field(&mut doc, 0, [50.0, 600.0, 70.0, 620.0], &NewField::CheckBox, Some("agree")).unwrap();
-    let widget = field(&fields(&doc), &name).widgets[0].obj;
-    let on = field(&fields(&doc), &name).widgets[0].on_state.clone().unwrap_or_else(|| "Yes".into());
-    let mut ap = doc.get(widget).as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().clone();
-    let mut down = Dict::new();
-    for state in [on.as_bytes(), b"Off".as_slice(), b"Gone".as_slice()] {
-        let mut d = Dict::new();
-        d.set(b"Subtype".to_vec(), Object::name("Form"));
-        d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 20.into(), 20.into()]));
-        let r = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"0 0 20 20 re f\n".to_vec())));
-        down.set(state.to_vec(), Object::Ref(r));
-    }
-    ap.set(b"D".to_vec(), Object::Dict(down));
-    doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap))).unwrap();
-    set_props(&mut doc, &name, &FieldProps { tooltip: Some("Tick to agree".into()), ..FieldProps::default() }).unwrap();
-    let ap = doc.get(widget).as_dict().unwrap().get(b"AP").map(|a| doc.resolve(a)).unwrap();
-    let d = ap.as_dict().unwrap().get(b"D").map(|d| doc.resolve(d)).expect("down states kept");
-    let d = d.as_dict().unwrap();
-    assert!(d.contains(on.as_bytes()) && d.contains(b"Off"));
-    assert!(!d.contains(b"Gone"), "a state the box no longer draws");
-}

From efb3439cb9a053ca86ba013b9def7388e033c741 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 15:45:38 -0400
Subject: [PATCH 121/149] Parity: cite the MCP resources test by its merged
 name (#608)

#451 renamed conventions_resources_and_modern_results to
conventions_resources before merging, but the misc.mcp-resources evidence
kept the old name, so `cargo xtask parity` failed on main.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 parity/acrobat-features.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6a83d48f..3a1e4f2e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9374,7 +9374,7 @@ milestone = "M13"
 status = "shipped"
 commands = []
 tools = ["doc_info", "text_extract", "page_render"]
-evidence = ["crates/automation/tests/automation.rs::mcp_resources_expose_open_documents", "crates/automation/src/mcp.rs::resource_uris_parse", "crates/automation/tests/automation.rs::conventions_resources_and_modern_results"]
+evidence = ["crates/automation/tests/automation.rs::mcp_resources_expose_open_documents", "crates/automation/src/mcp.rs::resource_uris_parse", "crates/automation/tests/automation.rs::conventions_resources"]
 notes = "resources/list, resources/templates/list and resources/read: pdfcraft://doc/{doc}/info (JSON), /text, /page/{page}/text, /page/{page}/image?dpi= (PNG)"
 
 [[feature]]

From d483d6d4750327c9e393fa64be74381f45f3652d Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 16:45:13 -0400
Subject: [PATCH 122/149] Fix #423: publish a standalone Linux CLI archive
 (#613)

On Linux, pdfcraft-cli shipped only inside the desktop packages (about
55 MB), while macOS already publishes pdfcraft-cli-<v>-macos-universal.zip.
Servers, CI and agent sandboxes only need the headless CLI.

packaging/linux/package.sh gains a `cli` format, on by default, that writes
pdfcraft-cli-<v>-linux-<arch>.tar.gz: the stripped pdfcraft-cli from the
shared staging tree plus the licences/README via copy_docs. copy_docs now
also copies NOTICE (every package benefits). The release job already
uploads and checksums every file in dist/release; its package check now
lists the archive and runs the extracted binary. README and
docs/releasing.md list the new artifact and state the glibc 2.35 baseline.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release.yml |  8 +++++++-
 README.md                     |  3 +++
 docs/releasing.md             |  8 +++++---
 packaging/env.sh              |  2 +-
 packaging/linux/package.sh    | 20 +++++++++++++++++---
 5 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aa09481b..e5c62e1f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -213,7 +213,7 @@ jobs:
       - name: Apply version override
         if: inputs.version != ''
         run: cargo xtask version set "$PDFCRAFT_VERSION"
-      - name: Build and package (AppImage, deb, rpm, tar.gz)
+      - name: Build and package (AppImage, deb, rpm, tar.gz, CLI tar.gz)
         env:
           CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
           CRAFT_FONTS_REQUIRED: "1"
@@ -223,6 +223,12 @@ jobs:
           dpkg-deb --info dist/release/*.deb
           dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/pdfcraft$|metainfo|applications'
           ldd target/release/pdfcraft
+          # The CLI-only archive: the binary and its licences, and it runs.
+          cli="dist/release/pdfcraft-cli-$PDFCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
+          tar -tzf "$cli" | grep -E '/pdfcraft-cli$'
+          tar -tzf "$cli" | grep -E '/LICENSE-APACHE$'
+          mkdir -p "$RUNNER_TEMP/cli" && tar -xzf "$cli" -C "$RUNNER_TEMP/cli"
+          "$RUNNER_TEMP/cli/pdfcraft-cli-$PDFCRAFT_VERSION-linux-${{ matrix.arch }}/pdfcraft-cli" --version
           python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.pdfcraft.yml')); assert m['id'] == 'ai.storyteller.pdfcraft'"
           for appimage in dist/release/*.AppImage; do
             chmod +x "$appimage"
diff --git a/README.md b/README.md
index 43342478..79f0a6c0 100644
--- a/README.md
+++ b/README.md
@@ -451,6 +451,9 @@ Use the MSI for your architecture. Per-user installation overrides are not suppo
 | Debian/Ubuntu | `pdfcraft-<ver>-linux-x86_64.deb` | `pdfcraft-<ver>-linux-aarch64.deb` | |
 | Fedora/RHEL/openSUSE | `pdfcraft-<ver>-linux-x86_64.rpm` | `pdfcraft-<ver>-linux-aarch64.rpm` | |
 | Tarball | `pdfcraft-<ver>-linux-x86_64.tar.gz` | `pdfcraft-<ver>-linux-aarch64.tar.gz` | Unpack anywhere |
+| Command-line tool | `pdfcraft-cli-<ver>-linux-x86_64.tar.gz` | `pdfcraft-cli-<ver>-linux-aarch64.tar.gz` | `pdfcraft-cli` alone (and its opt-in MCP server), for servers, CI and agents |
+
+Every Linux build needs glibc 2.35 or newer (Ubuntu 22.04+, Debian 12+, Fedora 36+, RHEL 10).
 
 ### FreeBSD
 
diff --git a/docs/releasing.md b/docs/releasing.md
index 30900549..5fb8d70c 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -48,8 +48,8 @@ published (`gh workflow run release.yml --ref <branch>`).
 | Windows 10+ x64 | `pdfcraft-<v>-windows-x64.msi`, `pdfcraft-<v>-windows-x64-portable.zip` | `windows-latest` |
 | Windows 10+ x86 (32-bit) | `pdfcraft-<v>-windows-x86.msi`, `pdfcraft-<v>-windows-x86-portable.zip` | `windows-latest` |
 | Windows 11 on ARM64 | `pdfcraft-<v>-windows-arm64.msi`, `pdfcraft-<v>-windows-arm64-portable.zip` | `windows-latest` (cross-compiled) |
-| Linux x86_64 | `pdfcraft-<v>-linux-x86_64.{AppImage,AppImage.zsync,deb,rpm,tar.gz}` | `ubuntu-22.04` |
-| Linux aarch64 | `pdfcraft-<v>-linux-aarch64.{AppImage,AppImage.zsync,deb,rpm,tar.gz}` | `ubuntu-22.04-arm` |
+| Linux x86_64 | `pdfcraft-<v>-linux-x86_64.{AppImage,AppImage.zsync,deb,rpm,tar.gz}`, `pdfcraft-cli-<v>-linux-x86_64.tar.gz` | `ubuntu-22.04` |
+| Linux aarch64 | `pdfcraft-<v>-linux-aarch64.{AppImage,AppImage.zsync,deb,rpm,tar.gz}`, `pdfcraft-cli-<v>-linux-aarch64.tar.gz` | `ubuntu-22.04-arm` |
 | Flatpak x86_64 | `pdfcraft-<v>-linux-x86_64.flatpak` | `ubuntu-24.04` (repackages the Linux tarball) |
 | Flatpak aarch64 | `pdfcraft-<v>-linux-aarch64.flatpak` | `ubuntu-24.04-arm` (repackages the Linux tarball) |
 | FreeBSD 14 x86_64 | `pdfcraft-<v>-freebsd-x86_64.tar.gz` | FreeBSD VM on `ubuntu-latest` |
@@ -131,7 +131,9 @@ Locally: `dotnet tool install -g wix --version 5.0.2`, then `pwsh packaging/wind
 `packaging/linux/package.sh` stages one FHS tree (both binaries, the desktop entry, hicolor icons,
 AppStream metainfo) and makes every format from it: an **AppImage** (any distribution, nothing to
 install), a **.deb** and an **.rpm** (built with [nfpm](https://nfpm.goreleaser.com) from
-`nfpm.yaml`; they integrate with the menu, MIME and icon caches), and a **.tar.gz**.
+`nfpm.yaml`; they integrate with the menu, MIME and icon caches), a **.tar.gz**, and a CLI-only
+**`pdfcraft-cli-<v>-linux-<arch>.tar.gz`** (the stripped `pdfcraft-cli` plus the licences and
+README, for servers, CI and agent sandboxes). `--formats` picks a subset (`appimage deb rpm tar cli`).
 
 The binaries are built on Ubuntu 22.04, the oldest GitHub-hosted image, so they need only
 **glibc ≥ 2.35**: Ubuntu 22.04+, Debian 12+, Fedora 36+, RHEL 10. Windowing (X11, Wayland,
diff --git a/packaging/env.sh b/packaging/env.sh
index d4023a1a..a903be9c 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -47,7 +47,7 @@ warn() {
 # Copy licence and readme files that exist into a package directory.
 copy_docs() {
   local dest="$1" f
-  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
+  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT NOTICE; do
     if [ -f "$ROOT/$f" ]; then cp "$ROOT/$f" "$dest/"; fi
   done
   copy_font_licences "$dest"
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index ae0166e2..06b04a9e 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -6,8 +6,9 @@
 #   $DIST/pdfcraft-<version>-linux-<arch>.deb       Debian, Ubuntu, Mint, Pop!_OS, ...
 #   $DIST/pdfcraft-<version>-linux-<arch>.rpm       Fedora, openSUSE, RHEL, ...
 #   $DIST/pdfcraft-<version>-linux-<arch>.tar.gz    plain FHS-style tree (bin/, share/)
+#   $DIST/pdfcraft-cli-<version>-linux-<arch>.tar.gz  the headless CLI alone (servers, CI, agents)
 #
-# Usage: packaging/linux/package.sh [--skip-build] [--formats "appimage deb rpm tar"]
+# Usage: packaging/linux/package.sh [--skip-build] [--formats "appimage deb rpm tar cli"]
 #
 # Needs: cargo; nfpm for deb/rpm (https://nfpm.goreleaser.com); appimagetool for the AppImage
 # (downloaded into $CARGO_TARGET_DIR if missing). Build on an old distro (CI: Ubuntu 22.04,
@@ -20,12 +21,12 @@ HERE="$ROOT/packaging/linux"
 APP_ID=ai.storyteller.pdfcraft
 
 SKIP_BUILD=0
-FORMATS="appimage deb rpm tar"
+FORMATS="appimage deb rpm tar cli"
 while [ $# -gt 0 ]; do
   case "$1" in
     --skip-build) SKIP_BUILD=1; shift ;;
     --formats) FORMATS="$2"; shift 2 ;;
-    -h | --help) sed -n '2,15p' "$0"; exit 0 ;;
+    -h | --help) sed -n '2,16p' "$0"; exit 0 ;;
     *) echo "unknown argument: $1" >&2; exit 2 ;;
   esac
 done
@@ -80,6 +81,19 @@ if has tar; then
   echo "wrote $DIST/$BASENAME.tar.gz"
 fi
 
+# ---- CLI-only .tar.gz ---------------------------------------------------------------------------
+# The stripped pdfcraft-cli (and its opt-in MCP server) with the licences, for machines that never
+# open a window. Like the other formats it needs glibc >= the build host's.
+if has cli; then
+  CLI_NAME="pdfcraft-cli-$VERSION-linux-$ARCH"
+  CLI_DIR="$WORK/cli/$CLI_NAME"
+  mkdir -p "$CLI_DIR"
+  cp "$STAGE/usr/bin/pdfcraft-cli" "$CLI_DIR/"
+  copy_docs "$CLI_DIR"
+  tar -C "$WORK/cli" -czf "$DIST/$CLI_NAME.tar.gz" "$CLI_NAME"
+  echo "wrote $DIST/$CLI_NAME.tar.gz"
+fi
+
 # ---- .deb / .rpm --------------------------------------------------------------------------------
 if has deb || has rpm; then
   command -v nfpm >/dev/null || { echo "error: nfpm not found (https://nfpm.goreleaser.com/install/)" >&2; exit 1; }

From 90bb2f14ad4c60f84d900c1389e289e51a5ce7a6 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 16:52:07 -0400
Subject: [PATCH 123/149] Refs #142: decode outline titles with BOMs and raw
 UTF-8 consistently (#614)

The bookmarks panel decoded /Title through lopdf::decode_text_string,
which keeps a PDF 2.0 UTF-8 BOM as a visible U+FEFF, drops the whole
title when the bytes after a UTF-8 BOM are not valid UTF-8, and reads
BOM-less raw UTF-8 (written by some producers) as PDFDocEncoding
mojibake. Outline editing in pdfcraft-organize used a second decoder,
PdfString::to_text, so the two could disagree.

PdfString::to_text now decodes UTF-8 after a BOM lossily, reads
BOM-less strings that are valid non-ASCII UTF-8 as UTF-8, and strips
stray leading U+FEFF. The inspector's text strings (titles, name-tree
keys, field values) go through the same function.

The reporter's file decodes correctly on main, so this is hardening of
the decoder rather than a reproduction of that file.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/cos/src/object.rs     | 52 +++++++++++++++++++++++++++++-------
 crates/render/src/inspect.rs | 48 ++++++++++++++++++++++++++++++---
 2 files changed, 87 insertions(+), 13 deletions(-)

diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index 42659f9f..a805648e 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -51,16 +51,25 @@ impl PdfString {
     }
 
     /// Decode a text string: UTF-16BE (BOM), UTF-8 (BOM, PDF 2.0) or PDFDocEncoding.
+    ///
+    /// Lenient beyond the spec, as readers are: invalid sequences after a BOM decode lossily
+    /// instead of dropping the string, a BOM-less string whose bytes are valid UTF-8 with
+    /// non-ASCII bytes (written by some producers) is read as UTF-8 rather than as
+    /// PDFDocEncoding mojibake, and stray leading U+FEFF (doubled BOMs) are removed.
     pub fn to_text(&self) -> String {
-        let b = &self.bytes;
-        if b.len() >= 2 && b[0] == 0xFE && b[1] == 0xFF {
-            let units: Vec<u16> = b[2..].as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes(*c)).collect();
-            return String::from_utf16_lossy(&units);
-        }
-        if b.len() >= 3 && b[..3] == [0xEF, 0xBB, 0xBF] {
-            return String::from_utf8_lossy(&b[3..]).into_owned();
-        }
-        b.iter().map(|&c| pdfdoc_char(c)).collect()
+        let s = match self.bytes.as_slice() {
+            [0xFE, 0xFF, rest @ ..] => {
+                let units: Vec<u16> = rest.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes(*c)).collect();
+                String::from_utf16_lossy(&units)
+            }
+            [0xEF, 0xBB, 0xBF, rest @ ..] => String::from_utf8_lossy(rest).into_owned(),
+            b => match std::str::from_utf8(b) {
+                // Pure ASCII is identical either way; only non-ASCII UTF-8 needs the switch.
+                Ok(utf8) if !b.is_ascii() => utf8.to_owned(),
+                _ => b.iter().map(|&c| pdfdoc_char(c)).collect(),
+            },
+        };
+        if s.starts_with('\u{FEFF}') { s.trim_start_matches('\u{FEFF}').to_owned() } else { s }
     }
 }
 
@@ -384,6 +393,31 @@ mod tests {
         assert!(!PdfString::text("abc").bytes.starts_with(&[0xFE, 0xFF]));
     }
 
+    #[test]
+    fn text_string_encodings() {
+        // UTF-16BE with BOM.
+        let mut utf16 = vec![0xFE, 0xFF];
+        utf16.extend("第一章 概述".encode_utf16().flat_map(u16::to_be_bytes));
+        assert_eq!(PdfString::literal(utf16).to_text(), "第一章 概述");
+        // UTF-8 with BOM (PDF 2.0): the BOM is not part of the text.
+        let mut utf8 = vec![0xEF, 0xBB, 0xBF];
+        utf8.extend_from_slice("第一章".as_bytes());
+        assert_eq!(PdfString::literal(utf8).to_text(), "第一章");
+        // Invalid UTF-8 after the BOM decodes lossily instead of vanishing.
+        assert_eq!(PdfString::literal(vec![0xEF, 0xBB, 0xBF, b'A', 0xFF, b'B']).to_text(), "A\u{FFFD}B");
+        // BOM-less raw UTF-8 from producers that skip the BOM.
+        assert_eq!(PdfString::literal("目录".as_bytes()).to_text(), "目录");
+        // PDFDocEncoding Latin-1 (not valid UTF-8) stays PDFDocEncoding.
+        assert_eq!(PdfString::literal(vec![b'C', b'a', b'f', 0xE9]).to_text(), "Café");
+        // Doubled BOMs leave no U+FEFF behind.
+        assert_eq!(PdfString::literal(vec![0xFE, 0xFF, 0xFE, 0xFF, 0x00, b'A']).to_text(), "A");
+        assert_eq!(PdfString::literal(vec![0xEF, 0xBB, 0xBF, 0xEF, 0xBB, 0xBF, b'A']).to_text(), "A");
+        // Odd trailing byte and empty strings never panic.
+        assert_eq!(PdfString::literal(vec![0xFE, 0xFF, 0x00, b'A', 0x00]).to_text(), "A");
+        assert_eq!(PdfString::literal(vec![0xFE, 0xFF]).to_text(), "");
+        assert_eq!(PdfString::literal(Vec::new()).to_text(), "");
+    }
+
     #[test]
     fn pdfdoc_encoding_high_range() {
         assert_eq!(PdfString::literal(vec![0x84, 0x92, 0xA0, b'A']).to_text(), "—™€A");
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index fa744a8a..ada3ae7e 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -520,7 +520,7 @@ impl<'a> Inspector<'a> {
     fn text(&self, d: &Dictionary, key: &[u8]) -> Option<String> {
         let o = self.resolve(d.get(key).ok()?);
         let s = match o {
-            Object::String(..) => lopdf::decode_text_string(o).ok()?,
+            Object::String(bytes, _) => text_string(bytes),
             Object::Name(n) => String::from_utf8_lossy(n).into_owned(),
             _ => return None,
         };
@@ -605,7 +605,10 @@ impl<'a> Inspector<'a> {
         if let Ok(Object::Array(pairs)) = node.get(b"Names").map(|o| self.resolve(o)) {
             for pair in pairs.chunks(2) {
                 if let [k, v] = pair {
-                    let key = lopdf::decode_text_string(self.resolve(k)).unwrap_or_default();
+                    let key = match self.resolve(k) {
+                        Object::String(bytes, _) => text_string(bytes),
+                        _ => String::new(),
+                    };
                     out.push((key, v));
                 }
             }
@@ -965,8 +968,16 @@ impl<'a> Inspector<'a> {
         };
         let value = match d.get(b"V").map(|v| self.resolve(v)) {
             Ok(Object::Name(n)) => Some(String::from_utf8_lossy(n).into_owned()),
-            Ok(v @ Object::String(..)) => lopdf::decode_text_string(v).ok(),
-            Ok(Object::Array(a)) => Some(a.iter().filter_map(|x| lopdf::decode_text_string(self.resolve(x)).ok()).collect::<Vec<_>>().join(", ")),
+            Ok(Object::String(bytes, _)) => Some(text_string(bytes)),
+            Ok(Object::Array(a)) => Some(
+                a.iter()
+                    .filter_map(|x| match self.resolve(x) {
+                        Object::String(bytes, _) => Some(text_string(bytes)),
+                        _ => None,
+                    })
+                    .collect::<Vec<_>>()
+                    .join(", "),
+            ),
             Ok(Object::Dictionary(_)) if kind == FieldKind::Signature => Some("signed".into()),
             _ => None,
         };
@@ -1112,6 +1123,12 @@ impl<'a> Inspector<'a> {
     }
 }
 
+/// A text string's value, decoded by the same rules as the engine's object model
+/// ([`pdfcraft_cos::PdfString::to_text`]) so the panels and outline editing agree.
+fn text_string(bytes: &[u8]) -> String {
+    pdfcraft_cos::PdfString::literal(bytes).to_text()
+}
+
 fn rect4(o: &Object) -> [f32; 4] {
     match o {
         Object::Array(a) if a.len() == 4 => {
@@ -1651,6 +1668,29 @@ trailer << /Root 1 0 R >>
         );
     }
 
+    #[test]
+    fn outline_titles_decode_every_text_string_encoding() {
+        // Issue #142: CJK bookmark titles showed as mojibake or with a stray BOM.
+        let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R >> endobj
+10 0 obj << /Type /Outlines /First 11 0 R /Last 16 0 R /Count 6 >> endobj
+11 0 obj << /Title <FEFF7B2C4E007AE0> /Parent 10 0 R /Next 12 0 R /Dest [3 0 R /Fit] >> endobj
+12 0 obj << /Title <EFBBBFE79BAEE5BD95> /Parent 10 0 R /Next 13 0 R /Dest [3 0 R /Fit] >> endobj
+13 0 obj << /Title <EFBBBF41FF42> /Parent 10 0 R /Next 14 0 R /Dest [3 0 R /Fit] >> endobj
+14 0 obj << /Title <E6A682E8BFB0> /Parent 10 0 R /Next 15 0 R /Dest [3 0 R /Fit] >> endobj
+15 0 obj << /Title <436166E9> /Parent 10 0 R /Next 16 0 R /Dest [3 0 R /Fit] >> endobj
+16 0 obj << /Title <FEFFFEFF0041> /Parent 10 0 R /Dest [3 0 R /Fit] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+        let info = inspect(Arc::new(pdf.to_vec()), None).expect("opens");
+        let titles: Vec<_> = info.outline.iter().map(|o| o.title.as_str()).collect();
+        // UTF-16BE, UTF-8 with BOM, invalid UTF-8 after a BOM (lossy, not dropped), BOM-less
+        // raw UTF-8, PDFDocEncoding Latin-1, and a doubled BOM.
+        assert_eq!(titles, ["第一章", "目录", "A\u{FFFD}B", "概述", "Café", "A"]);
+    }
+
     #[test]
     fn destination_points_map_to_the_displayed_page() {
         // A crop box away from the origin: x 100..400, y 50..450.

From 275cbcf323f63053079adf23a9092b77188da210 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 17:49:54 -0400
Subject: [PATCH 124/149] Refs #169: no form bar for push-button-only
 documents; Screen is not a comment (#615)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

LaTeX `animate` PDFs store each frame as a read-only push button and drive
them from a Screen annotation. PdfCraft showed "This document contains N
interactive form fields." because the bar counted any field, and listed
the Screen annotation in the Comments panel because only Link, Widget and
Popup were filtered out.

- The form-fields bar now needs at least one field that isn't a push
  button (something to fill in).
- Non-markup annotations (ISO 32000-2 §12.5.6: Screen, Movie, RichMedia,
  3D, PrinterMark, TrapNet, Watermark) are no longer comments, both when
  a document is inspected and when the comment list is rebuilt after an
  edit (new pdfcraft_annot::is_comment_subtype).

Playing the animation itself (page actions, timers) is out of scope here.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lib.rs         | 11 ++++-
 crates/annot/src/tests.rs       | 11 +++++
 crates/render/src/inspect.rs    |  6 ++-
 crates/ui-egui/src/canvas.rs    |  3 +-
 crates/ui-egui/tests/animate.rs | 79 +++++++++++++++++++++++++++++++++
 5 files changed, 106 insertions(+), 4 deletions(-)
 create mode 100644 crates/ui-egui/tests/animate.rs

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index 6b14dfaa..d0a0ae09 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -1793,7 +1793,14 @@ fn text_value(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
     (!s.is_empty()).then_some(s)
 }
 
-/// Every comment (not links, form widgets or pop-ups), ordered by page and then top edge.
+/// Whether an annotation subtype is a comment. Links, form widgets, pop-ups and the non-markup
+/// multimedia and print-production annotations (ISO 32000-2 §12.5.6: Screen, Movie, RichMedia,
+/// 3D, PrinterMark, TrapNet, Watermark) are not.
+pub fn is_comment_subtype(subtype: &str) -> bool {
+    !matches!(subtype, "Link" | "Widget" | "Popup" | "Screen" | "Movie" | "RichMedia" | "3D" | "PrinterMark" | "TrapNet" | "Watermark")
+}
+
+/// Every comment (see [`is_comment_subtype`]), ordered by page and then top edge.
 pub fn summaries(doc: &Document) -> Vec<Summary> {
     let mut out = Vec::new();
     let Ok(pages) = page_refs(doc) else { return out };
@@ -1802,7 +1809,7 @@ pub fn summaries(doc: &Document) -> Vec<Summary> {
             let obj = doc.resolve(entry);
             let Some(d) = obj.as_dict() else { continue };
             let Some(subtype) = d.name(b"Subtype").map(|s| String::from_utf8_lossy(s).into_owned()) else { continue };
-            if matches!(subtype.as_str(), "Link" | "Widget" | "Popup") {
+            if !is_comment_subtype(&subtype) {
                 continue;
             }
             let nums = |k: &[u8]| -> Vec<f32> {
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index 5990e0d0..93cc6497 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -919,3 +919,14 @@ fn redraw_keeps_shared_annotation_appearances_and_drops_stale_alternates() {
         }
     }
 }
+
+#[test]
+fn non_markup_annotations_are_not_comments() {
+    // #169: a LaTeX `animate` player's Screen annotation showed up in the Comments list.
+    for s in ["Link", "Widget", "Popup", "Screen", "Movie", "RichMedia", "3D", "PrinterMark", "TrapNet", "Watermark"] {
+        assert!(!is_comment_subtype(s), "{s}");
+    }
+    for s in ["Text", "FreeText", "Highlight", "Ink", "Stamp", "FileAttachment", "Redact", "Sound"] {
+        assert!(is_comment_subtype(s), "{s}");
+    }
+}
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index ada3ae7e..bd77a0f6 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -815,7 +815,11 @@ impl<'a> Inspector<'a> {
                     }
                     continue;
                 }
-                if matches!(subtype.as_str(), "Widget" | "Popup") {
+                // Not comments: form widgets, pop-ups and non-markup annotations such as the
+                // Screen annotation that drives a LaTeX `animate` player (keep in step with
+                // `pdfcraft_annot::is_comment_subtype`).
+                if matches!(subtype.as_str(), "Widget" | "Popup" | "Screen" | "Movie" | "RichMedia" | "3D" | "PrinterMark" | "TrapNet" | "Watermark")
+                {
                     continue;
                 }
                 let rect = rect4(self.resolve(d.get(b"Rect").unwrap_or(&Object::Null)));
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index e1747b99..1b936a8c 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2878,7 +2878,8 @@ fn notices(
             tl!("XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.").to_string(),
             true,
         ))
-    } else if !info.fields.is_empty() {
+    } else if info.fields.iter().any(|f| f.kind != pdfcraft_render::FieldKind::PushButton) {
+        // Push buttons alone (LaTeX `animate` frames, navigation buttons) leave nothing to fill in.
         Some((
             "text-cursor-input",
             crate::i18n::fmt(tl!("This document contains {n} interactive form fields."), &[("n", &info.fields.len().to_string())]),
diff --git a/crates/ui-egui/tests/animate.rs b/crates/ui-egui/tests/animate.rs
new file mode 100644
index 00000000..20008edd
--- /dev/null
+++ b/crates/ui-egui/tests/animate.rs
@@ -0,0 +1,79 @@
+//! LaTeX `animate` PDFs (#169): every field is a push button holding a frame and a Screen
+//! annotation drives the player. Nothing there can be filled in, so the form-fields bar stays
+//! away, and the Screen annotation is not a comment.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+/// A one-page PDF whose page has `/Annots [6 0 R …]` for each of `annots` (objects from 6 on)
+/// and whose AcroForm lists the widgets among them.
+fn pdf(annots: &[&str]) -> Vec<u8> {
+    let refs: Vec<String> = (0..annots.len()).map(|i| format!("{} 0 R", i + 6)).collect();
+    let fields: Vec<String> = annots.iter().enumerate().filter(|(_, a)| a.contains("/Widget")).map(|(i, _)| format!("{} 0 R", i + 6)).collect();
+    let mut objs: Vec<String> = vec![
+        format!("<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [{}] >> >>", fields.join(" ")),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Annots [{}] >>", refs.join(" ")),
+        "<< /Length 0 >>\nstream\n\nendstream".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 200 100] /Length 0 >>\nstream\n\nendstream".into(),
+    ];
+    objs.extend(annots.iter().map(|o| o.to_string()));
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn open(bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 800.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("animate.pdf", None, bytes).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+/// A frame of the player: a read-only push button (`/Ff 65537`), hidden unless `shown`.
+fn frame(name: &str, shown: bool) -> String {
+    let hidden = if shown { 4 } else { 6 };
+    format!("<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65537 /T ({name}) /F {hidden} /Rect [50 50 250 150] /P 3 0 R /AP << /N 5 0 R >> >>")
+}
+
+const SCREEN: &str = "<< /Type /Annot /Subtype /Screen /Rect [50 50 250 150] /P 3 0 R \
+     /AA << /PO << /S /JavaScript /JS (app.setInterval\\('a0_gotoNext\\(\\)', 500\\);) >> >> >>";
+
+#[test]
+fn push_buttons_alone_show_no_form_bar_and_a_screen_annotation_is_not_a_comment() {
+    let (a, b, c) = (frame("0.0", true), frame("0.1", false), frame("0.2", false));
+    let h = open(pdf(&[&a, &b, &c, SCREEN]));
+    {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!(doc.info.fields.len(), 3, "the frames are still fields");
+        assert!(doc.info.fields.iter().all(|f| f.kind == pdfcraft_render::FieldKind::PushButton));
+        assert!(doc.info.annotations.is_empty(), "no comments: {:?}", doc.info.annotations);
+    }
+    assert!(h.query_by_label_contains("interactive form fields").is_none(), "nothing to fill in, so no form bar");
+    assert!(h.query_by_label("Highlight fields").is_none());
+}
+
+#[test]
+fn a_fillable_field_beside_push_buttons_still_shows_the_form_bar() {
+    let button = frame("0.0", true);
+    let text = "<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /Rect [20 160 200 180] /P 3 0 R >>";
+    let h = open(pdf(&[&button, text, SCREEN]));
+    h.get_by_label_contains("This document contains 2 interactive form fields.");
+    h.get_by_label("Highlight fields");
+}

From 72d640f9f0cc3b078fc2d42233991d798f3557e7 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 17:57:02 -0400
Subject: [PATCH 125/149] Fix #155: edit text across content stream pieces
 (#628)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A page's /Contents array is one content stream in pieces that writers may
split between any two tokens (ISO 32000-2 §7.8.2). Edit text parsed each
piece on its own, so an operator whose operands ended one piece and whose
keyword started the next arrived with no operands: a `[(After) -20 (wards)]`
/ `TJ` split made the line vanish from text_lines, text_paragraphs and
text_edit, and from the Edit text tool.

The joined-parse logic the redaction interpreter used (#153) moves into
pdfcraft-content as `Pieces`: join the pieces, parse them as one stream,
map positions back to pieces, and splice joined byte ranges back into
per-piece bytes (an edit replacing or removing an operator that spans
pieces rewrites every piece it touches; untouched pieces keep their
objects). text_lines now interprets the joined operators, and replace_line
and rewrite_block splice through `Pieces`. Redaction uses the same helper.

Lines and paragraphs are grouped by the piece their first operator starts
in, as before, so pages whose pieces are separate drawings don't merge.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/tests/automation.rs |  42 +++++
 crates/content/src/lib.rs             |  94 +++++++++++
 crates/content/src/tests.rs           |  25 +++
 crates/edit/src/tests.rs              |  52 +++++-
 crates/edit/src/text.rs               | 234 ++++++++++++++------------
 crates/redact/src/interp.rs           |  15 +-
 parity/acrobat-features.toml          |   4 +-
 7 files changed, 341 insertions(+), 125 deletions(-)

diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 582e7a47..a8fcb6f7 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -1288,6 +1288,48 @@ fn editing_existing_text_through_tools() {
     assert_eq!(p["lines"].as_array().map(Vec::len), Some(2), "{p}");
 }
 
+/// One page whose content is one stream in three pieces (#155): a `TJ` array ends the middle
+/// piece and its operator starts the last one.
+fn split_streams_pdf() -> Vec<u8> {
+    let piece = |s: &str| format!("<< /Length {} >>\nstream\n{s}\nendstream", s.len());
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents [4 0 R 5 0 R 6 0 R] /Resources << /Font << /F1 7 0 R >> >> >>".into(),
+        piece("/P << /MCID 0"),
+        piece(">> BDC BT /F1 12 Tf 72 700 Td (Target) Tj 0 -20 Td [(After) -20 (wards)]"),
+        piece("TJ ET EMC"),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn a_line_split_across_content_streams_is_listed_and_edited() {
+    let dir = workdir("split-streams");
+    std::fs::write(dir.join("split.pdf"), split_streams_pdf()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "split.pdf" }))["doc"].as_u64().unwrap();
+    let lines = ok(&mut a, "text_lines", json!({ "doc": doc, "page": 1 }));
+    let texts: Vec<&str> = lines["lines"].as_array().unwrap().iter().filter_map(|l| l["text"].as_str()).collect();
+    assert_eq!(texts, ["Target", "Afterwards"], "{lines}");
+    let r = ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "line": 2, "text": "Later" }));
+    assert_eq!(r["line"]["text"], "Later");
+    assert_eq!(page_text(&mut a, doc)[0].split_whitespace().collect::<Vec<_>>(), ["Target", "Later"]);
+}
+
 #[test]
 fn paragraph_bold_without_font_keeps_the_source_family() {
     let dir = workdir("paragraph-bold");
diff --git a/crates/content/src/lib.rs b/crates/content/src/lib.rs
index 70e173d3..a56c952d 100644
--- a/crates/content/src/lib.rs
+++ b/crates/content/src/lib.rs
@@ -208,6 +208,100 @@ pub fn serialize_ops(ops: &[Op]) -> Vec<u8> {
     out
 }
 
+/// A page's content streams joined into the one stream they are. Writers may split it between
+/// any two tokens (ISO 32000-2 §7.8.2), so an operator's operands can end one piece and its
+/// keyword start the next: parse the pieces joined ([`Pieces::parse`]) and map positions back
+/// with [`Pieces::piece_of`]. A newline separates the pieces so tokens never run together.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Pieces {
+    data: Vec<u8>,
+    /// Where each piece ends in `data`, after its separator.
+    ends: Vec<usize>,
+}
+
+impl Pieces {
+    pub fn join<D: AsRef<[u8]>>(pieces: &[D]) -> Self {
+        let mut data = Vec::new();
+        let mut ends = Vec::with_capacity(pieces.len());
+        for p in pieces {
+            data.extend_from_slice(p.as_ref());
+            data.push(b'\n');
+            ends.push(data.len());
+        }
+        Pieces { data, ends }
+    }
+
+    /// The joined bytes (the spans of [`Pieces::parse`]'s operators index into them).
+    pub fn data(&self) -> &[u8] {
+        &self.data
+    }
+
+    /// How many pieces there are.
+    pub fn len(&self) -> usize {
+        self.ends.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.ends.is_empty()
+    }
+
+    /// Parse the pieces as one stream.
+    pub fn parse(&self) -> Parsed {
+        parse(&self.data)
+    }
+
+    /// The piece holding joined position `at` (the last piece for positions past the end).
+    pub fn piece_of(&self, at: usize) -> usize {
+        self.ends.iter().position(|&e| at < e).unwrap_or(self.ends.len().saturating_sub(1))
+    }
+
+    /// The pieces an operator spans: (the one its first token is in, the one its keyword is in).
+    pub fn pieces_of(&self, op: &Op) -> (usize, usize) {
+        (self.piece_of(op.span.start), self.piece_of(op.span.end.saturating_sub(1)))
+    }
+
+    /// The joined range of piece `i`, without its separator.
+    fn range(&self, i: usize) -> std::ops::Range<usize> {
+        let start = match i.checked_sub(1) {
+            None => 0,
+            Some(p) => self.ends.get(p).copied().unwrap_or(self.data.len()),
+        };
+        let end = self.ends.get(i).map_or(self.data.len(), |e| e.saturating_sub(1)).max(start);
+        start..end
+    }
+
+    /// Rebuild every piece after replacing joined byte ranges: `edits` are (range, bytes) in
+    /// ascending, non-overlapping order. A replacement goes into the piece its range starts in,
+    /// and the rest of a range that runs on into later pieces is removed from them, so an
+    /// operator split across pieces is replaced or removed whole. Everything else is copied byte
+    /// for byte. Returns every piece's new bytes (unchanged pieces come back equal).
+    pub fn splice(&self, edits: impl IntoIterator<Item = (std::ops::Range<usize>, Vec<u8>)>) -> Vec<Vec<u8>> {
+        let mut out: Vec<Vec<u8>> = (0..self.len()).map(|i| Vec::with_capacity(self.range(i).len())).collect();
+        let copy = |out: &mut Vec<Vec<u8>>, from: usize, to: usize| {
+            for (i, piece) in out.iter_mut().enumerate() {
+                let r = self.range(i);
+                let (a, b) = (from.max(r.start), to.min(r.end));
+                if a < b {
+                    piece.extend_from_slice(self.data.get(a..b).unwrap_or_default());
+                }
+            }
+        };
+        let mut at = 0;
+        for (range, bytes) in edits {
+            let start = range.start.clamp(at, self.data.len());
+            copy(&mut out, at, start);
+            if !bytes.is_empty()
+                && let Some(piece) = out.get_mut(self.piece_of(start))
+            {
+                piece.extend_from_slice(&bytes);
+            }
+            at = range.end.clamp(start, self.data.len());
+        }
+        copy(&mut out, at, self.data.len());
+        out
+    }
+}
+
 /// A number operand, written as an integer when it is one.
 pub fn num(v: f64) -> Object {
     if v.fract() == 0.0 && v.abs() < 1e15 { Object::Int(v as i64) } else { Object::Real((v * 10_000.0).round() / 10_000.0) }
diff --git a/crates/content/src/tests.rs b/crates/content/src/tests.rs
index 7a4a680f..e3c6d8d3 100644
--- a/crates/content/src/tests.rs
+++ b/crates/content/src/tests.rs
@@ -63,3 +63,28 @@ fn matrices_compose_and_invert() {
     assert!(overlaps([0.0, 0.0, 10.0, 10.0], [5.0, 5.0, 20.0, 20.0], 0.0));
     assert!(!overlaps([0.0, 0.0, 10.0, 10.0], [10.0, 0.0, 20.0, 10.0], 0.0));
 }
+
+#[test]
+fn pieces_parse_as_one_stream_and_splice_back() {
+    // An operator's operands end one piece and its keyword starts the next (§7.8.2).
+    let pieces = Pieces::join(&[&b"BT 72 700 Td [(After) -20 (wards)]"[..], b"TJ ET", b"q Q"]);
+    assert_eq!(pieces.len(), 3);
+    let ops = pieces.parse().ops;
+    let names: Vec<&[u8]> = ops.iter().map(|o| o.op.as_slice()).collect();
+    assert_eq!(names, [&b"BT"[..], b"Td", b"TJ", b"ET", b"q", b"Q"]);
+    assert_eq!(pieces.pieces_of(&ops[2]), (0, 1));
+    assert_eq!(pieces.pieces_of(&ops[3]), (1, 1));
+    assert_eq!(pieces.piece_of(usize::MAX), 2);
+    // Nothing changed: the pieces come back byte for byte.
+    assert_eq!(pieces.splice([]), [&b"BT 72 700 Td [(After) -20 (wards)]"[..], b"TJ ET", b"q Q"]);
+    // Replacing the split TJ rewrites both pieces it spans; the third is untouched.
+    let out = pieces.splice([(ops[2].span.clone(), b"(New) Tj".to_vec())]);
+    assert_eq!(out, [&b"BT 72 700 Td (New) Tj"[..], b" ET", b"q Q"]);
+    // Removing it leaves no stray operands or keyword.
+    let out = pieces.splice([(ops[2].span.clone(), Vec::new())]);
+    assert_eq!(out, [&b"BT 72 700 Td "[..], b" ET", b"q Q"]);
+    // Out-of-range or reversed edits are clamped, never a panic.
+    let out = pieces.splice([(std::ops::Range { start: 10, end: 5 }, b"x".to_vec()), (1000..2000, Vec::new())]);
+    assert_eq!(out.len(), 3);
+    assert!(Pieces::join::<&[u8]>(&[]).splice([(0..1, b"x".to_vec())]).is_empty());
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index e0e69f3a..c324aad6 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -790,10 +790,58 @@ fn editing_text_keeps_the_tokens_a_stream_shares_with_its_neighbours() {
     assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Target");
     text::replace_line(&mut doc, 0, 0, "Edited").unwrap();
     assert_split_tokens_kept(&reopen(&doc), "Edited");
-    // A paragraph rewrite rebuilds the same piece.
+    // A paragraph rewrite: "Target" and the line after it (split across pieces) are one
+    // paragraph, rewritten whole without stray tokens.
     let mut doc = split_streams_page();
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 1);
     text::replace_block(&mut doc, 0, 0, "Rewrapped").unwrap();
-    assert_split_tokens_kept(&reopen(&doc), "Rewrapped");
+    let (joined, ops) = joined_ops(&reopen(&doc));
+    assert!(joined.contains("Rewrapped") && !joined.contains("Target") && !joined.contains("wards"), "{joined}");
+    assert!(ops.iter().find(|o| o.is("BDC")).is_some_and(|o| o.operands.len() == 2), "{joined}");
+}
+
+/// The operators of the page's pieces joined back into one stream, each checked for operands.
+fn joined_ops(doc: &Document) -> (String, Vec<pdfcraft_content::Op>) {
+    let joined = streams(doc, 0).join("\n");
+    let ops = pdfcraft_content::parse(joined.as_bytes());
+    assert_eq!(ops.skipped, 0, "stray tokens: {joined}");
+    (joined, ops.ops)
+}
+
+#[test]
+fn a_line_whose_operator_starts_the_next_stream_can_be_edited() {
+    // #155: `[(After) -20 (wards)]` ends one piece and its `TJ` starts the next.
+    let doc = split_streams_page();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    assert_eq!(lines.iter().map(|l| l.text.as_str()).collect::<Vec<_>>(), ["Target", "Afterwards"]);
+    assert!(lines[1].rect[1] < lines[0].rect[1] && lines[1].rect[2] > lines[1].rect[0] + 40.0, "{:?}", lines[1].rect);
+
+    // Retyping it replaces the operator whole, in both pieces it spans.
+    let mut doc = split_streams_page();
+    text::replace_line(&mut doc, 0, 1, "Later").unwrap();
+    let doc = reopen(&doc);
+    let (joined, ops) = joined_ops(&doc);
+    assert!(!joined.contains("After") && !joined.contains("wards") && joined.contains("Target"), "{joined}");
+    assert!(ops.iter().filter(|o| o.is("TJ")).count() == 0, "{joined}");
+    assert!(ops.iter().find(|o| o.is("BDC")).is_some_and(|o| o.operands.len() == 2), "{joined}");
+    let lines = text::text_lines(&doc, 0).unwrap();
+    assert_eq!(lines.iter().map(|l| l.text.as_str()).collect::<Vec<_>>(), ["Target", "Later"]);
+    // The pieces stay pieces: the first is untouched, the marked content still closes.
+    let pieces = streams(&doc, 0);
+    assert_eq!(pieces.len(), 3);
+    assert_eq!(pieces[0].trim(), "/P << /MCID 0");
+    assert!(pieces[2].contains("EMC") && !pieces[2].contains("TJ"), "{pieces:?}");
+
+    // As a paragraph with the line before it: both lines are rewritten.
+    let mut doc = split_streams_page();
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    let last = blocks.iter().position(|b| b.text.contains("Afterwards")).unwrap();
+    text::replace_block(&mut doc, 0, last, "Rewrapped").unwrap();
+    let doc = reopen(&doc);
+    let (joined, ops) = joined_ops(&doc);
+    assert!(!joined.contains("wards") && joined.contains("Rewrapped"), "{joined}");
+    assert!(ops.iter().find(|o| o.is("BDC")).is_some_and(|o| o.operands.len() == 2), "{joined}");
+    assert!(text::text_lines(&doc, 0).unwrap().iter().any(|l| l.text == "Rewrapped"));
 }
 
 #[test]
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 2fe05ef6..449af022 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -13,7 +13,7 @@
 use std::collections::HashMap;
 use std::rc::Rc;
 
-use pdfcraft_content::{Matrix, Op, parse, serialize_ops};
+use pdfcraft_content::{Matrix, Op, Pieces, serialize_ops};
 use pdfcraft_cos::{Dict, Document, Object, PdfString, Stream};
 use pdfcraft_fonts::pdf::Metrics;
 use pdfcraft_fonts::{CraftFont, GlyphError, japanese_glyph_from};
@@ -38,6 +38,8 @@ pub struct TextLine {
     /// Whether new text in this font can only be shown by substituting another font (no
     /// Unicode mapping for the line, so nothing could be reused).
     pub decodable: bool,
+    /// The content stream piece the line starts in, and its operators (indices into the page's
+    /// streams parsed joined).
     stream: usize,
     ops: Vec<usize>,
     /// Where the line starts: text matrix (text space), the state there, and its `BT`.
@@ -167,32 +169,53 @@ fn content_streams(doc: &Document, page: &Dict) -> Vec<(Object, Vec<u8>)> {
         .collect()
 }
 
-/// Rewrite one of a page's content streams: `edit(i)` gives the operators to insert before
-/// operator `i` of `ops` (parsed from `data`) and whether to keep it. Everything else is copied
-/// byte for byte. A page's streams are one stream in pieces, split between any two tokens
-/// (ISO 32000-2 §7.8.2), so a piece can end with operands whose operator starts the next one,
-/// or start by closing a dictionary the previous one opened; those tokens belong to no operator
-/// parsed here and must stay where they are.
-fn splice(data: &[u8], ops: &[Op], mut edit: impl FnMut(usize) -> (Vec<Op>, bool)) -> Vec<u8> {
-    let mut out = Vec::with_capacity(data.len());
-    let mut at = 0;
+/// Rewrite a page's content (its streams joined, see [`Pieces`]): `edit(i)` gives the operators
+/// to insert before operator `i` of `ops` (parsed from the joined pieces) and whether to keep it.
+/// Everything else is copied byte for byte. A page's streams are one stream in pieces, split
+/// between any two tokens (ISO 32000-2 §7.8.2), so an operator's operands can end one piece and
+/// its keyword start the next; removing or replacing it rewrites every piece it spans. Returns
+/// each piece's new bytes.
+fn splice(pieces: &Pieces, ops: &[Op], mut edit: impl FnMut(usize) -> (Vec<Op>, bool)) -> Vec<Vec<u8>> {
+    let data = pieces.data();
+    let mut edits = Vec::new();
     for (i, op) in ops.iter().enumerate() {
         let (insert, keep) = edit(i);
         if insert.is_empty() && keep {
             continue;
         }
-        let start = op.span.start.clamp(at, data.len());
-        out.extend_from_slice(data.get(at..start).unwrap_or_default());
+        let mut bytes = Vec::new();
         if !insert.is_empty() {
-            if out.last().is_some_and(|b| !b.is_ascii_whitespace()) {
-                out.push(b'\n');
+            if op.span.start.checked_sub(1).and_then(|p| data.get(p)).is_some_and(|b| !b.is_ascii_whitespace()) {
+                bytes.push(b'\n');
             }
-            out.extend_from_slice(&serialize_ops(&insert));
+            bytes.extend_from_slice(&serialize_ops(&insert));
         }
-        at = if keep { start } else { op.span.end.clamp(start, data.len()) };
+        let end = if keep { op.span.start } else { op.span.end };
+        edits.push((op.span.start..end, bytes));
+    }
+    pieces.splice(edits)
+}
+
+/// The page's `/Contents` after a [`splice`]: pieces whose bytes changed become new streams
+/// (keeping their dictionaries), the others stay as they were.
+fn rewritten_contents(doc: &mut Document, streams: &[(Object, Vec<u8>)], new: Vec<Vec<u8>>) -> Object {
+    let mut contents: Vec<Object> = Vec::with_capacity(streams.len());
+    for ((obj, old), data) in streams.iter().zip(new) {
+        if *old == data {
+            contents.push(obj.clone());
+            continue;
+        }
+        let mut dict = match &*doc.resolve(obj) {
+            Object::Stream(s) => s.dict.clone(),
+            _ => Dict::new(),
+        };
+        dict.remove(b"Length");
+        contents.push(Object::Ref(doc.add(Object::Stream(Stream::flate(dict, &data)))));
+    }
+    match <[Object; 1]>::try_from(contents) {
+        Ok([one]) => one,
+        Err(many) => Object::Array(many),
     }
-    out.extend_from_slice(data.get(at..).unwrap_or_default());
-    out
 }
 
 fn page_dict(doc: &Document, page: usize) -> Result<pdfcraft_model::Page, EditError> {
@@ -436,59 +459,64 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
     let mut cache = HashMap::new();
     let mut lines: Vec<TextLine> = Vec::new();
     let mut carry = Carry::new();
-    for (si, (_, data)) in content_streams(doc, &p.dict).into_iter().enumerate() {
-        let ops = parse(&data).ops;
-        let shown = interpret(doc, &ops, &fonts_res, &mut cache, &mut carry);
-        let mut last: Option<(usize, f64, f64, f64)> = None; // (bt, baseline, end_x, size)
-        for s in shown {
-            let joins = last.is_some_and(|(bt, base, end, size)| {
-                bt == s.bt
-                    && lines.last().is_some_and(|l| l.font.as_bytes() == s.font.as_slice())
-                    && lines.last().is_some_and(|l| {
-                        (s.size - l.size).abs() < 0.01 && s.bold == l.bold && s.italic == l.italic && fill_color(&s.state.fill) == l.color
-                    })
-                    && (s.baseline - base).abs() < size * 0.3
-                    && s.start_x > end - size
-                    && s.start_x - end < size * 3.0
-            });
-            if joins && let Some(l) = lines.last_mut() {
-                let gap = s.start_x - last.map_or(s.start_x, |x| x.2);
-                if gap > l.size * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ') {
-                    l.text.push(' ');
-                }
-                l.text.push_str(&s.text);
-                l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
-                l.ops.push(s.op);
-                l.decodable &= s.decodable;
-                l.color = fill_color(&s.state.fill);
-            } else {
-                lines.push(TextLine {
-                    text: s.text.clone(),
-                    rect: s.rect,
-                    font: String::from_utf8_lossy(&s.font).into_owned(),
-                    base_font: s.base_font.clone(),
-                    size: s.size,
-                    bold: s.bold,
-                    italic: s.italic,
-                    color: fill_color(&s.state.fill),
-                    decodable: s.decodable,
-                    stream: si,
-                    ops: vec![s.op],
-                    origin: Origin {
-                        tm: s.tm.0,
-                        tlm: s.tlm.0,
-                        k: (s.tm.then(&s.state.ctm).0[2].powi(2) + s.tm.then(&s.state.ctm).0[3].powi(2)).sqrt(),
-                        ctm: s.state.ctm.0,
-                        baseline: s.baseline,
-                        x: s.start_x,
-                        state: TextState::of(&s.state),
-                        bt_op: s.bt_op,
-                        bt_state: TextState::of(&s.bt_state),
-                    },
-                });
+    // The streams are one stream in pieces (§7.8.2), split between any two tokens: parse them
+    // joined, so an operator whose operands end one piece still has them.
+    let pieces = Pieces::join(&content_streams(doc, &p.dict).into_iter().map(|(_, d)| d).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let shown = interpret(doc, &ops, &fonts_res, &mut cache, &mut carry);
+    let mut last: Option<(usize, usize, f64, f64, f64)> = None; // (piece, bt, baseline, end_x, size)
+    for s in shown {
+        // A line belongs to the piece its first operator starts in (lines in different pieces
+        // aren't joined or grouped, as before; editing rewrites every piece an edit touches).
+        let si = ops.get(s.op).map_or(0, |op| pieces.pieces_of(op).0);
+        let joins = last.is_some_and(|(piece, bt, base, end, size)| {
+            piece == si
+                && bt == s.bt
+                && lines.last().is_some_and(|l| l.font.as_bytes() == s.font.as_slice())
+                && lines.last().is_some_and(|l| {
+                    (s.size - l.size).abs() < 0.01 && s.bold == l.bold && s.italic == l.italic && fill_color(&s.state.fill) == l.color
+                })
+                && (s.baseline - base).abs() < size * 0.3
+                && s.start_x > end - size
+                && s.start_x - end < size * 3.0
+        });
+        if joins && let Some(l) = lines.last_mut() {
+            let gap = s.start_x - last.map_or(s.start_x, |x| x.3);
+            if gap > l.size * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ') {
+                l.text.push(' ');
             }
-            last = Some((s.bt, s.baseline, s.end_x, s.size.max(1.0)));
+            l.text.push_str(&s.text);
+            l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
+            l.ops.push(s.op);
+            l.decodable &= s.decodable;
+            l.color = fill_color(&s.state.fill);
+        } else {
+            lines.push(TextLine {
+                text: s.text.clone(),
+                rect: s.rect,
+                font: String::from_utf8_lossy(&s.font).into_owned(),
+                base_font: s.base_font.clone(),
+                size: s.size,
+                bold: s.bold,
+                italic: s.italic,
+                color: fill_color(&s.state.fill),
+                decodable: s.decodable,
+                stream: si,
+                ops: vec![s.op],
+                origin: Origin {
+                    tm: s.tm.0,
+                    tlm: s.tlm.0,
+                    k: (s.tm.then(&s.state.ctm).0[2].powi(2) + s.tm.then(&s.state.ctm).0[3].powi(2)).sqrt(),
+                    ctm: s.state.ctm.0,
+                    baseline: s.baseline,
+                    x: s.start_x,
+                    state: TextState::of(&s.state),
+                    bt_op: s.bt_op,
+                    bt_state: TextState::of(&s.bt_state),
+                },
+            });
         }
+        last = Some((si, s.bt, s.baseline, s.end_x, s.size.max(1.0)));
     }
     // Lines of only spaces aren't editable text.
     lines.retain(|l| !l.text.trim().is_empty());
@@ -695,9 +723,9 @@ pub fn replace_line(doc: &mut Document, page: usize, line: usize, text: &str) ->
     let mut res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
     let mut fonts_res = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
     let streams = content_streams(doc, &p.dict);
-    let (stream_obj, data) = streams.get(target.stream).cloned().ok_or_else(|| EditError::Invalid("the page's content changed".into()))?;
-    let ops = parse(&data).ops;
-    let first = target.ops[0];
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let first = target.ops.first().copied().filter(|i| *i < ops.len()).ok_or_else(|| EditError::Invalid("the page's content changed".into()))?;
     // The line's own font, when it can show every character.
     let font = fonts_res.get(target.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|d| Metrics::from_dict(doc, &d));
     let reused = font.as_ref().and_then(|m| m.encode(&text));
@@ -753,22 +781,14 @@ pub fn replace_line(doc: &mut Document, page: usize, line: usize, text: &str) ->
     // Rebuild: the line's first operator becomes the replacement, its others go. Copies of the
     // line drawn in the same area go too, so the replacement is all that shows.
     let drops = coincident_ops(&lines, std::slice::from_ref(&target.rect));
-    let new_data = splice(&data, &ops, |i| {
-        if i == first { (std::mem::take(&mut replacement), false) } else { (Vec::new(), !drops.get(&target.stream).is_some_and(|d| d.contains(&i))) }
-    });
-    let mut dict = match &*doc.resolve(&stream_obj) {
-        Object::Stream(s) => s.dict.clone(),
-        _ => Dict::new(),
-    };
-    dict.remove(b"Length");
-    let new = doc.add(Object::Stream(Stream::flate(dict, &new_data)));
-    let contents: Vec<Object> = streams.iter().enumerate().map(|(i, (o, _))| if i == target.stream { Object::Ref(new) } else { o.clone() }).collect();
+    let new_data = splice(&pieces, &ops, |i| if i == first { (std::mem::take(&mut replacement), false) } else { (Vec::new(), !drops.contains(&i)) });
+    let contents = rewritten_contents(doc, &streams, new_data);
     let page_ref = p.obj;
     if substituted.is_some() {
         res.set(b"Font".to_vec(), Object::Dict(fonts_res));
     }
     doc.update_dict(page_ref, |d| {
-        d.set(b"Contents".to_vec(), if contents.len() == 1 { contents[0].clone() } else { Object::Array(contents) });
+        d.set(b"Contents".to_vec(), contents);
         if substituted.is_some() {
             d.set(b"Resources".to_vec(), Object::Dict(res));
         }
@@ -781,13 +801,13 @@ fn font_size_before(ops: &[Op], at: usize) -> Option<f64> {
     ops[..at].iter().rev().find(|o| o.is("Tf")).and_then(|o| o.num(1))
 }
 
-/// The operators of every line drawn in the same area as one of `rects`, grouped by content
-/// stream. Documents sometimes draw a line more than once (fake bold, an invisible text layer),
-/// and a surviving copy would show the old text under the replaced line. Copies overlap a
-/// member's rect by more than half of the smaller rect; neighbouring lines share no area.
-fn coincident_ops(lines: &[TextLine], rects: &[[f64; 4]]) -> std::collections::HashMap<usize, std::collections::HashSet<usize>> {
+/// The operators of every line drawn in the same area as one of `rects`. Documents sometimes
+/// draw a line more than once (fake bold, an invisible text layer), and a surviving copy would
+/// show the old text under the replaced line. Copies overlap a member's rect by more than half of
+/// the smaller rect; neighbouring lines share no area.
+fn coincident_ops(lines: &[TextLine], rects: &[[f64; 4]]) -> std::collections::HashSet<usize> {
     let area = |r: [f64; 4]| ((r[2] - r[0]) * (r[3] - r[1])).max(0.0);
-    let mut drop = std::collections::HashMap::new();
+    let mut drop = std::collections::HashSet::new();
     for l in lines {
         let covered = rects.iter().any(|m| {
             let ix = (m[2].min(l.rect[2]) - m[0].max(l.rect[0])).max(0.0);
@@ -796,7 +816,7 @@ fn coincident_ops(lines: &[TextLine], rects: &[[f64; 4]]) -> std::collections::H
             small > 0.0 && ix * iy / small > 0.5
         });
         if covered {
-            drop.entry(l.stream).or_insert_with(std::collections::HashSet::new).extend(l.ops.iter().copied());
+            drop.extend(l.ops.iter().copied());
         }
     }
     drop
@@ -935,8 +955,8 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
     let mut res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
     let mut fonts_res = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
     let streams = content_streams(doc, &p.dict);
-    let (stream_obj, data) = streams.get(first.stream).cloned().ok_or_else(|| EditError::Invalid("the page's content changed".into()))?;
-    let ops = parse(&data).ops;
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
     let text = text.unwrap_or(&b.text).split(paragraph_separator).filter(|word| !word.is_empty()).collect::<Vec<_>>().join(" ");
     let o = &first.origin;
     let (font_name, old_size) = o.state.font.clone().ok_or_else(|| EditError::Invalid("the paragraph has no font".into()))?;
@@ -1117,18 +1137,18 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
     block_ops.push(Op::new("Q", vec![]));
     // The paragraph's operators go, and so does anything drawn in the same area (a fake-bold
     // second copy, an invisible text layer): the new text is all that may show.
-    let mut drop: std::collections::HashMap<usize, std::collections::HashSet<usize>> =
-        members.iter().flat_map(|l| [(l.stream, l.ops.iter().copied().collect::<std::collections::HashSet<_>>())]).collect();
     let member_rects: Vec<[f64; 4]> = members.iter().map(|l| l.rect).collect();
-    for (stream, ops) in coincident_ops(&lines, &member_rects) {
-        drop.entry(stream).or_default().extend(ops);
-    }
+    let mut drop = coincident_ops(&lines, &member_rects);
+    drop.extend(members.iter().flat_map(|l| l.ops.iter().copied()));
     // Text shown earlier in the same text object stays first: the paragraph then goes where it
     // was, between two halves of the text object, so it keeps its place in reading order.
     let start = first.ops.first().copied().unwrap_or(o.bt_op);
-    let split = ops.get(o.bt_op..start).unwrap_or_default().iter().enumerate().any(|(i, op)| {
-        matches!(op.op.as_slice(), b"Tj" | b"TJ" | b"'" | b"\"") && !drop.get(&first.stream).is_some_and(|d| d.contains(&(o.bt_op + i)))
-    });
+    let split = ops
+        .get(o.bt_op..start)
+        .unwrap_or_default()
+        .iter()
+        .enumerate()
+        .any(|(i, op)| matches!(op.op.as_slice(), b"Tj" | b"TJ" | b"'" | b"\"") && !drop.contains(&(o.bt_op + i)));
     // What the text after the paragraph expects: the state at its BT (or where it was split).
     let after = if split { &o.state } else { &o.bt_state };
     block_ops.extend(after.ops().into_iter().filter(|op| !op.is("Tf") || after.font.is_some()));
@@ -1138,23 +1158,17 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
         block_ops.push(Op::new("Tm", o.tlm.iter().map(|v| n(*v)).collect()));
     }
     let at = if split { start } else { o.bt_op };
-    let new_data = splice(&data, &ops, |i| {
+    let new_data = splice(&pieces, &ops, |i| {
         let insert = if i == at { std::mem::take(&mut block_ops) } else { Vec::new() };
-        (insert, drop.get(&first.stream).is_none_or(|d| !d.contains(&i)))
+        (insert, !drop.contains(&i))
     });
-    let mut dict = match &*doc.resolve(&stream_obj) {
-        Object::Stream(s) => s.dict.clone(),
-        _ => Dict::new(),
-    };
-    dict.remove(b"Length");
-    let new = doc.add(Object::Stream(Stream::flate(dict, &new_data)));
-    let contents: Vec<Object> = streams.iter().enumerate().map(|(i, (o, _))| if i == first.stream { Object::Ref(new) } else { o.clone() }).collect();
+    let contents = rewritten_contents(doc, &streams, new_data);
     if new_font {
         res.set(b"Font".to_vec(), Object::Dict(fonts_res));
     }
     let page_ref = p.obj;
     doc.update_dict(page_ref, |d| {
-        d.set(b"Contents".to_vec(), if contents.len() == 1 { contents[0].clone() } else { Object::Array(contents) });
+        d.set(b"Contents".to_vec(), contents);
         if new_font {
             d.set(b"Resources".to_vec(), Object::Dict(res));
         }
diff --git a/crates/redact/src/interp.rs b/crates/redact/src/interp.rs
index 3876c686..4a607ddd 100644
--- a/crates/redact/src/interp.rs
+++ b/crates/redact/src/interp.rs
@@ -20,7 +20,7 @@
 use std::collections::HashMap;
 use std::rc::Rc;
 
-use pdfcraft_content::{Matrix, Op, contains, num, overlaps, parse, serialize_ops, string};
+use pdfcraft_content::{Matrix, Op, Pieces, contains, num, overlaps, serialize_ops, string};
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
 
 use crate::{Report, image};
@@ -210,15 +210,8 @@ pub(crate) fn process(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec<
     // The streams are one content stream in pieces, which may be split between any two tokens
     // (ISO 32000-2 §7.8.2): an operator's operands can end one piece and the operator start the
     // next. Parse them joined, then give each operator back to the piece its keyword is in.
-    let mut joined: Vec<u8> = Vec::new();
-    let mut ends: Vec<usize> = Vec::with_capacity(streams.len());
-    for data in streams {
-        joined.extend_from_slice(data);
-        joined.push(b'\n');
-        ends.push(joined.len());
-    }
-    let piece_of = |at: usize| ends.iter().position(|&e| at < e).unwrap_or(ends.len().saturating_sub(1));
-    let mut parsed = parse(&joined);
+    let joined = Pieces::join(streams);
+    let mut parsed = joined.parse();
     if !scope.hidden_layers.is_empty() {
         let props = res_dict(doc, resources, b"Properties");
         let (kept, removed) = strip_hidden_layers(doc, scope, parsed.ops, &props);
@@ -231,7 +224,7 @@ pub(crate) fn process(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec<
     let mut pieces: Vec<Vec<Op>> = streams.iter().map(|_| Vec::new()).collect();
     let mut rewrite: Vec<bool> = vec![forced_change; streams.len()];
     for op in parsed.ops {
-        let (first, last) = (piece_of(op.span.start), piece_of(op.span.end.saturating_sub(1)));
+        let (first, last) = joined.pieces_of(&op);
         // An operator split across pieces is written whole into its keyword's piece, so every
         // piece it spans is rewritten.
         if first < last {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3a1e4f2e..ba32039e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1806,8 +1806,8 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.edit_text"]
 tools = ["text_lines", "text_paragraphs", "text_edit"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/editing.rs::editing_existing_text_in_place", "crates/automation/tests/automation.rs::editing_existing_text_through_tools"]
-notes = "click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next"
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/editing.rs::editing_existing_text_in_place", "crates/automation/tests/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/automation.rs::a_line_split_across_content_streams_is_listed_and_edited"]
+notes = "click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next"
 
 [[feature]]
 id = "edit.text-reflow"

From e7a15783f3ea51ddf502fe03fa4be8bb3eedcfa6 Mon Sep 17 00:00:00 2001
From: Books <sabaksa11@gmail.com>
Date: Sat, 10 Oct 2026 09:22:07 +1100
Subject: [PATCH 126/149] Export to Word/HTML/RTF: read text and images drawn
 by form XObjects (fixes #314) (#406)

* Export to Word/HTML/RTF: read text and images drawn by form XObjects (fixes #314)

The office export built its paragraphs from text_blocks and its images from
page_images. Both read only the page's own content streams (they back Edit
text and Edit image, which rewrite those streams), so a page drawn through
`/Fm1 Do`, as many print-to-PDF tools emit, exported as an empty document.

Add read-only reading_blocks and reading_images to pdfcraft-edit. They
follow Do into form XObjects (nested ones too), apply each form's /Matrix,
use its own /Resources (or the caller's when it has none), and start it
from the graphics state at the Do. Depth is capped at MAX_FORM_DEPTH and a
form already being read is skipped, so self-referencing and mutually
recursive forms are read once. export_pages uses them; editing is
unchanged and still offers only the page's own text and images.

* Export: a page's walk through form XObjects has a total visit budget, so forms that fan out can't hang it

* Export: keep the image walk within clippy's argument limit

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/edit/src/images.rs    |  74 +++++++++++++
 crates/edit/src/lib.rs       |   4 +-
 crates/edit/src/tests.rs     | 145 ++++++++++++++++++++++++++
 crates/edit/src/text.rs      | 196 ++++++++++++++++++++++++++++++++++-
 crates/engine/src/compare.rs |  14 +--
 crates/engine/src/tests.rs   |  28 +++++
 6 files changed, 449 insertions(+), 12 deletions(-)

diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index 7f3a2a69..d9ba9c96 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -142,6 +142,80 @@ pub fn page_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, EditEr
     Ok(out)
 }
 
+/// The images page `page` (0-based) shows, in drawing order, including those drawn inside form
+/// XObjects (Export to Word, HTML and RTF). Read-only: indexes into this list are not
+/// [`page_images`] indexes, so they can't be passed to [`change_image`].
+pub fn reading_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, EditError> {
+    /// The CTM and `q` stack carry from one page stream to the next (§7.8.2); a form starts
+    /// its own.
+    /// The forms being read (cycle guard) and how many were entered (the page's budget).
+    struct Forms {
+        path: Vec<ObjRef>,
+        visits: usize,
+    }
+    struct State {
+        ctm: Matrix,
+        stack: Vec<Matrix>,
+    }
+    fn walk(doc: &Document, data: &[u8], resources: &Dict, st: &mut State, stream: usize, forms: &mut Forms, out: &mut Vec<PageImage>) {
+        let xo = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+        let (ctm, stack) = (&mut st.ctm, &mut st.stack);
+        for (i, op) in parse(data).ops.iter().enumerate() {
+            match op.op.as_slice() {
+                b"q" => stack.push(*ctm),
+                b"Q" => *ctm = stack.pop().unwrap_or(*ctm),
+                b"cm" => {
+                    if let Some(m) = op.nums::<6>() {
+                        *ctm = Matrix(m).then(ctm);
+                    }
+                }
+                b"Do" => {
+                    let Some(name) = op.name(0) else { continue };
+                    if let Some(form) = crate::text::form_call(doc, resources, name, *ctm, &forms.path, &mut forms.visits) {
+                        if let Some(r) = form.obj {
+                            forms.path.push(r);
+                        }
+                        let mut inner = State { ctm: form.ctm, stack: Vec::new() };
+                        walk(doc, &form.data, &form.resources, &mut inner, stream, forms, out);
+                        if form.obj.is_some() {
+                            forms.path.pop();
+                        }
+                        continue;
+                    }
+                    let Some(r) = xo.get(name).and_then(Object::as_ref) else { continue };
+                    let obj = doc.get(r);
+                    let Object::Stream(s) = &*obj else { continue };
+                    if s.dict.name(b"Subtype") != Some(b"Image") {
+                        continue;
+                    }
+                    out.push(PageImage {
+                        rect: ctm.bbox([0.0, 0.0, 1.0, 1.0]),
+                        matrix: ctm.0,
+                        name: String::from_utf8_lossy(name).into_owned(),
+                        object: Some(r),
+                        is_form: false,
+                        width: s.dict.int(b"Width").unwrap_or(0).max(0) as u32,
+                        height: s.dict.int(b"Height").unwrap_or(0).max(0) as u32,
+                        stream,
+                        op: i,
+                        draw_matrix: ctm.0,
+                    });
+                }
+                _ => {}
+            }
+        }
+    }
+    let p = page_of(doc, page)?;
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let mut out = Vec::new();
+    let mut st = State { ctm: Matrix::IDENTITY, stack: Vec::new() };
+    let mut forms = Forms { path: Vec::new(), visits: 0 };
+    for (si, (_, data)) in streams(doc, &p.dict).into_iter().enumerate() {
+        walk(doc, &data, &res, &mut st, si, &mut forms, &mut out);
+    }
+    Ok(out)
+}
+
 /// What to do with an image.
 #[derive(Clone, Debug, PartialEq)]
 pub enum ImageChange {
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index dfdec9ed..532b3248 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -614,9 +614,9 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
 mod flatten;
 pub use flatten::{flatten, flatten_fill_sign};
 pub mod images;
-pub use images::{ImageChange, PageImage, change_image, page_images, rect_to_rect, turn_about_centre};
+pub use images::{ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre};
 pub mod text;
-pub use text::{BlockStyle, LineEdit, TextBlock, TextLine, replace_block, replace_line, rewrite_block, text_blocks, text_lines};
+pub use text::{BlockStyle, LineEdit, TextBlock, TextLine, reading_blocks, replace_block, replace_line, rewrite_block, text_blocks, text_lines};
 pub mod added;
 pub use added::{Added, AddedImage, AddedText, Align, Content, Family, add_content, delete_content, first_undrawable, list_added, update_content};
 
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index c324aad6..4378eb25 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -1429,3 +1429,148 @@ fn fill_sign_flatten_bakes_marks_keeps_other_comments_and_does_not_reuse_pcfl0()
     assert!(summaries(&doc).iter().any(|s| s.intent.as_deref() == Some("FreeTextTypeWriter")), "the hidden typewriter stays");
     assert_eq!(summaries(&doc).iter().filter(|s| s.intent.as_deref() == Some("FreeTextTypeWriter")).count(), 1);
 }
+
+/// A one-page document from its objects (object 1 is the catalog).
+fn build(objs: &[&str]) -> Document {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+fn stream(dict: &str, data: &str) -> String {
+    format!("<< {dict} /Length {} >>\nstream\n{data}\nendstream", data.len())
+}
+
+/// #314: text and images drawn by (nested) form XObjects are read for export, placed through
+/// every form matrix and set in each form's own fonts; editing still sees only the page's text.
+#[test]
+fn reading_follows_form_xobjects() {
+    let page = stream("", "q 1 0 0 1 10 0 cm /Fm1 Do Q BT /F1 12 Tf 72 100 Td (Page text) Tj ET");
+    let fm1 = stream(
+        "/Type /XObject /Subtype /Form /BBox [0 0 600 800] /Matrix [1 0 0 1 0 50] /Resources << /Font << /F1 7 0 R >> /XObject << /Fm2 8 0 R >> >>",
+        "BT /F1 18 Tf 72 700 Td (Hello from a test invoice) Tj ET /Fm2 Do",
+    );
+    let fm2 = stream(
+        "/Type /XObject /Subtype /Form /BBox [0 0 300 400] /Matrix [2 0 0 2 0 0] /Resources << /Font << /F2 9 0 R >> /XObject << /Im1 10 0 R >> >>",
+        "BT /F2 10 Tf 50 100 Td (Nested) Tj ET q 20 0 0 10 5 5 cm /Im1 Do Q",
+    );
+    let image = stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", "A");
+    let doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Resources << /Font << /F1 5 0 R >> /XObject << /Fm1 6 0 R >> >> /Contents 4 0 R >>",
+        &page,
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Courier >>",
+        &fm1,
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
+        &fm2,
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Times-Bold >>",
+        &image,
+    ]);
+    let close = |a: f64, b: f64| (a - b).abs() < 0.01;
+
+    let blocks = text::reading_blocks(&doc, 0).unwrap();
+    let texts: Vec<&str> = blocks.iter().map(|b| b.text.as_str()).collect();
+    assert_eq!(texts, ["Hello from a test invoice", "Nested", "Page text"]);
+    let (hello, nested, own) = (&blocks[0], &blocks[1], &blocks[2]);
+    // Hello: (72, 700) moved by the form's (0, 50) and the page's (10, 0).
+    assert_eq!(hello.base_font, "Helvetica", "the form's own /F1, not the page's");
+    assert!(close(hello.rect[0], 82.0) && close(hello.size, 18.0), "{hello:?}");
+    // Nested: (50, 100) doubled by Fm2, then Fm1 and the page: (110, 250), 20 pt.
+    assert_eq!(nested.base_font, "Times-Bold");
+    assert!(nested.bold);
+    assert!(close(nested.rect[0], 110.0) && close(nested.size, 20.0), "{nested:?}");
+    assert_eq!(own.base_font, "Courier");
+
+    let images = images::reading_images(&doc, 0).unwrap();
+    assert_eq!(images.len(), 1, "{images:?}");
+    let r = images[0].rect;
+    assert!(close(r[0], 20.0) && close(r[1], 60.0) && close(r[2], 60.0) && close(r[3], 80.0), "{r:?}");
+    assert_eq!((images[0].width, images[0].height), (1, 1));
+
+    // Editing works on the page's own streams only, unchanged.
+    let editable: Vec<String> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(editable, ["Page text"]);
+    // The page draws one figure of its own (Fm1, edited as a whole); the image inside Fm2 is not
+    // a page image.
+    let own = images::page_images(&doc, 0).unwrap();
+    assert_eq!(own.len(), 1, "{own:?}");
+    assert!(own[0].is_form && own[0].object == Some(pdfcraft_cos::ObjRef::new(6, 0)), "{own:?}");
+}
+
+/// A chain of forms, each drawing the next twenty times, twelve deep: within the depth cap but
+/// 20^11 visits without a budget. Reading stops at the page's visit budget instead of hanging.
+#[test]
+fn form_xobjects_that_fan_out_stop_at_the_visit_budget() {
+    let font = "/Font << /F1 5 0 R >>";
+    let levels = 12;
+    let mut objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Resources << /Font << /F1 5 0 R >> /XObject << /N 6 0 R >> >> /Contents 4 0 R >>"
+            .to_string(),
+        stream("", "/N Do"),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
+    ];
+    for level in 0..levels {
+        let next = 7 + level;
+        objs.push(if level + 1 == levels {
+            stream(&format!("/Subtype /Form /BBox [0 0 9 9] /Resources << {font} >>"), "BT /F1 10 Tf 10 10 Td (leaf) Tj ET")
+        } else {
+            stream(&format!("/Subtype /Form /BBox [0 0 9 9] /Resources << {font} /XObject << /N {next} 0 R >> >>"), &"/N Do ".repeat(20))
+        });
+    }
+    let refs: Vec<&str> = objs.iter().map(String::as_str).collect();
+    let doc = build(&refs);
+    let start = std::time::Instant::now();
+    let _ = text::reading_blocks(&doc, 0).unwrap();
+    assert!(images::reading_images(&doc, 0).unwrap().is_empty());
+    assert!(start.elapsed() < std::time::Duration::from_secs(30), "took {:?}", start.elapsed());
+}
+
+/// Forms that draw themselves or each other, have no resources, a malformed matrix, or are
+/// missing are read once (or skipped) without panicking or looping.
+#[test]
+fn hostile_form_xobjects_are_read_once() {
+    let page = stream("", "/Loop Do /A Do /NoRes Do /Bad Do /Missing Do /F1 Do");
+    let font = "/Font << /F1 5 0 R >>";
+    let lp = stream(
+        &format!("/Subtype /Form /BBox [0 0 9 9] /Resources << {font} /XObject << /Loop 6 0 R >> >>"),
+        "/Loop Do BT /F1 10 Tf 10 10 Td (once) Tj ET",
+    );
+    let a = stream(
+        &format!("/Subtype /Form /BBox [0 0 9 9] /Resources << {font} /XObject << /B 8 0 R >> >>"),
+        "/B Do BT /F1 10 Tf 10 100 Td (from a) Tj ET",
+    );
+    let b = stream(
+        &format!("/Subtype /Form /BBox [0 0 9 9] /Resources << {font} /XObject << /A 7 0 R >> >>"),
+        "/A Do BT /F1 10 Tf 10 200 Td (from b) Tj ET",
+    );
+    let nores = stream("/Subtype /Form /BBox [0 0 9 9]", "BT /F1 10 Tf 10 300 Td (inherited) Tj ET");
+    let bad = stream(&format!("/Subtype /Form /BBox [0 0 9 9] /Matrix [1 0 0] /Resources << {font} >>"), "BT /F1 10 Tf 10 400 Td (bad matrix) Tj ET");
+    let doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Resources << /Font << /F1 5 0 R >> /XObject << /Loop 6 0 R /A 7 0 R /NoRes 9 0 R /Bad 10 0 R >> >> /Contents 4 0 R >>",
+        &page,
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
+        &lp,
+        &a,
+        &b,
+        &nores,
+        &bad,
+    ]);
+    let texts: Vec<String> = text::reading_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["once", "from b", "from a", "inherited", "bad matrix"]);
+    assert!(images::reading_images(&doc, 0).unwrap().is_empty());
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 449af022..3168db63 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -13,7 +13,7 @@
 use std::collections::HashMap;
 use std::rc::Rc;
 
-use pdfcraft_content::{Matrix, Op, Pieces, serialize_ops};
+use pdfcraft_content::{Matrix, Op, Pieces, parse, serialize_ops};
 use pdfcraft_cos::{Dict, Document, Object, PdfString, Stream};
 use pdfcraft_fonts::pdf::Metrics;
 use pdfcraft_fonts::{CraftFont, GlyphError, japanese_glyph_from};
@@ -295,7 +295,17 @@ impl Carry {
     }
 }
 
-fn interpret(doc: &Document, ops: &[Op], fonts_res: &Dict, cache: &mut HashMap<Vec<u8>, Rc<Metrics>>, carry: &mut Carry) -> Vec<Shown> {
+/// A `Do` met while interpreting: its operator index, XObject name and the state there.
+type Invocation = (usize, Vec<u8>, Ts);
+
+fn interpret(
+    doc: &Document,
+    ops: &[Op],
+    fonts_res: &Dict,
+    cache: &mut HashMap<Vec<u8>, Rc<Metrics>>,
+    carry: &mut Carry,
+    mut invoked: Option<&mut Vec<Invocation>>,
+) -> Vec<Shown> {
     let mut out = Vec::new();
     let mut ts = carry.ts.clone();
     let mut at_bt = (0usize, ts.clone());
@@ -346,6 +356,11 @@ fn interpret(doc: &Document, ops: &[Op], fonts_res: &Dict, cache: &mut HashMap<V
             b"Tz" => ts.scale = op.num(0).unwrap_or(100.0) / 100.0,
             b"TL" => ts.leading = op.num(0).unwrap_or(0.0),
             b"Ts" => ts.rise = op.num(0).unwrap_or(0.0),
+            b"Do" => {
+                if let (Some(list), Some(name)) = (invoked.as_deref_mut(), op.name(0)) {
+                    list.push((i, name.to_vec(), ts.clone()));
+                }
+            }
             b"Td" | b"TD" => {
                 if let Some([x, y]) = op.nums::<2>() {
                     if op.is("TD") {
@@ -463,7 +478,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
     // joined, so an operator whose operands end one piece still has them.
     let pieces = Pieces::join(&content_streams(doc, &p.dict).into_iter().map(|(_, d)| d).collect::<Vec<_>>());
     let ops = pieces.parse().ops;
-    let shown = interpret(doc, &ops, &fonts_res, &mut cache, &mut carry);
+    let shown = interpret(doc, &ops, &fonts_res, &mut cache, &mut carry, None);
     let mut last: Option<(usize, usize, f64, f64, f64)> = None; // (piece, bt, baseline, end_x, size)
     for s in shown {
         // A line belongs to the piece its first operator starts in (lines in different pieces
@@ -523,6 +538,173 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
     Ok(lines)
 }
 
+/// The line `s` continues, or a new one: `last` is the previous run of the same stream
+/// (`bt`, baseline, end x, size).
+fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<(usize, f64, f64, f64)>, s: Shown, stream: usize) {
+    let joins = last.is_some_and(|(bt, base, end, size)| {
+        bt == s.bt
+            && lines.last().is_some_and(|l| l.font.as_bytes() == s.font.as_slice())
+            && lines
+                .last()
+                .is_some_and(|l| (s.size - l.size).abs() < 0.01 && s.bold == l.bold && s.italic == l.italic && fill_color(&s.state.fill) == l.color)
+            && (s.baseline - base).abs() < size * 0.3
+            && s.start_x > end - size
+            && s.start_x - end < size * 3.0
+    });
+    if joins && let Some(l) = lines.last_mut() {
+        let gap = s.start_x - last.map_or(s.start_x, |x| x.2);
+        if gap > l.size * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ') {
+            l.text.push(' ');
+        }
+        l.text.push_str(&s.text);
+        l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
+        l.ops.push(s.op);
+        l.decodable &= s.decodable;
+        l.color = fill_color(&s.state.fill);
+    } else {
+        lines.push(TextLine {
+            text: s.text.clone(),
+            rect: s.rect,
+            font: String::from_utf8_lossy(&s.font).into_owned(),
+            base_font: s.base_font.clone(),
+            size: s.size,
+            bold: s.bold,
+            italic: s.italic,
+            color: fill_color(&s.state.fill),
+            decodable: s.decodable,
+            stream,
+            ops: vec![s.op],
+            origin: Origin {
+                tm: s.tm.0,
+                tlm: s.tlm.0,
+                k: (s.tm.then(&s.state.ctm).0[2].powi(2) + s.tm.then(&s.state.ctm).0[3].powi(2)).sqrt(),
+                ctm: s.state.ctm.0,
+                baseline: s.baseline,
+                x: s.start_x,
+                state: TextState::of(&s.state),
+                bt_op: s.bt_op,
+                bt_state: TextState::of(&s.bt_state),
+            },
+        });
+    }
+    *last = Some((s.bt, s.baseline, s.end_x, s.size.max(1.0)));
+}
+
+/// How deep form XObjects nest before reading stops (they may also refer to themselves).
+pub(crate) const MAX_FORM_DEPTH: usize = 12;
+
+/// The most form XObjects one page's walk enters, at any depth. The depth cap alone still lets
+/// a form that draws another form many times fan out exponentially (100 `Do`s on each of 12
+/// levels), which would hang export on a hostile PDF.
+pub(crate) const MAX_FORM_VISITS: usize = 4096;
+
+/// A form XObject a page draws: its object, content, resources and its matrix composed with the
+/// CTM at the `Do`.
+pub(crate) struct FormCall {
+    pub(crate) obj: Option<pdfcraft_cos::ObjRef>,
+    pub(crate) data: Vec<u8>,
+    pub(crate) resources: Dict,
+    pub(crate) ctm: Matrix,
+}
+
+/// The form XObject `name` in `resources`, drawn with `ctm`. `None` for images, missing names
+/// and forms already being read (`path`), nested too deep, or past the page's `visits` budget
+/// ([`MAX_FORM_VISITS`]); each form entered counts one visit.
+pub(crate) fn form_call(
+    doc: &Document,
+    resources: &Dict,
+    name: &[u8],
+    ctm: Matrix,
+    path: &[pdfcraft_cos::ObjRef],
+    visits: &mut usize,
+) -> Option<FormCall> {
+    if path.len() >= MAX_FORM_DEPTH || *visits >= MAX_FORM_VISITS {
+        return None;
+    }
+    let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned())?;
+    let o = xobjects.get(name)?;
+    let obj = o.as_ref();
+    if obj.is_some_and(|r| path.contains(&r)) {
+        return None;
+    }
+    let Object::Stream(s) = &*doc.resolve(o) else { return None };
+    if s.dict.name(b"Subtype") != Some(b"Form") {
+        return None;
+    }
+    let m = s.dict.get(b"Matrix").map(|m| doc.resolve(m)).and_then(|m| {
+        let a = m.as_array()?;
+        let v: Vec<f64> = a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect();
+        <[f64; 6]>::try_from(v).ok().filter(|v| v.iter().all(|x| x.is_finite()))
+    });
+    // A form without its own resources uses the ones it was drawn with (PDF 1.1 files).
+    let own = s.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned());
+    *visits = visits.saturating_add(1);
+    Some(FormCall {
+        obj,
+        data: s.decoded().unwrap_or_default(),
+        resources: own.unwrap_or_else(|| resources.clone()),
+        ctm: m.map_or(ctm, |m| Matrix(m).then(&ctm)),
+    })
+}
+
+/// The lines a page shows as it reads, including text drawn by form XObjects (which
+/// [`text_lines`] leaves out because it can only rewrite the page's own streams). Lines from a
+/// form carry a stream number past the page's streams, one per form drawn.
+fn reading_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditError> {
+    struct Walk<'a> {
+        doc: &'a Document,
+        lines: Vec<TextLine>,
+        next_stream: usize,
+        path: Vec<pdfcraft_cos::ObjRef>,
+        visits: usize,
+    }
+    fn walk(w: &mut Walk, ops: &[Op], resources: &Dict, carry: &mut Carry, stream: usize) {
+        let fonts_res = resources.get(b"Font").map(|f| w.doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+        let mut cache = HashMap::new();
+        let mut invoked = Vec::new();
+        let shown = interpret(w.doc, ops, &fonts_res, &mut cache, carry, Some(&mut invoked));
+        let mut last = None;
+        let mut forms = invoked.into_iter().peekable();
+        for s in shown {
+            while let Some((_, name, ts)) = forms.next_if(|f| f.0 < s.op) {
+                enter(w, resources, &name, ts);
+                // Text after a form starts a new line.
+                last = None;
+            }
+            add_shown(&mut w.lines, &mut last, s, stream);
+        }
+        for (_, name, ts) in forms {
+            enter(w, resources, &name, ts);
+        }
+    }
+    fn enter(w: &mut Walk, resources: &Dict, name: &[u8], ts: Ts) {
+        let Some(form) = form_call(w.doc, resources, name, ts.ctm, &w.path, &mut w.visits) else { return };
+        let ops = parse(&form.data).ops;
+        // The form starts with the graphics state at its `Do`, its own matrix applied.
+        let mut carry = Carry { ts: Ts { ctm: form.ctm, ..ts }, stack: Vec::new() };
+        let stream = w.next_stream;
+        w.next_stream = w.next_stream.saturating_add(1);
+        if let Some(r) = form.obj {
+            w.path.push(r);
+        }
+        walk(w, &ops, &form.resources, &mut carry, stream);
+        if form.obj.is_some() {
+            w.path.pop();
+        }
+    }
+    let p = page_dict(doc, page)?;
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let streams = content_streams(doc, &p.dict);
+    let mut w = Walk { doc, lines: Vec::new(), next_stream: streams.len(), path: Vec::new(), visits: 0 };
+    let mut carry = Carry::new();
+    for (si, (_, data)) in streams.into_iter().enumerate() {
+        walk(&mut w, &parse(&data).ops, &res, &mut carry, si);
+    }
+    let mut lines = w.lines;
+    lines.retain(|l| !l.text.trim().is_empty());
+    Ok(lines)
+}
+
 /// Text → the bytes that show it in the chosen font.
 type Encoder = Box<dyn Fn(&str) -> Option<Vec<u8>>>;
 
@@ -828,6 +1010,14 @@ pub fn text_blocks(doc: &Document, page: usize) -> Result<Vec<TextBlock>, EditEr
     Ok(group_blocks(&lines))
 }
 
+/// The paragraphs on a page as a reader sees them, including text drawn by form XObjects
+/// (Export to Word, HTML and RTF). Read-only: indexes into this list are not
+/// [`text_blocks`] indexes, so they can't be passed to [`replace_block`] or [`rewrite_block`].
+pub fn reading_blocks(doc: &Document, page: usize) -> Result<Vec<TextBlock>, EditError> {
+    let lines = reading_lines(doc, page)?;
+    Ok(group_blocks(&lines))
+}
+
 /// Lines that share a left edge, a centre or a right edge (left, centred or right-aligned text).
 fn aligned(a: &TextLine, b: &TextLine) -> bool {
     let tol = b.size.max(1.0);
diff --git a/crates/engine/src/compare.rs b/crates/engine/src/compare.rs
index 7da14c82..c11fc261 100644
--- a/crates/engine/src/compare.rs
+++ b/crates/engine/src/compare.rs
@@ -150,7 +150,8 @@ impl OfficeFormat {
 }
 
 impl crate::Document {
-    /// The pages as paragraphs and images (for Word, HTML and RTF export).
+    /// The pages as paragraphs and images (for Word, HTML and RTF export), including what
+    /// form XObjects draw.
     pub fn export_pages(&self) -> Vec<pdfcraft_export::Page> {
         let Some(cos) = self.editor.as_ref().map(|e| &e.cos) else { return Vec::new() };
         self.info
@@ -158,7 +159,7 @@ impl crate::Document {
             .iter()
             .enumerate()
             .map(|(i, info)| {
-                let blocks = pdfcraft_edit::text_blocks(cos, i)
+                let blocks = pdfcraft_edit::reading_blocks(cos, i)
                     .unwrap_or_default()
                     .into_iter()
                     .filter(|b| !b.text.trim().is_empty())
@@ -174,12 +175,11 @@ impl crate::Document {
                         }
                     })
                     .collect();
-                let images = self
-                    .page_images(i)
+                let images = pdfcraft_edit::reading_images(cos, i)
+                    .unwrap_or_default()
                     .iter()
-                    .enumerate()
-                    .filter_map(|(k, im)| {
-                        let (ext, bytes) = self.page_image_file(i, k).ok()?;
+                    .filter_map(|im| {
+                        let (ext, bytes) = pdfcraft_create::image_file(cos, im.object?).ok()?;
                         Some(pdfcraft_export::Image { ext: if ext == "jpg" { "jpg" } else { "png" }, bytes, rect: im.rect })
                     })
                     .collect();
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index ad7e0806..0cff7d7c 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1761,6 +1761,34 @@ fn exporting_office_files_keeps_images() {
     assert!(String::from_utf8(d.export_office(compare::OfficeFormat::Html)).unwrap().contains("data:image/png;base64,"));
 }
 
+/// #314: a page whose content is drawn through a form XObject exports its text (the file from
+/// the report: no xref table, wrong stream lengths).
+#[test]
+fn exporting_office_files_reads_form_xobjects() {
+    let pdf = b"%PDF-1.4
+1 0 obj <</Type/Catalog/Pages 2 0 R>> endobj
+2 0 obj <</Type/Pages/Kids[3 0 R]/Count 1>> endobj
+3 0 obj <</Type/Page/Parent 2 0 R/MediaBox[0 0 595 842]/Resources<</XObject<</Fm1 7 0 R>>>>/Contents 5 0 R>> endobj
+4 0 obj <</Type/Font/Subtype/Type1/BaseFont/Helvetica/Encoding/WinAnsiEncoding>> endobj
+5 0 obj <</Length 22>> stream
+q 1 0 0 1 0 0 cm /Fm1 Do Q
+endstream endobj
+7 0 obj <</Type/XObject/Subtype/Form/BBox[0 0 595 842]/Resources<</Font<</F1 4 0 R>>>>/Length 60>> stream
+BT /F1 18 Tf 72 760 Td (Hello from a test invoice) Tj ET
+endstream endobj
+trailer <</Root 1 0 R>>
+%%EOF
+";
+    let mut s = Session::new();
+    let id = s.open("form.pdf", None, Arc::new(pdf.to_vec()), None).unwrap();
+    let d = s.get(id).unwrap();
+    let blocks: Vec<String> = d.export_pages()[0].blocks.iter().map(|b| b.text.clone()).collect();
+    assert_eq!(blocks, ["Hello from a test invoice"]);
+    assert!(String::from_utf8(d.export_office(compare::OfficeFormat::Html)).unwrap().contains("Hello from a test invoice"));
+    // Edit text still offers only what the page's own streams show.
+    assert!(d.text_blocks(0).is_empty());
+}
+
 #[test]
 fn exporting_office_files_keeps_text_colour() {
     // #526: a dark green heading came out black in Word.

From c3a717a0931225870672ae3d2efcf7c6f45c485a Mon Sep 17 00:00:00 2001
From: feraremag2680 <feraremag@gmail.com>
Date: Sat, 10 Oct 2026 00:37:24 +0200
Subject: [PATCH 127/149] tests: pin the interface language in the harnesses
 added since #502 (#593)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* tests: pin the interface language in the harnesses added since #502

#502 pinned it in every harness there was. These five arrived after its
branch point, so the suite is red again on a machine whose display
language has a catalog:

- `commands.rs`, Clear Recent Files from the menu (#557).
- `editing.rs`, `session_harness` (#462), which clicks "Don't save".
- `stamps.rs`, the rotated-stamp test (#473), which clicks "OK".
- `ui.rs`, removing one recent file from Home (#557), and the narrow tab
  strip (#416), which reads "Display theme:".

The eight other `PdfCraftApp::new()` without the line never draw the
shell, so `i18n::set_current` is never called and the thread-local stays
on English. They compare saved state or a default, and are left alone —
including the one that asserts on a `notify_tr` toast, which reads
English for the same reason.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* tests: pin the interface language in the date-format and Pages-panel harnesses too

---------

Co-authored-by: Fernando Areán <soporte@codebit.es>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/tests/commands.rs    | 1 +
 crates/ui-egui/tests/date_format.rs | 3 +++
 crates/ui-egui/tests/editing.rs     | 1 +
 crates/ui-egui/tests/stamps.rs      | 1 +
 crates/ui-egui/tests/ui.rs          | 2 ++
 crates/ui-egui/tests/viewer.rs      | 1 +
 6 files changed, 9 insertions(+)

diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index 7119821e..310602d8 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -251,6 +251,7 @@ fn recent_file(name: &str) -> pdfcraft_ui_egui::RecentFile {
 fn clear_recent_files_at_the_foot_of_open_recent_empties_the_list() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
         app.recent.extend([recent_file("first.pdf"), recent_file("second.pdf")]);
         app
diff --git a/crates/ui-egui/tests/date_format.rs b/crates/ui-egui/tests/date_format.rs
index 161784c3..aa523d45 100644
--- a/crates/ui-egui/tests/date_format.rs
+++ b/crates/ui-egui/tests/date_format.rs
@@ -30,6 +30,7 @@ fn retype(h: &mut Harness<'static, PdfCraftApp>, text: &str) {
 fn fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, PDF.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         app.set_option("dialog", "preferences").unwrap();
@@ -99,6 +100,7 @@ fn fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered()
 fn month_names_follow_the_date_language_or_else_the_interface_language() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.set_option("date-format", "d mmmm yyyy").unwrap();
         app.set_option("language", "cs").unwrap();
         app.set_option("dialog", "preferences").unwrap();
@@ -130,6 +132,7 @@ fn month_names_follow_the_date_language_or_else_the_interface_language() {
 fn a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, PDF.to_vec()).expect("opens");
         app.set_option("left", "closed").unwrap();
         // Japanese weekday names: Fill & Sign text can't hold them yet.
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 668852bb..61410be2 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -416,6 +416,7 @@ impl Drop for TempPdfs {
 fn session_harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.reopen_last_session = true;
         setup(&mut app);
         app
diff --git a/crates/ui-egui/tests/stamps.rs b/crates/ui-egui/tests/stamps.rs
index 66144da5..46798e8c 100644
--- a/crates/ui-egui/tests/stamps.rs
+++ b/crates/ui-egui/tests/stamps.rs
@@ -49,6 +49,7 @@ fn natural_image_stamps_keep_displayed_bounds_on_rotated_pages() {
     for degrees in [0, 90, 180, 270] {
         let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
             let id = app.views[0].id;
             app.session.apply(id, pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees }).unwrap();
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 970c5173..46a5e3dc 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -72,6 +72,7 @@ fn home_removes_one_recent_file_or_clears_them_all() {
     // Tall enough that the Recent list is on screen without scrolling.
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1600.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         for name in ["first.pdf", "second.pdf", "third.pdf"] {
             app.recent.push(pdfcraft_ui_egui::RecentFile { name: name.into(), path: format!("/nowhere/{name}"), pages: 1, size: 0 });
         }
@@ -176,6 +177,7 @@ fn narrow_tab_strips_accept_vertical_wheel_scrolling() {
     for width in [600.0, 900.0] {
         let mut h = Harness::builder().with_size(egui::vec2(width, 700.0)).build_eframe(|_cc| {
             let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
             for i in 0..12 {
                 app.open_bytes(&format!("narrow-{i:02}.pdf"), None, FIXTURE.to_vec()).unwrap();
             }
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index ebac7540..af89def4 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -682,6 +682,7 @@ fn pages_panel_harness(sizes: &[(u32, u32)]) -> Harness<'static, PdfCraftApp> {
     let bytes = sized_fixture(sizes);
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
         app.open_bytes("cheques.pdf", None, bytes).unwrap();
         app.right = Some(pdfcraft_ui_egui::RightPanel::Pages);
         app

From 445673fe1b160f0b676a4f6f5b5bc285de7699b2 Mon Sep 17 00:00:00 2001
From: Dmytro <140102908+dmatviichuk@users.noreply.github.com>
Date: Sat, 10 Oct 2026 00:38:18 +0200
Subject: [PATCH 128/149] M14: clarify Ukrainian wording and restore CI (#584)

* M14: clarify Ukrainian certificate and accessibility wording

Distinguish the certificate holder from the document topic, translate
fixed certificate types, and clarify fingerprints, keyboard access,
table sections and equal field sizes. Validate the complete catalog
with VESUM 6.8.6 and review technical-word exceptions in context.

Fixes #503
Follow-up to #509

Co-authored-by: Codex <noreply@openai.com>

* M14: restore CI after merged test changes

Keep one byte-identical copy of each appearance regression test instead
of five definitions, preserving all three test bodies and assertions.
Correct MCP resource parity evidence to the existing passing test name.

Co-authored-by: Codex <noreply@openai.com>

* ROADMAP: drop the CI follow-up sentence (main fixed the duplicated tests and MCP evidence in #605/#608)

---------

Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml               |  2 +-
 ROADMAP.md                     |  4 +++-
 crates/ui-egui/src/i18n/mod.rs |  2 ++
 crates/ui-egui/src/i18n/uk.tsv | 13 ++++++++-----
 crates/ui-egui/src/sign_ui.rs  |  2 +-
 5 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 26abaaa8..7aa5e915 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "750c7229170e1ffd96b140ed13f0ce85a7c04a5223ed2648a75c96e2c0d65140"
+sha256 = "55fb645e8983bd4396c3d70a7a53040bd260476b198d3cf2cf5d223f909e7436"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index b3b29ad1..1225b19f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -106,7 +106,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 165–290 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 23% | 155–295 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 33–66 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Hungarian and Ukrainian catalogs have ≈1,800–2,000 entries each; Simplified Chinese, French, German, Hungarian and Ukrainian coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog; Ukrainian locales (`uk`, `uk_UA`) follow the Ukrainian one. #307 (bounded large-PDF memory): share resource indexes and native parser metadata, inspect structure lazily, bound scan/full-save caches and raster storage, and reuse signature discovery safely. Three Linux trials retain full-save workflow RSS at 1.06 GiB (previously 3.69 GiB); rebased engine navigation uses 821 MiB (previously 997 MiB). With the RSS guard removed, the unmodified baseline was kernel OOM-killed in a 15 GiB container; rebased optimized inspection completed at 497.7 MiB in 1.78 s. Strict Clippy, 1,336 workspace tests and 30 WASM crate checks pass. The larger-host follow-up is closed. File-backed input, global memory budgets and Windows validation remain pending. Missing: more catalogs filled in, installers, performance budgets |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Hungarian and Ukrainian catalogs have ≈1,800–2,100 entries each; Simplified Chinese, French, German, Hungarian and Ukrainian coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog; Ukrainian locales (`uk`, `uk_UA`) follow the Ukrainian one; its certificate and accessibility wording has a dictionary-checked follow-up. #307 (bounded large-PDF memory): share resource indexes and native parser metadata, inspect structure lazily, bound scan/full-save caches and raster storage, and reuse signature discovery safely. Three Linux trials retain full-save workflow RSS at 1.06 GiB (previously 3.69 GiB); rebased engine navigation uses 821 MiB (previously 997 MiB). With the RSS guard removed, the unmodified baseline was kernel OOM-killed in a 15 GiB container; rebased optimized inspection completed at 497.7 MiB in 1.78 s. Strict Clippy, 1,336 workspace tests and 30 WASM crate checks pass. The larger-host follow-up is closed. File-backed input, global memory budgets and Windows validation remain pending. Missing: more catalogs filled in, installers, performance budgets |
 | | **Total (original plan sizing)** | **2,085–3,840** | **≈ 35%** | **≈ 1,350–2,500 at the planned rate; ≈ 600–1,100 at the measured rate** | |
 
 **Overall progress: about 30–35% of the effort (51.0% of features shipped).** The viewer and the core are far ahead of the editing features, because the viewer was built first so progress could be seen; rendering itself is still borrowed from `hayro`. See [Honest assessment](#honest-assessment-2026-10-05).
@@ -184,6 +184,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (community, M5, #158):** Fill & Sign date format. Preferences ▸ Date format sets the pattern Fill & Sign dates use: 12 presets or any pattern in Acrobat date letters (with `\` escapes), checked and previewed as typed, remembered, and settable through `fill_sign_date_format`, `fill_sign_add` `format`/`language` and `ui set date-format`/`date-language`. Month and weekday names come in the interface languages (Czech in the genitive after a day), following the interface language unless one is picked. Fill & Sign text is still Helvetica/WinAnsi, so a date with other letters (Czech ř, Japanese, Chinese) is refused with a warning rather than saved as "?". This goes past Acrobat, whose Fill & Sign has no format setting. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M14, #503 follow-up):** Reviewed the complete Ukrainian catalog with VESUM 6.8.6 and manually checked the labels added when #509 landed. Certificate Subject now names the certificate holder separately from the document topic; certificate types and fingerprints, equal field sizes, keyboard/assistive-technology guidance and table sections use clearer contextual wording. Reviewed technical compounds and abbreviations remain unchanged. Overall effort estimate remains about 30–35%.
+
 - **2026-10-09 (community, Home pinned folders):** Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, M14, Telugu):** Telugu (తెలుగు, `te`) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; `te` and `te_IN` locales follow it. Telugu text is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index da944c6e..c17bab23 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -1640,6 +1640,8 @@ mod tests {
         assert_eq!(tr_ctx(uk, "comment menu", "Edit"), "Редагувати");
         assert_eq!(tr_ctx(uk, "signature pad", "Type"), "Ввести");
         assert_eq!(tr_ctx(uk, "action wizard", "Start"), "Почати");
+        assert_eq!(tr(uk, "Subject"), "Тема");
+        assert_eq!(tr_ctx(uk, "certificate", "Subject"), "Власник сертифіката");
         let mut app = crate::PdfCraftApp::default();
         app.set_option("language", "UK").unwrap();
         assert_eq!(app.language, "uk");
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 1dc65fc0..080f8997 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2090,17 +2090,19 @@ calendar date	December	грудня
 	The Windows store's digital IDs couldn't be listed: {e}	Не вдалося отримати список цифрових посвідчень зі сховища Windows: {e}
 	Align fields	Вирівняти поля
 	Distribute fields	Розподілити поля
-	Match field sizes	Вирівняти розміри полів
+	Match field sizes	Задати однакові розміри полів
 	Mark for redaction	Позначити для вилучення вмісту
 	Mark pages for redaction	Позначити сторінки для вилучення вмісту
 	Change document properties	Змінити властивості документа
 	Mark differences	Позначити відмінності
 	Run form script	Виконати сценарій форми
-	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Вміст зі сценаріями має бути доступним із клавіатури та допоміжних технологій. Перевірте сценарії документа.
-	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Рядки таблиці мають бути безпосередньо в таблиці або в її заголовку, тілі чи підсумку. Виправте теги таблиці.
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Вміст зі сценаріями має бути доступним для керування за допомогою клавіатури й допоміжних технологій. Перевірте сценарії документа.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Рядки таблиці мають належати безпосередньо таблиці або її заголовній, основній чи нижній частині. Виправте теги таблиці.
 	Basic constraints	Основні обмеження
-	SHA-1 digest	Дайджест SHA-1
-	SHA-256 digest	Дайджест SHA-256
+	Certificate authority	Центр сертифікації
+	End entity	Кінцевий суб’єкт
+	SHA-1 digest	Відбиток SHA-1
+	SHA-256 digest	Відбиток SHA-256
 	Squiggly	Хвилясте
 	Home / End	Home / End
 	H / Space (hold)	H / Пробіл (утримувати)
@@ -2125,3 +2127,4 @@ calendar date	December	грудня
 	Printer properties	Властивості принтера
 	Reset to printer defaults	Скинути до налаштувань принтера за замовчуванням
 	This printer offers no settings of its own.	Цей принтер не має власних налаштувань.
+certificate	Subject	Власник сертифіката
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/sign_ui.rs
index bb453ff1..36b7fc87 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/sign_ui.rs
@@ -1071,7 +1071,7 @@ pub(crate) fn cert_viewer(ui: &mut egui::Ui, v: &mut CertViewer, trusted: &[Cert
                         ("Validity starts", c.not_before.to_string()),
                         ("Validity ends", c.not_after.to_string()),
                         ("Public key", c.public_key.describe()),
-                        ("Basic constraints", if c.is_ca { "Certificate authority".into() } else { "End entity".into() }),
+                        ("Basic constraints", tl!(if c.is_ca { "Certificate authority" } else { "End entity" }).to_string()),
                         ("Key usage", c.key_usage.map(key_usage).unwrap_or_else(|| tl!("Not present").to_string())),
                         ("Self-signed", if c.is_self_signed() { tl!("Yes").to_string() } else { tl!("No").to_string() }),
                         ("SHA-1 digest", hex(&sign::keys::DigestAlg::Sha1.digest(&[&c.raw]))),

From b0548e64a76fe86581e7ebdbea12308cb2a3fd2e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rk=20Bartalos?= <bartalos86@gmail.com>
Date: Sat, 10 Oct 2026 00:39:31 +0200
Subject: [PATCH 129/149] M14: correct Hungarian Windows Store and
 saved-signature labels (#595)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M14: correct Hungarian Windows Store and saved-signature labels

Follow-up to the Magyar catalog: the certificate list keeps the name Windows Store, saved signature and initials labels take the substituted noun, and the squiggly comment type names the underline.

* hu: keep "Windows-tároló" — "Windows store" is the certificate store, not Microsoft's app store

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml               | 2 +-
 crates/ui-egui/src/i18n/hu.tsv | 6 +++---
 crates/ui-egui/src/i18n/mod.rs | 4 ++++
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 7aa5e915..f8f3781c 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6c2860945882f12af506be1830182ddb6c783a524f718ee0c0540bf781400641"
+sha256 = "54561c1c94ad81a6e452e42cb9d9d49ef5417d4d4b08a1b71cadba1327b85499"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index e2f73712..eae14c39 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2052,8 +2052,8 @@ action wizard	Start	Indítás
 # Labels that reach tl!() through a variable (Fill & Sign buttons, link prompts, notices, history labels, checker and certificate rows)
 	Add {what}	{what} hozzáadása
 	Use {what}	{what} használata
-	Place saved {what}	Mentett elem elhelyezése: {what}
-	Remove saved {what}	Mentett elem eltávolítása: {what}
+	Place saved {what}	Mentett {what} elhelyezése
+	Remove saved {what}	Mentett {what} eltávolítása
 	A link	Egy hivatkozás
 	A button	Egy gomb
 	A script	Egy szkript
@@ -2079,7 +2079,7 @@ action wizard	Start	Indítás
 	Basic constraints	Alapvető korlátozások
 	SHA-1 digest	SHA-1 kivonat
 	SHA-256 digest	SHA-256 kivonat
-	Squiggly	Hullámos
+	Squiggly	Hullámos aláhúzás
 	Home / End	Home / End
 	H / Space (hold)	H / szóköz (nyomva tartva)
 	Rotation:	Elforgatás:
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index c17bab23..93931b66 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -1526,6 +1526,10 @@ mod tests {
         assert_eq!(tr(hu, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
         assert_eq!(tr_ctx(hu, "signature pad", "Type"), "Gépelés");
         assert_eq!(tr_ctx(hu, "action wizard", "Start"), "Indítás");
+        assert_eq!(tr(hu, "Windows store  ·  "), "Windows-tároló  ·  ");
+        assert_eq!(tr(hu, "Place saved {what}"), "Mentett {what} elhelyezése");
+        assert_eq!(tr(hu, "Remove saved {what}"), "Mentett {what} eltávolítása");
+        assert_eq!(tr(hu, "Squiggly"), "Hullámos aláhúzás");
         // one (1), other (0, 2+)
         assert_eq!((0..=3).map(|n| (hu.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
         assert_eq!(trn(hu, 0, "{n} page", "{n} pages"), "0 oldal");

From 8b04e3cba4095282ea36745ec04a8490d0497d6d Mon Sep 17 00:00:00 2001
From: Thorsten Hirsch <t.hirsch@web.de>
Date: Sat, 10 Oct 2026 00:40:12 +0200
Subject: [PATCH 130/149] M9: chain building checks CA constraints, key usage,
 path length and validity (#620)

* M9: chain building checks CA constraints, key usage, path length and validity

build_chain linked certificates by name and signature only. An issuer must
also be allowed to issue: basicConstraints CA:TRUE (an old v1 self-signed
root without constraints still anchors), keyCertSign when there is a key
usage, a pathLenConstraint that allows the CAs below it, and validity at the
signing time (or the trusted timestamp / token time) when it is known.

Without this, an ordinary end-entity certificate of a trusted CA, embedded in
a PDF, could "issue" a certificate for any identity and chain to the trusted
root. The signature details now say why an issuer was refused.

Tests issue certificates in-process and cover each refusal, plus a signed PDF
whose signer chains through an end-entity certificate (Unknown, not Valid).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LXAstazhuAFyakty2m93Af

* M9: unreadable keyUsage, pathLen or basicConstraints fail closed; only v1/v2 self-signed certificates count as old roots

- a present keyUsage that doesn't parse allows no usage (it was unrestricted)
- a present pathLenConstraint that doesn't parse allows no CA below (it was unlimited)
- basicConstraints counts as present before it is parsed, so a garbled one can't make a
  certificate look like an old root
- the self-signed-without-basicConstraints exception applies to v1/v2 certificates only
- restores the load_certificates doc comment

Tests build v1 certificates when they have no extensions, as real old roots are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M9: clippy: slice from a reference in the chain test

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                 |   2 +
 crates/sign/README.md      |   6 +
 crates/sign/src/pdf.rs     |  21 +++-
 crates/sign/src/x509.rs    |  99 +++++++++++++--
 crates/sign/tests/chain.rs | 241 +++++++++++++++++++++++++++++++++++++
 5 files changed, 353 insertions(+), 16 deletions(-)
 create mode 100644 crates/sign/tests/chain.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 1225b19f..707cbc4b 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -168,6 +168,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 Newest first. One line per session: the date, what moved, and the new overall percentage.
 
+- **2026-10-09 (M9, review of #144):** Chain building checks what an issuer may do. `x509::build_chain` linked certificates by name and signature only, so an ordinary subscriber certificate embedded in a PDF, or one in the trusted list, could "issue" a certificate for any identity and chain to a trusted root. An issuer now needs basicConstraints CA:TRUE (an old v1 self-signed root without constraints still anchors), keyCertSign when it has a key usage, a pathLenConstraint that allows the CAs below it, and validity at the signing time (or the trusted timestamp/token time) when known; the signature's details say why an issuer was refused. Negative tests issue certificates in-process and cover each refusal, plus a signed PDF whose signer chains through an end-entity certificate (Unknown, not Valid). Still missing: key usage and extended key usage of the signer, name constraints and unknown critical extensions. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (M14, German interface follow-up):** Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.
 
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
diff --git a/crates/sign/README.md b/crates/sign/README.md
index f77e5232..6e8e785b 100644
--- a/crates/sign/README.md
+++ b/crates/sign/README.md
@@ -53,6 +53,12 @@ ECDSA P-256/P-384; the store integration is tested with software-backed keys.
   revisions are diffed against the signed one, and the changes are classified (signing, form
   fill, comments, metadata, page content, document structure) under the DocMDP permissions.
   The verdict follows Acrobat: valid, unknown (intact but the identity isn't trusted) or invalid.
+- **Chains are checked, not just linked.** `x509::build_chain` only takes an issuer whose key
+  verifies the certificate below it *and* that may issue: `basicConstraints` CA:TRUE (an old v1
+  self-signed root without constraints counts), `keyCertSign` when it has a key usage, a
+  `pathLenConstraint` that allows the CAs below it, and, given the signing time, validity then.
+  Certificates embedded in a document are in the pool too, so an ordinary subscriber certificate
+  can never vouch for another one; when an issuer is refused, the signature's details say why.
 
 Oracles: poppler's `pdfsig` reports our signatures valid; OpenSSL reads our `.p12` files and
 verifies our CMS; `tests/data/openssl-signed.pdf` is a signature OpenSSL made, which we validate.
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index d10475ae..2881b7cf 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -21,7 +21,7 @@ use crate::cms::SignedData;
 use crate::der::Time;
 use crate::keys::DigestAlg;
 use crate::pkcs12::DigitalId;
-use crate::x509::{Certificate, build_chain};
+use crate::x509::{Certificate, build_chain, build_chain_noted};
 
 #[cfg(test)]
 #[path = "pdf_discovery_tests.rs"]
@@ -536,8 +536,9 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
                     // own claimed time, as without a timestamp.
                     let mut pool = crate::timestamp::token_certs(raw);
                     pool.extend(trust.certs.iter().cloned());
-                    let trusted_tsa =
-                        t.signer_certificate().is_some_and(|c| c.valid_at(t.gen_time) && build_chain(&c, &pool).iter().any(|x| trust.trusts(x)));
+                    let trusted_tsa = t
+                        .signer_certificate()
+                        .is_some_and(|c| c.valid_at(t.gen_time) && build_chain(&c, &pool, Some(t.gen_time)).iter().any(|x| trust.trusts(x)));
                     if trusted_tsa {
                         info.timestamp_time = Some(t.gen_time);
                     } else {
@@ -576,13 +577,20 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
     info.signing_time = s.signing_time.or_else(|| info.date.as_deref().and_then(Time::from_pdf));
     let mut pool = sd.certificates.clone();
     pool.extend(trust.certs.iter().cloned());
-    let chain: Vec<Certificate> = build_chain(&cert, &pool).into_iter().cloned().collect();
+    // The time the chain is judged at: trusted timestamp, else the signer's claimed time.
+    let at = info.timestamp_time.or(info.signing_time);
+    let (chain, refused) = build_chain_noted(&cert, &pool, at);
+    let chain: Vec<Certificate> = chain.into_iter().cloned().collect();
     let trusted = chain.iter().any(|c| trust.trusts(c));
     info.chain = chain;
     info.certificate = Some(cert.clone());
+    if let Some(why) = refused
+        && !trusted
+    {
+        info.details.push(why);
+    }
     // Revocation evidence embedded in the document security store, if any. A verified
     // revocation is final: later blocks must not soften the verdict.
-    let at = info.timestamp_time.or(info.signing_time);
     let signer = info.chain.first().cloned();
     let revoked = check_dss_revocation(doc, signer.as_ref(), &at, info);
     // Changes after signing.
@@ -773,7 +781,8 @@ fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut Sig
         // ordinary signature from an unknown signer.
         let mut pool = crate::timestamp::token_certs(&contents);
         pool.extend(trust.certs.iter().cloned());
-        let trusted_tsa = token.signer_certificate().map(|c| build_chain(&c, &pool).iter().any(|x| trust.trusts(x))).unwrap_or(false);
+        let trusted_tsa =
+            token.signer_certificate().map(|c| build_chain(&c, &pool, Some(token.gen_time)).iter().any(|x| trust.trusts(x))).unwrap_or(false);
         if trusted_tsa {
             info.status = Status::Valid;
             info.details.push("The timestamp token is valid and its authority is trusted.".into());
diff --git a/crates/sign/src/x509.rs b/crates/sign/src/x509.rs
index ee5d00b8..1b9848a1 100644
--- a/crates/sign/src/x509.rs
+++ b/crates/sign/src/x509.rs
@@ -117,6 +117,11 @@ pub struct Certificate {
     pub public_key: PublicKey,
     /// Basic constraints: a CA certificate.
     pub is_ca: bool,
+    /// Whether the certificate has a basicConstraints extension at all (old v1 roots don't).
+    pub has_basic_constraints: bool,
+    /// Basic constraints `pathLenConstraint`: how many CA certificates may follow this one
+    /// before the end-entity certificate.
+    pub path_len: Option<u32>,
     /// Key usage bits (bit 0 = digitalSignature, 1 = nonRepudiation, 5 = keyCertSign), if present.
     pub key_usage: Option<u16>,
     pub subject_key_id: Option<Vec<u8>>,
@@ -128,6 +133,8 @@ pub struct Certificate {
     pub ocsp_urls: Vec<String>,
     /// CRL distribution point URLs (2.5.29.31).
     pub crl_urls: Vec<String>,
+    /// The `version` field: 0 for v1, 1 for v2, 2 for v3.
+    pub version: u64,
 }
 
 /// The certificate extensions `Certificate::parse` reads, gathered tolerantly: an
@@ -137,6 +144,8 @@ pub struct Certificate {
 #[derive(Default)]
 struct Extensions {
     is_ca: bool,
+    has_basic_constraints: bool,
+    path_len: Option<u32>,
     key_usage: Option<u16>,
     subject_key_id: Option<Vec<u8>>,
     authority_key_id: Option<Vec<u8>>,
@@ -149,10 +158,21 @@ impl Extensions {
     fn read(&mut self, oid: &str, value: &Tlv<'_>) {
         match oid {
             "2.5.29.19" => {
+                // Present at all, even when it doesn't parse: a malformed basicConstraints must
+                // not make a certificate look like an old v1 root (which may issue). Unparsed,
+                // it stays "not a CA".
+                self.has_basic_constraints = true;
                 let Ok(bc) = Tlv::parse_all(value.value) else { return };
-                self.is_ca = bc.children().is_ok_and(|c| c.first().is_some_and(|b| b.tag == tag::BOOLEAN && b.value != [0]));
+                let fields = bc.children().unwrap_or_default();
+                self.is_ca = fields.first().is_some_and(|b| b.tag == tag::BOOLEAN && b.value != [0]);
+                // pathLenConstraint is the INTEGER after the optional cA BOOLEAN. One that is
+                // present but unreadable (negative, too long) allows no CA below, not any number.
+                self.path_len = fields.iter().find(|t| t.tag == tag::INTEGER).map(|t| t.u64().map_or(0, |n| u32::try_from(n).unwrap_or(u32::MAX)));
             }
             "2.5.29.15" => {
+                // A keyUsage that is present restricts the key even when it doesn't parse: an
+                // unreadable one allows no usage at all, never every usage.
+                self.key_usage = Some(0);
                 let Ok(bits) = Tlv::parse_all(value.value) else { return };
                 let Some((_, b)) = bits.value.split_first() else { return };
                 // Bit 0 is the most significant bit of the first byte.
@@ -231,8 +251,11 @@ impl Certificate {
         let parts = cert.children()?;
         let [tbs, sig_alg, sig] = parts.as_slice() else { return Err(SignError::Malformed("Certificate".into())) };
         let mut f = tbs.children()?.into_iter().peekable();
+        // version [0] EXPLICIT INTEGER DEFAULT v1 (0); v3 is 2. Unreadable counts as v3, the
+        // stricter reading (no v1-root exception in `may_issue`).
+        let mut version = 0u64;
         if f.peek().is_some_and(|t| t.tag == tag::ctx(0)) {
-            f.next();
+            version = f.next().and_then(|v| v.inner().ok()).and_then(|v| v.u64().ok()).unwrap_or(2);
         }
         let serial = f.next().ok_or_else(|| SignError::Malformed("serial".into()))?.expect(tag::INTEGER, "serial")?.value.to_vec();
         let _inner_alg = f.next();
@@ -255,7 +278,17 @@ impl Certificate {
                 ext.read(o.as_str(), value);
             }
         }
-        let Extensions { is_ca, key_usage, subject_key_id, authority_key_id, extended_key_usage, ocsp_urls, crl_urls } = ext;
+        let Extensions {
+            is_ca,
+            has_basic_constraints,
+            path_len,
+            key_usage,
+            subject_key_id,
+            authority_key_id,
+            extended_key_usage,
+            ocsp_urls,
+            crl_urls,
+        } = ext;
         Ok(Certificate {
             raw: raw.to_vec(),
             tbs: tbs.raw.to_vec(),
@@ -268,12 +301,15 @@ impl Certificate {
             not_after: na.time()?,
             public_key,
             is_ca,
+            has_basic_constraints,
+            path_len,
             key_usage,
             subject_key_id,
             authority_key_id,
             extended_key_usage,
             ocsp_urls,
             crl_urls,
+            version,
         })
     }
 
@@ -289,6 +325,17 @@ impl Certificate {
         key.verify(scheme, digest, &digest.digest(&[&self.tbs]), &self.signature).unwrap_or(false)
     }
 
+    /// Whether this certificate may issue certificates (RFC 5280 §4.2.1.9, §4.2.1.3): it is a
+    /// CA by its basic constraints, and if it has a key usage, that includes `keyCertSign`. A
+    /// self-signed v1 or v2 certificate (an old root, which predates extensions) with no basic
+    /// constraints counts as a CA; a v3 certificate must say it is one.
+    pub fn may_issue(&self) -> bool {
+        /// keyUsage bit 5.
+        const KEY_CERT_SIGN: u16 = 1 << 5;
+        let old_root = self.version < 2 && !self.has_basic_constraints && self.is_self_signed();
+        (self.is_ca || old_root) && self.key_usage.is_none_or(|u| u & KEY_CERT_SIGN != 0)
+    }
+
     /// Valid at `t`.
     pub fn valid_at(&self, t: Time) -> bool {
         self.not_before <= t && t <= self.not_after
@@ -348,21 +395,53 @@ impl Certificate {
     }
 }
 
-/// The chain from `leaf` up through `pool`, as far as issuers can be found and their keys
-/// verify the certificate below. Stops at a self-signed certificate.
-pub fn build_chain<'a>(leaf: &'a Certificate, pool: &'a [Certificate]) -> Vec<&'a Certificate> {
+/// The chain from `leaf` up through `pool`, as far as issuers can be found and may issue: each
+/// issuer's key verifies the certificate below it, it is a CA allowed to sign certificates, its
+/// `pathLenConstraint` allows the CA certificates below it, and (when `at` is given) it was valid
+/// then. Stops at a self-signed certificate. Certificates embedded in a document are in `pool`
+/// too, so an ordinary end-entity certificate must never be accepted as an issuer.
+pub fn build_chain<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at: Option<Time>) -> Vec<&'a Certificate> {
+    build_chain_noted(leaf, pool, at).0
+}
+
+/// [`build_chain`], and why it stopped where it did if a certificate that matched the issuer by
+/// name and signature was refused.
+pub fn build_chain_noted<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at: Option<Time>) -> (Vec<&'a Certificate>, Option<String>) {
     let mut chain = vec![leaf];
+    let mut refused = None;
     while chain.len() < 10 {
         let Some(&last) = chain.last() else { break };
         if last.issuer.raw == last.subject.raw {
             break;
         }
-        let Some(issuer) = pool.iter().find(|c| c.subject.raw == last.issuer.raw && !chain.contains(c) && last.signed_by(&c.public_key)) else {
-            break;
-        };
+        // CA certificates between `last` and the leaf: what a candidate's pathLenConstraint limits.
+        let below = chain.len() - 1;
+        let mut found = None;
+        for c in pool.iter().filter(|c| c.subject.raw == last.issuer.raw && !chain.contains(c) && last.signed_by(&c.public_key)) {
+            let why = if !c.may_issue() {
+                Some("is not a CA certificate that may issue certificates")
+            } else if c.path_len.is_some_and(|n| below > n as usize) {
+                Some("does not allow this many CA certificates below it (path length)")
+            } else if at.is_some_and(|t| !c.valid_at(t)) {
+                Some("was not valid at the time of signing")
+            } else {
+                None
+            };
+            match why {
+                None => {
+                    found = Some(c);
+                    break;
+                }
+                Some(why) => {
+                    refused = Some(format!("The certificate of {} {why}, so it is not used to vouch for {}.", c.display_name(), last.display_name()))
+                }
+            }
+        }
+        let Some(issuer) = found else { break };
+        refused = None;
         chain.push(issuer);
     }
-    chain
+    (chain, refused)
 }
 
 /// Certificates from a file: DER, or PEM with one or more `CERTIFICATE` blocks (`.cer`, `.crt`,
diff --git a/crates/sign/tests/chain.rs b/crates/sign/tests/chain.rs
new file mode 100644
index 00000000..273d9fdf
--- /dev/null
+++ b/crates/sign/tests/chain.rs
@@ -0,0 +1,241 @@
+//! Chain building: which certificates may vouch for which (RFC 5280 §6.1, the parts that matter
+//! for trust). Certificates are issued in-process with chosen extensions, so every refusal is
+//! tested on its own.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::Document;
+use pdfcraft_sign::der::{self, Time, tag};
+use pdfcraft_sign::pkcs12::DigitalId;
+use pdfcraft_sign::x509::{Certificate, Name, build_chain, build_chain_noted};
+use pdfcraft_sign::{PrivateKey, SignOptions, Status, TrustStore, signatures};
+
+fn time(year: u32) -> Time {
+    Time { year, month: 6, day: 1, hour: 12, minute: 0, second: 0 }
+}
+
+fn ext(oid: &str, value: &[u8]) -> Vec<u8> {
+    der::seq(&[&der::oid(oid), &der::boolean(true), &der::octets(value)])
+}
+
+/// basicConstraints: `cA` (omitted when false, as DER does) and an optional `pathLenConstraint`.
+fn basic_constraints(ca: bool, path_len: Option<u64>) -> Vec<u8> {
+    let mut parts: Vec<Vec<u8>> = Vec::new();
+    if ca {
+        parts.push(der::boolean(true));
+    }
+    if let Some(n) = path_len {
+        parts.push(der::int(n));
+    }
+    let refs: Vec<&[u8]> = parts.iter().map(Vec::as_slice).collect();
+    ext("2.5.29.19", &der::seq(&refs))
+}
+
+const DIGITAL_SIGNATURE: u8 = 0x80;
+const KEY_CERT_SIGN: u8 = 0x04;
+
+fn key_usage(bits: u8) -> Vec<u8> {
+    ext("2.5.29.15", &der::tlv(tag::BIT_STRING, &[1, bits]))
+}
+
+struct Party {
+    name: Name,
+    key: PrivateKey,
+    cert: Certificate,
+}
+
+/// A certificate for a fresh key, signed by `issuer` (or by itself).
+fn issue(cn: &str, issuer: Option<&Party>, valid: (u32, u32), extensions: &[Vec<u8>]) -> Party {
+    let key = PrivateKey::generate_p256().unwrap();
+    let name = Name::build(cn, "", "Chain Tests", "", "US");
+    let signer = issuer.map_or(&key, |i| &i.key);
+    let issuer_name = issuer.map_or(&name, |i| &i.name);
+    let alg = signer.preferred_digest();
+    let sig_alg = signer.signature_algorithm(alg);
+    let exts: Vec<&[u8]> = extensions.iter().map(Vec::as_slice).collect();
+    let mut fields: Vec<Vec<u8>> = Vec::new();
+    // v3 when there are extensions; with none, a v1 certificate (no version field), as old roots.
+    if !exts.is_empty() {
+        fields.push(der::explicit(0, &der::int(2)));
+    }
+    fields.extend([
+        der::uint(&[1 + cn.len() as u8]),
+        sig_alg.clone(),
+        issuer_name.raw.clone(),
+        der::seq(&[&time(valid.0).encode(), &time(valid.1).encode()]),
+        name.raw.clone(),
+        key.public_key().spki(),
+    ]);
+    if !exts.is_empty() {
+        fields.push(der::explicit(3, &der::seq(&exts)));
+    }
+    let refs: Vec<&[u8]> = fields.iter().map(Vec::as_slice).collect();
+    let tbs = der::seq(&refs);
+    let signature = signer.sign(alg, &tbs).unwrap();
+    let cert = Certificate::parse(&der::seq(&[&tbs, &sig_alg, &der::bit_string(&signature)])).unwrap();
+    Party { name, key, cert }
+}
+
+const FOREVER: (u32, u32) = (2020, 2040);
+
+fn root() -> Party {
+    issue("Test Root", None, FOREVER, &[basic_constraints(true, None), key_usage(KEY_CERT_SIGN)])
+}
+
+fn ca(cn: &str, under: &Party, path_len: Option<u64>) -> Party {
+    issue(cn, Some(under), FOREVER, &[basic_constraints(true, path_len), key_usage(KEY_CERT_SIGN)])
+}
+
+fn end_entity(cn: &str, under: &Party) -> Party {
+    issue(cn, Some(under), FOREVER, &[basic_constraints(false, None), key_usage(DIGITAL_SIGNATURE)])
+}
+
+fn names(chain: &[&Certificate]) -> Vec<String> {
+    chain.iter().map(|c| c.subject.common_name().unwrap_or_default().to_string()).collect()
+}
+
+#[test]
+fn a_proper_chain_is_built() {
+    let r = root();
+    let i = ca("Intermediate", &r, None);
+    let l = end_entity("Leaf", &i);
+    let pool = [i.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf", "Intermediate", "Test Root"]);
+    assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2026)))), ["Leaf", "Intermediate", "Test Root"]);
+}
+
+#[test]
+fn an_end_entity_certificate_cannot_issue() {
+    let r = root();
+    let e = end_entity("Ordinary Subscriber", &r);
+    // A certificate its holder made with the end-entity key.
+    let forged = end_entity("Bank AG", &e);
+    let pool = [e.cert.clone(), r.cert.clone()];
+    let (chain, why) = build_chain_noted(&forged.cert, &pool, None);
+    assert_eq!(names(&chain), ["Bank AG"], "the subscriber certificate does not vouch for what it signed");
+    assert!(why.is_some_and(|w| w.contains("not a CA")), "the reason is reported");
+    // Neither does one without basicConstraints (not a v1 root: it has an issuer).
+    let plain = issue("No Constraints", Some(&r), FOREVER, &[]);
+    let under_plain = end_entity("Under Plain", &plain);
+    let pool = [plain.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&under_plain.cert, &pool, None)), ["Under Plain"]);
+    // CA:TRUE does not help when keyUsage leaves out keyCertSign…
+    let signing_only = issue("Signing Only CA", Some(&r), FOREVER, &[basic_constraints(true, None), key_usage(DIGITAL_SIGNATURE)]);
+    let below = end_entity("Below Signing Only", &signing_only);
+    let pool = [signing_only.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&below.cert, &pool, None)), ["Below Signing Only"]);
+    // …and a CA with no keyUsage at all is fine.
+    let any_usage = issue("Any Usage CA", Some(&r), FOREVER, &[basic_constraints(true, None)]);
+    let below = end_entity("Below Any Usage", &any_usage);
+    let pool = [any_usage.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&below.cert, &pool, None)), ["Below Any Usage", "Any Usage CA", "Test Root"]);
+}
+
+#[test]
+fn a_path_length_constraint_limits_the_cas_below() {
+    let r = root();
+    let i1 = ca("Constrained", &r, Some(0));
+    let i2 = ca("Sub CA", &i1, None);
+    let l = end_entity("Leaf", &i2);
+    let pool = [i1.cert.clone(), i2.cert.clone(), r.cert.clone()];
+    // pathLen 0: no CA may follow it, so Sub CA's issuer is refused and the chain stops there.
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf", "Sub CA"]);
+    // pathLen 0 directly above the leaf is fine, and pathLen 1 allows one CA below.
+    let direct = end_entity("Direct Leaf", &i1);
+    assert_eq!(names(&build_chain(&direct.cert, &pool, None)), ["Direct Leaf", "Constrained", "Test Root"]);
+    let i1 = ca("Constrained 1", &r, Some(1));
+    let i2 = ca("Sub CA 1", &i1, None);
+    let l = end_entity("Leaf 1", &i2);
+    let pool = [i1.cert.clone(), i2.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf 1", "Sub CA 1", "Constrained 1", "Test Root"]);
+}
+
+#[test]
+fn issuers_must_have_been_valid_when_it_matters() {
+    let r = root();
+    let old = issue("Short Lived CA", Some(&r), (2020, 2022), &[basic_constraints(true, None), key_usage(KEY_CERT_SIGN)]);
+    let l = end_entity("Leaf", &old);
+    let pool = [old.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2021)))), ["Leaf", "Short Lived CA", "Test Root"]);
+    let (chain, why) = build_chain_noted(&l.cert, &pool, Some(time(2023)));
+    assert_eq!(names(&chain), ["Leaf"], "expired by then");
+    assert!(why.is_some_and(|w| w.contains("not valid")));
+    assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2019)))), ["Leaf"], "not yet valid");
+    // With no time to judge by, nothing is refused on validity.
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)).len(), 3);
+}
+
+#[test]
+fn an_old_v1_self_signed_root_without_constraints_still_anchors() {
+    // No extensions at all: basicConstraints absent, as in v1 roots.
+    let r = issue("Old V1 Root", None, FOREVER, &[]);
+    assert!(r.cert.is_self_signed() && !r.cert.has_basic_constraints && r.cert.may_issue());
+    let i = ca("Under V1", &r, None);
+    let l = end_entity("Leaf", &i);
+    let pool = [i.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf", "Under V1", "Old V1 Root"]);
+    // A self-signed certificate that says CA:FALSE is not a root that can issue.
+    let not_a_ca = issue("Self Signed Leaf", None, FOREVER, &[basic_constraints(false, None)]);
+    assert!(!not_a_ca.cert.may_issue());
+}
+
+fn fixture() -> Vec<u8> {
+    std::fs::read(format!("{}/tests/data/openssl-signed.pdf", env!("CARGO_MANIFEST_DIR"))).unwrap()
+}
+
+/// Sign a small PDF with `leaf`, embedding `embedded`, and validate it trusting only `anchor`.
+fn verdict(leaf: Party, embedded: Vec<Certificate>, anchor: &Certificate) -> (Status, Vec<String>) {
+    let id = DigitalId { key: leaf.key, certificate: leaf.cert, chain: embedded, friendly_name: None };
+    let doc = Document::open(Arc::new(fixture())).unwrap();
+    let opts = SignOptions { page: 0, rect: None, date: "D:20260601120000Z".into(), ..SignOptions::default() };
+    let signed = pdfcraft_sign::sign(&doc, &id, &opts).unwrap();
+    let trust = TrustStore { certs: vec![anchor.clone()] };
+    let s = signatures(&Document::open(Arc::new(signed.clone())).unwrap(), &signed, &trust).into_iter().rfind(|s| s.signed).unwrap();
+    (s.status, s.details)
+}
+
+#[test]
+fn a_signature_chaining_through_an_ordinary_certificate_is_not_trusted() {
+    let r = root();
+    // The root vouches for a CA, which vouches for the signer: valid.
+    let i = ca("Issuing CA", &r, None);
+    let l = end_entity("Honest Signer", &i);
+    let (status, details) = verdict(l, vec![i.cert.clone()], &r.cert);
+    assert_eq!(status, Status::Valid, "{details:?}");
+    // The root vouched for an ordinary subscriber, who signed the "signer" certificate with the
+    // subscriber's own key and embedded it: the root must not vouch for that.
+    let subscriber = end_entity("Ordinary Subscriber", &r);
+    let forged = end_entity("Forged Identity", &subscriber);
+    let (status, details) = verdict(forged, vec![subscriber.cert.clone()], &r.cert);
+    assert_eq!(status, Status::Unknown, "{details:?}");
+    assert!(details.iter().any(|d| d.contains("not a CA")), "{details:?}");
+}
+
+#[test]
+fn a_v3_self_signed_certificate_without_constraints_is_not_a_root_that_issues() {
+    // A self-signed v3 ID with no basicConstraints and no key usage (only a key identifier): it
+    // may sign documents, but it may not vouch for anyone else.
+    let id = issue("Self Signed V3 ID", None, FOREVER, &[ext("2.5.29.14", &der::octets(&[1, 2, 3, 4]))]);
+    assert!(id.cert.is_self_signed() && !id.cert.has_basic_constraints && id.cert.version == 2);
+    assert!(!id.cert.may_issue());
+    let l = end_entity("Leaf", &id);
+    assert_eq!(names(&build_chain(&l.cert, std::slice::from_ref(&id.cert), None)), ["Leaf"]);
+}
+
+#[test]
+fn unreadable_constraint_extensions_fail_closed() {
+    // keyUsage present but not a BIT STRING: no usage at all, so no keyCertSign.
+    let bad_usage = ext("2.5.29.15", &[0xff, 0x00]);
+    let c = issue("Bad Usage CA", Some(&root()), FOREVER, &[basic_constraints(true, None), bad_usage]);
+    assert_eq!(c.cert.key_usage, Some(0));
+    assert!(!c.cert.may_issue());
+    // pathLenConstraint present but negative: no CA may follow, not any number.
+    let negative = ext("2.5.29.19", &der::seq(&[&der::boolean(true), &der::tlv(tag::INTEGER, &[0xff])]));
+    let c = issue("Negative PathLen CA", Some(&root()), FOREVER, &[negative]);
+    assert!(c.cert.is_ca);
+    assert_eq!(c.cert.path_len, Some(0));
+    // basicConstraints present but unparsable: present, not a CA, so not an "old v1 root".
+    let garbage = ext("2.5.29.19", &[0x30, 0x05, 0x01]);
+    let c = issue("Garbled Constraints", None, FOREVER, &[garbage]);
+    assert!(c.cert.has_basic_constraints && !c.cert.is_ca && !c.cert.may_issue());
+}

From d90b3f897f980ec66ab479d69a23127fbe647345 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Fri, 9 Oct 2026 18:42:23 -0400
Subject: [PATCH 131/149] Refs #103: ship the OCR models in the desktop release
 packages (#630)

Release builds said "Text recognition isn't installed: its models are
missing" because no packaging script or release job fetched the OCR
models: only `cargo xtask models` does, into the source tree.

- packaging/env.sh gains stage_models DEST, which runs
  `cargo xtask models DEST` (every ATTRIBUTION.toml kind = "model" file,
  SHA-256 verified, with its licence text). No model file is named, so
  the models PRs #433/#572 add ship without packaging changes.
- `cargo xtask models` also writes ATTRIBUTION.txt crediting each model
  (CC-BY-SA-4.0 requires attribution when redistributed).
- macOS: PdfCraft.app/Contents/Resources/models, before signing.
- Windows: models\ beside pdfcraft.exe in the MSI (WiX v5 <Files>
  harvest) and the portable zip; test-msi.ps1 checks the folder.
- Linux deb/rpm/tar.gz/AppImage, Flatpak bundle and FreeBSD tarball:
  share/pdfcraft/models beside bin/. Models::search_dirs now also looks
  in <exe dir>/../share/pdfcraft/models (Models::dirs_beside_exe); a
  test builds every package layout on disk and finds the models in each.
  release.yml and freebsd.yml check the packages contain them.
- The missing-models messages no longer tell end users to run cargo,
  and the 11 catalogs that keyed an old PRINTCRAFT_MODELS wording (or
  the previous one) now key the current English text; ATTRIBUTION
  hashes updated. A test checks the translations match.

The web (wasm) build, which the issue reports, still has no models; this
is the desktop half only.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/freebsd.yml                 |  2 +-
 .github/workflows/release.yml                 |  3 +
 ATTRIBUTION.toml                              | 22 +++----
 crates/automation/src/tools.rs                |  2 +-
 crates/ocr/src/lib.rs                         | 58 +++++++++++++++++--
 crates/ui-egui/src/i18n/bg.tsv                |  5 +-
 crates/ui-egui/src/i18n/de.tsv                |  5 +-
 crates/ui-egui/src/i18n/es.tsv                |  5 +-
 crates/ui-egui/src/i18n/fr.tsv                |  5 +-
 crates/ui-egui/src/i18n/hu.tsv                |  5 +-
 crates/ui-egui/src/i18n/ja.tsv                |  4 +-
 crates/ui-egui/src/i18n/mod.rs                | 16 +++++
 crates/ui-egui/src/i18n/ru.tsv                |  5 +-
 crates/ui-egui/src/i18n/te.tsv                |  5 +-
 crates/ui-egui/src/i18n/uk.tsv                |  5 +-
 crates/ui-egui/src/i18n/zh-hans.tsv           |  5 +-
 crates/ui-egui/src/i18n/zh-hant.tsv           |  4 +-
 crates/ui-egui/src/ocr_ui.rs                  |  2 +-
 docs/releasing.md                             |  8 +++
 packaging/env.sh                              | 19 ++++++
 packaging/freebsd/package.sh                  |  4 +-
 packaging/linux/flatpak-bundle.sh             |  2 +-
 .../ai.storyteller.pdfcraft.bundle.yml        |  2 +
 packaging/linux/package.sh                    |  4 +-
 packaging/macos/package.sh                    |  3 +
 packaging/windows/package.ps1                 | 19 +++++-
 packaging/windows/pdfcraft.wxs                | 14 ++++-
 packaging/windows/test-msi.ps1                | 16 ++++-
 parity/acrobat-features.toml                  |  2 +-
 xtask/src/assets.rs                           | 29 +++++++++-
 30 files changed, 218 insertions(+), 62 deletions(-)

diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index a86fc140..b852d863 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -49,4 +49,4 @@ jobs:
             CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked
             # The release packaging, end to end (a quicker release profile than the real release).
             CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 packaging/freebsd/package.sh
-            tar -tzf dist/release/pdfcraft-*-freebsd-*.tar.gz | grep -E '/bin/pdfcraft$|/bin/pdfcraft-cli$|applications/'
+            tar -tzf dist/release/pdfcraft-*-freebsd-*.tar.gz | grep -E '/bin/pdfcraft$|/bin/pdfcraft-cli$|applications/|/share/pdfcraft/models/.+\.rten$'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e5c62e1f..2f6c3a4f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -222,6 +222,9 @@ jobs:
         run: |
           dpkg-deb --info dist/release/*.deb
           dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/pdfcraft$|metainfo|applications'
+          # The OCR models (#103), where the installed app looks: <bin>/../share/pdfcraft/models.
+          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/share/pdfcraft/models/.+\.rten$'
+          tar -tzf dist/release/*.tar.gz | grep -E '/share/pdfcraft/models/.+\.rten$'
           ldd target/release/pdfcraft
           # The CLI-only archive: the binary and its licences, and it runs.
           cli="dist/release/pdfcraft-cli-$PDFCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index f8f3781c..99cbbfb0 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d1f4c7c71d2359e816878e8de837119649513e20b8cf1036276f4d18639398f5"
+sha256 = "ed6e797e2ae7e4632aabc585af973c15f34d0366671a6c57acf222a3a98b087b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1cac4789161502b2fc3c52ac0bc9a89fd714495a87c594ba7a4f04e49e5a6456"
+sha256 = "0575e82da2596ca407ad8153cde04750fa6c1ab98ab7b850032ed361d51f9a4e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "85a57e66f819e93c8c541548cd932ec98cd3dca888c25b62d5c973fb795eb78a"
+sha256 = "460a8a8740f1a8a97f3c3e4bc8d27913d417539a5667a2686a4ec1047c309d39"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f005a60c77110251be379572e3eb6bf9a7907946788f5ce0f8689800f5cc7b76"
+sha256 = "e41c2db222bd35f291a8fa286ac49f4efc8886646269a084958aaa59e2c848c8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "a53fb2b7d91a6f9cb37c5d7fcc77e0884b9b23a0f406569ba203062cff731be1"
+sha256 = "357f864eb011b8fdcbe0db609a85ce6f8c7fb421769361e5def005cc515d311d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "affd4f7f2e7285abfb987625bbb726cf3d761f0a67ccaf00c18d986be3fa5f9d"
+sha256 = "2d42c2fbb62771bad33dab83926adc34c553b7d0b6cf666322076b9820f641de"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "88e402a8a16ba8ccd6f73e91326691ce4c4f86bf113cc484fb4c2af953ab3122"
+sha256 = "bb5e94d419faf579e9cd0ef9e1f26da6aa342567004a8ff53cb0a2037a8981bb"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "54561c1c94ad81a6e452e42cb9d9d49ef5417d4d4b08a1b71cadba1327b85499"
+sha256 = "31b4e703f7b60727e09cc7e68b287e748f4dbd0ae9e1298b96714bcf8da6e74e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "af9bd7f0a2c9f64faaea928e219be50a9ce8a71d40ae4c13e84cfe1aed751f40"
+sha256 = "d25162d477b3370238b23b0a61e827c4df73aac2cb5ccfc694f79e2adc9798c7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b93836c384d11e5027b902f6f5a9fa389a5a793213bb77f6754e4cf71fdc28c8"
+sha256 = "0534c5852449a72af65da004b085c6d0566aa7d9cdf98d38978ba3e39493ef75"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "55fb645e8983bd4396c3d70a7a53040bd260476b198d3cf2cf5d223f909e7436"
+sha256 = "306d998039e76769eeb6fa43871807193b8f2ebafc4924f15d17db710ddab184"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 8eb2fa03..9fa6a54a 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -898,7 +898,7 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["paths", "folder"],
             )),
-        t("ocr_status", "OCR status", "Whether text recognition is available (its models are installed: run `cargo xtask models` or set PDFCRAFT_MODELS), where it looks for them, and the languages it reads.")
+        t("ocr_status", "OCR status", "Whether text recognition is available (its models are installed: release packages include them; a source build fetches them with `cargo xtask models`; PDFCRAFT_MODELS overrides), where it looks for them, and the languages it reads.")
             .ro()
             .cmd("ocr.recognize")
             .with(schema(json!({}), &[])),
diff --git a/crates/ocr/src/lib.rs b/crates/ocr/src/lib.rs
index f026f5bd..ae829d96 100644
--- a/crates/ocr/src/lib.rs
+++ b/crates/ocr/src/lib.rs
@@ -23,7 +23,9 @@ pub const LANGUAGES: &[(&str, &str)] = &[("en", "English")];
 
 #[derive(Debug, thiserror::Error)]
 pub enum OcrError {
-    #[error("the text recognition models are not installed (run `cargo xtask models`, or set PDFCRAFT_MODELS)")]
+    /// Shown to end users (release packages ship the models; a source build fetches them with
+    /// `cargo xtask models`). The UI catalogs key this exact text.
+    #[error("the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)")]
     NoModels,
     #[error("loading {0}: {1}")]
     Load(String, String),
@@ -47,8 +49,8 @@ impl Models {
         (m.detection.is_file() && m.recognition.is_file()).then_some(m)
     }
 
-    /// Look for the models: `$PDFCRAFT_MODELS`, then `models/` beside the executable (and
-    /// `Resources/models` in a macOS bundle), then the source tree's `assets/models/`.
+    /// Look for the models: `$PDFCRAFT_MODELS`, then where the release packages install them
+    /// beside the executable ([`Models::dirs_beside_exe`]), then the source tree's `assets/models/`.
     pub fn find() -> Option<Models> {
         Self::search_dirs().iter().find_map(|d| Self::in_dir(d))
     }
@@ -60,12 +62,21 @@ impl Models {
             dirs.push(PathBuf::from(d));
         }
         if let Some(exe) = std::env::current_exe().ok().and_then(|e| e.parent().map(Path::to_path_buf)) {
-            dirs.push(exe.join("models"));
-            dirs.push(exe.join("../Resources/models"));
+            dirs.extend(Self::dirs_beside_exe(&exe));
         }
         dirs.push(Path::new(env!("CARGO_MANIFEST_DIR")).join("../../assets/models"));
         dirs
     }
+
+    /// Where the release packages put the models, relative to the directory holding the
+    /// executable (packaging/*):
+    /// - `models/` beside it: the Windows MSI and portable zip;
+    /// - `../Resources/models`: the macOS app bundle (`Contents/MacOS` → `Contents/Resources`);
+    /// - `../share/pdfcraft/models`: the FHS-style trees (`bin/` → `share/`) of the Linux
+    ///   deb/rpm/tar.gz/AppImage/Flatpak and the FreeBSD tarball, wherever they are installed.
+    pub fn dirs_beside_exe(exe_dir: &Path) -> Vec<PathBuf> {
+        vec![exe_dir.join("models"), exe_dir.join("../Resources/models"), exe_dir.join("../share/pdfcraft/models")]
+    }
 }
 
 /// A recognised word: its text and its box in image pixels `[left, top, right, bottom]`.
@@ -236,6 +247,43 @@ mod tests {
         assert_eq!(w.up, [-10.0, 0.0]);
     }
 
+    /// #103: every release package's layout puts the models where the installed app looks.
+    /// Mirrors packaging/{windows/package.ps1,macos/package.sh,linux/package.sh,freebsd/package.sh}.
+    #[test]
+    fn finds_the_models_in_every_release_package_layout() {
+        let base = std::env::temp_dir().join(format!("pdfcraft-ocr-layouts-{}", std::process::id()));
+        let layouts = [
+            ("windows", "PdfCraft", "PdfCraft/models"),
+            ("macos", "PdfCraft.app/Contents/MacOS", "PdfCraft.app/Contents/Resources/models"),
+            ("linux-deb-rpm", "usr/bin", "usr/share/pdfcraft/models"),
+            ("linux-tar", "pdfcraft-1.0.0-linux-x86_64/bin", "pdfcraft-1.0.0-linux-x86_64/share/pdfcraft/models"),
+            ("appimage", "PdfCraft.AppDir/usr/bin", "PdfCraft.AppDir/usr/share/pdfcraft/models"),
+            ("flatpak", "app/bin", "app/share/pdfcraft/models"),
+            ("freebsd", "usr/local/bin", "usr/local/share/pdfcraft/models"),
+        ];
+        for (name, exe_dir, models_dir) in layouts {
+            let root = base.join(name);
+            let (exe_dir, models_dir) = (root.join(exe_dir), root.join(models_dir));
+            std::fs::create_dir_all(&exe_dir).unwrap();
+            std::fs::create_dir_all(&models_dir).unwrap();
+            let found = || Models::dirs_beside_exe(&exe_dir).iter().find_map(|d| Models::in_dir(d));
+            assert_eq!(found(), None, "{name}: no models yet");
+            for file in [DETECTION_MODEL, RECOGNITION_MODEL] {
+                std::fs::write(models_dir.join(file), b"model").unwrap();
+            }
+            let models = found().unwrap_or_else(|| panic!("{name}: models in {} not found", models_dir.display()));
+            assert_eq!(models.detection.canonicalize().unwrap(), models_dir.join(DETECTION_MODEL).canonicalize().unwrap(), "{name}");
+        }
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
+    /// The message tells end users what to do; release builds have no cargo.
+    #[test]
+    fn missing_models_message_is_for_end_users() {
+        let message = OcrError::NoModels.to_string();
+        assert!(!message.contains("cargo") && message.contains("PDFCRAFT_MODELS"), "{message}");
+    }
+
     /// End to end on rendered text, when the models are installed (`cargo xtask models`).
     #[test]
     fn reads_rendered_text() {
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index cc047f5a..419ef313 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -899,7 +899,7 @@
 	Searchable Image (Exact)	Изображение с възможност за търсене (точно)
 	Adds invisible text over each word; the page image is not changed	Добавя невидим текст върху всяка дума; изображението на страницата не се променя
 	Downsample to	Намали разделителната способност до
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Разпознаването на текст не е инсталирано: моделите му липсват (изпълнете `cargo xtask models` или задайте PRINTCRAFT_MODELS).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Разпознаването на текст не е инсталирано: файловете на моделите му липсват. Инсталирайте PdfCraft отново или задайте в PDFCRAFT_MODELS папката, която ги съдържа.
 	Settings	Настройки
 	Protect	Защита
 	Advanced options	Разширени опции
@@ -1968,7 +1968,7 @@
 	the image is empty	изображението е празно
 	The operation failed.	Операцията е неуспешна.
 	the password is incorrect	паролата е грешна
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	моделите за разпознаване на текст не са инсталирани (изпълнете `cargo xtask models` или задайте PRINTCRAFT_MODELS)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	моделите за разпознаване на текст не са инсталирани (инсталирайте PdfCraft отново или задайте в PDFCRAFT_MODELS папката, която ги съдържа)
 	The title in the metadata and the document information differ	Заглавието в метаданните и в информацията за документа се различават
 	the title must not be empty	заглавието не може да е празно
 	there are no pages to print	няма страници за печат
@@ -1997,7 +1997,6 @@
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Скриптовете се изпълняват в изолирана среда без достъп до файлове или мрежа. Скрипт, който иска да отвори уебстраница, първо се нуждае от вашето разрешение. При изключен JavaScript стандартните функции на Acrobat за форматиране, валидиране и изчисляване продължават да работят.
 	Sign yourself	Подпишете сами
 	Switch to two-page view first to show the cover page	Първо превключете към изглед с две страници, за да се покаже корицата
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Разпознаването на текст не е инсталирано: моделите му липсват (изпълнете `cargo xtask models` или задайте PDFCRAFT_MODELS).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Използва се при отваряне на PDF файлове. Изрично зададен режим при стартиране или управление има предимство за сесията.
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Използва се, когато PDF файлът не задава оформление или мащаб. Непрекъснатото превъртане никога не спира на границите между страниците.
 	Write this email?	Да се напише ли този имейл?
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8aa85e06..1c4aa3eb 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -1174,7 +1174,7 @@
 	Searchable Image (Exact)	Durchsuchbares Bild (exakt)
 	Adds invisible text over each word; the page image is not changed	Legt unsichtbaren Text über jedes Wort; das Seitenbild bleibt unverändert
 	Downsample to	Herunterrechnen auf
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Die Texterkennung ist nicht installiert, ihre Modelle fehlen (führe `cargo xtask models` aus oder setze PRINTCRAFT_MODELS).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Die Texterkennung ist nicht installiert: ihre Modelldateien fehlen. Installiere PdfCraft neu oder setze PDFCRAFT_MODELS auf den Ordner, der sie enthält.
 	Settings	Einstellungen
 	Optional	Optional
 	Planned · {m}	Geplant · {m}
@@ -1693,7 +1693,7 @@
 	there are no pages to print	keine Seiten zum Drucken vorhanden
 	the document has no tags	das Dokument hat keine Tags
 	{0}: {1}	{0}: {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	die Modelle für die Texterkennung sind nicht installiert (führe `cargo xtask models` aus oder setze PRINTCRAFT_MODELS)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	die Modelle für die Texterkennung sind nicht installiert (installiere PdfCraft neu oder setze PDFCRAFT_MODELS auf den Ordner, der sie enthält)
 	the image is empty	das Bild ist leer
 	this file isn't XFDF, FDF, XML or text form data	diese Datei enthält keine Formulardaten als XFDF, FDF, XML oder Text
 	nothing in the file matches this document	nichts in der Datei passt zu diesem Dokument
@@ -1888,7 +1888,6 @@
 	Open this web page?	Diese Webseite öffnen?
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Skripte laufen in einer Sandbox ohne Datei- oder Netzwerkzugriff. Ein Skript, das eine Webseite öffnen will, braucht zuerst deine Erlaubnis. Bei deaktiviertem JavaScript funktionieren die Standardfunktionen von Acrobat zum Formatieren, Prüfen und Berechnen weiterhin.
 	Sign yourself	Selbst unterschreiben
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Die Texterkennung ist nicht installiert, ihre Modelle fehlen (führe `cargo xtask models` aus oder setze PDFCRAFT_MODELS).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Wird beim Öffnen von PDFs verwendet. Ein ausdrücklich gewählter Start- oder Steuermodus hat für die Sitzung Vorrang.
 	Write this email?	Diese E-Mail schreiben?
 	{who} in this document wants to open this address in your browser:	{who} in diesem Dokument möchte diese Adresse in deinem Browser öffnen:
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 079faac3..4c75dcb9 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1193,7 +1193,7 @@
 	Searchable Image (Exact)	Imagen con búsqueda (exacta)
 	Adds invisible text over each word; the page image is not changed	Añade texto invisible sobre cada palabra; la imagen de la página no cambia
 	Downsample to	Reducir resolución a
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	El reconocimiento de texto no está instalado: faltan sus modelos (ejecuta `cargo xtask models` o define PRINTCRAFT_MODELS).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	El reconocimiento de texto no está instalado: faltan sus archivos de modelo. Reinstala PdfCraft o define PDFCRAFT_MODELS con la carpeta que los contiene.
 	Settings	Ajustes
 	Optional	Opcional
 	Planned · {m}	Previsto · {m}
@@ -1769,7 +1769,7 @@
 	there are no pages to print	no hay páginas que imprimir
 	the document has no tags	el documento no tiene etiquetas
 	{0}: {1}	{0}: {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	los modelos de reconocimiento de texto no están instalados (ejecuta `cargo xtask models` o define PRINTCRAFT_MODELS)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	los modelos de reconocimiento de texto no están instalados (reinstala PdfCraft o define PDFCRAFT_MODELS con la carpeta que los contiene)
 	the image is empty	la imagen está vacía
 	this file isn't XFDF, FDF, XML or text form data	este archivo no contiene datos de formulario XFDF, FDF, XML ni de texto
 	nothing in the file matches this document	nada en el archivo coincide con este documento
@@ -1964,7 +1964,6 @@
 	Open this web page?	¿Abrir esta página web?
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Los scripts se ejecutan en un entorno aislado, sin acceso a archivos ni a la red. Un script que pida abrir una página web necesita antes tu permiso. Con JavaScript desactivado, las funciones estándar de formato, validación y cálculo de Acrobat siguen funcionando.
 	Sign yourself	Firmar tú mismo
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	El reconocimiento de texto no está instalado: faltan sus modelos (ejecuta `cargo xtask models` o define PDFCRAFT_MODELS).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Se usa al abrir archivos PDF. Un modo de inicio o de control explícito tiene prioridad durante la sesión.
 	Write this email?	¿Escribir este correo?
 	{who} in this document wants to open this address in your browser:	{who} de este documento quiere abrir esta dirección en tu navegador:
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index e83f588c..0b008dbe 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1173,7 +1173,7 @@
 	Searchable Image (Exact)	Image recherchable (exacte)
 	Adds invisible text over each word; the page image is not changed	Ajoute du texte invisible sur chaque mot ; l'image de la page n'est pas modifiée
 	Downsample to	Sous-échantillonner à
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	La reconnaissance de texte n'est pas installée : ses modèles sont absents (exécutez `cargo xtask models`, ou définissez PRINTCRAFT_MODELS).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	La reconnaissance de texte n'est pas installée : ses fichiers de modèles sont absents. Réinstallez PdfCraft, ou définissez PDFCRAFT_MODELS sur le dossier qui les contient.
 	Settings	Réglages
 	Optional	Facultatif
 	Planned · {m}	Prévu · {m}
@@ -1692,7 +1692,7 @@
 	there are no pages to print	il n'y a aucune page à imprimer
 	the document has no tags	le document ne contient aucune balise
 	{0}: {1}	{0} : {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	les modèles de reconnaissance de texte ne sont pas installés (exécutez `cargo xtask models`, ou définissez PRINTCRAFT_MODELS)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	les modèles de reconnaissance de texte ne sont pas installés (réinstallez PdfCraft, ou définissez PDFCRAFT_MODELS sur le dossier qui les contient)
 	the image is empty	l'image est vide
 	this file isn't XFDF, FDF, XML or text form data	ce fichier n'est pas des données de formulaire XFDF, FDF, XML ou texte
 	nothing in the file matches this document	rien dans le fichier ne correspond à ce document
@@ -1887,7 +1887,6 @@
 	Open this web page?	Ouvrir cette page web ?
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Les scripts s'exécutent dans un bac à sable, sans accès aux fichiers ni au réseau. Un script qui demande d'ouvrir une page web a d'abord besoin de votre autorisation. Si JavaScript est désactivé, les fonctions standard de format, de validation et de calcul d'Acrobat continuent de fonctionner.
 	Sign yourself	Signer soi-même
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	La reconnaissance de texte n'est pas installée : ses modèles sont absents (exécutez `cargo xtask models`, ou définissez PDFCRAFT_MODELS).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Utilisé à l'ouverture des PDF. Un mode de lancement ou de contrôle explicite a priorité pour la session.
 	Write this email?	Écrire ce courriel ?
 	{who} in this document wants to open this address in your browser:	{who} dans ce document veut ouvrir cette adresse dans votre navigateur :
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index eae14c39..82d8c6c1 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -1169,7 +1169,7 @@
 	Searchable Image (Exact)	Kereshető kép (pontos)
 	Adds invisible text over each word; the page image is not changed	Láthatatlan szöveget helyez minden szóra; az oldalkép nem változik
 	Downsample to	Feloldás csökkentése erre
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	A szövegfelismerés nincs telepítve: hiányoznak a modelljei (futtasd a `cargo xtask models` parancsot, vagy állítsd be a PRINTCRAFT_MODELS változót).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	A szövegfelismerés nincs telepítve: hiányoznak a modellfájljai. Telepítsd újra a PdfCraftot, vagy állítsd a PDFCRAFT_MODELS változót az őket tartalmazó mappára.
 	Settings	Beállítások
 	Optional	Nem kötelező
 	Planned · {m}	Tervezett · {m}
@@ -1688,7 +1688,7 @@
 	there are no pages to print	nincs nyomtatható oldal
 	the document has no tags	a dokumentumnak nincs címkéje
 	{0}: {1}	{0}: {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	a szövegfelismerés modelljei nincsenek telepítve (futtasd a `cargo xtask models` parancsot, vagy állítsd be a PRINTCRAFT_MODELS változót)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	a szövegfelismerés modelljei nincsenek telepítve (telepítsd újra a PdfCraftot, vagy állítsd a PDFCRAFT_MODELS változót az őket tartalmazó mappára)
 	the image is empty	a kép üres
 	this file isn't XFDF, FDF, XML or text form data	ez a fájl nem XFDF, FDF, XML vagy szöveges űrlapadat
 	nothing in the file matches this document	a fájlban semmi sem illeszkedik ehhez a dokumentumhoz
@@ -1883,7 +1883,6 @@
 	Open this web page?	Megnyitod ezt a weboldalt?
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	A szkriptek homokozóban futnak, fájl- és hálózat-hozzáférés nélkül. Ha egy szkript weboldalt akar nyitni, előbb az engedélyed kell. Kikapcsolt JavaScript mellett az Acrobat szabványos formázó, ellenőrző és számoló függvényei továbbra is működnek.
 	Sign yourself	Saját kezű aláírás
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	A szövegfelismerés nincs telepítve: hiányoznak a modelljei (futtasd a `cargo xtask models` parancsot, vagy állítsd be a PDFCRAFT_MODELS változót).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	PDF-ek megnyitásakor érvényes. A kifejezetten választott indítási vagy vezérlőmód a munkamenetre felülírja.
 	Write this email?	Megírod ezt az e-mailt?
 	{who} in this document wants to open this address in your browser:	{who} ebben a dokumentumban meg akarja nyitni ezt a címet a böngésződben:
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 8d9d5511..713bf60d 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1199,7 +1199,7 @@
 	Searchable Image (Exact)	検索可能な画像（元の画像を保持）
 	Adds invisible text over each word; the page image is not changed	各単語に非表示のテキストを重ねます。ページ画像は変更しません
 	Downsample to	ダウンサンプル:
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	テキスト認識がインストールされていません。モデルがありません（`cargo xtask models` を実行するか PRINTCRAFT_MODELS を設定してください）。
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	テキスト認識がインストールされていません。モデルファイルがありません。PdfCraft を再インストールするか、PDFCRAFT_MODELS にモデルファイルのあるフォルダーを設定してください。
 	Settings	設定
 	Optional	任意
 	Planned · {m}	予定 · {m}
@@ -1775,7 +1775,7 @@
 	there are no pages to print	印刷するページはありません
 	the document has no tags	文書にタグはありません
 	{0}: {1}	{0}: {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	テキスト認識モデルがインストールされていません（`cargo xtask models` を実行するか PRINTCRAFT_MODELS を設定してください）
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	テキスト認識モデルがインストールされていません（PdfCraft を再インストールするか、PDFCRAFT_MODELS にモデルのあるフォルダーを設定してください）
 	the image is empty	画像が空です
 	this file isn't XFDF, FDF, XML or text form data	このファイルは XFDF、FDF、XML、テキストのフォームデータではありません
 	nothing in the file matches this document	この文書に一致する項目がファイルにありません
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 93931b66..15a33b78 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -637,6 +637,22 @@ mod tests {
         assert_eq!(fmt("unchanged", &[]), "unchanged");
     }
 
+    /// #103: the missing-OCR-models messages are translated under their current English text
+    /// (catalogs once keyed an older `PRINTCRAFT_MODELS` wording, which never matched).
+    #[test]
+    fn missing_ocr_models_messages_are_translated() {
+        let error = pdfcraft_engine::ocr::OcrError::NoModels.to_string();
+        let notice = "Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.";
+        assert!(include_str!("../ocr_ui.rs").contains(notice), "keep in step with ocr_ui.rs");
+        for code in ["bg", "de", "es", "fr", "hu", "ja", "ru", "te", "uk", "zh-hans", "zh-hant"] {
+            let lang = Lang::from_code(code).expect("registered");
+            assert!(has(lang, notice) && has(lang, &error), "{code}");
+        }
+        for lang in &LANGUAGES {
+            assert!(!lang.source.contains("PRINTCRAFT"), "{}", lang.code);
+        }
+    }
+
     /// Japanese translates every registered command and every All tools group, section and item.
     #[test]
     fn japanese_covers_commands_and_catalogue() {
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 12c8ef8c..fbe654bf 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -1194,7 +1194,7 @@
 	Searchable Image (Exact)	Доступное для поиска изображение (точное)
 	Adds invisible text over each word; the page image is not changed	Добавляет невидимый текст над каждым словом; изображение страницы не меняется
 	Downsample to	Уменьшить до
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Распознавание текста не установлено: отсутствуют модели (запустите `cargo xtask models` или задайте PRINTCRAFT_MODELS).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Распознавание текста не установлено: отсутствуют файлы моделей. Переустановите PdfCraft или задайте в PDFCRAFT_MODELS папку, в которой они лежат.
 	Settings	Настройки
 	Optional	Опционально
 	Planned · {m}	Запланировано · {m}
@@ -1760,7 +1760,7 @@
 	there are no pages to print	нет страниц для печати
 	the document has no tags	у документа нет тегов
 	{0}: {1}	{0}: {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	модели распознавания текста не установлены (запустите `cargo xtask models` или задайте PRINTCRAFT_MODELS)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	модели распознавания текста не установлены (переустановите PdfCraft или задайте в PDFCRAFT_MODELS папку, в которой они лежат)
 	the image is empty	изображение пустое
 	this file isn't XFDF, FDF, XML or text form data	этот файл не является XFDF, FDF, XML или текстовыми данными формы
 	nothing in the file matches this document	ничего в файле не соответствует этому документу
@@ -1955,7 +1955,6 @@
 	Open this web page?	Открыть эту веб-страницу?
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Скрипты выполняются в песочнице без доступа к файлам и сети. Скрипт, который просит открыть веб-страницу, сначала нуждается в вашем разрешении. При отключённом JavaScript стандартные функции Acrobat форматирования, проверки и вычислений всё равно работают.
 	Sign yourself	Подписать самим собой
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Распознавание текста не установлено: отсутствуют модели (запустите `cargo xtask models` или задайте PDFCRAFT_MODELS).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Используется при открытии PDF. Явный запуск или режим управления имеет приоритет для сессии.
 	Write this email?	Написать это письмо?
 	{who} in this document wants to open this address in your browser:	{who} в этом документе хочет открыть этот адрес в вашем браузере:
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index ebef861c..28c6e24c 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -1173,7 +1173,7 @@ comment menu	Edit	సవరించు
 	Searchable Image (Exact)	వెతకగలిగే చిత్రం (యథాతథం)
 	Adds invisible text over each word; the page image is not changed	ప్రతి పదంపై కనిపించని టెక్స్ట్‌ను జోడిస్తుంది; పేజీ చిత్రం మారదు
 	Downsample to	ఈ రిజల్యూషన్‌కు తగ్గించు
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	టెక్స్ట్ గుర్తింపు ఇన్‌స్టాల్ చేయబడలేదు: దానికి అవసరమైన మోడల్‌లు లేవు (`cargo xtask models`ను అమలు చేయండి, లేదా PRINTCRAFT_MODELSను సెట్ చేయండి).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	టెక్స్ట్ గుర్తింపు ఇన్‌స్టాల్ కాలేదు: దాని మోడల్ ఫైల్‌లు లేవు. PdfCraftను మళ్లీ ఇన్‌స్టాల్ చేయండి, లేదా వాటిని కలిగి ఉన్న ఫోల్డర్‌కు PDFCRAFT_MODELSను సెట్ చేయండి.
 	Settings	సెట్టింగ్‌లు
 	Optional	ఐచ్ఛికం
 	Planned · {m}	ప్రణాళికలో ఉంది · {m}
@@ -1693,7 +1693,7 @@ action wizard	Start	ప్రారంభించు
 	there are no pages to print	ముద్రించడానికి పేజీలు ఏవీ లేవు
 	the document has no tags	పత్రంలో ట్యాగ్‌లు లేవు
 	{0}: {1}	{0}: {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	టెక్స్ట్ గుర్తింపు మోడల్‌లు ఇన్‌స్టాల్ చేయబడలేదు (`cargo xtask models` అమలు చేయండి, లేదా PRINTCRAFT_MODELS సెట్ చేయండి)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	టెక్స్ట్ గుర్తింపు మోడల్‌లు ఇన్‌స్టాల్ చేయబడలేదు (PdfCraftను మళ్లీ ఇన్‌స్టాల్ చేయండి, లేదా వాటిని కలిగి ఉన్న ఫోల్డర్‌కు PDFCRAFT_MODELSను సెట్ చేయండి)
 	the image is empty	చిత్రం ఖాళీగా ఉంది
 	this file isn't XFDF, FDF, XML or text form data	ఈ ఫైల్ XFDF, FDF, XML లేదా టెక్స్ట్ ఫారం డేటా కాదు
 	nothing in the file matches this document	ఫైల్‌లోని ఏదీ ఈ పత్రంతో సరిపోలడం లేదు
@@ -1888,7 +1888,6 @@ action wizard	Start	ప్రారంభించు
 	Open this web page?	ఈ వెబ్ పేజీని తెరవాలా?
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	స్క్రిప్ట్‌లు ఫైల్ లేదా నెట్‌వర్క్ యాక్సెస్ లేని శాండ్‌బాక్స్‌లో అమలవుతాయి. వెబ్ పేజీని తెరవమని అడిగే స్క్రిప్ట్‌కు ముందుగా మీ అనుమతి అవసరం. JavaScript ఆఫ్‌లో ఉన్నా, Acrobat ప్రామాణిక ఫార్మాట్, ధృవీకరణ, గణన ఫంక్షన్‌లు పని చేస్తూనే ఉంటాయి.
 	Sign yourself	స్వయంగా సంతకం చేయడం
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	టెక్స్ట్ గుర్తింపు ఇన్‌స్టాల్ కాలేదు: దాని మోడల్‌లు లేవు (`cargo xtask models` అమలు చేయండి, లేదా PDFCRAFT_MODELS సెట్ చేయండి).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	PDFలను తెరిచేటప్పుడు ఉపయోగించబడుతుంది. ప్రారంభించేటప్పుడు లేదా కంట్రోల్ ద్వారా స్పష్టంగా ఇచ్చిన మోడ్‌కు ఆ సెషన్‌లో ప్రాధాన్యత ఉంటుంది.
 	Write this email?	ఈ ఇమెయిల్ రాయాలా?
 	{who} in this document wants to open this address in your browser:	ఈ పత్రంలోని {who} ఈ చిరునామాను మీ బ్రౌజర్‌లో తెరవాలనుకుంటోంది:
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 080f8997..51bf057b 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -1197,7 +1197,7 @@
 	Searchable Image (Exact)	Зображення з пошуком (точне)
 	Adds invisible text over each word; the page image is not changed	Додає невидимий текст поверх кожного слова; зображення сторінки не змінюється
 	Downsample to	Знизити роздільну здатність до
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	Розпізнавання тексту не встановлено: бракує моделей (виконайте `cargo xtask models` або задайте PRINTCRAFT_MODELS).
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Розпізнавання тексту не встановлено: бракує файлів моделей. Перевстановіть PdfCraft або задайте в PDFCRAFT_MODELS теку, у якій вони лежать.
 	Settings	Налаштування
 	Optional	Необов’язково
 	Planned · {m}	Заплановано · {m}
@@ -1763,7 +1763,7 @@
 	there are no pages to print	немає сторінок для друку
 	the document has no tags	документ не має тегів
 	{0}: {1}	{0}: {1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	моделі розпізнавання тексту не встановлено (виконайте `cargo xtask models` або задайте PRINTCRAFT_MODELS)
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	моделі розпізнавання тексту не встановлено (перевстановіть PdfCraft або задайте в PDFCRAFT_MODELS теку, у якій вони лежать)
 	the image is empty	зображення порожнє
 	this file isn't XFDF, FDF, XML or text form data	цей файл не містить даних форми XFDF, FDF, XML чи текстових даних
 	nothing in the file matches this document	ніщо у файлі не відповідає цьому документу
@@ -1958,7 +1958,6 @@
 	Open this web page?	Відкрити цю вебсторінку?
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Сценарії виконуються в ізольованому середовищі без доступу до файлів і мережі. Сценарій, що просить відкрити вебсторінку, спочатку потребує вашого дозволу. Коли JavaScript вимкнено, стандартні функції форматування, перевірки й обчислення Acrobat усе одно працюють.
 	Sign yourself	Підписати самостійно
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Розпізнавання тексту не встановлено: бракує моделей (виконайте `cargo xtask models` або задайте PDFCRAFT_MODELS).
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Використовується під час відкриття PDF. Явно заданий режим запуску або керування має пріоритет для сеансу.
 	Write this email?	Написати цього листа?
 	{who} in this document wants to open this address in your browser:	{who} у цьому документі хоче відкрити цю адресу у вашому браузері:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 3fdbc568..f8b9f6e2 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -906,7 +906,7 @@
 	Searchable Image (Exact)	可搜索图像（精确）
 	Adds invisible text over each word; the page image is not changed	在每个词上添加不可见文本；页面图像保持不变
 	Downsample to	降采样至
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	未安装文本识别：缺少模型（运行 `cargo xtask models`，或设置 PRINTCRAFT_MODELS）。
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	未安装文本识别：缺少模型文件。请重新安装 PdfCraft，或将 PDFCRAFT_MODELS 设置为包含这些文件的文件夹。
 	Settings	设置
 	Protect	保护
 	Advanced options	高级选项
@@ -1978,7 +1978,7 @@
 	the image is empty	图像为空
 	The operation failed.	操作失败。
 	the password is incorrect	密码不正确
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	尚未安装文本识别模型（请运行 `cargo xtask models` 或设置 PRINTCRAFT_MODELS）
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	尚未安装文本识别模型（请重新安装 PdfCraft，或将 PDFCRAFT_MODELS 设置为包含这些模型的文件夹）
 	The title in the metadata and the document information differ	元数据与文档信息中的标题不一致
 	the title must not be empty	标题不能为空
 	there are no pages to print	没有可打印的页面
@@ -2009,7 +2009,6 @@
 	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	脚本在沙盒中运行，无法访问文件或网络。脚本请求打开网页时，需要先获得您的许可。关闭 JavaScript 后，Acrobat 的标准格式、验证和计算函数仍可使用。
 	Sign yourself	自行签名
 	Switch to two-page view first to show the cover page	请先切换到双页视图，才能显示封面页
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	尚未安装文本识别功能：缺少模型（请运行 `cargo xtask models` 或设置 PDFCRAFT_MODELS）。
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	用于打开 PDF 时。如果启动参数或控制通道明确指定了模式，则本次会话优先使用该模式。
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF 未指定布局或缩放时使用。连续滚动时页面不会逐页吸附。
 	Reopen the files that were open when PdfCraft last closed	重新打开上次关闭 PdfCraft 时打开的文件
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 18fd9301..fae92447 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -861,7 +861,7 @@
 	Searchable Image (Exact)	可搜尋圖片（精確）
 	Adds invisible text over each word; the page image is not changed	在每個詞上新增不可見文字；頁面圖片保持不變
 	Downsample to	降取樣至
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PRINTCRAFT_MODELS).	未安裝文字識別：缺少模型（執行 `cargo xtask models`，或設定 PRINTCRAFT_MODELS）。
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	未安裝文字辨識：缺少模型檔案。請重新安裝 PdfCraft，或將 PDFCRAFT_MODELS 設定為包含這些檔案的資料夾。
 	Settings	設定
 	Protect	保護
 	Advanced options	進階選項
@@ -1768,7 +1768,7 @@
 	there are no pages to print	沒有可列印的頁面
 	the document has no tags	此文件沒有標籤
 	{0}: {1}	{0}：{1}
-	the text recognition models are not installed (run `cargo xtask models`, or set PRINTCRAFT_MODELS)	尚未安裝文字辨識模型，請執行 `cargo xtask models` 或設定 PRINTCRAFT_MODELS
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	尚未安裝文字辨識模型（請重新安裝 PdfCraft，或將 PDFCRAFT_MODELS 設定為包含這些模型的資料夾）
 	the image is empty	圖片是空的
 	this file isn't XFDF, FDF, XML or text form data	此檔案不是 XFDF、FDF、XML 或純文字表單資料
 	nothing in the file matches this document	檔案中沒有與此文件相符的資料
diff --git a/crates/ui-egui/src/ocr_ui.rs b/crates/ui-egui/src/ocr_ui.rs
index c8a32bbe..f980d7cc 100644
--- a/crates/ui-egui/src/ocr_ui.rs
+++ b/crates/ui-egui/src/ocr_ui.rs
@@ -113,7 +113,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
     });
     if !available {
         ui.label(
-            egui::RichText::new(tl!("Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS)."))
+            egui::RichText::new(tl!("Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them."))
                 .small()
                 .color(t.text_muted),
         );
diff --git a/docs/releasing.md b/docs/releasing.md
index 5fb8d70c..06b1c2ce 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -68,6 +68,14 @@ pinned in `release.yml` and builds with `CRAFT_FONTS_DIR` and `CRAFT_FONTS_REQUI
 embed its Japanese fonts and fail rather than ship without them (`AGENTS.md` §1.4). Bump the pin
 deliberately.
 
+**OCR models:** every desktop package ships the Scan & OCR models (#103). The packaging scripts call
+`stage_models` (`packaging/env.sh`; `package.ps1` on Windows), which runs `cargo xtask models` to
+fetch every `kind = "model"` file in `ATTRIBUTION.toml` (verified by SHA-256) with its licence text
+and an `ATTRIBUTION.txt`, straight into the package, so packaging needs the network. They go where
+`pdfcraft_ocr::Models::dirs_beside_exe` looks: `models\` beside `pdfcraft.exe` (MSI, portable zip),
+`PdfCraft.app/Contents/Resources/models` (macOS), and `share/pdfcraft/models` beside `bin/`
+(deb, rpm, tar.gz, AppImage, Flatpak, FreeBSD). The web build doesn't include them yet.
+
 ### macOS
 
 `packaging/macos/package.sh` builds both architectures, joins them with `lipo`, and assembles
diff --git a/packaging/env.sh b/packaging/env.sh
index a903be9c..f34f17bd 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -65,6 +65,25 @@ copy_font_licences() {
   done
 }
 
+# Fetch the OCR models into a package directory (#103): `cargo xtask models DEST` downloads every
+# ATTRIBUTION.toml `kind = "model"` file, verified by SHA-256, with its licence text and an
+# ATTRIBUTION.txt crediting them. DEST must be where pdfcraft_ocr::Models::dirs_beside_exe looks
+# from the installed executable. Nothing here names a model file, so a model added to the manifest
+# later ships without changing the packaging.
+stage_models() {
+  local dest="$1"
+  mkdir -p "$dest"
+  dest="$(cd "$dest" && pwd)"
+  (cd "$ROOT" && cargo xtask models "$dest")
+  rm -f "$dest"/*.part
+  if ! ls "$dest"/*.LICENCE.txt >/dev/null 2>&1 || [ ! -s "$dest/ATTRIBUTION.txt" ]; then
+    echo "error: no OCR models in $dest after cargo xtask models" >&2
+    exit 1
+  fi
+  echo "OCR models in $dest:"
+  ls -l "$dest"
+}
+
 # Portable SHA-256 of a file (prints just the hash).
 sha256() {
   if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
diff --git a/packaging/freebsd/package.sh b/packaging/freebsd/package.sh
index cb357b8b..0828058f 100755
--- a/packaging/freebsd/package.sh
+++ b/packaging/freebsd/package.sh
@@ -6,7 +6,7 @@
 # MIME type, AppStream metadata and icons are the freedesktop ones Linux uses.
 #
 # Usage: packaging/freebsd/package.sh [--skip-build]
-# Needs: bash, a Rust toolchain, and the GUI libraries in .github/workflows/freebsd.yml.
+# Needs: bash, a Rust toolchain, curl and the network (the OCR models), and the GUI libraries in .github/workflows/freebsd.yml.
 set -euo pipefail
 # shellcheck source=../env.sh
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
@@ -51,6 +51,8 @@ sed -e "s/@VERSION@/$VERSION/g" -e "s/@DATE@/$PDFCRAFT_BUILD_DATE/g" \
   "$LINUX/$APP_ID.metainfo.xml.in" >"$STAGE/share/metainfo/$APP_ID.metainfo.xml"
 cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/share/icons/"
 copy_docs "$STAGE/share/doc/pdfcraft"
+# OCR models: the app finds them at <bin>/../share/pdfcraft/models.
+stage_models "$STAGE/share/pdfcraft/models"
 
 "$STAGE/bin/pdfcraft" --version
 mkdir -p "$DIST"
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index f983fa22..4f6d3104 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -66,7 +66,7 @@ if [ "$TEST" = 1 ]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
   flatpak run --command=pdfcraft-cli "$APP_ID" --version
-  flatpak run --command=sh "$APP_ID" -c 'ls /app/share/applications /app/share/metainfo /app/share/mime/packages /app/share/icons/hicolor/scalable/apps'
+  flatpak run --command=sh "$APP_ID" -c 'ls /app/share/applications /app/share/metainfo /app/share/mime/packages /app/share/icons/hicolor/scalable/apps /app/share/pdfcraft/models'
   # Informational: printing runs lp/lpstat, which the freedesktop runtime doesn't ship (see the
   # manifest's finish-args). Says so if a runtime update ever adds them.
   flatpak run --command=sh "$APP_ID" -c 'command -v lp lpstat' || echo "note: no lp/lpstat in the runtime, so printing is unavailable in the Flatpak"
diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
index 05e95167..10aedeee 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
@@ -45,6 +45,8 @@ modules:
       - install -Dm644 share/mime/packages/ai.storyteller.pdfcraft.xml /app/share/mime/packages/ai.storyteller.pdfcraft.xml
       # Already has the release's version and date substituted by package.sh.
       - install -Dm644 share/metainfo/ai.storyteller.pdfcraft.metainfo.xml /app/share/metainfo/ai.storyteller.pdfcraft.metainfo.xml
+      # OCR models (with their licences), found at /app/bin/../share/pdfcraft/models.
+      - mkdir -p /app/share/pdfcraft && cp -R share/pdfcraft/models /app/share/pdfcraft/
       # Licences, including the embedded craft-fonts' OFL texts.
       - mkdir -p /app/share/icons /app/share/doc && cp -R share/icons/hicolor /app/share/icons/ && cp -R share/doc/pdfcraft /app/share/doc/
     sources:
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 06b04a9e..129aaea9 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -10,7 +10,7 @@
 #
 # Usage: packaging/linux/package.sh [--skip-build] [--formats "appimage deb rpm tar cli"]
 #
-# Needs: cargo; nfpm for deb/rpm (https://nfpm.goreleaser.com); appimagetool for the AppImage
+# Needs: cargo, curl and the network (the OCR models: cargo xtask models); nfpm for deb/rpm (https://nfpm.goreleaser.com); appimagetool for the AppImage
 # (downloaded into $CARGO_TARGET_DIR if missing). Build on an old distro (CI: Ubuntu 22.04,
 # glibc 2.35) so the binaries run on newer ones. Optional: desktop-file-validate, appstreamcli,
 # zsyncmake (the zsync package) for the AppImage's .zsync.
@@ -63,6 +63,8 @@ mkdir -p "$STAGE/usr/share/icons"
 cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/usr/share/icons/"
 mkdir -p "$STAGE/usr/share/doc/pdfcraft"
 copy_docs "$STAGE/usr/share/doc/pdfcraft"
+# OCR models: the app finds them at <bin>/../share/pdfcraft/models, so in every format below.
+stage_models "$STAGE/usr/share/pdfcraft/models"
 
 if command -v desktop-file-validate >/dev/null; then
   desktop-file-validate "$STAGE/usr/share/applications/$APP_ID.desktop"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 507e911d..c73581a2 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -104,6 +104,9 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 cp "$WORK/bin/pdfcraft" "$APP/Contents/MacOS/PdfCraft"
 cp "$ROOT/assets/app-icon/pdfcraft.icns" "$APP/Contents/Resources/PdfCraft.icns"
 copy_font_licences "$APP/Contents/Resources"
+# OCR models: the app finds them at Contents/MacOS/../Resources/models. Before signing, so the
+# bundle's seal covers them.
+stage_models "$APP/Contents/Resources/models"
 sed -e "s/@VERSION@/$VERSION/g" -e "s/@SHORT_VERSION@/$SHORT_VERSION/g" \
   -e "s/@BUILD_SHA@/${PDFCRAFT_BUILD_SHA:-unknown}/g" \
   "$HERE/Info.plist.in" >"$APP/Contents/Info.plist"
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index 14588668..c556652d 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -5,13 +5,13 @@
 .DESCRIPTION
   Produces, in $env:DIST (default: dist/release):
     pdfcraft-<version>-windows-<arch>.msi            per-machine installer (WiX v5)
-    pdfcraft-<version>-windows-<arch>-portable.zip   pdfcraft.exe + pdfcraft-cli.exe + portable.txt
+    pdfcraft-<version>-windows-<arch>-portable.zip   pdfcraft.exe + pdfcraft-cli.exe + models\ + portable.txt
 
   The binaries link the C runtime statically (+crt-static), so neither the MSI nor the portable
   zip needs the Visual C++ redistributable. Signing is delegated to sign.ps1 (skipped with a
   warning when no signing secrets are set).
 
-  Needs: Rust (MSVC toolchain + the target), the Windows SDK (rc.exe, signtool.exe),
+  Needs: Rust (MSVC toolchain + the target), curl and the network (the OCR models), the Windows SDK (rc.exe, signtool.exe),
   and WiX v5: dotnet tool install --global wix --version 5.0.2
 
 .EXAMPLE
@@ -90,12 +90,24 @@ Copy-Item (Join-Path $Bin 'pdfcraft.exe'), (Join-Path $Bin 'pdfcraft-cli.exe') $
 
 & (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'pdfcraft.exe') (Join-Path $Stage 'pdfcraft-cli.exe')
 
+# OCR models (#103): the app looks in models\ beside pdfcraft.exe. `cargo xtask models` fetches every
+# ATTRIBUTION.toml `kind = "model"` file (verified by SHA-256) with its licence and ATTRIBUTION.txt;
+# the MSI and the portable zip take the whole folder, so new models ship without naming them here.
+$Models = Join-Path $Stage 'models'
+New-Item -ItemType Directory -Force -Path $Models | Out-Null
+Push-Location $Root
+try { Invoke-Native 'cargo xtask models' { cargo xtask models $Models } } finally { Pop-Location }
+Remove-Item -Force (Join-Path $Models '*.part') -ErrorAction SilentlyContinue
+if (-not (Test-Path (Join-Path $Models 'ATTRIBUTION.txt')) -or -not (Get-ChildItem (Join-Path $Models '*.LICENCE.txt'))) {
+  throw "no OCR models in $Models after cargo xtask models"
+}
+
 # ---- MSI ---------------------------------------------------------------------------------------
 $Msi = Join-Path $Dist "pdfcraft-$Version-windows-$Arch.msi"
 Invoke-Native 'wix build' {
   wix build (Join-Path $PSScriptRoot 'pdfcraft.wxs') -arch $Arch `
     (Join-Path $PSScriptRoot 'installer-ui.wxs') `
-    -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\pdfcraft.ico')" `
+    -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "ModelsDir=$Models" -d "IconPath=$(Join-Path $Root 'assets\app-icon\pdfcraft.ico')" `
     -o $Msi
 }
 # Inspect the built MSI, not just the XML, before signing/publishing it. In a child process, so
@@ -110,6 +122,7 @@ $Portable = Join-Path $TargetDir "windows-package\pdfcraft-$Version-windows-$Arc
 Remove-Item -Recurse -Force $Portable -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force -Path $Portable | Out-Null
 Copy-Item (Join-Path $Stage '*.exe') $Portable
+Copy-Item -Recurse $Models (Join-Path $Portable 'models')
 foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
   $p = Join-Path $Root $f
   if (Test-Path $p) { Copy-Item $p $Portable }
diff --git a/packaging/windows/pdfcraft.wxs b/packaging/windows/pdfcraft.wxs
index cd0480fa..200800af 100644
--- a/packaging/windows/pdfcraft.wxs
+++ b/packaging/windows/pdfcraft.wxs
@@ -2,7 +2,7 @@
 <!--
   PdfCraft MSI (WiX Toolset v5: `dotnet tool install -g wix`). Built by package.ps1:
 
-    wix build pdfcraft.wxs installer-ui.wxs -arch x64 -d Version=1.2.3 -d BinDir=... -d IconPath=... -o out.msi
+    wix build pdfcraft.wxs installer-ui.wxs -arch x64 -d Version=1.2.3 -d BinDir=... -d ModelsDir=... -d IconPath=... -o out.msi
 
   Per-machine install into Program Files, a Start Menu shortcut, a desktop shortcut (on by default,
   optional), an App Paths entry, and PdfCraft registered as a PDF handler (offered under "Open with"
@@ -43,13 +43,16 @@
     <UIRef Id="PdfcraftInstallerUI" />
 
     <StandardDirectory Id="ProgramFiles6432Folder">
-      <Directory Id="INSTALLFOLDER" Name="PdfCraft" />
+      <Directory Id="INSTALLFOLDER" Name="PdfCraft">
+        <Directory Id="ModelsFolder" Name="models" />
+      </Directory>
     </StandardDirectory>
     <StandardDirectory Id="ProgramMenuFolder" />
     <StandardDirectory Id="DesktopFolder" />
 
     <Feature Id="Main" Title="PdfCraft" Level="1">
       <ComponentGroupRef Id="PdfcraftFiles" />
+      <ComponentGroupRef Id="PdfcraftModels" />
     </Feature>
   </Package>
 
@@ -134,5 +137,12 @@
         <File Id="PdfcraftCliExe" Source="$(var.BinDir)\pdfcraft-cli.exe" KeyPath="yes" />
       </Component>
     </ComponentGroup>
+
+    <!-- OCR models (#103), with their licences and ATTRIBUTION.txt, in models\ beside pdfcraft.exe
+         where the app looks for them: every file `cargo xtask models` fetched (package.ps1), one
+         component each, so new models ship without naming them here. -->
+    <ComponentGroup Id="PdfcraftModels" Directory="ModelsFolder">
+      <Files Include="$(var.ModelsDir)\*" />
+    </ComponentGroup>
   </Fragment>
 </Wix>
diff --git a/packaging/windows/test-msi.ps1 b/packaging/windows/test-msi.ps1
index 29191c40..9c0d50b5 100644
--- a/packaging/windows/test-msi.ps1
+++ b/packaging/windows/test-msi.ps1
@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-  Check the compiled MSI's install scope, publisher, shortcuts and native UI, without installing it.
+  Check the compiled MSI's install scope, publisher, shortcuts, native UI and OCR models, without installing it.
 .EXAMPLE
   pwsh packaging/windows/test-msi.ps1 dist/release/pdfcraft-0.2.1-windows-x64.msi
 #>
@@ -131,8 +131,20 @@ foreach ($exit in @(@('InstallComplete', '-1'), @('InstallCancelled', '-2'), @('
 }
 $title = Read-Row 'SELECT `Text` FROM `Control` WHERE `Dialog_` = ''InstallComplete'' AND `Control` = ''Title''' 1
 if ($title[0] -notmatch 'completed successfully') { throw 'Success dialog does not confirm completion' }
+# OCR models (#103): installed into models\ beside pdfcraft.exe, where the app looks for them.
+$modelsDir = Read-Row 'SELECT `Directory_Parent`, `DefaultDir` FROM `Directory` WHERE `Directory` = ''ModelsFolder''' 2
+Assert-Equal $modelsDir[0] 'INSTALLFOLDER' 'OCR models folder parent'
+# DefaultDir is `models`, or `SHORT|models` with a generated 8.3 name.
+if ($modelsDir[1] -notmatch '(^|\|)models$') { throw "OCR models folder name: '$($modelsDir[1])'" }
+$modelFiles = 0
+$view = $Database.OpenView('SELECT `File`.`FileName` FROM `File`, `Component` WHERE `File`.`Component_` = `Component`.`Component` AND `Component`.`Directory_` = ''ModelsFolder''')
+try {
+  [void] $view.Execute()
+  while ($record = $view.Fetch()) { if ($record.StringData(1) -match '\.rten$') { $modelFiles++ } }
+} finally { [void] $view.Close() }
+if ($modelFiles -lt 2) { throw "expected the OCR models (*.rten) in models\, found $modelFiles" }
 $rm = Read-Row 'SELECT `Dialog` FROM `Dialog` WHERE `Dialog` = ''MsiRMFilesInUse''' 1
 Assert-Equal $rm[0] 'MsiRMFilesInUse' 'Files-in-use dialog'
 [void] [Runtime.InteropServices.Marshal]::FinalReleaseComObject($Database)
 [void] [Runtime.InteropServices.Marshal]::FinalReleaseComObject($Installer)
-Write-Output 'ok MSI: per-machine scope guard, publisher, persistent progress text, Start Menu shortcut, optional desktop shortcut (default on, checkbox), icon/key path, full-UI success/cancel/error and Finish controls, files-in-use dialog'
+Write-Output 'ok MSI: per-machine scope guard, publisher, persistent progress text, Start Menu shortcut, optional desktop shortcut (default on, checkbox), icon/key path, full-UI success/cancel/error and Finish controls, files-in-use dialog, OCR models'
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ba32039e..42aebb07 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -6367,7 +6367,7 @@ status = "shipped"
 commands = ["ocr.recognize"]
 tools = ["ocr_recognize", "ocr_status"]
 evidence = ["crates/engine/src/tests.rs::recognize_text_makes_a_scanned_page_searchable", "crates/automation/tests/automation.rs::ocr_tools_make_a_scan_searchable", "crates/ui-egui/tests/ocr.rs::recognize_text_dialog_adds_searchable_text"]
-notes = "ocrs engine (MIT/Apache) with CC-BY-SA models fetched by `cargo xtask models`; runs on a worker thread with progress; one undoable step; pages with text are skipped."
+notes = "ocrs engine (MIT/Apache) with CC-BY-SA models fetched by `cargo xtask models`; the desktop release packages ship them (#103; packaging/env.sh stage_models), the web build does not yet; runs on a worker thread with progress; one undoable step; pages with text are skipped."
 
 [[feature]]
 id = "ocr.recognize-range"
diff --git a/xtask/src/assets.rs b/xtask/src/assets.rs
index 43a0af7b..870d9b95 100644
--- a/xtask/src/assets.rs
+++ b/xtask/src/assets.rs
@@ -336,7 +336,8 @@ fn fetch_verified(url: &str, path: &Path, sha256: &str) -> Result<()> {
 }
 
 /// `cargo xtask models [DIR]`: fetch the OCR models (`kind = "model"`) into `assets/models/` (git-ignored),
-/// where the app and tests look for them.
+/// where the app and tests look for them. Each comes with its licence (`<file>.LICENCE.txt`), and
+/// `ATTRIBUTION.txt` credits them all, so the release packages can ship the directory as it is.
 pub fn models(args: &[String]) -> Result<()> {
     let root = root();
     let m = load(&root)?;
@@ -344,9 +345,23 @@ pub fn models(args: &[String]) -> Result<()> {
     for p in fetch_all(&m, &dir, "model")? {
         println!("models: {}", p.display());
     }
+    std::fs::write(dir.join("ATTRIBUTION.txt"), models_attribution(&m))?;
     Ok(())
 }
 
+/// The credits shipped beside the models (their licences require attribution).
+fn models_attribution(m: &Manifest) -> String {
+    let mut s = String::from("PdfCraft's text recognition (Scan & OCR) uses these models, unmodified.\n");
+    for f in m.fetched.iter().filter(|f| f.kind == "model") {
+        let _ = write!(
+            s,
+            "\n{}\n  {}\n  by {}\n  from {}\n  licence: {} ({}; full text in {}.LICENCE.txt)\n",
+            f.file, f.title, f.author, f.source, f.licence, f.licence_url, f.file
+        );
+    }
+    s
+}
+
 /// ATTRIBUTION.md, generated from the manifest.
 pub fn render_markdown(m: &Manifest) -> String {
     let mut s = String::new();
@@ -417,6 +432,18 @@ pub fn render_markdown(m: &Manifest) -> String {
 mod tests {
     use super::*;
 
+    /// The release packages ship assets/models as fetched (#103): every model is credited there.
+    #[test]
+    fn models_attribution_credits_every_model() {
+        let m = load(&root()).unwrap();
+        let text = models_attribution(&m);
+        let models: Vec<_> = m.fetched.iter().filter(|f| f.kind == "model").collect();
+        assert!(!models.is_empty());
+        for f in models {
+            assert!(text.contains(&f.file) && text.contains(&f.author) && text.contains(&f.licence), "{}", f.file);
+        }
+    }
+
     fn asset(path: &str, author: &str, kind: &str, licence: &str) -> Asset {
         Asset {
             path: path.into(),

From 0079bead14d7f83fcc7bbeee9d0b98b83b86d330 Mon Sep 17 00:00:00 2001
From: Thorsten Hirsch <t.hirsch@web.de>
Date: Sat, 10 Oct 2026 00:42:37 +0200
Subject: [PATCH 132/149] M9: validate a document timestamp that sits in a
 signature field (#621)

* M9: validate a document timestamp that sits in a signature field

Documenso (and others) store the document timestamp as an AcroForm signature
field (`Timestamp_1`) whose /V is a /Type /DocTimeStamp dictionary. Field
values only went through the signature validator, which read the RFC 3161
token as a CMS signature, compared its TSTInfo with the document digest and
reported "altered or corrupted since the signature was applied" for an
untouched file.

- A field value with /SubFilter /ETSI.RFC3161 is validated as a timestamp.
- Standalone timestamps are found with /Type /DocTimeStamp (ISO 32000-2
  12.8.5) as well as the /Type /Sig older writers used; our own
  timestamp_document now writes /DocTimeStamp. The discovery cache (#419)
  selects its candidates with the same test, so it sees both.
- The discovery test that lists a signature field holding a timestamp used to
  assert `doc_timestamp == false`, which is the bug above; it asserts true now.
  What that test is about (the field is listed once, not also as a standalone
  timestamp) is unchanged.

Regression tests build the same structure with a test TSA; no third-party
file is needed, and they fail without the fix.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* M9: a trusted TSA whose certificate wasn't valid when it stamped leaves a document timestamp Unknown, never Valid

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                             |   2 +
 crates/sign/src/pdf.rs                 |  32 ++++++--
 crates/sign/src/pdf_discovery_tests.rs |   4 +-
 crates/sign/tests/pdf.rs               | 105 +++++++++++++++++++++++++
 4 files changed, 136 insertions(+), 7 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 707cbc4b..3a71d948 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -170,6 +170,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (M9, review of #144):** Chain building checks what an issuer may do. `x509::build_chain` linked certificates by name and signature only, so an ordinary subscriber certificate embedded in a PDF, or one in the trusted list, could "issue" a certificate for any identity and chain to a trusted root. An issuer now needs basicConstraints CA:TRUE (an old v1 self-signed root without constraints still anchors), keyCertSign when it has a key usage, a pathLenConstraint that allows the CAs below it, and validity at the signing time (or the trusted timestamp/token time) when known; the signature's details say why an issuer was refused. Negative tests issue certificates in-process and cover each refusal, plus a signed PDF whose signer chains through an end-entity certificate (Unknown, not Valid). Still missing: key usage and extended key usage of the signer, name constraints and unknown critical extensions. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M9):** A document timestamp stored as a signature field (Documenso writes `Timestamp_1` that way, its `/V` a `/Type /DocTimeStamp` dictionary) was read as a CMS signature and reported "altered or corrupted since the signature was applied" on an untouched file. A field value with `/SubFilter /ETSI.RFC3161` is validated as a timestamp now, and standalone timestamps are found by `/DocTimeStamp` (ISO 32000-2 §12.8.5) as well as the `/Type /Sig` older writers used; `timestamp_document` writes `/DocTimeStamp`. Regression tests build the same structure with a test TSA. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (M14, German interface follow-up):** Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.
 
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index 2881b7cf..ba7db951 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -56,7 +56,7 @@ struct TimestampCandidates {
 const DISCOVERY_CACHE_LIMIT: usize = 4096;
 
 fn is_document_timestamp(object: &Object) -> bool {
-    object.as_dict().is_some_and(|d| d.name(b"Type") == Some(b"Sig") && d.name(b"SubFilter") == Some(b"ETSI.RFC3161") && d.contains(b"ByteRange"))
+    object.as_dict().is_some_and(|d| is_doc_timestamp(d) && d.contains(b"ByteRange"))
 }
 
 /// Only dictionary/null edits have a local effect on candidate membership. Changes to an
@@ -473,7 +473,23 @@ fn unhex(s: &[u8]) -> Option<Vec<u8>> {
     digits.chunks(2).map(|p| Some(val(p[0])? << 4 | p.get(1).map_or(Some(0), |c| val(*c))?)).collect()
 }
 
+/// A document timestamp dictionary: `/SubFilter /ETSI.RFC3161`, typed `/DocTimeStamp`
+/// (ISO 32000-2 §12.8.5) or, as older writers have it, `/Sig`.
+fn is_doc_timestamp(d: &Dict) -> bool {
+    d.name(b"SubFilter") == Some(b"ETSI.RFC3161") && matches!(d.name(b"Type"), Some(b"DocTimeStamp" | b"Sig"))
+}
+
 fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, info: &mut SignatureInfo, cache: &DigestCache) {
+    // A document timestamp can also be the value of a signature field (Documenso writes
+    // `Timestamp_1` that way). Its `/Contents` is a bare RFC 3161 token, not a signature over the
+    // document, so it must not be read as one.
+    if is_doc_timestamp(v) {
+        info.sub_filter = Some("ETSI.RFC3161".to_string());
+        info.doc_timestamp = true;
+        info.timestamp = true;
+        validate_doc_timestamp(doc, bytes, v, info, cache, trust);
+        return;
+    }
     info.date = text(doc, v, b"M");
     info.reason = text(doc, v, b"Reason");
     info.location = text(doc, v, b"Location");
@@ -781,11 +797,15 @@ fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut Sig
         // ordinary signature from an unknown signer.
         let mut pool = crate::timestamp::token_certs(&contents);
         pool.extend(trust.certs.iter().cloned());
-        let trusted_tsa =
-            token.signer_certificate().map(|c| build_chain(&c, &pool, Some(token.gen_time)).iter().any(|x| trust.trusts(x))).unwrap_or(false);
-        if trusted_tsa {
+        // A trusted authority whose certificate was not valid at the time it stamped proves
+        // nothing either (its detail is already recorded above): never upgrade that to Valid.
+        let in_validity = token.signer_certificate().is_some_and(|c| c.valid_at(token.gen_time));
+        let trusted_tsa = token.signer_certificate().is_some_and(|c| build_chain(&c, &pool, Some(token.gen_time)).iter().any(|x| trust.trusts(x)));
+        if trusted_tsa && in_validity {
             info.status = Status::Valid;
             info.details.push("The timestamp token is valid and its authority is trusted.".into());
+        } else if trusted_tsa {
+            info.status = Status::Unknown;
         } else {
             info.status = Status::Unknown;
             info.details.push("The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.".into());
@@ -822,7 +842,7 @@ pub(crate) fn signature_contents(doc: &Document) -> Vec<Vec<u8>> {
     }
     for (r, o) in doc.scan_objects() {
         let Some(d) = o.as_dict() else { continue };
-        if d.name(b"Type") == Some(b"Sig") && d.name(b"SubFilter") == Some(b"ETSI.RFC3161") {
+        if is_doc_timestamp(d) {
             add(d, Some(r));
         }
     }
@@ -1280,7 +1300,7 @@ pub fn timestamp_document(doc: &Document, tsa: &dyn crate::timestamp::TimestampA
     }
     let mut doc = doc.clone();
     let mut v = Dict::new();
-    v.set(b"Type".to_vec(), Object::name("Sig"));
+    v.set(b"Type".to_vec(), Object::name("DocTimeStamp"));
     v.set(b"Filter".to_vec(), Object::name("Adobe.PPKLite"));
     v.set(b"SubFilter".to_vec(), Object::name("ETSI.RFC3161"));
     v.set(b"ByteRange".to_vec(), Object::Array([0].iter().chain(BR_MARK.iter()).map(|n| Object::Int(*n)).collect()));
diff --git a/crates/sign/src/pdf_discovery_tests.rs b/crates/sign/src/pdf_discovery_tests.rs
index 1798e76b..e9e40f64 100644
--- a/crates/sign/src/pdf_discovery_tests.rs
+++ b/crates/sign/src/pdf_discovery_tests.rs
@@ -113,7 +113,9 @@ fn field_membership_is_refreshed_even_when_discovery_is_cached() {
     let listed = list_cached(&doc, doc.bytes(), &TrustStore::default(), &cache);
     assert_eq!(listed.len(), 1, "field values must not be duplicated as standalone timestamps");
     assert_eq!(listed[0].field, "Approval");
-    assert!(!listed[0].doc_timestamp);
+    // A field whose value is a document timestamp (Documenso writes `Timestamp_1` so) is still
+    // checked as a timestamp: its /Contents is a bare RFC 3161 token, not a signature.
+    assert!(listed[0].doc_timestamp);
     doc.update_dict(doc.root().unwrap(), |d| {
         d.remove(b"AcroForm");
     })
diff --git a/crates/sign/tests/pdf.rs b/crates/sign/tests/pdf.rs
index 132787bf..206277f6 100644
--- a/crates/sign/tests/pdf.rs
+++ b/crates/sign/tests/pdf.rs
@@ -776,3 +776,108 @@ fn signing_with_windows_store_identities() {
         assert!(out.status.success(), "test certificate remains: {thumbprint}");
     }
 }
+
+/// Documenso-style: an AcroForm signature field `Timestamp_1` whose `/V` is the document
+/// timestamp dictionary (`/Type /DocTimeStamp`, `/SubFilter /ETSI.RFC3161`).
+fn fixture_timestamped_in_a_field(tsa: &TestTsa) -> Vec<u8> {
+    let mut value_num = 0;
+    let base = edit_after(&fixture(), |doc| {
+        let field = doc.add(Object::Null);
+        // `timestamp_document` adds its dictionary next.
+        value_num = field.num + 1;
+        let at = |num| Object::Ref(pdfcraft_cos::ObjRef { num, generation: 0 });
+        let mut widget = pdfcraft_cos::Dict::new();
+        for (k, v) in [
+            ("Type", Object::name("Annot")),
+            ("Subtype", Object::name("Widget")),
+            ("FT", Object::name("Sig")),
+            ("T", Object::String(PdfString::text("Timestamp_1"))),
+            ("Rect", Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(0), Object::Int(0)])),
+            ("P", at(3)),
+            ("F", Object::Int(132)),
+            ("V", at(value_num)),
+        ] {
+            widget.set(k.as_bytes().to_vec(), v);
+        }
+        doc.set(field, Object::Dict(widget));
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| {
+            if let Some(Object::Dict(form)) = c.get_mut(b"AcroForm")
+                && let Some(Object::Array(fields)) = form.get_mut(b"Fields")
+            {
+                fields.push(Object::Ref(field));
+            }
+        })
+        .unwrap();
+    });
+    let stamped = pdfcraft_sign::timestamp_document(&open(&base), tsa, "D:20261006120000Z").unwrap();
+    let held = open(&stamped).get(pdfcraft_cos::ObjRef { num: value_num, generation: 0 });
+    assert_eq!(held.as_dict().and_then(|d| d.name(b"Type")), Some(&b"DocTimeStamp"[..]), "the field holds the timestamp");
+    stamped
+}
+
+#[test]
+fn a_document_timestamp_held_by_a_signature_field_is_checked_as_a_timestamp() {
+    let tsa = TestTsa {
+        id: pkcs12::open(&data("rsa-aes.p12"), "test").unwrap(),
+        time: Time { year: 2026, month: 10, day: 6, hour: 12, minute: 0, second: 0 },
+    };
+    let stamped = fixture_timestamped_in_a_field(&tsa);
+    let trust = TrustStore { certs: vec![tsa.id.certificate.clone()] };
+    let all = signatures(&open(&stamped), &stamped, &trust);
+    let stamps: Vec<_> = all.iter().filter(|s| s.signed).collect();
+    assert_eq!(stamps.len(), 1, "listed once, not as field and as standalone: {:?}", all.iter().map(|s| &s.field).collect::<Vec<_>>());
+    let s = stamps[0];
+    assert_eq!(s.field, "Timestamp_1");
+    assert!(s.doc_timestamp && s.timestamp);
+    assert_eq!(s.sub_filter.as_deref(), Some("ETSI.RFC3161"));
+    assert_eq!(s.timestamp_time, Some(tsa.time));
+    assert_eq!(s.status, Status::Valid, "{:?}", s.details);
+    // Without trusting the TSA the stamp is intact but unknown, never "altered".
+    let s = signatures(&open(&stamped), &stamped, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!(s.status, Status::Unknown, "{:?}", s.details);
+    assert!(!s.details.iter().any(|d| d.contains("altered or corrupted")), "{:?}", s.details);
+    // A changed byte in what it covers is still caught, and reported as the timestamp's.
+    let mut tampered = stamped.clone();
+    let i = tampered.windows(13).position(|w| w == b"Contract text").unwrap();
+    tampered[i] = b'K';
+    let s = signatures(&open(&tampered), &tampered, &trust).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!(s.status, Status::Invalid);
+    assert!(s.details.iter().any(|d| d.contains("since the timestamp was applied")), "{:?}", s.details);
+}
+
+/// A trusted timestamp authority whose certificate was not yet valid when it stamped proves
+/// nothing: the field timestamp stays Unknown, never Valid.
+#[test]
+fn a_field_timestamp_from_a_trusted_tsa_outside_its_validity_is_not_valid() {
+    let tsa = TestTsa {
+        id: pkcs12::open(&data("rsa-aes.p12"), "test").unwrap(),
+        // Before the TSA certificate's validity (it starts in October 2026).
+        time: Time { year: 2020, month: 1, day: 1, hour: 0, minute: 0, second: 0 },
+    };
+    let stamped = fixture_timestamped_in_a_field(&tsa);
+    let trust = TrustStore { certs: vec![tsa.id.certificate.clone()] };
+    let s = signatures(&open(&stamped), &stamped, &trust).into_iter().find(|s| s.signed).unwrap();
+    assert!(s.doc_timestamp);
+    assert_eq!(s.status, Status::Unknown, "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.contains("was not valid at the time of timestamping")), "{:?}", s.details);
+    assert!(!s.details.iter().any(|d| d.contains("its authority is trusted")), "{:?}", s.details);
+}
+
+#[test]
+fn a_standalone_timestamp_typed_sig_by_an_older_writer_is_still_a_timestamp() {
+    let tsa = TestTsa {
+        id: pkcs12::open(&data("rsa-aes.p12"), "test").unwrap(),
+        time: Time { year: 2026, month: 10, day: 6, hour: 12, minute: 0, second: 0 },
+    };
+    let stamped = pdfcraft_sign::timestamp_document(&open(&fixture()), &tsa, "D:20261006120000Z").unwrap();
+    let s = signatures(&open(&stamped), &stamped, &TrustStore::default()).into_iter().find(|s| s.doc_timestamp).unwrap();
+    assert_eq!(s.status, Status::Unknown, "{:?}", s.details);
+    // The same bytes with `/Type /Sig` in place of `/Type /DocTimeStamp` (padded to the same
+    // length): the imprint no longer matches, but it is still found as a timestamp.
+    let mut old = stamped.clone();
+    let at = old.windows(19).position(|w| w == b"/Type /DocTimeStamp").unwrap();
+    old[at..at + 19].copy_from_slice(b"/Type /Sig         ");
+    let s = signatures(&open(&old), &old, &TrustStore::default()).into_iter().find(|s| s.doc_timestamp).expect("found as a timestamp");
+    assert_eq!(s.status, Status::Invalid);
+}

From c957288d3b5fd617536f2dba08545e289d21bc9f Mon Sep 17 00:00:00 2001
From: Thorsten Hirsch <t.hirsch@web.de>
Date: Sat, 10 Oct 2026 00:43:21 +0200
Subject: [PATCH 133/149] M9: read BER signatures (DocuSign, Documenso);
 classify later changes narrowly (#144)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M9: read BER signatures; later changes are classified narrowly

Real-world signatures (DocuSign, Telekom QES, Documenso) are BER: indefinite
lengths and segmented OCTET STRINGs, which the strict DER reader turned away
("DER signature wrong"). Behind that, later revisions that add DSS data or
rewrite the XMP were classified as tampering.

- cms: the CMS structure is read with `Tlv::parse_ber` (the reader #453 added
  for PKCS#12); certificates and signed attributes are still verified over
  their own exact bytes, signed attributes with an indefinite length are
  re-encoded as DER first (RFC 5652 §5.4), and the details say the signature
  was BER. High tag numbers are not read.
- pdf: validation data added after signing is a permitted change, but only
  objects reached through /DSS /Certs|CRLs|OCSPs|VRI by the keys the standard
  defines, with the shape of their role, and new or only grown since signing.
  A /DSS entry naming other objects (a page's contents) excuses nothing.
- pdf: only the signed catalog's /Metadata is the document's XMP. A
  /Type /Metadata or /Type /DSS label on any other dictionary or stream, even
  one it already had when signed (a page's Form XObject), makes nothing
  permitted. Negative tests at every DocMDP level.

Six of the new tests fail on the previous code: the BER signature, nested
segments, the store-growth rules, and a dictionary or stream carrying a
/Type /Metadata or /Type /DSS label. The last one let a drawn Form XObject be
rewritten under a Valid signature.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* M9: comparing a grown document security store is linear for references and bounded otherwise

only_grew compared arrays element by element, so a crafted /Certs of ~100k entries could hang
validation. Reference arrays are compared as sets; other arrays only up to 10,000 elements.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                             |   2 +
 crates/sign/README.md                  |  15 +-
 crates/sign/src/cms.rs                 |  29 +-
 crates/sign/src/der.rs                 |   6 +
 crates/sign/src/pdf.rs                 | 137 ++++++++-
 crates/sign/src/pdf_discovery_tests.rs |  19 ++
 crates/sign/tests/ber.rs               |  76 +++++
 crates/sign/tests/pdf.rs               | 378 +++++++++++++++++++++++++
 parity/acrobat-features.toml           |   8 +-
 9 files changed, 650 insertions(+), 20 deletions(-)
 create mode 100644 crates/sign/tests/ber.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 3a71d948..d9d99326 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -172,6 +172,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (M9):** A document timestamp stored as a signature field (Documenso writes `Timestamp_1` that way, its `/V` a `/Type /DocTimeStamp` dictionary) was read as a CMS signature and reported "altered or corrupted since the signature was applied" on an untouched file. A field value with `/SubFilter /ETSI.RFC3161` is validated as a timestamp now, and standalone timestamps are found by `/DocTimeStamp` (ISO 32000-2 §12.8.5) as well as the `/Type /Sig` older writers used; `timestamp_document` writes `/DocTimeStamp`. Regression tests build the same structure with a test TSA. Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M9, signatures as DocuSign and Documenso write them, #144):** A real DocuSign + Telekom qualified-signature PDF showed "DER signature wrong" although Acrobat validates it: both CMS blobs use BER indefinite lengths. The CMS is read with the BER reader that #453 added (`Tlv::parse_ber`: indefinite lengths, segmented OCTET STRINGs, depth-bounded) while certificates and signed attributes are still verified over their own exact bytes, and the details say the signature was BER; tests build the nesting bombs a crafted /Contents could hold. Behind that, later revisions that add DSS data (indirect `/Certs`, `/VRI`) or rewrite the catalog's XMP were classified as disallowed changes; they are permitted now, narrowly (review by echelon on #144): only objects reached through `/DSS` `/Certs|CRLs|OCSPs|VRI` with the shape of their role, and new or only grown since signing, count as the store, and only the catalog's `/Metadata` is the document's XMP. A `/DSS` entry naming a page's contents, or a `/Type /DSS` or `/Type /Metadata` label on an existing dictionary or stream, makes nothing permitted. Six of the new tests fail on the previous code, among them a Form XObject labelled `/Type /Metadata` before signing that could be rewritten under a Valid signature. Negative tests at every DocMDP level. Cross-checked with pdfsig (both signatures valid). Still missing: AATL/EUTL trust lists (a separate change: they need CA-constraint checks in chain building first). Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (M14, German interface follow-up):** Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.
 
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
diff --git a/crates/sign/README.md b/crates/sign/README.md
index 6e8e785b..cb7455f8 100644
--- a/crates/sign/README.md
+++ b/crates/sign/README.md
@@ -38,7 +38,10 @@ for s in signatures(&doc, &bytes, &trust) {                                // li
   validity). `dss::embed` merges revocation evidence into the catalog's `/DSS` with `/VRI`
   entries keyed per signature (uppercase-hex SHA-1 of `/Contents`), deduplicating
   byte-identical blobs — sign → DSS → timestamp makes a B-LTA file, and the change classifier
-  treats the store as a permitted change. `revocation` parses and verifies RFC 5280 CRLs and
+  treats the store as a permitted change: only objects reached through `/Certs`, `/CRLs`,
+  `/OCSPs` and `/VRI` with the shape of their role, and new or only grown since the signature,
+  count (a `/DSS` entry naming a page's contents, or a `/Type /DSS` label, does not).
+  `revocation` parses and verifies RFC 5280 CRLs and
   RFC 6960 OCSP responses (responder identity, OCSP-signing EKU for delegated responders,
   CertID hash matching, validity windows); validation checks embedded evidence against the
   signer's chain and a verified revocation invalidates the signature.
@@ -59,6 +62,16 @@ ECDSA P-256/P-384; the store integration is tested with software-backed keys.
   `pathLenConstraint` that allows the CAs below it, and, given the signing time, validity then.
   Certificates embedded in a document are in the pool too, so an ordinary subscriber certificate
   can never vouch for another one; when an issuer is refused, the signature's details say why.
+- **BER as well as DER.** The CMS is read with `der::Tlv::parse_ber`, as Windows CryptoAPI, Adobe
+  PPKMS, DocuSign, Documenso and `openssl cms -stream` write it: indefinite lengths and an
+  OCTET STRING split into segments. Only the structure is read that way; certificates and signed
+  attributes are still verified over their own exact bytes (signed attributes written with an
+  indefinite length are re-encoded as DER first, as RFC 5652 §5.4 has them signed). Nesting is
+  bounded, and the details say that the signature was BER. High tag numbers are not read.
+- **Later changes are classified narrowly.** Only the catalog's own `/Metadata` stream is the
+  document's XMP, and only objects reached through the `/DSS` keys above are the security store. A
+  `/Type /Metadata` or `/Type /DSS` *label* on any other dictionary or stream (a page's Form
+  XObject, say) makes nothing permitted, at every DocMDP level.
 
 Oracles: poppler's `pdfsig` reports our signatures valid; OpenSSL reads our `.p12` files and
 verifies our CMS; `tests/data/openssl-signed.pdf` is a signature OpenSSL made, which we validate.
diff --git a/crates/sign/src/cms.rs b/crates/sign/src/cms.rs
index d665b4c5..7627c44e 100644
--- a/crates/sign/src/cms.rs
+++ b/crates/sign/src/cms.rs
@@ -50,6 +50,8 @@ pub struct SignedData {
     pub signer: SignerInfo,
     /// Encapsulated content (`adbe.pkcs7.sha1` carries the document digest here).
     pub content: Option<Vec<u8>>,
+    /// Encoding irregularities that were tolerated (BER instead of DER, …), for the details.
+    pub quirks: Vec<&'static str>,
 }
 
 fn bad(what: &str) -> SignError {
@@ -60,7 +62,14 @@ impl SignedData {
     /// Parse a `ContentInfo` holding SignedData. Bytes after it (a PDF placeholder's zero
     /// padding) are ignored.
     pub fn parse(bytes: &[u8]) -> Result<SignedData, SignError> {
-        let (ci, _) = Tlv::parse(bytes)?;
+        // CMS from DocuSign, Documenso, Windows and `openssl cms -stream` is BER (indefinite lengths,
+        // segmented strings). Only its structure is read this way: certificates and signed
+        // attributes are still verified over their own exact bytes.
+        let (ci, _) = Tlv::parse_ber(bytes)?;
+        let mut quirks = Vec::new();
+        if ci.is_indefinite() {
+            quirks.push("The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.");
+        }
         let ci = ci.expect(tag::SEQUENCE, "ContentInfo")?.children()?;
         let [ct, content] = ci.as_slice() else { return Err(bad("ContentInfo")) };
         if ct.oid()? != SIGNED_DATA {
@@ -73,9 +82,12 @@ impl SignedData {
         let encap = it.next().ok_or_else(|| bad("encapContentInfo"))?.children()?;
         let content = match encap.get(1) {
             Some(c) if c.tag == tag::ctx(0) => {
+                // BER signers may split the content into a constructed OCTET STRING.
                 let inner = c.inner()?;
-                // Constructed OCTET STRINGs (BER) are not expected in DER-signed PDFs.
-                Some(inner.expect(tag::OCTET_STRING, "eContent")?.value.to_vec())
+                if inner.tag != tag::OCTET_STRING {
+                    quirks.push("The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.");
+                }
+                Some(inner.octets("eContent")?.into_owned())
             }
             _ => None,
         };
@@ -99,7 +111,7 @@ impl SignedData {
         }
         let infos = signer_infos.ok_or_else(|| bad("no signerInfos"))?.children()?;
         let si = infos.first().ok_or_else(|| bad("no signer"))?;
-        Ok(SignedData { certificates, signer: parse_signer(si)?, content })
+        Ok(SignedData { certificates, signer: parse_signer(si)?, content, quirks })
     }
 
     /// The signer's certificate among those carried.
@@ -150,8 +162,11 @@ fn parse_signer(si: &Tlv<'_>) -> Result<SignerInfo, SignError> {
     let (mut message_digest, mut content_type, mut signing_time, mut signing_certificate) = (None, None, None, false);
     if next.tag == tag::ctx(0) {
         // Signed over the DER SET OF, i.e. the same contents with the universal SET tag.
-        let mut set = next.raw.to_vec();
-        set[0] = tag::SET;
+        // (An indefinite-length encoding is re-encoded with a definite length.)
+        let mut set = if next.is_indefinite() { der::tlv(tag::SET, next.value) } else { next.raw.to_vec() };
+        if let Some(t) = set.first_mut() {
+            *t = tag::SET;
+        }
         for a in next.children()? {
             let p = a.children()?;
             let Some(o) = p.first().and_then(|o| o.oid().ok()) else { continue };
@@ -168,7 +183,7 @@ fn parse_signer(si: &Tlv<'_>) -> Result<SignerInfo, SignError> {
         next = it.next().ok_or_else(|| bad("signatureAlgorithm"))?;
     }
     let (scheme, scheme_digest) = signature_algorithm(&next)?;
-    let signature = it.next().ok_or_else(|| bad("signature"))?.expect(tag::OCTET_STRING, "signature")?.value.to_vec();
+    let signature = it.next().ok_or_else(|| bad("signature"))?.octets("signature")?.into_owned();
     let mut timestamp = false;
     let mut timestamp_token = None;
     for t in it {
diff --git a/crates/sign/src/der.rs b/crates/sign/src/der.rs
index 949e7a92..5c816eae 100644
--- a/crates/sign/src/der.rs
+++ b/crates/sign/src/der.rs
@@ -140,6 +140,12 @@ impl<'a> Tlv<'a> {
         Ok(t)
     }
 
+    /// Whether this element is written with the indefinite length form (BER, never DER). Tags are
+    /// single-octet here, so the length octet is the second.
+    pub fn is_indefinite(&self) -> bool {
+        self.raw.get(1) == Some(&0x80)
+    }
+
     /// The children of a constructed element, read with the same rules as their parent.
     pub fn children(&self) -> Result<Vec<Tlv<'a>>, SignError> {
         let mut out = Vec::new();
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index ba7db951..d2925baa 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -537,6 +537,7 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
         Err(e) => return invalid(info, &format!("The signature could not be read ({e}).")),
     };
     let s = &sd.signer;
+    info.details.extend(sd.quirks.iter().map(|q| q.to_string()));
     info.digest = Some(s.digest);
     info.timestamp = s.timestamp;
     let mut unverified_time = None;
@@ -873,6 +874,7 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
     // The signed revision's document-level XMP stream.
     let old_metadata = old.root().and_then(|root| old.get(root).as_dict().and_then(|c| c.get(b"Metadata").and_then(Object::as_ref)));
     let (mut allowed, mut disallowed): (Vec<&str>, Vec<&str>) = (Vec::new(), Vec::new());
+    let dss = dss_parts(doc, &old);
     // Stored at the same place in both (and not edited since): the same bytes, unchanged.
     let same_place = |num: u32| -> bool {
         use pdfcraft_cos::XrefEntry;
@@ -898,18 +900,18 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
             continue;
         }
         let kind = match &*new {
+            // The Document Security Store's own arrays and dictionaries, when they only grew.
+            _ if dss.contains(&num) => "document security store",
             Object::Dict(d) => change_kind(doc, &old, d, before.as_deref().and_then(Object::as_dict)),
             Object::Stream(s) => {
                 if old_content.contains(&r) {
                     "page content"
                 } else if s.dict.name(b"Type") == Some(b"XRef") || s.dict.name(b"Type") == Some(b"ObjStm") || before.is_none() {
                     continue;
-                } else if s.dict.name(b"Type") == Some(b"Metadata")
-                    && (Some(r) == old_metadata || matches!(before.as_deref(), Some(Object::Stream(b)) if b.dict.name(b"Type") == Some(b"Metadata")))
-                {
-                    // Only the signed catalog's XMP stream, or a stream that was already
-                    // metadata when signed: a later /Type /Metadata label on anything else
-                    // (a page's Form XObject) does not make rewriting it a metadata change.
+                } else if s.dict.name(b"Type") == Some(b"Metadata") && Some(r) == old_metadata {
+                    // Only the signed catalog's XMP stream. A /Type /Metadata label on anything
+                    // else, even one it already had when signed (a page's Form XObject: the
+                    // renderer ignores /Type), does not make rewriting it a metadata change.
                     "metadata"
                 } else {
                     "other changes"
@@ -935,6 +937,127 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
     if disallowed.is_empty() { Modification::Allowed(own(allowed)) } else { Modification::Disallowed(own(disallowed)) }
 }
 
+/// Where an object sits in the Document Security Store (ISO 32000-2 §12.8.4.3).
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum DssRole {
+    /// The `/DSS` dictionary.
+    Dss,
+    /// A `/Certs`, `/CRLs`, `/OCSPs` (or a VRI entry's `/Cert`, `/CRL`, `/OCSP`) array.
+    DataArray,
+    /// A certificate, CRL, OCSP response or timestamp token stream.
+    Data,
+    /// The `/VRI` dictionary.
+    VriMap,
+    /// One entry of `/VRI`.
+    VriEntry,
+}
+
+/// The indirect objects the catalog's `/DSS` reaches by the keys the standard defines, and the
+/// role each plays there. Any other key is not followed: `/DSS << /X 5 0 R >>` does not make
+/// object 5 part of the store.
+fn dss_walk(doc: &Document) -> Vec<(ObjRef, DssRole)> {
+    const LIMIT: usize = 100_000;
+    let mut out = Vec::new();
+    let Some(dss) = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|c| c.get(b"DSS").cloned())) else { return out };
+    // The roles nest at most four deep (DSS, VRI, entry, array, data), so no seen-set is needed.
+    let mut stack = vec![(dss, DssRole::Dss)];
+    let mut steps = 0usize;
+    while let Some((o, role)) = stack.pop() {
+        steps += 1;
+        if steps > LIMIT {
+            break;
+        }
+        if let Object::Ref(r) = &o {
+            out.push((*r, role));
+        }
+        match (role, &*doc.resolve(&o)) {
+            (DssRole::Dss, Object::Dict(d)) => {
+                for (k, v) in d.iter() {
+                    match k.as_slice() {
+                        b"Certs" | b"CRLs" | b"OCSPs" => stack.push((v.clone(), DssRole::DataArray)),
+                        b"VRI" => stack.push((v.clone(), DssRole::VriMap)),
+                        _ => {}
+                    }
+                }
+            }
+            (DssRole::DataArray, Object::Array(a)) => stack.extend(a.iter().map(|v| (v.clone(), DssRole::Data))),
+            (DssRole::VriMap, Object::Dict(d)) => stack.extend(d.iter().map(|(_, v)| (v.clone(), DssRole::VriEntry))),
+            (DssRole::VriEntry, Object::Dict(d)) => {
+                for (k, v) in d.iter() {
+                    match k.as_slice() {
+                        b"Cert" | b"CRL" | b"OCSP" => stack.push((v.clone(), DssRole::DataArray)),
+                        b"TS" => stack.push((v.clone(), DssRole::Data)),
+                        _ => {}
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    out
+}
+
+/// Whether `now` only adds to `before`: an array keeps every element, a dictionary keeps every
+/// entry (an entry that is an array or dictionary may itself have grown).
+fn only_grew(doc: &Document, old: &Document, before: &Object, now: &Object, depth: u8) -> bool {
+    /// Arrays of anything but references are compared element by element (quadratic), so only
+    /// up to this size; a store's `/Certs`/`/CRLs`/`/OCSPs` are references, compared as sets.
+    const MAX_COMPARED: usize = 10_000;
+    match (before, now) {
+        (Object::Array(b), Object::Array(n)) => {
+            if b.len() > n.len() {
+                return false;
+            }
+            let refs = |a: &[Object]| a.iter().map(Object::as_ref).collect::<Option<HashSet<ObjRef>>>();
+            match (refs(b), refs(n)) {
+                (Some(b), Some(n)) => b.is_subset(&n),
+                _ => b.len() <= MAX_COMPARED && n.len() <= MAX_COMPARED && b.iter().all(|x| n.contains(x)),
+            }
+        }
+        (Object::Dict(b), Object::Dict(n)) => b.iter().all(|(k, v)| match n.get(k) {
+            Some(nv) => nv == v || (depth < 4 && only_grew(doc, old, &old.resolve(v), &doc.resolve(nv), depth + 1)),
+            None => false,
+        }),
+        _ => before == now,
+    }
+}
+
+/// The objects of the Document Security Store that count as validation data added after
+/// signing: its dictionary, `/Certs`/`/CRLs`/`/OCSPs` arrays, `/VRI` and its entries, when
+/// - they are reached by the standard's keys and have the shape of their role, and
+/// - they are new, or were already part of the signed store and have only grown.
+///
+/// An existing object is never made "document security store" by pointing the store at it: the
+/// page's `/Contents` array, or a dictionary labelled `/Type /DSS`, keep being judged as what they
+/// are. The data streams need no entry here: new objects are not changes, and rewriting an
+/// existing one is judged on its own.
+fn dss_parts(doc: &Document, old: &Document) -> HashSet<u32> {
+    let signed: HashSet<u32> = dss_walk(old).into_iter().map(|(r, _)| r.num).collect();
+    let is_stream = |o: &Object| matches!(&*doc.resolve(o), Object::Stream(_));
+    let mut parts = HashSet::new();
+    for (r, role) in dss_walk(doc) {
+        let now = doc.get(r);
+        let shaped = match (role, &*now) {
+            (DssRole::Dss, Object::Dict(d)) => d.iter().all(|(k, _)| matches!(k.as_slice(), b"Type" | b"Certs" | b"CRLs" | b"OCSPs" | b"VRI")),
+            (DssRole::DataArray, Object::Array(a)) => a.iter().all(|e| matches!(e, Object::Ref(_)) && is_stream(e)),
+            (DssRole::VriMap, Object::Dict(d)) => d.iter().all(|(_, v)| matches!(&*doc.resolve(v), Object::Dict(_))),
+            (DssRole::VriEntry, Object::Dict(d)) => {
+                d.iter().all(|(k, _)| matches!(k.as_slice(), b"Type" | b"Cert" | b"CRL" | b"OCSP" | b"TU" | b"TS"))
+            }
+            _ => false,
+        };
+        let before = old.try_get(r.num).ok().filter(|o| !matches!(**o, Object::Null));
+        let history = match before {
+            None => true,
+            Some(b) => signed.contains(&r.num) && only_grew(doc, old, &b, &now, 0),
+        };
+        if shaped && history {
+            parts.insert(r.num);
+        }
+    }
+    parts
+}
+
 /// What adding `added` annotations amounts to: signing (signature widgets only), form fill
 /// (other widgets) or comments.
 fn added_annots(doc: &Document, added: &[ObjRef]) -> &'static str {
@@ -993,7 +1116,6 @@ fn change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>)
     };
     match ty {
         Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams") => return "signature",
-        Some(b"DSS") => return "document security store",
         Some(b"Catalog") => {
             let keys: &[&[u8]] = &[b"AcroForm", b"DSS", b"Perms", b"Metadata", b"NeedsRendering"];
             return match before {
@@ -1024,7 +1146,6 @@ fn change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>)
             };
         }
         Some(b"Pages") => return if before.is_some() { "pages added or removed" } else { "document structure" },
-        Some(b"Metadata") => return "metadata",
         _ => {}
     }
     match d.name(b"Subtype") {
diff --git a/crates/sign/src/pdf_discovery_tests.rs b/crates/sign/src/pdf_discovery_tests.rs
index e9e40f64..66bf7c8a 100644
--- a/crates/sign/src/pdf_discovery_tests.rs
+++ b/crates/sign/src/pdf_discovery_tests.rs
@@ -352,3 +352,22 @@ fn real_file_discovery_cache_diagnostic() {
     eprintln!("signature-discovery-reopen\tfull_scans={}", scans(&cache));
     assert_eq!(scans(&cache), 2);
 }
+
+/// A store's arrays only "grew" when every old element is still there; huge arrays (a crafted
+/// `/Certs` of 200,000 references) are compared in linear time, and huge arrays of values that
+/// aren't references are not taken as growth at all, rather than compared quadratically.
+#[test]
+fn only_grew_compares_huge_arrays_without_quadratic_work() {
+    let doc = Document::new_empty();
+    let refs = |n: u32| Object::Array((1..=n).map(|i| Object::Ref(ObjRef::new(i, 0))).collect());
+    let start = std::time::Instant::now();
+    assert!(only_grew(&doc, &doc, &refs(200_000), &refs(200_001), 0));
+    assert!(!only_grew(&doc, &doc, &refs(200_001), &refs(200_000), 0));
+    let mut dropped = (1..=200_000).map(|i| Object::Ref(ObjRef::new(i, 0))).collect::<Vec<_>>();
+    dropped[100_000] = Object::Ref(ObjRef::new(999_999, 0));
+    assert!(!only_grew(&doc, &doc, &refs(200_000), &Object::Array(dropped), 0));
+    let ints = |n: i64| Object::Array((0..n).map(Object::Int).collect());
+    assert!(only_grew(&doc, &doc, &ints(100), &ints(101), 0));
+    assert!(!only_grew(&doc, &doc, &ints(20_000), &ints(20_001), 0));
+    assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
+}
diff --git a/crates/sign/tests/ber.rs b/crates/sign/tests/ber.rs
new file mode 100644
index 00000000..4a0032f5
--- /dev/null
+++ b/crates/sign/tests/ber.rs
@@ -0,0 +1,76 @@
+//! CMS read as BER: the bounds on what a crafted /Contents can make the reader do.
+//!
+//! The BER reader itself is `der::Tlv::parse_ber`; these tests go through `SignedData::parse`,
+//! the way a PDF's signature reaches it.
+
+use pdfcraft_sign::cms::SignedData;
+use pdfcraft_sign::der::{self, tag};
+
+/// `levels` constructed OCTET STRINGs inside one another, each with a definite length, around one
+/// empty primitive OCTET STRING. Built from the inside out in linear time.
+fn nested_octet_strings(levels: usize) -> Vec<u8> {
+    let header = |len: usize| -> Vec<u8> {
+        let mut h = vec![tag::OCTET_STRING_SEGMENTS];
+        if len < 0x80 {
+            h.push(len as u8);
+        } else {
+            let be: Vec<u8> = len.to_be_bytes().into_iter().skip_while(|b| *b == 0).collect();
+            h.push(0x80 | be.len() as u8);
+            h.extend(be);
+        }
+        h
+    };
+    // The content length of each level, the innermost (the empty `04 00`, 2 bytes) first.
+    let mut inner = vec![2usize];
+    for _ in 0..levels {
+        let last = inner.last().copied().unwrap_or(2);
+        inner.push(last + header(last).len());
+    }
+    let mut out = Vec::new();
+    for len in inner.iter().rev().skip(1) {
+        out.extend(header(*len));
+    }
+    out.extend([tag::OCTET_STRING, 0x00]);
+    out
+}
+
+/// A ContentInfo holding SignedData whose encapsulated content is `econtent`. It has no
+/// SignerInfo, so parsing always ends in an error: what matters is where.
+fn cms_with_econtent(econtent: &[u8]) -> Vec<u8> {
+    let encap = der::seq(&[&der::oid("1.2.840.113549.1.7.1"), &der::explicit(0, econtent)]);
+    let signed_data = der::seq(&[&der::int(1), &der::tlv(tag::SET, &[]), &encap]);
+    der::seq(&[&der::oid("1.2.840.113549.1.7.2"), &der::explicit(0, &signed_data)])
+}
+
+fn error_of(cms: &[u8]) -> String {
+    SignedData::parse(cms).err().map(|e| e.to_string()).unwrap_or_default()
+}
+
+#[test]
+fn deeply_nested_segmented_content_is_an_error_not_a_stack_overflow() {
+    // Definite lengths nest without any end-of-contents scan to bound them, so a /Contents of a few
+    // hundred KB can hold 100 000 levels. It used to be able to overflow the stack and abort.
+    let deep = cms_with_econtent(&nested_octet_strings(100_000));
+    assert!(deep.len() < 1 << 20, "a plausible /Contents");
+    let why = error_of(&deep);
+    assert!(why.contains("nested too deeply"), "{why}");
+    // A few segments, as a BER signer writes them, are read: the error is the missing SignerInfo.
+    let shallow = error_of(&cms_with_econtent(&nested_octet_strings(2)));
+    assert!(shallow.contains("signerInfos"), "{shallow}");
+}
+
+#[test]
+fn indefinite_length_nesting_bombs_are_refused() {
+    // 10 000 indefinite-length SEQUENCEs: every level would have to be walked to find its end.
+    let bomb: Vec<u8> = std::iter::repeat_n([tag::SEQUENCE, 0x80], 10_000).flatten().collect();
+    assert!(SignedData::parse(&bomb).is_err());
+    let in_content = cms_with_econtent(&bomb);
+    assert!(SignedData::parse(&in_content).is_err());
+}
+
+#[test]
+fn a_truncated_indefinite_length_cms_is_an_error() {
+    // The end-of-contents octets are missing, as in a /Contents cut short.
+    let cut = [0x30, 0x80, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02];
+    assert!(SignedData::parse(&cut).is_err());
+}
diff --git a/crates/sign/tests/pdf.rs b/crates/sign/tests/pdf.rs
index 206277f6..6029f19c 100644
--- a/crates/sign/tests/pdf.rs
+++ b/crates/sign/tests/pdf.rs
@@ -589,6 +589,384 @@ fn declaring_a_form_xfa_does_not_excuse_replacing_the_pages() {
     }
 }
 
+/// Re-encode a DER CMS the way Windows CryptoAPI / Adobe PPKMS / `openssl cms -stream` write it:
+/// indefinite lengths on ContentInfo, [0] and SignedData (the signed attributes stay DER).
+fn to_ber(der_cms: &[u8]) -> Vec<u8> {
+    use pdfcraft_sign::der::Tlv;
+    let ci = Tlv::parse(der_cms).unwrap().0.children().unwrap();
+    let sd = ci[1].inner().unwrap().children().unwrap();
+    let mut out = vec![0x30, 0x80];
+    out.extend_from_slice(ci[0].raw);
+    out.extend_from_slice(&[0xA0, 0x80, 0x30, 0x80]);
+    for c in sd {
+        out.extend_from_slice(c.raw);
+    }
+    out.extend_from_slice(&[0; 6]);
+    out
+}
+
+/// The signature `/Contents` hex of the only signed field, and its position in `pdf`.
+fn contents_span(pdf: &[u8]) -> (usize, usize) {
+    let key = b"/Contents <";
+    let start = pdf.windows(key.len()).position(|w| w == key).map(|i| i + key.len()).unwrap();
+    (start, start + pdf[start..].iter().position(|b| *b == b'>').unwrap())
+}
+
+#[test]
+fn validates_signatures_written_with_ber_indefinite_lengths() {
+    for file in ["rsa-aes.p12", "ec-p256.p12"] {
+        let id = pkcs12::open(&data(file), "test").unwrap();
+        let mut signed = pdfcraft_sign::sign(&open(&fixture()), &id, &opts()).unwrap();
+        let (a, b) = contents_span(&signed);
+        let hex = |s: &[u8]| s.iter().map(|x| format!("{x:02x}")).collect::<String>();
+        let der: Vec<u8> = (a..b).step_by(2).map(|i| u8::from_str_radix(std::str::from_utf8(&signed[i..i + 2]).unwrap(), 16).unwrap()).collect();
+        let der_len = pdfcraft_sign::der::Tlv::parse(&der).unwrap().0.raw.len();
+        let mut ber = to_ber(&der[..der_len]);
+        assert_eq!(ber[1], 0x80, "indefinite");
+        ber.resize((b - a) / 2, 0);
+        signed[a..b].copy_from_slice(hex(&ber).as_bytes());
+        let anchor = id.certificate.clone();
+        let s = signatures(&open(&signed), &signed, &TrustStore { certs: vec![anchor] }).into_iter().find(|s| s.signed).unwrap();
+        assert_eq!(s.status, Status::Valid, "{file}: {:?}", s.details);
+        assert!(s.details.iter().any(|d| d.contains("BER")), "the tolerance is reported: {:?}", s.details);
+        // Tampering is still caught: the digest check is not relaxed.
+        let mut tampered = signed.clone();
+        let i = tampered.windows(13).position(|w| w == b"Contract text").unwrap();
+        tampered[i] = b'K';
+        let s = signatures(&open(&tampered), &tampered, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
+        assert_eq!(s.status, Status::Invalid);
+    }
+}
+
+#[test]
+fn validation_data_and_xmp_added_after_signing_are_not_tampering() {
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &opts()).unwrap();
+    // As DocuSign / Acrobat LTV do: a DSS whose /Certs and /VRI are indirect objects, and XMP.
+    let edited = edit_after(&signed, |doc| {
+        let mut cert = pdfcraft_cos::Dict::new();
+        cert.set(b"Length".to_vec(), Object::Int(3));
+        let cert = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(cert, vec![1, 2, 3])));
+        let certs = doc.add(Object::Array(vec![Object::Ref(cert)]));
+        let vri = doc.add(Object::Dict(pdfcraft_cos::Dict::new()));
+        let mut dss = pdfcraft_cos::Dict::new();
+        dss.set(b"Certs".to_vec(), Object::Ref(certs));
+        dss.set(b"VRI".to_vec(), Object::Ref(vri));
+        let dss = doc.add(Object::Dict(dss));
+        let mut xmp = pdfcraft_cos::Dict::new();
+        xmp.set(b"Type".to_vec(), Object::name("Metadata"));
+        xmp.set(b"Subtype".to_vec(), Object::name("XML"));
+        xmp.set(b"Length".to_vec(), Object::Int(1));
+        let xmp = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(xmp, b"x".to_vec())));
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| {
+            c.set(b"DSS".to_vec(), Object::Ref(dss));
+            c.set(b"Metadata".to_vec(), Object::Ref(xmp));
+        })
+        .unwrap();
+    });
+    let s = signatures(&open(&edited), &edited, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
+    assert!(matches!(s.modification, Modification::Allowed(_)), "{:?}", s.modification);
+    assert_eq!(s.status, Status::Unknown, "{:?}", s.details);
+    // Page content changes are still refused.
+    let edited = edit_after(&signed, change_text);
+    let s = signatures(&open(&edited), &edited, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!(s.status, Status::Invalid);
+}
+
+// ── DSS and metadata: what later revisions may add ─────────────────────────────────────────
+
+fn oref(num: u32) -> Object {
+    Object::Ref(pdfcraft_cos::ObjRef { num, generation: 0 })
+}
+
+fn dict_of(entries: Vec<(&str, Object)>) -> pdfcraft_cos::Dict {
+    let mut d = pdfcraft_cos::Dict::new();
+    for (k, v) in entries {
+        d.set(k.as_bytes().to_vec(), v);
+    }
+    d
+}
+
+fn stream_of(body: &[u8]) -> Object {
+    let d = dict_of(vec![("Length", Object::Int(body.len() as i64))]);
+    Object::Stream(pdfcraft_cos::Stream::from_raw(d, body.to_vec()))
+}
+
+/// Set the catalog's `/DSS`.
+fn set_dss(doc: &mut Document, dss: Object) {
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"DSS".to_vec(), dss)).unwrap();
+}
+
+/// Rewrite object `num` (the page's contents) so the page shows other text.
+fn forge_contents(doc: &mut Document, num: u32) {
+    doc.set(pdfcraft_cos::ObjRef { num, generation: 0 }, stream_of(b"BT /F1 14 Tf 20 250 Td (Forged) Tj ET"));
+}
+
+/// `fixture()` with the page's `/Contents` an indirect array (object 7) holding object 4.
+fn fixture_with_contents_array() -> Vec<u8> {
+    let objs: Vec<&[u8]> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R] >> >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 7 0 R /Resources << /Font << /F1 5 0 R >> >> /Annots [6 0 R] >>",
+        b"<< /Length 44 >>\nstream\nBT /F1 14 Tf 20 250 Td (Contract text) Tj ET\nendstream",
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
+        b"<< /Type /Annot /Subtype /Widget /FT /Sig /T (Approval) /Rect [150 20 280 70] /P 3 0 R /F 4 >>",
+        b"[4 0 R]",
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// Every DocMDP level: no certification (an approval signature), then P=1, 2 and 3.
+const LEVELS: [Option<u8>; 4] = [None, Some(1), Some(2), Some(3)];
+
+/// Each tampering `attack` of the signed `base` is refused at every level, with `kind` among the
+/// reasons, while the untouched file stays valid.
+fn assert_refused_at_every_level(base: &[u8], kind: &str, attack: impl Fn(&mut Document)) {
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    let check = |bytes: &[u8]| signatures(&open(bytes), bytes, &trust).into_iter().find(|s| s.signed).unwrap();
+    for certify in LEVELS {
+        let signed = pdfcraft_sign::sign(&open(base), &id, &SignOptions { certify, ..opts() }).unwrap();
+        assert_eq!(check(&signed).status, Status::Valid, "{certify:?}: untouched");
+        let s = check(&edit_after(&signed, &attack));
+        assert_eq!(s.status, Status::Invalid, "{certify:?}: {:?} {:?}", s.modification, s.details);
+        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.iter().any(|k| k == kind)), "{certify:?}: {:?}", s.modification);
+    }
+}
+
+#[test]
+fn a_dss_entry_does_not_make_the_object_it_names_part_of_the_store() {
+    // `/DSS << /X 4 0 R >>` and a rewrite of object 4, the page's contents: the contents are
+    // still page content.
+    assert_refused_at_every_level(&fixture(), "page content", |doc| {
+        set_dss(doc, Object::Dict(dict_of(vec![("X", oref(4))])));
+        forge_contents(doc, 4);
+    });
+    // The same through an indirect store, and through every key the store does define.
+    for key in ["X", "Certs", "CRLs", "OCSPs"] {
+        assert_refused_at_every_level(&fixture(), "page content", |doc| {
+            let dss = doc.add(Object::Dict(dict_of(vec![(key, Object::Array(vec![oref(4)]))])));
+            set_dss(doc, Object::Ref(dss));
+            forge_contents(doc, 4);
+        });
+    }
+    // A VRI entry's /Cert array, and its /TS.
+    for key in ["Cert", "CRL", "OCSP", "TS"] {
+        assert_refused_at_every_level(&fixture(), "page content", |doc| {
+            let value = if key == "TS" { oref(4) } else { Object::Array(vec![oref(4)]) };
+            let entry = doc.add(Object::Dict(dict_of(vec![(key, value)])));
+            let vri = doc.add(Object::Dict(dict_of(vec![("0123456789ABCDEF0123456789ABCDEF01234567", Object::Ref(entry))])));
+            let dss = doc.add(Object::Dict(dict_of(vec![("VRI", Object::Ref(vri))])));
+            set_dss(doc, Object::Ref(dss));
+            forge_contents(doc, 4);
+        });
+    }
+}
+
+#[test]
+fn an_existing_dictionary_is_not_a_store_part_because_the_store_names_it() {
+    // The font dictionary (object 5), rewritten and then listed as the store, its /VRI, a VRI
+    // entry, or simply labelled /Type /DSS.
+    let rewrite_font = |doc: &mut Document, extra: Option<(&str, Object)>| {
+        let mut d = dict_of(vec![("Type", Object::name("Font")), ("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Courier"))]);
+        if let Some((k, v)) = extra {
+            d.set(k.as_bytes().to_vec(), v);
+        }
+        doc.set(pdfcraft_cos::ObjRef { num: 5, generation: 0 }, Object::Dict(d));
+    };
+    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+        rewrite_font(doc, Some(("Type", Object::name("DSS"))));
+    });
+    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+        set_dss(doc, oref(5));
+        rewrite_font(doc, None);
+    });
+    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+        set_dss(doc, Object::Dict(dict_of(vec![("VRI", oref(5))])));
+        rewrite_font(doc, None);
+    });
+    // An existing dictionary with only DSS-looking keys that the signed file never had as a store.
+    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+        doc.set(
+            pdfcraft_cos::ObjRef { num: 5, generation: 0 },
+            Object::Dict(dict_of(vec![("Type", Object::name("Font")), ("Cert", Object::Array(vec![]))])),
+        );
+        set_dss(doc, Object::Dict(dict_of(vec![("VRI", Object::Dict(dict_of(vec![("0123456789ABCDEF0123456789ABCDEF01234567", oref(5))])))])));
+    });
+}
+
+#[test]
+fn an_existing_array_stays_what_it_is_when_the_store_points_at_it() {
+    // The page's /Contents is an indirect array (object 7). Pointing /Certs at it and appending
+    // a new stream still changes what the page shows.
+    assert_refused_at_every_level(&fixture_with_contents_array(), "other changes", |doc| {
+        let extra = doc.add(stream_of(b"BT /F1 14 Tf 20 200 Td (Forged) Tj ET"));
+        doc.set(pdfcraft_cos::ObjRef { num: 7, generation: 0 }, Object::Array(vec![oref(4), Object::Ref(extra)]));
+        set_dss(doc, Object::Dict(dict_of(vec![("Certs", oref(7))])));
+    });
+}
+
+#[test]
+fn a_dictionary_labelled_metadata_is_not_a_metadata_change() {
+    // Only the catalog's XMP stream is metadata (a stream, not a dictionary a label was put on).
+    assert_refused_at_every_level(&fixture(), "other changes", |doc| {
+        doc.set(
+            pdfcraft_cos::ObjRef { num: 5, generation: 0 },
+            Object::Dict(dict_of(vec![
+                ("Type", Object::name("Metadata")),
+                ("Subtype", Object::name("Type1")),
+                ("BaseFont", Object::name("Courier")),
+            ])),
+        );
+    });
+}
+
+/// A one-page document like `fixture()` (objects 1–6) plus a stream, object 7, with the given
+/// dictionary entries and body. `catalog_extra` goes into the catalog; the page draws object 7
+/// as a Form XObject when `drawn`.
+fn fixture_with_stream_7(catalog_extra: &str, drawn: bool, dict: &str, body: &[u8]) -> Vec<u8> {
+    let page_content: &[u8] =
+        if drawn { b"BT /F1 14 Tf 20 250 Td (Contract text) Tj ET /Fm1 Do" } else { b"BT /F1 14 Tf 20 250 Td (Contract text) Tj ET" };
+    let xobject = if drawn { " /XObject << /Fm1 7 0 R >>" } else { "" };
+    let stream = |dict: &str, body: &[u8]| {
+        let mut o = format!("<< {dict} /Length {} >>\nstream\n", body.len()).into_bytes();
+        o.extend_from_slice(body);
+        o.extend_from_slice(b"\nendstream");
+        o
+    };
+    let objs: Vec<Vec<u8>> = vec![
+        format!("<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R] >> {catalog_extra} >>").into_bytes(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >>{xobject} >> /Annots [6 0 R] >>"
+        )
+        .into_bytes(),
+        stream("", page_content),
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_vec(),
+        b"<< /Type /Annot /Subtype /Widget /FT /Sig /T (Approval) /Rect [150 20 280 70] /P 3 0 R /F 4 >>".to_vec(),
+        stream(dict, body),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn a_stream_already_labelled_metadata_when_signed_is_not_metadata_unless_the_catalog_names_it() {
+    // A Form XObject the page draws, labelled /Type /Metadata before signing (the renderer ignores
+    // /Type). Rewriting it later changes what the page shows, so it is not a metadata change.
+    let base = fixture_with_stream_7("", true, "/Type /Metadata /Subtype /Form /BBox [0 0 300 300]", b"0 0 1 rg 10 10 100 100 re f");
+    assert_refused_at_every_level(&base, "other changes", |doc| {
+        let d = dict_of(vec![
+            ("Type", Object::name("Metadata")),
+            ("Subtype", Object::name("Form")),
+            ("BBox", Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(300), Object::Int(300)])),
+            ("Length", Object::Int(27)),
+        ]);
+        doc.set(
+            pdfcraft_cos::ObjRef { num: 7, generation: 0 },
+            Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"1 0 0 rg 10 10 100 100 re f".to_vec())),
+        );
+    });
+}
+
+#[test]
+fn the_catalogs_own_xmp_stream_may_still_be_rewritten_after_signing() {
+    // The control for the test above: the stream the signed catalog's /Metadata names is the
+    // document's XMP, and rewriting it is allowed at every level.
+    let base = fixture_with_stream_7("/Metadata 7 0 R", false, "/Type /Metadata /Subtype /XML", b"<x:xmpmeta/>");
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    for certify in LEVELS {
+        let signed = pdfcraft_sign::sign(&open(&base), &id, &SignOptions { certify, ..opts() }).unwrap();
+        let edited = edit_after(&signed, |doc| {
+            let d = dict_of(vec![("Type", Object::name("Metadata")), ("Subtype", Object::name("XML")), ("Length", Object::Int(13))]);
+            doc.set(pdfcraft_cos::ObjRef { num: 7, generation: 0 }, Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"<x:xmpmeta />".to_vec())));
+        });
+        let s = signatures(&open(&edited), &edited, &trust).into_iter().find(|s| s.signed).unwrap();
+        assert!(matches!(&s.modification, Modification::Allowed(k) if k.iter().any(|k| k == "metadata")), "{certify:?}: {:?}", s.modification);
+        assert_eq!(s.status, Status::Valid, "{certify:?}: {:?}", s.details);
+    }
+}
+
+/// A document whose catalog already has a store: `/Certs` (object `.0`) with one certificate,
+/// and `/VRI` (object `.1`).
+fn fixture_with_dss() -> (Vec<u8>, u32, u32) {
+    let mut ids = (0, 0);
+    let bytes = edit_after(&fixture(), |doc| {
+        let cert = doc.add(stream_of(&[1, 2, 3]));
+        let certs = doc.add(Object::Array(vec![Object::Ref(cert)]));
+        let vri = doc.add(Object::Dict(pdfcraft_cos::Dict::new()));
+        let dss = doc.add(Object::Dict(dict_of(vec![("Type", Object::name("DSS")), ("Certs", Object::Ref(certs)), ("VRI", Object::Ref(vri))])));
+        set_dss(doc, Object::Ref(dss));
+        ids = (certs.num, vri.num);
+    });
+    (bytes, ids.0, ids.1)
+}
+
+#[test]
+fn a_signed_store_may_grow_but_not_lose_or_swap_entries() {
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    let check = |bytes: &[u8]| signatures(&open(bytes), bytes, &trust).into_iter().find(|s| s.signed).unwrap();
+    let (base, certs, vri) = fixture_with_dss();
+    for certify in LEVELS {
+        let signed = pdfcraft_sign::sign(&open(&base), &id, &SignOptions { certify, ..opts() }).unwrap();
+        assert_eq!(check(&signed).status, Status::Valid, "{certify:?}");
+        // Validation data appended to the arrays, and a VRI entry: what Acrobat's LTV does.
+        let grown = edit_after(&signed, |doc| {
+            let more = doc.add(stream_of(&[4, 5, 6]));
+            let entry = doc.add(Object::Dict(dict_of(vec![("Cert", Object::Array(vec![Object::Ref(more)]))])));
+            let old = open(&signed);
+            let Object::Array(mut kept) = (*old.get(pdfcraft_cos::ObjRef { num: certs, generation: 0 })).clone() else { panic!("array") };
+            kept.push(Object::Ref(more));
+            doc.set(pdfcraft_cos::ObjRef { num: certs, generation: 0 }, Object::Array(kept));
+            doc.set(
+                pdfcraft_cos::ObjRef { num: vri, generation: 0 },
+                Object::Dict(dict_of(vec![("0123456789ABCDEF0123456789ABCDEF01234567", Object::Ref(entry))])),
+            );
+        });
+        let s = check(&grown);
+        assert_eq!(s.status, Status::Valid, "{certify:?}: {:?} {:?}", s.modification, s.details);
+        assert!(matches!(&s.modification, Modification::Allowed(k) if k.iter().any(|k| k == "document security store")), "{:?}", s.modification);
+        // Dropping what was signed is a change, not an addition.
+        let dropped = edit_after(&signed, |doc| {
+            doc.set(pdfcraft_cos::ObjRef { num: certs, generation: 0 }, Object::Array(vec![]));
+        });
+        let s = check(&dropped);
+        assert_eq!(s.status, Status::Invalid, "{certify:?}: {:?}", s.modification);
+        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.iter().any(|k| k == "other changes")), "{:?}", s.modification);
+    }
+}
+
 #[test]
 fn a_form_xobject_relabelled_metadata_is_not_a_metadata_change() {
     let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 42aebb07..5b68de8b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5942,8 +5942,8 @@ milestone = "M9"
 status = "shipped"
 commands = ["sign.validate"]
 tools = ["sign_list"]
-evidence = ["crates/sign/tests/pdf.rs::validates_a_signature_made_by_openssl"]
-notes = "validated; new signatures use CAdES"
+evidence = ["crates/sign/tests/pdf.rs::validates_a_signature_made_by_openssl", "crates/sign/tests/pdf.rs::validates_signatures_written_with_ber_indefinite_lengths", "crates/sign/tests/ber.rs::deeply_nested_segmented_content_is_an_error_not_a_stack_overflow", "crates/sign/tests/ber.rs::indefinite_length_nesting_bombs_are_refused"]
+notes = "validated, including BER-encoded CMS (indefinite lengths and segmented strings, as DocuSign, Documenso, Adobe PPKMS and Windows write it; the BER is reported in the details); new signatures use CAdES. Not read: BER high tag numbers. Still missing: multiple SignerInfos, counter-signatures, CMS with the signer's cert referenced but absent"
 
 [[feature]]
 id = "sign.cades-pades-bb"
@@ -6218,8 +6218,8 @@ milestone = "M9"
 status = "shipped"
 commands = ["sign.panel"]
 tools = ["sign_list"]
-evidence = ["crates/sign/tests/pdf.rs::later_changes_are_classified_under_the_signature_permissions", "crates/sign/tests/pdf.rs::signing_an_existing_field_and_counter_signing", "crates/engine/src/tests.rs::signing_saving_trusting_and_commenting_afterwards"]
-notes = "revision diff classified as signing, form fill, comments, metadata, page content or structure"
+evidence = ["crates/sign/tests/pdf.rs::later_changes_are_classified_under_the_signature_permissions", "crates/sign/tests/pdf.rs::signing_an_existing_field_and_counter_signing", "crates/engine/src/tests.rs::signing_saving_trusting_and_commenting_afterwards", "crates/sign/tests/pdf.rs::validation_data_and_xmp_added_after_signing_are_not_tampering", "crates/sign/tests/pdf.rs::a_dss_entry_does_not_make_the_object_it_names_part_of_the_store", "crates/sign/tests/pdf.rs::an_existing_dictionary_is_not_a_store_part_because_the_store_names_it", "crates/sign/tests/pdf.rs::an_existing_array_stays_what_it_is_when_the_store_points_at_it", "crates/sign/tests/pdf.rs::a_signed_store_may_grow_but_not_lose_or_swap_entries", "crates/sign/tests/pdf.rs::a_dictionary_labelled_metadata_is_not_a_metadata_change", "crates/sign/tests/pdf.rs::a_stream_already_labelled_metadata_when_signed_is_not_metadata_unless_the_catalog_names_it", "crates/sign/tests/pdf.rs::the_catalogs_own_xmp_stream_may_still_be_rewritten_after_signing"]
+notes = "revision diff classified as signing, form fill, comments, metadata, page content or structure. Later revisions that add DSS data (new /Certs, /CRLs, /OCSPs, /VRI objects, or ones of the signed store that only grew) or rewrite the catalog's XMP are permitted changes; a /DSS entry that names other objects, or a /Type /DSS or /Type /Metadata label on an existing dictionary or stream, does not excuse changing them (negative tests at every DocMDP level)"
 
 [[feature]]
 id = "sign.view-signed-version"

From 56f85f76dfdf94a682ccc0339139faedbe9ef75d Mon Sep 17 00:00:00 2001
From: Thorsten Hirsch <t.hirsch@web.de>
Date: Sat, 10 Oct 2026 00:44:38 +0200
Subject: [PATCH 134/149] M9: more signature validation algorithms (SHA-3,
 RIPEMD-160, Ed25519, P-521, brainpool, PSS, rsa_sha1) (#386)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M9: more signature validation algorithms

Validation now reads what real signers write, and says when it is weak:

- Digests SHA-224, SHA-512/224, SHA-512/256, SHA3-224/256/384/512 and
  RIPEMD-160, beside SHA-1 and SHA-2.
- RSA PKCS#1 v1.5 for every digest, in `rsa_pad`: the one expected encoding
  is built and compared byte for byte, with or without the DigestInfo's NULL
  (RFC 8017 App. B.1). A signature over the bare digest, which doesn't say
  which hash it uses, is refused. The signature value must be below the
  modulus (RFC 8017 §5.2.2); s and s + n both verified before.
- RSA-PSS with the hash, MGF1 hash and salt length the signature declares.
- ECDSA as DER, non-minimal DER or raw r||s on P-256, P-384, P-521 and
  brainpoolP256r1/P384r1/P512r1 (BSI "plain" ECDSA OIDs too); brainpoolP512r1
  is hand-written on crypto-bigint because no RustCrypto crate has it.
- Ed25519 (RFC 8419), and the legacy adbe.x509.rsa_sha1 format.
- An algorithm PdfCraft can't check is Unknown, never Invalid.
- SHA-1 and RIPEMD-160 signatures validate, but the signature's details say
  the algorithm is weak (wording pinned by tests).
- Encoding irregularities that were tolerated are listed in the details
  (`verify_noting`; `verify` keeps its signature).

Found while testing, each with a regression test that failed before the fix:
a brainpoolP512r1 public key with a coordinate >= p panicked inside
crypto-bigint's `sub_mod` (the certificate comes from the PDF); it is refused
now, and the point at infinity is an invalid signature, not an error.

Vectors were made with OpenSSL (tests/data/README.md has the commands).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Update comment to clarify MAC digest restrictions

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* M9: a legacy x509.rsa_sha1 signature whose key the verifier rejects is Invalid; only unsupported keys are "can't check yet"

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.md                           |   3 +-
 ATTRIBUTION.toml                         |  11 +
 Cargo.lock                               | 131 +++++++
 ROADMAP.md                               |   2 +
 crates/sign/Cargo.toml                   |  11 +-
 crates/sign/README.md                    |  20 ++
 crates/sign/src/cms.rs                   |  51 ++-
 crates/sign/src/ec512.rs                 | 180 ++++++++++
 crates/sign/src/keys.rs                  | 415 ++++++++++++++++++-----
 crates/sign/src/lib.rs                   |   2 +
 crates/sign/src/pdf.rs                   | 110 +++++-
 crates/sign/src/pkcs12.rs                |  19 +-
 crates/sign/src/rsa_pad.rs               | 139 ++++++++
 crates/sign/src/timestamp.rs             |   3 +-
 crates/sign/src/x509.rs                  |   7 +-
 crates/sign/tests/algorithms.rs          | 140 ++++++++
 crates/sign/tests/crypto.rs              | 262 +++++++++++++-
 crates/sign/tests/data/README.md         |  35 ++
 crates/sign/tests/data/x509-rsa-sha1.pdf |  29 ++
 crates/sign/tests/pdf.rs                 |  40 +++
 parity/acrobat-features.toml             |   4 +-
 21 files changed, 1508 insertions(+), 106 deletions(-)
 create mode 100644 crates/sign/src/ec512.rs
 create mode 100644 crates/sign/src/rsa_pad.rs
 create mode 100644 crates/sign/tests/algorithms.rs
 create mode 100644 crates/sign/tests/data/x509-rsa-sha1.pdf

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index afe30062..3e54a560 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (257)
+## In this repository (258)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -265,6 +265,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `assets/fonts/DancingScript.ttf` | Dancing Script (variable) | The Dancing Script Project Authors (Pablo Impallari) | OFL-1.1 | https://github.com/google/fonts/blob/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/dancingscript/DancingScript%5Bwght%5D.ttf | Fill & Sign typed signatures and initials: the typed name's glyph outlines, drawn as filled paths (the font file itself is not embedded in PDFs) |
 | `packaging/macos/dmg/background.svg` | PdfCraft macOS DMG window background | @XusBadia | MIT OR Apache-2.0 | Original work for this repository, derived from the PdfCraft app icon (assets/app-icon/pdfcraft.svg, referenced via an SVG image element, not copied) | Finder window of the macOS DMG; rendered to background.tiff by packaging/macos/dmg/generate.py |
 | `packaging/macos/dmg/background.tiff` | PdfCraft macOS DMG window background (rendered) | @XusBadia | MIT OR Apache-2.0 | Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py | 1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile |
+| `crates/sign/tests/data/x509-rsa-sha1.pdf` | One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/pdf.rs): the legacy adbe.x509.rsa_sha1 format |
 
 ## Compiled in through dependencies (6)
 
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 99cbbfb0..9af55652 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -3208,3 +3208,14 @@ licence = "OFL-1.1"
 attribution = "https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md"
 kind = "font"
 usage = "Japanese fallback in the interface (BIZ UDPGothic first) and Japanese glyphs in edited PDF text (Shippori Mincho); the web build embeds only BIZ UDPGothic Regular"
+
+[[asset]]
+path = "crates/sign/tests/data/x509-rsa-sha1.pdf"
+title = "One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key"
+author = "PdfCraft contributors"
+source = "Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md)"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "document"
+usage = "Signature validation tests (crates/sign/tests/pdf.rs): the legacy adbe.x509.rsa_sha1 format"
+sha256 = "b77bfb21166f4bd043597e45a1ea28b9d9f4ba6df0142b3a0fc8b7f8e0fc111b"
diff --git a/Cargo.lock b/Cargo.lock
index 05523a30..e5da3f9f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -730,6 +730,30 @@ dependencies = [
  "static_assertions",
 ]
 
+[[package]]
+name = "bp256"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46f98c2d9e8e0796b24f84b7ae14159b91ae6ae4b85f74f7655a678a56ad5e1e"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primefield",
+ "primeorder",
+]
+
+[[package]]
+name = "bp384"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc61f3a96b44a33fbb971e9917b81f4207d6dae9a6b0715845c785a48e73d9c2"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primefield",
+ "primeorder",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.4"
@@ -1160,6 +1184,33 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
+[[package]]
+name = "curve25519-dalek"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "dashmap"
 version = "6.2.1"
@@ -1338,6 +1389,28 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "ed25519"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
+dependencies = [
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "eframe"
 version = "0.36.2"
@@ -2614,6 +2687,16 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "keccak"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+]
+
 [[package]]
 name = "khronos-egl"
 version = "6.0.0"
@@ -3400,6 +3483,20 @@ dependencies = [
  "sha2",
 ]
 
+[[package]]
+name = "p521"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449"
+dependencies = [
+ "base16ct",
+ "ecdsa",
+ "elliptic-curve",
+ "primefield",
+ "primeorder",
+ "sha2",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3770,22 +3867,30 @@ dependencies = [
  "aes",
  "aws-lc-rs",
  "base64 0.22.1",
+ "bp256",
+ "bp384",
  "cbc",
+ "crypto-bigint",
  "des",
+ "ecdsa",
+ "ed25519-dalek",
  "getrandom 0.4.3",
  "hmac",
  "p256",
  "p384",
+ "p521",
  "pbkdf2",
  "pdfcraft-annot",
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "rc2",
+ "ripemd",
  "rsa",
  "rustls-cng",
  "security-framework",
  "sha1",
  "sha2",
+ "sha3",
  "thiserror 2.0.21",
 ]
 
@@ -4556,6 +4661,15 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "ripemd"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dd4211456b4172d7e44261920c25acf07367c4f04bb5f5d54fc21b090d9b159"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "ron"
 version = "0.12.2"
@@ -5006,6 +5120,17 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha3"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
+dependencies = [
+ "digest",
+ "keccak",
+ "sponge-cursor",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -5223,6 +5348,12 @@ dependencies = [
  "der",
 ]
 
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
diff --git a/ROADMAP.md b/ROADMAP.md
index d9d99326..fffb0e32 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -174,6 +174,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (M9, signatures as DocuSign and Documenso write them, #144):** A real DocuSign + Telekom qualified-signature PDF showed "DER signature wrong" although Acrobat validates it: both CMS blobs use BER indefinite lengths. The CMS is read with the BER reader that #453 added (`Tlv::parse_ber`: indefinite lengths, segmented OCTET STRINGs, depth-bounded) while certificates and signed attributes are still verified over their own exact bytes, and the details say the signature was BER; tests build the nesting bombs a crafted /Contents could hold. Behind that, later revisions that add DSS data (indirect `/Certs`, `/VRI`) or rewrite the catalog's XMP were classified as disallowed changes; they are permitted now, narrowly (review by echelon on #144): only objects reached through `/DSS` `/Certs|CRLs|OCSPs|VRI` with the shape of their role, and new or only grown since signing, count as the store, and only the catalog's `/Metadata` is the document's XMP. A `/DSS` entry naming a page's contents, or a `/Type /DSS` or `/Type /Metadata` label on an existing dictionary or stream, makes nothing permitted. Six of the new tests fail on the previous code, among them a Form XObject labelled `/Type /Metadata` before signing that could be rewritten under a Valid signature. Negative tests at every DocMDP level. Cross-checked with pdfsig (both signatures valid). Still missing: AATL/EUTL trust lists (a separate change: they need CA-constraint checks in chain building first). Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M9, signature algorithms, #386):** Validation reads what real signers write. Digests SHA-224, SHA-512/224, SHA-512/256, SHA3-224/256/384/512 and RIPEMD-160 (beside SHA-1/2); RSA PKCS#1 with or without the DigestInfo's NULL (checked by building the one expected encoding and comparing it byte for byte, in `rsa_pad`, for every digest; a bare digest without any DigestInfo is refused, it doesn't say which hash it uses); RSA-PSS with the hash, MGF1 hash and salt length the signature declares; ECDSA as DER, non-minimal DER or raw r‖s on P-256, P-384, P-521 and brainpoolP256r1/P384r1/P512r1 (the last hand-written on `crypto-bigint`, no RustCrypto crate exists); Ed25519 (RFC 8419); the legacy `adbe.x509.rsa_sha1` format. Algorithms PdfCraft can't check give Unknown instead of Invalid. Review of #386 (echelon): an RSA signature value must be below the modulus (RFC 8017 §5.2.2; `s` and `s + n` both verified before), and SHA-1 and RIPEMD-160 signatures still validate but the signature's details now say the algorithm is weak (wording pinned by tests). Found on the way, each with a regression test that failed first: a brainpoolP512r1 key with a coordinate not reduced modulo p panicked inside the bigint arithmetic (the certificate comes from the PDF), now refused, and the point at infinity is an invalid signature rather than an error. Tolerated encodings are listed in the signature's details. Vectors made with OpenSSL; cross-checked with pdfsig. Still missing: Ed448/DSA, signing with the new digests. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (M14, German interface follow-up):** Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.
 
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
diff --git a/crates/sign/Cargo.toml b/crates/sign/Cargo.toml
index ccd75f7b..73210cff 100644
--- a/crates/sign/Cargo.toml
+++ b/crates/sign/Cargo.toml
@@ -20,14 +20,23 @@ sha1 = "0.11"
 sha2 = "0.11"
 p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
 p384 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
+# Verification only: P-521 and the Brainpool curves German qualified-signature cards use.
+p521 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
+bp256 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
+bp384 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
+ecdsa = { version = "0.17", default-features = false, features = ["algorithm", "der"] }
 # Verification only on native targets (RSA private-key operations use aws-lc-rs, ADR-0009).
-rsa = { version = "=0.10.0-rc.18", default-features = false, features = ["std"] }
+crypto-bigint = { version = "0.7", default-features = false, features = ["alloc"] }
+rsa = { version = "=0.10.0-rc.18", default-features = false, features = ["std", "hazmat"] }
 pbkdf2 = { version = "0.13", default-features = false, features = ["hmac"] }
 hmac = "0.13"
 aes = "0.9"
 cbc = { version = "0.2", features = ["alloc", "block-padding"] }
 des = "0.9"
 rc2 = "0.9"
+sha3 = "0.12.0"
+ripemd = "0.2.0"
+ed25519-dalek = "3.0.0"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 aws-lc-rs = { version = "1.18", default-features = false, features = ["aws-lc-sys", "prebuilt-nasm"] }
diff --git a/crates/sign/README.md b/crates/sign/README.md
index cb7455f8..1d1f895d 100644
--- a/crates/sign/README.md
+++ b/crates/sign/README.md
@@ -72,6 +72,26 @@ ECDSA P-256/P-384; the store integration is tested with software-backed keys.
   document's XMP, and only objects reached through the `/DSS` keys above are the security store. A
   `/Type /Metadata` or `/Type /DSS` *label* on any other dictionary or stream (a page's Form
   XObject, say) makes nothing permitted, at every DocMDP level.
+- **Strict in what it checks, tolerant where signers differ.** RSA PKCS #1 signatures are checked
+  against the one encoding the digest should have, built here and compared byte for byte; the
+  `DigestInfo` may omit its NULL parameter, as older signers write it (RFC 8017 App. B.1), but a
+  signature over the bare digest, which doesn't say which hash it uses, is refused. A signature
+  value must be below the modulus (RFC 8017 §5.2.2). RSA-PSS uses the salt length it declares.
+  ECDSA is read as DER, non-minimal DER or raw `r ‖ s`. `adbe.x509.rsa_sha1` is validated. What the
+  check tolerated is listed in the signature's details: a DigestInfo without its NULL, an RSA value
+  that isn't modulus-length, ECDSA that isn't canonical DER, a SignerInfo whose digest algorithm
+  differs from the one the signature algorithm names. What PdfCraft can't check (an unknown
+  algorithm or curve) is *unknown*, never *invalid*.
+- **Weak algorithms still validate, and say so.** SHA-1 and RIPEMD-160 signatures are common in
+  documents signed years ago, so they validate (new signatures never use SHA-1), but the signature's
+  details say that the algorithm is weak and shouldn't be relied on.
+- **Validation algorithms:** digests SHA-1, SHA-224/256/384/512, SHA-512/224, SHA-512/256,
+  SHA3-224/256/384/512 and RIPEMD-160. RSA PKCS #1 v1.5 and RSASSA-PSS (the hash, MGF1 hash and
+  salt length the signature declares), ECDSA on P-256, P-384, P-521, brainpoolP256r1, P384r1 and
+  P512r1 (also BSI "plain" ECDSA), and Ed25519 (RFC 8419, over the signed attributes).
+  Signing: RSA, P-256, P-384 with SHA-256/384/512. The RSA padding checks and brainpoolP512r1 are
+  written here (`rsa_pad`, `ec512`) on `crypto-bigint`, because the typed APIs of the `rsa` crate
+  and RustCrypto don't cover them.
 
 Oracles: poppler's `pdfsig` reports our signatures valid; OpenSSL reads our `.p12` files and
 verifies our CMS; `tests/data/openssl-signed.pdf` is a signature OpenSSL made, which we validate.
diff --git a/crates/sign/src/cms.rs b/crates/sign/src/cms.rs
index 7627c44e..f1f17e4d 100644
--- a/crates/sign/src/cms.rs
+++ b/crates/sign/src/cms.rs
@@ -124,14 +124,51 @@ impl SignedData {
 
     /// Check the signature value with `cert`'s key. `content_digest` is the digest of the
     /// signed content (the document byte ranges) when there are no signed attributes.
-    pub fn verify_signature(&self, cert: &Certificate, content_digest: &[u8]) -> bool {
+    /// `Err(Unsupported)`: the signer's key algorithm can't be checked here.
+    pub fn verify_signature(&self, cert: &Certificate, content_digest: &[u8]) -> Result<bool, SignError> {
+        self.verify_signature_noting(cert, content_digest, &mut Vec::new())
+    }
+
+    /// [`SignedData::verify_signature`], noting in `notes` each encoding irregularity or
+    /// disagreement it tolerated. Only meaningful when it returns `Ok(true)`.
+    pub fn verify_signature_noting(&self, cert: &Certificate, content_digest: &[u8], notes: &mut Vec<&'static str>) -> Result<bool, SignError> {
         let s = &self.signer;
-        let alg = s.scheme_digest.unwrap_or(s.digest);
-        let digest = match &s.signed_attrs {
-            Some(attrs) => alg.digest(&[attrs]),
-            None => content_digest.to_vec(),
-        };
-        cert.public_key.verify(s.scheme, alg, &digest, &s.signature).unwrap_or(false)
+        // EdDSA signs the message itself: with signed attributes, their DER encoding.
+        if s.scheme == Scheme::Ed25519 {
+            let Some(attrs) = &s.signed_attrs else {
+                return Err(SignError::Unsupported("Ed25519 signature without signed attributes".into()));
+            };
+            return cert.public_key.verify_message(s.scheme, attrs, &s.signature);
+        }
+        // The signature algorithm names the digest it used; a bare `rsaEncryption` / `ecPublicKey`
+        // uses the SignerInfo's digestAlgorithm. Some signers disagree, so try both.
+        let named = s.scheme_digest.unwrap_or(s.digest);
+        let mut algs = vec![named];
+        if !algs.contains(&s.digest) {
+            algs.push(s.digest);
+        }
+        for alg in algs {
+            let digest = match &s.signed_attrs {
+                Some(attrs) => alg.digest(&[attrs]),
+                None => content_digest.to_vec(),
+            };
+            // Notes from an attempt that doesn't verify say nothing about the signature.
+            let mut attempt = Vec::new();
+            if cert.public_key.verify_noting(s.scheme, alg, &digest, &s.signature, &mut attempt)? {
+                notes.extend(attempt);
+                // The hash of the content and the hash the signature is made with.
+                for weak in [s.digest, alg].into_iter().filter_map(DigestAlg::weakness) {
+                    if !notes.contains(&weak) {
+                        notes.push(weak);
+                    }
+                }
+                if alg != named {
+                    notes.push("The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.");
+                }
+                return Ok(true);
+            }
+        }
+        Ok(false)
     }
 }
 
diff --git a/crates/sign/src/ec512.rs b/crates/sign/src/ec512.rs
new file mode 100644
index 00000000..53c73e54
--- /dev/null
+++ b/crates/sign/src/ec512.rs
@@ -0,0 +1,180 @@
+//! ECDSA verification on brainpoolP512r1 (RFC 5639), for which no RustCrypto curve crate exists.
+//!
+//! Verification only, on public data, so plain affine arithmetic over `crypto-bigint` is enough:
+//! no secret is involved, and a verification takes a few milliseconds. Checked against
+//! signatures made by OpenSSL (`tests/crypto.rs`).
+
+use rsa::BoxedUint;
+
+const P: &str = "aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3";
+const A: &str = "7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca";
+const B: &str = "3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723";
+const GX: &str = "81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822";
+const GY: &str = "7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892";
+const N: &str = "aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069";
+
+const BITS: u32 = 512;
+const BYTES: usize = 64;
+
+type Point = Option<(BoxedUint, BoxedUint)>;
+
+fn big(bytes: &[u8]) -> Option<BoxedUint> {
+    let pad = BYTES.checked_sub(bytes.len())?;
+    let mut v = vec![0u8; pad];
+    v.extend_from_slice(bytes);
+    BoxedUint::from_be_slice(&v, BITS).ok()
+}
+
+fn hex(s: &str) -> Option<BoxedUint> {
+    let bytes: Option<Vec<u8>> = (0..s.len()).step_by(2).map(|i| u8::from_str_radix(s.get(i..i + 2)?, 16).ok()).collect();
+    big(&bytes?)
+}
+
+/// Arithmetic modulo a prime.
+struct Field {
+    nz: crypto_bigint::NonZero<BoxedUint>,
+}
+
+impl Field {
+    fn new(p: BoxedUint) -> Option<Field> {
+        let nz = Option::from(crypto_bigint::NonZero::new(p))?;
+        Some(Field { nz })
+    }
+    fn add(&self, a: &BoxedUint, b: &BoxedUint) -> BoxedUint {
+        a.add_mod(b, &self.nz)
+    }
+    fn sub(&self, a: &BoxedUint, b: &BoxedUint) -> BoxedUint {
+        a.sub_mod(b, &self.nz)
+    }
+    fn mul(&self, a: &BoxedUint, b: &BoxedUint) -> BoxedUint {
+        a.mul_mod(b, &self.nz)
+    }
+    fn inv(&self, a: &BoxedUint) -> Option<BoxedUint> {
+        Option::from(a.invert_mod(&self.nz))
+    }
+    /// Whether `v` is reduced (`v < p`). `add_mod`, `sub_mod` and friends assert it, and panic on
+    /// anything else, so nothing from outside may reach them without this check.
+    fn is_reduced(&self, v: &BoxedUint) -> bool {
+        v < self.nz.as_ref()
+    }
+}
+
+struct Curve {
+    f: Field,
+    a: BoxedUint,
+    b: BoxedUint,
+    g: (BoxedUint, BoxedUint),
+    n: BoxedUint,
+}
+
+impl Curve {
+    fn brainpool_p512r1() -> Option<Curve> {
+        Some(Curve { f: Field::new(hex(P)?)?, a: hex(A)?, b: hex(B)?, g: (hex(GX)?, hex(GY)?), n: hex(N)? })
+    }
+
+    fn on_curve(&self, x: &BoxedUint, y: &BoxedUint) -> bool {
+        let f = &self.f;
+        let lhs = f.mul(y, y);
+        let rhs = f.add(&f.add(&f.mul(&f.mul(x, x), x), &f.mul(&self.a, x)), &self.b);
+        lhs == rhs
+    }
+
+    fn double(&self, p: &Point) -> Point {
+        let (x, y) = p.as_ref()?;
+        let f = &self.f;
+        if bool::from(y.is_zero()) {
+            return None;
+        }
+        let three = big(&[3])?;
+        let two = big(&[2])?;
+        let num = f.add(&f.mul(&three, &f.mul(x, x)), &self.a);
+        let lambda = f.mul(&num, &f.inv(&f.mul(&two, y))?);
+        let x3 = f.sub(&f.sub(&f.mul(&lambda, &lambda), x), x);
+        let y3 = f.sub(&f.mul(&lambda, &f.sub(x, &x3)), y);
+        Some((x3, y3))
+    }
+
+    fn add(&self, p: &Point, q: &Point) -> Point {
+        let (Some((x1, y1)), Some((x2, y2))) = (p, q) else { return p.clone().or_else(|| q.clone()) };
+        let f = &self.f;
+        if x1 == x2 {
+            return if y1 == y2 { self.double(p) } else { None };
+        }
+        let lambda = f.mul(&f.sub(y2, y1), &f.inv(&f.sub(x2, x1))?);
+        let x3 = f.sub(&f.sub(&f.mul(&lambda, &lambda), x1), x2);
+        let y3 = f.sub(&f.mul(&lambda, &f.sub(x1, &x3)), y1);
+        Some((x3, y3))
+    }
+
+    /// `k · p`, double-and-add from the top bit.
+    fn mul(&self, k: &BoxedUint, p: &Point) -> Point {
+        let mut acc: Point = None;
+        for i in (0..k.bits_vartime()).rev() {
+            acc = self.double(&acc);
+            if bool::from(k.bit(i)) {
+                acc = self.add(&acc, p);
+            }
+        }
+        acc
+    }
+}
+
+/// Check the ECDSA signature `r ‖ s` (64 bytes each) of `digest` with the SEC1 uncompressed
+/// point `public` (`04 ‖ x ‖ y`). `None`: the key is not a valid point or the input is malformed.
+pub fn verify(public: &[u8], digest: &[u8], rs: &[u8]) -> Option<bool> {
+    let c = Curve::brainpool_p512r1()?;
+    let [0x04, xy @ ..] = public else { return None };
+    if xy.len() != 2 * BYTES || rs.len() != 2 * BYTES {
+        return None;
+    }
+    let (qx, qy) = (big(xy.get(..BYTES)?)?, big(xy.get(BYTES..)?)?);
+    // SEC 1 §2.3.4: coordinates are field elements. The field arithmetic panics on unreduced ones.
+    if !c.f.is_reduced(&qx) || !c.f.is_reduced(&qy) || !c.on_curve(&qx, &qy) {
+        return None;
+    }
+    let (r, s) = (big(rs.get(..BYTES)?)?, big(rs.get(BYTES..)?)?);
+    let n = crypto_bigint::NonZero::new(c.n.clone());
+    let n: crypto_bigint::NonZero<BoxedUint> = Option::from(n)?;
+    let zero = |v: &BoxedUint| bool::from(v.is_zero());
+    if zero(&r) || zero(&s) || r >= c.n || s >= c.n {
+        return Some(false);
+    }
+    // The leftmost 512 bits of the digest (all of it, for digests up to SHA-512).
+    let e = big(digest.get(..digest.len().min(BYTES))?)?.rem_vartime(&n);
+    let w: BoxedUint = Option::from(s.invert_mod(&n))?;
+    let u1 = e.mul_mod(&w, &n);
+    let u2 = r.mul_mod(&w, &n);
+    let point = c.add(&c.mul(&u1, &Some(c.g.clone())), &c.mul(&u2, &Some((qx, qy))));
+    // The point at infinity is no valid result (X9.62 §7.4.1 step 5): the signature is wrong.
+    let Some((x, _)) = point else { return Some(false) };
+    Some(x.rem_vartime(&n) == r)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn unhex(s: &str) -> [u8; 64] {
+        let v: Vec<u8> = (0..s.len()).step_by(2).map(|i| u8::from_str_radix(s.get(i..i + 2).unwrap_or("00"), 16).unwrap_or(0)).collect();
+        let mut out = [0u8; 64];
+        out[64 - v.len()..].copy_from_slice(&v);
+        out
+    }
+
+    /// Never-crash: public keys and signature values of any size are refused, not panicked on.
+    #[test]
+    fn hostile_keys_and_signatures_are_refused() {
+        let digest = [7u8; 64];
+        let key = |x: &[u8; 64], y: &[u8; 64]| [&[4u8][..], x, y].concat();
+        let (p, n, gx, gy) = (unhex(P), unhex(N), unhex(GX), unhex(GY));
+        // Coordinates that are not field elements, or not on the curve.
+        for (x, y) in [([0xFF; 64], [0xFF; 64]), (p, [0; 64]), ([0; 64], p), ([0; 64], [0; 64]), (p, p)] {
+            assert_eq!(verify(&key(&x, &y), &digest, &[1u8; 128]), None);
+        }
+        // The generator, a real point, with an r or s that is zero, n, or all ones.
+        for bad in [[0u8; 64], n, [0xFF; 64]] {
+            assert_eq!(verify(&key(&gx, &gy), &digest, &[bad.to_vec(), vec![1; 64]].concat()), Some(false));
+            assert_eq!(verify(&key(&gx, &gy), &digest, &[vec![1; 64], bad.to_vec()].concat()), Some(false));
+        }
+    }
+}
diff --git a/crates/sign/src/keys.rs b/crates/sign/src/keys.rs
index 84558578..c9ea6cb2 100644
--- a/crates/sign/src/keys.rs
+++ b/crates/sign/src/keys.rs
@@ -9,66 +9,112 @@ use crate::der::{self, Tlv, tag};
 
 pub mod oid {
     pub const SHA1: &str = "1.3.14.3.2.26";
+    pub const SHA224: &str = "2.16.840.1.101.3.4.2.4";
     pub const SHA256: &str = "2.16.840.1.101.3.4.2.1";
     pub const SHA384: &str = "2.16.840.1.101.3.4.2.2";
     pub const SHA512: &str = "2.16.840.1.101.3.4.2.3";
+    pub const SHA512_224: &str = "2.16.840.1.101.3.4.2.5";
+    pub const SHA512_256: &str = "2.16.840.1.101.3.4.2.6";
+    pub const SHA3_224: &str = "2.16.840.1.101.3.4.2.7";
+    pub const SHA3_256: &str = "2.16.840.1.101.3.4.2.8";
+    pub const SHA3_384: &str = "2.16.840.1.101.3.4.2.9";
+    pub const SHA3_512: &str = "2.16.840.1.101.3.4.2.10";
+    pub const RIPEMD160: &str = "1.3.36.3.2.1";
     pub const RSA: &str = "1.2.840.113549.1.1.1";
-    pub const RSA_SHA1: &str = "1.2.840.113549.1.1.5";
     pub const RSA_PSS: &str = "1.2.840.113549.1.1.10";
-    pub const RSA_SHA256: &str = "1.2.840.113549.1.1.11";
-    pub const RSA_SHA384: &str = "1.2.840.113549.1.1.12";
-    pub const RSA_SHA512: &str = "1.2.840.113549.1.1.13";
     pub const MGF1: &str = "1.2.840.113549.1.1.8";
     pub const EC: &str = "1.2.840.10045.2.1";
     pub const P256: &str = "1.2.840.10045.3.1.7";
     pub const P384: &str = "1.3.132.0.34";
-    pub const ECDSA_SHA1: &str = "1.2.840.10045.4.1";
-    pub const ECDSA_SHA256: &str = "1.2.840.10045.4.3.2";
-    pub const ECDSA_SHA384: &str = "1.2.840.10045.4.3.3";
-    pub const ECDSA_SHA512: &str = "1.2.840.10045.4.3.4";
+    pub const P521: &str = "1.3.132.0.35";
+    pub const BRAINPOOL_P256: &str = "1.3.36.3.3.2.8.1.1.7";
+    pub const BRAINPOOL_P384: &str = "1.3.36.3.3.2.8.1.1.11";
+    pub const BRAINPOOL_P512: &str = "1.3.36.3.3.2.8.1.1.13";
+    pub const ED25519: &str = "1.3.101.112";
 }
 
 /// Message digests.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum DigestAlg {
     Sha1,
+    Sha224,
     Sha256,
     Sha384,
     Sha512,
+    Sha512_224,
+    Sha512_256,
+    Sha3_224,
+    Sha3_256,
+    Sha3_384,
+    Sha3_512,
+    Ripemd160,
 }
 
 impl DigestAlg {
+    /// Every digest, for tables.
+    pub const ALL: [DigestAlg; 12] = [
+        DigestAlg::Sha1,
+        DigestAlg::Sha224,
+        DigestAlg::Sha256,
+        DigestAlg::Sha384,
+        DigestAlg::Sha512,
+        DigestAlg::Sha512_224,
+        DigestAlg::Sha512_256,
+        DigestAlg::Sha3_224,
+        DigestAlg::Sha3_256,
+        DigestAlg::Sha3_384,
+        DigestAlg::Sha3_512,
+        DigestAlg::Ripemd160,
+    ];
+
     pub fn from_oid(o: &str) -> Option<DigestAlg> {
-        Some(match o {
-            oid::SHA1 => DigestAlg::Sha1,
-            oid::SHA256 => DigestAlg::Sha256,
-            oid::SHA384 => DigestAlg::Sha384,
-            oid::SHA512 => DigestAlg::Sha512,
-            _ => return None,
-        })
+        DigestAlg::ALL.into_iter().find(|d| d.oid() == o)
     }
 
     pub fn oid(self) -> &'static str {
         match self {
             DigestAlg::Sha1 => oid::SHA1,
+            DigestAlg::Sha224 => oid::SHA224,
             DigestAlg::Sha256 => oid::SHA256,
             DigestAlg::Sha384 => oid::SHA384,
             DigestAlg::Sha512 => oid::SHA512,
+            DigestAlg::Sha512_224 => oid::SHA512_224,
+            DigestAlg::Sha512_256 => oid::SHA512_256,
+            DigestAlg::Sha3_224 => oid::SHA3_224,
+            DigestAlg::Sha3_256 => oid::SHA3_256,
+            DigestAlg::Sha3_384 => oid::SHA3_384,
+            DigestAlg::Sha3_512 => oid::SHA3_512,
+            DigestAlg::Ripemd160 => oid::RIPEMD160,
         }
     }
 
     pub fn name(self) -> &'static str {
         match self {
             DigestAlg::Sha1 => "SHA-1",
+            DigestAlg::Sha224 => "SHA-224",
             DigestAlg::Sha256 => "SHA-256",
             DigestAlg::Sha384 => "SHA-384",
             DigestAlg::Sha512 => "SHA-512",
+            DigestAlg::Sha512_224 => "SHA-512/224",
+            DigestAlg::Sha512_256 => "SHA-512/256",
+            DigestAlg::Sha3_224 => "SHA3-224",
+            DigestAlg::Sha3_256 => "SHA3-256",
+            DigestAlg::Sha3_384 => "SHA3-384",
+            DigestAlg::Sha3_512 => "SHA3-512",
+            DigestAlg::Ripemd160 => "RIPEMD-160",
         }
     }
 
     /// The digest of the concatenation of `parts`.
     pub fn digest(self, parts: &[&[u8]]) -> Vec<u8> {
-        fn run<D: sha2::Digest>(parts: &[&[u8]]) -> Vec<u8> {
+        fn sha2_run<D: sha2::Digest>(parts: &[&[u8]]) -> Vec<u8> {
+            let mut h = D::new();
+            for p in parts {
+                h.update(p);
+            }
+            h.finalize().to_vec()
+        }
+        fn sha3_run<D: sha3::Digest>(parts: &[&[u8]]) -> Vec<u8> {
             let mut h = D::new();
             for p in parts {
                 h.update(p);
@@ -76,10 +122,51 @@ impl DigestAlg {
             h.finalize().to_vec()
         }
         match self {
-            DigestAlg::Sha1 => run::<sha1::Sha1>(parts),
-            DigestAlg::Sha256 => run::<sha2::Sha256>(parts),
-            DigestAlg::Sha384 => run::<sha2::Sha384>(parts),
-            DigestAlg::Sha512 => run::<sha2::Sha512>(parts),
+            DigestAlg::Sha1 => sha2_run::<sha1::Sha1>(parts),
+            DigestAlg::Sha224 => sha2_run::<sha2::Sha224>(parts),
+            DigestAlg::Sha256 => sha2_run::<sha2::Sha256>(parts),
+            DigestAlg::Sha384 => sha2_run::<sha2::Sha384>(parts),
+            DigestAlg::Sha512 => sha2_run::<sha2::Sha512>(parts),
+            DigestAlg::Sha512_224 => sha2_run::<sha2::Sha512_224>(parts),
+            DigestAlg::Sha512_256 => sha2_run::<sha2::Sha512_256>(parts),
+            DigestAlg::Sha3_224 => sha3_run::<sha3::Sha3_224>(parts),
+            DigestAlg::Sha3_256 => sha3_run::<sha3::Sha3_256>(parts),
+            DigestAlg::Sha3_384 => sha3_run::<sha3::Sha3_384>(parts),
+            DigestAlg::Sha3_512 => sha3_run::<sha3::Sha3_512>(parts),
+            DigestAlg::Ripemd160 => {
+                use ripemd::Digest;
+                let mut h = ripemd::Ripemd160::new();
+                for p in parts {
+                    h.update(p);
+                }
+                h.finalize().to_vec()
+            }
+        }
+    }
+
+    /// What to tell the user when a signature that still validates uses this digest, or `None`
+    /// for one that is fine. Old documents carry SHA-1 and RIPEMD-160, so they validate, but a
+    /// signature panel that showed them like a SHA-256 one would overstate what they prove.
+    pub fn weakness(self) -> Option<&'static str> {
+        match self {
+            DigestAlg::Sha1 => Some(
+                "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.",
+            ),
+            DigestAlg::Ripemd160 => Some(
+                "This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.",
+            ),
+            _ => None,
+        }
+    }
+
+    /// The digest length in bytes.
+    pub fn output_len(self) -> usize {
+        match self {
+            DigestAlg::Sha1 | DigestAlg::Ripemd160 => 20,
+            DigestAlg::Sha224 | DigestAlg::Sha512_224 | DigestAlg::Sha3_224 => 28,
+            DigestAlg::Sha256 | DigestAlg::Sha512_256 | DigestAlg::Sha3_256 => 32,
+            DigestAlg::Sha384 | DigestAlg::Sha3_384 => 48,
+            DigestAlg::Sha512 | DigestAlg::Sha3_512 => 64,
         }
     }
 
@@ -89,52 +176,130 @@ impl DigestAlg {
     }
 }
 
+/// RSASSA-PSS parameters (RFC 4055 §3.1) besides the message digest.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct PssParams {
+    /// The MGF1 hash.
+    pub mgf: DigestAlg,
+    /// The declared salt length; `None` recovers it from the signature.
+    pub salt_len: Option<usize>,
+}
+
 /// How a signature value is computed.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Scheme {
     RsaPkcs1,
-    RsaPss,
+    RsaPss(PssParams),
+    /// ECDSA over a digest, the signature DER or plain `r ‖ s`.
     Ecdsa,
+    /// EdDSA over the message itself (RFC 8419), not over a digest.
+    Ed25519,
 }
 
+/// Signature algorithm OIDs that name both the scheme and the digest.
+const SIGNATURE_OIDS: &[(&str, Scheme, DigestAlg)] = &[
+    ("1.2.840.113549.1.1.5", Scheme::RsaPkcs1, DigestAlg::Sha1),
+    ("1.2.840.113549.1.1.14", Scheme::RsaPkcs1, DigestAlg::Sha224),
+    ("1.2.840.113549.1.1.11", Scheme::RsaPkcs1, DigestAlg::Sha256),
+    ("1.2.840.113549.1.1.12", Scheme::RsaPkcs1, DigestAlg::Sha384),
+    ("1.2.840.113549.1.1.13", Scheme::RsaPkcs1, DigestAlg::Sha512),
+    ("1.2.840.113549.1.1.15", Scheme::RsaPkcs1, DigestAlg::Sha512_224),
+    ("1.2.840.113549.1.1.16", Scheme::RsaPkcs1, DigestAlg::Sha512_256),
+    ("2.16.840.1.101.3.4.3.13", Scheme::RsaPkcs1, DigestAlg::Sha3_224),
+    ("2.16.840.1.101.3.4.3.14", Scheme::RsaPkcs1, DigestAlg::Sha3_256),
+    ("2.16.840.1.101.3.4.3.15", Scheme::RsaPkcs1, DigestAlg::Sha3_384),
+    ("2.16.840.1.101.3.4.3.16", Scheme::RsaPkcs1, DigestAlg::Sha3_512),
+    ("1.3.36.3.3.1.2", Scheme::RsaPkcs1, DigestAlg::Ripemd160),
+    ("1.2.840.10045.4.1", Scheme::Ecdsa, DigestAlg::Sha1),
+    ("1.2.840.10045.4.3.1", Scheme::Ecdsa, DigestAlg::Sha224),
+    ("1.2.840.10045.4.3.2", Scheme::Ecdsa, DigestAlg::Sha256),
+    ("1.2.840.10045.4.3.3", Scheme::Ecdsa, DigestAlg::Sha384),
+    ("1.2.840.10045.4.3.4", Scheme::Ecdsa, DigestAlg::Sha512),
+    ("2.16.840.1.101.3.4.3.9", Scheme::Ecdsa, DigestAlg::Sha3_224),
+    ("2.16.840.1.101.3.4.3.10", Scheme::Ecdsa, DigestAlg::Sha3_256),
+    ("2.16.840.1.101.3.4.3.11", Scheme::Ecdsa, DigestAlg::Sha3_384),
+    ("2.16.840.1.101.3.4.3.12", Scheme::Ecdsa, DigestAlg::Sha3_512),
+    // BSI TR-03111 "plain" ECDSA (r ‖ s), as German signature cards write it.
+    ("0.4.0.127.0.7.1.1.4.1.1", Scheme::Ecdsa, DigestAlg::Sha1),
+    ("0.4.0.127.0.7.1.1.4.1.2", Scheme::Ecdsa, DigestAlg::Sha224),
+    ("0.4.0.127.0.7.1.1.4.1.3", Scheme::Ecdsa, DigestAlg::Sha256),
+    ("0.4.0.127.0.7.1.1.4.1.4", Scheme::Ecdsa, DigestAlg::Sha384),
+    ("0.4.0.127.0.7.1.1.4.1.5", Scheme::Ecdsa, DigestAlg::Sha512),
+    ("0.4.0.127.0.7.1.1.4.1.6", Scheme::Ecdsa, DigestAlg::Ripemd160),
+];
+
 /// A signature `AlgorithmIdentifier`: the scheme and, when the identifier names one, the digest.
 pub fn signature_algorithm(alg: &Tlv<'_>) -> Result<(Scheme, Option<DigestAlg>), SignError> {
     let parts = alg.children()?;
     let o = parts.first().ok_or_else(|| SignError::Malformed("empty algorithm".into()))?.oid()?;
+    if let Some((_, scheme, digest)) = SIGNATURE_OIDS.iter().find(|(k, _, _)| *k == o) {
+        return Ok((*scheme, Some(*digest)));
+    }
     Ok(match o.as_str() {
         oid::RSA => (Scheme::RsaPkcs1, None),
-        oid::RSA_SHA1 => (Scheme::RsaPkcs1, Some(DigestAlg::Sha1)),
-        oid::RSA_SHA256 => (Scheme::RsaPkcs1, Some(DigestAlg::Sha256)),
-        oid::RSA_SHA384 => (Scheme::RsaPkcs1, Some(DigestAlg::Sha384)),
-        oid::RSA_SHA512 => (Scheme::RsaPkcs1, Some(DigestAlg::Sha512)),
-        oid::RSA_PSS => {
-            // RSASSA-PSS-params: [0] hashAlgorithm (default SHA-1).
-            let hash = parts
-                .get(1)
-                .and_then(|p| p.children().ok())
-                .and_then(|c| c.into_iter().find(|t| t.tag == tag::ctx(0)))
-                .and_then(|h| h.inner().ok())
-                .and_then(|a| a.children().ok())
-                .and_then(|a| a.first().and_then(|o| o.oid().ok()))
-                .and_then(|o| DigestAlg::from_oid(&o))
-                .unwrap_or(DigestAlg::Sha1);
-            (Scheme::RsaPss, Some(hash))
-        }
-        oid::ECDSA_SHA1 => (Scheme::Ecdsa, Some(DigestAlg::Sha1)),
-        oid::ECDSA_SHA256 => (Scheme::Ecdsa, Some(DigestAlg::Sha256)),
-        oid::ECDSA_SHA384 => (Scheme::Ecdsa, Some(DigestAlg::Sha384)),
-        oid::ECDSA_SHA512 => (Scheme::Ecdsa, Some(DigestAlg::Sha512)),
         oid::EC => (Scheme::Ecdsa, None),
+        oid::ED25519 => (Scheme::Ed25519, None),
+        oid::RSA_PSS => {
+            let (hash, params) = pss_params(parts.get(1))?;
+            (Scheme::RsaPss(params), Some(hash))
+        }
         other => return Err(SignError::Unsupported(format!("signature algorithm {other}"))),
     })
 }
 
+/// `RSASSA-PSS-params` (RFC 4055): `[0]` hash (default SHA-1), `[1]` mask generation function
+/// (default MGF1 with SHA-1), `[2]` salt length (default 20). Absent parameters mean the defaults.
+fn pss_params(params: Option<&Tlv<'_>>) -> Result<(DigestAlg, PssParams), SignError> {
+    let hash_of = |alg: &Tlv<'_>| -> Result<DigestAlg, SignError> {
+        let o = alg.children()?.first().ok_or_else(|| SignError::Malformed("PSS hash".into()))?.oid()?;
+        DigestAlg::from_oid(&o).ok_or_else(|| SignError::Unsupported(format!("digest {o}")))
+    };
+    let mut hash = DigestAlg::Sha1;
+    let mut mgf = DigestAlg::Sha1;
+    let mut salt_len = 20usize;
+    if let Some(p) = params.filter(|p| p.tag == tag::SEQUENCE) {
+        for field in p.children()? {
+            match field.tag {
+                t if t == tag::ctx(0) => hash = hash_of(&field.inner()?)?,
+                t if t == tag::ctx(1) => {
+                    let m = field.inner()?.children()?;
+                    if m.first().map(|o| o.oid()).transpose()?.as_deref() != Some(oid::MGF1) {
+                        return Err(SignError::Unsupported("PSS mask generation function other than MGF1".into()));
+                    }
+                    mgf = hash_of(m.get(1).ok_or_else(|| SignError::Malformed("MGF1 hash".into()))?)?;
+                }
+                t if t == tag::ctx(2) => {
+                    salt_len = usize::try_from(field.inner()?.u64()?).map_err(|_| SignError::Malformed("PSS salt length".into()))?
+                }
+                _ => {}
+            }
+        }
+    }
+    Ok((hash, PssParams { mgf, salt_len: Some(salt_len) }))
+}
+
 /// A public key from a `SubjectPublicKeyInfo`.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum PublicKey {
-    Rsa { n: Vec<u8>, e: Vec<u8> },
+    Rsa {
+        n: Vec<u8>,
+        e: Vec<u8>,
+    },
     P256(Vec<u8>),
     P384(Vec<u8>),
+    /// Verification only (no signing).
+    P521(Vec<u8>),
+    BrainpoolP256(Vec<u8>),
+    BrainpoolP384(Vec<u8>),
+    BrainpoolP512(Vec<u8>),
+    /// The 32-byte public key (RFC 8032). Signs the message itself, see [`Scheme::Ed25519`].
+    Ed25519(Vec<u8>),
+    /// A key algorithm or curve PdfCraft can't check signatures with. The certificate still
+    /// parses (so its name and dates show); verifying with it gives [`SignError::Unsupported`].
+    Unsupported {
+        what: String,
+        spki: Vec<u8>,
+    },
 }
 
 impl PublicKey {
@@ -143,7 +308,19 @@ impl PublicKey {
     pub fn key_bits(&self) -> Vec<u8> {
         match self {
             PublicKey::Rsa { n, e } => der::seq(&[&der::uint(n), &der::uint(e)]),
-            PublicKey::P256(bits) | PublicKey::P384(bits) => bits.clone(),
+            PublicKey::P256(bits)
+            | PublicKey::P384(bits)
+            | PublicKey::P521(bits)
+            | PublicKey::BrainpoolP256(bits)
+            | PublicKey::BrainpoolP384(bits)
+            | PublicKey::BrainpoolP512(bits)
+            | PublicKey::Ed25519(bits) => bits.clone(),
+            // The BIT STRING of the stored SubjectPublicKeyInfo (empty if it doesn't parse).
+            PublicKey::Unsupported { spki, .. } => Tlv::parse(spki)
+                .ok()
+                .and_then(|(t, _)| t.children().ok())
+                .and_then(|c| c.get(1).and_then(|k| k.bits().ok().map(<[u8]>::to_vec)))
+                .unwrap_or_default(),
         }
     }
 
@@ -154,6 +331,7 @@ impl PublicKey {
         let o = alg.first().ok_or_else(|| SignError::Malformed("key algorithm".into()))?.oid()?;
         let bits = key.bits()?;
         match o.as_str() {
+            oid::ED25519 => Ok(PublicKey::Ed25519(bits.to_vec())),
             oid::RSA => {
                 let k = Tlv::parse_all(bits)?.children()?;
                 let [n, e] = k.as_slice() else { return Err(SignError::Malformed("RSAPublicKey".into())) };
@@ -162,9 +340,13 @@ impl PublicKey {
             oid::EC => match alg.get(1).map(|c| c.oid()).transpose()?.as_deref() {
                 Some(oid::P256) => Ok(PublicKey::P256(bits.to_vec())),
                 Some(oid::P384) => Ok(PublicKey::P384(bits.to_vec())),
-                other => Err(SignError::Unsupported(format!("elliptic curve {}", other.unwrap_or("?")))),
+                Some(oid::P521) => Ok(PublicKey::P521(bits.to_vec())),
+                Some(oid::BRAINPOOL_P256) => Ok(PublicKey::BrainpoolP256(bits.to_vec())),
+                Some(oid::BRAINPOOL_P384) => Ok(PublicKey::BrainpoolP384(bits.to_vec())),
+                Some(oid::BRAINPOOL_P512) => Ok(PublicKey::BrainpoolP512(bits.to_vec())),
+                other => Ok(PublicKey::Unsupported { what: format!("elliptic curve {}", other.unwrap_or("?")), spki: spki.raw.to_vec() }),
             },
-            other => Err(SignError::Unsupported(format!("public key algorithm {other}"))),
+            other => Ok(PublicKey::Unsupported { what: format!("public key algorithm {other}"), spki: spki.raw.to_vec() }),
         }
     }
 
@@ -177,6 +359,12 @@ impl PublicKey {
             }
             PublicKey::P256(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::P256)]), &der::bit_string(p)]),
             PublicKey::P384(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::P384)]), &der::bit_string(p)]),
+            PublicKey::P521(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::P521)]), &der::bit_string(p)]),
+            PublicKey::BrainpoolP256(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::BRAINPOOL_P256)]), &der::bit_string(p)]),
+            PublicKey::BrainpoolP384(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::BRAINPOOL_P384)]), &der::bit_string(p)]),
+            PublicKey::BrainpoolP512(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::BRAINPOOL_P512)]), &der::bit_string(p)]),
+            PublicKey::Ed25519(p) => der::seq(&[&der::seq(&[&der::oid(oid::ED25519)]), &der::bit_string(p)]),
+            PublicKey::Unsupported { spki, .. } => spki.clone(),
         }
     }
 
@@ -186,43 +374,118 @@ impl PublicKey {
             PublicKey::Rsa { n, .. } => format!("RSA {}-bit", n.len() * 8),
             PublicKey::P256(_) => "ECDSA P-256".into(),
             PublicKey::P384(_) => "ECDSA P-384".into(),
+            PublicKey::P521(_) => "ECDSA P-521".into(),
+            PublicKey::BrainpoolP256(_) => "ECDSA brainpoolP256r1".into(),
+            PublicKey::BrainpoolP384(_) => "ECDSA brainpoolP384r1".into(),
+            PublicKey::BrainpoolP512(_) => "ECDSA brainpoolP512r1".into(),
+            PublicKey::Ed25519(_) => "Ed25519".into(),
+            PublicKey::Unsupported { what, .. } => format!("unsupported ({what})"),
         }
     }
 
-    /// Check `sig` over a message whose digest (with `alg`) is `digest`.
+    /// Check `sig` over a message whose digest (with `alg`) is `digest`. Encodings are read
+    /// leniently (see [`crate::rsa_pad`], [`ecdsa_rs`]); the cryptographic check never is.
+    /// `Err(Unsupported)` means "can't tell", as opposed to `Ok(false)`: "doesn't match".
     pub fn verify(&self, scheme: Scheme, alg: DigestAlg, digest: &[u8], sig: &[u8]) -> Result<bool, SignError> {
+        self.verify_noting(scheme, alg, digest, sig, &mut Vec::new())
+    }
+
+    /// [`PublicKey::verify`], noting in `notes` each encoding irregularity it tolerated. Only
+    /// meaningful when it returns `Ok(true)`: a signature that doesn't verify may leave notes
+    /// about how far it got.
+    pub fn verify_noting(&self, scheme: Scheme, alg: DigestAlg, digest: &[u8], sig: &[u8], notes: &mut Vec<&'static str>) -> Result<bool, SignError> {
         match (self, scheme) {
-            (PublicKey::Rsa { n, e }, Scheme::RsaPkcs1 | Scheme::RsaPss) => {
-                use rsa::{BoxedUint, Pkcs1v15Sign, RsaPublicKey, pss::Pss};
-                let key = RsaPublicKey::new(BoxedUint::from_be_slice_vartime(n), BoxedUint::from_be_slice_vartime(e))
-                    .map_err(|e| SignError::Malformed(format!("RSA key: {e}")))?;
-                let ok = match (scheme, alg) {
-                    (Scheme::RsaPkcs1, DigestAlg::Sha1) => key.verify(Pkcs1v15Sign::new::<sha1::Sha1>(), digest, sig),
-                    (Scheme::RsaPkcs1, DigestAlg::Sha256) => key.verify(Pkcs1v15Sign::new::<sha2::Sha256>(), digest, sig),
-                    (Scheme::RsaPkcs1, DigestAlg::Sha384) => key.verify(Pkcs1v15Sign::new::<sha2::Sha384>(), digest, sig),
-                    (Scheme::RsaPkcs1, DigestAlg::Sha512) => key.verify(Pkcs1v15Sign::new::<sha2::Sha512>(), digest, sig),
-                    (_, DigestAlg::Sha1) => key.verify(Pss::<sha1::Sha1>::new(), digest, sig),
-                    (_, DigestAlg::Sha256) => key.verify(Pss::<sha2::Sha256>::new(), digest, sig),
-                    (_, DigestAlg::Sha384) => key.verify(Pss::<sha2::Sha384>::new(), digest, sig),
-                    (_, DigestAlg::Sha512) => key.verify(Pss::<sha2::Sha512>::new(), digest, sig),
-                };
-                Ok(ok.is_ok())
-            }
+            (PublicKey::Unsupported { what, .. }, _) => Err(SignError::Unsupported(what.clone())),
+            (PublicKey::Rsa { n, e }, Scheme::RsaPkcs1) => crate::rsa_pad::pkcs1_verify(n, e, alg, digest, sig, notes),
+            (PublicKey::Rsa { n, e }, Scheme::RsaPss(params)) => crate::rsa_pad::pss_verify(n, e, alg, params, digest, sig, notes),
+            (PublicKey::Ed25519(_), _) => Err(SignError::Unsupported("Ed25519 signs the message, not a digest".into())),
             (PublicKey::P256(p), Scheme::Ecdsa) => {
                 use p256::ecdsa::signature::hazmat::PrehashVerifier;
                 let key = p256::ecdsa::VerifyingKey::from_sec1_bytes(p).map_err(|_| SignError::Malformed("P-256 key".into()))?;
-                let Ok(s) = p256::ecdsa::Signature::from_der(sig) else { return Ok(false) };
+                let Some(s) = ecdsa_rs(sig, 32, notes).and_then(|rs| p256::ecdsa::Signature::from_slice(&rs).ok()) else { return Ok(false) };
                 Ok(key.verify_prehash(digest, &s).is_ok())
             }
             (PublicKey::P384(p), Scheme::Ecdsa) => {
                 use p384::ecdsa::signature::hazmat::PrehashVerifier;
                 let key = p384::ecdsa::VerifyingKey::from_sec1_bytes(p).map_err(|_| SignError::Malformed("P-384 key".into()))?;
-                let Ok(s) = p384::ecdsa::Signature::from_der(sig) else { return Ok(false) };
+                let Some(s) = ecdsa_rs(sig, 48, notes).and_then(|rs| p384::ecdsa::Signature::from_slice(&rs).ok()) else { return Ok(false) };
                 Ok(key.verify_prehash(digest, &s).is_ok())
             }
+            (PublicKey::P521(p), Scheme::Ecdsa) => {
+                use p521::ecdsa::signature::hazmat::PrehashVerifier;
+                let key = p521::ecdsa::VerifyingKey::from_sec1_bytes(p).map_err(|_| SignError::Malformed("P-521 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 66, notes).and_then(|rs| p521::ecdsa::Signature::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::BrainpoolP256(p), Scheme::Ecdsa) => {
+                use ecdsa::signature::hazmat::PrehashVerifier;
+                type Curve = bp256::BrainpoolP256r1;
+                let key = ecdsa::VerifyingKey::<Curve>::from_sec1_bytes(p).map_err(|_| SignError::Malformed("brainpoolP256r1 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 32, notes).and_then(|rs| ecdsa::Signature::<Curve>::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::BrainpoolP384(p), Scheme::Ecdsa) => {
+                use ecdsa::signature::hazmat::PrehashVerifier;
+                type Curve = bp384::BrainpoolP384r1;
+                let key = ecdsa::VerifyingKey::<Curve>::from_sec1_bytes(p).map_err(|_| SignError::Malformed("brainpoolP384r1 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 48, notes).and_then(|rs| ecdsa::Signature::<Curve>::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::BrainpoolP512(p), Scheme::Ecdsa) => {
+                let Some(rs) = ecdsa_rs(sig, 64, notes) else { return Ok(false) };
+                crate::ec512::verify(p, digest, &rs).ok_or_else(|| SignError::Malformed("brainpoolP512r1 key or signature".into()))
+            }
             _ => Ok(false),
         }
     }
+
+    /// Check `sig` over `msg` itself, for the schemes that don't sign a digest (Ed25519,
+    /// RFC 8419: with signed attributes, the message is their DER encoding).
+    pub fn verify_message(&self, scheme: Scheme, msg: &[u8], sig: &[u8]) -> Result<bool, SignError> {
+        match (self, scheme) {
+            (PublicKey::Unsupported { what, .. }, _) => Err(SignError::Unsupported(what.clone())),
+            (PublicKey::Ed25519(k), Scheme::Ed25519) => {
+                let bytes: [u8; 32] = k.as_slice().try_into().map_err(|_| SignError::Malformed("Ed25519 key".into()))?;
+                let key = ed25519_dalek::VerifyingKey::from_bytes(&bytes).map_err(|_| SignError::Malformed("Ed25519 key".into()))?;
+                let Ok(sig) = ed25519_dalek::Signature::from_slice(sig) else { return Ok(false) };
+                Ok(key.verify_strict(msg, &sig).is_ok())
+            }
+            _ => Ok(false),
+        }
+    }
+}
+
+/// An ECDSA signature as the fixed-width `r ‖ s` the curve crates read: from the standard DER
+/// `SEQUENCE { INTEGER r, INTEGER s }` (also with integers that have redundant leading zeros or
+/// the sign byte missing), or already raw `r ‖ s` as PKCS #11 tokens return it. `notes` gets an
+/// entry when the signature was not canonical DER.
+fn ecdsa_rs(sig: &[u8], field_len: usize, notes: &mut Vec<&'static str>) -> Option<Vec<u8>> {
+    let pad = |int: &[u8]| -> Option<Vec<u8>> {
+        let int = int.get(int.iter().position(|b| *b != 0).unwrap_or(int.len())..).unwrap_or_default();
+        let zeros = field_len.checked_sub(int.len())?;
+        Some(std::iter::repeat_n(0u8, zeros).chain(int.iter().copied()).collect())
+    };
+    if let Ok((t, rest)) = Tlv::parse(sig)
+        && t.tag == tag::SEQUENCE
+        && rest.iter().all(|b| *b == 0)
+        && let Ok(parts) = t.children()
+        && let [r, s] = parts.as_slice()
+        && r.tag == tag::INTEGER
+        && s.tag == tag::INTEGER
+    {
+        // Canonical DER: nothing after the sequence, minimal positive integers.
+        let minimal = |i: &Tlv<'_>| i.value.first().is_some_and(|b| b & 0x80 == 0) && !matches!(i.value, [0, b, ..] if b & 0x80 == 0);
+        if !rest.is_empty() || !minimal(r) || !minimal(s) {
+            notes.push("The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.");
+        }
+        let mut out = pad(r.value)?;
+        out.extend(pad(s.value)?);
+        return Some(out);
+    }
+    (sig.len() == field_len * 2).then(|| {
+        notes.push("The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.");
+        sig.to_vec()
+    })
 }
 
 enum Inner {
@@ -370,16 +633,14 @@ impl PrivateKey {
 
     /// The signature `AlgorithmIdentifier` this key writes with `alg`.
     pub fn signature_algorithm(&self, alg: DigestAlg) -> Vec<u8> {
-        match (&self.public, alg) {
-            (PublicKey::Rsa { .. }, DigestAlg::Sha1) => der::algorithm(oid::RSA_SHA1, Some(&der::null())),
-            (PublicKey::Rsa { .. }, DigestAlg::Sha256) => der::algorithm(oid::RSA_SHA256, Some(&der::null())),
-            (PublicKey::Rsa { .. }, DigestAlg::Sha384) => der::algorithm(oid::RSA_SHA384, Some(&der::null())),
-            (PublicKey::Rsa { .. }, DigestAlg::Sha512) => der::algorithm(oid::RSA_SHA512, Some(&der::null())),
-            (_, DigestAlg::Sha1) => der::algorithm(oid::ECDSA_SHA1, None),
-            (_, DigestAlg::Sha256) => der::algorithm(oid::ECDSA_SHA256, None),
-            (_, DigestAlg::Sha384) => der::algorithm(oid::ECDSA_SHA384, None),
-            (_, DigestAlg::Sha512) => der::algorithm(oid::ECDSA_SHA512, None),
-        }
+        let rsa = matches!(self.public, PublicKey::Rsa { .. });
+        let scheme = if rsa { Scheme::RsaPkcs1 } else { Scheme::Ecdsa };
+        // `sign` only writes SHA-256/384/512, which the table has for both schemes.
+        let oid = SIGNATURE_OIDS
+            .iter()
+            .find(|(_, s, d)| *s == scheme && *d == alg)
+            .map_or(if rsa { "1.2.840.113549.1.1.11" } else { "1.2.840.10045.4.3.2" }, |(o, _, _)| *o);
+        der::algorithm(oid, rsa.then(der::null).as_deref())
     }
 
     /// The digest a signature with this key should use: SHA-256, or SHA-384 for P-384.
@@ -392,8 +653,8 @@ impl PrivateKey {
 
     /// Sign `msg` (hashed with `alg`). New signatures never use SHA-1.
     pub fn sign(&self, alg: DigestAlg, msg: &[u8]) -> Result<Vec<u8>, SignError> {
-        if alg == DigestAlg::Sha1 {
-            return Err(SignError::Unsupported("SHA-1 for new signatures".into()));
+        if !matches!(alg, DigestAlg::Sha256 | DigestAlg::Sha384 | DigestAlg::Sha512) {
+            return Err(SignError::Unsupported(format!("{} for new signatures", alg.name())));
         }
         match &self.inner {
             #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/sign/src/lib.rs b/crates/sign/src/lib.rs
index b35f8ae9..9cb57c03 100644
--- a/crates/sign/src/lib.rs
+++ b/crates/sign/src/lib.rs
@@ -10,12 +10,14 @@
 pub mod cms;
 pub mod der;
 pub mod dss;
+mod ec512;
 #[cfg(target_os = "macos")]
 pub mod keychain;
 pub mod keys;
 pub mod pdf;
 pub mod pkcs12;
 pub mod revocation;
+mod rsa_pad;
 pub mod timestamp;
 #[cfg(target_os = "windows")]
 pub mod windows;
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index d2925baa..ec566c73 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -528,12 +528,18 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
     info.signed_len = covered;
     // The signed revision's number: its cross-reference sections (1 for a reconstructed file).
     info.revision = cache.revision(bytes, covered).map_or(1, |d| d.revisions().len().max(1));
+    // What can't be checked is unknown, not invalid: only data that is wrong or fails its check
+    // is "invalid".
+    let unsupported = |info: &mut SignatureInfo, why: &str| {
+        info.status = Status::Unknown;
+        info.details.push(format!("PdfCraft can't check this signature yet: {why}."));
+    };
     if info.sub_filter.as_deref() == Some("adbe.x509.rsa_sha1") {
-        info.details.push("This signature uses the legacy adbe.x509.rsa_sha1 format, which PdfCraft does not validate yet.".into());
-        return;
+        return validate_x509_rsa_sha1(doc, bytes, trust, v, info, cache, (l0, o1, covered), &contents);
     }
     let sd = match SignedData::parse(&contents) {
         Ok(sd) => sd,
+        Err(SignError::Unsupported(e)) => return unsupported(info, &e),
         Err(e) => return invalid(info, &format!("The signature could not be read ({e}).")),
     };
     let s = &sd.signer;
@@ -587,12 +593,42 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
     };
     info.algorithm = Some(format!("{} with {}", cert.public_key.describe(), s.scheme_digest.unwrap_or(s.digest).name()));
     info.signer = Some(cert.display_name());
-    if !sd.verify_signature(&cert, &content_digest) {
-        info.certificate = Some(cert);
-        return invalid(info, "The signature value does not match the signer's certificate: the signature is corrupt.");
+    let mut notes = Vec::new();
+    match sd.verify_signature_noting(&cert, &content_digest, &mut notes) {
+        Ok(true) => info.details.extend(notes.into_iter().map(String::from)),
+        Ok(false) => {
+            info.certificate = Some(cert);
+            return invalid(info, "The signature value does not match the signer's certificate: the signature is corrupt.");
+        }
+        Err(SignError::Unsupported(e)) => {
+            info.certificate = Some(cert);
+            return unsupported(info, &e);
+        }
+        Err(e) => {
+            info.certificate = Some(cert);
+            return invalid(info, &format!("The signature could not be checked ({e})."));
+        }
     }
-    info.signing_time = s.signing_time.or_else(|| info.date.as_deref().and_then(Time::from_pdf));
-    let mut pool = sd.certificates.clone();
+    finish_validation(doc, bytes, trust, info, cache, covered, cert, &sd.certificates, s.signing_time, unverified_time);
+}
+
+/// The verdict once the signature value has been checked: chain and trust, the signing time
+/// against the certificate's validity, and what later revisions changed.
+#[allow(clippy::too_many_arguments)]
+fn finish_validation(
+    doc: &Document,
+    bytes: &[u8],
+    trust: &TrustStore,
+    info: &mut SignatureInfo,
+    cache: &DigestCache,
+    covered: usize,
+    cert: Certificate,
+    embedded: &[Certificate],
+    cms_time: Option<Time>,
+    unverified_time: Option<Time>,
+) {
+    info.signing_time = cms_time.or_else(|| info.date.as_deref().and_then(Time::from_pdf));
+    let mut pool = embedded.to_vec();
     pool.extend(trust.certs.iter().cloned());
     // The time the chain is judged at: trusted timestamp, else the signer's claimed time.
     let at = info.timestamp_time.or(info.signing_time);
@@ -850,6 +886,66 @@ pub(crate) fn signature_contents(doc: &Document) -> Vec<Vec<u8>> {
     out
 }
 
+/// `adbe.x509.rsa_sha1` (ISO 32000-2 §12.8.3.2, deprecated): `/Contents` is the PKCS #1
+/// signature as a DER OCTET STRING over the SHA-1 digest of the byte ranges, and `/Cert` holds the
+/// signer's certificate (then any others) as DER byte strings.
+#[allow(clippy::too_many_arguments)]
+fn validate_x509_rsa_sha1(
+    doc: &Document,
+    bytes: &[u8],
+    trust: &TrustStore,
+    v: &Dict,
+    info: &mut SignatureInfo,
+    cache: &DigestCache,
+    (l0, o1, covered): (usize, usize, usize),
+    contents: &[u8],
+) {
+    let fail = |info: &mut SignatureInfo, why: &str| {
+        info.status = Status::Invalid;
+        info.details.push(why.to_string());
+    };
+    let certs: Vec<Certificate> = match v.get(b"Cert").map(|c| doc.resolve(c)).as_deref() {
+        Some(Object::Array(a)) => a.iter().filter_map(|c| doc.resolve(c).as_string().map(|s| s.bytes.clone())).collect::<Vec<_>>(),
+        Some(Object::String(s)) => vec![s.bytes.clone()],
+        _ => Vec::new(),
+    }
+    .iter()
+    .filter_map(|raw| Certificate::parse(raw).ok())
+    .collect();
+    let Some(cert) = certs.first().cloned() else { return fail(info, "The signer's certificate is not in the signature.") };
+    let signature = match crate::der::Tlv::parse_ber(contents).and_then(|(t, _)| t.octets("signature").map(|o| o.into_owned())) {
+        Ok(sig) => sig,
+        Err(e) => return fail(info, &format!("The signature could not be read ({e}).")),
+    };
+    info.digest = Some(DigestAlg::Sha1);
+    info.algorithm = Some(format!("{} with SHA-1", cert.public_key.describe()));
+    info.signer = Some(cert.display_name());
+    let digest = cache.digest(DigestAlg::Sha1, bytes, l0, o1, covered);
+    let mut notes = Vec::new();
+    match cert.public_key.verify_noting(crate::keys::Scheme::RsaPkcs1, DigestAlg::Sha1, &digest, &signature, &mut notes) {
+        Ok(true) => info.details.extend(notes.into_iter().map(String::from)),
+        Ok(false) => {
+            info.certificate = Some(cert);
+            return fail(info, "The document has been altered or corrupted since the signature was applied.");
+        }
+        // Only what PdfCraft doesn't support yet is "can't check"; a key or value that is
+        // malformed is a signature that doesn't verify (as on the CMS path).
+        Err(SignError::Unsupported(e)) => {
+            info.certificate = Some(cert);
+            info.status = Status::Unknown;
+            info.details.push(format!("PdfCraft can't check this signature yet: {e}."));
+            return;
+        }
+        Err(e) => {
+            info.certificate = Some(cert);
+            return fail(info, &format!("The signature could not be verified ({e})."));
+        }
+    }
+    info.details.push("The signature uses the legacy adbe.x509.rsa_sha1 format.".into());
+    info.details.extend(DigestAlg::Sha1.weakness().map(String::from));
+    finish_validation(doc, bytes, trust, info, cache, covered, cert, &certs, None, None);
+}
+
 /// What later revisions changed, classified as Acrobat reports it, under DocMDP `p` (or none:
 /// an approval signature permits form fill, comments and further signatures).
 fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Modification {
diff --git a/crates/sign/src/pkcs12.rs b/crates/sign/src/pkcs12.rs
index 69d4e14e..ab83e747 100644
--- a/crates/sign/src/pkcs12.rs
+++ b/crates/sign/src/pkcs12.rs
@@ -71,11 +71,14 @@ fn bmp(password: &str) -> Vec<u8> {
 
 /// The PKCS #12 key derivation function (RFC 7292 Appendix B.2).
 fn pkcs12_kdf(alg: DigestAlg, password: &[u8], salt: &[u8], id: u8, iterations: u32, n: usize) -> Vec<u8> {
+    // Callers only pass the SHA-1/SHA-2 digests PKCS #12 files use (`open` restricts the MAC digest).
     let (u, v) = match alg {
         DigestAlg::Sha1 => (20, 64),
+        DigestAlg::Sha224 => (28, 64),
         DigestAlg::Sha256 => (32, 64),
         DigestAlg::Sha384 => (48, 128),
         DigestAlg::Sha512 => (64, 128),
+        _ => return Vec::new(),
     };
     let _ = u;
     let fill = |s: &[u8]| -> Vec<u8> {
@@ -157,21 +160,25 @@ fn hmac(alg: DigestAlg, key: &[u8], data: &[u8]) -> Result<Vec<u8>, SignError> {
     }
     match alg {
         DigestAlg::Sha1 => run::<sha1::Sha1>(key, data),
+        DigestAlg::Sha224 => run::<sha2::Sha224>(key, data),
         DigestAlg::Sha256 => run::<sha2::Sha256>(key, data),
         DigestAlg::Sha384 => run::<sha2::Sha384>(key, data),
         DigestAlg::Sha512 => run::<sha2::Sha512>(key, data),
+        other => Err(SignError::Unsupported(format!("{} in a PKCS #12 MAC", other.name()))),
     }
 }
 
-fn pbkdf2(prf: DigestAlg, password: &[u8], salt: &[u8], rounds: u32, len: usize) -> Vec<u8> {
+fn pbkdf2(prf: DigestAlg, password: &[u8], salt: &[u8], rounds: u32, len: usize) -> Result<Vec<u8>, SignError> {
     let mut out = vec![0u8; len];
     match prf {
         DigestAlg::Sha1 => pbkdf2::pbkdf2_hmac::<sha1::Sha1>(password, salt, rounds, &mut out),
+        DigestAlg::Sha224 => pbkdf2::pbkdf2_hmac::<sha2::Sha224>(password, salt, rounds, &mut out),
         DigestAlg::Sha256 => pbkdf2::pbkdf2_hmac::<sha2::Sha256>(password, salt, rounds, &mut out),
         DigestAlg::Sha384 => pbkdf2::pbkdf2_hmac::<sha2::Sha384>(password, salt, rounds, &mut out),
         DigestAlg::Sha512 => pbkdf2::pbkdf2_hmac::<sha2::Sha512>(password, salt, rounds, &mut out),
+        other => return Err(SignError::Unsupported(format!("PBKDF2 with {}", other.name()))),
     }
-    out
+    Ok(out)
 }
 
 /// Decrypt `ct` with the password-based scheme `alg` (an AlgorithmIdentifier).
@@ -215,7 +222,7 @@ fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8]) -> Result<Vec<u8>, Sign
                 other => return Err(SignError::Unsupported(format!("PBES2 cipher {}", other.unwrap_or("?")))),
             };
             let iv = sc.get(1).ok_or_else(|| bad("IV"))?.octets("IV")?;
-            let key = pbkdf2(prf, password.as_bytes(), &salt, rounds, cipher.key_len());
+            let key = pbkdf2(prf, password.as_bytes(), &salt, rounds, cipher.key_len())?;
             cipher.decrypt(&key, &iv, ct)
         }
         PBE_SHA_3DES | PBE_SHA_2DES | PBE_SHA_RC2_128 | PBE_SHA_RC2_40 => {
@@ -355,7 +362,9 @@ pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, SignError> {
         let digest_info = m.first().ok_or_else(|| bad("MacData"))?.children()?;
         let alg = digest_info.first().ok_or_else(|| bad("MAC algorithm"))?.children()?;
         let alg_oid = alg.first().ok_or_else(|| bad("MAC algorithm"))?.oid()?;
-        let alg = DigestAlg::from_oid(&alg_oid).ok_or_else(|| SignError::Unsupported(format!("MAC digest {alg_oid}")))?;
+        let alg = DigestAlg::from_oid(&alg_oid)
+            .filter(|d| matches!(d, DigestAlg::Sha1 | DigestAlg::Sha224 | DigestAlg::Sha256 | DigestAlg::Sha384 | DigestAlg::Sha512))
+            .ok_or_else(|| SignError::Unsupported(format!("MAC digest {alg_oid}")))?;
         let expected = digest_info.get(1).ok_or_else(|| bad("MAC"))?.octets("MAC")?;
         let salt = m.get(1).ok_or_else(|| bad("MAC salt"))?.octets("MAC salt")?;
         let iterations = m.get(2).map(|i| i.u64()).transpose()?.unwrap_or(1) as u32;
@@ -435,7 +444,7 @@ pub fn write(id: &DigitalId, password: &str) -> Result<Vec<u8>, SignError> {
     const ITER: u32 = 2048;
     let encrypt = |plain: &[u8]| -> Result<Vec<u8>, SignError> {
         let (salt, iv) = (random(16)?, random(16)?);
-        let key = pbkdf2(DigestAlg::Sha256, password.as_bytes(), &salt, ITER, 32);
+        let key = pbkdf2(DigestAlg::Sha256, password.as_bytes(), &salt, ITER, 32)?;
         let ct = cbc::Encryptor::<aes::Aes256>::new_from_slices(&key, &iv)
             .map_err(|_| SignError::Crypto("AES".into()))?
             .encrypt_padded_vec::<Pkcs7>(plain);
diff --git a/crates/sign/src/rsa_pad.rs b/crates/sign/src/rsa_pad.rs
new file mode 100644
index 00000000..8cc6e08f
--- /dev/null
+++ b/crates/sign/src/rsa_pad.rs
@@ -0,0 +1,139 @@
+//! RSA signature checks with the padding done here: the raw public-key operation comes from the
+//! `rsa` crate, and the EMSA-PKCS1-v1_5 / EMSA-PSS encodings (RFC 8017 §9) are checked against
+//! any digest, any MGF1 hash and any salt length, which the `rsa` crate's typed API can't do.
+//! Verification only; public data, so nothing here needs to be constant-time.
+
+use rsa::{BoxedUint, RsaPublicKey};
+
+use crate::SignError;
+use crate::der;
+use crate::keys::{DigestAlg, PssParams};
+
+/// The encoded message `sig^e mod n` as exactly `n.len()` bytes, or `None` if the signature is
+/// out of range. `n` is the modulus without leading zeros. `notes` gets an entry when the
+/// signature value was not written with exactly the modulus' length (RFC 8017 §8.2.2 wants
+/// that); some signers drop or add leading zero bytes.
+fn encoded_message(n: &[u8], e: &[u8], sig: &[u8], notes: &mut Vec<&'static str>) -> Result<Option<Vec<u8>>, SignError> {
+    let k = n.len();
+    let key = RsaPublicKey::new(BoxedUint::from_be_slice_vartime(n), BoxedUint::from_be_slice_vartime(e))
+        .map_err(|e| SignError::Malformed(format!("RSA key: {e}")))?;
+    if sig.len() != k {
+        notes
+            .push("The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.");
+    }
+    let sig = match sig.iter().position(|b| *b != 0) {
+        Some(i) => sig.get(i..).unwrap_or_default(),
+        None => return Ok(None),
+    };
+    // RFC 8017 §5.2.2: the signature representative must be below the modulus. Otherwise s and
+    // s + n are the same number modulo n and both would verify. Both are big-endian without
+    // leading zeros here, so a longer one is larger and equal lengths compare byte by byte.
+    let modulus = n.get(n.iter().position(|b| *b != 0).unwrap_or(n.len())..).unwrap_or_default();
+    if sig.len() > modulus.len() || (sig.len() == modulus.len() && sig >= modulus) {
+        return Ok(None);
+    }
+    let Ok(em) = rsa::hazmat::rsa_encrypt(&key, &BoxedUint::from_be_slice_vartime(sig)) else { return Ok(None) };
+    let bytes = em.to_be_bytes();
+    let mut out = vec![0u8; k.saturating_sub(bytes.len())];
+    let skip = bytes.len().saturating_sub(k);
+    out.extend_from_slice(bytes.get(skip..).unwrap_or_default());
+    Ok(Some(out))
+}
+
+/// `DigestInfo ::= SEQUENCE { AlgorithmIdentifier, OCTET STRING }`.
+fn digest_info(alg: DigestAlg, digest: &[u8], null_params: bool) -> Vec<u8> {
+    let id = der::algorithm(alg.oid(), null_params.then(der::null).as_deref());
+    der::seq(&[&id, &der::octets(digest)])
+}
+
+/// RSASSA-PKCS1-v1_5 (RFC 8017 §8.2.2): the signature is checked against the one encoding the
+/// message digest should have, built here and compared byte for byte, so there is nothing for a
+/// forger to put in trailing or padding bytes. Two `DigestInfo` encodings are accepted: with the
+/// NULL parameter (the standard one) and without it, which older signers write (RFC 8017 App. B.1
+/// has verifiers accept both); the second is noted in `notes`. A signature over the bare digest,
+/// without any `DigestInfo`, is not accepted: it does not say which hash algorithm it uses.
+pub fn pkcs1_verify(n: &[u8], e: &[u8], alg: DigestAlg, digest: &[u8], sig: &[u8], notes: &mut Vec<&'static str>) -> Result<bool, SignError> {
+    let Some(em) = encoded_message(n, e, sig, notes)? else { return Ok(false) };
+    let k = em.len();
+    let forms = [
+        (digest_info(alg, digest, true), None),
+        (
+            digest_info(alg, digest, false),
+            Some("The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway."),
+        ),
+    ];
+    for (t, note) in forms {
+        let Some(ps) = k.checked_sub(t.len() + 3).filter(|ps| *ps >= 8) else { continue };
+        let mut expected = vec![0x00, 0x01];
+        expected.extend(std::iter::repeat_n(0xFF, ps));
+        expected.push(0x00);
+        expected.extend_from_slice(&t);
+        if expected == em {
+            notes.extend(note);
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+/// MGF1 (RFC 8017 §B.2.1).
+fn mgf1(hash: DigestAlg, seed: &[u8], len: usize) -> Vec<u8> {
+    let mut out = Vec::with_capacity(len + hash.output_len());
+    let mut counter = 0u32;
+    while out.len() < len {
+        out.extend(hash.digest(&[seed, &counter.to_be_bytes()]));
+        counter = counter.wrapping_add(1);
+    }
+    out.truncate(len);
+    out
+}
+
+/// EMSA-PSS-VERIFY (RFC 8017 §9.1.2) with `digest` (of the message, with `alg`) as `mHash`.
+pub fn pss_verify(
+    n: &[u8],
+    e: &[u8],
+    alg: DigestAlg,
+    params: PssParams,
+    digest: &[u8],
+    sig: &[u8],
+    notes: &mut Vec<&'static str>,
+) -> Result<bool, SignError> {
+    let Some(raw) = encoded_message(n, e, sig, notes)? else { return Ok(false) };
+    let mod_bits = n.first().map_or(0, |b| (n.len() * 8) as u32 - b.leading_zeros());
+    let Some(em_bits) = mod_bits.checked_sub(1) else { return Ok(false) };
+    let em_len = em_bits.div_ceil(8) as usize;
+    // emLen is k, or k - 1 when the modulus is 8m+1 bits (then the top byte must be zero).
+    let Some(lead) = raw.len().checked_sub(em_len) else { return Ok(false) };
+    if raw.get(..lead).is_none_or(|l| l.iter().any(|b| *b != 0)) {
+        return Ok(false);
+    }
+    let em = raw.get(lead..).unwrap_or_default();
+    let h_len = alg.output_len();
+    if digest.len() != h_len {
+        return Ok(false);
+    }
+    let Some(db_len) = em_len.checked_sub(h_len + 1).filter(|l| *l >= 1) else { return Ok(false) };
+    if em.last() != Some(&0xBC) {
+        return Ok(false);
+    }
+    let Some((masked_db, rest)) = em.split_at_checked(db_len) else { return Ok(false) };
+    let Some(h) = rest.get(..h_len) else { return Ok(false) };
+    let spare = (8 * em_len as u32).saturating_sub(em_bits);
+    let top_mask = 0xFFu8.checked_shr(spare).unwrap_or(0);
+    if masked_db.first().is_none_or(|b| b & !top_mask != 0) {
+        return Ok(false);
+    }
+    let mut db: Vec<u8> = masked_db.iter().zip(mgf1(params.mgf, h, db_len)).map(|(a, b)| a ^ b).collect();
+    if let Some(b) = db.first_mut() {
+        *b &= top_mask;
+    }
+    let Some(sep) = db.iter().position(|b| *b != 0) else { return Ok(false) };
+    if db.get(sep) != Some(&1) {
+        return Ok(false);
+    }
+    let salt = db.get(sep + 1..).unwrap_or_default();
+    if params.salt_len.is_some_and(|l| l != salt.len()) {
+        return Ok(false);
+    }
+    Ok(alg.digest(&[&[0u8; 8], digest, salt]) == h)
+}
diff --git a/crates/sign/src/timestamp.rs b/crates/sign/src/timestamp.rs
index c634e0bf..58eda4f0 100644
--- a/crates/sign/src/timestamp.rs
+++ b/crates/sign/src/timestamp.rs
@@ -147,7 +147,8 @@ pub fn parse_token(raw: &[u8]) -> Result<TimestampToken, SignError> {
         return Err(bad("token signed message digest does not match TSTInfo"));
     }
     let cert = token.signer_certificate().ok_or_else(|| bad("TSA certificate is missing"))?;
-    if !token.verify_signature(cert, &content_digest) {
+    // An algorithm that can't be checked stays `Unsupported` rather than reading as invalid.
+    if !token.verify_signature(cert, &content_digest)? {
         return Err(bad("TSA signature is invalid"));
     }
     Ok(TimestampToken { raw: raw.to_vec(), digest, imprint, policy, serial, gen_time })
diff --git a/crates/sign/src/x509.rs b/crates/sign/src/x509.rs
index 1b9848a1..24900df4 100644
--- a/crates/sign/src/x509.rs
+++ b/crates/sign/src/x509.rs
@@ -321,8 +321,11 @@ impl Certificate {
     /// Whether `key` verifies this certificate's signature.
     pub fn signed_by(&self, key: &PublicKey) -> bool {
         let Ok(alg) = Tlv::parse_all(&self.sig_alg) else { return false };
-        let Ok((scheme, Some(digest))) = keys::signature_algorithm(&alg) else { return false };
-        key.verify(scheme, digest, &digest.digest(&[&self.tbs]), &self.signature).unwrap_or(false)
+        match keys::signature_algorithm(&alg) {
+            Ok((scheme @ keys::Scheme::Ed25519, _)) => key.verify_message(scheme, &self.tbs, &self.signature).unwrap_or(false),
+            Ok((scheme, Some(digest))) => key.verify(scheme, digest, &digest.digest(&[&self.tbs]), &self.signature).unwrap_or(false),
+            _ => false,
+        }
     }
 
     /// Whether this certificate may issue certificates (RFC 5280 §4.2.1.9, §4.2.1.3): it is a
diff --git a/crates/sign/tests/algorithms.rs b/crates/sign/tests/algorithms.rs
new file mode 100644
index 00000000..06d5696c
--- /dev/null
+++ b/crates/sign/tests/algorithms.rs
@@ -0,0 +1,140 @@
+//! Signatures by OpenSSL 3.6 with the algorithms beyond SHA-2/RSA/NIST-curve ECDSA: SHA-3,
+//! SHA-512/256, RIPEMD-160, RSA-PSS with other MGF1 hashes and salt lengths, Ed25519 and
+//! brainpoolP512r1. Every vector signs the message "hello" with a throw-away key (see
+//! tests/data/README.md for the commands). The CMS files are detached, `openssl cms -sign -binary`.
+
+use pdfcraft_sign::cms::SignedData;
+use pdfcraft_sign::keys::{DigestAlg, PssParams, Scheme};
+
+fn unhex(s: &str) -> Vec<u8> {
+    (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
+}
+
+const C_RSA_SHA3_256: &str = "308205e906092a864886f70d010702a08205da308205d6020101310d300b0609608648016503040208300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182025830820254020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040208a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d010904312204203338be694f50c5f338814986cdf0686453a888b84f424d792af4b9202398f392307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300d06092a864886f70d01010105000482010004884153af307d5b12f87d673598b15b1c722ed15091d97af4d36e40942b009f849b55e4429ee550ad7f001db9a1cb293c2319b253a1d998266897f27c35e9670c87080a71e932beb932d594c4f9735e5dd20d3145db26c4352a1ebea7c7692e3272032e1a1736445eb238b93825315369beed81839f71525848fb8a725b9804cc2ac6c8756754f46fc182df5a1bf0dbc97bcf8a5dbc0d4d9da26f7b68029d1e7fc35893958d6c7084f3199605e103788e2a61cd8a68847588d8607a1a31cb1106753d35109cdd309a098553dfd0f33c2269fd5b396318f35e06c4d67be6a7b05dbacd2c265a3bbfa11c1a4c192052e4130aac97addb703514d43e62dc8b629b";
+const C_RSA_SHA512_256: &str = "308205e906092a864886f70d010702a08205da308205d6020101310d300b0609608648016503040206300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182025830820254020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040206a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d01090431220420e30d87cfa2a75db545eac4d61baf970366a8357c7f72fa95b52d0accb698f13a307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300d06092a864886f70d010101050004820100293b265b6bf4eaa2d3b3777c6116fd922696578bd835f77728809758d7af89aa96afab9da9e320183c63ead9e499508d1f892aea5e1e5b96645b838062f4b14062fa417bdd23257021c05de0e9614ed8141715e9354f21f2ab389194a447c80dda6c87ea80d551abbb0cfc450663359c747cdc41aa296f1a71f4e2b53e97c94d30aa094edbd0fefe53835e550a1a9c55404f8f41d32cc8033df7e0b877008ac6f75f02a6071b02647e5adf756a56f683f452d5f9a180fa62f7c7089019b99037b8e3488798238b85ae5b773b4dfd0d157afe4688209520244bd77a56dd98bda615b2e00312a1a5595c439e84af24749e6d6e44abd7da2794523faba3d0acb737";
+const C_RSA_RIPEMD160: &str = "308205d906092a864886f70d010702a08205ca308205c6020101310b300906052b240302010500300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182024a30820246020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300906052b240302010500a081d8301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302306092a864886f70d01090431160414108f07b8382412612c048d07d13f814118445acd307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300d06092a864886f70d0101010500048201007373c1c0747a77c073a62cf99b97ac43c15677c668ebd6c965296ec1a8c30f33e5b4cb35c652db0c0fe3184259bae01d6f7df64026ee4b58ac5005c46cbf603e45524fba7bb54e81cf0b10a5e7843dcbb8a72d60ffa9a503d0bc5c2306374688b95ff7f4d31366385a69fee1f6c657bd3a82418c56afc53b30446ef0f5776e17769761f1812379c83835f17614f1b2e9adf2ad5cc645cd861cd1e6cf2ebe14a963f208655769e1d6139b4bdeaecc366b0e3924ec46fcfdef05979674fdfb33ada6a0f185abd36c6cd3ff3ba6684b99a72154d933ffc90e8950d72066bf5e3524c09632ebdac06c2944084573c2a6e5344c6a09643f832441a93ef7dc39affd45";
+const C_PSS_SHA256_MGF1SHA1_SALT20: &str = "308205fa06092a864886f70d010702a08205eb308205e7020101310d300b0609608648016503040201300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182026930820265020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040201a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d010904312204202cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128301e06092a864886f70d01010a3011a00f300d0609608648016503040201050004820100159800c2d48396d32cb1e3dddf841f0bad186da462fc45cab82bf6d2d4bb8f82d200560b16f2ecfea672af07af82ae967453193e130071033d47bba03a7d81685b29812293a6d33f4126103ebcd4552ced5c8d13ea6fcac5920b5ab0641b1884919cbed2cb280cdc19569094e0ecf8fdebe0b53a546f46cdb2c3c41b030e520302dae89d9d10206c78ad0fd2ead13dba8b067abf185de957ba4daaa8de7437ca014567d7cfbe8d0f6f9cb8de8dceae5d7292ed731170323e0def553653d4af11239d52eacf1f1a406e6d8c1d7f597af25a2154582d1ad2e9c3b8951ba1350ee3322ef76ac988829de28917c7b153fb493913195250e95185ecac4081e6f18355";
+const C_PSS_SHA384_MGF1SHA256_SALT0: &str = "3082062d06092a864886f70d010702a082061e3082061a020101310d300b0609608648016503040202300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182029c30820298020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040202a081f4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a303f06092a864886f70d0109043132043059e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128304106092a864886f70d01010a3034a00f300d06096086480165030402020500a11c301a06092a864886f70d010108300d06096086480165030402010500a203020100048201003ce51d5b4168c11bb39613de1c2633c8daa86622bdacc1313cf6d597bfb9c15311dbdde51b0f0d3ff67dd922e13e79b84a414c8c9cfffbe35bcf83eefb32b7c5cc371dc56af704cf5b3269dca13c48f27d64a06bc98710f1e3f254b23ba7b41e7ec7027087dea4f4fbb9119d86926220f93d7e8d7be9ad3c5c41e3a4e1d94f09a9f494aac93e13429eec6358d77d83b937686fd41beaeb4d551c3a48ac743ba27592a5435aa8add806200ea3ec61712b8ba4580f2bf80c488b3bc5020c13ecac37a68e3ad3895379a788dbd8a080ed19178dcdaf35d0d8a45d1c7c81e4ddc6916eb74266bba6c3b616b421f78ceeddda3331f3148b6e6145f5b2c4eca9e35b41";
+const C_ED25519: &str = "3082032c06092a864886f70d010702a082031d30820319020101310d300b0609608648016503040203300b06092a864886f70d010701a08201553082015130820103a003020102021447398d434ffa904166d2a7d30fe4df35890dab29300506032b6570301e311c301a06035504030c1354657374205369676e65722045643235353139301e170d3236313030373130303735365a170d3336313030343130303735365a301e311c301a06035504030c1354657374205369676e65722045643235353139302a300506032b657003210007233d4f6ee95134d0232c25b1b5bef159b0c0c32c8911773fa68e99bfee67c2a3533051301d0603551d0e04160414e5fdf0f2f76d4aa4f9cb70dc9c3d6066aa6efb23301f0603551d23041830168014e5fdf0f2f76d4aa4f9cb70dc9c3d6066aa6efb23300f0603551d130101ff040530030101ff300506032b657003410085df55271628b581a5b5c6531253eeca4a3aea556007bfc3cb15132b3ddfc117c5c632a150a025cde2a509346e0497411169812dea45b22257c5d50eaf8c2a0c3182019d308201990201013036301e311c301a06035504030c1354657374205369676e65722045643235353139021447398d434ffa904166d2a7d30fe4df35890dab29300b0609608648016503040203a0820104301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303833395a304f06092a864886f70d010904314204409b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300506032b65700440e3924e19b88b24d8b614a29cee8c3190c9b0a753273705b794bc2e37ca1e5b1d567ea724e5c4a4189ad102ea51d0506e645aed78ed1835e94eb1543cc9a57c06";
+const C_BP512_SHA512: &str = "3082043a06092a864886f70d010702a082042b30820427020101310d300b0609608648016503040203300b06092a864886f70d010701a08202173082021330820176a003020102021417327c0f542434a70893e2caaf25132f86d924a8300a06082a8648ce3d040304301c311a301806035504030c1154657374205369676e6572204250353132301e170d3236313030373130303735365a170d3336313030343130303735365a301c311a301806035504030c1154657374205369676e657220425035313230819b301406072a8648ce3d020106092b240303020801010d03818200042bcc6a56c9e35aff784fb796021f73923d0d8fafe4573df9a3a834f04dabd67fcaaa23c2a20d15a95d42db3ffcb9e9bc5a09cc0d052afdb830e01600782e1c2a307d843f1d804a2083891608b5f05e34273fb00fca1f8a0ef82a821bbac7194ff34c2ab09f6efa4fab871d8150a0fd1625990bd04afcdee025eb585fbb2178c2a3533051301d0603551d0e041604149e51d60b2b4c8459d59e41a99d57a79503b5362d301f0603551d230418301680149e51d60b2b4c8459d59e41a99d57a79503b5362d300f0603551d130101ff040530030101ff300a06082a8648ce3d04030403818a003081860241008126d9a4de09333ad8db822c0718d7a1d1c3a41fdc2f8d5f551109092bd24b8d60c305885a1aa91faf3d82208efa5e92ad0fd16e145dca5da3e8ef026242e1eb0241009b124b54fbc4793a50cc6bd9af3e2d0f459943a71999d9175522ff9668844cce4600ffddbef2a2ca4f49c0c3389d37c6ceed14dea1c3c7320e76ffff327ffd1c318201e9308201e50201013034301c311a301806035504030c1154657374205369676e6572204250353132021417327c0f542434a70893e2caaf25132f86d924a8300b0609608648016503040203a0820104301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a304f06092a864886f70d010904314204409b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300a06082a8648ce3d040304048188308185024066a840051f4caad67c7df0d7db8454f3dbe9184ead3287447c9a5f62eaaaf0cc538979d228b8943d0abd103ac9d5c2ea6aa64384ffe284ce0233dc13b25f6594024100900d2f6251b75aa6224228d076870d014824f79c9670c6d83e8772105c0668c1d96f617c9b09057da442df5aae0dca9dc127cd0ce3de7bfe165270b018143fd6";
+const C_BP512_SHA3_256: &str = "3082041a06092a864886f70d010702a082040b30820407020101310d300b0609608648016503040208300b06092a864886f70d010701a08202173082021330820176a003020102021417327c0f542434a70893e2caaf25132f86d924a8300a06082a8648ce3d040304301c311a301806035504030c1154657374205369676e6572204250353132301e170d3236313030373130303735365a170d3336313030343130303735365a301c311a301806035504030c1154657374205369676e657220425035313230819b301406072a8648ce3d020106092b240303020801010d03818200042bcc6a56c9e35aff784fb796021f73923d0d8fafe4573df9a3a834f04dabd67fcaaa23c2a20d15a95d42db3ffcb9e9bc5a09cc0d052afdb830e01600782e1c2a307d843f1d804a2083891608b5f05e34273fb00fca1f8a0ef82a821bbac7194ff34c2ab09f6efa4fab871d8150a0fd1625990bd04afcdee025eb585fbb2178c2a3533051301d0603551d0e041604149e51d60b2b4c8459d59e41a99d57a79503b5362d301f0603551d230418301680149e51d60b2b4c8459d59e41a99d57a79503b5362d300f0603551d130101ff040530030101ff300a06082a8648ce3d04030403818a003081860241008126d9a4de09333ad8db822c0718d7a1d1c3a41fdc2f8d5f551109092bd24b8d60c305885a1aa91faf3d82208efa5e92ad0fd16e145dca5da3e8ef026242e1eb0241009b124b54fbc4793a50cc6bd9af3e2d0f459943a71999d9175522ff9668844cce4600ffddbef2a2ca4f49c0c3389d37c6ceed14dea1c3c7320e76ffff327ffd1c318201c9308201c50201013034301c311a301806035504030c1154657374205369676e6572204250353132021417327c0f542434a70893e2caaf25132f86d924a8300b0609608648016503040208a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d010904312204203338be694f50c5f338814986cdf0686453a888b84f424d792af4b9202398f392307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300b060960864801650304030a04818830818502410097943cf78c3e6440f03e00d7ca3a96d986190e7cc56db1b1d3dd806810c9d731d5ab576df900173082372fd1beeb206da3bf1958c11c375f5a38aa2766f083a402402c495a25cc16836322d724606b34912ed08904c97e2c1557ca13796ce02ad37d4a2bd8ce0001f020fb131c3c4e7602c8346e30b0a23a5f030d6885aa07a90c40";
+const PSS_SHA3_256: &str = "be8d2369801beaea9c45935787bd005a6d6085003cb235c5bf8c867cafd8edf9ed288aa3a16b019d64b0668be302a5ca6fa0388774a85471804154f9411fd0abd6738b6fb5a7acf38b60fe70d65e1f93447f57e34fdb502c741001c184113117cd3b7daec1614ebdd152f071117bb1012587f93df00321cc22d1ac53788e1c9906c2c5a31f9364220c1b1e913b2ac3409aca39296a51b4fbc192a87d671dc83726831fa2e59ce1783c09fee8c95d53d8caf50da32d896839a03ab4ff4a390a6dee006dfa686c60368bfc2d64e5d974acb3c022edb1a9fd57a167ce03a31de8eef3a9a7d9460013d636dab53b00ed6e24bf736cdfd56c2be7e8b8aeaeabf74842";
+const PSS_SHA512_256: &str = "4aeff996324c1aae8216497d7be896d949361f80ae5cfeee82a959f9a8ff7c8d2e0ec783b435f1952dc768ea97a949acca1783210e8754a71c9c2255689d370a349dfb9845e69595d3386ee88aafd2369ecdbba53de692eacc68fd5f0e3e2451f6fe000d680d860d235958f666eddfb4dba69ed730b6f9f82889617e744c0ec4fda72fb9e8f32190913dc77bb281713c5f45a7bd9c346645b401fb4a58348d4eb86511bcdeeca113cb9a9c8c4b587da763ce16b104580dee0ccbbac4a3e969ea53835a8067bdd9b1f8109940fb61abb8b03381b5272c2bbc381a50961130fb3a7c4fe02689111ac76f3a4c1f4439d25326aeec75afc3839478b3289a2ff2482d";
+
+/// A CMS signature must verify, name the digest it should, and fail if the signature is damaged.
+fn check_cms(name: &str, hex: &str, digest: DigestAlg, scheme: impl Fn(Scheme) -> bool) {
+    let sd = SignedData::parse(&unhex(hex)).unwrap_or_else(|e| panic!("{name}: {e}"));
+    let s = &sd.signer;
+    assert_eq!(s.digest, digest, "{name}");
+    assert!(scheme(s.scheme), "{name}: {:?}", s.scheme);
+    let content = digest.digest(&[b"hello"]);
+    assert_eq!(s.message_digest.as_deref(), Some(&content[..]), "{name}: the message digest attribute is our digest of the content");
+    let cert = sd.signer_certificate().unwrap_or_else(|| panic!("{name}: signer certificate"));
+    assert!(sd.verify_signature(cert, &content).unwrap_or_else(|e| panic!("{name}: {e}")), "{name}");
+    let mut bad = sd.clone();
+    let mid = bad.signer.signature.len() / 2;
+    bad.signer.signature[mid] ^= 0x10;
+    assert!(!bad.verify_signature(cert, &content).unwrap_or(false), "{name}: damaged signature");
+}
+
+#[test]
+fn rsa_with_sha3_sha512_256_and_ripemd160() {
+    check_cms("sha3-256", C_RSA_SHA3_256, DigestAlg::Sha3_256, |s| s == Scheme::RsaPkcs1);
+    check_cms("sha512/256", C_RSA_SHA512_256, DigestAlg::Sha512_256, |s| s == Scheme::RsaPkcs1);
+    check_cms("ripemd160", C_RSA_RIPEMD160, DigestAlg::Ripemd160, |s| s == Scheme::RsaPkcs1);
+}
+
+#[test]
+fn only_weak_digests_leave_a_note_when_a_signature_validates() {
+    let notes_of = |hex: &str| {
+        let sd = SignedData::parse(&unhex(hex)).unwrap();
+        let cert = sd.signer_certificate().unwrap();
+        let mut notes = Vec::new();
+        assert!(sd.verify_signature_noting(cert, &sd.signer.digest.digest(&[b"hello"]), &mut notes).unwrap());
+        notes
+    };
+    // RIPEMD-160 is named; SHA3-256 and SHA-512/256 are not.
+    let weak = notes_of(C_RSA_RIPEMD160);
+    assert_eq!(weak, [DigestAlg::Ripemd160.weakness().unwrap()], "{weak:?}");
+    assert!(notes_of(C_RSA_SHA3_256).is_empty());
+    assert!(notes_of(C_RSA_SHA512_256).is_empty());
+}
+
+#[test]
+fn rsa_pss_with_its_declared_parameters() {
+    check_cms("pss sha256 mgf1-sha1 salt 20", C_PSS_SHA256_MGF1SHA1_SALT20, DigestAlg::Sha256, |s| {
+        s == Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha1, salt_len: Some(20) })
+    });
+    check_cms("pss sha384 mgf1-sha256 salt 0", C_PSS_SHA384_MGF1SHA256_SALT0, DigestAlg::Sha384, |s| {
+        s == Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len: Some(0) })
+    });
+    // PSS over SHA-3 and SHA-512/256 digests, MGF1 with the same hash.
+    let id = pdfcraft_sign::pkcs12::open(&std::fs::read(format!("{}/tests/data/rsa-aes.p12", env!("CARGO_MANIFEST_DIR"))).unwrap(), "test").unwrap();
+    let key = &id.certificate.public_key;
+    for (name, alg, salt, sig) in [("sha3-256", DigestAlg::Sha3_256, 32, PSS_SHA3_256), ("sha512/256", DigestAlg::Sha512_256, 0, PSS_SHA512_256)] {
+        let digest = alg.digest(&[b"hello"]);
+        let pss = Scheme::RsaPss(PssParams { mgf: alg, salt_len: Some(salt) });
+        assert!(key.verify(pss, alg, &digest, &unhex(sig)).unwrap(), "{name}");
+        assert!(!key.verify(pss, alg, &alg.digest(&[b"hellp"]), &unhex(sig)).unwrap(), "{name}: other message");
+        let wrong_mgf = Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha1, salt_len: Some(salt) });
+        assert!(!key.verify(wrong_mgf, alg, &digest, &unhex(sig)).unwrap(), "{name}: the MGF1 hash matters");
+    }
+}
+
+#[test]
+fn ed25519_signs_the_signed_attributes_themselves() {
+    check_cms("ed25519", C_ED25519, DigestAlg::Sha512, |s| s == Scheme::Ed25519);
+    let sd = SignedData::parse(&unhex(C_ED25519)).unwrap();
+    let cert = sd.signer_certificate().unwrap();
+    assert_eq!(cert.public_key.describe(), "Ed25519");
+    assert!(cert.is_self_signed(), "the certificate's own Ed25519 signature checks");
+    // A digest can't be verified with Ed25519: it signs the message.
+    let r = cert.public_key.verify(Scheme::Ed25519, DigestAlg::Sha512, &[0; 64], &sd.signer.signature);
+    assert!(matches!(r, Err(pdfcraft_sign::SignError::Unsupported(_))));
+}
+
+#[test]
+fn ecdsa_on_brainpool_p512r1() {
+    check_cms("bp512 sha512", C_BP512_SHA512, DigestAlg::Sha512, |s| s == Scheme::Ecdsa);
+    check_cms("bp512 sha3-256", C_BP512_SHA3_256, DigestAlg::Sha3_256, |s| s == Scheme::Ecdsa);
+    let sd = SignedData::parse(&unhex(C_BP512_SHA512)).unwrap();
+    let cert = sd.signer_certificate().unwrap();
+    assert_eq!(cert.public_key.describe(), "ECDSA brainpoolP512r1");
+    assert!(cert.is_self_signed(), "certificate signed with ecdsa-with-SHA512 on brainpoolP512r1");
+    let spki = cert.public_key.spki();
+    let back = pdfcraft_sign::PublicKey::from_spki(&pdfcraft_sign::der::Tlv::parse_all(&spki).unwrap()).unwrap();
+    assert_eq!(back, cert.public_key, "re-encodes the SubjectPublicKeyInfo");
+}
+
+/// `a + b` for big-endian numbers of equal width, or `None` if it does not fit.
+fn add_be(a: &[u8], b: &[u8]) -> Option<Vec<u8>> {
+    let mut out = vec![0u8; a.len()];
+    let mut carry = 0u16;
+    for i in (0..a.len()).rev() {
+        let sum = u16::from(a[i]) + u16::from(b[i]) + carry;
+        out[i] = sum as u8;
+        carry = sum >> 8;
+    }
+    (carry == 0).then_some(out)
+}
+
+#[test]
+fn brainpool_p512r1_keys_must_have_coordinates_reduced_modulo_p() {
+    use pdfcraft_sign::PublicKey;
+    const P: &str =
+        "aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3";
+    let sd = SignedData::parse(&unhex(C_BP512_SHA512)).unwrap();
+    let cert = sd.signer_certificate().unwrap();
+    let content = DigestAlg::Sha512.digest(&[b"hello"]);
+    assert!(sd.verify_signature(cert, &content).unwrap(), "the key as written verifies");
+    let PublicKey::BrainpoolP512(point) = &cert.public_key else { panic!("a brainpoolP512r1 key") };
+    let (x, y) = (&point[1..65], &point[65..]);
+    let p = unhex(P);
+    // The same point written with x + p (or y + p): congruent, but not the canonical encoding.
+    for (what, x, y) in [("x + p", add_be(x, &p).unwrap(), y.to_vec()), ("y + p", x.to_vec(), add_be(y, &p).unwrap())] {
+        let mut forged = cert.clone();
+        forged.public_key = PublicKey::BrainpoolP512([&[4u8][..], &x, &y].concat());
+        let r = sd.verify_signature(&forged, &content);
+        assert!(matches!(r, Err(pdfcraft_sign::SignError::Malformed(_))), "{what}: {r:?}");
+    }
+}
diff --git a/crates/sign/tests/crypto.rs b/crates/sign/tests/crypto.rs
index ef9c570a..a7e6931c 100644
--- a/crates/sign/tests/crypto.rs
+++ b/crates/sign/tests/crypto.rs
@@ -153,12 +153,12 @@ fn signatures_round_trip_for_every_key_type() {
         assert_eq!(signer, &id.certificate);
         assert_eq!(sd.signer.message_digest.as_deref(), Some(&digest[..]));
         assert!(sd.signer.signing_certificate, "CAdES signing-certificate-v2");
-        assert!(sd.verify_signature(signer, &digest), "{file}");
+        assert!(sd.verify_signature(signer, &digest).unwrap(), "{file}");
         assert_eq!(sd.certificates.len(), 1 + id.chain.len());
         // Tampering with the signature breaks it.
         let mut bad = sd.clone();
         bad.signer.signature[5] ^= 1;
-        assert!(!bad.verify_signature(signer, &digest), "{file}");
+        assert!(!bad.verify_signature(signer, &digest).unwrap(), "{file}");
     }
 }
 
@@ -181,7 +181,7 @@ fn new_digital_ids_are_self_signed_and_survive_a_p12_round_trip() {
         let d = DigestAlg::Sha256.digest(&[b"x"]);
         let sig = cms::sign_detached(&back.key, &back.certificate, &[], DigestAlg::Sha256, &d).unwrap();
         let sd = cms::SignedData::parse(&sig).unwrap();
-        assert!(sd.verify_signature(&back.certificate, &d));
+        assert!(sd.verify_signature(&back.certificate, &d).unwrap());
     }
 }
 
@@ -341,3 +341,259 @@ fn ocsp_responses_verify_and_match_the_certificate() {
     let error = der::seq(&[&der::int(6)]);
     assert!(OcspResponse::parse(&error).is_err());
 }
+
+// ── tolerance for the encodings found in old and unusual signers ───────────────────────────────
+// RSA signatures over SHA-256("hello") by the key in rsa-aes.p12, made with OpenSSL 3 (see
+// tests/data/README.md): the standard DigestInfo, DigestInfo without the NULL parameter, the bare
+// digest (which is refused: it does not say which hash algorithm it uses), and RSASSA-PSS with a
+// zero-length salt.
+const RSA_STD: &str = "40896f76bc460e4ae9dc523dfe136159c7ccc20eff09bfeeafd570fd41a6c016d6b2a1d771ba81642dd5bf94d2bb9c4aeead237ce0e1662678efd5ff7b8590bf7d5042f6541b001a9f7d688e60a9fde5c9b3f295bd5373aea1059b53f1341f30a4db68302161e95c6a62847205782edcd1fa99b6720eaa60b59d3f54d4ec7be396c8f1146fe35f198bd12dca608b8080a446f89ba300fd74f8df4e7f177c59dc48cf878451423dd9674df768a12f85a1b5e81a5b8df43ac0fb03c4393cfed7dceeeddf1c8aef9a37e738ff4169a6881e783c2f841fb974eb0e6ecedf649bf64fbc51920b7824d86b26527acaec5d0ebb44454606441fea2b7d7b7a6014ab9d64";
+const RSA_NO_NULL: &str = "a6589a056b04903cd77d5dae3b52f8c9905403ee2cef2e7343cfdd07746cbf1034c8c510a6f7258face9cfbcacb990e30f185dd091310d88efc3457e0fd34245d525e2cb5ceaab029e7b7fd25a581379c92e6abf90a36388cfc6afba0be47c99abc8b32e82a2c750ffe7c6d04de886cbfe63685cfc0f0204f641103e3c752496a0ae341fb503c4c2389824f7f20d07a03f0e3a95d5084fc1fb1b94c6bc607a14623b1bf7180b3d7d4592e217ba08698becb1994a6ef72ccab6e239418f11c57f184f59b0d1c7407216856cd4585da6a07354191ae85f8be02e670a10017f115ccb55d96f2ea2c1f095bbcf6b50ed8763945b78054989b016119c5371d918d682";
+const RSA_BARE: &str = "a5812c29d3edf0b567636aaa501a960b977e774a0ea941e41401611d8b63464e99e2e908d8d8452b97112597f06f2adee029109bf6e421eb57add689b518532232199151ed822d1766013ea44ae5cb468b4a2288cf866f8c5954b729bfd34a8ca82d73bb397a75eb76687f7d9e506dab32e2da6231ece307fe8eb929c7648f73de6dd81c38aecb78a0e7ef0e11654fbadef88c7b206079afee70db8054ada079c6456826383dfd2504f05033b58cf1610a180953e501e137b47de5a77914cfaa33b8c588f24dcdb5789e7d1288ff009918f6c2808bfa1c57398d2e007a5e6d3004a3ca568a4ae2eb5cfa14083099e81cfcb53ead9ec6650a7c58e441d117d439";
+const RSA_PSS_SALT0: &str = "2cdbb02d75a80df07dcca229363644caa4391cca30a3bc1281a3f4512dbe609727767c42e62cdad7d6bd38088b2c0b5dcb439fd2c337c31b47bbc39bda0e5c1486a773cde163fa2cad8047c06217541c993b21413e5cd341a4f66d2fb6e4755b52d25935dd90af667ce3d3e1825c8e6e40274dca7cf469ae17cbc3c1c1560d87a877a46353245128120beb1108cd0cafddae5b4ef9005601cc05f114da9de4cdaee08020d5b9be27e7b48f961e40664ef592990580bc1e1f2a8107c3d71d323df120720be6e862191a0aaa3b394b96efd2f45afa5f8211e2082865b8d3e3c28f99054976162ae8f42a903bfb82c17700db93fef603c4cd85c70a0be68fda9af8";
+
+fn unhex(s: &str) -> Vec<u8> {
+    (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
+}
+
+#[test]
+fn rsa_signatures_are_read_with_every_digestinfo_variant() {
+    use pdfcraft_sign::keys::{DigestAlg, PssParams, Scheme};
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    for (name, sig) in [("standard", RSA_STD), ("no NULL", RSA_NO_NULL)] {
+        assert!(key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &unhex(sig)).unwrap(), "{name}");
+    }
+    // The bare digest, with no DigestInfo, binds no hash algorithm: not a signature we accept.
+    assert!(!key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &unhex(RSA_BARE)).unwrap(), "bare digest");
+    // PSS with the salt length it declares, or any when none is declared.
+    let pss = |salt_len| Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len });
+    assert!(key.verify(pss(Some(0)), DigestAlg::Sha256, &digest, &unhex(RSA_PSS_SALT0)).unwrap());
+    assert!(key.verify(pss(None), DigestAlg::Sha256, &digest, &unhex(RSA_PSS_SALT0)).unwrap(), "salt length recovered");
+    assert!(!key.verify(pss(Some(32)), DigestAlg::Sha256, &digest, &unhex(RSA_PSS_SALT0)).unwrap(), "declared salt length is enforced");
+    // The check itself is not relaxed: another digest, a flipped bit, or the wrong scheme fail.
+    let other = DigestAlg::Sha256.digest(&[b"hellp"]);
+    let mut flipped = unhex(RSA_STD);
+    flipped[7] ^= 1;
+    for sig in [RSA_STD, RSA_NO_NULL, RSA_BARE] {
+        assert!(!key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &other, &unhex(sig)).unwrap());
+    }
+    assert!(!key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &flipped).unwrap());
+    assert!(!key.verify(pss(None), DigestAlg::Sha256, &digest, &unhex(RSA_STD)).unwrap());
+}
+
+#[test]
+fn ecdsa_signatures_are_read_as_der_non_minimal_der_or_raw() {
+    use pdfcraft_sign::der::{self, Tlv};
+    use pdfcraft_sign::keys::{DigestAlg, Scheme};
+    for (file, field) in [("ec-p256.p12", 32usize), ("ec-p384.p12", 48)] {
+        let id = pkcs12::open(&data(file), "test").unwrap();
+        let alg = id.key.preferred_digest();
+        let msg = b"signed content";
+        let digest = alg.digest(&[msg]);
+        let sig = id.key.sign(alg, msg).unwrap();
+        let pk = id.key.public_key();
+        assert!(pk.verify(Scheme::Ecdsa, alg, &digest, &sig).unwrap(), "{file}: DER");
+        let ints = Tlv::parse_all(&sig).unwrap().children().unwrap();
+        let fixed = |i: &Tlv<'_>| {
+            let m = i.uint_bytes();
+            let mut v = vec![0u8; field - m.len()];
+            v.extend_from_slice(m);
+            v
+        };
+        let (r, s) = (fixed(&ints[0]), fixed(&ints[1]));
+        // Raw r ‖ s (PKCS #11 tokens).
+        let raw = [r.clone(), s.clone()].concat();
+        assert!(pk.verify(Scheme::Ecdsa, alg, &digest, &raw).unwrap(), "{file}: raw");
+        // Integers padded with redundant leading zeros.
+        let padded = |v: &[u8]| der::tlv(0x02, &[&[0u8, 0][..], v].concat());
+        let loose = der::seq(&[&padded(&r), &padded(&s)]);
+        assert!(pk.verify(Scheme::Ecdsa, alg, &digest, &loose).unwrap(), "{file}: non-minimal DER");
+        // Still a real check.
+        let mut bad = raw.clone();
+        bad[3] ^= 0x40;
+        assert!(!pk.verify(Scheme::Ecdsa, alg, &digest, &bad).unwrap());
+        assert!(!pk.verify(Scheme::Ecdsa, alg, &DigestAlg::Sha256.digest(&[b"other"]), &raw).unwrap());
+        assert!(!pk.verify(Scheme::Ecdsa, alg, &digest, &[1, 2, 3]).unwrap());
+    }
+}
+
+#[test]
+fn tolerated_encodings_are_noted_and_standard_ones_are_not() {
+    use pdfcraft_sign::der::{self, Tlv};
+    use pdfcraft_sign::keys::{DigestAlg, Scheme};
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    let rsa_notes = |sig: &[u8]| {
+        let mut notes = Vec::new();
+        assert!(key.verify_noting(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, sig, &mut notes).unwrap());
+        notes
+    };
+    assert!(rsa_notes(&unhex(RSA_STD)).is_empty(), "a standard signature needs no excuse");
+    let no_null = rsa_notes(&unhex(RSA_NO_NULL));
+    assert!(matches!(no_null.as_slice(), [n] if n.contains("no NULL")), "{no_null:?}");
+    // A zero byte in front of the signature value: still the same signature, but not modulus-length.
+    let padded: Vec<u8> = std::iter::once(0).chain(unhex(RSA_STD)).collect();
+    let long = rsa_notes(&padded);
+    assert!(matches!(long.as_slice(), [n] if n.contains("modulus")), "{long:?}");
+
+    for (file, field) in [("ec-p256.p12", 32usize), ("ec-p384.p12", 48)] {
+        let id = pkcs12::open(&data(file), "test").unwrap();
+        let alg = id.key.preferred_digest();
+        let digest = alg.digest(&[b"signed content"]);
+        let sig = id.key.sign(alg, b"signed content").unwrap();
+        let pk = id.key.public_key();
+        let ec_notes = |sig: &[u8]| {
+            let mut notes = Vec::new();
+            assert!(pk.verify_noting(Scheme::Ecdsa, alg, &digest, sig, &mut notes).unwrap(), "{file}");
+            notes
+        };
+        assert!(ec_notes(&sig).is_empty(), "{file}: DER as made");
+        let ints = Tlv::parse_all(&sig).unwrap().children().unwrap();
+        let fixed = |i: &Tlv<'_>| {
+            let m = i.uint_bytes();
+            let mut v = vec![0u8; field - m.len()];
+            v.extend_from_slice(m);
+            v
+        };
+        let (r, s) = (fixed(&ints[0]), fixed(&ints[1]));
+        let raw = ec_notes(&[r.clone(), s.clone()].concat());
+        assert!(matches!(raw.as_slice(), [n] if n.contains("raw")), "{file}: {raw:?}");
+        let padded = |v: &[u8]| der::tlv(0x02, &[&[0u8, 0][..], v].concat());
+        let loose = ec_notes(&der::seq(&[&padded(&r), &padded(&s)]));
+        assert!(matches!(loose.as_slice(), [n] if n.contains("canonical DER")), "{file}: {loose:?}");
+    }
+}
+
+/// `a + b` for big-endian numbers of equal width, or `None` if the sum does not fit.
+fn add_be(a: &[u8], b: &[u8]) -> Option<Vec<u8>> {
+    let mut out = vec![0u8; a.len()];
+    let mut carry = 0u16;
+    for i in (0..a.len()).rev() {
+        let sum = u16::from(a[i]) + u16::from(b[i]) + carry;
+        out[i] = sum as u8;
+        carry = sum >> 8;
+    }
+    (carry == 0).then_some(out)
+}
+
+#[test]
+fn weak_digests_say_so_in_words_that_are_pinned() {
+    use pdfcraft_sign::keys::DigestAlg;
+    // What the signature panel shows for a signature that still validates but should not be
+    // relied on. Strong digests get no note at all.
+    for alg in DigestAlg::ALL {
+        let note = alg.weakness();
+        match alg {
+            DigestAlg::Sha1 => assert_eq!(
+                note,
+                Some(
+                    "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on."
+                )
+            ),
+            DigestAlg::Ripemd160 => assert_eq!(
+                note,
+                Some(
+                    "This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on."
+                )
+            ),
+            _ => assert_eq!(note, None, "{}", alg.name()),
+        }
+    }
+}
+
+#[test]
+fn an_rsa_signature_value_not_below_the_modulus_is_refused() {
+    use pdfcraft_sign::keys::{DigestAlg, PssParams, Scheme};
+    // RFC 8017 §5.2.2 (RSAVP1): a signature representative s must be below n. Otherwise s and
+    // s + n are the same number modulo n and both would verify (malleability, not forgery).
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let PublicKey::Rsa { n, .. } = key else { panic!("an RSA key") };
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    let pss = Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len: Some(0) });
+    let sig = unhex(RSA_PSS_SALT0);
+    assert!(key.verify(pss, DigestAlg::Sha256, &digest, &sig).unwrap(), "the signature as made");
+    let alias = add_be(&sig, n).expect("this signature plus the modulus still has the modulus' length");
+    assert_eq!(alias.len(), n.len());
+    assert!(!key.verify(pss, DigestAlg::Sha256, &digest, &alias).unwrap(), "s + n is not the signature");
+}
+
+#[test]
+fn hostile_rsa_signature_values_are_wrong_not_crashes() {
+    use pdfcraft_sign::keys::{DigestAlg, PssParams, Scheme};
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let PublicKey::Rsa { n, .. } = key else { panic!("an RSA key") };
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    let pss = Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len: Some(32) });
+    let mut one_more = vec![1u8];
+    one_more.extend(vec![0u8; n.len()]);
+    for sig in [vec![], vec![0], vec![0; n.len()], vec![0xFF; n.len()], vec![0xFF; n.len() + 40], n.clone(), one_more] {
+        for scheme in [Scheme::RsaPkcs1, pss] {
+            assert!(!key.verify(scheme, DigestAlg::Sha256, &digest, &sig).unwrap(), "{} bytes", sig.len());
+        }
+    }
+    // A digest of the wrong length for PSS is a mismatch, not a crash either.
+    assert!(!key.verify(pss, DigestAlg::Sha256, &[1, 2, 3], &unhex(RSA_STD)).unwrap());
+}
+
+#[test]
+fn keys_of_unknown_algorithms_are_unsupported_not_wrong() {
+    use pdfcraft_sign::der::{self, Tlv};
+    use pdfcraft_sign::keys::{DigestAlg, Scheme};
+    // An Ed448 key (1.3.101.113), which isn't supported: the key parses, checking says "can't".
+    let spki = der::seq(&[&der::seq(&[&der::oid("1.3.101.113")]), &der::bit_string(&[7u8; 57])]);
+    let key = PublicKey::from_spki(&Tlv::parse_all(&spki).unwrap()).unwrap();
+    assert_eq!(key.spki(), spki);
+    assert!(key.describe().contains("unsupported"));
+    let r = key.verify(Scheme::Ecdsa, DigestAlg::Sha256, &[0; 32], &[0; 64]);
+    assert!(matches!(r, Err(SignError::Unsupported(_))), "{r:?}");
+    // An unknown curve likewise.
+    let spki = der::seq(&[&der::seq(&[&der::oid("1.2.840.10045.2.1"), &der::oid("1.3.132.0.10")]), &der::bit_string(&[4u8; 65])]);
+    let key = PublicKey::from_spki(&Tlv::parse_all(&spki).unwrap()).unwrap();
+    assert!(matches!(key.verify(Scheme::Ecdsa, DigestAlg::Sha256, &[0; 32], &[0; 64]), Err(SignError::Unsupported(_))));
+}
+
+// ECDSA signatures by OpenSSL 3 over a digest of "hello": (SubjectPublicKeyInfo, digest, DER signature).
+const P521: (&str, &str, &str) = (
+    "30819b301006072a8648ce3d020106052b8104002303818600040079586325f44d28973f270dcb9595a6309b93c3898eedb901b08873694c690265e61c1cbf5b1a339cacdcfe3ece7e00744bf6ed158d663209c8acf378ddda2e824100b1386a84a2efa8d4f78b6cf7018e58fac5bb9a57f33b3ef584649ba57910a163ba026245ad9e1b93597b5db1f05431267b3953c205312d0c8bf0d910eef237f438",
+    "9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043",
+    "30818802420156bae253f050fc9202661280cbb8b1eedb8d4767aee63afdd130d376f50a18097902d0c6bd17eb8e4b4383f355751f3578e06850d5f3dfd8a86f3085e7100535b4024201f92f6f722290652195edf7b3168a91425a4e8a70386e06af6bceafd8a5f26dc19e5c13e7566e789d9459433e911e439819fdc350ea8ab1df6421257eaa55e23cf8",
+);
+const BP256: (&str, &str, &str) = (
+    "305a301406072a8648ce3d020106092b2403030208010107034200049ba05e64295ad9b86295d9cfa717a2549474e83abb2825be32a0fae5297b07344f9e9018cf394001f98d634680b1e20be49f6118c726fdad4b11ccae99b95358",
+    "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
+    "304402203815740bcccfdec285f1e168f28b4529bb39eba2683085260653c7a53dd2e69e022048ba910ce1f9141d8213fa1804a3d548271e0b9c307f6b26c80951be7e7a59a2",
+);
+const BP384: (&str, &str, &str) = (
+    "307a301406072a8648ce3d020106092b240303020801010b03620004874bc125ea23dd5553b1e5440c5cb064032f9a6cbdea271745232ade525b082951d0b251a45b2af74d3325dbe7872f9635b6223c6b2cd4d7f24a50fd9058f946a154919adb24e268975df951e561884b14f899bc87af0820c50f3b706b7acb4c",
+    "59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f",
+    "30640230284776ae1458b137bfe0f1628193983ae8bd5d58d84957fb215da42c5ba0e48400aaba4960b6e0a23aa8d7c20084cbba02301000b700ae6d946ad032f7a08e64c565bb6227e722edd2813dcbc5dfa79d099cf93ea8d48b4293869942a4f68671a915",
+);
+
+#[test]
+fn verifies_ecdsa_on_p521_and_the_brainpool_curves() {
+    use pdfcraft_sign::der::Tlv;
+    use pdfcraft_sign::keys::{DigestAlg, Scheme};
+    for (name, (spki, digest, sig), alg, describe) in [
+        ("P-521", P521, DigestAlg::Sha512, "ECDSA P-521"),
+        ("brainpoolP256r1", BP256, DigestAlg::Sha256, "ECDSA brainpoolP256r1"),
+        ("brainpoolP384r1", BP384, DigestAlg::Sha384, "ECDSA brainpoolP384r1"),
+    ] {
+        let spki = unhex(spki);
+        let key = PublicKey::from_spki(&Tlv::parse_all(&spki).unwrap()).unwrap();
+        assert_eq!(key.describe(), describe);
+        assert_eq!(key.spki(), spki, "{name}: re-encodes");
+        let (digest, sig) = (unhex(digest), unhex(sig));
+        assert!(key.verify(Scheme::Ecdsa, alg, &digest, &sig).unwrap(), "{name}");
+        let mut bad = digest.clone();
+        bad[0] ^= 1;
+        assert!(!key.verify(Scheme::Ecdsa, alg, &bad, &sig).unwrap(), "{name}: other digest");
+        // The digest named by the algorithm identifier may be shorter than the curve (SHA-256 on
+        // P-521 etc.): that is a different digest, so it must not verify this signature.
+        assert!(!key.verify(Scheme::Ecdsa, alg, &digest[..digest.len() / 2], &sig).unwrap(), "{name}: short digest");
+    }
+}
diff --git a/crates/sign/tests/data/README.md b/crates/sign/tests/data/README.md
index 4b9c98d0..b33f327e 100644
--- a/crates/sign/tests/data/README.md
+++ b/crates/sign/tests/data/README.md
@@ -35,3 +35,38 @@ openssl pkcs12 -export -inkey leaf.key -in leaf.crt -certfile ca.crt -out chain.
 `openssl cms -sign -binary -md sha256 -outform DER -signer rsa.crt -inkey rsa.key` over its
 byte ranges (`adbe.pkcs7.detached`, with OpenSSL's signing-time attribute). It checks the
 validator against a signature PdfCraft did not make; poppler's `pdfsig` reports it valid.
+
+### `x509-rsa-sha1.pdf`
+
+A synthetic one-page PDF signed the legacy way (`/SubFilter /adbe.x509.rsa_sha1`, `/Cert` = `rsa.crt.pem`,
+`/Contents` = a DER OCTET STRING with the PKCS #1 signature of the SHA-1 digest of the byte ranges), with
+the key of `rsa-aes.p12`. Built by writing the objects with a fixed-width `/ByteRange` and zero-filled
+`/Contents`, patching the byte range, then `openssl dgst -sha1 -sign rsa.key` over the two ranges.
+
+### RSA signature variants (hex constants in `tests/crypto.rs`)
+
+Over SHA-256("hello") with the key of `rsa-aes.p12`:
+`openssl dgst -sha256 -sign rsa.key` (standard DigestInfo); `openssl pkeyutl -sign -pkeyopt rsa_padding_mode:pkcs1`
+over a hand-built DigestInfo without the NULL parameter, and over the bare digest;
+`openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:0 -sign rsa.key`.
+
+### Other algorithms (hex constants in `tests/algorithms.rs`)
+
+All sign the message `hello` with throw-away keys, OpenSSL 3.6. RSA ones use the key of `rsa-aes.p12`.
+
+```sh
+cms() { openssl cms -sign -binary -in msg -outform DER "$@"; }
+cms -md sha3-256   -signer rsa.crt -inkey rsa.key -out c_rsa_sha3_256.der
+cms -md sha512-256 -signer rsa.crt -inkey rsa.key -out c_rsa_sha512_256.der
+cms -provider legacy -provider default -md ripemd160 -signer rsa.crt -inkey rsa.key -out c_rsa_ripemd160.der
+cms -md sha256 -signer rsa.crt -inkey rsa.key -keyopt rsa_padding_mode:pss -keyopt rsa_mgf1_md:sha1 -keyopt rsa_pss_saltlen:20 -out c_pss_sha256_mgf1sha1_salt20.der
+cms -md sha384 -signer rsa.crt -inkey rsa.key -keyopt rsa_padding_mode:pss -keyopt rsa_mgf1_md:sha256 -keyopt rsa_pss_saltlen:0 -out c_pss_sha384_mgf1sha256_salt0.der
+openssl req -x509 -newkey ed25519 -nodes -keyout ed.key -out ed.crt -subj "/CN=Test Signer Ed25519"
+cms -md sha512 -signer ed.crt -inkey ed.key -out c_ed25519.der
+openssl ecparam -name brainpoolP512r1 -genkey -noout -out bp512.key
+openssl req -x509 -new -key bp512.key -sha512 -out bp512.crt -subj "/CN=Test Signer BP512"
+cms -md sha512   -signer bp512.crt -inkey bp512.key -out c_bp512_sha512.der
+cms -md sha3-256 -signer bp512.crt -inkey bp512.key -out c_bp512_sha3_256.der
+openssl dgst -sha3-256   -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 -sign rsa.key -out pss_sha3_256.sig msg
+openssl dgst -sha512-256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:0  -sign rsa.key -out pss_sha512_256.sig msg
+```
diff --git a/crates/sign/tests/data/x509-rsa-sha1.pdf b/crates/sign/tests/data/x509-rsa-sha1.pdf
new file mode 100644
index 00000000..f610648c
--- /dev/null
+++ b/crates/sign/tests/data/x509-rsa-sha1.pdf
@@ -0,0 +1,29 @@
+%PDF-1.7
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /SigFlags 3 >> >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [4 0 R] >>
+endobj
+4 0 obj
+<< /Type /Annot /Subtype /Widget /FT /Sig /T (Legacy) /Rect [0 0 0 0] /P 3 0 R /F 132 /V 5 0 R >>
+endobj
+5 0 obj
+<< /Type /Sig /Filter /Adobe.PPKLite /SubFilter /adbe.x509.rsa_sha1 /ByteRange [0 0000002212 0000003414 0000000218] /Cert <308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe4242> /Contents <04820100960d572d3b941e684ec8bcfe65cd26fc7feed8f01256e1334477c218de9d7cf534edb60e66aa8a2d8569f6c5ddd84e1ab92df5080b74aa6679fa65228f268e8d8004a44aa674a086820882f382124a57d51cad65bc2c1a5f7d2655c2013c7f1a210aac4960961dd11c30aa14ee52c665bc5ea1a8d19e898c305f10c6bd1a5bc53b77f628a01bcbaa94783f3927eb5fc4a2aa0d5c57c1ec4de6fa0d0a511d3d50360cf3553fcd7f25f0131e556bf4a035be248459788f044b8f9825c9c1195ee1eb42d4b7ee9e973a917bfa2e7f105818f8587712a9c2eafc4aad6f54237ee6ed1dc758e215a158758c3cb77178cd848d2dca3705708bbe6a824a268177a8178f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000> /M (D:20261002120000Z) >>
+endobj
+xref
+0 6
+0000000000 65535 f 
+0000000009 00000 n 
+0000000102 00000 n 
+0000000159 00000 n 
+0000000246 00000 n 
+0000000359 00000 n 
+trailer
+<< /Size 6 /Root 1 0 R >>
+startxref
+3448
+%%EOF
diff --git a/crates/sign/tests/pdf.rs b/crates/sign/tests/pdf.rs
index 6029f19c..4bb7daf8 100644
--- a/crates/sign/tests/pdf.rs
+++ b/crates/sign/tests/pdf.rs
@@ -1259,3 +1259,43 @@ fn a_standalone_timestamp_typed_sig_by_an_older_writer_is_still_a_timestamp() {
     let s = signatures(&open(&old), &old, &TrustStore::default()).into_iter().find(|s| s.doc_timestamp).expect("found as a timestamp");
     assert_eq!(s.status, Status::Invalid);
 }
+
+/// A legacy adbe.x509.rsa_sha1 signature whose certificate carries an RSA key the verifier
+/// rejects (public exponent 1) is Invalid, not "can't check yet".
+#[test]
+fn a_legacy_x509_signature_with_a_malformed_rsa_key_is_invalid() {
+    let pdf = data("x509-rsa-sha1.pdf");
+    let at = pdf.windows(10).position(|w| w == b"0203010001").expect("the certificate's exponent 65537");
+    let mut bad = pdf.clone();
+    bad[at..at + 10].copy_from_slice(b"0203000001");
+    let s = signatures(&open(&bad), &bad, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!(s.sub_filter.as_deref(), Some("adbe.x509.rsa_sha1"));
+    assert_eq!(s.status, Status::Invalid, "{:?}", s.details);
+    assert!(!s.details.iter().any(|d| d.contains("can't check this signature yet")), "{:?}", s.details);
+}
+
+#[test]
+fn validates_the_legacy_adbe_x509_rsa_sha1_format() {
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    // tests/data/x509-rsa-sha1.pdf: made with OpenSSL (README.md) as Acrobat 4-era signers wrote it.
+    let pdf = data("x509-rsa-sha1.pdf");
+    let s = signatures(&open(&pdf), &pdf, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!(s.sub_filter.as_deref(), Some("adbe.x509.rsa_sha1"));
+    assert_eq!(s.status, Status::Unknown, "intact, identity not trusted: {:?}", s.details);
+    assert_eq!(s.signer.as_deref(), Some("Test Signer RSA"));
+    assert_eq!(s.algorithm.as_deref(), Some("RSA 2048-bit with SHA-1"));
+    assert_eq!(s.modification, Modification::None);
+    // SHA-1 still validates, but the panel says it is weak.
+    let weak = "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.";
+    assert_eq!(s.details.iter().filter(|d| *d == weak).count(), 1, "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.contains("legacy adbe.x509.rsa_sha1 format")), "{:?}", s.details);
+    let trusted = TrustStore { certs: vec![id.certificate.clone()] };
+    let s = signatures(&open(&pdf), &pdf, &trusted).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!(s.status, Status::Valid, "{:?}", s.details);
+    // One changed byte inside the signed range.
+    let mut bad = pdf.clone();
+    let i = bad.windows(8).position(|w| w == b"(Legacy)").unwrap() + 1;
+    bad[i] = b'l';
+    let s = signatures(&open(&bad), &bad, &trusted).into_iter().find(|s| s.signed).unwrap();
+    assert_eq!(s.status, Status::Invalid, "{:?}", s.details);
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 5b68de8b..a34d16d9 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -5966,8 +5966,8 @@ milestone = "M9"
 status = "shipped"
 commands = ["sign.digital"]
 tools = ["sign_document"]
-evidence = ["crates/sign/tests/crypto.rs::signatures_round_trip_for_every_key_type"]
-notes = "SHA-256, SHA-384 for P-384; SHA-1 refused for new signatures, validated in old ones"
+evidence = ["crates/sign/tests/crypto.rs::signatures_round_trip_for_every_key_type", "crates/sign/tests/crypto.rs::rsa_signatures_are_read_with_every_digestinfo_variant", "crates/sign/tests/crypto.rs::ecdsa_signatures_are_read_as_der_non_minimal_der_or_raw", "crates/sign/tests/crypto.rs::verifies_ecdsa_on_p521_and_the_brainpool_curves", "crates/sign/tests/crypto.rs::keys_of_unknown_algorithms_are_unsupported_not_wrong", "crates/sign/tests/crypto.rs::tolerated_encodings_are_noted_and_standard_ones_are_not", "crates/sign/tests/crypto.rs::weak_digests_say_so_in_words_that_are_pinned", "crates/sign/tests/crypto.rs::an_rsa_signature_value_not_below_the_modulus_is_refused", "crates/sign/tests/crypto.rs::hostile_rsa_signature_values_are_wrong_not_crashes", "crates/sign/tests/algorithms.rs::rsa_with_sha3_sha512_256_and_ripemd160", "crates/sign/tests/algorithms.rs::rsa_pss_with_its_declared_parameters", "crates/sign/tests/algorithms.rs::ed25519_signs_the_signed_attributes_themselves", "crates/sign/tests/algorithms.rs::ecdsa_on_brainpool_p512r1", "crates/sign/tests/algorithms.rs::brainpool_p512r1_keys_must_have_coordinates_reduced_modulo_p", "crates/sign/tests/algorithms.rs::only_weak_digests_leave_a_note_when_a_signature_validates", "crates/sign/tests/pdf.rs::validates_the_legacy_adbe_x509_rsa_sha1_format"]
+notes = "SHA-256, SHA-384 for P-384; SHA-1 refused for new signatures, validated in old ones. Validation also reads SHA-224, SHA-512/224, SHA-512/256, SHA3-224/256/384/512, RIPEMD-160, RSA PKCS#1 with or without the DigestInfo NULL (a bare digest without any DigestInfo is refused), RSA-PSS with its declared MGF1 hash and salt length, ECDSA as DER/non-minimal DER/raw r||s on P-256, P-384, P-521 and brainpoolP256r1/P384r1/P512r1 (the last hand-written on crypto-bigint, checked against OpenSSL), Ed25519 (RFC 8419), and the legacy adbe.x509.rsa_sha1 format. An RSA value not below the modulus is refused (RFC 8017 5.2.2). SHA-1 and RIPEMD-160 validate but the signature details say the algorithm is weak (wording pinned by tests); tolerated encodings are listed in the details. An algorithm PdfCraft cannot check gives Unknown, not Invalid. Still missing: Ed448/SHAKE, DSA, brainpool curves other than P256/P384/P512, signing with the new digests"
 
 [[feature]]
 id = "sign.certify"

From 80e6bc9d98cacbad9467f980f302f742e61c158d Mon Sep 17 00:00:00 2001
From: Alexis <byxisgeek@gmail.com>
Date: Sat, 10 Oct 2026 00:44:56 +0200
Subject: [PATCH 135/149] M14: complete the French (fr) catalog (#579)

Add the 47 labels and messages that had no French translation (redaction
marks, undo/redo labels, file-dialog and script warnings, SHA digests,
contextual Start/Subject/Edit/Type, ...). Written from the plain meaning of
the English text, clean-room, following the existing fr.tsv vocabulary
(vouvoiement, "biffer" for redact).

Update the fr.tsv SHA-256 in ATTRIBUTION.toml and add a credit entry for
the contributor in contributors/people.toml.

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml               |  2 +-
 contributors/people.toml       |  3 +++
 crates/ui-egui/src/i18n/fr.tsv | 47 ++++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 9af55652..d1c4fcca 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e41c2db222bd35f291a8fa286ac49f4efc8886646269a084958aaa59e2c848c8"
+sha256 = "3413a391aeb98cc442f9e384df0e676492debe49132629b0c903c45c3d7d56d1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
diff --git a/contributors/people.toml b/contributors/people.toml
index ade46dac..566639db 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -64,3 +64,6 @@ sync_github_name = true
 real_name = "Tao Chen"
 display_name = "Tao Chen"
 sync_github_name = false
+
+[people.Byxis]
+sync_github_name = true
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 0b008dbe..807d3697 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2057,3 +2057,50 @@
 	Printer properties	Propriétés de l'imprimante
 	Reset to printer defaults	Rétablir les réglages par défaut de l'imprimante
 	This printer offers no settings of its own.	Cette imprimante ne propose aucun réglage propre.
+	A button	Un bouton
+	A link	Un lien
+	A script	Un script
+	About	À propos
+	Add {what}	Ajouter {what}
+	Added the first {n} PDFs in {folder}	Les {n} premiers PDF de {folder} ont été ajoutés
+	Align fields	Aligner les champs
+	Another file dialog is still open. Finish with it first.	Une autre boîte de dialogue de fichier est encore ouverte. Terminez d'abord avec celle-ci.
+	Basic constraints	Contraintes de base
+	Change document properties	Modifier les propriétés du document
+	Contributors	Contributeurs
+	Couldn't show the file picker. Please try again.	Impossible d'afficher le sélecteur de fichiers. Veuillez réessayer.
+	Distribute fields	Répartir les champs
+	H / Space (hold)	H / Espace (maintenir)
+	Home / End	Début / Fin
+	Inserted text	Texte inséré
+	Mark differences	Marquer les différences
+	Mark for redaction	Marquer pour biffure
+	Mark pages for redaction	Marquer des pages pour biffure
+	Match field sizes	Uniformiser la taille des champs
+	Models	Modèles
+	No PDFs found in {folder}	Aucun PDF trouvé dans {folder}
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Ne continuez que si vous faites confiance à ce document. Une adresse peut transmettre des informations du document, par exemple ce que vous avez saisi dans son formulaire.
+	Place saved {what}	Placer {what} (version enregistrée)
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Imprimez en recto seul. Gardez les feuilles dans l'ordre, découpez aux repères, puis empilez les piles de gauche à droite et de haut en bas.
+	Redo {action}	Rétablir {action}
+	Remove saved {what}	Supprimer {what} (version enregistrée)
+	Run form script	Exécuter le script du formulaire
+	SHA-1 digest	Empreinte SHA-1
+	SHA-256 digest	Empreinte SHA-256
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Le contenu scripté doit être utilisable au clavier et avec les technologies d'assistance. Vérifiez les scripts du document.
+	Squiggly	Ondulé
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Les lignes de tableau doivent se trouver directement dans un tableau ou dans son en-tête, son corps ou son pied. Corrigez les balises du tableau.
+	That didn't work: an internal error stopped it ({m}).	Cela n'a pas fonctionné : une erreur interne l'a interrompu ({m}).
+	The Windows store's digital IDs couldn't be listed: {e}	Impossible de lister les identités numériques du magasin de certificats Windows : {e}
+	The document changed while you were choosing a file, so nothing was changed.	Le document a changé pendant que vous choisissiez un fichier, donc rien n'a été modifié.
+	The document was closed before it could be saved.	Le document a été fermé avant de pouvoir être enregistré.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Les pages ont été extraites mais pas supprimées, car le document a changé pendant que vous choisissiez un dossier.
+	Undo {action}	Annuler {action}
+	Unlocked {n} of {m} files	{n} fichier(s) sur {m} déverrouillé(s)
+	Use {what}	Utiliser {what}
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	{who} dans ce document a tenté d'ouvrir une adresse que PdfCraft n'ouvre pas : {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} dans ce document a tenté d'ouvrir une adresse que PdfCraft n'ouvre pas : {e}. Seuls les liens web (http, https) et e-mail (mailto) s'ouvrent depuis les documents.
+action wizard	Start	Démarrer
+certificate	Subject	Titulaire
+comment menu	Edit	Modifier
+signature pad	Type	Saisir

From cc31d11227627de39d0b2a6579ed43aab40a33fe Mon Sep 17 00:00:00 2001
From: Ikki Nishihara <b25d025@akita-pu.ac.jp>
Date: Sat, 10 Oct 2026 07:45:11 +0900
Subject: [PATCH 136/149] i18n: complete the Japanese catalog (105 missing
 strings) and check it like fr/de/ru/zh-hans (#587)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* i18n: complete the Japanese catalog and check it like the other languages

Japanese lacked 105 strings that other languages already have: the
open-link and open-email confirmations, DPI settings, the script sandbox
note, XFA form notes, signing, table and page-mode settings, and the
Contributors / Models statistics. Each now has a Japanese row, so the
interface no longer falls back to English for them.

`japanese_covers_ui_literals` joins the French, German, Russian and
Simplified Chinese checks: every `tl!("…")` literal in the UI source needs
a Japanese row. ATTRIBUTION.toml carries the catalog's new SHA-256.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* ja: the Fill & Sign flatten setting main gained meanwhile

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml               |   2 +-
 crates/ui-egui/src/i18n/ja.tsv | 107 +++++++++++++++++++++++++++++++++
 crates/ui-egui/src/i18n/mod.rs |  49 +++++++++++++++
 docs/localization.md           |   2 +-
 4 files changed, 158 insertions(+), 2 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index d1c4fcca..e318ee81 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0534c5852449a72af65da004b085c6d0566aa7d9cdf98d38978ba3e39493ef75"
+sha256 = "e9801730750c13ce4cfe71fb5034a1a4e2984bd20b59ecaf94477c2dbc590e54"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 713bf60d..e55ba2ba 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1997,3 +1997,110 @@
 	Printer properties	プリンターのプロパティ
 	Reset to printer defaults	プリンターの初期設定に戻す
 	This printer offers no settings of its own.	このプリンターには独自の設定がありません。
+	% of all commits	全コミットに占める割合（%）
+	+Bin	+Bin
+	+LOC	+LOC
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}：PR {prs} 件、コミット {commits} 件、行数 +{added} / −{deleted}（Δ {delta}）、バイナリファイル +{bin_added} / −{bin_deleted}、{first} – {last}
+	A button	ボタン
+	A link	リンク
+	A script	スクリプト
+	About	概要
+	Add {what}	{what}を追加
+	Align fields	フィールドを整列
+	Another file dialog is still open. Finish with it first.	別のファイルダイアログがまだ開いています。先にそちらの操作を終えてください。
+	Basic constraints	基本制約
+	Binary assets added	追加したバイナリファイル数
+	Binary assets removed	削除したバイナリファイル数
+	Change document properties	文書のプロパティを変更
+	Change {what}	{what}を変更
+	Commits	コミット
+	Company	企業
+	Contributors	貢献者
+	Couldn't show the file picker. Please try again.	ファイル選択ダイアログを表示できませんでした。もう一度お試しください。
+	Create	作成
+	Create PDF from images	画像から PDF を作成
+	Cut and stack	裁断して重ねる
+	DPI sets the printed page size without resampling the image.	DPI で印刷時のページサイズが決まります。画像は再サンプリングされません。
+	Default page display	既定のページ表示
+	Default workspace mode	既定のワークスペースモード
+	Default zoom	既定のズーム
+	Display name	表示名
+	Distribute fields	フィールドを均等配置
+	Documents and view	文書と表示
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	テンプレートをもとにレイアウトした動的 XFA フォームです（{pages}、{fields}）。
+	Files are combined in this order. Leave Pages empty to take every page.	ファイルはこの順序で結合されます。すべてのページを含めるには、「ページ」を空欄のままにしてください。
+	First	最初
+	First commit	最初のコミット
+	Grab bag	いろいろ
+	H / Space (hold)	H / Space（押したまま）
+	Home / End	Home / End
+	Last	最後
+	Last commit	最後のコミット
+	Line delta	行数の増減
+	Line ending	線端の形状
+	Lines +/−	行数 +/−
+	Lines added	追加した行数
+	Lines deleted	削除した行数
+	Mark differences	相違点をマーク
+	Mark for redaction	墨消し対象としてマーク
+	Mark pages for redaction	ページを墨消し対象としてマーク
+	Match field sizes	フィールドのサイズを揃える
+	Merged PRs	マージ済みの PR
+	Model	モデル
+	Models	モデル
+	Name (A–Z)	名前（A–Z）
+	No contributor data was built into this copy.	このビルドには貢献者のデータが組み込まれていません。
+	No model credits were built into this copy.	このビルドにはモデルのクレジット情報が組み込まれていません。
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	この文書を信頼できる場合にのみ続行してください。アドレスには、フォームに入力した内容など、文書内の情報が含まれていることがあります。
+	Open email app	メールアプリを開く
+	Open link	リンクを開く
+	Open this web page?	このウェブページを開きますか？
+	PRs	PRs
+	Place saved {what}	保存済みの{what}を配置
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	片面印刷してください。用紙の順序を保ったままマークに沿って裁断し、できた束を左から右、上から下の順に重ねてください。
+	Real name	本名
+	Remove saved {what}	保存済みの{what}を削除
+	Reverse the order	並び順を逆にする
+	Run form script	フォームのスクリプトを実行
+	SHA-1 digest	SHA-1 ダイジェスト
+	SHA-256 digest	SHA-256 ダイジェスト
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	スクリプトで動作するコンテンツは、キーボードや支援技術でも操作できる必要があります。文書のスクリプトを確認してください。
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	スクリプトは、ファイルやネットワークにアクセスできないサンドボックス内で実行されます。スクリプトがウェブページを開くには、事前にユーザーの許可が必要です。JavaScript がオフでも、Acrobat 標準の書式・検証・計算関数は引き続き動作します。
+	Selected image files: {count}	選択した画像ファイル数：{count}
+	Show	表示
+	Sign yourself	自分で署名
+	Sort	並べ替え
+	Squiggly	波線
+	Table	表
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	表の行は、表、またはそのヘッダー・本体・フッターの直下に置く必要があります。表のタグを修正してください。
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	テキスト認識がインストールされていません。必要なモデルがありません（`cargo xtask models` を実行するか、PDFCRAFT_MODELS を設定してください）。
+	That didn't work: an internal error stopped it ({m}).	内部エラーのため、操作を完了できませんでした（{m}）。
+	The Windows store's digital IDs couldn't be listed: {e}	Windows 証明書ストアのデジタル ID の一覧を取得できませんでした：{e}
+	The document changed while you were choosing a file, so nothing was changed.	ファイルを選択している間に文書が変更されたため、何も変更されていません。
+	The document was closed before it could be saved.	保存する前に文書が閉じられました。
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	フォルダーを選択している間に文書が変更されたため、ページは抽出しましたが、削除はしていません。
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	このウェブアドレスには、異なる文字体系の文字が混在しています。これはほかのサイトの名前を装う際によく使われる手口です。
+	This web address uses letters from another alphabet, which can look like familiar ones.	このウェブアドレスには別の文字体系の文字が使われており、見慣れた文字と似て見えることがあります。
+	Use 72 DPI (one point per pixel)	72 DPI を使用（1 ピクセルあたり 1 ポイント）
+	Use custom DPI	カスタム DPI を使用
+	Use each image's embedded DPI; use 72 DPI when it is absent.	各画像に埋め込まれた DPI を使用します。埋め込まれていない場合は 72 DPI を使用します。
+	Use image resolution	画像の解像度を使用
+	Use {what}	{what}を使用
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF にレイアウトやズームの指定がない場合に使用されます。連続スクロールでは、ページの境目にスナップすることはありません。
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	PDF を開くときに使用されます。起動モードや制御モードを明示的に指定した場合は、そのセッションではそちらが優先されます。
+	Username	ユーザー名
+	Write this email?	このメールを作成しますか？
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA フォームです。フィールドと XFA データは常に同期されるため、入力した内容がほかのビューアーでも表示されます。
+	{n} contributors · {c} commits	貢献者 {n} 人 · コミット {c} 件
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	この文書内の{who}が、PdfCraft では開けないアドレスを開こうとしました：{e}。
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	この文書内の{who}が、PdfCraft では開けないアドレスを開こうとしました：{e}。文書から開けるのは、ウェブ（http、https）とメール（mailto）のリンクだけです。
+	{who} in this document wants to open this address in your browser:	この文書内の{who}が、次のアドレスをブラウザーで開こうとしています：
+	{who} in this document wants to open your email app with this address:	この文書内の{who}が、次のアドレスでメールアプリを開こうとしています：
+	ΔLOC	ΔLOC
+	−Bin	−Bin
+	−LOC	−LOC
+@plural	{n} field|{n} fields	{n} 個のフィールド
+@plural	{n} page|{n} pages	{n} ページ
+signature pad	Type	入力
+	Flatten Fill & Sign when saving	保存時に入力と署名を統合する
+	Text, marks and signatures become part of the page. Other comments stay editable.	テキスト、マーク、署名がページの一部になります。その他のコメントは引き続き編集できます。
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 15a33b78..5a05d3e3 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -670,6 +670,55 @@ mod tests {
         }
     }
 
+    /// Every `tl!("…")` literal in the UI source (test modules aside), unescaped.
+    fn ui_literals() -> std::collections::BTreeSet<String> {
+        let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+        let mut literals = std::collections::BTreeSet::new();
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(dir).expect("UI source directory") {
+                let path = entry.expect("UI source entry").path();
+                if path.is_dir() {
+                    if path.file_name().is_some_and(|name| name != "i18n") {
+                        stack.push(path);
+                    }
+                } else if path.extension().is_some_and(|ext| ext == "rs") {
+                    let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n");
+                    let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+                    while let Some((_, after)) = rest.split_once("tl!(\"") {
+                        let mut escaped = false;
+                        let end = after
+                            .char_indices()
+                            .find_map(|(i, c)| {
+                                if c == '"' && !escaped {
+                                    return Some(i);
+                                }
+                                escaped = c == '\\' && !escaped;
+                                None
+                            })
+                            .expect("closed tl! literal");
+                        let (raw, tail) = after.split_at(end);
+                        if tail.starts_with("\")") {
+                            let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
+                            literals.insert(label);
+                        }
+                        rest = tail.strip_prefix('"').expect("closing quote");
+                    }
+                }
+            }
+        }
+        literals
+    }
+
+    /// Japanese translates every `tl!("…")` literal in the UI source, so a new string can't ship in
+    /// English by accident (the same check French, German, Russian and Simplified Chinese have).
+    #[test]
+    fn japanese_covers_ui_literals() {
+        let literals = ui_literals();
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(JA(), label)).collect();
+        assert!(missing.is_empty(), "untranslated Japanese UI literals: {missing:#?}");
+    }
+
     /// With craft-fonts, every Japanese translation has glyphs: with all interface faces (desktop)
     /// and with BIZ UDPGothic Regular alone (the web build's only Japanese face).
     #[test]
diff --git a/docs/localization.md b/docs/localization.md
index 43f77e38..e3e685a2 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -20,7 +20,7 @@ Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com
 
 There is no right-to-left interface language yet. File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
 
-Simplified Chinese, French and German coverage tests, following PhotoCraft's complete-catalog approach, check every registered command, All tools label and `tl!("literal")` in the UI source. Simplified Chinese also checks direct `i18n::t` calls and multiline literals, plus the About tabs, contributor name modes, sort options, table headers and model columns. Generated history labels, contributor summaries and diagnostics are tested with user-supplied names and error details. Catalog coverage does not guarantee glyph coverage: the release-pinned craft-fonts input currently has no `Hans` face, and the web build embeds only BIZ UDPGothic Regular. Chinese font delivery remains separate work, as discussed in [#112](https://github.com/storytold/pdfcraft/pull/112) and [#140](https://github.com/storytold/pdfcraft/pull/140).
+Japanese, Simplified Chinese, French and German coverage tests, following PhotoCraft's complete-catalog approach, check every registered command, All tools label and `tl!("literal")` in the UI source. Simplified Chinese also checks direct `i18n::t` calls and multiline literals, plus the About tabs, contributor name modes, sort options, table headers and model columns. Generated history labels, contributor summaries and diagnostics are tested with user-supplied names and error details. Catalog coverage does not guarantee glyph coverage: the release-pinned craft-fonts input currently has no `Hans` face, and the web build embeds only BIZ UDPGothic Regular. Chinese font delivery remains separate work, as discussed in [#112](https://github.com/storytold/pdfcraft/pull/112) and [#140](https://github.com/storytold/pdfcraft/pull/140).
 
 German labels keep nouns capitalized, including tool names inserted into notices. The certificate viewer uses the `certificate` context for `Subject` (the certificate holder), while document properties keep the plain translation (the topic). Search hints reserve room for the shortcut, and Home cards limit their title and description to the available rows; hovering shows the full text when it is shortened.
 

From 22cbf6562809fa40d2d1cf5f5a86ceb48c1e4ee1 Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:45:27 -0700
Subject: [PATCH 137/149] Tell the user when PdfCraft draws without a GPU
 (#519) (#627)

* Refs #519: tell the user when PdfCraft draws without a GPU

When wgpu's adapter is a software one (WARP on Windows, llvmpipe on
Linux), show a notice at launch that PdfCraft may be slow. egui-wgpu
only logged it, so the #519 reporter had to find it in pdfcraft.log.

The OpenGL fallback isn't covered: glow reports its renderer only
through unsafe calls. The string is translated in the ten catalogs that
carry the portable-mode notice, with their ATTRIBUTION.toml hashes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* zh-hant: the drawing-without-a-GPU notice

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                    | 22 +++++++++++-----------
 apps/pdfcraft/src/main.rs           | 28 ++++++++++++++++++++++++++++
 crates/ui-egui/src/i18n/bg.tsv      |  1 +
 crates/ui-egui/src/i18n/cs.tsv      |  1 +
 crates/ui-egui/src/i18n/de.tsv      |  1 +
 crates/ui-egui/src/i18n/es.tsv      |  1 +
 crates/ui-egui/src/i18n/fr.tsv      |  1 +
 crates/ui-egui/src/i18n/hu.tsv      |  1 +
 crates/ui-egui/src/i18n/ja.tsv      |  1 +
 crates/ui-egui/src/i18n/pt-br.tsv   |  1 +
 crates/ui-egui/src/i18n/uk.tsv      |  1 +
 crates/ui-egui/src/i18n/zh-hans.tsv |  1 +
 crates/ui-egui/src/i18n/zh-hant.tsv |  1 +
 13 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index e318ee81..696dfe31 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ed6e797e2ae7e4632aabc585af973c15f34d0366671a6c57acf222a3a98b087b"
+sha256 = "4c4a3955e2f687d8b0483bd01986bf652a6a84cd5c8fadac01bc30dc74466aa8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0575e82da2596ca407ad8153cde04750fa6c1ab98ab7b850032ed361d51f9a4e"
+sha256 = "64cb89b98806cceee1900c840a167a181fb8d6fe43ad8f361c4d56e25b504b30"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8bab483a3f5ba3a724365c2a5a892291a10f41fdc443eaceb66f49c8a20cae20"
+sha256 = "8aaf1667040f5fb982a31c680674cf1c51e98092e5ccc38dc5a7e916238c2d1c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2cd5dcc6cf7e94914b955ee0f2f5c3e8951b16e26ab49fcb7111246a6e31ee2a"
+sha256 = "81a1320a5769dce52c90d35953d82c0eccbb18deb05421883d6ef0680ce4c6b3"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "460a8a8740f1a8a97f3c3e4bc8d27913d417539a5667a2686a4ec1047c309d39"
+sha256 = "d9eb5199e627ada01c404232ae500bff145654a61ae4379b037dbdc2afd13efa"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3413a391aeb98cc442f9e384df0e676492debe49132629b0c903c45c3d7d56d1"
+sha256 = "e6f51aa5d11225920e971f43420dfde96e5ab209b3fa7cffd572a2959bf09d82"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "357f864eb011b8fdcbe0db609a85ce6f8c7fb421769361e5def005cc515d311d"
+sha256 = "d1250a2d29e447b86b4b9f9515f9d9b7c74ff8fe7a1ac0d6207355a02d895f8b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "31b4e703f7b60727e09cc7e68b287e748f4dbd0ae9e1298b96714bcf8da6e74e"
+sha256 = "292fb26efe13ae85f4343b4dffd541ba36d4963cb309f7cbad5074b940aaf5e5"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d25162d477b3370238b23b0a61e827c4df73aac2cb5ccfc694f79e2adc9798c7"
+sha256 = "df90a3c504c18f606a94fb6aa1fb4f8cd2aa26112aa09c29add5e37db02495af"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e9801730750c13ce4cfe71fb5034a1a4e2984bd20b59ecaf94477c2dbc590e54"
+sha256 = "1333d121349c531e3297d9ac304de76434bb7248dbbe0732ec7d842bac5c9eb2"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "306d998039e76769eeb6fa43871807193b8f2ebafc4924f15d17db710ddab184"
+sha256 = "a09703008f9ef9e3c96bf6fc6853288ae733ab3b069ed5d02fd9e78fa9acda62"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index ae295990..6399927b 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -297,6 +297,9 @@ fn app_creator<'a>(
         if let Some(dir) = pdfcraft_ui_egui::RecoveryStore::default_dir() {
             app.enable_recovery(pdfcraft_ui_egui::RecoveryStore::new(dir));
         }
+        if let Some(state) = &cc.wgpu_render_state {
+            notify_software_renderer(&mut app, state.adapter.get_info().device_type);
+        }
         // A portable marker whose data folder can't be written (#157): say where settings went.
         if let Some(w) = &pdfcraft_ui_egui::portable::current().unwritable {
             app.notify_fmt(
@@ -325,6 +328,16 @@ fn app_creator<'a>(
     })
 }
 
+/// Tell the user when wgpu draws on the processor (WARP on Windows, llvmpipe on Linux) rather than
+/// a GPU, which makes everything slower. egui-wgpu only logs it, so the reporter of #519 had to find
+/// it in pdfcraft.log. The OpenGL fallback isn't covered: glow only reports its renderer through
+/// `unsafe` calls.
+fn notify_software_renderer(app: &mut PdfCraftApp, device_type: eframe::wgpu::DeviceType) {
+    if device_type == eframe::wgpu::DeviceType::Cpu {
+        app.notify_tr("PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.");
+    }
+}
+
 /// Write the control endpoint so that only the current user can read the token.
 ///
 /// The JSON goes to a new file next to `path`, created fresh (owner-only on Unix), which then
@@ -555,6 +568,21 @@ mod tests {
         assert_eq!(native_options(false, eframe::Renderer::Glow).renderer, eframe::Renderer::Glow);
     }
 
+    #[test]
+    fn a_software_renderer_is_shown_to_the_user() {
+        use eframe::wgpu::DeviceType;
+        // Issue #519: WARP or llvmpipe is announced in the app, not just in pdfcraft.log.
+        let mut app = super::PdfCraftApp::new();
+        super::notify_software_renderer(&mut app, DeviceType::Cpu);
+        let notice = app.toast.as_ref().map(|(m, _)| m.as_str()).unwrap_or_default();
+        assert!(notice.contains("without a graphics processor"), "{notice:?}");
+        for gpu in [DeviceType::IntegratedGpu, DeviceType::DiscreteGpu, DeviceType::VirtualGpu, DeviceType::Other] {
+            let mut app = super::PdfCraftApp::new();
+            super::notify_software_renderer(&mut app, gpu);
+            assert!(app.toast.is_none(), "{gpu:?}: {:?}", app.toast);
+        }
+    }
+
     #[test]
     fn gpu_backends_avoid_vulkan_on_windows_and_prefer_low_power() {
         let mut native = eframe::NativeOptions::default();
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 419ef313..89f1648a 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -1605,6 +1605,7 @@
 	Couldn't open {name}: {e}	{name} не можа да бъде отворен: {e}
 	Couldn't read {name}: {e}	{name} не можа да бъде прочетен: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Преносимият режим е изключен: в {folder} не може да се записва ({error}). Вместо това настройките се пазят в потребителската ви папка.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft рисува без графичен процесор, затова може да е бавен. Обновяването на графичния драйвер може да помогне.
 	Couldn't save: {e}	Записването не бе успешно: {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Изтеглянето на прикачени файлове в уеб версията ще стане достъпно с M3.10 ({n} байта готови)
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 36c2d243..d3d9d642 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -117,4 +117,5 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Vyberte obrázek PNG nebo JPEG (nejvýše 4 MiB). Průhlednost bude zachována.
 	Couldn't import the signature image: {e}	Obrázek podpisu nelze importovat: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Přenosný režim je vypnutý: do složky {folder} nelze zapisovat ({error}). Nastavení se místo toho ukládá do vaší uživatelské složky.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft vykresluje bez grafického procesoru, takže může být pomalý. Pomoci může aktualizace grafického ovladače.
 	Go to page…	Přejít na stránku…
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 1c4aa3eb..1330ebbf 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -1576,6 +1576,7 @@
 	Couldn't open {name}: {e}	{name} konnte nicht geöffnet werden: {e}
 	Couldn't read {name}: {e}	{name} konnte nicht gelesen werden: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Der portable Modus ist aus: In {folder} kann nicht geschrieben werden ({error}). Die Einstellungen werden stattdessen in deinem Benutzerordner gespeichert.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft zeichnet ohne Grafikprozessor und kann daher langsam sein. Ein aktualisierter Grafiktreiber kann helfen.
 	Couldn't save: {e}	Speichern fehlgeschlagen: {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Anhänge herunterladen kommt im Web mit M3.10 ({n} Bytes bereit)
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 4c75dcb9..bbf7da8a 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1652,6 +1652,7 @@
 	Couldn't open {name}: {e}	No se pudo abrir {name}: {e}
 	Couldn't read {name}: {e}	No se pudo leer {name}: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	El modo portátil está desactivado: no se puede escribir en {folder} ({error}). La configuración se guarda en tu carpeta de usuario.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft está dibujando sin procesador gráfico, así que puede ir lento. Actualizar el controlador gráfico puede ayudar.
 	Couldn't save: {e}	No se pudo guardar: {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	La descarga de archivos adjuntos en la versión web llegará con M3.10 ({n} bytes listos)
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 807d3697..6364bb87 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1575,6 +1575,7 @@
 	Couldn't open {name}: {e}	Impossible d'ouvrir {name} : {e}
 	Couldn't read {name}: {e}	Impossible de lire {name} : {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Le mode portable est désactivé : impossible d'écrire dans {folder} ({error}). Les réglages sont conservés dans votre dossier utilisateur.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft dessine sans processeur graphique et peut donc être lent. Mettre à jour le pilote graphique peut aider.
 	Couldn't save: {e}	Impossible d'enregistrer : {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Le téléchargement des pièces jointes sur le web arrivera avec M3.10 ({n} octets prêts)
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 82d8c6c1..ca38626b 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -1571,6 +1571,7 @@
 	Couldn't open {name}: {e}	{name} megnyitása nem sikerült: {e}
 	Couldn't read {name}: {e}	{name} olvasása nem sikerült: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	A hordozható mód ki van kapcsolva: {folder} nem írható ({error}). A beállítások helyette a felhasználói mappádban maradnak.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	A PdfCraft grafikus processzor nélkül rajzol, ezért lassú lehet. A grafikus illesztőprogram frissítése segíthet.
 	Couldn't save: {e}	A mentés nem sikerült: {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	A mellékletek letöltése a weben az M3.10-zel érkezik ({n} bájt kész)
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index e55ba2ba..e7c89068 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1658,6 +1658,7 @@
 	Couldn't open {name}: {e}	{name} を開けませんでした: {e}
 	Couldn't read {name}: {e}	{name} を読み取れませんでした: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	ポータブルモードは無効です: {folder} に書き込めません ({error})。設定は代わりにユーザーフォルダーに保存されます。
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft はグラフィックプロセッサーを使わずに描画しているため、動作が遅くなることがあります。グラフィックドライバーを更新すると改善する場合があります。
 	Couldn't save: {e}	保存できませんでした: {e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Web 版の添付ファイルのダウンロードは M3.10 で対応予定です（{n} バイト準備済み）
 	`{command}` {when}	`{command}`: {when}
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index a9b1f742..2c027d74 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -70,5 +70,6 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Escolha uma imagem PNG ou JPEG (até 4 MiB). A transparência é preservada.
 	Couldn't import the signature image: {e}	Não foi possível importar a imagem da assinatura: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	O modo portátil está desativado: não é possível gravar em {folder} ({error}). As configurações ficam na sua pasta de usuário.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	O PdfCraft está desenhando sem processador gráfico, por isso pode ficar lento. Atualizar o driver de vídeo pode ajudar.
 	Go to page…	Ir para a página…
 	Reopen the files that were open when PdfCraft last closed	Reabrir os arquivos que estavam abertos quando o PdfCraft foi fechado pela última vez
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 51bf057b..227e0526 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2007,6 +2007,7 @@
 	Couldn't optimize the file	Не вдалося оптимізувати файл
 	Files are combined in this order. Leave Pages empty to take every page.	Файли об’єднуються в цьому порядку. Залиште «Сторінки» порожнім, щоб узяти всі сторінки.
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Портативний режим вимкнено: неможливо записати в {folder} ({error}). Налаштування зберігаються у вашій користувацькій теці.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft малює без графічного процесора, тому може працювати повільно. Оновлення графічного драйвера може допомогти.
 	Show	Показувати
 	Sort	Сортувати
 	Reverse the order	Зворотний порядок
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index f8b9f6e2..43b30a92 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -1612,6 +1612,7 @@
 	Couldn't open {name}: {e}	无法打开{name}：{e}
 	Couldn't read {name}: {e}	无法读取{name}：{e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	便携模式已关闭：无法写入{folder}（{error}）。设置改为保存在你的用户文件夹中。
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft 正在不使用图形处理器的情况下绘制，因此可能较慢。更新显卡驱动程序可能会有帮助。
 	Couldn't save: {e}	无法保存：{e}
 	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Web 端附件下载将于 M3.10 到来（{n} 字节已就绪）
 	`{command}` {when}	`{command}` {when}
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index fae92447..09183f07 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1990,3 +1990,4 @@
 	Printer properties	印表機內容
 	Reset to printer defaults	還原印表機預設值
 	This printer offers no settings of its own.	此印表機沒有專屬設定。
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft 正在不使用圖形處理器的情況下繪製，因此可能較慢。更新顯示卡驅動程式可能會有幫助。

From 96854d8d924e2542f22a82e3e9bd9e79b8682dc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rk=20Bartalos?= <bartalos86@gmail.com>
Date: Sat, 10 Oct 2026 00:45:54 +0200
Subject: [PATCH 138/149] M5: name line endings in the comment properties combo
 (#582)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M5: name line endings in the comment properties combo

The menu showed PDF tokens such as ROpenArrow. It now uses translated labels, and the stored /LE name is unchanged.

* Fix main CI: move the rotated-field render test out of pdfcraft-forms (#591)

#516 added pdfcraft-render as a dev-dependency of pdfcraft-forms for one
rendering test. Both crates are layer 3, so `cargo xtask layers` (run in
CI) rejects the sideways edge and main went red. The test now lives in
crates/engine/tests/form_rotation.rs, where both crates are already
dependencies, and forms drops the dev-dependency. The parity evidence
points at the new location.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* ja: 平ら for the Butt line ending

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml                    | 26 +++++++++++++-------------
 ROADMAP.md                          |  1 +
 crates/ui-egui/src/comment_props.rs | 29 ++++++++++++++++++++++++-----
 crates/ui-egui/src/i18n/bg.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/cs.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/de.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/es.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/fr.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/hu.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/ja.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/pt-br.tsv   |  6 ++++++
 crates/ui-egui/src/i18n/ru.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/te.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/uk.tsv      |  6 ++++++
 crates/ui-egui/src/i18n/zh-hans.tsv |  6 ++++++
 crates/ui-egui/src/i18n/zh-hant.tsv |  6 ++++++
 crates/ui-egui/tests/comments.rs    |  9 +++++++++
 17 files changed, 125 insertions(+), 18 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 696dfe31..8b5e1a5b 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4c4a3955e2f687d8b0483bd01986bf652a6a84cd5c8fadac01bc30dc74466aa8"
+sha256 = "df55a2ab783a02419d86c244cd793d4f42616ff842860b9ee8740960526f713d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "64cb89b98806cceee1900c840a167a181fb8d6fe43ad8f361c4d56e25b504b30"
+sha256 = "4aee7a68592c36cc2bb828a51e71fdf6ed12e660bd80b2f214a6d3aef554d1d5"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8aaf1667040f5fb982a31c680674cf1c51e98092e5ccc38dc5a7e916238c2d1c"
+sha256 = "af2e8234147dbcc8da6414e213fe560312d44e816f0bde6271577c4d8041748b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "81a1320a5769dce52c90d35953d82c0eccbb18deb05421883d6ef0680ce4c6b3"
+sha256 = "7abd689f910f5b28f48dc9c0b2d3859965ad27c962d919a011efb959247edfee"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d9eb5199e627ada01c404232ae500bff145654a61ae4379b037dbdc2afd13efa"
+sha256 = "9ebeb8cd5168cffaa027f7d4bc08b7987c09661027f64e4067b0975f456737bd"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e6f51aa5d11225920e971f43420dfde96e5ab209b3fa7cffd572a2959bf09d82"
+sha256 = "9b160ff2781512e07eb9f5a6be39681eec0fd413c61e0becc11913ef9baac5e3"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d1250a2d29e447b86b4b9f9515f9d9b7c74ff8fe7a1ac0d6207355a02d895f8b"
+sha256 = "e7007083de3633c85fdf98b249e201f50100c3adfa2cf889acd03449a700b1e7"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2d42c2fbb62771bad33dab83926adc34c553b7d0b6cf666322076b9820f641de"
+sha256 = "7315ad9ec7e672c9654a399f0142e8f78b9331c654048085f3b4b573edd51fa1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "bb5e94d419faf579e9cd0ef9e1f26da6aa342567004a8ff53cb0a2037a8981bb"
+sha256 = "54ae61ed7eb2c93cf739200a6ec4b198ce40991eccebfca0bdc1eb40847d64cf"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "292fb26efe13ae85f4343b4dffd541ba36d4963cb309f7cbad5074b940aaf5e5"
+sha256 = "46f5a79f8264f3ca3aba4fa5a95877e55f7a55dcee68834854fcc7ee24390c2c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "df90a3c504c18f606a94fb6aa1fb4f8cd2aa26112aa09c29add5e37db02495af"
+sha256 = "12d77d9d83b20cea4486f91628655bbd49440d550c6d4516412b448a289e284d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1333d121349c531e3297d9ac304de76434bb7248dbbe0732ec7d842bac5c9eb2"
+sha256 = "62e9d95a3dbf94024c059f3a3f7646e99119bffb1da0d60580933bfed6f03985"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "a09703008f9ef9e3c96bf6fc6853288ae733ab3b069ed5d02fd9e78fa9acda62"
+sha256 = "9a2259eb0a18fae4290f4f5e03b147f689315d02a86a0b1bb9bf4541bc2f984c"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/ROADMAP.md b/ROADMAP.md
index fffb0e32..5152c5bb 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -128,6 +128,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 ## Log
 
+- **2026-10-09 (M5, line-ending labels):** Comment properties names each line ending in words ("Reverse open arrow", "Butt", …) and those labels are translated. The PDF `/LE` token is unchanged. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5, line endings):** Lines, connected lines and callouts draw all ten standard line-ending styles. `comment_add` accepts `endings`, and Comment properties can change them in one undo step. An unknown name is left undrawn, and a non-finite direction is rejected. Cloudy borders remain polygon-only, so `comment.line-endings` stays partial. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, JPX sample normalization):** JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).
diff --git a/crates/ui-egui/src/comment_props.rs b/crates/ui-egui/src/comment_props.rs
index 92a7beb7..023f5b7e 100644
--- a/crates/ui-egui/src/comment_props.rs
+++ b/crates/ui-egui/src/comment_props.rs
@@ -28,6 +28,22 @@ pub struct PropsDraft {
 const ICONS: [NoteIcon; 7] =
     [NoteIcon::Comment, NoteIcon::Note, NoteIcon::Help, NoteIcon::Insert, NoteIcon::Key, NoteIcon::NewParagraph, NoteIcon::Paragraph];
 
+/// The name shown in the line-ending combo. [`LineEnding::name`] stays the PDF `/LE` token.
+fn ending_label(ending: LineEnding) -> &'static str {
+    match ending {
+        LineEnding::None => tl!("None"),
+        LineEnding::Square => tl!("Square"),
+        LineEnding::Circle => tl!("Circle"),
+        LineEnding::Diamond => tl!("Diamond"),
+        LineEnding::OpenArrow => tl!("Open arrow"),
+        LineEnding::ClosedArrow => tl!("Closed arrow"),
+        LineEnding::Butt => tl!("Butt"),
+        LineEnding::ROpenArrow => tl!("Reverse open arrow"),
+        LineEnding::RClosedArrow => tl!("Reverse closed arrow"),
+        LineEnding::Slash => tl!("Slash"),
+    }
+}
+
 impl PdfCraftApp {
     /// Attach file: ask for a file (or take `attach_override`) and attach it at `at`.
     pub fn attach_file_comment(&mut self, page: usize, at: [f64; 2]) {
@@ -193,11 +209,14 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                         ui.label(tl!("Line ending"));
                         ui.horizontal(|ui| {
                             for (i, ending) in ends.iter_mut().enumerate() {
-                                egui::ComboBox::from_id_salt(("line-ending", i)).selected_text(ending.name()).width(130.0).show_ui(ui, |ui| {
-                                    for style in LineEnding::ALL {
-                                        ui.selectable_value(ending, style, style.name());
-                                    }
-                                });
+                                egui::ComboBox::from_id_salt(("line-ending", i)).selected_text(ending_label(*ending)).width(188.0).show_ui(
+                                    ui,
+                                    |ui| {
+                                        for style in LineEnding::ALL {
+                                            ui.selectable_value(ending, style, ending_label(style));
+                                        }
+                                    },
+                                );
                             }
                         });
                         ui.end_row();
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 89f1648a..fcd5f281 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -611,6 +611,12 @@
 	Icon	Икона
 	Thickness	Дебелина
 	Line ending	Край на линията
+	Open arrow	Отворена стрелка
+	Closed arrow	Затворена стрелка
+	Butt	Тъп край
+	Reverse open arrow	Обърната отворена стрелка
+	Reverse closed arrow	Обърната затворена стрелка
+	Slash	Наклонена черта
 	Modified	Променено
 	No status has been set.	Не е зададено състояние.
 	Compare Files	Сравняване на файлове
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index d3d9d642..69617198 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -119,3 +119,9 @@
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Přenosný režim je vypnutý: do složky {folder} nelze zapisovat ({error}). Nastavení se místo toho ukládá do vaší uživatelské složky.
 	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft vykresluje bez grafického procesoru, takže může být pomalý. Pomoci může aktualizace grafického ovladače.
 	Go to page…	Přejít na stránku…
+	Open arrow	Otevřená šipka
+	Closed arrow	Zavřená šipka
+	Butt	Tupý konec
+	Reverse open arrow	Otevřená šipka obráceně
+	Reverse closed arrow	Zavřená šipka obráceně
+	Slash	Lomítko
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 1330ebbf..9cbd57a4 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -899,6 +899,12 @@
 	Icon	Symbol
 	Thickness	Stärke
 	Line ending	Linienende
+	Open arrow	Offener Pfeil
+	Closed arrow	Geschlossener Pfeil
+	Butt	Stumpf
+	Reverse open arrow	Offener Pfeil umgekehrt
+	Reverse closed arrow	Geschlossener Pfeil umgekehrt
+	Slash	Schrägstrich
 	Modified	Geändert
 	No status has been set.	Es wurde kein Status festgelegt.
 	Compare Files	Dateien vergleichen
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index bbf7da8a..f5dabbaf 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2005,6 +2005,12 @@
 	Couldn't import the signature image: {e}	No se pudo importar la imagen de la firma: {e}
 	Go to page…	Ir a la página…
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Las fuentes estándar no pueden mostrar «{c}» ({code}). Por ahora solo se pueden añadir como texto caracteres de Europa occidental.
+	Open arrow	Flecha abierta
+	Closed arrow	Flecha cerrada
+	Butt	Extremo recto
+	Reverse open arrow	Flecha abierta invertida
+	Reverse closed arrow	Flecha cerrada invertida
+	Slash	Barra
 	Larger pages	Páginas más grandes
 	Smaller pages	Páginas más pequeñas
 	Reset page size	Restablecer el tamaño de las páginas
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 6364bb87..db9c0c32 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -898,6 +898,12 @@
 	Icon	Icône
 	Thickness	Épaisseur
 	Line ending	Extrémité de ligne
+	Open arrow	Flèche ouverte
+	Closed arrow	Flèche fermée
+	Butt	Extrémité plate
+	Reverse open arrow	Flèche ouverte inversée
+	Reverse closed arrow	Flèche fermée inversée
+	Slash	Barre oblique
 	Modified	Modifié
 	No status has been set.	Aucun état n'a été défini.
 	Compare Files	Comparer des fichiers
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index ca38626b..3346103a 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2084,6 +2084,12 @@ action wizard	Start	Indítás
 	H / Space (hold)	H / szóköz (nyomva tartva)
 	Rotation:	Elforgatás:
 	Line ending	Vonalvég
+	Open arrow	Nyitott nyíl
+	Closed arrow	Zárt nyíl
+	Butt	Tompa
+	Reverse open arrow	Fordított nyitott nyíl
+	Reverse closed arrow	Fordított zárt nyíl
+	Slash	Perjel
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	A szabványos betűtípusok nem tudják megjeleníteni ezt: „{c}” ({code}). Egyelőre csak nyugat-európai karakterek adhatók hozzá szövegként.
 	Larger pages	Nagyobb oldalak
 	Smaller pages	Kisebb oldalak
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index e7c89068..fd9d0bbb 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1982,6 +1982,12 @@
 	Go to page…	ページへ移動…
 	Reopen the files that were open when PdfCraft last closed	前回 PdfCraft を閉じたときに開いていたファイルを再度開く
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準フォントでは「{c}」（{code}）を表示できません。現在、テキストとして追加できるのは西ヨーロッパの文字のみです。
+	Open arrow	開いた矢印
+	Closed arrow	閉じた矢印
+	Butt	平ら
+	Reverse open arrow	逆向きの開いた矢印
+	Reverse closed arrow	逆向きの閉じた矢印
+	Slash	斜線
 	Larger pages	ページを大きく表示
 	Smaller pages	ページを小さく表示
 	Reset page size	ページサイズをリセット
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 2c027d74..3486ecb9 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -73,3 +73,9 @@
 	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	O PdfCraft está desenhando sem processador gráfico, por isso pode ficar lento. Atualizar o driver de vídeo pode ajudar.
 	Go to page…	Ir para a página…
 	Reopen the files that were open when PdfCraft last closed	Reabrir os arquivos que estavam abertos quando o PdfCraft foi fechado pela última vez
+	Open arrow	Seta aberta
+	Closed arrow	Seta fechada
+	Butt	Topo reto
+	Reverse open arrow	Seta aberta invertida
+	Reverse closed arrow	Seta fechada invertida
+	Slash	Barra
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index fbe654bf..073e9113 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -919,6 +919,12 @@
 	Icon	Значок
 	Thickness	Толщина
 	Line ending	Окончание линии
+	Open arrow	Открытая стрелка
+	Closed arrow	Закрытая стрелка
+	Butt	Торец
+	Reverse open arrow	Обратная открытая стрелка
+	Reverse closed arrow	Обратная закрытая стрелка
+	Slash	Косая черта
 	Modified	Изменено
 	No status has been set.	Статус не установлен.
 	Compare Files	Сравнить файлы
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 28c6e24c..9014a0ae 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2023,6 +2023,12 @@ action wizard	Start	ప్రారంభించు
 	Pin folder to Home…	ఫోల్డర్‌ను హోమ్‌కు పిన్ చేయి…
 	No recent files	ఇటీవలి ఫైళ్లు లేవు
 	Go to page…	పేజీకి వెళ్లు…
+	Open arrow	తెరిచిన బాణం
+	Closed arrow	మూసిన బాణం
+	Butt	మొండి చివర
+	Reverse open arrow	తిరగబెట్టిన తెరిచిన బాణం
+	Reverse closed arrow	తిరగబెట్టిన మూసిన బాణం
+	Slash	వాలు గీత
 	Date format	తేదీ ఫార్మాట్
 	Fill & Sign dates	నింపడం & సంతకం తేదీలు
 	Pattern	నమూనా
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 227e0526..57075537 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2108,6 +2108,12 @@ calendar date	December	грудня
 	H / Space (hold)	H / Пробіл (утримувати)
 	Rotation:	Поворот:
 	Line ending	Закінчення лінії
+	Open arrow	Відкрита стрілка
+	Closed arrow	Закрита стрілка
+	Butt	Торець
+	Reverse open arrow	Зворотна відкрита стрілка
+	Reverse closed arrow	Зворотна закрита стрілка
+	Slash	Коса риска
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартні шрифти не можуть відобразити «{c}» ({code}). Поки що як текст можна додавати лише західноєвропейські символи.
 	Larger pages	Більші сторінки
 	Smaller pages	Менші сторінки
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 43b30a92..c5832767 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -618,6 +618,12 @@
 	Icon	图标
 	Thickness	粗细
 	Line ending	线条端点
+	Open arrow	开口箭头
+	Closed arrow	闭合箭头
+	Butt	平头
+	Reverse open arrow	反向开口箭头
+	Reverse closed arrow	反向闭合箭头
+	Slash	斜线
 	Modified	修改时间
 	No status has been set.	尚未设置状态。
 	Compare Files	比较文件
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 09183f07..9d51dfe9 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1974,6 +1974,12 @@
 	Go to page…	轉到頁面…
 	Reopen the files that were open when PdfCraft last closed	重新開啟上次關閉 PdfCraft 時開啟的檔案
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準字型無法顯示「{c}」（{code}）。目前只能新增西歐字元作為文字。
+	Open arrow	開口箭頭
+	Closed arrow	閉合箭頭
+	Butt	平頭
+	Reverse open arrow	反向開口箭頭
+	Reverse closed arrow	反向閉合箭頭
+	Slash	斜線
 	Larger pages	放大頁面
 	Smaller pages	縮小頁面
 	Reset page size	重設頁面大小
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index 2544eeb3..cc3b6e82 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -271,6 +271,15 @@ fn line_ending_properties_change_and_undo() {
     h.state_mut().open_comment_props(0, 0);
     h.run_steps(2);
     h.get_by_label("Line ending");
+    h.query_all_by_value("None").next().expect("start ending").click();
+    h.run_steps(2);
+    for label in ["Open arrow", "Closed arrow", "Butt", "Reverse open arrow", "Reverse closed arrow", "Slash", "Square", "Circle", "Diamond"] {
+        h.get_by_label(label);
+    }
+    assert_eq!(h.query_all_by_label("ROpenArrow").count(), 0);
+    assert_eq!(h.query_all_by_label("OpenArrow").count(), 0);
+    h.get_by_label("None").click();
+    h.run_steps(1);
     {
         let d = h.state_mut().comment_props.as_mut().expect("open");
         assert_eq!(d.edited.endings.as_deref(), Some(&[pdfcraft_engine::LineEnding::None, pdfcraft_engine::LineEnding::None][..]));

From caeec49f5ed3626ea604c2650253ec6b09aa7252 Mon Sep 17 00:00:00 2001
From: Tevinhead <barrett.wallace@gmail.com>
Date: Sat, 10 Oct 2026 05:52:13 +0700
Subject: [PATCH 139/149] M3: keep late startup URLs from changing the active
 document (#583)

Co-authored-by: Tevinhead <173904641+Tevinhead@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                      |   3 +
 apps/pdfcraft-web/src/main.rs   |   2 +-
 crates/ui-egui/src/lib.rs       | 101 ++++++++++----
 crates/ui-egui/tests/pickers.rs | 226 ++++++++++++++++++++++++++++++++
 packaging/web/README.md         |   5 +
 parity/acrobat-features.toml    |   4 +-
 6 files changed, 316 insertions(+), 25 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 5152c5bb..aa9c3010 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -96,6 +96,7 @@ Hours are for a single agent (low–high). "Done" is the estimated fraction of t
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
 | M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
+| M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; late browser startup downloads preserve the current document and Save target (#171). |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize. Missing: Replace pages, page transitions, recovery on the web |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M6 | Forms + JavaScript | 160–320 | 45% | 95–185 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
@@ -129,6 +130,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 ## Log
 
 - **2026-10-09 (M5, line-ending labels):** Comment properties names each line ending in words ("Reverse open arrow", "Butt", …) and those labels are translated. The PDF `/LE` token is unchanged. Overall estimate unchanged (about 30–35%).
+- **2026-10-09 (M3, #171):** A browser startup `?file=` download opens in a background tab once the user has started working, so it cannot switch the active document or the next Save. Deliberate opens still activate their tab; Home, Combine files, workspace choices and another file's password prompt are preserved. Initial-view geometry is applied to the background document, and its script notices wait until its tab is selected. Synthetic shell tests cover the race, saving the local edit, tab switching, encrypted arrivals, errors and converted text. Milestone and overall effort estimates unchanged (about 30–35%).
+
 - **2026-10-09 (M5, line endings):** Lines, connected lines and callouts draw all ten standard line-ending styles. `comment_add` accepts `endings`, and Comment properties can change them in one undo step. An unknown name is left undrawn, and a non-finite direction is rejected. Cloudy borders remain polygon-only, so `comment.line-endings` stays partial. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, JPX sample normalization):** JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).
diff --git a/apps/pdfcraft-web/src/main.rs b/apps/pdfcraft-web/src/main.rs
index 6fb56469..1899c298 100644
--- a/apps/pdfcraft-web/src/main.rs
+++ b/apps/pdfcraft-web/src/main.rs
@@ -29,7 +29,7 @@ fn main() {
                     }
                     // `?file=<url>` opens a PDF from a URL (same-origin or CORS-enabled).
                     if let Some(url) = query_param("file") {
-                        let inbox = app.inbox.clone();
+                        let inbox = app.startup_inbox.clone();
                         let failed = app.failed_inbox.clone();
                         let ctx = cc.egui_ctx.clone();
                         wasm_bindgen_futures::spawn_local(async move {
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 6694c4f4..1e88c2a4 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -343,6 +343,8 @@ pub struct PasswordPrompt {
     pub bytes: std::sync::Arc<Vec<u8>>,
     pub input: String,
     pub error: Option<String>,
+    /// A late startup file must stay in the background even after it is unlocked.
+    activate: bool,
 }
 
 #[derive(serde::Serialize, serde::Deserialize)]
@@ -412,6 +414,10 @@ pub struct PdfCraftApp {
     pub full_screen: bool,
     /// Files delivered asynchronously (web drag-and-drop, web file picker).
     pub inbox: Inbox,
+    /// The browser's startup `?file=` download. Unlike a deliberate Open or drop, a late
+    /// arrival opens in the background once the user has started working (#171).
+    pub startup_inbox: Inbox,
+    startup_superseded: bool,
     /// Asynchronous opens that failed (web `?file=` fetches), shown as a notice.
     pub failed_inbox: FailedInbox,
     /// Requests from the operating system, polled every frame (macOS Apple events).
@@ -656,6 +662,8 @@ impl PdfCraftApp {
             password_prompt: None,
             full_screen: false,
             inbox: Default::default(),
+            startup_inbox: Default::default(),
+            startup_superseded: false,
             failed_inbox: Default::default(),
             os_events: None,
             close_request: None,
@@ -766,12 +774,14 @@ impl PdfCraftApp {
     fn apply_initial_view(&mut self, index: usize, v: &pdfcraft_engine::InitialView) {
         use pdfcraft_engine::{InitialLayout as L, Magnification as M, Navigation as N};
         let pages = self.session.get(self.views[index].id).map_or(0, |d| d.info.pages.len());
-        match v.navigation {
-            N::PageOnly => {}
-            N::Bookmarks => self.right = Some(RightPanel::Bookmarks),
-            N::Pages => self.right = Some(RightPanel::Pages),
-            N::Attachments => self.right = Some(RightPanel::Attachments),
-            N::Layers => self.right = Some(RightPanel::Layers),
+        if self.active == Some(index) {
+            match v.navigation {
+                N::PageOnly => {}
+                N::Bookmarks => self.right = Some(RightPanel::Bookmarks),
+                N::Pages => self.right = Some(RightPanel::Pages),
+                N::Attachments => self.right = Some(RightPanel::Attachments),
+                N::Layers => self.right = Some(RightPanel::Layers),
+            }
         }
         let view = &mut self.views[index];
         match v.layout {
@@ -801,21 +811,37 @@ impl PdfCraftApp {
 
     /// Open a document and make it the active tab. Encrypted files raise the password prompt.
     pub fn open_bytes(&mut self, name: &str, path: Option<String>, bytes: Vec<u8>) -> Result<(), String> {
-        // Images and text files become new, unsaved PDFs (Create a PDF).
-        if let Some(r) = self.open_converted(name, &bytes) {
-            return r;
-        }
-        self.try_open(name, path, std::sync::Arc::new(bytes), None)
+        self.startup_superseded = true;
+        self.open_bytes_with_focus(name, path, bytes, true)
     }
 
-    fn try_open(&mut self, name: &str, path: Option<String>, bytes: std::sync::Arc<Vec<u8>>, password: Option<&str>) -> Result<(), String> {
+    fn open_bytes_with_focus(&mut self, name: &str, path: Option<String>, bytes: Vec<u8>, activate: bool) -> Result<(), String> {
+        // Images and text files become new, unsaved PDFs (Create a PDF).
+        let active = self.active;
+        if let Some(r) = self.open_converted(name, &bytes) {
+            if !activate {
+                self.active = active;
+            }
+            return r;
+        }
+        self.try_open(name, path, std::sync::Arc::new(bytes), None, activate)
+    }
+
+    fn try_open(
+        &mut self,
+        name: &str,
+        path: Option<String>,
+        bytes: std::sync::Arc<Vec<u8>>,
+        password: Option<&str>,
+        activate: bool,
+    ) -> Result<(), String> {
         use pdfcraft_render::OpenError;
         let size = bytes.len();
         let id = match self.session.open(name, path.clone(), bytes.clone(), password) {
             Ok(id) => id,
             Err(e @ (OpenError::NeedsPassword | OpenError::WrongPassword)) => {
                 let error = matches!(e, OpenError::WrongPassword).then(|| "Incorrect password. Try again.".to_string());
-                self.password_prompt = Some(PasswordPrompt { name: name.to_string(), path, bytes, input: String::new(), error });
+                self.password_prompt = Some(PasswordPrompt { name: name.to_string(), path, bytes, input: String::new(), error, activate });
                 return Ok(());
             }
             Err(e) => return Err(e.to_string()),
@@ -824,7 +850,7 @@ impl PdfCraftApp {
         let doc = self.session.get(id).ok_or("the document could not be opened")?;
         let pages = doc.info.pages.len();
         // Acrobat opens straight to the Comments panel when a document has comments.
-        if self.right.is_none() {
+        if activate && self.right.is_none() {
             self.right = if !doc.info.annotations.is_empty() {
                 Some(RightPanel::Comments)
             } else if !doc.info.outline.is_empty() {
@@ -835,12 +861,14 @@ impl PdfCraftApp {
         }
         let initial = doc.initial_view();
         self.views.push(DocView::new(id, &doc.info, self.view_defaults));
-        self.active = Some(self.views.len() - 1);
+        if activate {
+            self.active = Some(self.views.len() - 1);
+        }
         self.apply_initial_view(self.views.len() - 1, &initial);
-        if let Some(mode) = self.mode_override {
+        if activate && let Some(mode) = self.mode_override {
             // Explicit mode options do not reset independent --tool / --left choices.
             self.mode = mode;
-        } else if self.mode != self.default_mode {
+        } else if activate && self.mode != self.default_mode {
             // Switch workspace like the mode bar, but a left panel the user (or `--left closed`)
             // closed stays closed, and an unchanged mode keeps the tool panel the user chose.
             let left_open = self.left_open;
@@ -854,8 +882,12 @@ impl PdfCraftApp {
         }
         // What the form's scripts said while it opened (messages, errors) shows now, not with
         // the next edit.
-        let out = self.session.take_js_output(id);
-        self.handle_js(id, out);
+        // Background documents keep their script output until their tab is selected: a print
+        // or save request must never act on the current document instead.
+        if activate {
+            let out = self.session.take_js_output(id);
+            self.handle_js(id, out);
+        }
         Ok(())
     }
 
@@ -930,6 +962,7 @@ impl PdfCraftApp {
     /// Browsers read dropped files asynchronously; the bytes land in `inbox` and open next frame.
     #[cfg(target_arch = "wasm32")]
     fn open_dropped(&mut self, f: egui::DroppedFileHandle, ctx: &egui::Context) {
+        self.startup_superseded = true;
         let inbox = self.inbox.clone();
         let ctx = ctx.clone();
         wasm_bindgen_futures::spawn_local(async move {
@@ -990,10 +1023,11 @@ impl PdfCraftApp {
     pub fn submit_password(&mut self, password: Option<String>) {
         let Some(p) = self.password_prompt.take() else { return };
         let Some(pw) = password else { return };
-        match self.try_open(&p.name, p.path, p.bytes, Some(&pw)) {
+        match self.try_open(&p.name, p.path, p.bytes, Some(&pw), p.activate) {
             Err(e) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &p.name), ("e", &e.to_string())]),
-            // A recovered encrypted document is open once the prompt is gone.
-            Ok(()) if self.password_prompt.is_none() => {
+            // A recovered encrypted document is open once its foreground prompt is gone.
+            // Unlocking a background startup file must not finish another file's recovery.
+            Ok(()) if p.activate && self.password_prompt.is_none() => {
                 if let Some(meta) = self.pending_recovered.clone() {
                     self.finish_recovery(&meta);
                 }
@@ -1027,6 +1061,7 @@ impl PdfCraftApp {
     }
 
     pub fn open_dialog(&mut self) {
+        self.startup_superseded = true;
         #[cfg(not(target_arch = "wasm32"))]
         self.pick(
             pickers::PickFor::Open,
@@ -1685,6 +1720,8 @@ impl eframe::App for PdfCraftApp {
             }
         }
         self.sync_theme(ctx);
+        // Remember user work even if its tab is subsequently closed or Home is selected.
+        self.startup_superseded |= !self.views.is_empty() || self.combine_showing() || self.dialog.is_some() || self.password_prompt.is_some();
         // Before taking this frame's drop: the grid must be drawn once with the pointer where
         // the files were let go before the gap is read.
         self.finish_grid_drop(ctx);
@@ -1711,6 +1748,22 @@ impl eframe::App for PdfCraftApp {
                 self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
             }
         }
+        // Don't replace a pending prompt or import. A startup file may need its own password
+        // prompt, so its bytes stay queued until the current interaction finishes.
+        if self.password_prompt.is_none()
+            && self.image_import.is_none()
+            && self.dialog.is_none()
+            && self.close_request.is_none()
+            && self.pending_link.is_none()
+        {
+            let startup = self.startup_inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
+            for (name, bytes) in startup {
+                let activate = !self.startup_superseded;
+                if let Err(e) = self.open_bytes_with_focus(&name, None, bytes, activate) {
+                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e)]);
+                }
+            }
+        }
         let failed: Vec<(String, String)> = self.failed_inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
         for (name, e) in failed {
             self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e)]);
@@ -1726,6 +1779,10 @@ impl eframe::App for PdfCraftApp {
                 OsEvent::Quit => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
             }
         }
+        if let Some((_, id)) = self.active_ids() {
+            let out = self.session.take_js_output(id);
+            self.handle_js(id, out);
+        }
         if let Some(mut control) = self.control.take() {
             control.tick(ctx, self);
             self.control = Some(control);
diff --git a/crates/ui-egui/tests/pickers.rs b/crates/ui-egui/tests/pickers.rs
index fb0103f4..e29fcf46 100644
--- a/crates/ui-egui/tests/pickers.rs
+++ b/crates/ui-egui/tests/pickers.rs
@@ -424,3 +424,229 @@ fn a_failed_startup_url_is_reported_in_the_app() {
     assert!(h.state().views.is_empty(), "no document was opened");
     assert!(failed.lock().unwrap().is_empty(), "each failure is reported once");
 }
+
+fn deliver_startup(h: &Harness<'static, PdfCraftApp>, name: &str, bytes: Vec<u8>) {
+    h.state().startup_inbox.lock().unwrap().push((name.into(), bytes));
+}
+
+#[test]
+fn a_startup_url_opens_in_front_when_the_user_has_not_started_working() {
+    let mut h = harness(&[]);
+    deliver_startup(&h, "startup.pdf", fixture(2));
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(0));
+    assert_eq!(pages(h.state(), 0), 2);
+    assert!(h.state().startup_inbox.lock().unwrap().is_empty());
+    h.run_steps(2);
+    assert_eq!(h.state().views.len(), 1, "the arrival opens once");
+}
+
+#[test]
+fn a_late_startup_url_preserves_the_current_edit_workspace_and_save_target() {
+    use pdfcraft_engine::{Edit, InitialView, Magnification, Navigation, Session};
+    use pdfcraft_ui_egui::{LeftPanel, Mode, QuickTool, RightPanel};
+
+    // A downloaded PDF can ask to show a different panel and magnification. Its own view
+    // should honour those settings without taking the user's workspace away.
+    let mut s = Session::new();
+    let id = s.open("late.pdf", None, std::sync::Arc::new(fixture(1)), None).unwrap();
+    let initial = InitialView { navigation: Navigation::Bookmarks, magnification: Magnification::Percent(175.0), ..Default::default() };
+    s.apply(id, Edit::SetInitialView(Box::new(initial))).unwrap();
+    let late = s.save_bytes(id).unwrap().as_ref().clone();
+
+    let mut h = harness(&[3]);
+    let active = h.state().active_ids().unwrap().1;
+    h.state_mut().apply_edit(Edit::DeletePages { pages: vec![1] });
+    h.state_mut().mode = Mode::Edit;
+    h.state_mut().right = Some(RightPanel::Pages);
+    h.state_mut().left = LeftPanel::AllTools;
+    h.state_mut().left_open = false;
+    h.state_mut().quick_tool = QuickTool::Hand;
+    deliver_startup(&h, "late.pdf", late);
+    h.run_steps(2);
+
+    assert_eq!(h.state().active_ids().unwrap().1, active, "Save still targets the user's document");
+    assert_eq!(h.state().mode, Mode::Edit);
+    assert_eq!(h.state().right, Some(RightPanel::Pages));
+    assert_eq!(h.state().left, LeftPanel::AllTools);
+    assert!(!h.state().left_open);
+    assert_eq!(h.state().quick_tool, QuickTool::Hand);
+    assert!(dirty(h.state(), 0));
+    assert_eq!(h.state().views.len(), 2, "the startup file remains available in its own tab");
+    assert_eq!(h.state().views[1].zoom, 1.75);
+
+    let dir = scratch("startup-save");
+    let path = dir.join("saved.pdf");
+    h.state_mut().save_override = Some(path.to_string_lossy().into_owned());
+    assert!(h.state_mut().execute("file.save"));
+    h.run_steps(2);
+    let saved = PageRenderer::new(std::sync::Arc::new(std::fs::read(&path).unwrap()), Default::default());
+    assert_eq!(saved.page_count(), 2, "the saved file contains the local deletion");
+    assert!(!dirty(h.state(), 0), "the local document was saved, not the startup document");
+
+    h.get_by_label("late.pdf").click();
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(1), "the user can choose the downloaded tab");
+    h.get_by_label("saved.pdf").click();
+    h.run_steps(2);
+    assert_eq!(pages(h.state(), 0), 2, "the edit survives switching back");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_late_startup_url_preserves_home_even_after_all_other_tabs_are_closed() {
+    for close in [false, true] {
+        let mut h = harness(&[3]);
+        if close {
+            h.state_mut().close_tab(0);
+        } else {
+            h.get_by_label("Home").click();
+            h.run_steps(2);
+        }
+        assert_eq!(h.state().active, None);
+        deliver_startup(&h, "late.pdf", fixture(1));
+        h.run_steps(2);
+        assert_eq!(h.state().active, None, "Home stays selected (closed tabs: {close})");
+        h.get_by_label_contains("Welcome to PdfCraft");
+        h.get_by_label("late.pdf").click();
+        h.run_steps(2);
+        assert!(h.state().active.is_some());
+    }
+}
+
+#[test]
+fn deliberate_browser_file_opens_still_activate_the_new_tab() {
+    let mut h = harness(&[3]);
+    h.state().inbox.lock().unwrap().push(("picked.pdf".into(), fixture(2)));
+    deliver_startup(&h, "late.pdf", fixture(1));
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(1), "a deliberate Open wins even on the same frame");
+    assert_eq!(pages(h.state(), 1), 2);
+    assert_eq!(h.state().views.len(), 3);
+}
+
+#[test]
+fn opening_a_file_picker_supersedes_the_startup_url_even_if_the_picker_is_cancelled() {
+    let mut h = harness(&[]);
+    h.state_mut().pick_override = Some(vec![]);
+    h.state_mut().execute("file.open");
+    deliver_startup(&h, "late.pdf", fixture(1));
+    h.run_steps(2);
+    assert_eq!(h.state().active, None, "the startup file doesn't replace the user's newer Open action");
+    assert_eq!(h.state().views.len(), 1, "it is still available as a background tab");
+}
+
+#[test]
+fn a_broken_late_startup_file_reports_its_error_without_changing_the_active_document() {
+    let mut h = harness(&[3]);
+    deliver_startup(&h, "broken.pdf", b"not a PDF".to_vec());
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(0));
+    assert_eq!(h.state().views.len(), 1);
+    let toast = &h.state().toast.as_ref().unwrap().0;
+    assert!(toast.contains("broken.pdf"), "{toast}");
+    assert!(h.state().startup_inbox.lock().unwrap().is_empty());
+}
+
+fn encrypted_fixture() -> Vec<u8> {
+    use pdfcraft_engine::{Edit, Protection, Session};
+    let mut s = Session::new();
+    let id = s.open("encrypted.pdf", None, std::sync::Arc::new(fixture(1)), None).unwrap();
+    s.apply(id, Edit::Protect(Protection { open_password: Some("test-password".into()), ..Default::default() })).unwrap();
+    s.save_bytes(id).unwrap().as_ref().clone()
+}
+
+#[test]
+fn a_startup_url_does_not_replace_another_documents_password_prompt() {
+    for cancel in [false, true] {
+        let mut h = harness(&[]);
+        h.state_mut().open_bytes("local-encrypted.pdf", None, encrypted_fixture()).unwrap();
+        deliver_startup(&h, "late.pdf", fixture(2));
+        h.run_steps(2);
+        assert_eq!(h.state().password_prompt.as_ref().unwrap().name, "local-encrypted.pdf");
+        assert!(h.state().views.is_empty());
+        assert_eq!(h.state().startup_inbox.lock().unwrap().len(), 1, "startup bytes wait for the prompt");
+        h.state_mut().submit_password((!cancel).then(|| "test-password".into()));
+        h.run_steps(2);
+        assert!(h.state().password_prompt.is_none());
+        assert!(h.state().startup_inbox.lock().unwrap().is_empty());
+        assert_eq!(h.state().active, if cancel { None } else { Some(0) });
+        assert_eq!(h.state().views.len(), if cancel { 1 } else { 2 });
+    }
+}
+
+#[test]
+fn unlocking_a_late_startup_url_keeps_it_in_the_background() {
+    let mut h = harness(&[3]);
+    deliver_startup(&h, "late-encrypted.pdf", encrypted_fixture());
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(0));
+    assert_eq!(h.state().password_prompt.as_ref().unwrap().name, "late-encrypted.pdf");
+    h.state_mut().submit_password(Some("wrong-password".into()));
+    h.run_steps(2);
+    assert!(h.state().password_prompt.as_ref().unwrap().error.is_some());
+    assert_eq!(h.state().active, Some(0));
+    h.state_mut().submit_password(Some("test-password".into()));
+    h.run_steps(2);
+    assert!(h.state().password_prompt.is_none());
+    assert_eq!(h.state().active, Some(0));
+    assert_eq!(h.state().views.len(), 2);
+    h.get_by_label("late-encrypted.pdf").click();
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(1));
+}
+
+#[test]
+fn a_late_startup_url_preserves_the_combine_files_tab() {
+    let mut h = harness(&[]);
+    h.state_mut().open_combine_tab();
+    h.run_steps(2);
+    deliver_startup(&h, "late.pdf", fixture(1));
+    h.run_steps(2);
+    assert!(h.state().combine_showing());
+    assert_eq!(h.state().active, None);
+    assert_eq!(h.state().views.len(), 1);
+}
+
+#[test]
+fn a_late_startup_url_waits_for_an_existing_dialog_to_close() {
+    let mut h = harness(&[3]);
+    h.state_mut().dialog = Some(pdfcraft_ui_egui::Dialog::Preferences);
+    deliver_startup(&h, "late.pdf", fixture(1));
+    h.run_steps(2);
+    assert_eq!(h.state().dialog, Some(pdfcraft_ui_egui::Dialog::Preferences));
+    assert_eq!(h.state().views.len(), 1);
+    assert_eq!(h.state().startup_inbox.lock().unwrap().len(), 1);
+    h.state_mut().dialog = None;
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(0));
+    assert_eq!(h.state().views.len(), 2);
+    assert!(h.state().startup_inbox.lock().unwrap().is_empty());
+}
+
+#[test]
+fn a_late_startup_text_file_is_still_converted_without_stealing_focus() {
+    let mut h = harness(&[3]);
+    deliver_startup(&h, "late.txt", b"A downloaded text file".to_vec());
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(0));
+    assert_eq!(h.state().views.len(), 2);
+    assert_eq!(pages(h.state(), 1), 1);
+}
+
+#[test]
+fn a_background_startup_forms_script_notice_waits_until_its_tab_is_selected() {
+    let template = pdfcraft_xfa::fixtures::scripted_template()
+        .replace("if (qty.rawValue === null) qty.rawValue = 2;", r#"xfa.host.messageBox("Late form opened");"#);
+    let mut h = harness(&[3]);
+    deliver_startup(&h, "late-form.pdf", pdfcraft_xfa::fixtures::shell(&template));
+    h.run_steps(2);
+    assert_eq!(h.state().active, Some(0));
+    assert!(h.state().toast.is_none(), "the background form must not interrupt the current document");
+    h.get_by_label("late-form.pdf").click();
+    h.run_steps(2);
+    assert_eq!(h.state().toast.as_ref().unwrap().0, "Late form opened");
+    h.state_mut().toast = None;
+    h.run_steps(2);
+    assert!(h.state().toast.is_none(), "the notice is delivered once");
+}
diff --git a/packaging/web/README.md b/packaging/web/README.md
index 20ed886a..7aaa49d6 100644
--- a/packaging/web/README.md
+++ b/packaging/web/README.md
@@ -19,6 +19,11 @@ so the site works at a domain root (`https://example.com/`), under a prefix
 (`https://example.com/tools/pdfcraft/`) and from a CDN bucket. The asset names carry a content
 hash, so they can be cached forever. Only `index.html` needs revalidation.
 
+Add `?file=<URL-encoded document URL>` to open a PDF on startup. The document must be served
+from the same origin or allow the app's origin through CORS. If the user starts working before
+the download finishes, the downloaded file opens in a background tab; the current document,
+workspace and Save target stay selected. Click the downloaded file's tab to switch to it.
+
 ## Required server settings
 
 - **MIME type:** serve `.wasm` as `application/wasm`. Browsers refuse to stream-compile it under
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index a34d16d9..bbe7b097 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1778,8 +1778,8 @@ milestone = "M3"
 status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = "web build works; IndexedDB/OPFS recent list and download flow are M3.10"
+evidence = ["crates/ui-egui/tests/pickers.rs::a_startup_url_opens_in_front_when_the_user_has_not_started_working", "crates/ui-egui/tests/pickers.rs::a_late_startup_url_preserves_the_current_edit_workspace_and_save_target", "crates/ui-egui/tests/pickers.rs::deliberate_browser_file_opens_still_activate_the_new_tab"]
+notes = "web build works; a late startup ?file= download opens in a background tab after the user starts working, preserving the active document and Save target (#171). IndexedDB/OPFS recent list and download flow are M3.10"
 
 [[feature]]
 id = "view.large-document-performance"

From 04f6b1a634c17ef55d8e6707e83271154c6dae5c Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Sat, 10 Oct 2026 00:53:42 +0200
Subject: [PATCH 140/149] M2: bound PDF functions and reject invalid calculator
 operations (#581)

Limit function construction and calculator work, detect path cycles, and handle input-derived integer and stack errors through the existing optional failure path.

Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ROADMAP.md                                   |   2 +
 crates/render/src/raster.rs                  | 189 ++++++++++++++
 vendor/README.md                             |   2 +-
 vendor/hayro-interpret/README.md             |  19 +-
 vendor/hayro-interpret/src/function/mod.rs   |  61 ++++-
 vendor/hayro-interpret/src/function/type3.rs |  73 +++++-
 vendor/hayro-interpret/src/function/type4.rs | 259 ++++++++++++++++---
 7 files changed, 556 insertions(+), 49 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index aa9c3010..80a4f931 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -182,6 +182,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (M14, German interface follow-up):** Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.
 
+- **2026-10-09 (M2, PDF-function hardening):** Vendored function construction has a shared 64-level/10,000-node limit and path cycle detection; calculator parsing and evaluation have shared depth/work budgets. Calculator integer division, logical shifts, rotations and indices avoid input-driven panics, and fixed-size stack errors propagate. Synthetic tests exercise exact/over limits, shared children and cyclic references, with invalid shading calculations preserving later page content. Limits return the existing optional failure and log their reason when logging is enabled. Milestone/overall effort estimates remain unchanged (about 30–35%).
+
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (community, M14, Hungarian):** Magyar (`hu`) is a complete interface catalog (2,036 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `hu` and `hu_HU`, and from Preferences. Informal "te"; commands are nouns (Mentés, Megnyitás). After a numeral the noun stays singular, so both plural forms match. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover Hungarian diacritics including ő and ű. Overall estimate unchanged (about 30–35%).
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 7eec3ad6..bce9fefb 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1178,6 +1178,195 @@ mod tests {
         }
     }
 
+    /// Public-API regressions run in normal workspace CI; dependency unit tests do not.
+    fn function_limits_calculator_eval(program: &str) -> Option<Vec<f32>> {
+        use hayro::hayro_interpret::Function;
+        use hayro_syntax::object::{FromBytes, Object};
+        let data = format!("<< /FunctionType 4 /Domain [] /Length {} >> stream\n{program}\nendstream", program.len());
+        let object = Object::from_bytes(data.as_bytes()).unwrap();
+        Function::new(&object)?.eval(Default::default()).map(|values| values.to_vec())
+    }
+
+    #[test]
+    fn function_limits_idiv_zero_is_refused() {
+        assert!(function_limits_calculator_eval("{ 1 0 idiv }").is_none());
+    }
+
+    #[test]
+    fn function_limits_idiv_overflow_is_refused() {
+        assert!(function_limits_calculator_eval("{ -2147483648 -1 idiv }").is_none());
+    }
+
+    #[test]
+    fn function_limits_large_logical_shifts_discard_all_bits() {
+        for shift in [32, -32, 2147483647, -2147483648] {
+            assert_eq!(function_limits_calculator_eval(&format!("{{ 7 {shift} bitshift }}")), Some(vec![0.0]));
+        }
+        assert_eq!(function_limits_calculator_eval("{ 1073741824 1 bitshift }"), Some(vec![-2147483648.0]));
+        assert_eq!(function_limits_calculator_eval("{ -2147483648 -1 bitshift }"), Some(vec![1073741824.0]));
+    }
+
+    #[test]
+    fn function_limits_rotation_accepts_the_most_negative_integer() {
+        assert_eq!(function_limits_calculator_eval("{ 1 2 3 3 -2147483648 roll }"), Some(vec![3.0, 1.0, 2.0]));
+    }
+
+    #[test]
+    fn function_limits_large_indices_are_refused() {
+        assert!(function_limits_calculator_eval("{ 1 4294967295 index }").is_none());
+    }
+
+    #[test]
+    fn function_limits_operand_stack_boundary() {
+        assert_eq!(function_limits_calculator_eval(&format!("{{ 1 {} }}", "dup ".repeat(63))).unwrap().len(), 64);
+        assert!(function_limits_calculator_eval(&format!("{{ 1 {} }}", "dup ".repeat(64))).is_none());
+    }
+
+    #[test]
+    fn function_limits_calculator_arithmetic_and_depth() {
+        for (program, expected) in [
+            ("{ -5 2 idiv }", vec![-2.0]),
+            ("{ 7 3 bitshift }", vec![56.0]),
+            ("{ 142 -3 bitshift }", vec![17.0]),
+            ("{ 1 2 3 3 -1 roll }", vec![2.0, 3.0, 1.0]),
+        ] {
+            assert_eq!(function_limits_calculator_eval(program), Some(expected));
+        }
+        let mut program = "{ 0 }".to_owned();
+        for _ in 1..64 {
+            program = format!("{{ true {program} if }}");
+        }
+        assert_eq!(function_limits_calculator_eval(&program), Some(vec![0.0]));
+        assert!(function_limits_calculator_eval(&format!("{{ true {program} if }}")).is_none());
+    }
+
+    #[test]
+    fn function_limits_calculator_work_boundary() {
+        // With no loops, each admitted operator can execute at most once. The exact parse
+        // boundary can be evaluated, while construction rejects the next operator.
+        assert_eq!(function_limits_calculator_eval(&format!("{{ {} }}", "0 pop ".repeat(5000))), Some(vec![]));
+        assert!(function_limits_calculator_eval(&format!("{{ {} 0 }}", "0 pop ".repeat(5000))).is_none());
+    }
+
+    #[test]
+    fn function_limits_calculator_work_counts_unselected_branches() {
+        // 9,996 branch operators + two procedure openings + true + ifelse = 10,000 tokens.
+        let branch = "0 pop ".repeat(2499);
+        assert_eq!(function_limits_calculator_eval(&format!("{{ true {{ {branch} }} {{ {branch} }} ifelse }}")), Some(vec![]));
+        assert!(function_limits_calculator_eval(&format!("{{ true {{ {branch} }} {{ {branch} 0 }} ifelse }}")).is_none());
+    }
+    #[test]
+    fn function_limits_public_construction_work_and_depth() {
+        use hayro::hayro_interpret::Function;
+        use hayro_syntax::object::{FromBytes, Object};
+
+        let mut data = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >>".to_owned();
+        for _ in 1..64 {
+            data = format!("<< /FunctionType 3 /Domain [0 1] /Functions [{data}] /Bounds [] /Encode [0 1] >>");
+        }
+        let object = Object::from_bytes(data.as_bytes()).unwrap();
+        assert_eq!(Function::new(&object).unwrap().eval([0.5].into_iter().collect()).unwrap().as_slice(), &[0.5]);
+        let over = format!("<< /FunctionType 3 /Domain [0 1] /Functions [{data}] /Bounds [] /Encode [0 1] >>");
+        assert!(Function::new(&Object::from_bytes(over.as_bytes()).unwrap()).is_none());
+
+        // One root plus 10,000 leaves is one node past the common budget. This input remains
+        // below a megabyte and does not attempt excessive recursion or an allocation failure.
+        let leaf = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> ";
+        for children in [9999, 10_000] {
+            let data = format!(
+                "<< /FunctionType 3 /Domain [0 1] /Functions [{}] /Bounds [{}] /Encode [{}] >>",
+                leaf.repeat(children),
+                "0.5 ".repeat(children - 1),
+                "0 1 ".repeat(children)
+            );
+            let object = Object::from_bytes(data.as_bytes()).unwrap();
+            assert_eq!(Function::new(&object).is_some(), children == 9999);
+        }
+    }
+    #[test]
+    fn function_limits_stitching_cycles_are_refused_and_shared_children_work() {
+        use hayro::hayro_interpret::Function;
+        use hayro_syntax::object::{Object, ObjectIdentifier};
+
+        let pdf = |functions: &str| {
+            hayro_syntax::Pdf::new(
+                format!(
+                    "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
+             {functions}\ntrailer << /Root 1 0 R >>\n%%EOF"
+                )
+                .into_bytes(),
+            )
+            .unwrap()
+        };
+        for functions in [
+            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [4 0 R] /Bounds [] /Encode [0 1] >> endobj",
+            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R] /Bounds [] /Encode [0 1] >> endobj\n5 0 obj << /FunctionType 3 /Domain [0 1] /Functions [4 0 R] /Bounds [] /Encode [0 1] >> endobj",
+            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [] /Bounds [] /Encode [] >> endobj",
+            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [99 0 R] /Bounds [] /Encode [0 1] >> endobj",
+            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R 99 0 R] /Bounds [0.5] /Encode [0 1 0 1] >> endobj\n5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj",
+        ] {
+            let parsed = pdf(functions);
+            let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+            assert!(Function::new(&object).is_none(), "accepted invalid children: {functions}");
+        }
+        let parsed = pdf(
+            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R 5 0 R] /Bounds [0.5] /Encode [0 1 0 1] >> endobj\n5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj",
+        );
+        let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+        let function = Function::new(&object).unwrap();
+        let output = function.eval([0.75].into_iter().collect()).unwrap();
+        assert!((output[0] - 0.5).abs() < 0.001);
+    }
+
+    #[test]
+    fn function_limits_shared_references_count_toward_construction_work() {
+        use hayro::hayro_interpret::Function;
+        use hayro_syntax::object::{Object, ObjectIdentifier};
+        for children in [9999, 10_000] {
+            let bytes = format!(
+                "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
+                 4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [{}] /Bounds [{}] /Encode [{}] >> endobj\n\
+                 5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+                "5 0 R ".repeat(children),
+                "0.5 ".repeat(children - 1),
+                "0 1 ".repeat(children)
+            )
+            .into_bytes();
+            let parsed = hayro_syntax::Pdf::new(bytes).unwrap();
+            let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+            assert_eq!(Function::new(&object).is_some(), children == 9999);
+        }
+    }
+    #[test]
+    fn function_limits_invalid_calculator_keeps_the_page_renderable() {
+        use super::*;
+        let program = "{ pop 1 0 idiv }";
+        let content = "/S sh 0 0 1 rg 0 0 20 20 re f";
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Resources << /Shading << /S 4 0 R >> >> /Contents 6 0 R >> endobj\n\
+             4 0 obj << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 20 0] /Function 5 0 R >> endobj\n\
+             5 0 obj << /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >> stream\n{program}\nendstream endobj\n\
+             6 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+            program.len(),
+            content.len()
+        )
+        .into_bytes();
+        let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (20, 20));
+        let (pixels, remainder) = page.rgba.as_chunks::<4>();
+        assert!(remainder.is_empty());
+        assert!(pixels.iter().all(|pixel| *pixel == [0, 0, 255, 255]));
+    }
     #[test]
     fn watchdog_skips_a_stuck_page_and_keeps_rendering() {
         use super::*;
diff --git a/vendor/README.md b/vendor/README.md
index 6c06cdcd..baa1f23c 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -7,7 +7,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable` |
 
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
diff --git a/vendor/hayro-interpret/README.md b/vendor/hayro-interpret/README.md
index effd4459..6536284b 100644
--- a/vendor/hayro-interpret/README.md
+++ b/vendor/hayro-interpret/README.md
@@ -38,4 +38,21 @@ Licensed under either of
 - Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or <http://www.apache.org/licenses/LICENSE-2.0>)
 - MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
 
-at your option. 
+at your option.
+
+## PdfCraft function limits
+
+The PdfCraft patch rejects function construction after 64 nested functions or 10,000 total
+function nodes, including repeated references, and detects cycles on the current path. Shared
+children in different branches remain valid. Stitching functions reject empty or unresolved
+child lists instead of silently truncating them. Calculator functions have a shared limit of 64
+procedure levels and 10,000 parsed tokens (operators and procedure openings); evaluation has
+its own 10,000-operator limit across selected branches. These are implementation resource
+limits rather than PDF format limits. Rejection returns the existing `None`, and the optional
+`logging` feature reports the reason and limit; no new interface warning is introduced.
+
+Calculator integer division without an integer result is also rejected. Bit shifting discards
+bits beyond the 32-bit word and fills with zeroes, including logical right shifts of negative
+words; rotation accepts the full signed shift range without negating the minimum integer.
+Fixed-size operand and procedure-stack overflow errors propagate instead of truncating work.
+Normal function signatures and supported color/transfer-function behavior remain unchanged.
diff --git a/vendor/hayro-interpret/src/function/mod.rs b/vendor/hayro-interpret/src/function/mod.rs
index 89d25174..1258a4f9 100644
--- a/vendor/hayro-interpret/src/function/mod.rs
+++ b/vendor/hayro-interpret/src/function/mod.rs
@@ -22,6 +22,19 @@ use std::sync::Arc;
 pub(crate) type Values = SmallVec<[f32; 4]>;
 type TupleVec = SmallVec<[(f32, f32); 4]>;
 
+// PdfCraft patch: PDF functions are untrusted object graphs. A normal color/transfer function
+// has only a few nodes; cap both nesting and total construction work, including repeated
+// references, before creating their children. These are resource limits, not PDF format limits.
+const MAX_FUNCTION_DEPTH: usize = 64;
+const MAX_FUNCTION_NODES: usize = 10_000;
+
+struct ConstructionBudget {
+    remaining: usize,
+    // Stable backing-byte identity catches cycles without rejecting shared siblings. Looking
+    // at pointers only compares identities; no pointer is ever dereferenced.
+    path: Vec<(*const u8, usize)>,
+}
+
 #[derive(Debug)]
 enum FunctionType {
     Type0(Type0),
@@ -37,17 +50,45 @@ pub struct Function(Arc<FunctionType>);
 impl Function {
     /// Create a new function.
     pub fn new(obj: &Object<'_>) -> Option<Self> {
+        Self::new_inner(
+            obj,
+            &mut ConstructionBudget {
+                remaining: MAX_FUNCTION_NODES,
+                path: Vec::new(),
+            },
+            0,
+        )
+    }
+
+    fn new_inner(obj: &Object<'_>, budget: &mut ConstructionBudget, depth: usize) -> Option<Self> {
+        if depth >= MAX_FUNCTION_DEPTH {
+            warn!("PDF function nesting exceeds the limit of {MAX_FUNCTION_DEPTH} levels");
+            return None;
+        }
+        if budget.remaining == 0 {
+            warn!("PDF function construction exceeds the limit of {MAX_FUNCTION_NODES} nodes");
+            return None;
+        }
+        budget.remaining -= 1;
         let (dict, stream) = dict_or_stream(obj)?;
-
-        let function_type = match dict.get::<u8>(FUNCTION_TYPE)? {
-            0 => FunctionType::Type0(Type0::new(stream?)?),
-            2 => FunctionType::Type2(Type2::new(dict)?),
-            3 => FunctionType::Type3(Type3::new(dict)?),
-            4 => FunctionType::Type4(Type4::new(stream?)?),
-            _ => return None,
-        };
-
-        Some(Self(Arc::new(function_type)))
+        let identity = (dict.data().as_ptr(), dict.data().len());
+        if budget.path.contains(&identity) {
+            warn!("PDF function contains a cyclic stitching-function reference");
+            return None;
+        }
+        budget.path.push(identity);
+        let result = (|| {
+            let function_type = match dict.get::<u8>(FUNCTION_TYPE)? {
+                0 => FunctionType::Type0(Type0::new(stream?)?),
+                2 => FunctionType::Type2(Type2::new(dict)?),
+                3 => FunctionType::Type3(Type3::new(dict, budget, depth + 1)?),
+                4 => FunctionType::Type4(Type4::new(stream?)?),
+                _ => return None,
+            };
+            Some(Self(Arc::new(function_type)))
+        })();
+        budget.path.pop();
+        result
     }
 
     /// Evaluate the function with the given input.
diff --git a/vendor/hayro-interpret/src/function/type3.rs b/vendor/hayro-interpret/src/function/type3.rs
index f66fead1..2d3720d4 100644
--- a/vendor/hayro-interpret/src/function/type3.rs
+++ b/vendor/hayro-interpret/src/function/type3.rs
@@ -16,12 +16,34 @@ pub(crate) struct Type3 {
 
 impl Type3 {
     /// Create a new type 3 function.
-    pub(crate) fn new(dict: &Dict<'_>) -> Option<Self> {
+    pub(super) fn new(
+        dict: &Dict<'_>,
+        budget: &mut super::ConstructionBudget,
+        depth: usize,
+    ) -> Option<Self> {
         let clamper = Clamper::new(dict)?;
 
-        let functions = dict
-            .get::<Array<'_>>(FUNCTIONS)
-            .and_then(|d| d.iter::<Object<'_>>().map(|o| Function::new(&o)).collect())?;
+        // PdfCraft patch: all descendants share the caller's depth, work and cycle guards.
+        // The resolved iterator also ends on an unresolved/cyclic reference. Require one
+        // resolved child per raw slot so that failure cannot silently shorten the function list.
+        let array = dict.get::<Array<'_>>(FUNCTIONS)?;
+        let mut objects = array.iter::<Object<'_>>();
+        let functions: Vec<Function> = array
+            .raw_iter()
+            .map(|_| {
+                let Some(object) = objects.next() else {
+                    warn!(
+                        "PDF stitching function contains an unresolved or cyclic child reference"
+                    );
+                    return None;
+                };
+                Function::new_inner(&object, budget, depth)
+            })
+            .collect::<Option<_>>()?;
+        if functions.is_empty() {
+            warn!("PDF stitching function has no child functions");
+            return None;
+        }
         let domain = *clamper.domain.first()?;
         let mut bounds = vec![domain.0 - 0.0001];
         if let Some(a) = dict.get::<Array<'_>>(BOUNDS) {
@@ -132,4 +154,47 @@ mod tests {
             &[0.7, 0.7, 0.7]
         );
     }
+
+    fn function_limits_stitching(levels: usize) -> String {
+        let mut function = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >>".to_owned();
+        for _ in 1..levels {
+            function = format!(
+                "<< /FunctionType 3 /Domain [0 1] /Functions [{function}] /Bounds [] /Encode [0 1] >>"
+            );
+        }
+        function
+    }
+
+    #[test]
+    fn function_limits_stitching_depth_is_bounded() {
+        let data = function_limits_stitching(64);
+        let object = Object::from_bytes(data.as_bytes()).unwrap();
+        assert_eq!(
+            Function::new(&object).unwrap().eval(smallvec![0.5]),
+            Some(smallvec![0.5])
+        );
+        let data = function_limits_stitching(65);
+        let object = Object::from_bytes(data.as_bytes()).unwrap();
+        assert!(Function::new(&object).is_none());
+    }
+
+    fn function_limits_fanout(children: usize) -> String {
+        let leaf = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> ";
+        format!(
+            "<< /FunctionType 3 /Domain [0 1] /Functions [{}] /Bounds [{}] /Encode [{}] >>",
+            leaf.repeat(children),
+            "0.5 ".repeat(children.saturating_sub(1)),
+            "0 1 ".repeat(children)
+        )
+    }
+
+    #[test]
+    fn function_limits_stitching_fanout_shares_a_node_budget() {
+        let data = function_limits_fanout(9999);
+        let object = Object::from_bytes(data.as_bytes()).unwrap();
+        assert!(Function::new(&object).is_some());
+        let data = function_limits_fanout(10000);
+        let object = Object::from_bytes(data.as_bytes()).unwrap();
+        assert!(Function::new(&object).is_none());
+    }
 }
diff --git a/vendor/hayro-interpret/src/function/type4.rs b/vendor/hayro-interpret/src/function/type4.rs
index ffa6a374..e4c0d1e0 100644
--- a/vendor/hayro-interpret/src/function/type4.rs
+++ b/vendor/hayro-interpret/src/function/type4.rs
@@ -8,6 +8,33 @@ use smallvec::SmallVec;
 use std::array;
 use std::ops::Rem;
 
+// PdfCraft patch: calculator color/transfer functions normally contain a handful of operators.
+// Bound every parsed branch and every executed operator as well as recursive procedure depth.
+// A shared budget is never reset when entering an `if` or `ifelse` branch.
+const MAX_CALCULATOR_DEPTH: usize = 64;
+const MAX_CALCULATOR_OPS: usize = 10_000;
+
+struct CalculatorBudget {
+    remaining: usize,
+}
+
+impl CalculatorBudget {
+    fn new() -> Self {
+        Self {
+            remaining: MAX_CALCULATOR_OPS,
+        }
+    }
+
+    fn take(&mut self) -> Option<()> {
+        if self.remaining == 0 {
+            warn!("PDF calculator function exceeds the limit of {MAX_CALCULATOR_OPS} operators");
+            return None;
+        }
+        self.remaining -= 1;
+        Some(())
+    }
+}
+
 /// A type 4 function (postscript function).
 #[derive(Debug)]
 pub(crate) struct Type4 {
@@ -34,10 +61,15 @@ impl Type4 {
         let mut arg_stack = InterpreterStack::new();
 
         for input in input {
-            arg_stack.push(Argument::Float(input));
+            arg_stack.push(Argument::Float(input))?;
         }
 
-        eval_inner(&self.program, &mut arg_stack)?;
+        eval_inner(
+            &self.program,
+            &mut arg_stack,
+            &mut CalculatorBudget::new(),
+            0,
+        )?;
 
         let mut out: SmallVec<_> = arg_stack.items().iter().map(|i| i.as_f32()).collect();
 
@@ -162,17 +194,26 @@ impl<T: Default, const C: usize> ArgumentsStack<T, C> {
 type InterpreterStack = ArgumentsStack<Argument, 64>;
 type ParseStack = ArgumentsStack<Vec<PostScriptOp>, 2>;
 
-fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> Option<()> {
+fn eval_inner(
+    procedure: &[PostScriptOp],
+    arg_stack: &mut InterpreterStack,
+    budget: &mut CalculatorBudget,
+    depth: usize,
+) -> Option<()> {
+    if depth >= MAX_CALCULATOR_DEPTH {
+        warn!("PDF calculator nesting exceeds the limit of {MAX_CALCULATOR_DEPTH} levels");
+        return None;
+    }
     macro_rules! zero {
         ($eval:expr) => {
-            arg_stack.push($eval);
+            arg_stack.push($eval)?;
         };
     }
 
     macro_rules! one_f {
         ($eval:expr) => {
             let n1 = arg_stack.pop()?;
-            arg_stack.push(Argument::Float($eval(n1.as_f32())));
+            arg_stack.push(Argument::Float($eval(n1.as_f32())))?;
         };
     }
 
@@ -180,7 +221,7 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
         ($eval:expr) => {
             let n2 = arg_stack.pop()?;
             let n1 = arg_stack.pop()?;
-            arg_stack.push(Argument::Float($eval(n1.as_f32(), n2.as_f32())));
+            arg_stack.push(Argument::Float($eval(n1.as_f32(), n2.as_f32())))?;
         };
     }
 
@@ -200,7 +241,7 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
                 (Argument::Bool(f1), Argument::Bool(f2)) => Argument::Bool($eval_b(f1, f2)),
             };
 
-            arg_stack.push(res);
+            arg_stack.push(res)?;
         };
     }
 
@@ -209,6 +250,7 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
     }
 
     for op in procedure {
+        budget.take()?;
         match op {
             PostScriptOp::Number(n) => arg_stack.push(Argument::Float(n.as_f64() as f32))?,
             PostScriptOp::Abs => {
@@ -249,12 +291,14 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
                 one_f!(|n: f32| n.floor());
             }
             PostScriptOp::Idiv => {
-                two_f!(|n1: f32, n2: f32| {
-                    let n1 = n1 as i32;
-                    let n2 = n2 as i32;
-
-                    (n1 / n2) as f32
-                });
+                // PdfCraft patch: zero divisors and MIN / -1 have no integer result.
+                let n2 = arg_stack.pop()?.as_f32() as i32;
+                let n1 = arg_stack.pop()?.as_f32() as i32;
+                let quotient = n1.checked_div(n2).or_else(|| {
+                    warn!("PDF calculator idiv has a zero divisor or an out-of-range result");
+                    None
+                })?;
+                arg_stack.push(Argument::Float(quotient as f32))?;
             }
             PostScriptOp::Ln => {
                 one_f!(|n: f32| n.ln());
@@ -291,14 +335,17 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
             }
             PostScriptOp::Bitshift => {
                 two_f!(|n1: f32, n2: f32| {
-                    let num = n1 as u32;
+                    // PdfCraft patch: PLRM, bitshift, discards shifted-out bits and fills
+                    // with zeroes. All bits are gone at >= 32; use the signed word's bit
+                    // pattern for negative operands, and never negate MIN for right shifts.
+                    let num = n1 as i32 as u32;
                     let shift = n2 as i32;
-
-                    if shift >= 0 {
-                        (num << shift) as f32
+                    let bits = if shift >= 0 {
+                        num.checked_shl(shift as u32).unwrap_or(0)
                     } else {
-                        (num >> -shift) as f32
-                    }
+                        num.checked_shr(shift.unsigned_abs()).unwrap_or(0)
+                    };
+                    bits as i32 as f32
                 });
             }
             PostScriptOp::Eq => {
@@ -330,7 +377,7 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
                     Argument::Bool(b) => Argument::Bool(!b),
                 };
 
-                arg_stack.push(res);
+                arg_stack.push(res)?;
             }
             PostScriptOp::Or => {
                 four!(
@@ -351,40 +398,40 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
                 let cond = arg_stack.pop()?.as_bool();
 
                 if cond {
-                    eval_inner(p, arg_stack)?;
+                    eval_inner(p, arg_stack, budget, depth + 1)?;
                 }
             }
             PostScriptOp::IfElse(p1, p2) => {
                 let cond = arg_stack.pop()?.as_bool();
 
                 if cond {
-                    eval_inner(p1, arg_stack)?;
+                    eval_inner(p1, arg_stack, budget, depth + 1)?;
                 } else {
-                    eval_inner(p2, arg_stack)?;
+                    eval_inner(p2, arg_stack, budget, depth + 1)?;
                 }
             }
             PostScriptOp::Copy => {
                 let n = arg_stack.pop()?.as_f32() as u32 as usize;
                 let start = arg_stack.len().checked_sub(n)?;
                 for i in start..arg_stack.len() {
-                    arg_stack.push(*arg_stack.at(i)?);
+                    arg_stack.push(*arg_stack.at(i)?)?;
                 }
             }
             PostScriptOp::Dup => {
-                arg_stack.push(*arg_stack.last()?);
+                arg_stack.push(*arg_stack.last()?)?;
             }
             PostScriptOp::Exch => {
                 let n2 = arg_stack.pop()?;
                 let n1 = arg_stack.pop()?;
 
-                arg_stack.push(n2);
-                arg_stack.push(n1);
+                arg_stack.push(n2)?;
+                arg_stack.push(n1)?;
             }
             PostScriptOp::Index => {
                 let n = arg_stack.pop()?.as_f32() as u32 as usize;
-                let n = arg_stack.len().checked_sub(n + 1)?;
+                let n = arg_stack.len().checked_sub(n.checked_add(1)?)?;
 
-                arg_stack.push(*arg_stack.at(n)?);
+                arg_stack.push(*arg_stack.at(n)?)?;
             }
             PostScriptOp::Pop => {
                 arg_stack.pop()?;
@@ -404,7 +451,7 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
                     let shift = j as usize % target.len();
                     target.rotate_right(shift);
                 } else {
-                    let shift = (-j) as usize % target.len();
+                    let shift = j.unsigned_abs() as usize % target.len();
                     target.rotate_left(shift);
                 }
             }
@@ -416,10 +463,18 @@ fn eval_inner(procedure: &[PostScriptOp], arg_stack: &mut InterpreterStack) -> O
 
 fn parse_procedure(data: &[u8]) -> Option<Vec<PostScriptOp>> {
     let mut r = Reader::new(data);
-    parse_procedure_inner(&mut r)
+    parse_procedure_inner(&mut r, &mut CalculatorBudget::new(), 0)
 }
 
-fn parse_procedure_inner(r: &mut Reader<'_>) -> Option<Vec<PostScriptOp>> {
+fn parse_procedure_inner(
+    r: &mut Reader<'_>,
+    budget: &mut CalculatorBudget,
+    depth: usize,
+) -> Option<Vec<PostScriptOp>> {
+    if depth >= MAX_CALCULATOR_DEPTH {
+        warn!("PDF calculator nesting exceeds the limit of {MAX_CALCULATOR_DEPTH} levels");
+        return None;
+    }
     let mut stack = ParseStack::new();
 
     let mut ops = vec![];
@@ -434,8 +489,10 @@ fn parse_procedure_inner(r: &mut Reader<'_>) -> Option<Vec<PostScriptOp>> {
 
             break;
         } else if r.peek_byte()? == b'{' {
-            stack.push(parse_procedure_inner(r)?);
+            budget.take()?;
+            stack.push(parse_procedure_inner(r, budget, depth + 1)?)?;
         } else {
+            budget.take()?;
             let op = PostScriptOp::from_reader(r, &mut stack)?;
             ops.push(op);
         }
@@ -907,4 +964,140 @@ mod tests {
 
         assert_eq!(res.as_slice(), &[-5.0, -2.0, 5.0]);
     }
+
+    fn function_limits_result(program: &str) -> Option<Values> {
+        Type4 {
+            program: parse_procedure(format!("{{ {program} }}").as_bytes())?,
+            clamper: Clamper {
+                domain: TupleVec::default(),
+                range: None,
+            },
+        }
+        .eval(Values::new())
+    }
+
+    #[test]
+    fn function_limits_idiv_zero_is_refused() {
+        assert!(function_limits_result("1 0 idiv").is_none());
+    }
+
+    #[test]
+    fn function_limits_idiv_overflow_is_refused() {
+        assert!(function_limits_result("-2147483648 -1 idiv").is_none());
+    }
+
+    #[test]
+    fn function_limits_large_bitshifts_discard_all_bits() {
+        for shift in [32, -32, 2147483647, -2147483648] {
+            assert_eq!(
+                function_limits_result(&format!("7 {shift} bitshift")),
+                Some(smallvec![0.0])
+            );
+        }
+        assert_eq!(
+            function_limits_result("1073741824 1 bitshift"),
+            Some(smallvec![-2147483648.0])
+        );
+        assert_eq!(
+            function_limits_result("-2147483648 -1 bitshift"),
+            Some(smallvec![1073741824.0])
+        );
+    }
+
+    #[test]
+    fn function_limits_roll_handles_the_most_negative_integer() {
+        assert_eq!(
+            function_limits_result("1 2 3 3 -2147483648 roll"),
+            Some(smallvec![3.0, 1.0, 2.0])
+        );
+    }
+
+    #[test]
+    fn function_limits_large_indices_are_refused() {
+        assert!(function_limits_result("1 4294967295 index").is_none());
+    }
+
+    #[test]
+    fn function_limits_operand_stack_overflow_is_refused() {
+        assert_eq!(
+            function_limits_result(&format!("1 {}", "dup ".repeat(63)))
+                .unwrap()
+                .len(),
+            64
+        );
+        assert!(function_limits_result(&format!("1 {}", "dup ".repeat(64))).is_none());
+    }
+
+    fn function_limits_nested_program(levels: usize) -> String {
+        let mut program = "{ 0 }".to_owned();
+        for _ in 1..levels {
+            program = format!("{{ true {program} if }}");
+        }
+        program
+    }
+
+    #[test]
+    fn function_limits_calculator_parse_depth_is_bounded() {
+        assert!(parse_procedure(function_limits_nested_program(64).as_bytes()).is_some());
+        assert!(parse_procedure(function_limits_nested_program(65).as_bytes()).is_none());
+    }
+
+    #[test]
+    fn function_limits_calculator_parse_work_is_shared() {
+        assert!(parse_procedure(format!("{{ {} }}", "0 pop ".repeat(5000)).as_bytes()).is_some());
+        assert!(parse_procedure(format!("{{ {} }}", "0 pop ".repeat(5001)).as_bytes()).is_none());
+    }
+
+    #[test]
+    fn function_limits_parse_budget_counts_unselected_branches() {
+        let branch = "0 pop ".repeat(2500);
+        let program = format!("{{ true {{ {branch} }} {{ {branch} }} ifelse }}");
+        assert!(parse_procedure(program.as_bytes()).is_none());
+        assert!(parse_procedure(b"{ {} {} }").is_some());
+        assert!(parse_procedure(b"{ {} {} {} }").is_none());
+    }
+    fn function_limits_eval(program: Vec<PostScriptOp>) -> Option<Values> {
+        Type4 {
+            program,
+            clamper: Clamper {
+                domain: TupleVec::default(),
+                range: None,
+            },
+        }
+        .eval(Values::new())
+    }
+
+    #[test]
+    fn function_limits_calculator_eval_work_is_bounded() {
+        let pair = [PostScriptOp::Number(Number::from_i32(0)), PostScriptOp::Pop];
+        assert_eq!(
+            function_limits_eval((0..5000).flat_map(|_| pair.iter().cloned()).collect()),
+            Some(Values::new())
+        );
+        assert!(
+            function_limits_eval((0..5001).flat_map(|_| pair.iter().cloned()).collect()).is_none()
+        );
+    }
+
+    #[test]
+    fn function_limits_eval_budget_is_shared_by_branches() {
+        let pair = [PostScriptOp::Number(Number::from_i32(0)), PostScriptOp::Pop];
+        let mut program: Vec<_> = (0..3000).flat_map(|_| pair.iter().cloned()).collect();
+        program.push(PostScriptOp::True);
+        program.push(PostScriptOp::If(
+            (0..2000).flat_map(|_| pair.iter().cloned()).collect(),
+        ));
+        assert!(function_limits_eval(program).is_none());
+    }
+    #[test]
+    fn function_limits_calculator_eval_depth_is_bounded() {
+        let mut program = vec![PostScriptOp::Number(Number::from_i32(0))];
+        for _ in 1..64 {
+            program = vec![PostScriptOp::True, PostScriptOp::If(program)];
+        }
+        assert_eq!(function_limits_eval(program.clone()), Some(smallvec![0.0]));
+        assert!(
+            function_limits_eval(vec![PostScriptOp::True, PostScriptOp::If(program)]).is_none()
+        );
+    }
 }

From 1f0466fcaeba154d51fd958938d6cba00e1d484f Mon Sep 17 00:00:00 2001
From: Streetblock <github@streetblock.de>
Date: Sat, 10 Oct 2026 00:53:56 +0200
Subject: [PATCH 141/149] M2: bound image resampling buffers before allocation
 (#592)

Check source, destination, convolution and filter-plan sizes before allocation. Preserve original image geometry when a resize exceeds the policy, while allowing valid wide sources to shrink.

Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                   |   1 +
 ROADMAP.md                   |   2 +
 crates/render/src/raster.rs  | 141 +++++++++
 vendor/README.md             |   2 +-
 vendor/hayro/Cargo.toml      |   4 +
 vendor/hayro/Cargo.toml.orig |   2 +
 vendor/hayro/src/lib.rs      |   2 +-
 vendor/hayro/src/renderer.rs | 551 ++++++++++++++++++++++++-----------
 8 files changed, 538 insertions(+), 167 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e5da3f9f..1d7ab14c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2285,6 +2285,7 @@ dependencies = [
  "hayro-interpret",
  "image",
  "kurbo 0.13.1",
+ "log",
  "pic-scale",
  "vello_cpu 0.0.8",
 ]
diff --git a/ROADMAP.md b/ROADMAP.md
index 80a4f931..a00e8933 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -186,6 +186,8 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
 
+- **2026-10-09 (M2, image resampling bounds):** Image resampling checks source buffers, finite transforms, target RGBA sizes, intermediate scratch dimensions and estimated filter work before planning or allocating; wide valid sources may shrink before backend side limits. Oversized or failed resampling retains the original pixels and placement when the source fits the backend; invalid sources, unrepresentable fallbacks and failed staging/output reserves are skipped with a logged warning. Small synthetic metadata regressions and an anisotropically transformed image cover the guards and fallback. Overall estimate unchanged (about 30–35%).
+
 - **2026-10-09 (community, M14, Hungarian):** Magyar (`hu`) is a complete interface catalog (2,036 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `hu` and `hu_HU`, and from Preferences. Informal "te"; commands are nouns (Mentés, Megnyitás). After a numeral the noun stays singular, so both plural forms match. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover Hungarian diacritics including ő and ű. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M14, Windows Auto):** Neutral launcher locales (`C`, `C.UTF-8`, `POSIX`) no longer select English ahead of the Windows preferred display-language list. Explicit supported locale overrides retain their priority. Regression tests use existing catalogs and cover neutral/mixed overrides, unsupported first display tags and multiple preferred Windows languages. Catalogs and other platforms are unchanged; overall effort estimate remains about 30–35%.
 
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index bce9fefb..71dad3d0 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -1493,6 +1493,147 @@ mod tests {
 
     use super::*;
 
+    // Metadata-only: the test budget is 128 pixels and no image buffer is allocated.
+    #[test]
+    fn image_resampling_rejects_anisotropic_target_growth() {
+        assert_eq!(hayro::image_resampling_size(16, 1, 1, 16, 0.5, 32.0, 128), None);
+        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 32.0, 128), None);
+        assert_eq!(hayro::image_resampling_size(16, 1, 4, 64, 0.5, 32.0, 128), None);
+    }
+
+    #[test]
+    fn image_resampling_bounds_intermediate_before_planning() {
+        // Source and destination are each 128 pixels, but their crossed dimensions are 256.
+        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 0.5, 2.0, 128), None);
+    }
+
+    #[test]
+    fn image_resampling_rejects_invalid_sources_and_scales() {
+        assert_eq!(hayro::image_resampling_size(4, 4, 3, 47, 0.5, 0.5, 128), None);
+        assert_eq!(hayro::image_resampling_size(4, 4, 3, 49, 0.5, 0.5, 128), None);
+        for scale in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY, -1.0, 0.0] {
+            assert_eq!(hayro::image_resampling_size(4, 4, 3, 48, 0.5, scale, 128), None);
+        }
+    }
+
+    #[test]
+    fn image_resampling_keeps_valid_sizes_and_exact_limits() {
+        assert_eq!(hayro::image_resampling_size(16, 8, 1, 128, 0.5, 0.5, 128), Some((8, 4)));
+        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 8.0, 128), Some((8, 8)));
+        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 1.0, 1.0, 128), Some((16, 8)));
+        assert_eq!(hayro::image_resampling_size(0, 8, 1, 0, 1.0, 1.0, 128), None);
+        assert_eq!(hayro::image_resampling_size(16, 9, 1, 144, 1.0, 1.0, 128), None);
+        assert_eq!(hayro::image_resampling_size(65_536, 1, 1, 65_536, 1.0, 1.0, u64::MAX), None);
+        for channels in [1, 3, 4] {
+            assert_eq!(hayro::image_resampling_size(65_536, 1, channels, 65_536 * channels, 1.0 / 4096.0, 1.0, 65_536), Some((16, 1)));
+        }
+        assert_eq!(hayro::image_resampling_size(65_535, 1, 1, 65_535, 1.0, 1.0, 65_535), Some((65_535, 1)));
+        assert_eq!(hayro::image_resampling_size((1 << 20) + 1, 1, 1, (1 << 20) + 1, 1.0 / 4096.0, 1.0, 1 << 28), None);
+    }
+
+    #[test]
+    fn image_resampling_padded_backend_dimensions_stay_checked() {
+        // A Type 3 image's two-pixel frame may reach u16::MAX exactly, never wrap to zero.
+        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5), Some((65_535, 5)));
+        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5 - 1), None);
+        assert_eq!(hayro::image_resampling_size(65_532 + 4, 1 + 4, 4, 65_536 * 5 * 4, 1.0, 1.0, 1 << 28), None);
+    }
+    fn strip_image_pdf(width: u32, body: &str, space: &str, encoded: &str, alpha: Option<&str>) -> Vec<u8> {
+        let (mask_ref, mask_obj) = match alpha {
+            Some(data) => (
+                "/SMask 6 0 R",
+                format!(
+                    "6 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n",
+                    data.len() + 1
+                ),
+            ),
+            None => ("", String::new()),
+        };
+        format!(
+            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 4] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height 1 /ColorSpace /{space} /BitsPerComponent 8 {mask_ref} /Filter /ASCIIHexDecode /Length {} >> stream\n{encoded}>\nendstream endobj\n\
+             {mask_obj}trailer << /Root 1 0 R >>\n%%EOF", body.len(), encoded.len() + 1,
+        ).into_bytes()
+    }
+
+    // Safe on the original renderer too: 192 KiB RGB / 64 KiB gray sources shrink to 16 pixels.
+    #[test]
+    fn image_resampling_wide_sources_shrink_before_backend_side_limits() {
+        for (space, encoded, expected) in
+            [("DeviceRGB", "ff0000".repeat(65_536), [255, 0, 0, 255]), ("DeviceGray", "7f".repeat(65_536), [127, 127, 127, 255])]
+        {
+            let pdf = strip_image_pdf(65_536, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", space, &encoded, None);
+            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+            assert!(page.error.is_none(), "{space}: {:?}", page.error);
+            assert_eq!((page.width, page.height), (20, 4));
+            let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
+            assert_eq!(pixel(1), &[255, 255, 255, 255], "{space}: left placement");
+            assert_eq!(pixel(3), &expected, "{space}: source image was not dropped");
+            assert_eq!(pixel(17), &expected, "{space}: right placement");
+            assert_eq!(pixel(19), &[255, 255, 255, 255], "{space}: right placement");
+        }
+    }
+
+    #[test]
+    fn image_resampling_wide_transparent_sources_still_shrink() {
+        let data = "ff0000".repeat(65_536);
+        let alpha = "7f".repeat(65_536);
+        let pdf = strip_image_pdf(65_536, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceRGB", &data, Some(&alpha));
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (20, 4));
+        assert_eq!(&page.rgba[(20 + 3) * 4..][..4], &[255, 128, 128, 255]);
+    }
+
+    #[test]
+    fn image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement() {
+        let data = "ff0000".repeat(16);
+        let alpha = "7f".repeat(8);
+        let pdf = strip_image_pdf(16, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceRGB", &data, Some(&alpha));
+        let pdf = String::from_utf8(pdf)
+            .unwrap()
+            .replace("6 0 obj << /Type /XObject /Subtype /Image /Width 16", "6 0 obj << /Type /XObject /Subtype /Image /Width 8");
+        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (20, 4));
+        let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
+        assert_eq!(pixel(1), &[255, 255, 255, 255]);
+        assert_eq!(pixel(3), &[255, 128, 128, 255]);
+        assert_eq!(pixel(17), &[255, 128, 128, 255]);
+        assert_eq!(pixel(19), &[255, 255, 255, 255]);
+    }
+    // GREEN-only integration: the original renderer would attempt GiB buffers. The source is
+    // only 96 KiB, and the fixed guard rejects the target before the resampling plan/allocation.
+    #[test]
+    fn resampling_fallback_preserves_original_geometry_and_pixels() {
+        let data = "ff0000".repeat(32_767);
+        let body = "q 16383.5 0 0 1000000000 2 2 cm /Im0 Do Q\n";
+        let pdf = format!(
+            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width 32767 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Interpolate true /Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+            body.len(),
+            data.len() + 1,
+        );
+        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (20, 20));
+        let pixel = |x: usize, y: usize| &page.rgba[(y * 20 + x) * 4..][..4];
+        assert_eq!(pixel(0, 5), &[255, 255, 255, 255]);
+        assert_eq!(pixel(3, 5), &[255, 0, 0, 255]);
+        assert_eq!(pixel(19, 5), &[255, 0, 0, 255]);
+    }
+
     const ONE_PAGE: &[u8] = b"%PDF-1.4
 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
diff --git a/vendor/README.md b/vendor/README.md
index baa1f23c..584d9206 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -9,7 +9,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 |---|---|---|---|---|
 | hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable` |
 
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over` |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices` |
diff --git a/vendor/hayro/Cargo.toml b/vendor/hayro/Cargo.toml
index cb05624d..86360dca 100644
--- a/vendor/hayro/Cargo.toml
+++ b/vendor/hayro/Cargo.toml
@@ -60,6 +60,10 @@ default-features = false
 [dependencies.kurbo]
 version = "0.13.0"
 
+# PdfCraft patch: report image resampling fallbacks through the application's logger.
+[dependencies.log]
+version = "0.4"
+
 [dependencies.pic-scale]
 version = "0.7.9"
 features = [
diff --git a/vendor/hayro/Cargo.toml.orig b/vendor/hayro/Cargo.toml.orig
index 1e60e6c0..36bdd8bb 100644
--- a/vendor/hayro/Cargo.toml.orig
+++ b/vendor/hayro/Cargo.toml.orig
@@ -16,6 +16,8 @@ image = { workspace = true, features = ["png"] }
 bytemuck = { workspace = true, features = ["bytemuck_derive"] }
 vello_cpu = { workspace = true }
 pic-scale = { workspace = true }
+# PdfCraft patch: report image resampling fallbacks through the application's logger.
+log = { workspace = true }
 
 [dev-dependencies]
 log = { workspace = true }
diff --git a/vendor/hayro/src/lib.rs b/vendor/hayro/src/lib.rs
index 7acc4851..3f702ee4 100644
--- a/vendor/hayro/src/lib.rs
+++ b/vendor/hayro/src/lib.rs
@@ -61,7 +61,7 @@ use vello_cpu::{Level, Pixmap, RenderMode};
 
 mod renderer;
 /// PdfCraft patch: exported for its regression test.
-pub use renderer::tiling_cell_scale;
+pub use renderer::{image_resampling_size, tiling_cell_scale};
 
 /// A cache used by the renderer.
 ///
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index 89982c48..e23b77bc 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -11,6 +11,7 @@ use pic_scale::{
     ImageSize, ImageStore, ImageStoreMut, PicScaleError, Resampling, ResamplingFunction, Scaler,
 };
 use std::collections::HashMap;
+use std::mem::size_of;
 use std::rc::Rc;
 use std::sync::Arc;
 use vello_cpu::color::palette::css::BLACK;
@@ -20,10 +21,161 @@ use vello_cpu::{
     Image, ImageSource, Mask, PaintType, Pixmap, RenderContext, RenderSettings, peniko,
 };
 
-
 /// PdfCraft patch: largest image drawn, in pixels (2^28 ≈ 268 MP, well above real page images).
 const MAX_IMAGE_PIXELS: u64 = 1 << 28;
 
+/// PdfCraft patch: source axes allowed into CatmullRom planning. Unlike the final pixmap,
+/// sources need not fit u16: a 65536-pixel strip can safely shrink to a 16-pixel image.
+/// This resource cap follows the existing CCITT column limit; the filter-work estimate below
+/// additionally bounds tables/scratch before entering the opaque PicScale planner.
+const MAX_RESAMPLING_SOURCE_SIDE: u32 = 1 << 20;
+const MAX_RESAMPLING_PLAN_BYTES: usize = 128 << 20;
+
+/// PdfCraft patch: source, intermediate and RGBA byte lengths, independent of backend sides.
+fn source_byte_len(width: u32, height: u32, channels: usize, max_pixels: u64) -> Option<usize> {
+    if width == 0 || height == 0 || !matches!(channels, 1 | 3 | 4) {
+        return None;
+    }
+    let pixels = u64::from(width).checked_mul(u64::from(height))?;
+    if pixels > max_pixels {
+        return None;
+    }
+    let pixels = usize::try_from(pixels).ok()?;
+    let rgba_len = pixels.checked_mul(4)?;
+    if rgba_len > isize::MAX as usize {
+        return None;
+    }
+    pixels.checked_mul(channels)
+}
+
+/// PdfCraft patch: only final pixmaps/padded glyphs need to fit the backend's u16 sides.
+fn image_byte_len(width: u32, height: u32, channels: usize, max_pixels: u64) -> Option<usize> {
+    if width > u32::from(u16::MAX) || height > u32::from(u16::MAX) {
+        return None;
+    }
+    source_byte_len(width, height, channels, max_pixels)
+}
+
+/// PdfCraft patch: conservative CatmullRom planning work for one axis in PicScale 0.7.12.
+/// Its four-tap kernel grows on downscaling. Include float/32-aligned i16 weights, temporary
+/// float/f64/usize tap arrays and two copies of the bounds. This is a size estimate, not a
+/// fallible reserve inside PicScale or a bound on total renderer memory.
+fn filter_plan_bytes(source: u32, target: u32) -> Option<usize> {
+    if source == target {
+        return Some(0);
+    }
+    let (source, target) = (usize::try_from(source).ok()?, usize::try_from(target).ok()?);
+    if target == 0 {
+        return None;
+    }
+    let taps = source.checked_mul(4)?.div_ceil(target).max(4);
+    let aligned_taps = taps.div_ceil(32).checked_mul(32)?;
+    let float_weights = taps.checked_mul(target)?.checked_mul(size_of::<f32>())?;
+    let fixed_weights = aligned_taps
+        .checked_mul(target)?
+        .checked_mul(size_of::<i16>())?;
+    let tap_scratch = taps.checked_mul(size_of::<f32>() + size_of::<f64>() + size_of::<usize>())?;
+    let bounds = target.checked_mul(4)?.checked_mul(size_of::<usize>())?;
+    float_weights
+        .checked_add(fixed_weights)?
+        .checked_add(tap_scratch)?
+        .checked_add(bounds)
+}
+
+/// PdfCraft patch: alpha-aware RGBA plans also need source-sized premultiplication scratch.
+/// Bound the combined scratch before planning, including a conservative crossed intermediate
+/// (or four rows for a short target) when both convolution axes change.
+fn resampling_scratch_byte_len(
+    source: (u32, u32),
+    target: (u32, u32),
+    channels: usize,
+    max_pixels: u64,
+) -> Option<usize> {
+    if source == target {
+        return Some(0);
+    }
+    let alpha = if channels == 4 {
+        source_byte_len(source.0, source.1, channels, max_pixels)?
+    } else {
+        0
+    };
+    let filter = if source.0 != target.0 && source.1 != target.1 {
+        source_byte_len(source.0, target.1.max(4), channels, max_pixels)?
+    } else {
+        0
+    };
+    let len = alpha.checked_add(filter)?;
+    let limit = max_pixels.saturating_mul(4).min(isize::MAX as u64);
+    if u64::try_from(len).ok()? > limit {
+        return None;
+    }
+    Some(len)
+}
+
+/// PdfCraft patch: validate output, crossed intermediate and filter-work bounds before planning.
+/// Source width × target height also bounds PicScale's smaller single-threaded four-row scratch.
+fn resampling_byte_len(
+    source: (u32, u32),
+    target: (u32, u32),
+    channels: usize,
+    data_len: usize,
+    max_pixels: u64,
+) -> Option<usize> {
+    if source_byte_len(source.0, source.1, channels, max_pixels)? != data_len {
+        return None;
+    }
+    let target_len = image_byte_len(target.0, target.1, channels, max_pixels)?;
+    resampling_scratch_byte_len(source, target, channels, max_pixels)?;
+    source_byte_len(source.0, target.1, channels, max_pixels)?;
+    if source.0 > MAX_RESAMPLING_SOURCE_SIDE || source.1 > MAX_RESAMPLING_SOURCE_SIDE {
+        return None;
+    }
+    let plan_bytes = filter_plan_bytes(source.0, target.0)?
+        .checked_add(filter_plan_bytes(source.1, target.1)?)?;
+    if plan_bytes > MAX_RESAMPLING_PLAN_BYTES {
+        return None;
+    }
+    Some(target_len)
+}
+
+/// PdfCraft patch: image dimensions selected before allocating resampling buffers.
+/// Exported for PdfCraft's small, metadata-only regression tests. `None` rejects invalid
+/// sources/scales or an over-budget target/intermediate; the caller may retain a valid source.
+#[doc(hidden)]
+pub fn image_resampling_size(
+    width: u32,
+    height: u32,
+    channels: usize,
+    data_len: usize,
+    x_scale: f32,
+    y_scale: f32,
+    max_pixels: u64,
+) -> Option<(u32, u32)> {
+    if !x_scale.is_finite() || !y_scale.is_finite() || x_scale <= 0.0 || y_scale <= 0.0 {
+        return None;
+    }
+    let target = if x_scale < 1.0 || y_scale < 1.0 {
+        let side = |size: u32, scale: f32| {
+            (size as f32 * scale)
+                .ceil()
+                .max(1.0)
+                .min((u16::MAX / 2) as f32) as u32
+        };
+        (side(width, x_scale), side(height, y_scale))
+    } else {
+        (width, height)
+    };
+    resampling_byte_len((width, height), target, channels, data_len, max_pixels)?;
+    Some(target)
+}
+
+/// PdfCraft patch: allocation failures in image conversion/resampling keep the renderer alive.
+fn image_buffer(len: usize) -> Option<Vec<u8>> {
+    let mut out = Vec::new();
+    out.try_reserve_exact(len).ok()?;
+    Some(out)
+}
+
 /// PdfCraft patch: most pieces one dashed stroke may be cut into. Stroke expansion keeps every
 /// dash, so a pattern that is tiny next to its path asks for billions: a fuzzed `/D [[11] 0]` on
 /// a line from x = 92234775807 allocated over 5 GB, and `[0.000001] 0 d` on a 20 pt line over
@@ -174,6 +326,20 @@ impl Renderer {
     }
 
     fn draw_image_with_alpha_mask(&mut self, image_data: ImageData, alpha_data: LumaData) {
+        // PdfCraft patch: mismatched masks need a dummy RGB staging image. Validate and
+        // reserve it before creating/pushing any mask, so failure skips the whole image.
+        let Some(len) = source_byte_len(alpha_data.width, alpha_data.height, 3, MAX_IMAGE_PIXELS)
+        else {
+            log::warn!(
+                "Image alpha-mask staging dimensions exceeded the buffer limit; image skipped"
+            );
+            return;
+        };
+        let Some(mut dummy_rgb) = image_buffer(len) else {
+            log::warn!("Image alpha-mask staging buffer could not be allocated; image skipped");
+            return;
+        };
+        dummy_rgb.resize(len, 0);
         let mask = {
             let transform = *self.ctx.transform()
                 * Affine::scale_non_uniform(
@@ -196,7 +362,7 @@ impl Renderer {
             };
             let mut mask_pix = Pixmap::new(self.ctx.width(), self.ctx.height());
             let rgb_data = ImageData::Rgb(RgbData {
-                data: vec![0; alpha_data.width as usize * alpha_data.height as usize * 3],
+                data: dummy_rgb,
                 width: alpha_data.width,
                 height: alpha_data.height,
                 interpolate: alpha_data.interpolate,
@@ -228,8 +394,8 @@ impl Renderer {
         new_width: u32,
         new_height: u32,
         pixel_format: ImagePixelFormat,
-    ) -> Vec<u8> {
-        match pixel_format {
+    ) -> (Vec<u8>, u32, u32) {
+        let resized = match pixel_format {
             ImagePixelFormat::Luma => self.resize_image_data_impl::<1>(
                 data,
                 src_width,
@@ -260,6 +426,15 @@ impl Renderer {
                     scaler.plan_rgba_resampling(source_size, target_size, true)
                 },
             ),
+        };
+        match resized {
+            Ok(out) => (out, new_width, new_height),
+            Err(original) => {
+                log::warn!(
+                    "Image resampling failed or exceeded its buffer limit; falling back to source data"
+                );
+                (original, src_width, src_height)
+            }
         }
     }
 
@@ -275,213 +450,259 @@ impl Renderer {
             ImageSize,
             ImageSize,
         ) -> Result<Arc<Resampling<u8, N>>, PicScaleError>,
-    ) -> Vec<u8> {
-        let source_size = ImageSize::new(src_width as usize, src_height as usize);
-        let target_size = ImageSize::new(new_width as usize, new_height as usize);
-        let src = ImageStore::<u8, N>::from_slice(&data, src_width as usize, src_height as usize)
-            .unwrap();
-        let mut out = vec![0; new_width as usize * new_height as usize * N];
-        let mut dst =
-            ImageStoreMut::<u8, N>::from_slice(&mut out, new_width as usize, new_height as usize)
-                .unwrap();
-        let plan = plan(&self.scaler, source_size, target_size).unwrap();
-        plan.resample(&src, &mut dst).unwrap();
-        out
+    ) -> Result<Vec<u8>, Vec<u8>> {
+        // PdfCraft patch: validate before constructing a plan or allocating its output/scratch.
+        // Returning the owned input preserves both its pixels and dimensions on any failure.
+        let resized = (|| {
+            let len = resampling_byte_len(
+                (src_width, src_height),
+                (new_width, new_height),
+                N,
+                data.len(),
+                MAX_IMAGE_PIXELS,
+            )?;
+            let source_size = ImageSize::new(src_width as usize, src_height as usize);
+            let target_size = ImageSize::new(new_width as usize, new_height as usize);
+            let src = ImageStore::<u8, N>::from_slice(&data, source_size.width, source_size.height)
+                .ok()?;
+            let plan = plan(&self.scaler, source_size, target_size).ok()?;
+            let scratch_len = plan.scratch_size();
+            let scratch_bound = resampling_scratch_byte_len(
+                (src_width, src_height),
+                (new_width, new_height),
+                N,
+                MAX_IMAGE_PIXELS,
+            )?;
+            if scratch_len > scratch_bound {
+                return None;
+            }
+            let mut out = image_buffer(len)?;
+            out.resize(len, 0);
+            let mut dst =
+                ImageStoreMut::<u8, N>::from_slice(&mut out, target_size.width, target_size.height)
+                    .ok()?;
+            let mut scratch = image_buffer(scratch_len)?;
+            scratch.resize(scratch_len, 0);
+            plan.resample_with_scratch(&src, &mut dst, &mut scratch)
+                .ok()?;
+            Some(out)
+        })();
+        match resized {
+            Some(out) => Ok(out),
+            None => Err(data),
+        }
     }
 
     fn draw_image(&mut self, image_data: ImageData, alpha_data: Option<LumaData>) {
         let cur_transform = *self.ctx.transform();
-        let mut additional_transform = Affine::IDENTITY;
-
         let (x_scale, y_scale) = {
             let (x, y) = x_y_advances(&cur_transform);
             (x.length() as f32, y.length() as f32)
         };
-        let mut img_width = image_data.width();
-        let mut img_height = image_data.height();
-        // PdfCraft patch: skip images with absurd dimensions (a fuzzed inline image claimed
-        // /W 4294967295 over four bytes of data; resampling it never finished).
-        if img_width == 0 || img_height == 0 || u64::from(img_width) * u64::from(img_height) > MAX_IMAGE_PIXELS {
+        // PdfCraft patch: do not send non-finite or collapsed geometry to the rasterizer.
+        if !cur_transform.as_coeffs().iter().all(|v| v.is_finite())
+            || !x_scale.is_finite()
+            || !y_scale.is_finite()
+            || x_scale <= 0.0
+            || y_scale <= 0.0
+        {
+            log::warn!("Image has an invalid transform and was skipped");
+            return;
+        }
+        let (source_width, source_height) = (image_data.width(), image_data.height());
+        let channels = match &image_data {
+            ImageData::Luma(_) => 1,
+            ImageData::Rgb(_) => 3,
+        };
+        let data_len = match &image_data {
+            ImageData::Luma(a) => a.data.len(),
+            ImageData::Rgb(a) => a.data.len(),
+        };
+        if source_byte_len(source_width, source_height, channels, MAX_IMAGE_PIXELS)
+            != Some(data_len)
+        {
+            log::warn!("Image has invalid or over-limit source dimensions/data and was skipped");
             return;
         }
         let interpolate = image_data.interpolate();
-
-        if let Some(a) = &alpha_data
-            && (a.width != img_width || a.height != img_height || a.interpolate != interpolate)
-        {
-            return self.draw_image_with_alpha_mask(image_data, alpha_data.unwrap());
+        if let Some(a) = &alpha_data {
+            if source_byte_len(a.width, a.height, 1, MAX_IMAGE_PIXELS) != Some(a.data.len()) {
+                log::warn!("Image has invalid or over-limit alpha dimensions/data and was skipped");
+                return;
+            }
+            if a.width != source_width || a.height != source_height || a.interpolate != interpolate
+            {
+                if let Some(alpha) = alpha_data {
+                    self.draw_image_with_alpha_mask(image_data, alpha);
+                }
+                return;
+            }
         }
-
         let mut quality = if interpolate {
             ImageQuality::Medium
         } else {
             ImageQuality::Low
         };
-
         let has_alpha = alpha_data.is_some();
         let mut may_have_transparency = has_alpha || self.force_images_may_have_transparency();
-        let needs_resize = x_scale < 1.0 || y_scale < 1.0;
-        let (new_width, new_height) = if needs_resize {
-            let w = (img_width as f32 * x_scale)
-                .ceil()
-                .max(1.0)
-                .min((u16::MAX / 2) as f32) as u32;
-            let h = (img_height as f32 * y_scale)
-                .ceil()
-                .max(1.0)
-                .min((u16::MAX / 2) as f32) as u32;
-            if self.in_type3_glyph {
-                quality = ImageQuality::High;
+        let requested_resize = x_scale < 1.0 || y_scale < 1.0;
+        let (new_width, new_height) = match image_resampling_size(
+            source_width,
+            source_height,
+            channels,
+            data_len,
+            x_scale,
+            y_scale,
+            MAX_IMAGE_PIXELS,
+        ) {
+            Some(target) => target,
+            None => {
+                if image_byte_len(source_width, source_height, 4, MAX_IMAGE_PIXELS).is_none() {
+                    log::warn!(
+                        "Image resampling exceeded its buffer limit and the original resolution cannot fit the backend; image skipped"
+                    );
+                    return;
+                }
+                log::warn!(
+                    "Image resampling exceeded its buffer limit; retaining the original resolution"
+                );
+                (source_width, source_height)
             }
-            (w, h)
-        } else {
-            (img_width, img_height)
         };
+        if requested_resize && self.in_type3_glyph {
+            quality = ImageQuality::High;
+        }
+        let needs_resize = (new_width, new_height) != (source_width, source_height);
 
-        // For luma images without alpha, we can resize as single-channel and
-        // expand to RGBA afterwards, which is ~4x faster.
-        let mut rgba_data = if matches!(&image_data, ImageData::Luma(_)) && !has_alpha {
-            // We cannot lift this up due to borrowing issues.
-            let ImageData::Luma(luma) = image_data else {
-                unreachable!()
-            };
-
-            let luma_data = if !needs_resize {
-                luma.data
-            } else {
-                let resized = self.resize_image_data(
-                    luma.data,
-                    img_width,
-                    img_height,
-                    new_width,
-                    new_height,
-                    ImagePixelFormat::Luma,
-                );
-                additional_transform = Affine::scale_non_uniform(
-                    img_width as f64 / new_width as f64,
-                    img_height as f64 / new_height as f64,
-                );
-                img_width = new_width;
-                img_height = new_height;
-                resized
-            };
-
-            luma_data
-                .iter()
-                .flat_map(|g| [*g, *g, *g, 255])
-                .collect::<Vec<_>>()
-        } else if matches!(&image_data, ImageData::Rgb(_)) && !has_alpha && needs_resize {
-            let ImageData::Rgb(rgb) = image_data else {
-                unreachable!()
-            };
-
-            let resized = self.resize_image_data(
-                rgb.data,
-                img_width,
-                img_height,
+        // Preserve the single-channel/RGB fast paths. With alpha, expand directly to RGBA;
+        // every source and alpha length was validated before zipping or allocating.
+        let (data, format) = match (image_data, alpha_data) {
+            (ImageData::Luma(luma), None) => (luma.data, ImagePixelFormat::Luma),
+            (ImageData::Rgb(rgb), None) => (rgb.data, ImagePixelFormat::Rgb),
+            (image, Some(alpha)) => {
+                let Some(len) = source_byte_len(source_width, source_height, 4, MAX_IMAGE_PIXELS)
+                else {
+                    return;
+                };
+                let Some(mut rgba) = image_buffer(len) else {
+                    log::warn!(
+                        "Image RGBA buffer could not be allocated and the image was skipped"
+                    );
+                    return;
+                };
+                match image {
+                    ImageData::Luma(luma) => {
+                        rgba.extend(
+                            luma.data
+                                .iter()
+                                .zip(alpha.data)
+                                .flat_map(|(g, a)| [*g, *g, *g, a]),
+                        );
+                    }
+                    ImageData::Rgb(rgb) => {
+                        rgba.extend(
+                            rgb.data
+                                .as_chunks::<3>()
+                                .0
+                                .iter()
+                                .zip(alpha.data)
+                                .flat_map(|([r, g, b], a)| [*r, *g, *b, a]),
+                        );
+                    }
+                }
+                (rgba, ImagePixelFormat::Rgba)
+            }
+        };
+        let (data, mut img_width, mut img_height) = if needs_resize {
+            self.resize_image_data(
+                data,
+                source_width,
+                source_height,
                 new_width,
                 new_height,
-                ImagePixelFormat::Rgb,
-            );
-            additional_transform = Affine::scale_non_uniform(
-                img_width as f64 / new_width as f64,
-                img_height as f64 / new_height as f64,
-            );
-            img_width = new_width;
-            img_height = new_height;
-
-            let mut out = Vec::with_capacity((img_width * img_height) as usize * 4);
-            for px in resized.chunks_exact(3) {
-                out.extend_from_slice(&[px[0], px[1], px[2], 255]);
-            }
-            out
+                format,
+            )
         } else {
-            let (rgb_data, alpha_data) = match image_data {
-                ImageData::Rgb(rgb) => (rgb.data, alpha_data.map(|a| a.data)),
-                ImageData::Luma(luma) => {
-                    let rgb = luma
-                        .data
-                        .iter()
-                        .flat_map(|g| [*g, *g, *g])
-                        .collect::<Vec<_>>();
-                    (rgb, alpha_data.map(|a| a.data))
-                }
-            };
-
-            let rgba_data = match alpha_data {
-                None => rgb_data
-                    .chunks_exact(3)
-                    .flat_map(|rgb| [rgb[0], rgb[1], rgb[2], 255])
-                    .collect::<Vec<_>>(),
-                Some(alpha) => rgb_data
-                    .chunks_exact(3)
-                    .zip(alpha)
-                    .flat_map(|(rgb, a)| [rgb[0], rgb[1], rgb[2], a])
-                    .collect::<Vec<_>>(),
-            };
-
-            if !needs_resize {
-                rgba_data
-            } else {
-                let resized = self.resize_image_data(
-                    rgba_data,
-                    img_width,
-                    img_height,
-                    new_width,
-                    new_height,
-                    ImagePixelFormat::Rgba,
-                );
-                additional_transform = Affine::scale_non_uniform(
-                    img_width as f64 / new_width as f64,
-                    img_height as f64 / new_height as f64,
-                );
-                img_width = new_width;
-                img_height = new_height;
-                resized
-            }
+            (data, source_width, source_height)
+        };
+        if image_byte_len(img_width, img_height, 4, MAX_IMAGE_PIXELS).is_none() {
+            log::warn!(
+                "Image resampling failed and the original resolution cannot fit the backend; image skipped"
+            );
+            return;
+        }
+        let mut additional_transform = Affine::scale_non_uniform(
+            source_width as f64 / img_width as f64,
+            source_height as f64 / img_height as f64,
+        );
+        let mut rgba_data = if matches!(format, ImagePixelFormat::Rgba) {
+            data
+        } else {
+            let Some(len) = image_byte_len(img_width, img_height, 4, MAX_IMAGE_PIXELS) else {
+                return;
+            };
+            let Some(mut rgba) = image_buffer(len) else {
+                log::warn!("Image RGBA buffer could not be allocated and the image was skipped");
+                return;
+            };
+            match format {
+                ImagePixelFormat::Luma => rgba.extend(data.iter().flat_map(|g| [*g, *g, *g, 255])),
+                ImagePixelFormat::Rgb => rgba.extend(
+                    data.as_chunks::<3>()
+                        .0
+                        .iter()
+                        .flat_map(|[r, g, b]| [*r, *g, *b, 255]),
+                ),
+                ImagePixelFormat::Rgba => {} // Handled above.
+            }
+            rgba
         };
-
         if has_alpha {
             let (chunks, _) = rgba_data.as_chunks_mut::<4>();
             for chunk in chunks {
-                *chunk = AlphaColor::from_rgba8(chunk[0], chunk[1], chunk[2], chunk[3])
+                let [r, g, b, a] = *chunk;
+                *chunk = AlphaColor::from_rgba8(r, g, b, a)
                     .premultiply()
                     .to_rgba8()
                     .to_u8_array();
             }
         }
-
-        // The problem is that by default, when applying a bilinear or bicubic scaling, we will
-        // sample pixels using an extend (pad/reflect/repeat). For glyphs, this is undesirable
-        // as the glyphs will look very bold. Therefore, for glyphs it is more desirable to sample
-        // a transparent pixel when reaching the border. Thus, we wrap glyphs in a transparent frame
-        // of pixel width 2.
+        // Type 3 glyphs get a transparent two-pixel frame for interpolation. Check the padded
+        // RGBA allocation and u16 dimensions too, before narrowing or growing either side.
         if self.in_type3_glyph {
-            let mut padded_image = vec![];
-            padded_image.extend(vec![0; (4 * img_width as usize + 16) * 2]);
-
+            let (Some(width), Some(height)) = (img_width.checked_add(4), img_height.checked_add(4))
+            else {
+                return;
+            };
+            let Some(len) = image_byte_len(width, height, 4, MAX_IMAGE_PIXELS) else {
+                log::warn!(
+                    "Image glyph padding exceeded its buffer limit and the image was skipped"
+                );
+                return;
+            };
+            let Some(mut padded) = image_buffer(len) else {
+                log::warn!("Image glyph padding could not be allocated and the image was skipped");
+                return;
+            };
+            let row_len = width as usize * 4; // Checked RGBA length above bounds every row.
+            padded.resize(row_len * 2, 0);
             for row in rgba_data.chunks_exact(img_width as usize * 4) {
-                padded_image.extend([0; 8]);
-                padded_image.extend(row);
-                padded_image.extend([0; 8]);
+                padded.extend([0; 8]);
+                padded.extend_from_slice(row);
+                padded.extend([0; 8]);
             }
-
-            padded_image.extend(vec![0; (4 * img_width as usize + 16) * 2]);
-            img_width += 4;
-            img_height += 4;
+            padded.resize(len, 0);
+            (img_width, img_height) = (width, height);
             additional_transform *= Affine::translate((-2.0, -2.0));
             may_have_transparency = true;
-
-            rgba_data = padded_image;
+            rgba_data = padded;
         }
-
         let pixmap = Pixmap::from_parts_with_opacity(
             bytemuck::cast_vec(rgba_data),
             img_width as u16,
             img_height as u16,
             may_have_transparency,
         );
-
         self.draw_pixmap(
             Arc::new(pixmap),
             quality,

From f7d5ca4a0753f4275f17da66ddcf64c4774002cf Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:54:10 -0700
Subject: [PATCH 142/149] Windows: a window larger than the GPU's texture limit
 can't close PdfCraft (#577) (#609)

* Windows: vendor egui-wgpu 0.36.2 as published (#577)

The crate as released on crates.io, plus egui's LICENSE-APACHE and
LICENSE-MIT from the 0.36.2 tag (the published crate leaves them out).
Not used yet: the next commit patches it and adds it to [patch.crates-io].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Windows: a window larger than the GPU's texture limit can't close PdfCraft (#577)

egui-wgpu 0.36.2 configures a window's surface at the window's own size.
Beyond the device's max_texture_dimension_2d, Surface::configure fails
validation and wgpu's default error handler panics. eframe configures the
surface before the app is created, so no app code can intercept it
(emilk/egui#8361). #578 raised the device's limit to the adapter's; this
removes the crash for windows larger than even that.

vendor/egui-wgpu: `winit::surface_fit` shrinks both sides by one factor so
neither exceeds the limit (the longer side lands exactly on it), and egui
draws at that factor into the surface. On DX12, PdfCraft's Windows default,
the swapchain is stretched over the window (DXGI_SCALING_STRETCH), so the
window stays complete and lined up with the pointer, only softer; wgpu's GL
backend copies it unscaled into a corner instead. It applies wherever a
surface is sized: install, resize (start-up restore, maximise, DPI change,
fullscreen) and a recreated surface, which starts again from the window's
own size. Depth and MSAA textures follow. A surface logs a warning when
it becomes fitted.

Why only an Outlook launch hit it (read from the code, not observed):
winit creates the window at CW_USEDEFAULT, so Windows places it, and a
launcher that hands ShellExecute its own window gets new windows on its
monitor. winit then converts the restored logical size at that monitor's
scale: 3440 points became 8600 pixels on a 250% panel. eframe's clamp
compares points against the largest monitor, so it let 3440 through.

Tests: surface_fit with the issue's 8600 x 3423 and edge sizes (zero,
u32::MAX, a zero limit, the longer side exactly on the limit); egui-wgpu
resolves to vendor/egui-wgpu and the fit stays wired into the paths that
size a surface.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* vendor/egui-wgpu: drop the stray .cargo-ok marker

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                             |    2 -
 Cargo.toml                             |    1 +
 ROADMAP.md                             |    1 +
 apps/pdfcraft/src/main.rs              |   76 +
 docs/development.md                    |    8 +-
 vendor/README.md                       |    1 +
 vendor/egui-wgpu/.cargo_vcs_info.json  |    6 +
 vendor/egui-wgpu/Cargo.lock            | 2719 ++++++++++++++++++++++++
 vendor/egui-wgpu/Cargo.toml            |  340 +++
 vendor/egui-wgpu/Cargo.toml.orig       |   75 +
 vendor/egui-wgpu/LICENSE-APACHE        |  201 ++
 vendor/egui-wgpu/LICENSE-MIT           |   25 +
 vendor/egui-wgpu/README.md             |   10 +
 vendor/egui-wgpu/src/capture.rs        |  267 +++
 vendor/egui-wgpu/src/egui.wgsl         |  162 ++
 vendor/egui-wgpu/src/lib.rs            |  555 +++++
 vendor/egui-wgpu/src/renderer.rs       | 1178 ++++++++++
 vendor/egui-wgpu/src/setup.rs          |  331 +++
 vendor/egui-wgpu/src/texture_copy.wgsl |   43 +
 vendor/egui-wgpu/src/winit.rs          |  869 ++++++++
 20 files changed, 6866 insertions(+), 4 deletions(-)
 create mode 100644 vendor/egui-wgpu/.cargo_vcs_info.json
 create mode 100644 vendor/egui-wgpu/Cargo.lock
 create mode 100644 vendor/egui-wgpu/Cargo.toml
 create mode 100644 vendor/egui-wgpu/Cargo.toml.orig
 create mode 100644 vendor/egui-wgpu/LICENSE-APACHE
 create mode 100644 vendor/egui-wgpu/LICENSE-MIT
 create mode 100644 vendor/egui-wgpu/README.md
 create mode 100644 vendor/egui-wgpu/src/capture.rs
 create mode 100644 vendor/egui-wgpu/src/egui.wgsl
 create mode 100644 vendor/egui-wgpu/src/lib.rs
 create mode 100644 vendor/egui-wgpu/src/renderer.rs
 create mode 100644 vendor/egui-wgpu/src/setup.rs
 create mode 100644 vendor/egui-wgpu/src/texture_copy.wgsl
 create mode 100644 vendor/egui-wgpu/src/winit.rs

diff --git a/Cargo.lock b/Cargo.lock
index 1d7ab14c..e82b91c0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1474,8 +1474,6 @@ dependencies = [
 [[package]]
 name = "egui-wgpu"
 version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
 dependencies = [
  "ahash",
  "bytemuck",
diff --git a/Cargo.toml b/Cargo.toml
index e80a0b46..6eb0f41b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -99,3 +99,4 @@ hayro-syntax = { path = "vendor/hayro-syntax" }
 hayro-jbig2 = { path = "vendor/hayro-jbig2" }
 lopdf = { path = "vendor/lopdf" }
 winit = { path = "vendor/winit" }
+egui-wgpu = { path = "vendor/egui-wgpu" }
diff --git a/ROADMAP.md b/ROADMAP.md
index a00e8933..0a5a34e4 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -137,6 +137,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 - **2026-10-09 (M2, JPX sample normalization):** JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
+- **2026-10-09 (M14, #577 follow-up):** A window larger than the GPU's texture limit no longer closes PdfCraft. Vendored egui-wgpu 0.36.2 fits the window's surface within `max_texture_dimension_2d` and draws egui at the matching scale, on every path that sizes a surface (start-up restore, resize, maximise, DPI change, a recreated surface); upstream is emilk/egui#8361. Root cause of the Outlook-only trigger: winit creates the window on the launching app's monitor and converts the restored size at that monitor's scale. Unit tests cover the 8600 × 3423 case and edge sizes; a Windows Sandbox (WARP) run of a window one pixel over the limit panicked before and kept drawing after. Estimates unchanged.
 
 - **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 6399927b..3d1e8ecc 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -626,6 +626,82 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_window_larger_than_the_gpu_limit_gets_a_surface_within_it() {
+        use eframe::egui_wgpu::winit::surface_fit;
+        // Issue #577: 3440 x 1369 points restored at 250% asked an 8192-pixel device for this.
+        let (width, height, scale) = surface_fit(8600, 3423, 8192);
+        assert_eq!((width, height), (8192, 3260));
+        // Both sides shrink alike and egui draws at that factor: the whole window is drawn.
+        assert!((8600.0 * scale - 8192.0).abs() < 0.01, "{scale}");
+        assert!((3423.0 * scale - height as f32).abs() < 1.0, "{scale}");
+        // Within the limit nothing changes, up to and including the limit itself.
+        assert_eq!(surface_fit(8600, 3423, 16384), (8600, 3423, 1.0));
+        assert_eq!(surface_fit(8192, 8192, 8192), (8192, 8192, 1.0));
+        assert_eq!(surface_fit(0, 0, 8192), (0, 0, 1.0));
+        // One side over the limit: the window as it would be stretched across monitors.
+        assert_eq!(surface_fit(8193, 600, 8192).0, 8192);
+        assert_eq!(surface_fit(600, 8193, 8192).1, 8192);
+    }
+
+    #[test]
+    fn surface_fit_never_empties_or_overflows_a_surface() {
+        use eframe::egui_wgpu::winit::surface_fit;
+        for (w, h, max) in [
+            (1, u32::MAX, 8192),
+            (u32::MAX, 1, 2048),
+            (u32::MAX, u32::MAX, 16384),
+            (0, u32::MAX, 8192),
+            (u32::MAX, 0, 8192),
+            (5, 7, 0),
+            (40_000, 3, 1),
+        ] {
+            let (fw, fh, scale) = surface_fit(w, h, max);
+            assert!(fw <= max.max(1) && fh <= max.max(1), "{w} x {h} in {max}: {fw} x {fh}");
+            // A side that wasn't zero stays non-zero (`Surface::configure` rejects an empty one),
+            // and a zero side stays zero (egui-wgpu skips configuring it).
+            assert_eq!((fw == 0, fh == 0), (w == 0, h == 0), "{w} x {h} in {max}: {fw} x {fh}");
+            assert!(scale.is_finite() && scale > 0.0 && scale <= 1.0, "{w} x {h} in {max}: {scale}");
+        }
+        // The longer side lands exactly on the limit (rounding never leaves it a pixel short),
+        // and the shorter side keeps the window's proportions to within a pixel.
+        for max in [2048, 8192, 16384] {
+            for long in (max + 1..=max * 5).step_by(997).chain([max * 2, max * 4, u32::MAX]) {
+                for short in [1, 3, 600, max / 3, max - 1, max, long - 1, long] {
+                    let (fw, fh, scale) = surface_fit(long, short, max);
+                    assert_eq!(fw, max, "{long} x {short} in {max}");
+                    let expected = f64::from(short) * f64::from(max) / f64::from(long);
+                    assert!((f64::from(fh) - expected).abs() <= 1.0, "{long} x {short} in {max}: {fh}");
+                    assert_eq!(surface_fit(short, long, max), (fh, fw, scale), "transposed");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn egui_wgpu_carries_the_surface_size_fit() {
+        // Issue #577: egui-wgpu 0.36.2 configures a window's surface at the window's size, and
+        // `Surface::configure` panics when that's beyond the device's `max_texture_dimension_2d`
+        // (emilk/egui#8361). vendor/egui-wgpu fits it within the limit. A dependency bump that
+        // resolves egui-wgpu from crates.io again, or a re-vendored copy without the patch, would
+        // bring the crash back: re-apply the patch, or drop the copy once an egui release has a
+        // fix (vendor/README.md).
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+        let lock = std::fs::read_to_string(root.join("Cargo.lock")).unwrap();
+        let egui_wgpu = lock.split("[[package]]").find(|p| p.contains("\nname = \"egui-wgpu\"\n")).expect("egui-wgpu is in Cargo.lock");
+        assert!(!egui_wgpu.contains("\nsource = "), "egui-wgpu must resolve to vendor/egui-wgpu, not:{egui_wgpu}");
+        // `surface_fit` is tested above; these keep it in the paths that size a surface.
+        let painter = std::fs::read_to_string(root.join("vendor/egui-wgpu/src/winit.rs")).unwrap().replace("\r\n", "\n");
+        for patch in [
+            "let (width, height, render_scale) = surface_fit(window_width, window_height, max_side);",
+            "let (fit_width, fit_height, _) = surface_fit(width, height, self.max_surface_side());",
+            "pixels_per_point: pixels_per_point * surface_state.render_scale,",
+            "old_state.window_width,\n            old_state.window_height,",
+        ] {
+            assert!(painter.contains(patch), "vendor/egui-wgpu lost its surface size patch: {patch}");
+        }
+    }
+
     #[test]
     fn winit_carries_the_windows_11_monitor_scale_fix() {
         // Issue #324: winit 0.30.13 as released nudges a window dragged onto a monitor with another
diff --git a/docs/development.md b/docs/development.md
index a6b2c488..6506cd65 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -29,8 +29,12 @@ covers every target starting with it (`pdfcraft*=debug`). The logger is
 The desktop renderer enables the selected adapter's supported 2D texture extent, while keeping
 egui-wgpu's other device requirements. Restored windows on mixed-DPI monitors can exceed its
 default 8192-pixel extent even when the GPU supports a larger surface (#577). The enabled extent
-never exceeds the adapter's capability; this does not make surfaces larger than the hardware
-limit renderable.
+never exceeds the adapter's capability. A window larger than even that (restored at another
+monitor's scale, or stretched across monitors) gets a surface fitted within the limit and is drawn
+at a correspondingly lower scale instead of panicking in `Surface::configure` (vendored egui-wgpu,
+`surface_fit`; see `vendor/README.md`). On DX12, PdfCraft's Windows default, the surface is
+stretched over the window: softer, but complete and lined up with the pointer. wgpu's GL backend
+copies it unscaled into a corner of the window instead.
 
 ## Environment variables
 
diff --git a/vendor/README.md b/vendor/README.md
index 584d9206..d1de21fe 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -14,6 +14,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices` |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
+| egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::egui_wgpu_carries_the_surface_size_fit`, which keeps the patch in the build and in the paths that size a surface |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
 
diff --git a/vendor/egui-wgpu/.cargo_vcs_info.json b/vendor/egui-wgpu/.cargo_vcs_info.json
new file mode 100644
index 00000000..eac02e1c
--- /dev/null
+++ b/vendor/egui-wgpu/.cargo_vcs_info.json
@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "49682f8baa058bf49e011035cfbd6e825f88a5ef"
+  },
+  "path_in_vcs": "crates/egui-wgpu"
+}
\ No newline at end of file
diff --git a/vendor/egui-wgpu/Cargo.lock b/vendor/egui-wgpu/Cargo.lock
new file mode 100644
index 00000000..8f7ebf3b
--- /dev/null
+++ b/vendor/egui-wgpu/Cargo.lock
@@ -0,0 +1,2719 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "accesskit"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
+dependencies = [
+ "uuid",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android-activity"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f2a1bb052857d5dd49572219344a7332b31b76405648eabac5bc68978251bcd"
+dependencies = [
+ "android-properties",
+ "bitflags 2.13.1",
+ "cc",
+ "jni",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-context",
+ "ndk-sys",
+ "num_enum",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "android-properties"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7eb209b1518d6bb87b283c20095f5228ecda460da70b44f0802523dea6da04"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "as-raw-xcb-connection"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"
+
+[[package]]
+name = "ash"
+version = "0.38.0+1.3.281"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb44936d800fea8f016d7f2311c6a4f97aebd5dc86f09906139ec848cf3a46f"
+dependencies = [
+ "libloading",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "bit-set"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2f926cc3060f09db9ebc5b52823d85268d24bb917e472c0c4bea35780a7d"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "block2"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c132eebf10f5cad5289222520a4a058514204aed6d791f1cf4fe8088b82d15f"
+dependencies = [
+ "objc2 0.5.2",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2 0.6.4",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f65693059b6b9c588b9f62fed1cedbf0a8b805631457ea162d68f0de186f3de5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "bytes"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
+
+[[package]]
+name = "calloop"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b99da2f8558ca23c71f4fd15dc57c906239752dd27ff3c00a1d56b685b7cbfec"
+dependencies = [
+ "bitflags 2.13.1",
+ "log",
+ "polling",
+ "rustix 0.38.44",
+ "slab",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "calloop-wayland-source"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20"
+dependencies = [
+ "calloop",
+ "rustix 0.38.44",
+ "wayland-backend",
+ "wayland-client",
+]
+
+[[package]]
+name = "cc"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "codespan-reporting"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
+dependencies = [
+ "serde",
+ "termcolor",
+ "unicode-width",
+]
+
+[[package]]
+name = "color"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ec7c5eb7a16992b1904d76c517d170ab353b0e0b3d5a0c81a8a0cd1037893cf"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-graphics"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "core-graphics-types",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "libc",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "cursor-icon"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
+
+[[package]]
+name = "dispatch"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b"
+
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2 0.6.4",
+]
+
+[[package]]
+name = "dlib"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab8ecd87370524b461f8557c119c405552c396ed91fc0a8eec68679eab26f94a"
+dependencies = [
+ "libloading",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+
+[[package]]
+name = "dpi"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
+
+[[package]]
+name = "ecolor"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
+dependencies = [
+ "bytemuck",
+ "emath",
+]
+
+[[package]]
+name = "egui"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
+dependencies = [
+ "accesskit",
+ "ahash",
+ "bitflags 2.13.1",
+ "emath",
+ "epaint",
+ "itertools",
+ "log",
+ "nohash-hasher",
+ "profiling",
+ "smallvec",
+ "unicode-segmentation",
+ "web-sys",
+]
+
+[[package]]
+name = "egui-wgpu"
+version = "0.36.2"
+dependencies = [
+ "ahash",
+ "bytemuck",
+ "document-features",
+ "egui",
+ "epaint",
+ "log",
+ "profiling",
+ "thiserror 2.0.18",
+ "type-map",
+ "web-time",
+ "wgpu",
+ "winit",
+]
+
+[[package]]
+name = "either"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+
+[[package]]
+name = "emath"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "epaint"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
+dependencies = [
+ "ahash",
+ "bytemuck",
+ "ecolor",
+ "emath",
+ "font-types",
+ "harfrust",
+ "log",
+ "nohash-hasher",
+ "parking_lot",
+ "profiling",
+ "self_cell",
+ "skrifa",
+ "smallvec",
+ "unicode-general-category",
+ "unicode-segmentation",
+ "vello_cpu",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "euclid"
+version = "0.22.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fearless_simd"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "font-types"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a7299a780854a6d391be2ae1c8521c9368471b559dbfd6a8dbd9f407eaff100"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
+[[package]]
+name = "futures-core"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+
+[[package]]
+name = "futures-task"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+
+[[package]]
+name = "futures-util"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "gethostname"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
+dependencies = [
+ "rustix 1.1.4",
+ "windows-link",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "gl_generator"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a95dfc23a2b4a9a2f5ab41d194f8bfda3cabec42af4e39f08c339eb2a0c124d"
+dependencies = [
+ "khronos_api",
+ "log",
+ "xml-rs",
+]
+
+[[package]]
+name = "glifo"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
+dependencies = [
+ "bytemuck",
+ "foldhash",
+ "hashbrown 0.17.1",
+ "log",
+ "peniko",
+ "skrifa",
+ "smallvec",
+ "vello_common",
+]
+
+[[package]]
+name = "glow"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29038e1c483364cc6bb3cf78feee1816002e127c331a1eec55a4d202b9e1adb5"
+dependencies = [
+ "js-sys",
+ "slotmap",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "glutin_wgl_sys"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c4ee00b289aba7a9e5306d57c2d05499b2e5dc427f84ac708bd2c090212cf3e"
+dependencies = [
+ "gl_generator",
+]
+
+[[package]]
+name = "gpu-allocator"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51255ea7cfaadb6c5f1528d43e92a82acb2b96c43365989a28b2d44ee38f8795"
+dependencies = [
+ "ash",
+ "hashbrown 0.16.1",
+ "log",
+ "presser",
+ "thiserror 2.0.18",
+ "windows",
+]
+
+[[package]]
+name = "guillotiere"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b17e70c989c36bad147b27a58d148c0741c51448aa5653436547323e524d0ab"
+dependencies = [
+ "euclid",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "num-traits",
+ "zerocopy",
+]
+
+[[package]]
+name = "harfrust"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c03d949a14aa089bbb282f7dd76a498a7f684428e4257202efc119ec010376f9"
+dependencies = [
+ "bitflags 2.13.1",
+ "bytemuck",
+ "read-fonts",
+ "smallvec",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "khronos-egl"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aae1df220ece3c0ada96b8153459b67eebe9ae9212258bb0134ae60416fdf76"
+dependencies = [
+ "libc",
+ "libloading",
+ "pkg-config",
+]
+
+[[package]]
+name = "khronos_api"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
+
+[[package]]
+name = "kurbo"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b60dfc32f652b926df6192e55525b16d186c69d47876c3ead4da5cc9f8450e2"
+dependencies = [
+ "arrayvec",
+ "euclid",
+ "polycool",
+ "smallvec",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "plain",
+ "redox_syscall 0.9.0",
+]
+
+[[package]]
+name = "linebender_resource_handle"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "naga"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23bf0a141a9ab6f07dbb492db53245e464bc9db42f407772d9ae03d83a2c1033"
+dependencies = [
+ "arrayvec",
+ "bit-set",
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "codespan-reporting",
+ "half",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "libm",
+ "log",
+ "naga-types",
+ "num-traits",
+ "once_cell",
+ "rustc-hash 1.1.0",
+ "spirv",
+ "thiserror 2.0.18",
+ "unicode-ident",
+]
+
+[[package]]
+name = "naga-types"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "658200ddc25c6c7b860747516d132d1b284c0fafb7a380233acee9a72fb30e11"
+dependencies = [
+ "hashbrown 0.17.1",
+ "indexmap",
+ "rustc-hash 1.1.0",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "ndk"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.13.1",
+ "jni-sys 0.3.1",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "ndk-sys"
+version = "0.6.0+11769913"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+dependencies = [
+ "jni-sys 0.3.1",
+]
+
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "objc-sys"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb91bdd390c7ce1a8607f35f3ca7151b65afc0ff5ff3b34fa350f7d7c7e4310"
+
+[[package]]
+name = "objc2"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46a785d4eeff09c14c487497c162e92766fbb3e4059a71840cecc03d9a50b804"
+dependencies = [
+ "objc-sys",
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+dependencies = [
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "libc",
+ "objc2 0.5.2",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-foundation 0.2.2",
+ "objc2-quartz-core 0.2.2",
+]
+
+[[package]]
+name = "objc2-cloud-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74dd3b56391c7a0596a295029734d3c1c5e7e510a4cb30245f8221ccea96b009"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-contacts"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5ff520e9c33812fd374d8deecef01d4a840e7b41862d849513de77e44aa4889"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.1",
+ "dispatch2",
+ "objc2 0.6.4",
+]
+
+[[package]]
+name = "objc2-core-graphics"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
+dependencies = [
+ "dispatch2",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+ "objc2-io-surface",
+]
+
+[[package]]
+name = "objc2-core-image"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55260963a527c99f1819c4f8e3b47fe04f9650694ef348ffd2227e8196d34c80"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-metal 0.2.2",
+]
+
+[[package]]
+name = "objc2-core-location"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "000cfee34e683244f284252ee206a27953279d370e309649dc3ee317b37e5781"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-contacts",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-foundation"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "dispatch",
+ "libc",
+ "objc2 0.5.2",
+]
+
+[[package]]
+name = "objc2-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-surface"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-link-presentation"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1a1ae721c5e35be65f01a03b6d2ac13a54cb4fa70d8a5da293d7b0020261398"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-app-kit",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-metal"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-metal"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.6.2",
+ "objc2 0.6.4",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-metal 0.2.2",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation 0.3.2",
+ "objc2-metal 0.3.2",
+]
+
+[[package]]
+name = "objc2-symbols"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a684efe3dec1b305badae1a28f6555f6ddd3bb2c2267896782858d5a78404dc"
+dependencies = [
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8bb46798b20cd6b91cbd113524c490f1686f4c4e8f49502431415f3512e2b6f"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-cloud-kit",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+ "objc2-link-presentation",
+ "objc2-quartz-core 0.2.2",
+ "objc2-symbols",
+ "objc2-uniform-type-identifiers",
+ "objc2-user-notifications",
+]
+
+[[package]]
+name = "objc2-uniform-type-identifiers"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44fa5f9748dbfe1ca6c0b79ad20725a11eca7c2218bceb4b005cb1be26273bfe"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-user-notifications"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76cfcbf642358e8689af64cee815d139339f3ed8ad05103ed5eaf73db8d84cb3"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "orbclient"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5df339f526ea9a60e371768d50efc2f2508c7203290731565d1f7a6f71d21747"
+dependencies = [
+ "libc",
+ "libredox",
+]
+
+[[package]]
+name = "ordered-float"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7d950ca161dc355eaf28f82b11345ed76c6e1f6eb1f4f4479e0323b9e2fbd0e"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "peniko"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "839c8299360d2e998bdb106dc0a6cd71dcc5f4df51df1b620361bf50e283cca6"
+dependencies = [
+ "bytemuck",
+ "color",
+ "kurbo",
+ "linebender_resource_handle",
+ "smallvec",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix 1.1.4",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "polycool"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50596ddc09eb5ad5f75cacd40209568e66df71baf86e1499a0e99c4cff12a5a6"
+dependencies = [
+ "arrayvec",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "presser"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf8e6a8aa66ce33f63993ffc4ea4271eb5b0530a9002db8455ea6050c77bfa"
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "profiling"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
+
+[[package]]
+name = "quick-xml"
+version = "0.39.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "range-alloc"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca45419789ae5a7899559e9512e58ca889e41f04f1f2445e9f4b290ceccd1d08"
+
+[[package]]
+name = "raw-window-handle"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
+
+[[package]]
+name = "raw-window-metal"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40d213455a5f1dc59214213c7330e074ddf8114c9a42411eb890c767357ce135"
+dependencies = [
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "objc2-quartz-core 0.3.2",
+]
+
+[[package]]
+name = "read-fonts"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "046a7d674daf459825b32f5062056d6882db0d2f5a479fbd76ccfc870ac18709"
+dependencies = [
+ "bytemuck",
+ "font-types",
+ "once_cell",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5102a6aaa05aa011a238e178e6bca86d2cb56fc9f586d37cb80f5bca6e07759"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "renderdoc-sys"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.12.1",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "self_cell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "skrifa"
+version = "0.44.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819ab7d62b1d3e72d9d9dea5650bac30424f9111364bb94928dbf5ecad1baa68"
+dependencies = [
+ "bytemuck",
+ "read-fonts",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "slotmap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
+dependencies = [
+ "bitflags 2.13.1",
+ "calloop",
+ "calloop-wayland-source",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix 0.38.44",
+ "thiserror 1.0.69",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
+
+[[package]]
+name = "smol_str"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "spirv"
+version = "0.4.0+sdk-1.4.341.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9571ea910ebd84c86af4b3ed27f9dbdc6ad06f17c5f96146b2b671e2976744f"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+
+[[package]]
+name = "type-map"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb30dbbd9036155e74adad6812e9898d03ec374946234fbcebd5dfc7b9187b90"
+dependencies = [
+ "rustc-hash 2.1.3",
+]
+
+[[package]]
+name = "unicode-general-category"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "uuid"
+version = "1.23.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
+
+[[package]]
+name = "vello_common"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
+dependencies = [
+ "bytemuck",
+ "fearless_simd",
+ "guillotiere",
+ "log",
+ "peniko",
+ "smallvec",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "vello_cpu"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
+dependencies = [
+ "bytemuck",
+ "glifo",
+ "hashbrown 0.17.1",
+ "vello_common",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wayland-backend"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2857dd20b54e916ec7253b3d6b4d5c4d7d4ca2c33c2e11c6c76a99bd8744755d"
+dependencies = [
+ "cc",
+ "downcast-rs",
+ "rustix 1.1.4",
+ "scoped-tls",
+ "smallvec",
+ "wayland-sys",
+]
+
+[[package]]
+name = "wayland-client"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645c7c96bb74690c3189b5c9cb4ca1627062bb23693a4fad9d8c3de958260144"
+dependencies = [
+ "bitflags 2.13.1",
+ "rustix 1.1.4",
+ "wayland-backend",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-csd-frame"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
+dependencies = [
+ "bitflags 2.13.1",
+ "cursor-icon",
+ "wayland-backend",
+]
+
+[[package]]
+name = "wayland-cursor"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
+dependencies = [
+ "rustix 1.1.4",
+ "wayland-client",
+ "xcursor",
+]
+
+[[package]]
+name = "wayland-protocols"
+version = "0.32.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-plasma"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6d8cf1eb2c1c31ed1f5643c88a6e53538129d4af80030c8cabd1f9fa884d91"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-wlr"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-scanner"
+version = "0.31.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c324a910fd86ebdc364a3e61ec1f11737d3b1d6c273c0239ee8ff4bc0d24b4a"
+dependencies = [
+ "proc-macro2",
+ "quick-xml",
+ "quote",
+]
+
+[[package]]
+name = "wayland-sys"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8eab23fefc9e41f8e841df4a9c707e8a8c4ed26e944ef69297184de2785e3be"
+dependencies = [
+ "dlib",
+ "log",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wgpu"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d8f4bd44d92da5270f03409dba9f952dab24f128e05d6a554926101d1bf9114"
+dependencies = [
+ "arrayvec",
+ "bitflags 2.13.1",
+ "bytemuck",
+ "cfg-if",
+ "cfg_aliases",
+ "document-features",
+ "hashbrown 0.17.1",
+ "js-sys",
+ "log",
+ "naga",
+ "parking_lot",
+ "portable-atomic",
+ "profiling",
+ "raw-window-handle",
+ "smallvec",
+ "static_assertions",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "wgpu-core",
+ "wgpu-hal",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-core"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08763620e76fc980bca7bf84de82568614487a53172dd968d89187282eb87fa2"
+dependencies = [
+ "arrayvec",
+ "bit-set",
+ "bit-vec",
+ "bitflags 2.13.1",
+ "bytemuck",
+ "cfg_aliases",
+ "document-features",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "log",
+ "naga",
+ "naga-types",
+ "once_cell",
+ "parking_lot",
+ "portable-atomic",
+ "profiling",
+ "raw-window-handle",
+ "rustc-hash 1.1.0",
+ "smallvec",
+ "thiserror 2.0.18",
+ "wgpu-core-deps-apple",
+ "wgpu-core-deps-emscripten",
+ "wgpu-core-deps-wasm",
+ "wgpu-core-deps-windows-linux-android",
+ "wgpu-hal",
+ "wgpu-naga-bridge",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-core-deps-apple"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3283b6da70d7fc892de95840215aa36381b5d0cbc479e88ee2b173c7b992b225"
+dependencies = [
+ "wgpu-hal",
+]
+
+[[package]]
+name = "wgpu-core-deps-emscripten"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85dcf2b2e5c2afb9eda64c570a87a4e570304bf39e52eddbaaf222d655b656ad"
+dependencies = [
+ "wgpu-hal",
+]
+
+[[package]]
+name = "wgpu-core-deps-wasm"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6c13228950f36a56023976a6c4ee6714b27fb40e3d52a33f7d3bb6d109c0b1"
+dependencies = [
+ "wgpu-hal",
+]
+
+[[package]]
+name = "wgpu-core-deps-windows-linux-android"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f76bc9c1c186ff3d9054e0d224c93c8c1c79d6653907c5249a5c1ea1a2cb1e43"
+dependencies = [
+ "wgpu-hal",
+]
+
+[[package]]
+name = "wgpu-hal"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf765132d8d5f50e192e7880464890c13f4e7457aafe8e5466e8174586e9f101"
+dependencies = [
+ "android_system_properties",
+ "arrayvec",
+ "ash",
+ "bit-set",
+ "bitflags 2.13.1",
+ "block2 0.6.2",
+ "bytemuck",
+ "cfg-if",
+ "cfg_aliases",
+ "glow",
+ "glutin_wgl_sys",
+ "gpu-allocator",
+ "hashbrown 0.17.1",
+ "js-sys",
+ "khronos-egl",
+ "libc",
+ "libloading",
+ "log",
+ "naga",
+ "naga-types",
+ "ndk-sys",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation 0.3.2",
+ "objc2-metal 0.3.2",
+ "objc2-quartz-core 0.3.2",
+ "once_cell",
+ "ordered-float",
+ "parking_lot",
+ "portable-atomic",
+ "portable-atomic-util",
+ "profiling",
+ "range-alloc",
+ "raw-window-handle",
+ "raw-window-metal",
+ "renderdoc-sys",
+ "smallvec",
+ "static_assertions",
+ "thiserror 2.0.18",
+ "wasm-bindgen",
+ "wayland-sys",
+ "web-sys",
+ "wgpu-naga-bridge",
+ "wgpu-types",
+ "windows",
+ "windows-core",
+ "windows-result",
+]
+
+[[package]]
+name = "wgpu-naga-bridge"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9eaac644e5008925c78567d272b9d66ef83da55a53cc17fc7daade7bb6e66e5"
+dependencies = [
+ "naga",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-types"
+version = "30.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a9c93c2b35edde326df60ffdee4c0f5864eac3011d6768b70d43f028ad93565"
+dependencies = [
+ "bitflags 2.13.1",
+ "bytemuck",
+ "js-sys",
+ "log",
+ "naga-types",
+ "raw-window-handle",
+ "static_assertions",
+ "web-sys",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winit"
+version = "0.30.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+dependencies = [
+ "ahash",
+ "android-activity",
+ "atomic-waker",
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "bytemuck",
+ "calloop",
+ "cfg_aliases",
+ "concurrent-queue",
+ "core-foundation",
+ "core-graphics",
+ "cursor-icon",
+ "dpi",
+ "js-sys",
+ "libc",
+ "memmap2",
+ "ndk",
+ "objc2 0.5.2",
+ "objc2-app-kit",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit",
+ "orbclient",
+ "percent-encoding",
+ "pin-project",
+ "raw-window-handle",
+ "redox_syscall 0.4.1",
+ "rustix 0.38.44",
+ "smithay-client-toolkit",
+ "smol_str",
+ "tracing",
+ "unicode-segmentation",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-plasma",
+ "web-sys",
+ "web-time",
+ "windows-sys 0.52.0",
+ "x11-dl",
+ "x11rb",
+ "xkbcommon-dl",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "x11-dl"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "x11rb"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9993aa5be5a26815fe2c3eacfc1fde061fc1a1f094bf1ad2a18bf9c495dd7414"
+dependencies = [
+ "as-raw-xcb-connection",
+ "gethostname",
+ "libc",
+ "libloading",
+ "once_cell",
+ "rustix 1.1.4",
+ "x11rb-protocol",
+]
+
+[[package]]
+name = "x11rb-protocol"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
+
+[[package]]
+name = "xcursor"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec9e4a500ca8864c5b47b8b482a73d62e4237670e5b5f1d6b9e3cae50f28f2b"
+
+[[package]]
+name = "xkbcommon-dl"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d039de8032a9a8856a6be89cea3e5d12fdd82306ab7c94d74e6deab2460651c5"
+dependencies = [
+ "bitflags 2.13.1",
+ "dlib",
+ "log",
+ "once_cell",
+ "xkeysym",
+]
+
+[[package]]
+name = "xkeysym"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
+
+[[package]]
+name = "xml-rs"
+version = "0.8.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
+
+[[package]]
+name = "zerocopy"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/vendor/egui-wgpu/Cargo.toml b/vendor/egui-wgpu/Cargo.toml
new file mode 100644
index 00000000..cd9495a2
--- /dev/null
+++ b/vendor/egui-wgpu/Cargo.toml
@@ -0,0 +1,340 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2024"
+rust-version = "1.95"
+name = "egui-wgpu"
+version = "0.36.2"
+authors = [
+    "Nils Hasenbanck <nils@hasenbanck.de>",
+    "embotech <opensource@embotech.com>",
+    "Emil Ernerfeldt <emil.ernerfeldt@gmail.com>",
+]
+build = false
+include = [
+    "../../LICENSE-APACHE",
+    "../../LICENSE-MIT",
+    "**/*.rs",
+    "**/*.wgsl",
+    "Cargo.toml",
+]
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "Bindings for using egui natively using the wgpu library"
+homepage = "https://github.com/emilk/egui/tree/main/crates/egui-wgpu"
+readme = "README.md"
+keywords = [
+    "wgpu",
+    "egui",
+    "gui",
+    "gamedev",
+]
+categories = [
+    "gui",
+    "game-development",
+]
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/emilk/egui/tree/main/crates/egui-wgpu"
+resolver = "2"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--generate-link-to-definition"]
+
+[features]
+capture = ["dep:egui"]
+default = [
+    "fragile-send-sync-non-atomic-wasm",
+    "macos-window-resize-jitter-fix",
+    "wgpu/default",
+    "wgpu/webgl",
+]
+fragile-send-sync-non-atomic-wasm = ["wgpu/fragile-send-sync-non-atomic-wasm"]
+macos-window-resize-jitter-fix = ["wgpu/metal"]
+wayland = ["winit?/wayland"]
+winit = [
+    "dep:winit",
+    "winit/rwh_06",
+    "dep:egui",
+    "capture",
+]
+x11 = ["winit?/x11"]
+
+[lib]
+name = "egui_wgpu"
+path = "src/lib.rs"
+
+[dependencies.ahash]
+version = "0.8.12"
+features = [
+    "no-rng",
+    "std",
+]
+default-features = false
+
+[dependencies.bytemuck]
+version = "1.25"
+
+[dependencies.document-features]
+version = "0.2.12"
+
+[dependencies.egui]
+version = "0.36.2"
+optional = true
+default-features = false
+
+[dependencies.epaint]
+version = "0.36.2"
+features = ["bytemuck"]
+default-features = false
+
+[dependencies.log]
+version = "0.4.33"
+features = ["std"]
+
+[dependencies.profiling]
+version = "1.0"
+default-features = false
+
+[dependencies.thiserror]
+version = "2.0"
+
+[dependencies.type-map]
+version = "0.5.1"
+
+[dependencies.web-time]
+version = "1.1"
+
+[dependencies.wgpu]
+version = "30.0"
+features = [
+    "std",
+    "wgsl",
+]
+default-features = false
+
+[dependencies.winit]
+version = "0.30.13"
+optional = true
+default-features = false
+
+[lints.clippy]
+allow_attributes = "warn"
+as_ptr_cast_mut = "warn"
+assigning_clones = "allow"
+bool_to_int_with_if = "warn"
+branches_sharing_code = "warn"
+cast_possible_truncation = "allow"
+cast_possible_wrap = "allow"
+checked_conversions = "warn"
+clear_with_drain = "warn"
+clone_on_ref_ptr = "warn"
+cloned_instead_of_copied = "warn"
+coerce_container_to_any = "warn"
+comparison_chain = "allow"
+dbg_macro = "warn"
+debug_assert_with_mut_call = "warn"
+decimal_bitwise_operands = "warn"
+default_union_representation = "warn"
+derive_partial_eq_without_eq = "warn"
+disallowed_script_idents = "warn"
+doc_broken_link = "warn"
+doc_comment_double_space_linebreaks = "warn"
+doc_include_without_cfg = "warn"
+doc_link_with_quotes = "warn"
+doc_markdown = "warn"
+duration_suboptimal_units = "warn"
+elidable_lifetime_names = "warn"
+empty_enum_variants_with_brackets = "warn"
+empty_enums = "warn"
+enum_glob_use = "warn"
+equatable_if_let = "warn"
+exit = "warn"
+expl_impl_clone_on_copy = "warn"
+explicit_deref_methods = "warn"
+explicit_into_iter_loop = "warn"
+explicit_iter_loop = "warn"
+fallible_impl_from = "warn"
+filter_map_next = "warn"
+flat_map_option = "warn"
+float_cmp_const = "warn"
+fn_params_excessive_bools = "warn"
+fn_to_numeric_cast_any = "warn"
+format_push_string = "warn"
+from_iter_instead_of_collect = "warn"
+get_unwrap = "warn"
+ignore_without_reason = "warn"
+ignored_unit_patterns = "warn"
+implicit_clone = "warn"
+imprecise_flops = "warn"
+inconsistent_struct_constructor = "warn"
+index_refutable_slice = "warn"
+inefficient_to_string = "warn"
+infinite_loop = "warn"
+into_iter_without_iter = "warn"
+invalid_upcast_comparisons = "warn"
+ip_constant = "warn"
+iter_filter_is_ok = "warn"
+iter_filter_is_some = "warn"
+iter_not_returning_iterator = "warn"
+iter_on_empty_collections = "warn"
+iter_on_single_items = "warn"
+iter_over_hash_type = "warn"
+iter_without_into_iter = "warn"
+large_digit_groups = "warn"
+large_futures = "warn"
+large_include_file = "warn"
+large_stack_arrays = "warn"
+large_stack_frames = "warn"
+large_types_passed_by_value = "warn"
+let_underscore_must_use = "allow"
+let_underscore_untyped = "allow"
+linkedlist = "warn"
+literal_string_with_formatting_args = "warn"
+lossy_float_literal = "warn"
+macro_use_imports = "warn"
+manual_assert = "warn"
+manual_ilog2 = "warn"
+manual_instant_elapsed = "warn"
+manual_is_power_of_two = "warn"
+manual_is_variant_and = "warn"
+manual_let_else = "warn"
+manual_midpoint = "warn"
+manual_range_contains = "allow"
+manual_string_new = "warn"
+map_err_ignore = "warn"
+map_unwrap_or = "allow"
+match_bool = "warn"
+match_same_arms = "warn"
+match_wild_err_arm = "warn"
+match_wildcard_for_single_variants = "warn"
+mem_forget = "warn"
+mismatching_type_param_order = "warn"
+missing_assert_message = "warn"
+missing_errors_doc = "warn"
+missing_fields_in_debug = "warn"
+mut_mut = "warn"
+mutex_integer = "warn"
+needless_continue = "warn"
+needless_for_each = "warn"
+needless_pass_by_ref_mut = "warn"
+needless_pass_by_value = "warn"
+needless_raw_string_hashes = "warn"
+needless_type_cast = "warn"
+negative_feature_names = "warn"
+non_std_lazy_statics = "warn"
+non_zero_suggestions = "warn"
+nonstandard_macro_braces = "warn"
+option_as_ref_cloned = "warn"
+option_option = "warn"
+or_fun_call = "warn"
+path_buf_push_overwrite = "warn"
+pathbuf_init_then_push = "warn"
+precedence_bits = "warn"
+print_stderr = "warn"
+print_stdout = "warn"
+ptr_as_ptr = "warn"
+ptr_cast_constness = "warn"
+pub_underscore_fields = "warn"
+pub_without_shorthand = "warn"
+rc_mutex = "warn"
+redundant_type_annotations = "warn"
+ref_as_ptr = "warn"
+ref_option = "warn"
+ref_option_ref = "warn"
+ref_patterns = "warn"
+rest_pat_in_fully_bound_structs = "warn"
+return_and_then = "warn"
+same_functions_in_if_condition = "warn"
+same_length_and_capacity = "warn"
+self_named_module_files = "allow"
+self_only_used_in_recursion = "warn"
+semicolon_if_nothing_returned = "warn"
+set_contains_or_insert = "warn"
+should_panic_without_expect = "allow"
+significant_drop_tightening = "allow"
+single_char_pattern = "warn"
+single_match_else = "warn"
+single_option_map = "warn"
+std_instead_of_core = "warn"
+str_split_at_newline = "warn"
+str_to_string = "warn"
+string_add = "warn"
+string_add_assign = "warn"
+string_lit_as_bytes = "warn"
+string_lit_chars_any = "warn"
+suspicious_xor_used_as_pow = "warn"
+todo = "warn"
+too_long_first_doc_paragraph = "warn"
+too_many_lines = "allow"
+trailing_empty_array = "warn"
+trait_duplication_in_bounds = "warn"
+transmute_ptr_to_ptr = "warn"
+tuple_array_conversions = "warn"
+unchecked_time_subtraction = "warn"
+undocumented_unsafe_blocks = "warn"
+unimplemented = "warn"
+uninhabited_references = "warn"
+uninlined_format_args = "warn"
+unnecessary_box_returns = "warn"
+unnecessary_debug_formatting = "warn"
+unnecessary_literal_bound = "warn"
+unnecessary_safety_comment = "warn"
+unnecessary_safety_doc = "warn"
+unnecessary_self_imports = "warn"
+unnecessary_semicolon = "warn"
+unnecessary_struct_initialization = "warn"
+unnecessary_trailing_comma = "warn"
+unnecessary_wraps = "warn"
+unnested_or_patterns = "warn"
+unused_async = "warn"
+unused_peekable = "warn"
+unused_rounding = "warn"
+unused_self = "warn"
+unused_trait_names = "warn"
+unwrap_used = "warn"
+use_self = "warn"
+useless_let_if_seq = "warn"
+verbose_file_reads = "warn"
+wildcard_dependencies = "warn"
+wildcard_imports = "allow"
+zero_sized_map_values = "warn"
+
+[lints.clippy.all]
+level = "warn"
+priority = -1
+
+[lints.rust]
+trivial_casts = "allow"
+trivial_numeric_casts = "warn"
+unsafe_code = "deny"
+unused_import_braces = "warn"
+unused_lifetimes = "warn"
+unused_qualifications = "allow"
+
+[lints.rust.future_incompatible]
+level = "warn"
+priority = -1
+
+[lints.rust.nonstandard_style]
+level = "warn"
+priority = -1
+
+[lints.rust.rust_2018_idioms]
+level = "warn"
+priority = -1
+
+[lints.rustdoc]
+all = "warn"
diff --git a/vendor/egui-wgpu/Cargo.toml.orig b/vendor/egui-wgpu/Cargo.toml.orig
new file mode 100644
index 00000000..59090518
--- /dev/null
+++ b/vendor/egui-wgpu/Cargo.toml.orig
@@ -0,0 +1,75 @@
+[package]
+name = "egui-wgpu"
+version.workspace = true
+description = "Bindings for using egui natively using the wgpu library"
+authors = [
+  "Nils Hasenbanck <nils@hasenbanck.de>",
+  "embotech <opensource@embotech.com>",
+  "Emil Ernerfeldt <emil.ernerfeldt@gmail.com>",
+]
+edition.workspace = true
+rust-version.workspace = true
+homepage = "https://github.com/emilk/egui/tree/main/crates/egui-wgpu"
+license.workspace = true
+readme = "README.md"
+repository = "https://github.com/emilk/egui/tree/main/crates/egui-wgpu"
+categories = ["gui", "game-development"]
+keywords = ["wgpu", "egui", "gui", "gamedev"]
+include = ["../../LICENSE-APACHE", "../../LICENSE-MIT", "**/*.rs", "**/*.wgsl", "Cargo.toml"]
+
+[lints]
+workspace = true
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--generate-link-to-definition"]
+
+[features]
+default = [
+  "fragile-send-sync-non-atomic-wasm",
+  "macos-window-resize-jitter-fix",
+  "wgpu/default",
+  "wgpu/webgl", # A very important fallback for web support
+]
+
+## Enables the `capture` module for capturing screenshots.
+capture = ["dep:egui"]
+
+## Enable [`winit`](https://docs.rs/winit) integration. On Linux, requires either `wayland` or `x11`
+winit = ["dep:winit", "winit/rwh_06", "dep:egui", "capture"]
+
+## Enables Wayland support for winit.
+wayland = ["winit?/wayland"]
+
+## Enables x11 support for winit.
+x11 = ["winit?/x11"]
+
+## Make the renderer `Sync` on wasm, exploiting that by default wasm isn't multithreaded.
+## It may make code easier, especially when targeting both native and web.
+## On native most wgpu objects are send and sync, on the web they are not (by nature of the WebGPU specification).
+## This is not supported in [multithreaded WASM](https://gpuweb.github.io/gpuweb/explainer/#multithreading-transfer).
+## Thus that usage is guarded against with compiler errors in wgpu.
+fragile-send-sync-non-atomic-wasm = ["wgpu/fragile-send-sync-non-atomic-wasm"]
+
+## Enables the macOS live-resize jitter fix, which uses `present_with_transaction`.
+## This requires the `wgpu/metal` backend. Disable this feature if you want to use egui-wgpu
+## with a different backend (e.g. Vulkan or GL) on macOS without pulling in Metal.
+macos-window-resize-jitter-fix = ["wgpu/metal"]
+
+[dependencies]
+epaint = { workspace = true, default-features = false, features = ["bytemuck"] }
+
+ahash.workspace = true
+bytemuck.workspace = true
+document-features.workspace = true
+log.workspace = true
+profiling.workspace = true
+thiserror.workspace = true
+type-map.workspace = true
+web-time.workspace = true
+wgpu = { workspace = true, features = ["wgsl"] }
+
+# Optional dependencies:
+
+egui = { workspace = true, optional = true, default-features = false }
+winit = { workspace = true, optional = true, default-features = false }
diff --git a/vendor/egui-wgpu/LICENSE-APACHE b/vendor/egui-wgpu/LICENSE-APACHE
new file mode 100644
index 00000000..11069edd
--- /dev/null
+++ b/vendor/egui-wgpu/LICENSE-APACHE
@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/vendor/egui-wgpu/LICENSE-MIT b/vendor/egui-wgpu/LICENSE-MIT
new file mode 100644
index 00000000..673ea5f0
--- /dev/null
+++ b/vendor/egui-wgpu/LICENSE-MIT
@@ -0,0 +1,25 @@
+Copyright (c) 2018-2021 Emil Ernerfeldt <emil.ernerfeldt@gmail.com>
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
diff --git a/vendor/egui-wgpu/README.md b/vendor/egui-wgpu/README.md
new file mode 100644
index 00000000..9aab3159
--- /dev/null
+++ b/vendor/egui-wgpu/README.md
@@ -0,0 +1,10 @@
+# egui-wgpu
+
+[![Latest version](https://img.shields.io/crates/v/egui-wgpu.svg)](https://crates.io/crates/egui-wgpu)
+[![Documentation](https://docs.rs/egui-wgpu/badge.svg)](https://docs.rs/egui-wgpu)
+![MIT](https://img.shields.io/badge/license-MIT-blue.svg)
+![Apache](https://img.shields.io/badge/license-Apache-blue.svg)
+
+This crates provides bindings between [`egui`](https://github.com/emilk/egui) and [wgpu](https://crates.io/crates/wgpu).
+
+This was originally hosted at https://github.com/hasenbanck/egui_wgpu_backend
diff --git a/vendor/egui-wgpu/src/capture.rs b/vendor/egui-wgpu/src/capture.rs
new file mode 100644
index 00000000..54ddeb88
--- /dev/null
+++ b/vendor/egui-wgpu/src/capture.rs
@@ -0,0 +1,267 @@
+use egui::{UserData, ViewportId};
+use epaint::ColorImage;
+use std::sync::{Arc, mpsc};
+use wgpu::{BindGroupLayout, MultisampleState, StoreOp};
+
+/// A texture and a buffer for reading the rendered frame back to the cpu.
+///
+/// The texture is required since [`wgpu::TextureUsages::COPY_SRC`] is not an allowed
+/// flag for the surface texture on all platforms. This means that anytime we want to
+/// capture the frame, we first render it to this texture, and then we can copy it to
+/// both the surface texture (via a render pass) and the buffer (via a texture to buffer copy),
+/// from where we can pull it back
+/// to the cpu.
+pub struct CaptureState {
+    padding: BufferPadding,
+    pub texture: wgpu::Texture,
+    pipeline: wgpu::RenderPipeline,
+    bind_group: wgpu::BindGroup,
+}
+
+pub type CaptureReceiver = mpsc::Receiver<(ViewportId, Vec<UserData>, ColorImage)>;
+pub type CaptureSender = mpsc::Sender<(ViewportId, Vec<UserData>, ColorImage)>;
+pub use mpsc::channel as capture_channel;
+
+impl CaptureState {
+    pub fn new(device: &wgpu::Device, surface_texture: &wgpu::Texture) -> Self {
+        let shader = device.create_shader_module(wgpu::include_wgsl!("texture_copy.wgsl"));
+
+        let pipeline = device.create_render_pipeline(&wgpu::RenderPipelineDescriptor {
+            label: Some("texture_copy"),
+            layout: None,
+            vertex: wgpu::VertexState {
+                module: &shader,
+                entry_point: Some("vs_main"),
+                compilation_options: Default::default(),
+                buffers: &[],
+            },
+            fragment: Some(wgpu::FragmentState {
+                module: &shader,
+                entry_point: Some("fs_main"),
+                compilation_options: Default::default(),
+                targets: &[Some(surface_texture.format().into())],
+            }),
+            primitive: wgpu::PrimitiveState {
+                topology: wgpu::PrimitiveTopology::TriangleList,
+                ..Default::default()
+            },
+            depth_stencil: None,
+            multisample: MultisampleState::default(),
+            multiview_mask: None,
+            cache: None,
+        });
+
+        let bind_group_layout = pipeline.get_bind_group_layout(0);
+
+        let (texture, padding, bind_group) =
+            Self::create_texture(device, surface_texture, &bind_group_layout);
+
+        Self {
+            padding,
+            texture,
+            pipeline,
+            bind_group,
+        }
+    }
+
+    fn create_texture(
+        device: &wgpu::Device,
+        surface_texture: &wgpu::Texture,
+        layout: &BindGroupLayout,
+    ) -> (wgpu::Texture, BufferPadding, wgpu::BindGroup) {
+        let texture = device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("egui_screen_capture_texture"),
+            size: surface_texture.size(),
+            mip_level_count: surface_texture.mip_level_count(),
+            sample_count: surface_texture.sample_count(),
+            dimension: surface_texture.dimension(),
+            format: surface_texture.format(),
+            usage: wgpu::TextureUsages::RENDER_ATTACHMENT
+                | wgpu::TextureUsages::TEXTURE_BINDING
+                | wgpu::TextureUsages::COPY_SRC,
+            view_formats: &[],
+        });
+
+        let padding = BufferPadding::new(surface_texture.width());
+
+        let view = texture.create_view(&Default::default());
+
+        let bind_group = device.create_bind_group(&wgpu::BindGroupDescriptor {
+            layout,
+            entries: &[wgpu::BindGroupEntry {
+                binding: 0,
+                resource: wgpu::BindingResource::TextureView(&view),
+            }],
+            label: None,
+        });
+
+        (texture, padding, bind_group)
+    }
+
+    /// Updates the [`CaptureState`] if the size of the surface texture has changed
+    pub fn update(&mut self, device: &wgpu::Device, texture: &wgpu::Texture) {
+        if self.texture.size() != texture.size() {
+            let (new_texture, padding, bind_group) =
+                Self::create_texture(device, texture, &self.pipeline.get_bind_group_layout(0));
+            self.texture = new_texture;
+            self.padding = padding;
+            self.bind_group = bind_group;
+        }
+    }
+
+    /// Handles copying from the [`CaptureState`] texture to the surface texture and the buffer.
+    /// Pass the returned buffer to [`CaptureState::read_screen_rgba`] to read the data back to the cpu.
+    pub fn copy_textures(
+        &mut self,
+        device: &wgpu::Device,
+        output_frame: &wgpu::SurfaceTexture,
+        encoder: &mut wgpu::CommandEncoder,
+    ) -> wgpu::Buffer {
+        debug_assert_eq!(
+            self.texture.size(),
+            output_frame.texture.size(),
+            "Texture sizes must match, `CaptureState::update` was probably not called"
+        );
+
+        // It would be more efficient to reuse the Buffer, e.g. via some kind of ring buffer, but
+        // for most screenshot use cases this should be fine. When taking many screenshots (e.g. for a video)
+        // it might make sense to revisit this and implement a more efficient solution.
+        #[allow(clippy::allow_attributes, clippy::arc_with_non_send_sync)] // For wasm
+        let buffer = device.create_buffer(&wgpu::BufferDescriptor {
+            label: Some("egui_screen_capture_buffer"),
+            size: (self.padding.padded_bytes_per_row * self.texture.height()) as u64,
+            usage: wgpu::BufferUsages::COPY_DST | wgpu::BufferUsages::MAP_READ,
+            mapped_at_creation: false,
+        });
+        let padding = self.padding;
+        let tex = &mut self.texture;
+
+        let tex_extent = tex.size();
+
+        encoder.copy_texture_to_buffer(
+            tex.as_image_copy(),
+            wgpu::TexelCopyBufferInfo {
+                buffer: &buffer,
+                layout: wgpu::TexelCopyBufferLayout {
+                    offset: 0,
+                    bytes_per_row: Some(padding.padded_bytes_per_row),
+                    rows_per_image: None,
+                },
+            },
+            tex_extent,
+        );
+
+        let mut pass = encoder.begin_render_pass(&wgpu::RenderPassDescriptor {
+            label: Some("texture_copy"),
+            color_attachments: &[Some(wgpu::RenderPassColorAttachment {
+                view: &output_frame.texture.create_view(&Default::default()),
+                resolve_target: None,
+                ops: wgpu::Operations {
+                    load: wgpu::LoadOp::Clear(wgpu::Color::TRANSPARENT),
+                    store: StoreOp::Store,
+                },
+                depth_slice: None,
+            })],
+            depth_stencil_attachment: None,
+            occlusion_query_set: None,
+            timestamp_writes: None,
+            multiview_mask: None,
+        });
+
+        pass.set_pipeline(&self.pipeline);
+        pass.set_bind_group(0, &self.bind_group, &[]);
+        pass.draw(0..3, 0..1);
+
+        buffer
+    }
+
+    /// Handles copying from the [`CaptureState`] texture to the surface texture and the cpu
+    /// This function is non-blocking and will send the data to the given sender when it's ready.
+    /// Pass in the buffer returned from [`CaptureState::copy_textures`].
+    /// Make sure to call this after the encoder has been submitted.
+    pub fn read_screen_rgba(
+        &self,
+        ctx: egui::Context,
+        buffer: wgpu::Buffer,
+        data: Vec<UserData>,
+        tx: CaptureSender,
+        viewport_id: ViewportId,
+    ) {
+        #[allow(clippy::allow_attributes, clippy::arc_with_non_send_sync)] // For wasm
+        let buffer = Arc::new(buffer);
+        let buffer_clone = Arc::clone(&buffer);
+        let buffer_slice = buffer_clone.slice(..);
+        let format = self.texture.format();
+        let tex_extent = self.texture.size();
+        let padding = self.padding;
+        let to_rgba = match format {
+            wgpu::TextureFormat::Rgba8Unorm => [0, 1, 2, 3],
+            wgpu::TextureFormat::Bgra8Unorm => [2, 1, 0, 3],
+            _ => {
+                log::error!(
+                    "Screen can't be captured unless the surface format is Rgba8Unorm or Bgra8Unorm. Current surface format is {format:?}"
+                );
+                return;
+            }
+        };
+        buffer_slice.map_async(wgpu::MapMode::Read, move |result| {
+            if let Err(err) = result {
+                log::error!("Failed to map buffer for reading: {err}");
+                return;
+            }
+            let buffer_slice = buffer.slice(..);
+
+            let mut pixels = Vec::with_capacity((tex_extent.width * tex_extent.height) as usize);
+            let mapped_range = match buffer_slice.get_mapped_range() {
+                Ok(range) => range,
+                Err(err) => {
+                    log::error!("Failed to get mapped range for reading: {err}");
+                    return;
+                }
+            };
+            for padded_row in mapped_range.chunks(padding.padded_bytes_per_row as usize) {
+                let row = &padded_row[..padding.unpadded_bytes_per_row as usize];
+                for color in row.chunks(4) {
+                    pixels.push(epaint::Color32::from_rgba_premultiplied(
+                        color[to_rgba[0]],
+                        color[to_rgba[1]],
+                        color[to_rgba[2]],
+                        color[to_rgba[3]],
+                    ));
+                }
+            }
+            drop(mapped_range);
+            buffer.unmap();
+
+            tx.send((
+                viewport_id,
+                data,
+                ColorImage::new(
+                    [tex_extent.width as usize, tex_extent.height as usize],
+                    pixels,
+                ),
+            ))
+            .ok();
+            ctx.request_repaint();
+        });
+    }
+}
+
+#[derive(Copy, Clone)]
+struct BufferPadding {
+    unpadded_bytes_per_row: u32,
+    padded_bytes_per_row: u32,
+}
+
+impl BufferPadding {
+    fn new(width: u32) -> Self {
+        let bytes_per_pixel = core::mem::size_of::<u32>() as u32;
+        let unpadded_bytes_per_row = width * bytes_per_pixel;
+        let padded_bytes_per_row =
+            wgpu::util::align_to(unpadded_bytes_per_row, wgpu::COPY_BYTES_PER_ROW_ALIGNMENT);
+        Self {
+            unpadded_bytes_per_row,
+            padded_bytes_per_row,
+        }
+    }
+}
diff --git a/vendor/egui-wgpu/src/egui.wgsl b/vendor/egui-wgpu/src/egui.wgsl
new file mode 100644
index 00000000..39210841
--- /dev/null
+++ b/vendor/egui-wgpu/src/egui.wgsl
@@ -0,0 +1,162 @@
+// Vertex shader bindings
+
+struct VertexOutput {
+    @location(0) tex_coord: vec2<f32>,
+    @location(1) color: vec4<f32>, // gamma 0-1
+    @builtin(position) position: vec4<f32>,
+};
+
+struct Locals {
+    screen_size: vec2<f32>,
+
+    /// 1 if dithering is enabled, 0 otherwise
+    dithering: u32,
+
+    /// 1 to do manual filtering for more predictable kittest snapshot images.
+    /// See also https://github.com/emilk/egui/issues/5295
+    predictable_texture_filtering: u32,
+};
+@group(0) @binding(0) var<uniform> r_locals: Locals;
+
+
+// -----------------------------------------------
+// Adapted from
+// https://www.shadertoy.com/view/llVGzG
+// Originally presented in:
+// Jimenez 2014, "Next Generation Post-Processing in Call of Duty"
+//
+// A good overview can be found in
+// https://blog.demofox.org/2022/01/01/interleaved-gradient-noise-a-different-kind-of-low-discrepancy-sequence/
+// via https://github.com/rerun-io/rerun/
+fn interleaved_gradient_noise(n: vec2<f32>) -> f32 {
+    let f = 0.06711056 * n.x + 0.00583715 * n.y;
+    return fract(52.9829189 * fract(f));
+}
+
+fn dither_interleaved(rgb: vec3<f32>, levels: f32, frag_coord: vec4<f32>) -> vec3<f32> {
+    var noise = interleaved_gradient_noise(frag_coord.xy);
+    // scale down the noise slightly to ensure flat colors aren't getting dithered
+    noise = (noise - 0.5) * 0.95;
+    return rgb + noise / (levels - 1.0);
+}
+
+// 0-1 linear  from  0-1 sRGB gamma
+fn linear_from_gamma_rgb(srgb: vec3<f32>) -> vec3<f32> {
+    let cutoff = srgb < vec3<f32>(0.04045);
+    let lower = srgb / vec3<f32>(12.92);
+    let higher = pow((srgb + vec3<f32>(0.055)) / vec3<f32>(1.055), vec3<f32>(2.4));
+    return select(higher, lower, cutoff);
+}
+
+// 0-1 sRGB gamma  from  0-1 linear
+fn gamma_from_linear_rgb(rgb: vec3<f32>) -> vec3<f32> {
+    let cutoff = rgb < vec3<f32>(0.0031308);
+    let lower = rgb * vec3<f32>(12.92);
+    let higher = vec3<f32>(1.055) * pow(rgb, vec3<f32>(1.0 / 2.4)) - vec3<f32>(0.055);
+    return select(higher, lower, cutoff);
+}
+
+// 0-1 sRGBA gamma  from  0-1 linear
+fn gamma_from_linear_rgba(linear_rgba: vec4<f32>) -> vec4<f32> {
+    return vec4<f32>(gamma_from_linear_rgb(linear_rgba.rgb), linear_rgba.a);
+}
+
+// [u8; 4] SRGB as u32 -> [r, g, b, a] in 0.-1
+fn unpack_color(color: u32) -> vec4<f32> {
+    return vec4<f32>(
+        f32(color & 255u),
+        f32((color >> 8u) & 255u),
+        f32((color >> 16u) & 255u),
+        f32((color >> 24u) & 255u),
+    ) / 255.0;
+}
+
+fn position_from_screen(screen_pos: vec2<f32>) -> vec4<f32> {
+    return vec4<f32>(
+        2.0 * screen_pos.x / r_locals.screen_size.x - 1.0,
+        1.0 - 2.0 * screen_pos.y / r_locals.screen_size.y,
+        0.0,
+        1.0,
+    );
+}
+
+@vertex
+fn vs_main(
+    @location(0) a_pos: vec2<f32>,
+    @location(1) a_tex_coord: vec2<f32>,
+    @location(2) a_color: u32,
+) -> VertexOutput {
+    var out: VertexOutput;
+    out.tex_coord = a_tex_coord;
+    out.color = unpack_color(a_color);
+    out.position = position_from_screen(a_pos);
+    return out;
+}
+
+// Fragment shader bindings
+
+@group(1) @binding(0) var r_tex_color: texture_2d<f32>;
+@group(1) @binding(1) var r_tex_sampler: sampler;
+
+fn sample_texture(in: VertexOutput) -> vec4<f32> {
+    if r_locals.predictable_texture_filtering == 0 {
+        // Hardware filtering: fast, but varies across GPUs and drivers.
+        return textureSample(r_tex_color, r_tex_sampler, in.tex_coord);
+    } else {
+        // Manual bilinear filtering with four taps at pixel centers using textureLoad
+        let texture_size = vec2<i32>(textureDimensions(r_tex_color, 0));
+        let texture_size_f = vec2<f32>(texture_size);
+        let pixel_coord = in.tex_coord * texture_size_f - 0.5;
+        let pixel_fract = fract(pixel_coord);
+        let pixel_floor = vec2<i32>(floor(pixel_coord));
+
+        // Manual texture clamping
+        let max_coord = texture_size - vec2<i32>(1, 1);
+        let p00 = clamp(pixel_floor + vec2<i32>(0, 0), vec2<i32>(0, 0), max_coord);
+        let p10 = clamp(pixel_floor + vec2<i32>(1, 0), vec2<i32>(0, 0), max_coord);
+        let p01 = clamp(pixel_floor + vec2<i32>(0, 1), vec2<i32>(0, 0), max_coord);
+        let p11 = clamp(pixel_floor + vec2<i32>(1, 1), vec2<i32>(0, 0), max_coord);
+
+        // Load at pixel centers
+        let tl = textureLoad(r_tex_color, p00, 0);
+        let tr = textureLoad(r_tex_color, p10, 0);
+        let bl = textureLoad(r_tex_color, p01, 0);
+        let br = textureLoad(r_tex_color, p11, 0);
+
+        // Manual bilinear interpolation
+        let top = mix(tl, tr, pixel_fract.x);
+        let bottom = mix(bl, br, pixel_fract.x);
+        return mix(top, bottom, pixel_fract.y);
+    }
+}
+
+@fragment
+fn fs_main_linear_framebuffer(in: VertexOutput) -> @location(0) vec4<f32> {
+    // We expect "normal" textures that are NOT sRGB-aware.
+    let tex_gamma = sample_texture(in);
+    var out_color_gamma = in.color * tex_gamma;
+    // Dither the float color down to eight bits to reduce banding.
+    // This step is optional for egui backends.
+    // Note that dithering is performed on the gamma encoded values,
+    // because this function is used together with a srgb converting target.
+    if r_locals.dithering == 1 {
+        let out_color_gamma_rgb = dither_interleaved(out_color_gamma.rgb, 256.0, in.position);
+        out_color_gamma = vec4<f32>(out_color_gamma_rgb, out_color_gamma.a);
+    }
+    let out_color_linear = linear_from_gamma_rgb(out_color_gamma.rgb);
+    return vec4<f32>(out_color_linear, out_color_gamma.a);
+}
+
+@fragment
+fn fs_main_gamma_framebuffer(in: VertexOutput) -> @location(0) vec4<f32> {
+    // We expect "normal" textures that are NOT sRGB-aware.
+    let tex_gamma = sample_texture(in);
+    var out_color_gamma = in.color * tex_gamma;
+    // Dither the float color down to eight bits to reduce banding.
+    // This step is optional for egui backends.
+    if r_locals.dithering == 1 {
+        let out_color_gamma_rgb = dither_interleaved(out_color_gamma.rgb, 256.0, in.position);
+        out_color_gamma = vec4<f32>(out_color_gamma_rgb, out_color_gamma.a);
+    }
+    return out_color_gamma;
+}
diff --git a/vendor/egui-wgpu/src/lib.rs b/vendor/egui-wgpu/src/lib.rs
new file mode 100644
index 00000000..1eb975ae
--- /dev/null
+++ b/vendor/egui-wgpu/src/lib.rs
@@ -0,0 +1,555 @@
+//! This crates provides bindings between [`egui`](https://github.com/emilk/egui) and [wgpu](https://crates.io/crates/wgpu).
+//!
+//! If you're targeting WebGL you also need to turn on the
+//! `webgl` feature of the `wgpu` crate:
+//!
+//! ```toml
+//! # Enable both WebGL and WebGPU backends on web.
+//! wgpu = { version = "*", features = ["webgpu", "webgl"] }
+//! ```
+//!
+//! You can control whether WebGL or WebGPU will be picked at runtime by configuring
+//! [`WgpuConfiguration::wgpu_setup`].
+//! The default is to prefer WebGPU and fall back on WebGL.
+//!
+//! ## Feature flags
+#![doc = document_features::document_features!()]
+//!
+
+pub use wgpu;
+
+/// Low-level painting of [`egui`](https://github.com/emilk/egui) on [`wgpu`].
+mod renderer;
+
+mod setup;
+
+pub use renderer::*;
+pub use setup::{
+    EguiDisplayHandle, NativeAdapterSelectorMethod, WgpuSetup, WgpuSetupCreateNew,
+    WgpuSetupExisting,
+};
+
+/// Helpers for capturing screenshots of the UI.
+#[cfg(feature = "capture")]
+pub mod capture;
+
+/// Module for painting [`egui`](https://github.com/emilk/egui) with [`wgpu`] on [`winit`].
+#[cfg(feature = "winit")]
+pub mod winit;
+
+use std::sync::Arc;
+
+use epaint::mutex::RwLock;
+
+/// An error produced by egui-wgpu.
+#[derive(thiserror::Error, Debug)]
+pub enum WgpuError {
+    #[error(transparent)]
+    RequestAdapterError(#[from] wgpu::RequestAdapterError),
+
+    #[error("Adapter selection failed: {0}")]
+    CustomNativeAdapterSelectionError(String),
+
+    #[error("There was no valid format for the surface at all.")]
+    NoSurfaceFormatsAvailable,
+
+    #[error(transparent)]
+    RequestDeviceError(#[from] wgpu::RequestDeviceError),
+
+    #[error(transparent)]
+    CreateSurfaceError(#[from] wgpu::CreateSurfaceError),
+
+    #[cfg(feature = "winit")]
+    #[error(transparent)]
+    HandleError(#[from] ::winit::raw_window_handle::HandleError),
+}
+
+/// Runtime-mutable subset of [`WgpuConfiguration`].
+///
+/// Edit any field to have the surface reconfigured on the next paint.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct SurfaceConfig {
+    /// Present mode used for the primary surface.
+    pub present_mode: wgpu::PresentMode,
+
+    /// Desired maximum number of frames that the presentation engine should queue in advance.
+    ///
+    /// Use `1` for low-latency, and `2` for high-throughput.
+    ///
+    /// See [`wgpu::SurfaceConfiguration::desired_maximum_frame_latency`] for details.
+    ///
+    /// `None` => Let `wgpu` pick a default (currently `2`).
+    pub desired_maximum_frame_latency: Option<u32>,
+}
+
+impl SurfaceConfig {
+    /// Good default for GUIs with very little (or no) extra GPU work.
+    pub const LOW_LATENCY: Self = Self {
+        present_mode: wgpu::PresentMode::AutoVsync,
+
+        desired_maximum_frame_latency: if cfg!(target_os = "ios") {
+            None // The default is good on iOS, while `Some(1)` cuts FPS in half
+        } else {
+            Some(1)
+        },
+    };
+
+    /// Good default for GUIs with a lot of extra GPU work,
+    /// or that want to prioritize smoothness over latency.
+    pub const HIGH_THROUGHPUT: Self = Self {
+        present_mode: wgpu::PresentMode::AutoVsync,
+        desired_maximum_frame_latency: Some(2), // High-throughput.
+    };
+}
+
+/// Access to the render state for egui.
+#[derive(Clone)]
+pub struct RenderState {
+    /// Wgpu adapter used for rendering.
+    pub adapter: wgpu::Adapter,
+
+    /// All the available adapters.
+    ///
+    /// This is not available on web.
+    /// On web, we always select WebGPU is available, then fall back to WebGL if not.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub available_adapters: Vec<wgpu::Adapter>,
+
+    /// Wgpu instance used for creating surfaces and adapters.
+    pub instance: wgpu::Instance,
+
+    /// Wgpu device used for rendering, created from the adapter.
+    pub device: wgpu::Device,
+
+    /// Wgpu queue used for rendering, created from the adapter.
+    pub queue: wgpu::Queue,
+
+    /// The target texture format used for presenting to the window.
+    pub target_format: wgpu::TextureFormat,
+
+    /// Egui renderer responsible for drawing the UI.
+    pub renderer: Arc<RwLock<Renderer>>,
+
+    /// Runtime-mutable subset of the wgpu configuration.
+    ///
+    /// Update this to have the surface reconfigured on the next paint.
+    pub surface_config: SurfaceConfig,
+}
+
+async fn request_adapter(
+    instance: &wgpu::Instance,
+    power_preference: wgpu::PowerPreference,
+    compatible_surface: Option<&wgpu::Surface<'_>>,
+    available_adapters: &[wgpu::Adapter],
+) -> Result<wgpu::Adapter, WgpuError> {
+    profiling::function_scope!();
+
+    let adapter = instance
+        .request_adapter(&wgpu::RequestAdapterOptions {
+            power_preference,
+            compatible_surface,
+            // We don't expose this as an option right now since it's fairly rarely useful:
+            // * only has an effect on native
+            // * fails if there's no software rasterizer available
+            // * can achieve the same with `native_adapter_selector`
+            force_fallback_adapter: false,
+            apply_limit_buckets: false,
+        })
+        .await
+        .inspect_err(|_err| {
+            if cfg!(target_arch = "wasm32") {
+                // Nothing to add here
+            } else if available_adapters.is_empty() {
+                if std::env::var("DYLD_LIBRARY_PATH").is_ok() {
+                    // DYLD_LIBRARY_PATH can sometimes lead to loading dylibs that cause
+                    // us to find zero adapters. Very strange.
+                    // I don't want to debug this again.
+                    // See https://github.com/rerun-io/rerun/issues/11351 for more
+                    log::warn!(
+                        "No wgpu adapter found. This could be because DYLD_LIBRARY_PATH causes dylibs to be loaded that interfere with Metal device creation. Try restarting with DYLD_LIBRARY_PATH=''"
+                    );
+                } else {
+                    log::info!("No wgpu adapter found");
+                }
+            } else if available_adapters.len() == 1 {
+                log::info!(
+                    "The only available wgpu adapter was not suitable: {}",
+                    adapter_info_summary(&available_adapters[0].get_info())
+                );
+            } else {
+                log::info!(
+                    "No suitable wgpu adapter found out of the {} available ones: {}",
+                    available_adapters.len(),
+                    describe_adapters(available_adapters)
+                );
+            }
+        })?;
+
+    if 1 < available_adapters.len() {
+        log::info!(
+            "There are {} available wgpu adapters: {}",
+            available_adapters.len(),
+            describe_adapters(available_adapters)
+        );
+    }
+
+    Ok(adapter)
+}
+
+impl RenderState {
+    /// Creates a new [`RenderState`], containing everything needed for drawing egui with wgpu.
+    ///
+    /// # Errors
+    /// Wgpu initialization may fail due to incompatible hardware or driver for a given config.
+    pub async fn create(
+        config: &WgpuConfiguration,
+        instance: &wgpu::Instance,
+        compatible_surface: Option<&wgpu::Surface<'static>>,
+        options: RendererOptions,
+    ) -> Result<Self, WgpuError> {
+        profiling::scope!("RenderState::create"); // async yield give bad names using `profile_function`
+
+        // This is always an empty list on web.
+        #[cfg(not(target_arch = "wasm32"))]
+        let available_adapters = {
+            let backends = if let WgpuSetup::CreateNew(create_new) = &config.wgpu_setup {
+                create_new.instance_descriptor.backends
+            } else {
+                wgpu::Backends::all()
+            };
+
+            instance.enumerate_adapters(backends).await
+        };
+
+        let (instance, adapter, device, queue) = match config.wgpu_setup.clone() {
+            WgpuSetup::CreateNew(WgpuSetupCreateNew {
+                instance_descriptor: _,
+                display_handle: _,
+                power_preference,
+                native_adapter_selector: _native_adapter_selector,
+                device_descriptor,
+            }) => {
+                let adapter = {
+                    #[cfg(target_arch = "wasm32")]
+                    {
+                        request_adapter(instance, power_preference, compatible_surface, &[]).await
+                    }
+                    #[cfg(not(target_arch = "wasm32"))]
+                    if let Some(native_adapter_selector) = _native_adapter_selector {
+                        native_adapter_selector(&available_adapters, compatible_surface)
+                            .map_err(WgpuError::CustomNativeAdapterSelectionError)
+                    } else {
+                        request_adapter(
+                            instance,
+                            power_preference,
+                            compatible_surface,
+                            &available_adapters,
+                        )
+                        .await
+                    }
+                }?;
+
+                let (device, queue) = {
+                    profiling::scope!("request_device");
+                    adapter
+                        .request_device(&(*device_descriptor)(&adapter))
+                        .await?
+                };
+
+                (instance.clone(), adapter, device, queue)
+            }
+            WgpuSetup::Existing(WgpuSetupExisting {
+                instance,
+                adapter,
+                device,
+                queue,
+            }) => (instance, adapter, device, queue),
+        };
+
+        log_adapter_info(&adapter.get_info());
+
+        let surface_formats = {
+            profiling::scope!("get_capabilities");
+            compatible_surface.map_or_else(
+                || vec![wgpu::TextureFormat::Rgba8Unorm],
+                |s| s.get_capabilities(&adapter).formats,
+            )
+        };
+        let target_format = crate::preferred_framebuffer_format(&surface_formats)?;
+
+        let renderer = Renderer::new(&device, target_format, options);
+
+        // On wasm, depending on feature flags, wgpu objects may or may not implement sync.
+        // It doesn't make sense to switch to Rc for that special usecase, so simply disable the lint.
+        #[allow(clippy::allow_attributes, clippy::arc_with_non_send_sync)] // For wasm
+        Ok(Self {
+            instance,
+            adapter,
+            #[cfg(not(target_arch = "wasm32"))]
+            available_adapters,
+            device,
+            queue,
+            target_format,
+            renderer: Arc::new(RwLock::new(renderer)),
+            surface_config: config.surface,
+        })
+    }
+}
+
+fn describe_adapters(adapters: &[wgpu::Adapter]) -> String {
+    if adapters.is_empty() {
+        "(none)".to_owned()
+    } else if adapters.len() == 1 {
+        adapter_info_summary(&adapters[0].get_info())
+    } else {
+        adapters
+            .iter()
+            .map(|a| format!("{{{}}}", adapter_info_summary(&a.get_info())))
+            .collect::<Vec<_>>()
+            .join(", ")
+    }
+}
+
+/// Specifies which action should be taken as consequence of a surface error.
+pub enum SurfaceErrorAction {
+    /// Do nothing and skip the current frame.
+    SkipFrame,
+
+    /// Reconfigure the existing surface, then skip the current frame.
+    ///
+    /// Calls [`wgpu::Surface::configure`] on the current surface object.
+    /// Use for [`wgpu::CurrentSurfaceTexture::Outdated`].
+    Reconfigure,
+
+    /// Drop the surface, create a new one via [`wgpu::Instance::create_surface`], configure it,
+    /// then skip the current frame.
+    ///
+    /// Use for [`wgpu::CurrentSurfaceTexture::Lost`], where reconfiguring the same surface
+    /// object cannot recover.
+    RecreateSurface,
+}
+
+/// Configuration for using wgpu with eframe or the egui-wgpu winit feature.
+#[derive(Clone)]
+pub struct WgpuConfiguration {
+    /// Runtime-mutable configuration for the surface (present mode, frame latency).
+    ///
+    /// These are the fields exposed via [`RenderState::surface_config`] for live
+    /// reconfiguration at runtime.
+    pub surface: SurfaceConfig,
+
+    /// How to create the wgpu adapter & device
+    pub wgpu_setup: WgpuSetup,
+
+    /// Callback for surface status changes.
+    ///
+    /// Called with the [`wgpu::CurrentSurfaceTexture`] result whenever acquiring a frame
+    /// does not return [`wgpu::CurrentSurfaceTexture::Success`]. For
+    /// [`wgpu::CurrentSurfaceTexture::Suboptimal`], egui uses the frame as-is and
+    /// defers surface reconfiguration to the next frame — the callback is not invoked
+    /// in that case either.
+    pub on_surface_status:
+        Arc<dyn Fn(&wgpu::CurrentSurfaceTexture) -> SurfaceErrorAction + Send + Sync>,
+}
+
+#[test]
+fn wgpu_config_impl_send_sync() {
+    fn assert_send_sync<T: Send + Sync>() {}
+    assert_send_sync::<WgpuConfiguration>();
+}
+
+impl core::fmt::Debug for WgpuConfiguration {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        let Self {
+            surface,
+            wgpu_setup,
+            on_surface_status: _,
+        } = self;
+        f.debug_struct("WgpuConfiguration")
+            .field("surface", &surface)
+            .field("wgpu_setup", &wgpu_setup)
+            .finish_non_exhaustive()
+    }
+}
+
+impl WgpuConfiguration {
+    #[inline]
+    pub fn with_surface_config(mut self, surface_config: SurfaceConfig) -> Self {
+        self.surface = surface_config;
+        self
+    }
+}
+
+impl Default for WgpuConfiguration {
+    fn default() -> Self {
+        Self {
+            surface: SurfaceConfig::HIGH_THROUGHPUT,
+
+            // No display handle available at this point — callers should replace this with
+            // `WgpuSetup::from_display_handle(...)` before creating the instance if one is available.
+            wgpu_setup: WgpuSetup::without_display_handle(),
+            on_surface_status: Arc::new(|status| match status {
+                wgpu::CurrentSurfaceTexture::Outdated => {
+                    // The compositor changed the surface (resize, scale, output, …). wgpu
+                    // requires us to reconfigure before the next acquire. Skipping would mean
+                    // we are stuck in `Outdated` forever.
+                    log::trace!("Dropped frame with error: {status:?}");
+                    SurfaceErrorAction::Reconfigure
+                }
+                wgpu::CurrentSurfaceTexture::Lost => {
+                    // The underlying surface is gone and we need a fresh one from the `wgpu::Instance`.
+                    log::debug!("Dropped frame with error: {status:?}");
+                    SurfaceErrorAction::RecreateSurface
+                }
+                wgpu::CurrentSurfaceTexture::Occluded => {
+                    // App is hidden (minimized / behind another window). Skip silently.
+                    log::trace!("Skipping frame due to occlusion.");
+                    SurfaceErrorAction::SkipFrame
+                }
+                _ => {
+                    log::warn!("Dropped frame with error: {status:?}");
+                    SurfaceErrorAction::SkipFrame
+                }
+            }),
+        }
+    }
+}
+
+/// Find the framebuffer format that egui prefers
+///
+/// # Errors
+/// Returns [`WgpuError::NoSurfaceFormatsAvailable`] if the given list of formats is empty.
+pub fn preferred_framebuffer_format(
+    formats: &[wgpu::TextureFormat],
+) -> Result<wgpu::TextureFormat, WgpuError> {
+    for &format in formats {
+        if matches!(
+            format,
+            wgpu::TextureFormat::Rgba8Unorm | wgpu::TextureFormat::Bgra8Unorm
+        ) {
+            return Ok(format);
+        }
+    }
+
+    formats
+        .first()
+        .copied()
+        .ok_or(WgpuError::NoSurfaceFormatsAvailable)
+}
+
+/// Take's epi's depth/stencil bits and returns the corresponding wgpu format.
+pub fn depth_format_from_bits(depth_buffer: u8, stencil_buffer: u8) -> Option<wgpu::TextureFormat> {
+    match (depth_buffer, stencil_buffer) {
+        (0, 8) => Some(wgpu::TextureFormat::Stencil8),
+        (16, 0) => Some(wgpu::TextureFormat::Depth16Unorm),
+        (24, 0) => Some(wgpu::TextureFormat::Depth24Plus),
+        (24, 8) => Some(wgpu::TextureFormat::Depth24PlusStencil8),
+        (32, 0) => Some(wgpu::TextureFormat::Depth32Float),
+        (32, 8) => Some(wgpu::TextureFormat::Depth32FloatStencil8),
+        _ => None,
+    }
+}
+
+// ---------------------------------------------------------------------------
+
+fn log_adapter_info(info: &wgpu::AdapterInfo) {
+    let summary = adapter_info_summary(info);
+
+    let is_test = cfg!(test); // Software rasterizers are expected (and preferred) during testing!
+
+    if info.device_type == wgpu::DeviceType::Cpu && !is_test {
+        log::warn!("Software rasterizer detected - loss of performance expected. {summary}");
+    } else {
+        log::debug!("wgpu adapter: {summary}");
+    }
+}
+
+/// A human-readable summary about an adapter
+pub fn adapter_info_summary(info: &wgpu::AdapterInfo) -> String {
+    let wgpu::AdapterInfo {
+        name,
+        vendor,
+        device,
+        device_type,
+        driver,
+        driver_info,
+        backend,
+        device_pci_bus_id,
+        subgroup_min_size,
+        subgroup_max_size,
+        transient_saves_memory,
+        limit_bucket,
+    } = &info;
+
+    // Example values:
+    // > name: "llvmpipe (LLVM 16.0.6, 256 bits)", device_type: Cpu, backend: Vulkan, driver: "llvmpipe", driver_info: "Mesa 23.1.6-arch1.4 (LLVM 16.0.6)"
+    // > name: "Apple M1 Pro", device_type: IntegratedGpu, backend: Metal, driver: "", driver_info: ""
+    // > name: "ANGLE (Apple, Apple M1 Pro, OpenGL 4.1)", device_type: IntegratedGpu, backend: Gl, driver: "", driver_info: ""
+
+    use core::fmt::Write as _;
+
+    let mut summary = format!("backend: {backend:?}, device_type: {device_type:?}");
+
+    if !name.is_empty() {
+        write!(summary, ", name: {name:?}").ok();
+    }
+    if !driver.is_empty() {
+        write!(summary, ", driver: {driver:?}").ok();
+    }
+    if !driver_info.is_empty() {
+        write!(summary, ", driver_info: {driver_info:?}").ok();
+    }
+    if *vendor != 0 {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            write!(
+                summary,
+                ", vendor: {} (0x{vendor:04X})",
+                parse_vendor_id(*vendor)
+            )
+            .ok();
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            write!(summary, ", vendor: 0x{vendor:04X}").ok();
+        }
+    }
+    if *device != 0 {
+        write!(summary, ", device: 0x{device:02X}").ok();
+    }
+    if !device_pci_bus_id.is_empty() {
+        write!(summary, ", pci_bus_id: {device_pci_bus_id:?}").ok();
+    }
+    if *subgroup_min_size != 0 || *subgroup_max_size != 0 {
+        write!(
+            summary,
+            ", subgroup_size: {subgroup_min_size}..={subgroup_max_size}"
+        )
+        .ok();
+    }
+    write!(
+        summary,
+        ", transient_saves_memory: {transient_saves_memory:?}"
+    )
+    .ok();
+    write!(summary, ", limit_bucket: {limit_bucket:?}").ok();
+
+    summary
+}
+
+/// Tries to parse the adapter's vendor ID to a human-readable string.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn parse_vendor_id(vendor_id: u32) -> &'static str {
+    match vendor_id {
+        wgpu::hal::auxil::db::amd::VENDOR => "AMD",
+        wgpu::hal::auxil::db::apple::VENDOR => "Apple",
+        wgpu::hal::auxil::db::arm::VENDOR => "ARM",
+        wgpu::hal::auxil::db::broadcom::VENDOR => "Broadcom",
+        wgpu::hal::auxil::db::imgtec::VENDOR => "Imagination Technologies",
+        wgpu::hal::auxil::db::intel::VENDOR => "Intel",
+        wgpu::hal::auxil::db::mesa::VENDOR => "Mesa",
+        wgpu::hal::auxil::db::nvidia::VENDOR => "NVIDIA",
+        wgpu::hal::auxil::db::qualcomm::VENDOR => "Qualcomm",
+        _ => "Unknown",
+    }
+}
diff --git a/vendor/egui-wgpu/src/renderer.rs b/vendor/egui-wgpu/src/renderer.rs
new file mode 100644
index 00000000..de8808de
--- /dev/null
+++ b/vendor/egui-wgpu/src/renderer.rs
@@ -0,0 +1,1178 @@
+use core::{num::NonZeroU64, ops::Range};
+use std::borrow::Cow;
+
+use ahash::HashMap;
+use bytemuck::Zeroable as _;
+use epaint::{PaintCallbackInfo, Primitive, Vertex, emath::NumExt as _};
+
+use wgpu::util::DeviceExt as _;
+
+// Only implements Send + Sync on wasm32 in order to allow storing wgpu resources on the type map.
+#[cfg(not(all(
+    target_arch = "wasm32",
+    not(feature = "fragile-send-sync-non-atomic-wasm"),
+)))]
+/// You can use this for storage when implementing [`CallbackTrait`].
+pub type CallbackResources = type_map::concurrent::TypeMap;
+#[cfg(all(
+    target_arch = "wasm32",
+    not(feature = "fragile-send-sync-non-atomic-wasm"),
+))]
+/// You can use this for storage when implementing [`CallbackTrait`].
+pub type CallbackResources = type_map::TypeMap;
+
+/// You can use this to do custom [`wgpu`] rendering in an egui app.
+///
+/// Implement [`CallbackTrait`] and call [`Callback::new_paint_callback`].
+///
+/// This can be turned into a [`epaint::PaintCallback`] and [`epaint::Shape`].
+pub struct Callback(Box<dyn CallbackTrait>);
+
+impl Callback {
+    /// Creates a new [`epaint::PaintCallback`] from a callback trait instance.
+    pub fn new_paint_callback(
+        rect: epaint::emath::Rect,
+        callback: impl CallbackTrait + 'static,
+    ) -> epaint::PaintCallback {
+        epaint::PaintCallback {
+            rect,
+            callback: std::sync::Arc::new(Self(Box::new(callback))),
+        }
+    }
+}
+
+/// A callback trait that can be used to compose an [`epaint::PaintCallback`] via [`Callback`]
+/// for custom WGPU rendering.
+///
+/// Callbacks in [`Renderer`] are done in three steps:
+/// * [`CallbackTrait::prepare`]: called for all registered callbacks before the main egui render pass.
+/// * [`CallbackTrait::finish_prepare`]: called for all registered callbacks after all callbacks finished calling prepare.
+/// * [`CallbackTrait::paint`]: called for all registered callbacks during the main egui render pass.
+///
+/// Each callback has access to an instance of [`CallbackResources`] that is stored in the [`Renderer`].
+/// This can be used to store wgpu resources that need to be accessed during the [`CallbackTrait::paint`] step.
+///
+/// The callbacks implementing [`CallbackTrait`] itself must always be Send + Sync, but resources stored in
+/// [`Renderer::callback_resources`] are not required to implement Send + Sync when building for wasm.
+/// (this is because wgpu stores references to the JS heap in most of its resources which can not be shared with other threads).
+///
+///
+/// # Command submission
+///
+/// ## Command Encoder
+///
+/// The passed-in [`wgpu::CommandEncoder`] is egui's and can be used directly to register
+/// wgpu commands for simple use cases.
+/// This allows reusing the same [`wgpu::CommandEncoder`] for all callbacks and egui
+/// rendering itself.
+///
+/// ## Command Buffers
+///
+/// For more complicated use cases, one can also return a list of arbitrary
+/// [`wgpu::CommandBuffer`]s and have complete control over how they get created and fed.
+/// In particular, this gives an opportunity to parallelize command registration and
+/// prevents a faulty callback from poisoning the main wgpu pipeline.
+///
+/// When using eframe, the main egui command buffer, as well as all user-defined
+/// command buffers returned by this function, are guaranteed to all be submitted
+/// at once in a single call.
+///
+/// Command Buffers returned by [`CallbackTrait::finish_prepare`] will always be issued *after*
+/// those returned by [`CallbackTrait::prepare`].
+/// Order within command buffers returned by [`CallbackTrait::prepare`] is dependent
+/// on the order the respective [`epaint::Shape::Callback`]s were submitted in.
+///
+/// # Example
+///
+/// See the [`custom3d_wgpu`](https://github.com/emilk/egui/blob/main/crates/egui_demo_app/src/apps/custom3d_wgpu.rs) demo source for a detailed usage example.
+pub trait CallbackTrait: Send + Sync {
+    fn prepare(
+        &self,
+        _device: &wgpu::Device,
+        _queue: &wgpu::Queue,
+        _screen_descriptor: &ScreenDescriptor,
+        _egui_encoder: &mut wgpu::CommandEncoder,
+        _callback_resources: &mut CallbackResources,
+    ) -> Vec<wgpu::CommandBuffer> {
+        Vec::new()
+    }
+
+    /// Called after all [`CallbackTrait::prepare`] calls are done.
+    fn finish_prepare(
+        &self,
+        _device: &wgpu::Device,
+        _queue: &wgpu::Queue,
+        _egui_encoder: &mut wgpu::CommandEncoder,
+        _callback_resources: &mut CallbackResources,
+    ) -> Vec<wgpu::CommandBuffer> {
+        Vec::new()
+    }
+
+    /// Called after all [`CallbackTrait::finish_prepare`] calls are done.
+    ///
+    /// It is given access to the [`wgpu::RenderPass`] so that it can issue draw commands
+    /// into the same [`wgpu::RenderPass`] that is used for all other egui elements.
+    fn paint(
+        &self,
+        info: PaintCallbackInfo,
+        render_pass: &mut wgpu::RenderPass<'static>,
+        callback_resources: &CallbackResources,
+    );
+}
+
+/// Information about the screen used for rendering.
+pub struct ScreenDescriptor {
+    /// Size of the window in physical pixels.
+    pub size_in_pixels: [u32; 2],
+
+    /// High-DPI scale factor (pixels per point).
+    pub pixels_per_point: f32,
+}
+
+impl ScreenDescriptor {
+    /// size in "logical" points
+    fn screen_size_in_points(&self) -> [f32; 2] {
+        [
+            self.size_in_pixels[0] as f32 / self.pixels_per_point,
+            self.size_in_pixels[1] as f32 / self.pixels_per_point,
+        ]
+    }
+}
+
+/// Uniform buffer used when rendering.
+#[derive(Clone, Copy, Debug, PartialEq, bytemuck::Pod, bytemuck::Zeroable)]
+#[repr(C)]
+struct UniformBuffer {
+    screen_size_in_points: [f32; 2],
+    dithering: u32,
+
+    /// 1 to do manual filtering for more predictable kittest snapshot images.
+    ///
+    /// See also <https://github.com/emilk/egui/issues/5295>.
+    predictable_texture_filtering: u32,
+}
+
+struct SlicedBuffer {
+    buffer: wgpu::Buffer,
+    slices: Vec<Range<usize>>,
+    capacity: wgpu::BufferAddress,
+}
+
+pub struct Texture {
+    /// The texture may be None if the `TextureId` is just a handle to a user-provided bind-group.
+    pub texture: Option<wgpu::Texture>,
+
+    /// Bindgroup for the texture + sampler.
+    pub bind_group: wgpu::BindGroup,
+
+    /// Options describing the sampler used in the bind group. This may be None if the `TextureId`
+    /// is just a handle to a user-provided bind-group.
+    pub options: Option<epaint::textures::TextureOptions>,
+}
+
+/// Ways to configure [`Renderer`] during creation.
+#[derive(Clone, Copy, Debug)]
+pub struct RendererOptions {
+    /// Set the level of the multisampling anti-aliasing (MSAA).
+    ///
+    /// Must be a power-of-two. Higher = more smooth 3D.
+    ///
+    /// A value of `0` or `1` turns it off (default).
+    ///
+    /// `egui` already performs anti-aliasing via "feathering"
+    /// (controlled by [`egui::epaint::TessellationOptions`]),
+    /// but if you are embedding 3D in egui you may want to turn on multisampling.
+    pub msaa_samples: u32,
+
+    /// What format to use for the depth and stencil buffers,
+    /// e.g. [`wgpu::TextureFormat::Depth32FloatStencil8`].
+    ///
+    /// egui doesn't need depth/stencil, so the default value is `None` (no depth or stancil buffers).
+    pub depth_stencil_format: Option<wgpu::TextureFormat>,
+
+    /// Controls whether to apply dithering to minimize banding artifacts.
+    ///
+    /// Dithering assumes an sRGB output and thus will apply noise to any input value that lies between
+    /// two 8bit values after applying the sRGB OETF function, i.e. if it's not a whole 8bit value in "gamma space".
+    /// This means that only inputs from texture interpolation and vertex colors should be affected in practice.
+    ///
+    /// Defaults to true.
+    pub dithering: bool,
+
+    /// Perform texture filtering in software?
+    ///
+    /// This is useful when you want predictable rendering across
+    /// different hardware, e.g. for kittest snapshots.
+    ///
+    /// Default is `false`.
+    ///
+    /// See also <https://github.com/emilk/egui/issues/5295>.
+    pub predictable_texture_filtering: bool,
+}
+
+impl RendererOptions {
+    /// Set options that produce the most predicatable output.
+    ///
+    /// Useful for image snapshot tests.
+    pub const PREDICTABLE: Self = Self {
+        msaa_samples: 1,
+        depth_stencil_format: None,
+        dithering: false,
+        predictable_texture_filtering: true,
+    };
+}
+
+impl Default for RendererOptions {
+    fn default() -> Self {
+        Self {
+            msaa_samples: 0,
+            depth_stencil_format: None,
+            dithering: true,
+            predictable_texture_filtering: false,
+        }
+    }
+}
+
+/// Renderer for a egui based GUI.
+pub struct Renderer {
+    pipeline: wgpu::RenderPipeline,
+
+    index_buffer: SlicedBuffer,
+    vertex_buffer: SlicedBuffer,
+
+    uniform_buffer: wgpu::Buffer,
+    previous_uniform_buffer_content: UniformBuffer,
+    uniform_bind_group: wgpu::BindGroup,
+    texture_bind_group_layout: wgpu::BindGroupLayout,
+
+    /// Map of egui texture IDs to textures and their associated bindgroups (texture view +
+    /// sampler). The texture may be None if the `TextureId` is just a handle to a user-provided
+    /// sampler.
+    textures: HashMap<epaint::TextureId, Texture>,
+    next_user_texture_id: u64,
+    samplers: HashMap<epaint::textures::TextureOptions, wgpu::Sampler>,
+
+    options: RendererOptions,
+
+    /// Storage for resources shared with all invocations of [`CallbackTrait`]'s methods.
+    ///
+    /// See also [`CallbackTrait`].
+    pub callback_resources: CallbackResources,
+}
+
+impl Renderer {
+    /// Creates a renderer for a egui UI.
+    ///
+    /// `output_color_format` should preferably be [`wgpu::TextureFormat::Rgba8Unorm`] or
+    /// [`wgpu::TextureFormat::Bgra8Unorm`], i.e. in gamma-space.
+    pub fn new(
+        device: &wgpu::Device,
+        output_color_format: wgpu::TextureFormat,
+        options: RendererOptions,
+    ) -> Self {
+        profiling::function_scope!();
+
+        let shader = wgpu::ShaderModuleDescriptor {
+            label: Some("egui"),
+            source: wgpu::ShaderSource::Wgsl(Cow::Borrowed(include_str!("egui.wgsl"))),
+        };
+        let module = {
+            profiling::scope!("create_shader_module");
+            device.create_shader_module(shader)
+        };
+
+        let uniform_buffer = device.create_buffer_init(&wgpu::util::BufferInitDescriptor {
+            label: Some("egui_uniform_buffer"),
+            contents: bytemuck::cast_slice(&[UniformBuffer {
+                screen_size_in_points: [0.0, 0.0],
+                dithering: u32::from(options.dithering),
+                predictable_texture_filtering: u32::from(options.predictable_texture_filtering),
+            }]),
+            usage: wgpu::BufferUsages::UNIFORM | wgpu::BufferUsages::COPY_DST,
+        });
+
+        let uniform_bind_group_layout = {
+            profiling::scope!("create_bind_group_layout");
+            device.create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+                label: Some("egui_uniform_bind_group_layout"),
+                entries: &[wgpu::BindGroupLayoutEntry {
+                    binding: 0,
+                    visibility: wgpu::ShaderStages::VERTEX | wgpu::ShaderStages::FRAGMENT,
+                    ty: wgpu::BindingType::Buffer {
+                        has_dynamic_offset: false,
+                        min_binding_size: NonZeroU64::new(
+                            core::mem::size_of::<UniformBuffer>() as _
+                        ),
+                        ty: wgpu::BufferBindingType::Uniform,
+                    },
+                    count: None,
+                }],
+            })
+        };
+
+        let uniform_bind_group = {
+            profiling::scope!("create_bind_group");
+            device.create_bind_group(&wgpu::BindGroupDescriptor {
+                label: Some("egui_uniform_bind_group"),
+                layout: &uniform_bind_group_layout,
+                entries: &[wgpu::BindGroupEntry {
+                    binding: 0,
+                    resource: wgpu::BindingResource::Buffer(wgpu::BufferBinding {
+                        buffer: &uniform_buffer,
+                        offset: 0,
+                        size: None,
+                    }),
+                }],
+            })
+        };
+
+        let texture_bind_group_layout = {
+            profiling::scope!("create_bind_group_layout");
+            device.create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+                label: Some("egui_texture_bind_group_layout"),
+                entries: &[
+                    wgpu::BindGroupLayoutEntry {
+                        binding: 0,
+                        visibility: wgpu::ShaderStages::FRAGMENT,
+                        ty: wgpu::BindingType::Texture {
+                            multisampled: false,
+                            sample_type: wgpu::TextureSampleType::Float { filterable: true },
+                            view_dimension: wgpu::TextureViewDimension::D2,
+                        },
+                        count: None,
+                    },
+                    wgpu::BindGroupLayoutEntry {
+                        binding: 1,
+                        visibility: wgpu::ShaderStages::FRAGMENT,
+                        ty: wgpu::BindingType::Sampler(wgpu::SamplerBindingType::Filtering),
+                        count: None,
+                    },
+                ],
+            })
+        };
+
+        let pipeline_layout = device.create_pipeline_layout(&wgpu::PipelineLayoutDescriptor {
+            label: Some("egui_pipeline_layout"),
+            bind_group_layouts: &[
+                Some(&uniform_bind_group_layout),
+                Some(&texture_bind_group_layout),
+            ],
+            immediate_size: 0,
+        });
+
+        let depth_stencil = options
+            .depth_stencil_format
+            .map(|format| wgpu::DepthStencilState {
+                format,
+                depth_write_enabled: Some(false),
+                depth_compare: Some(wgpu::CompareFunction::Always),
+                stencil: wgpu::StencilState::default(),
+                bias: wgpu::DepthBiasState::default(),
+            });
+
+        let pipeline = {
+            profiling::scope!("create_render_pipeline");
+            device.create_render_pipeline(&wgpu::RenderPipelineDescriptor {
+                label: Some("egui_pipeline"),
+                layout: Some(&pipeline_layout),
+                vertex: wgpu::VertexState {
+                    entry_point: Some("vs_main"),
+                    module: &module,
+                    buffers: &[Some(wgpu::VertexBufferLayout {
+                        array_stride: 5 * 4,
+                        step_mode: wgpu::VertexStepMode::Vertex,
+                        // 0: vec2 position
+                        // 1: vec2 texture coordinates
+                        // 2: uint color
+                        attributes: &wgpu::vertex_attr_array![0 => Float32x2, 1 => Float32x2, 2 => Uint32],
+                    })],
+                    compilation_options: wgpu::PipelineCompilationOptions::default()
+                },
+                primitive: wgpu::PrimitiveState {
+                    topology: wgpu::PrimitiveTopology::TriangleList,
+                    unclipped_depth: false,
+                    conservative: false,
+                    cull_mode: None,
+                    front_face: wgpu::FrontFace::default(),
+                    polygon_mode: wgpu::PolygonMode::default(),
+                    strip_index_format: None,
+                },
+                depth_stencil,
+                multisample: wgpu::MultisampleState {
+                    alpha_to_coverage_enabled: false,
+                    count: options.msaa_samples.max(1),
+                    mask: !0,
+                },
+
+                fragment: Some(wgpu::FragmentState {
+                    module: &module,
+                    entry_point: Some(if output_color_format.is_srgb() {
+                        log::warn!("Detected a linear (sRGBA aware) framebuffer {output_color_format:?}. egui prefers Rgba8Unorm or Bgra8Unorm");
+                        "fs_main_linear_framebuffer"
+                    } else {
+                        "fs_main_gamma_framebuffer" // this is what we prefer
+                    }),
+                    targets: &[Some(wgpu::ColorTargetState {
+                        format: output_color_format,
+                        blend: Some(wgpu::BlendState {
+                            color: wgpu::BlendComponent {
+                                src_factor: wgpu::BlendFactor::One,
+                                dst_factor: wgpu::BlendFactor::OneMinusSrcAlpha,
+                                operation: wgpu::BlendOperation::Add,
+                            },
+                            alpha: wgpu::BlendComponent {
+                                src_factor: wgpu::BlendFactor::OneMinusDstAlpha,
+                                dst_factor: wgpu::BlendFactor::One,
+                                operation: wgpu::BlendOperation::Add,
+                            },
+                        }),
+                        write_mask: wgpu::ColorWrites::ALL,
+                    })],
+                    compilation_options: wgpu::PipelineCompilationOptions::default()
+                }),
+                multiview_mask: None,
+                cache: None,
+            }
+        )
+        };
+
+        const VERTEX_BUFFER_START_CAPACITY: wgpu::BufferAddress =
+            (core::mem::size_of::<Vertex>() * 1024) as _;
+        const INDEX_BUFFER_START_CAPACITY: wgpu::BufferAddress =
+            (core::mem::size_of::<u32>() * 1024 * 3) as _;
+
+        Self {
+            pipeline,
+            vertex_buffer: SlicedBuffer {
+                buffer: create_vertex_buffer(device, VERTEX_BUFFER_START_CAPACITY),
+                slices: Vec::with_capacity(64),
+                capacity: VERTEX_BUFFER_START_CAPACITY,
+            },
+            index_buffer: SlicedBuffer {
+                buffer: create_index_buffer(device, INDEX_BUFFER_START_CAPACITY),
+                slices: Vec::with_capacity(64),
+                capacity: INDEX_BUFFER_START_CAPACITY,
+            },
+            uniform_buffer,
+            // Buffers on wgpu are zero initialized, so this is indeed its current state!
+            previous_uniform_buffer_content: UniformBuffer::zeroed(),
+            uniform_bind_group,
+            texture_bind_group_layout,
+            textures: HashMap::default(),
+            next_user_texture_id: 0,
+            samplers: HashMap::default(),
+            options,
+            callback_resources: CallbackResources::default(),
+        }
+    }
+
+    /// Executes the egui renderer onto an existing wgpu renderpass.
+    ///
+    /// Note that the lifetime of `render_pass` is `'static` which requires a call to [`wgpu::RenderPass::forget_lifetime`].
+    /// This allows users to pass resources that live outside of the callback resources to the render pass.
+    /// The render pass internally keeps all referenced resources alive as long as necessary.
+    /// The only consequence of `forget_lifetime` is that any operation on the parent encoder will cause a runtime error
+    /// instead of a compile time error.
+    ///
+    /// # Panic
+    /// Always ensure that [`Renderer::update_buffers`] has been called otherwise calling [`Renderer::render`] will panic!
+    pub fn render(
+        &self,
+        render_pass: &mut wgpu::RenderPass<'static>,
+        paint_jobs: &[epaint::ClippedPrimitive],
+        screen_descriptor: &ScreenDescriptor,
+    ) {
+        profiling::function_scope!();
+
+        let pixels_per_point = screen_descriptor.pixels_per_point;
+        let size_in_pixels = screen_descriptor.size_in_pixels;
+
+        // Whether or not we need to reset the render pass because a paint callback has just
+        // run.
+        let mut needs_reset = true;
+
+        let mut index_buffer_slices = self.index_buffer.slices.iter();
+        let mut vertex_buffer_slices = self.vertex_buffer.slices.iter();
+
+        for epaint::ClippedPrimitive {
+            clip_rect,
+            primitive,
+        } in paint_jobs
+        {
+            if needs_reset {
+                render_pass.set_viewport(
+                    0.0,
+                    0.0,
+                    size_in_pixels[0] as f32,
+                    size_in_pixels[1] as f32,
+                    0.0,
+                    1.0,
+                );
+                render_pass.set_pipeline(&self.pipeline);
+                render_pass.set_bind_group(0, &self.uniform_bind_group, &[]);
+                needs_reset = false;
+            }
+
+            {
+                let rect = ScissorRect::new(clip_rect, pixels_per_point, size_in_pixels);
+
+                if rect.width == 0 || rect.height == 0 {
+                    // Skip rendering zero-sized clip areas.
+                    if let Primitive::Mesh(_) = primitive {
+                        // If this is a mesh, we need to advance the index and vertex buffer iterators:
+                        index_buffer_slices
+                            .next()
+                            .expect("You must call .update_buffers() before .render()");
+                        vertex_buffer_slices
+                            .next()
+                            .expect("You must call .update_buffers() before .render()");
+                    }
+                    continue;
+                }
+
+                render_pass.set_scissor_rect(rect.x, rect.y, rect.width, rect.height);
+            }
+
+            match primitive {
+                Primitive::Mesh(mesh) => {
+                    let index_buffer_slice = index_buffer_slices
+                        .next()
+                        .expect("You must call .update_buffers() before .render()");
+                    let vertex_buffer_slice = vertex_buffer_slices
+                        .next()
+                        .expect("You must call .update_buffers() before .render()");
+
+                    if let Some(Texture { bind_group, .. }) = self.textures.get(&mesh.texture_id) {
+                        render_pass.set_bind_group(1, bind_group, &[]);
+                        render_pass.set_index_buffer(
+                            self.index_buffer.buffer.slice(
+                                index_buffer_slice.start as u64..index_buffer_slice.end as u64,
+                            ),
+                            wgpu::IndexFormat::Uint32,
+                        );
+                        render_pass.set_vertex_buffer(
+                            0,
+                            self.vertex_buffer.buffer.slice(
+                                vertex_buffer_slice.start as u64..vertex_buffer_slice.end as u64,
+                            ),
+                        );
+                        render_pass.draw_indexed(0..mesh.indices.len() as u32, 0, 0..1);
+                    } else {
+                        log::warn!("Missing texture: {:?}", mesh.texture_id);
+                    }
+                }
+                Primitive::Callback(callback) => {
+                    let Some(cbfn) = callback.callback.downcast_ref::<Callback>() else {
+                        // We already warned in the `prepare` callback
+                        continue;
+                    };
+
+                    let info = PaintCallbackInfo {
+                        viewport: callback.rect,
+                        clip_rect: *clip_rect,
+                        pixels_per_point,
+                        screen_size_px: size_in_pixels,
+                    };
+
+                    let viewport_px = info.viewport_in_pixels();
+                    if viewport_px.width_px > 0 && viewport_px.height_px > 0 {
+                        profiling::scope!("callback");
+
+                        needs_reset = true;
+
+                        // We're setting a default viewport for the render pass as a
+                        // courtesy for the user, so that they don't have to think about
+                        // it in the simple case where they just want to fill the whole
+                        // paint area.
+                        //
+                        // The user still has the possibility of setting their own custom
+                        // viewport during the paint callback, effectively overriding this
+                        // one.
+                        render_pass.set_viewport(
+                            viewport_px.left_px as f32,
+                            viewport_px.top_px as f32,
+                            viewport_px.width_px as f32,
+                            viewport_px.height_px as f32,
+                            0.0,
+                            1.0,
+                        );
+
+                        cbfn.0.paint(info, render_pass, &self.callback_resources);
+                    }
+                }
+            }
+        }
+
+        render_pass.set_scissor_rect(0, 0, size_in_pixels[0], size_in_pixels[1]);
+    }
+
+    /// Should be called before [`Self::render`].
+    pub fn update_texture(
+        &mut self,
+        device: &wgpu::Device,
+        queue: &wgpu::Queue,
+        id: epaint::TextureId,
+        image_delta: &epaint::ImageDelta,
+    ) {
+        profiling::function_scope!();
+
+        let width = image_delta.image.width() as u32;
+        let height = image_delta.image.height() as u32;
+
+        let size = wgpu::Extent3d {
+            width,
+            height,
+            depth_or_array_layers: 1,
+        };
+
+        let data_color32 = match &image_delta.image {
+            epaint::ImageData::Color(image) => {
+                assert_eq!(
+                    width as usize * height as usize,
+                    image.pixels.len(),
+                    "Mismatch between texture size and texel count"
+                );
+                Cow::Borrowed(&image.pixels)
+            }
+        };
+        let data_bytes: &[u8] = bytemuck::cast_slice(data_color32.as_slice());
+
+        let queue_write_data_to_texture = |texture, origin| {
+            profiling::scope!("write_texture");
+            queue.write_texture(
+                wgpu::TexelCopyTextureInfo {
+                    texture,
+                    mip_level: 0,
+                    origin,
+                    aspect: wgpu::TextureAspect::All,
+                },
+                data_bytes,
+                wgpu::TexelCopyBufferLayout {
+                    offset: 0,
+                    bytes_per_row: Some(4 * width),
+                    rows_per_image: Some(height),
+                },
+                size,
+            );
+        };
+
+        // Use same label for all resources associated with this texture id (no point in retyping the type)
+        let label_str = format!("egui_texid_{id:?}");
+        let label = Some(label_str.as_str());
+
+        let (texture, origin, bind_group) = if let Some(pos) = image_delta.pos {
+            // update the existing texture
+            let Texture {
+                texture,
+                bind_group,
+                options,
+            } = self
+                .textures
+                .remove(&id)
+                .expect("Tried to update a texture that has not been allocated yet.");
+            let texture = texture.expect("Tried to update user texture.");
+            let options = options.expect("Tried to update user texture.");
+            let origin = wgpu::Origin3d {
+                x: pos[0] as u32,
+                y: pos[1] as u32,
+                z: 0,
+            };
+
+            (
+                texture,
+                origin,
+                // If the TextureOptions are the same as the previous ones, we can reuse the bind group. Otherwise we
+                // have to recreate it.
+                if image_delta.options == options {
+                    Some(bind_group)
+                } else {
+                    None
+                },
+            )
+        } else {
+            // allocate a new texture
+            let texture = {
+                profiling::scope!("create_texture");
+                device.create_texture(&wgpu::TextureDescriptor {
+                    label,
+                    size,
+                    mip_level_count: 1,
+                    sample_count: 1,
+                    dimension: wgpu::TextureDimension::D2,
+                    format: wgpu::TextureFormat::Rgba8Unorm,
+                    usage: wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_DST,
+                    view_formats: &[wgpu::TextureFormat::Rgba8Unorm],
+                })
+            };
+            let origin = wgpu::Origin3d::ZERO;
+            (texture, origin, None)
+        };
+
+        let bind_group = bind_group.unwrap_or_else(|| {
+            let sampler = self
+                .samplers
+                .entry(image_delta.options)
+                .or_insert_with(|| create_sampler(image_delta.options, device));
+            device.create_bind_group(&wgpu::BindGroupDescriptor {
+                label,
+                layout: &self.texture_bind_group_layout,
+                entries: &[
+                    wgpu::BindGroupEntry {
+                        binding: 0,
+                        resource: wgpu::BindingResource::TextureView(
+                            &texture.create_view(&wgpu::TextureViewDescriptor::default()),
+                        ),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 1,
+                        resource: wgpu::BindingResource::Sampler(sampler),
+                    },
+                ],
+            })
+        });
+
+        queue_write_data_to_texture(&texture, origin);
+
+        // A full update must (re)create the texture at exactly the delta's size,
+        // or glyph UVs (normalized by the CPU atlas size) will sample the wrong rows.
+        debug_assert!(
+            image_delta.pos.is_some() || [texture.width(), texture.height()] == [width, height],
+            "egui texture {id:?}: GPU texture is {}x{} but full delta is {width}x{height}",
+            texture.width(),
+            texture.height(),
+        );
+
+        self.textures.insert(
+            id,
+            Texture {
+                texture: Some(texture),
+                bind_group,
+                options: Some(image_delta.options),
+            },
+        );
+    }
+
+    pub fn free_texture(&mut self, id: &epaint::TextureId) {
+        if let Some(texture) = self.textures.remove(id).and_then(|t| t.texture) {
+            texture.destroy();
+        }
+    }
+
+    /// Get the WGPU texture and bind group associated to a texture that has been allocated by egui.
+    ///
+    /// This could be used by custom paint hooks to render images that have been added through
+    /// [`epaint::Context::load_texture`](https://docs.rs/egui/latest/egui/struct.Context.html#method.load_texture).
+    pub fn texture(&self, id: &epaint::TextureId) -> Option<&Texture> {
+        self.textures.get(id)
+    }
+
+    /// Registers a [`wgpu::Texture`] with a [`epaint::TextureId`].
+    ///
+    /// This enables the application to reference the texture inside an image ui element.
+    /// This effectively enables off-screen rendering inside the egui UI. Texture must have
+    /// the texture format [`wgpu::TextureFormat::Rgba8Unorm`].
+    pub fn register_native_texture(
+        &mut self,
+        device: &wgpu::Device,
+        texture: &wgpu::TextureView,
+        texture_filter: wgpu::FilterMode,
+    ) -> epaint::TextureId {
+        self.register_native_texture_with_sampler_options(
+            device,
+            texture,
+            wgpu::SamplerDescriptor {
+                label: Some(format!("egui_user_image_{}", self.next_user_texture_id).as_str()),
+                mag_filter: texture_filter,
+                min_filter: texture_filter,
+                ..Default::default()
+            },
+        )
+    }
+
+    /// Registers a [`wgpu::Texture`] with an existing [`epaint::TextureId`].
+    ///
+    /// This enables applications to reuse [`epaint::TextureId`]s.
+    pub fn update_egui_texture_from_wgpu_texture(
+        &mut self,
+        device: &wgpu::Device,
+        texture: &wgpu::TextureView,
+        texture_filter: wgpu::FilterMode,
+        id: epaint::TextureId,
+    ) {
+        self.update_egui_texture_from_wgpu_texture_with_sampler_options(
+            device,
+            texture,
+            wgpu::SamplerDescriptor {
+                label: Some(format!("egui_user_image_{}", self.next_user_texture_id).as_str()),
+                mag_filter: texture_filter,
+                min_filter: texture_filter,
+                ..Default::default()
+            },
+            id,
+        );
+    }
+
+    /// Registers a [`wgpu::Texture`] with a [`epaint::TextureId`] while also accepting custom
+    /// [`wgpu::SamplerDescriptor`] options.
+    ///
+    /// This allows applications to specify individual minification/magnification filters as well as
+    /// custom mipmap and tiling options.
+    ///
+    /// The texture must have the format [`wgpu::TextureFormat::Rgba8Unorm`].
+    /// Any compare function supplied in the [`wgpu::SamplerDescriptor`] will be ignored.
+    #[expect(clippy::needless_pass_by_value)] // false positive
+    pub fn register_native_texture_with_sampler_options(
+        &mut self,
+        device: &wgpu::Device,
+        texture: &wgpu::TextureView,
+        sampler_descriptor: wgpu::SamplerDescriptor<'_>,
+    ) -> epaint::TextureId {
+        profiling::function_scope!();
+
+        let sampler = device.create_sampler(&wgpu::SamplerDescriptor {
+            compare: None,
+            ..sampler_descriptor
+        });
+
+        let bind_group = device.create_bind_group(&wgpu::BindGroupDescriptor {
+            label: Some(format!("egui_user_image_{}", self.next_user_texture_id).as_str()),
+            layout: &self.texture_bind_group_layout,
+            entries: &[
+                wgpu::BindGroupEntry {
+                    binding: 0,
+                    resource: wgpu::BindingResource::TextureView(texture),
+                },
+                wgpu::BindGroupEntry {
+                    binding: 1,
+                    resource: wgpu::BindingResource::Sampler(&sampler),
+                },
+            ],
+        });
+
+        let id = epaint::TextureId::User(self.next_user_texture_id);
+        self.textures.insert(
+            id,
+            Texture {
+                texture: None,
+                bind_group,
+                options: None,
+            },
+        );
+        self.next_user_texture_id += 1;
+
+        id
+    }
+
+    /// Registers a [`wgpu::Texture`] with an existing [`epaint::TextureId`] while also accepting custom
+    /// [`wgpu::SamplerDescriptor`] options.
+    ///
+    /// This allows applications to reuse [`epaint::TextureId`]s created with custom sampler options.
+    #[expect(clippy::needless_pass_by_value)] // false positive
+    pub fn update_egui_texture_from_wgpu_texture_with_sampler_options(
+        &mut self,
+        device: &wgpu::Device,
+        texture: &wgpu::TextureView,
+        sampler_descriptor: wgpu::SamplerDescriptor<'_>,
+        id: epaint::TextureId,
+    ) {
+        profiling::function_scope!();
+
+        let Texture {
+            bind_group: user_texture_binding,
+            ..
+        } = self
+            .textures
+            .get_mut(&id)
+            .expect("Tried to update a texture that has not been allocated yet.");
+
+        let sampler = device.create_sampler(&wgpu::SamplerDescriptor {
+            compare: None,
+            ..sampler_descriptor
+        });
+
+        let bind_group = device.create_bind_group(&wgpu::BindGroupDescriptor {
+            label: Some(format!("egui_user_image_{}", self.next_user_texture_id).as_str()),
+            layout: &self.texture_bind_group_layout,
+            entries: &[
+                wgpu::BindGroupEntry {
+                    binding: 0,
+                    resource: wgpu::BindingResource::TextureView(texture),
+                },
+                wgpu::BindGroupEntry {
+                    binding: 1,
+                    resource: wgpu::BindingResource::Sampler(&sampler),
+                },
+            ],
+        });
+
+        *user_texture_binding = bind_group;
+    }
+
+    /// Uploads the uniform, vertex and index data used by the renderer.
+    /// Should be called before [`Self::render`].
+    ///
+    /// Returns all user-defined command buffers gathered from [`CallbackTrait::prepare`] & [`CallbackTrait::finish_prepare`] callbacks.
+    pub fn update_buffers(
+        &mut self,
+        device: &wgpu::Device,
+        queue: &wgpu::Queue,
+        encoder: &mut wgpu::CommandEncoder,
+        paint_jobs: &[epaint::ClippedPrimitive],
+        screen_descriptor: &ScreenDescriptor,
+    ) -> Vec<wgpu::CommandBuffer> {
+        profiling::function_scope!();
+
+        let screen_size_in_points = screen_descriptor.screen_size_in_points();
+
+        let uniform_buffer_content = UniformBuffer {
+            screen_size_in_points,
+            dithering: u32::from(self.options.dithering),
+            predictable_texture_filtering: u32::from(self.options.predictable_texture_filtering),
+        };
+        if uniform_buffer_content != self.previous_uniform_buffer_content {
+            profiling::scope!("update uniforms");
+            queue.write_buffer(
+                &self.uniform_buffer,
+                0,
+                bytemuck::cast_slice(&[uniform_buffer_content]),
+            );
+            self.previous_uniform_buffer_content = uniform_buffer_content;
+        }
+
+        // Determine how many vertices & indices need to be rendered, and gather prepare callbacks
+        let mut callbacks = Vec::new();
+        let (vertex_count, index_count) = {
+            profiling::scope!("count_vertices_indices");
+            paint_jobs.iter().fold((0, 0), |acc, clipped_primitive| {
+                match &clipped_primitive.primitive {
+                    Primitive::Mesh(mesh) => {
+                        (acc.0 + mesh.vertices.len(), acc.1 + mesh.indices.len())
+                    }
+                    Primitive::Callback(callback) => {
+                        if let Some(c) = callback.callback.downcast_ref::<Callback>() {
+                            callbacks.push(c.0.as_ref());
+                        } else {
+                            log::warn!("Unknown paint callback: expected `egui_wgpu::Callback`");
+                        }
+                        acc
+                    }
+                }
+            })
+        };
+
+        if index_count > 0 {
+            profiling::scope!("indices", index_count.to_string().as_str());
+
+            self.index_buffer.slices.clear();
+
+            let required_index_buffer_size = (core::mem::size_of::<u32>() * index_count) as u64;
+            if self.index_buffer.capacity < required_index_buffer_size {
+                // Resize index buffer if needed.
+                self.index_buffer.capacity =
+                    (self.index_buffer.capacity * 2).at_least(required_index_buffer_size);
+                self.index_buffer.buffer = create_index_buffer(device, self.index_buffer.capacity);
+            }
+
+            let index_buffer_staging = queue.write_buffer_with(
+                &self.index_buffer.buffer,
+                0,
+                #[expect(clippy::unwrap_used)] // Checked above
+                NonZeroU64::new(required_index_buffer_size).unwrap(),
+            );
+
+            let Some(mut index_buffer_staging) = index_buffer_staging else {
+                panic!(
+                    "Failed to create staging buffer for index data. Index count: {index_count}. Required index buffer size: {required_index_buffer_size}. Actual size {} and capacity: {} (bytes)",
+                    self.index_buffer.buffer.size(),
+                    self.index_buffer.capacity
+                );
+            };
+
+            let mut index_offset = 0;
+            for epaint::ClippedPrimitive { primitive, .. } in paint_jobs {
+                match primitive {
+                    Primitive::Mesh(mesh) => {
+                        let size = mesh.indices.len() * core::mem::size_of::<u32>();
+                        let slice = index_offset..(size + index_offset);
+                        index_buffer_staging
+                            .slice(slice.clone())
+                            .copy_from_slice(bytemuck::cast_slice(&mesh.indices));
+                        self.index_buffer.slices.push(slice);
+                        index_offset += size;
+                    }
+                    Primitive::Callback(_) => {}
+                }
+            }
+        }
+        if vertex_count > 0 {
+            profiling::scope!("vertices", vertex_count.to_string().as_str());
+
+            self.vertex_buffer.slices.clear();
+
+            let required_vertex_buffer_size =
+                (core::mem::size_of::<Vertex>() * vertex_count) as u64;
+            if self.vertex_buffer.capacity < required_vertex_buffer_size {
+                // Resize vertex buffer if needed.
+                self.vertex_buffer.capacity =
+                    (self.vertex_buffer.capacity * 2).at_least(required_vertex_buffer_size);
+                self.vertex_buffer.buffer =
+                    create_vertex_buffer(device, self.vertex_buffer.capacity);
+            }
+
+            let vertex_buffer_staging = queue.write_buffer_with(
+                &self.vertex_buffer.buffer,
+                0,
+                #[expect(clippy::unwrap_used)] // Checked above
+                NonZeroU64::new(required_vertex_buffer_size).unwrap(),
+            );
+
+            let Some(mut vertex_buffer_staging) = vertex_buffer_staging else {
+                panic!(
+                    "Failed to create staging buffer for vertex data. Vertex count: {vertex_count}. Required vertex buffer size: {required_vertex_buffer_size}. Actual size {} and capacity: {} (bytes)",
+                    self.vertex_buffer.buffer.size(),
+                    self.vertex_buffer.capacity
+                );
+            };
+
+            let mut vertex_offset = 0;
+            for epaint::ClippedPrimitive { primitive, .. } in paint_jobs {
+                match primitive {
+                    Primitive::Mesh(mesh) => {
+                        let size = mesh.vertices.len() * core::mem::size_of::<Vertex>();
+                        let slice = vertex_offset..(size + vertex_offset);
+                        vertex_buffer_staging
+                            .slice(slice.clone())
+                            .copy_from_slice(bytemuck::cast_slice(&mesh.vertices));
+                        self.vertex_buffer.slices.push(slice);
+                        vertex_offset += size;
+                    }
+                    Primitive::Callback(_) => {}
+                }
+            }
+        }
+
+        let mut user_cmd_bufs = Vec::new();
+        {
+            profiling::scope!("prepare callbacks");
+            for callback in &callbacks {
+                user_cmd_bufs.extend(callback.prepare(
+                    device,
+                    queue,
+                    screen_descriptor,
+                    encoder,
+                    &mut self.callback_resources,
+                ));
+            }
+        }
+        {
+            profiling::scope!("finish prepare callbacks");
+            for callback in &callbacks {
+                user_cmd_bufs.extend(callback.finish_prepare(
+                    device,
+                    queue,
+                    encoder,
+                    &mut self.callback_resources,
+                ));
+            }
+        }
+
+        user_cmd_bufs
+    }
+}
+
+fn create_sampler(
+    options: epaint::textures::TextureOptions,
+    device: &wgpu::Device,
+) -> wgpu::Sampler {
+    let mag_filter = match options.magnification {
+        epaint::textures::TextureFilter::Nearest => wgpu::FilterMode::Nearest,
+        epaint::textures::TextureFilter::Linear => wgpu::FilterMode::Linear,
+    };
+    let min_filter = match options.minification {
+        epaint::textures::TextureFilter::Nearest => wgpu::FilterMode::Nearest,
+        epaint::textures::TextureFilter::Linear => wgpu::FilterMode::Linear,
+    };
+    let address_mode = match options.wrap_mode {
+        epaint::textures::TextureWrapMode::ClampToEdge => wgpu::AddressMode::ClampToEdge,
+        epaint::textures::TextureWrapMode::Repeat => wgpu::AddressMode::Repeat,
+        epaint::textures::TextureWrapMode::MirroredRepeat => wgpu::AddressMode::MirrorRepeat,
+    };
+    device.create_sampler(&wgpu::SamplerDescriptor {
+        label: Some(&format!(
+            "egui sampler (mag: {mag_filter:?}, min {min_filter:?})"
+        )),
+        mag_filter,
+        min_filter,
+        address_mode_u: address_mode,
+        address_mode_v: address_mode,
+        ..Default::default()
+    })
+}
+
+fn create_vertex_buffer(device: &wgpu::Device, size: u64) -> wgpu::Buffer {
+    profiling::function_scope!();
+    device.create_buffer(&wgpu::BufferDescriptor {
+        label: Some("egui_vertex_buffer"),
+        usage: wgpu::BufferUsages::VERTEX | wgpu::BufferUsages::COPY_DST,
+        size,
+        mapped_at_creation: false,
+    })
+}
+
+fn create_index_buffer(device: &wgpu::Device, size: u64) -> wgpu::Buffer {
+    profiling::function_scope!();
+    device.create_buffer(&wgpu::BufferDescriptor {
+        label: Some("egui_index_buffer"),
+        usage: wgpu::BufferUsages::INDEX | wgpu::BufferUsages::COPY_DST,
+        size,
+        mapped_at_creation: false,
+    })
+}
+
+/// A Rect in physical pixel space, used for setting clipping rectangles.
+struct ScissorRect {
+    x: u32,
+    y: u32,
+    width: u32,
+    height: u32,
+}
+
+impl ScissorRect {
+    fn new(clip_rect: &epaint::Rect, pixels_per_point: f32, target_size: [u32; 2]) -> Self {
+        // Transform clip rect to physical pixels:
+        let clip_min_x = pixels_per_point * clip_rect.min.x;
+        let clip_min_y = pixels_per_point * clip_rect.min.y;
+        let clip_max_x = pixels_per_point * clip_rect.max.x;
+        let clip_max_y = pixels_per_point * clip_rect.max.y;
+
+        // Round to integer:
+        let clip_min_x = clip_min_x.round() as u32;
+        let clip_min_y = clip_min_y.round() as u32;
+        let clip_max_x = clip_max_x.round() as u32;
+        let clip_max_y = clip_max_y.round() as u32;
+
+        // Clamp:
+        let clip_min_x = clip_min_x.clamp(0, target_size[0]);
+        let clip_min_y = clip_min_y.clamp(0, target_size[1]);
+        let clip_max_x = clip_max_x.clamp(clip_min_x, target_size[0]);
+        let clip_max_y = clip_max_y.clamp(clip_min_y, target_size[1]);
+
+        Self {
+            x: clip_min_x,
+            y: clip_min_y,
+            width: clip_max_x - clip_min_x,
+            height: clip_max_y - clip_min_y,
+        }
+    }
+}
+
+// Look at the feature flag for an explanation.
+#[cfg(not(all(
+    target_arch = "wasm32",
+    not(feature = "fragile-send-sync-non-atomic-wasm"),
+)))]
+#[test]
+fn renderer_impl_send_sync() {
+    fn assert_send_sync<T: Send + Sync>() {}
+    assert_send_sync::<Renderer>();
+}
diff --git a/vendor/egui-wgpu/src/setup.rs b/vendor/egui-wgpu/src/setup.rs
new file mode 100644
index 00000000..3c9ceae5
--- /dev/null
+++ b/vendor/egui-wgpu/src/setup.rs
@@ -0,0 +1,331 @@
+use std::sync::Arc;
+
+/// A cloneable display handle for use with [`wgpu::InstanceDescriptor`].
+///
+/// [`wgpu::InstanceDescriptor`] stores its display handle as a non-cloneable
+/// `Box<dyn WgpuHasDisplayHandle>`. This trait wraps it so it can be cloned
+/// alongside the rest of the egui wgpu configuration.
+///
+/// Automatically implemented for all types that satisfy the bounds
+/// (including [`winit::event_loop::OwnedDisplayHandle`]).
+pub trait EguiDisplayHandle:
+    wgpu::rwh::HasDisplayHandle + core::fmt::Debug + Send + Sync + 'static
+{
+    /// Clone into a `Box<dyn WgpuHasDisplayHandle>` for [`wgpu::InstanceDescriptor::display`].
+    fn clone_for_wgpu(&self) -> Box<dyn wgpu::wgt::WgpuHasDisplayHandle>;
+
+    /// Clone into a new `Box<dyn EguiDisplayHandle>`.
+    fn clone_display_handle(&self) -> Box<dyn EguiDisplayHandle>;
+}
+
+impl Clone for Box<dyn EguiDisplayHandle> {
+    fn clone(&self) -> Self {
+        // We need to deref here, otherwise this causes infinite recursion stack overflow.
+        (**self).clone_display_handle()
+    }
+}
+
+impl<T> EguiDisplayHandle for T
+where
+    T: wgpu::rwh::HasDisplayHandle + Clone + core::fmt::Debug + Send + Sync + 'static,
+{
+    fn clone_for_wgpu(&self) -> Box<dyn wgpu::wgt::WgpuHasDisplayHandle> {
+        Box::new(self.clone())
+    }
+
+    fn clone_display_handle(&self) -> Box<dyn EguiDisplayHandle> {
+        Box::new(self.clone())
+    }
+}
+
+#[derive(Clone)]
+#[expect(clippy::large_enum_variant)]
+pub enum WgpuSetup {
+    /// Construct a wgpu setup using some predefined settings & heuristics.
+    /// This is the default option. You can customize most behaviours overriding the
+    /// supported backends, power preferences, and device description.
+    ///
+    /// By default can also be configured with various environment variables:
+    /// * `WGPU_BACKEND`: `vulkan`, `dx12`, `metal`, `opengl`, `webgpu`
+    /// * `WGPU_POWER_PREF`: `low`, `high` or `none`
+    /// * `WGPU_TRACE`: Path to a file to output a wgpu trace file.
+    ///
+    /// Each instance flag also comes with an environment variable (for details see [`wgpu::InstanceFlags`]):
+    /// * `WGPU_VALIDATION`: Enables validation (enabled by default in debug builds).
+    /// * `WGPU_DEBUG`: Generate debug information in shaders and objects  (enabled by default in debug builds).
+    /// * `WGPU_ALLOW_UNDERLYING_NONCOMPLIANT_ADAPTER`: Whether wgpu should expose adapters that run on top of non-compliant adapters.
+    /// * `WGPU_GPU_BASED_VALIDATION`: Enable GPU-based validation.
+    CreateNew(WgpuSetupCreateNew),
+
+    /// Run on an existing wgpu setup.
+    Existing(WgpuSetupExisting),
+}
+
+impl WgpuSetup {
+    /// Creates a new [`WgpuSetup::CreateNew`] with the given display handle.
+    ///
+    /// See [`WgpuSetupCreateNew::from_display_handle`] for details.
+    pub fn from_display_handle(display_handle: impl EguiDisplayHandle) -> Self {
+        Self::CreateNew(WgpuSetupCreateNew::from_display_handle(display_handle))
+    }
+
+    /// Creates a new [`WgpuSetup::CreateNew`] without a display handle.
+    ///
+    /// See [`WgpuSetupCreateNew::without_display_handle`] for details.
+    pub fn without_display_handle() -> Self {
+        Self::CreateNew(WgpuSetupCreateNew::without_display_handle())
+    }
+}
+
+impl core::fmt::Debug for WgpuSetup {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::CreateNew(create_new) => f
+                .debug_tuple("WgpuSetup::CreateNew")
+                .field(create_new)
+                .finish(),
+            Self::Existing { .. } => f.debug_tuple("WgpuSetup::Existing").finish(),
+        }
+    }
+}
+
+impl WgpuSetup {
+    /// Creates a new [`wgpu::Instance`] or clones the existing one.
+    ///
+    /// Does *not* store the wgpu instance, so calling this repeatedly may
+    /// create a new instance every time!
+    pub async fn new_instance(&self) -> wgpu::Instance {
+        match self {
+            Self::CreateNew(create_new) => {
+                #[allow(clippy::allow_attributes, unused_mut)]
+                let mut backends = create_new.instance_descriptor.backends;
+
+                // Don't try WebGPU if we're not in a secure context.
+                // Emscripten is excluded: wgpu gates both its `webgpu` backend and
+                // its `web_sys` re-export on `not(Emscripten)` (see the cfg aliases
+                // in `wgpu/build.rs`).
+                #[cfg(all(target_arch = "wasm32", not(target_os = "emscripten")))]
+                if backends.contains(wgpu::Backends::BROWSER_WEBGPU) {
+                    let is_secure_context =
+                        wgpu::web_sys::window().is_some_and(|w| w.is_secure_context());
+                    if !is_secure_context {
+                        log::info!(
+                            "WebGPU is only available in secure contexts, i.e. on HTTPS and on localhost."
+                        );
+                        backends.remove(wgpu::Backends::BROWSER_WEBGPU);
+                    }
+                }
+
+                log::debug!("Creating wgpu instance with backends {backends:?}");
+                let desc = &create_new.instance_descriptor;
+                let descriptor = wgpu::InstanceDescriptor {
+                    backends: desc.backends,
+                    flags: desc.flags,
+                    backend_options: desc.backend_options.clone(),
+                    memory_budget_thresholds: desc.memory_budget_thresholds,
+                    display: create_new
+                        .display_handle
+                        .as_ref()
+                        .map(|handle| handle.clone_for_wgpu()),
+                };
+                wgpu::util::new_instance_with_webgpu_detection(descriptor).await
+            }
+            Self::Existing(existing) => existing.instance.clone(),
+        }
+    }
+}
+
+impl From<WgpuSetupCreateNew> for WgpuSetup {
+    fn from(create_new: WgpuSetupCreateNew) -> Self {
+        Self::CreateNew(create_new)
+    }
+}
+
+impl From<WgpuSetupExisting> for WgpuSetup {
+    fn from(existing: WgpuSetupExisting) -> Self {
+        Self::Existing(existing)
+    }
+}
+
+/// Method for selecting an adapter on native.
+///
+/// This can be used for fully custom adapter selection.
+/// If available, `wgpu::Surface` is passed to allow checking for surface compatibility.
+pub type NativeAdapterSelectorMethod = Arc<
+    dyn Fn(&[wgpu::Adapter], Option<&wgpu::Surface<'_>>) -> Result<wgpu::Adapter, String>
+        + Send
+        + Sync,
+>;
+
+/// Configuration for creating a new wgpu setup.
+///
+/// Used for [`WgpuSetup::CreateNew`].
+///
+/// Prefer [`Self::from_display_handle`] when you have a display handle available.
+/// Most platforms work without one, but some (e.g. Wayland with GLES, or WebGL)
+/// require it, so providing one ensures maximum compatibility.
+/// With winit, pass [`EventLoop::owned_display_handle`](winit::event_loop::EventLoop::owned_display_handle).
+///
+/// Note: The display handle is stored in [`Self::display_handle`] rather than in
+/// [`Self::instance_descriptor`] so the config can be cloned
+/// ([`wgpu::InstanceDescriptor`] is not `Clone`). It is injected at instance creation time.
+pub struct WgpuSetupCreateNew {
+    /// Descriptor for the wgpu instance.
+    ///
+    /// Leave [`wgpu::InstanceDescriptor::display`] as `None` — use [`Self::display_handle`]
+    /// instead (injected at instance creation time).
+    ///
+    /// The most important field is [`wgpu::InstanceDescriptor::backends`], which controls
+    /// which backends are supported (wgpu will pick one of these). For example, set it to
+    /// [`wgpu::Backends::GL`] to use only WebGL. By default on web, WebGPU is preferred
+    /// with WebGL as a fallback (requires the `webgl` feature of crate `wgpu`).
+    pub instance_descriptor: wgpu::InstanceDescriptor,
+
+    /// Display handle passed to wgpu at instance creation time.
+    ///
+    /// Required on some platforms (e.g. Wayland with GLES, WebGL); optional elsewhere.
+    /// With winit, use [`winit::event_loop::OwnedDisplayHandle`].
+    ///
+    /// `eframe` 's winit & web integrations will attempt to fill the display handle automatically if it is left empty.
+    pub display_handle: Option<Box<dyn EguiDisplayHandle>>,
+
+    /// Power preference for the adapter if [`Self::native_adapter_selector`] is not set or targeting web.
+    pub power_preference: wgpu::PowerPreference,
+
+    /// Optional selector for native adapters.
+    ///
+    /// This field has no effect when targeting web!
+    /// Otherwise, if set [`Self::power_preference`] is ignored and the adapter is instead selected by this method.
+    /// Note that [`Self::instance_descriptor`]'s [`wgpu::InstanceDescriptor::backends`]
+    /// are still used to filter the adapter enumeration in the first place.
+    ///
+    /// Defaults to `None`.
+    pub native_adapter_selector: Option<NativeAdapterSelectorMethod>,
+
+    /// Configuration passed on device request, given an adapter
+    pub device_descriptor:
+        Arc<dyn Fn(&wgpu::Adapter) -> wgpu::DeviceDescriptor<'static> + Send + Sync>,
+}
+
+impl WgpuSetupCreateNew {
+    /// Creates a new configuration with the given display handle.
+    ///
+    /// This is the recommended constructor. Most platforms (Windows, macOS/iOS, Android, web)
+    /// work fine without a display handle, but some (e.g. Wayland on Linux with GLES) require
+    /// one. Providing it unconditionally ensures your app works everywhere.
+    ///
+    /// If you don't have a display handle available, use [`Self::without_display_handle`]
+    /// instead — it will still work on the majority of platforms.
+    ///
+    /// With winit, pass [`EventLoop::owned_display_handle`](winit::event_loop::EventLoop::owned_display_handle).
+    pub fn from_display_handle(display_handle: impl EguiDisplayHandle) -> Self {
+        Self {
+            display_handle: Some(Box::new(display_handle)),
+            ..Self::without_display_handle()
+        }
+    }
+
+    /// Creates a new configuration without a display handle.
+    ///
+    /// A display handle is not required for headless operation (offscreen rendering, tests,
+    /// compute-only workloads). It also isn't needed on most platforms even when presenting
+    /// to a window — only some configurations (e.g. Wayland on Linux with GLES) require one.
+    ///
+    /// If you do have a display handle available, prefer [`Self::from_display_handle`] for
+    /// maximum compatibility.
+    ///
+    /// With winit you can obtain one via [`EventLoop::owned_display_handle`](winit::event_loop::EventLoop::owned_display_handle).
+    ///
+    /// `eframe` 's winit & web integrations will attempt to fill the display handle automatically if it is left empty.
+    pub fn without_display_handle() -> Self {
+        Self {
+            instance_descriptor: wgpu::InstanceDescriptor {
+                // Add GL backend, primarily because WebGPU is not stable enough yet.
+                // (note however, that the GL backend needs to be opted-in via the wgpu feature flag "webgl")
+                backends: wgpu::Backends::from_env()
+                    .unwrap_or(wgpu::Backends::PRIMARY | wgpu::Backends::GL),
+                flags: wgpu::InstanceFlags::from_build_config().with_env(),
+                backend_options: wgpu::BackendOptions::from_env_or_default(),
+                memory_budget_thresholds: wgpu::MemoryBudgetThresholds::default(),
+                display: None,
+            },
+
+            display_handle: None,
+
+            power_preference: wgpu::PowerPreference::from_env()
+                .unwrap_or(wgpu::PowerPreference::HighPerformance),
+
+            native_adapter_selector: None,
+
+            device_descriptor: Arc::new(|adapter| {
+                let base_limits = if adapter.get_info().backend == wgpu::Backend::Gl {
+                    wgpu::Limits::downlevel_webgl2_defaults()
+                } else {
+                    wgpu::Limits::default()
+                };
+
+                wgpu::DeviceDescriptor {
+                    label: Some("egui wgpu device"),
+                    required_limits: wgpu::Limits {
+                        // When using a depth buffer, we have to be able to create a texture
+                        // large enough for the entire surface, and we want to support 4k+ displays.
+                        max_texture_dimension_2d: 8192,
+                        ..base_limits
+                    },
+                    ..Default::default()
+                }
+            }),
+        }
+    }
+}
+
+impl Clone for WgpuSetupCreateNew {
+    fn clone(&self) -> Self {
+        let desc = &self.instance_descriptor;
+        Self {
+            instance_descriptor: wgpu::InstanceDescriptor {
+                backends: desc.backends,
+                flags: desc.flags,
+                backend_options: desc.backend_options.clone(),
+                memory_budget_thresholds: desc.memory_budget_thresholds,
+                display: None,
+            },
+            display_handle: self.display_handle.clone(),
+            power_preference: self.power_preference,
+            native_adapter_selector: self.native_adapter_selector.clone(),
+            device_descriptor: Arc::clone(&self.device_descriptor),
+        }
+    }
+}
+
+impl core::fmt::Debug for WgpuSetupCreateNew {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        let Self {
+            instance_descriptor,
+            display_handle,
+            power_preference,
+            native_adapter_selector,
+            device_descriptor: _,
+        } = self;
+        f.debug_struct("WgpuSetupCreateNew")
+            .field("instance_descriptor", instance_descriptor)
+            .field("display_handle", display_handle)
+            .field("power_preference", power_preference)
+            .field(
+                "native_adapter_selector",
+                &native_adapter_selector.is_some(),
+            )
+            .finish_non_exhaustive()
+    }
+}
+
+/// Configuration for using an existing wgpu setup.
+///
+/// Used for [`WgpuSetup::Existing`].
+#[derive(Clone)]
+pub struct WgpuSetupExisting {
+    pub instance: wgpu::Instance,
+    pub adapter: wgpu::Adapter,
+    pub device: wgpu::Device,
+    pub queue: wgpu::Queue,
+}
diff --git a/vendor/egui-wgpu/src/texture_copy.wgsl b/vendor/egui-wgpu/src/texture_copy.wgsl
new file mode 100644
index 00000000..4096d164
--- /dev/null
+++ b/vendor/egui-wgpu/src/texture_copy.wgsl
@@ -0,0 +1,43 @@
+struct VertexOutput {
+    @builtin(position) position: vec4<f32>,
+};
+
+var<private> positions: array<vec2f, 3> = array<vec2f, 3>(
+    vec2f(-1.0, -3.0),
+    vec2f(-1.0, 1.0),
+    vec2f(3.0, 1.0)
+);
+
+// meant to be called with 3 vertex indices: 0, 1, 2
+// draws one large triangle over the clip space like this:
+// (the asterisks represent the clip space bounds)
+//-1,1           1,1
+// ---------------------------------
+// |              *              .
+// |              *           .
+// |              *        .
+// |              *      .
+// |              *    .
+// |              * .
+// |***************
+// |            . 1,-1
+// |          .
+// |       .
+// |     .
+// |   .
+// |.
+@vertex
+fn vs_main(@builtin(vertex_index) vertex_index: u32) -> VertexOutput {
+    var result: VertexOutput;
+    result.position = vec4f(positions[vertex_index], 0.0, 1.0);
+    return result;
+}
+
+@group(0)
+@binding(0)
+var r_color: texture_2d<f32>;
+
+@fragment
+fn fs_main(vertex: VertexOutput) -> @location(0) vec4<f32> {
+    return textureLoad(r_color, vec2i(vertex.position.xy), 0);
+}
diff --git a/vendor/egui-wgpu/src/winit.rs b/vendor/egui-wgpu/src/winit.rs
new file mode 100644
index 00000000..8ad20c57
--- /dev/null
+++ b/vendor/egui-wgpu/src/winit.rs
@@ -0,0 +1,869 @@
+#![expect(clippy::missing_errors_doc)]
+#![expect(clippy::undocumented_unsafe_blocks)]
+#![expect(clippy::unwrap_used)] // TODO(emilk): avoid unwraps
+#![expect(unsafe_code)]
+
+use crate::{RenderState, SurfaceConfig, SurfaceErrorAction, WgpuConfiguration, renderer};
+use crate::{
+    RendererOptions,
+    capture::{CaptureReceiver, CaptureSender, CaptureState, capture_channel},
+};
+use core::num::NonZeroU32;
+use egui::{Context, Event, UserData, ViewportId, ViewportIdMap, ViewportIdSet};
+use std::sync::Arc;
+
+struct SurfaceState {
+    surface: wgpu::Surface<'static>,
+    alpha_mode: wgpu::CompositeAlphaMode,
+    width: u32,
+    height: u32,
+    // PdfCraft patch (#577): `width` and `height` are the size the surface is configured at,
+    // which `surface_fit` keeps within the device's `max_texture_dimension_2d`; these are the
+    // window's own size, and `render_scale` is how much smaller the surface is drawn.
+    window_width: u32,
+    window_height: u32,
+    render_scale: f32,
+    resizing: bool,
+    needs_reconfigure: bool,
+    needs_recreate: bool,
+}
+
+/// PdfCraft patch (#577): the size to configure a window's surface at, and the factor egui
+/// draws it at, so that neither side exceeds `max_side` (the device's
+/// `max_texture_dimension_2d`).
+///
+/// `Surface::configure` rejects a larger surface, and wgpu reports that as an uncaptured
+/// validation error, which panics: a window bigger than the GPU's limit (restored at another
+/// monitor's scale, stretched across monitors, …) closed the app before it opened. Both sides
+/// shrink by the same factor and egui draws at that factor, so the whole window is drawn into
+/// the surface. Where the swapchain is stretched over the window (DX12 uses
+/// `DXGI_SCALING_STRETCH`) it fills the window and lines up with the pointer, only softer;
+/// wgpu's GL backend copies it unscaled into a corner instead. Degraded either way, but not a
+/// crash. A window within the limit is returned unchanged, with a factor of 1. The longer side
+/// becomes exactly `max_side`, and a side that isn't zero never becomes zero (an empty surface
+/// can't be configured either).
+pub fn surface_fit(width: u32, height: u32, max_side: u32) -> (u32, u32, f32) {
+    let max_side = max_side.max(1);
+    if width <= max_side && height <= max_side {
+        return (width, height, 1.0);
+    }
+    let longest = width.max(height);
+    let scale = (f64::from(max_side) / f64::from(longest)).min(1.0);
+    // `as` saturates and `scale` is finite and in (0, 1]: no overflow, NaN or panic. The longer
+    // side is set rather than computed, so floating-point rounding can't leave it a pixel short.
+    let fit = |side: u32| {
+        if side == 0 {
+            0
+        } else if side == longest {
+            max_side
+        } else {
+            ((f64::from(side) * scale).floor() as u32).clamp(1, max_side)
+        }
+    };
+    (fit(width), fit(height), scale as f32)
+}
+
+/// Everything you need to paint egui with [`wgpu`] on [`winit`].
+///
+/// Alternatively you can use [`crate::Renderer`] directly.
+///
+/// NOTE: all egui viewports share the same painter.
+pub struct Painter {
+    context: Context,
+    config: WgpuConfiguration,
+    options: RendererOptions,
+    support_transparent_backbuffer: bool,
+    screen_capture_state: Option<CaptureState>,
+
+    instance: wgpu::Instance,
+    render_state: Option<RenderState>,
+
+    // Per viewport/window:
+    depth_texture_view: ViewportIdMap<wgpu::TextureView>,
+    msaa_texture_view: ViewportIdMap<wgpu::TextureView>,
+    surfaces: ViewportIdMap<SurfaceState>,
+    capture_tx: CaptureSender,
+    capture_rx: CaptureReceiver,
+}
+
+impl Painter {
+    /// Manages [`wgpu`] state, including surface state, required to render egui.
+    ///
+    /// Only the [`wgpu::Instance`] is initialized here. Device selection and the initialization
+    /// of render + surface state is deferred until the painter is given its first window target
+    /// via [`set_window()`](Self::set_window). (Ensuring that a device that's compatible with the
+    /// native window is chosen)
+    ///
+    /// Before calling [`paint_and_update_textures()`](Self::paint_and_update_textures) a
+    /// [`wgpu::Surface`] must be initialized (and corresponding render state) by calling
+    /// [`set_window()`](Self::set_window) once you have
+    /// a [`winit::window::Window`] with a valid `.raw_window_handle()`
+    /// associated.
+    pub async fn new(
+        context: Context,
+        config: WgpuConfiguration,
+        support_transparent_backbuffer: bool,
+        options: RendererOptions,
+    ) -> Self {
+        let (capture_tx, capture_rx) = capture_channel();
+        let instance = config.wgpu_setup.new_instance().await;
+
+        Self {
+            context,
+            config,
+            options,
+            support_transparent_backbuffer,
+            screen_capture_state: None,
+
+            instance,
+            render_state: None,
+
+            depth_texture_view: Default::default(),
+            surfaces: Default::default(),
+            msaa_texture_view: Default::default(),
+
+            capture_tx,
+            capture_rx,
+        }
+    }
+
+    /// Get the [`RenderState`].
+    ///
+    /// Will return [`None`] if the render state has not been initialized yet.
+    pub fn render_state(&self) -> Option<RenderState> {
+        self.render_state.clone()
+    }
+
+    fn configure_surface(
+        surface_state: &SurfaceState,
+        render_state: &RenderState,
+        config: &SurfaceConfig,
+    ) {
+        profiling::function_scope!();
+
+        let SurfaceConfig {
+            present_mode,
+            desired_maximum_frame_latency,
+        } = *config;
+
+        // Transaction presentation can hold a drawable during AppKit live resize. Keep the
+        // configured low-latency path normally, but use three Metal drawables while resizing.
+        #[cfg(all(target_os = "macos", feature = "macos-window-resize-jitter-fix"))]
+        let desired_maximum_frame_latency = if surface_state.resizing {
+            Some(desired_maximum_frame_latency.unwrap_or(2).max(2))
+        } else {
+            desired_maximum_frame_latency
+        };
+
+        let width = surface_state.width;
+        let height = surface_state.height;
+
+        let mut surf_config = wgpu::SurfaceConfiguration {
+            usage: wgpu::TextureUsages::RENDER_ATTACHMENT,
+            format: render_state.target_format,
+            present_mode,
+            alpha_mode: surface_state.alpha_mode,
+            view_formats: vec![render_state.target_format],
+            ..surface_state
+                .surface
+                .get_default_config(&render_state.adapter, width, height)
+                .expect("The surface isn't supported by this adapter")
+        };
+
+        if let Some(desired_maximum_frame_latency) = desired_maximum_frame_latency {
+            surf_config.desired_maximum_frame_latency = desired_maximum_frame_latency;
+        }
+
+        surface_state
+            .surface
+            .configure(&render_state.device, &surf_config);
+    }
+
+    /// Drop the existing [`wgpu::Surface`] for `viewport_id` and create a fresh one for the
+    /// given window via [`wgpu::Instance::create_surface`], then configure it.
+    ///
+    /// Used to recover from [`wgpu::CurrentSurfaceTexture::Lost`], where reconfiguring the
+    /// existing surface object cannot recover.
+    fn recreate_surface(
+        &mut self,
+        viewport_id: ViewportId,
+        window: &Arc<winit::window::Window>,
+    ) -> Result<(), crate::WgpuError> {
+        profiling::function_scope!();
+
+        let Some(old_state) = self.surfaces.remove(&viewport_id) else {
+            return Ok(());
+        };
+
+        let surface = self.instance.create_surface(Arc::clone(window))?;
+        // PdfCraft patch (#577): the window's size; `width` and `height` may have been fitted.
+        self.install_surface(
+            surface,
+            viewport_id,
+            old_state.window_width,
+            old_state.window_height,
+            old_state.resizing,
+        );
+        Ok(())
+    }
+
+    /// Updates (or clears) the [`winit::window::Window`] associated with the [`Painter`]
+    ///
+    /// This creates a [`wgpu::Surface`] for the given Window (as well as initializing render
+    /// state if needed) that is used for egui rendering.
+    ///
+    /// This must be called before trying to render via
+    /// [`paint_and_update_textures`](Self::paint_and_update_textures)
+    ///
+    /// # Portability
+    ///
+    /// _In particular it's important to note that on Android a it's only possible to create
+    /// a window surface between `Resumed` and `Paused` lifecycle events, and Winit will panic on
+    /// attempts to query the raw window handle while paused._
+    ///
+    /// On Android [`set_window`](Self::set_window) should be called with `Some(window)` for each
+    /// `Resumed` event and `None` for each `Paused` event. Currently, on all other platforms
+    /// [`set_window`](Self::set_window) may be called with `Some(window)` as soon as you have a
+    /// valid [`winit::window::Window`].
+    ///
+    /// # Errors
+    /// If the provided wgpu configuration does not match an available device.
+    pub async fn set_window(
+        &mut self,
+        viewport_id: ViewportId,
+        window: Option<Arc<winit::window::Window>>,
+    ) -> Result<(), crate::WgpuError> {
+        profiling::scope!("Painter::set_window"); // profile_function gives bad names for async functions
+
+        if let Some(window) = window {
+            let size = window.inner_size();
+            if !self.surfaces.contains_key(&viewport_id) {
+                let surface = self.instance.create_surface(window)?;
+                self.add_surface(surface, viewport_id, size).await?;
+            }
+        } else {
+            log::warn!("No window - clearing all surfaces");
+            self.surfaces.clear();
+        }
+        Ok(())
+    }
+
+    /// Updates (or clears) the [`winit::window::Window`] associated with the [`Painter`] without taking ownership of the window.
+    ///
+    /// Like [`set_window`](Self::set_window) except:
+    ///
+    /// # Safety
+    /// The user is responsible for ensuring that the window is alive for as long as it is set.
+    pub async unsafe fn set_window_unsafe(
+        &mut self,
+        viewport_id: ViewportId,
+        window: Option<&winit::window::Window>,
+    ) -> Result<(), crate::WgpuError> {
+        profiling::scope!("Painter::set_window_unsafe"); // profile_function gives bad names for async functions
+
+        if let Some(window) = window {
+            let size = window.inner_size();
+            if !self.surfaces.contains_key(&viewport_id) {
+                let surface = unsafe {
+                    self.instance
+                        .create_surface_unsafe(wgpu::SurfaceTargetUnsafe::from_window(&window)?)?
+                };
+                self.add_surface(surface, viewport_id, size).await?;
+            }
+        } else {
+            log::warn!("No window - clearing all surfaces");
+            self.surfaces.clear();
+        }
+        Ok(())
+    }
+
+    async fn add_surface(
+        &mut self,
+        surface: wgpu::Surface<'static>,
+        viewport_id: ViewportId,
+        size: winit::dpi::PhysicalSize<u32>,
+    ) -> Result<(), crate::WgpuError> {
+        if self.render_state.is_none() {
+            let render_state =
+                RenderState::create(&self.config, &self.instance, Some(&surface), self.options)
+                    .await?;
+            self.render_state = Some(render_state);
+        }
+        self.install_surface(surface, viewport_id, size.width, size.height, false);
+        Ok(())
+    }
+
+    /// Inserts a freshly created surface into [`Self::surfaces`] and configures it.
+    ///
+    /// Render state must already be initialised before calling this.
+    // NOTE: The same assumption is already required by `resize_and_generate_depth_texture_view_and_msaa_view`.
+    fn install_surface(
+        &mut self,
+        surface: wgpu::Surface<'static>,
+        viewport_id: ViewportId,
+        width: u32,
+        height: u32,
+        resizing: bool,
+    ) {
+        let alpha_mode = {
+            // Panic: We use the same failure mode as `resize_and_generate_depth_texture_view_and_msaa_view`
+            let render_state = self
+                .render_state
+                .as_ref()
+                .expect("install_surface called before render_state initialization");
+            if self.support_transparent_backbuffer {
+                let supported_alpha_modes =
+                    surface.get_capabilities(&render_state.adapter).alpha_modes;
+                // Prefer pre multiplied over post multiplied!
+                if supported_alpha_modes.contains(&wgpu::CompositeAlphaMode::PreMultiplied) {
+                    wgpu::CompositeAlphaMode::PreMultiplied
+                } else if supported_alpha_modes.contains(&wgpu::CompositeAlphaMode::PostMultiplied)
+                {
+                    wgpu::CompositeAlphaMode::PostMultiplied
+                } else {
+                    log::warn!(
+                        "Transparent window was requested, but the active wgpu surface does not support a `CompositeAlphaMode` with transparency."
+                    );
+                    wgpu::CompositeAlphaMode::Auto
+                }
+            } else {
+                wgpu::CompositeAlphaMode::Auto
+            }
+        };
+        // PdfCraft patch (#577): store the fitted size, so nothing configures the window's own.
+        // `render_scale` starts at 1 so that the resize below, which sets it, logs the fit once.
+        let (fit_width, fit_height, _) = surface_fit(width, height, self.max_surface_side());
+        self.surfaces.insert(
+            viewport_id,
+            SurfaceState {
+                surface,
+                width: fit_width,
+                height: fit_height,
+                window_width: width,
+                window_height: height,
+                render_scale: 1.0,
+                alpha_mode,
+                resizing,
+                needs_reconfigure: false,
+                needs_recreate: false,
+            },
+        );
+        let Some(width) = NonZeroU32::new(width) else {
+            log::debug!("The window width was zero; skipping generate textures");
+            return;
+        };
+        let Some(height) = NonZeroU32::new(height) else {
+            log::debug!("The window height was zero; skipping generate textures");
+            return;
+        };
+        self.resize_and_generate_depth_texture_view_and_msaa_view(viewport_id, width, height);
+    }
+
+    /// Returns the maximum texture dimension supported if known
+    ///
+    /// This API will only return a known dimension after `set_window()` has been called
+    /// at least once, since the underlying device and render state are initialized lazily
+    /// once we have a window (that may determine the choice of adapter/device).
+    pub fn max_texture_side(&self) -> Option<usize> {
+        self.render_state
+            .as_ref()
+            .map(|rs| rs.device.limits().max_texture_dimension_2d as usize)
+    }
+
+    /// PdfCraft patch (#577): the largest side a surface may be configured at, or no limit
+    /// before the device exists (nothing is configured then).
+    fn max_surface_side(&self) -> u32 {
+        self.render_state
+            .as_ref()
+            .map_or(u32::MAX, |rs| rs.device.limits().max_texture_dimension_2d)
+    }
+
+    fn resize_and_generate_depth_texture_view_and_msaa_view(
+        &mut self,
+        viewport_id: ViewportId,
+        width_in_pixels: NonZeroU32,
+        height_in_pixels: NonZeroU32,
+    ) {
+        profiling::function_scope!();
+
+        // PdfCraft patch (#577): configure the surface, and size the depth and MSAA textures,
+        // within the device's limit; `surface_fit` keeps a non-zero side non-zero.
+        let max_side = self.max_surface_side();
+        let (window_width, window_height) = (width_in_pixels.get(), height_in_pixels.get());
+        let (width, height, render_scale) = surface_fit(window_width, window_height, max_side);
+
+        let render_state = self.render_state.as_ref().unwrap();
+        let surface_state = self.surfaces.get_mut(&viewport_id).unwrap();
+
+        if render_scale < 1.0 && surface_state.render_scale >= 1.0 {
+            log::warn!(
+                "the window is {window_width} × {window_height} pixels, more than this GPU draws \
+                 ({max_side} a side): drawing it at {width} × {height} and scaling it up"
+            );
+        }
+        surface_state.width = width;
+        surface_state.height = height;
+        surface_state.window_width = window_width;
+        surface_state.window_height = window_height;
+        surface_state.render_scale = render_scale;
+
+        Self::configure_surface(surface_state, render_state, &self.config.surface);
+
+        if let Some(depth_format) = self.options.depth_stencil_format {
+            self.depth_texture_view.insert(
+                viewport_id,
+                render_state
+                    .device
+                    .create_texture(&wgpu::TextureDescriptor {
+                        label: Some("egui_depth_texture"),
+                        size: wgpu::Extent3d {
+                            width,
+                            height,
+                            depth_or_array_layers: 1,
+                        },
+                        mip_level_count: 1,
+                        sample_count: self.options.msaa_samples.max(1),
+                        dimension: wgpu::TextureDimension::D2,
+                        format: depth_format,
+                        usage: wgpu::TextureUsages::RENDER_ATTACHMENT
+                            | wgpu::TextureUsages::TEXTURE_BINDING,
+                        view_formats: &[depth_format],
+                    })
+                    .create_view(&wgpu::TextureViewDescriptor::default()),
+            );
+        }
+
+        if let Some(render_state) = (self.options.msaa_samples > 1)
+            .then_some(self.render_state.as_ref())
+            .flatten()
+        {
+            let texture_format = render_state.target_format;
+            self.msaa_texture_view.insert(
+                viewport_id,
+                render_state
+                    .device
+                    .create_texture(&wgpu::TextureDescriptor {
+                        label: Some("egui_msaa_texture"),
+                        size: wgpu::Extent3d {
+                            width,
+                            height,
+                            depth_or_array_layers: 1,
+                        },
+                        mip_level_count: 1,
+                        sample_count: self.options.msaa_samples.max(1),
+                        dimension: wgpu::TextureDimension::D2,
+                        format: texture_format,
+                        usage: wgpu::TextureUsages::RENDER_ATTACHMENT,
+                        view_formats: &[texture_format],
+                    })
+                    .create_view(&wgpu::TextureViewDescriptor::default()),
+            );
+        }
+    }
+
+    /// Handles changes of the resizing state.
+    ///
+    /// Should be called prior to the first [`Painter::on_window_resized`] call and after the last in
+    /// the chain. Used to apply platform-specific logic, e.g. OSX Metal window resize jitter fix.
+    pub fn on_window_resize_state_change(&mut self, viewport_id: ViewportId, resizing: bool) {
+        profiling::function_scope!();
+
+        let Some(state) = self.surfaces.get_mut(&viewport_id) else {
+            return;
+        };
+        if state.resizing == resizing {
+            if resizing {
+                log::debug!(
+                    "Painter::on_window_resize_state_change() redundant call while resizing"
+                );
+            } else {
+                log::debug!(
+                    "Painter::on_window_resize_state_change() redundant call after resizing"
+                );
+            }
+            return;
+        }
+
+        // Set before reconfiguring so macOS live resize uses the temporary latency bump above.
+        state.resizing = resizing;
+
+        // Resizing is a bit tricky on macOS.
+        // It requires enabling ["present_with_transaction"](https://developer.apple.com/documentation/quartzcore/cametallayer/presentswithtransaction)
+        // flag to avoid jittering during the resize. Even though resize jittering on macOS
+        // is common across rendering backends, the solution for wgpu/metal is known.
+        //
+        // See https://github.com/emilk/egui/issues/903
+        #[cfg(all(target_os = "macos", feature = "macos-window-resize-jitter-fix"))]
+        {
+            // SAFETY: `as_hal::<Metal>()` returns `None` unless this surface is backed by wgpu's
+            // Metal backend.
+            unsafe {
+                if let (Some(render_state), Some(hal_surface)) = (
+                    self.render_state.as_ref(),
+                    state.surface.as_hal::<wgpu::hal::api::Metal>(),
+                ) {
+                    hal_surface
+                        .render_layer()
+                        .lock()
+                        .setPresentsWithTransaction(resizing);
+
+                    Self::configure_surface(state, render_state, &self.config.surface);
+                }
+            }
+        }
+    }
+
+    pub fn on_window_resized(
+        &mut self,
+        viewport_id: ViewportId,
+        width_in_pixels: NonZeroU32,
+        height_in_pixels: NonZeroU32,
+    ) {
+        profiling::function_scope!();
+
+        if self.surfaces.contains_key(&viewport_id) {
+            self.resize_and_generate_depth_texture_view_and_msaa_view(
+                viewport_id,
+                width_in_pixels,
+                height_in_pixels,
+            );
+        } else {
+            log::warn!(
+                "Ignoring window resize notification with no surface created via Painter::set_window()"
+            );
+        }
+    }
+
+    /// Returns two things:
+    ///
+    /// The approximate number of seconds spent on vsync-waiting (if any),
+    /// and the captures captured screenshot if it was requested.
+    ///
+    /// If `capture_data` isn't empty, a screenshot will be captured.
+    #[expect(clippy::too_many_arguments)]
+    pub fn paint_and_update_textures(
+        &mut self,
+        viewport_id: ViewportId,
+        pixels_per_point: f32,
+        clear_color: [f32; 4],
+        clipped_primitives: &[epaint::ClippedPrimitive],
+        textures_delta: &mut epaint::textures::TexturesDelta,
+        capture_data: Vec<UserData>,
+        window: &Arc<winit::window::Window>,
+    ) -> f32 {
+        profiling::function_scope!();
+
+        /// Guard to ensure that commands are always submitted to the renderer queue
+        /// so that calls to [`write_buffer()`](https://docs.rs/wgpu/latest/wgpu/struct.Queue.html#method.write_buffer)
+        /// are completed even if we take a codepath which doesn't submit commands and avoids
+        /// internal buffers growing indefinitely.
+        ///
+        /// This may happen, for example, if no output frame is resolved.
+        /// See <https://github.com/emilk/egui/pull/7928> for full context.
+        struct RendererQueueGuard<'q> {
+            queue: &'q wgpu::Queue,
+            commands_submitted: bool,
+        }
+
+        impl Drop for RendererQueueGuard<'_> {
+            fn drop(&mut self) {
+                // Only submit an empty command buffer array if no commands were
+                // explicitly submitted.
+                if !self.commands_submitted {
+                    self.queue.submit([]);
+                }
+            }
+        }
+
+        let capture = !capture_data.is_empty();
+        let mut vsync_sec = 0.0;
+
+        // If the previous frame produced `CurrentSurfaceTexture::Lost`, the action match
+        // below set `needs_recreate`. Recreate the surface now, before re-borrowing
+        // `self.render_state` / `self.surfaces` for the rest of the paint.
+        if self
+            .surfaces
+            .get(&viewport_id)
+            .is_some_and(|s| s.needs_recreate)
+            && let Err(err) = self.recreate_surface(viewport_id, window)
+        {
+            log::error!("Failed to recreate surface for {viewport_id:?}: {err}");
+            return vsync_sec;
+        }
+
+        // Apply any runtime changes requested via `RenderState::surface_config`.
+        // We diff against the already-applied values in `self.config.surface`
+        // and, if anything differs, mark every surface as needing reconfiguration so
+        // the existing `needs_reconfigure` pathway below picks them up.
+        if let Some(render_state) = self.render_state.as_ref()
+            && render_state.surface_config != self.config.surface
+        {
+            self.config.surface = render_state.surface_config;
+            #[expect(clippy::iter_over_hash_type)]
+            for surface in self.surfaces.values_mut() {
+                surface.needs_reconfigure = true;
+            }
+        }
+
+        let Some(render_state) = self.render_state.as_mut() else {
+            return vsync_sec;
+        };
+
+        let mut render_queue_guard = RendererQueueGuard {
+            queue: &render_state.queue,
+            commands_submitted: false,
+        };
+
+        let Some(surface_state) = self.surfaces.get_mut(&viewport_id) else {
+            return vsync_sec;
+        };
+
+        let mut encoder =
+            render_state
+                .device
+                .create_command_encoder(&wgpu::CommandEncoderDescriptor {
+                    label: Some("encoder"),
+                });
+
+        // Upload all resources for the GPU.
+        // PdfCraft patch (#577): a surface fitted within the GPU's limit is drawn smaller.
+        let screen_descriptor = renderer::ScreenDescriptor {
+            size_in_pixels: [surface_state.width, surface_state.height],
+            pixels_per_point: pixels_per_point * surface_state.render_scale,
+        };
+
+        let user_cmd_bufs = {
+            let mut renderer = render_state.renderer.write();
+            #[expect(clippy::iter_over_hash_type)] // Order doesn't matter here
+            for (id, image_deltas) in textures_delta.set.drain() {
+                for image_delta in image_deltas {
+                    renderer.update_texture(
+                        &render_state.device,
+                        &render_state.queue,
+                        id,
+                        &image_delta,
+                    );
+                }
+            }
+
+            renderer.update_buffers(
+                &render_state.device,
+                &render_state.queue,
+                &mut encoder,
+                clipped_primitives,
+                &screen_descriptor,
+            )
+        };
+
+        if surface_state.needs_reconfigure {
+            Self::configure_surface(surface_state, render_state, &self.config.surface);
+            surface_state.needs_reconfigure = false;
+        }
+
+        let output_frame = {
+            profiling::scope!("get_current_texture");
+            // This is what vsync-waiting happens on my Mac.
+            let start = web_time::Instant::now();
+            let output_frame = surface_state.surface.get_current_texture();
+            vsync_sec += start.elapsed().as_secs_f32();
+            output_frame
+        };
+
+        let output_frame = match output_frame {
+            wgpu::CurrentSurfaceTexture::Success(frame) => frame,
+            wgpu::CurrentSurfaceTexture::Suboptimal(frame) => {
+                surface_state.needs_reconfigure = true;
+                frame
+            }
+            other => {
+                match (*self.config.on_surface_status)(&other) {
+                    SurfaceErrorAction::Reconfigure => {
+                        Self::configure_surface(surface_state, render_state, &self.config.surface);
+                        self.context.request_repaint_of(viewport_id);
+                    }
+                    SurfaceErrorAction::RecreateSurface => {
+                        // Because of ownership, I could not find an easy way to do a full recovery here,
+                        // as that would involve dropping the old surface and creating a new one.
+                        // For now, we defer the recreation to the beginning of the next frame (which
+                        // we ensure to arrive via `request_repaint_of`). A cleaner solution would be
+                        // to untangle the ownership of `RenderState`.
+                        surface_state.needs_recreate = true;
+                        self.context.request_repaint_of(viewport_id);
+                    }
+                    SurfaceErrorAction::SkipFrame => {}
+                }
+                return vsync_sec;
+            }
+        };
+
+        let mut capture_buffer = None;
+        {
+            let renderer = render_state.renderer.read();
+
+            let target_texture = if capture {
+                let capture_state = self.screen_capture_state.get_or_insert_with(|| {
+                    CaptureState::new(&render_state.device, &output_frame.texture)
+                });
+                capture_state.update(&render_state.device, &output_frame.texture);
+
+                &capture_state.texture
+            } else {
+                &output_frame.texture
+            };
+            let target_view = target_texture.create_view(&wgpu::TextureViewDescriptor::default());
+
+            let (view, resolve_target) = (self.options.msaa_samples > 1)
+                .then_some(self.msaa_texture_view.get(&viewport_id))
+                .flatten()
+                .map_or((&target_view, None), |texture_view| {
+                    (texture_view, Some(&target_view))
+                });
+
+            let render_pass = encoder.begin_render_pass(&wgpu::RenderPassDescriptor {
+                label: Some("egui_render"),
+                color_attachments: &[Some(wgpu::RenderPassColorAttachment {
+                    view,
+                    resolve_target,
+                    ops: wgpu::Operations {
+                        load: wgpu::LoadOp::Clear(wgpu::Color {
+                            r: clear_color[0] as f64,
+                            g: clear_color[1] as f64,
+                            b: clear_color[2] as f64,
+                            a: clear_color[3] as f64,
+                        }),
+                        store: wgpu::StoreOp::Store,
+                    },
+                    depth_slice: None,
+                })],
+                depth_stencil_attachment: self.depth_texture_view.get(&viewport_id).map(|view| {
+                    wgpu::RenderPassDepthStencilAttachment {
+                        view,
+                        depth_ops: self
+                            .options
+                            .depth_stencil_format
+                            .is_some_and(|depth_stencil_format| {
+                                depth_stencil_format.has_depth_aspect()
+                            })
+                            .then_some(wgpu::Operations {
+                                load: wgpu::LoadOp::Clear(1.0),
+                                // It is very unlikely that the depth buffer is needed after egui finished rendering
+                                // so no need to store it. (this can improve performance on tiling GPUs like mobile chips or Apple Silicon)
+                                store: wgpu::StoreOp::Discard,
+                            }),
+                        stencil_ops: self
+                            .options
+                            .depth_stencil_format
+                            .is_some_and(|depth_stencil_format| {
+                                depth_stencil_format.has_stencil_aspect()
+                            })
+                            .then_some(wgpu::Operations {
+                                load: wgpu::LoadOp::Clear(0),
+                                store: wgpu::StoreOp::Discard,
+                            }),
+                    }
+                }),
+                timestamp_writes: None,
+                occlusion_query_set: None,
+                multiview_mask: None,
+            });
+
+            // Forgetting the pass' lifetime means that we are no longer compile-time protected from
+            // runtime errors caused by accessing the parent encoder before the render pass is dropped.
+            // Since we don't pass it on to the renderer, we should be perfectly safe against this mistake here!
+            renderer.render(
+                &mut render_pass.forget_lifetime(),
+                clipped_primitives,
+                &screen_descriptor,
+            );
+
+            if capture && let Some(capture_state) = &mut self.screen_capture_state {
+                capture_buffer = Some(capture_state.copy_textures(
+                    &render_state.device,
+                    &output_frame,
+                    &mut encoder,
+                ));
+            }
+        }
+
+        let encoded = {
+            profiling::scope!("CommandEncoder::finish");
+            encoder.finish()
+        };
+
+        // Submit the commands: both the main buffer and user-defined ones.
+        {
+            profiling::scope!("Queue::submit");
+            // wgpu doesn't document where vsync can happen. Maybe here?
+            let start = web_time::Instant::now();
+            render_state
+                .queue
+                .submit(core::iter::chain(user_cmd_bufs, [encoded]));
+            vsync_sec += start.elapsed().as_secs_f32();
+        };
+
+        // Ensure that the queue guard does not do unnecessary work when dropped
+        render_queue_guard.commands_submitted = true;
+
+        // Free textures marked for destruction **after** queue submit since they might still be used in the current frame.
+        // Calling `wgpu::Texture::destroy` on a texture that is still in use would invalidate the command buffer(s) it is used in.
+        // However, once we called `wgpu::Queue::submit`, it is up for wgpu to determine how long the underlying gpu resource has to live.
+        {
+            let mut renderer = render_state.renderer.write();
+            #[expect(clippy::iter_over_hash_type)] // Order doesn't matter here
+            for id in textures_delta.free.drain() {
+                renderer.free_texture(&id);
+            }
+        }
+
+        if let Some(capture_buffer) = capture_buffer
+            && let Some(screen_capture_state) = &mut self.screen_capture_state
+        {
+            screen_capture_state.read_screen_rgba(
+                self.context.clone(),
+                capture_buffer,
+                capture_data,
+                self.capture_tx.clone(),
+                viewport_id,
+            );
+        }
+
+        window.pre_present_notify();
+
+        {
+            profiling::scope!("present");
+            // wgpu doesn't document where vsync can happen. Maybe here?
+            let start = web_time::Instant::now();
+            render_state.queue.present(output_frame);
+            vsync_sec += start.elapsed().as_secs_f32();
+        }
+
+        vsync_sec
+    }
+
+    /// Call this at the beginning of each frame to receive the requested screenshots.
+    pub fn handle_screenshots(&self, events: &mut Vec<Event>) {
+        for (viewport_id, user_data, screenshot) in self.capture_rx.try_iter() {
+            let screenshot = Arc::new(screenshot);
+            for data in user_data {
+                events.push(Event::Screenshot {
+                    viewport_id,
+                    user_data: data,
+                    image: Arc::clone(&screenshot),
+                });
+            }
+        }
+    }
+
+    pub fn gc_viewports(&mut self, active_viewports: &ViewportIdSet) {
+        self.surfaces.retain(|id, _| active_viewports.contains(id));
+        self.depth_texture_view
+            .retain(|id, _| active_viewports.contains(id));
+        self.msaa_texture_view
+            .retain(|id, _| active_viewports.contains(id));
+    }
+
+    #[expect(clippy::needless_pass_by_ref_mut, clippy::unused_self)]
+    pub fn destroy(&mut self) {
+        // TODO(emilk): something here?
+    }
+}

From 36468f0ad4f27c68e0f2068aa48ff9cb95124ca4 Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:56:25 -0700
Subject: [PATCH 143/149] Windows: a GPU that can't set up the window falls
 back to OpenGL (#519) (#617)

* Windows: vendor egui-wgpu 0.36.2 as published (#577)

The crate as released on crates.io, plus egui's LICENSE-APACHE and
LICENSE-MIT from the 0.36.2 tag (the published crate leaves them out).
Not used yet: the next commit patches it and adds it to [patch.crates-io].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Windows: a window larger than the GPU's texture limit can't close PdfCraft (#577)

egui-wgpu 0.36.2 configures a window's surface at the window's own size.
Beyond the device's max_texture_dimension_2d, Surface::configure fails
validation and wgpu's default error handler panics. eframe configures the
surface before the app is created, so no app code can intercept it
(emilk/egui#8361). #578 raised the device's limit to the adapter's; this
removes the crash for windows larger than even that.

vendor/egui-wgpu: `winit::surface_fit` shrinks both sides by one factor so
neither exceeds the limit (the longer side lands exactly on it), and egui
draws at that factor into the surface. On DX12, PdfCraft's Windows default,
the swapchain is stretched over the window (DXGI_SCALING_STRETCH), so the
window stays complete and lined up with the pointer, only softer; wgpu's GL
backend copies it unscaled into a corner instead. It applies wherever a
surface is sized: install, resize (start-up restore, maximise, DPI change,
fullscreen) and a recreated surface, which starts again from the window's
own size. Depth and MSAA textures follow. A surface logs a warning when
it becomes fitted.

Why only an Outlook launch hit it (read from the code, not observed):
winit creates the window at CW_USEDEFAULT, so Windows places it, and a
launcher that hands ShellExecute its own window gets new windows on its
monitor. winit then converts the restored logical size at that monitor's
scale: 3440 points became 8600 pixels on a 250% panel. eframe's clamp
compares points against the largest monitor, so it let 3440 through.

Tests: surface_fit with the issue's 8600 x 3423 and edge sizes (zero,
u32::MAX, a zero limit, the longer side exactly on the limit); egui-wgpu
resolves to vendor/egui-wgpu and the fit stays wired into the paths that
size a surface.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Windows: a GPU that can't set up the window falls back to OpenGL (#519)

On a 2015 Intel GPU with no D3D12 driver, wgpu picked its GL adapter
over WARP and Surface::configure failed (GpuWaitTimeout). wgpu's default
error handler panics, and eframe configures the root surface before the
app is created, so the OpenGL retry from #530 never ran.

Vendored egui-wgpu (PdfCraft patch #519): winit::catch_errors runs a
closure inside wgpu error scopes (validation, out of memory, internal)
and returns the error. Painter::add_surface configures each new window's
surface inside it and returns a failure as WgpuError::ConfigureSurface,
so eframe returns Error::Wgpu and main retries with glow. Later
reconfigures are unchanged.

Tests: a real device returns a wgpu validation error from catch_errors
instead of panicking (red with the scopes removed), and add_surface
keeps the wiring (red with it removed). Docs: vendor/README.md patch 2,
docs/development.md "Renderer fallback" and PDFCRAFT_RENDERER, ROADMAP.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* vendor/egui-wgpu: drop the stray .cargo-ok marker

* Tests: the GPU error-scope test skips on a machine without a GPU adapter

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                    |  1 +
 ROADMAP.md                    |  2 +
 apps/pdfcraft/Cargo.toml      |  4 ++
 apps/pdfcraft/src/main.rs     | 72 +++++++++++++++++++++++++++++++++++
 docs/development.md           | 16 ++++++++
 vendor/README.md              |  2 +-
 vendor/egui-wgpu/src/lib.rs   |  6 +++
 vendor/egui-wgpu/src/winit.rs | 63 +++++++++++++++++++++++++++---
 8 files changed, 160 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e82b91c0..9fc6d186 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3550,6 +3550,7 @@ dependencies = [
  "fmv-macos-events",
  "log",
  "pdfcraft-ui-egui",
+ "pollster 1.0.1",
  "rustls-native-certs",
  "serde_json",
  "ureq",
diff --git a/ROADMAP.md b/ROADMAP.md
index 0a5a34e4..b2f34020 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -138,6 +138,8 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
 - **2026-10-09 (M14, #577 follow-up):** A window larger than the GPU's texture limit no longer closes PdfCraft. Vendored egui-wgpu 0.36.2 fits the window's surface within `max_texture_dimension_2d` and draws egui at the matching scale, on every path that sizes a surface (start-up restore, resize, maximise, DPI change, a recreated surface); upstream is emilk/egui#8361. Root cause of the Outlook-only trigger: winit creates the window on the launching app's monitor and converts the restored size at that monitor's scale. Unit tests cover the 8600 × 3423 case and edge sizes; a Windows Sandbox (WARP) run of a window one pixel over the limit panicked before and kept drawing after. Estimates unchanged.
+- **2026-10-09 (M14, #577 follow-up):** A window larger than the GPU's texture limit no longer closes PdfCraft. Vendored egui-wgpu 0.36.2 fits the window's surface within `max_texture_dimension_2d` and draws egui at the matching scale, on every path that sizes a surface (start-up restore, resize, maximise, DPI change, a recreated surface); upstream is emilk/egui#8361. Root cause of the Outlook-only trigger: winit creates the window on the launching app's monitor and converts the restored size at that monitor's scale. Unit tests cover the 8600 × 3423 case and edge sizes; a Windows Sandbox (WARP) run of a window one pixel over the limit panicked before and kept drawing after. Estimates unchanged.
+- **2026-10-09 (M14, #519):** A GPU that can't configure the window's surface at launch no longer panics, so PdfCraft's OpenGL retry runs. Vendored egui-wgpu configures a new window's surface inside wgpu error scopes (`winit::catch_errors`) and returns a failure as an error, so eframe returns `Error::Wgpu` and the existing OpenGL retry (#530) runs (a device lost during that configure still panics, on the first frame). Before, wgpu's default handler panicked: on a 2015 Intel GPU with no D3D12 driver wgpu picked the GL adapter over WARP and timed out in `Surface::configure` (`GpuWaitTimeout`). A real-device regression test (a wgpu validation error inside `catch_errors`) panicked with the scopes removed; in Windows Sandbox a forced configure failure panicked unpatched and retried with OpenGL patched (Sandbox has no OpenGL 2.0, so the OpenGL window itself was not shown there). Defaulting Windows to DX12 only (WARP instead of wgpu's GL backend) is left to the maintainers. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
diff --git a/apps/pdfcraft/Cargo.toml b/apps/pdfcraft/Cargo.toml
index 2400fe9e..b7a3ede5 100644
--- a/apps/pdfcraft/Cargo.toml
+++ b/apps/pdfcraft/Cargo.toml
@@ -28,6 +28,10 @@ log = { workspace = true }
 # behind a safe API. Same version as PhotoCraft. Pinned exactly: review the diff before bumping.
 fmv-macos-events = "=0.1.0"
 
+[dev-dependencies]
+# Waits for wgpu's adapter, device and error-scope futures in tests (already in the tree through wgpu).
+pollster = "1.0"
+
 [build-dependencies]
 # Icon + VERSIONINFO for pdfcraft.exe; build.rs only uses it when targeting Windows.
 winresource = "0.1"
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 3d1e8ecc..637ac5fa 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -702,6 +702,78 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic() {
+        // Issue #519: on a 2015 Intel GPU, wgpu's GL backend couldn't configure the window's
+        // surface (`GpuWaitTimeout`), and wgpu's default error handler panicked before the app was
+        // created, so PdfCraft never got to retry with OpenGL. vendor/egui-wgpu configures a new
+        // window's surface inside `catch_errors`. A real device on PdfCraft's own GPU settings,
+        // and an error wgpu raises before anything reaches the driver: a texture one pixel wider
+        // than the device allows.
+        use eframe::wgpu;
+        let native = super::native_options(false, eframe::Renderer::Wgpu);
+        let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else {
+            panic!("default setup creates its own instance")
+        };
+        let instance = pollster::block_on(native.wgpu_options.wgpu_setup.new_instance());
+        let options = wgpu::RequestAdapterOptions { power_preference: setup.power_preference, ..Default::default() };
+        // CI runners have a software adapter (WARP, llvmpipe); a machine without any skips.
+        let Ok(adapter) = pollster::block_on(instance.request_adapter(&options)) else {
+            eprintln!("skipping: no GPU adapter on this machine");
+            return;
+        };
+        let Ok((device, _queue)) = pollster::block_on(adapter.request_device(&(setup.device_descriptor)(&adapter))) else {
+            eprintln!("skipping: the adapter gives no device");
+            return;
+        };
+        let texture = |width: u32| {
+            device.create_texture(&wgpu::TextureDescriptor {
+                label: Some("issue-519"),
+                size: wgpu::Extent3d { width, height: 1, depth_or_array_layers: 1 },
+                mip_level_count: 1,
+                sample_count: 1,
+                dimension: wgpu::TextureDimension::D2,
+                format: wgpu::TextureFormat::Rgba8Unorm,
+                usage: wgpu::TextureUsages::TEXTURE_BINDING,
+                view_formats: &[],
+            })
+        };
+        let too_wide = device.limits().max_texture_dimension_2d.saturating_add(1);
+        let caught = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(too_wide)));
+        assert!(matches!(caught, Err(wgpu::Error::Validation { .. })), "{caught:?}");
+        // The device stays usable, and nothing is left behind to catch later errors by mistake.
+        let fine = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(16)));
+        assert!(fine.is_ok(), "{fine:?}");
+        assert_eq!(pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || 7)).ok(), Some(7));
+        // Nested: the inner call keeps its own error, and the outer one still catches what follows.
+        let caught = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || {
+            let inner = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(too_wide)));
+            assert!(inner.is_err(), "inner: {inner:?}");
+            texture(too_wide)
+        }));
+        assert!(matches!(caught, Err(wgpu::Error::Validation { .. })), "outer: {caught:?}");
+    }
+
+    #[test]
+    fn egui_wgpu_returns_a_surface_it_cannot_configure_as_an_error() {
+        // Issue #519: `catch_errors` is tested above; this keeps it around the first configure of
+        // every new window's surface, and its error reaching eframe as `WgpuError` (eframe then
+        // returns `Error::Wgpu`, which `main` retries with OpenGL). Without it a failed configure
+        // panics before the app is created, and the OpenGL retry never runs.
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+        let lock = std::fs::read_to_string(root.join("Cargo.lock")).unwrap();
+        let egui_wgpu = lock.split("[[package]]").find(|p| p.contains("\nname = \"egui-wgpu\"\n")).expect("egui-wgpu is in Cargo.lock");
+        assert!(!egui_wgpu.contains("\nsource = "), "egui-wgpu must resolve to vendor/egui-wgpu, not:{egui_wgpu}");
+        let painter = std::fs::read_to_string(root.join("vendor/egui-wgpu/src/winit.rs")).unwrap().replace("\r\n", "\n");
+        let add_surface = painter.split("async fn add_surface(").nth(1).and_then(|s| s.split("\n    fn ").next()).expect("add_surface");
+        for patch in [
+            "let installed = catch_errors(&device, || {\n            self.install_surface(surface, viewport_id, size.width, size.height, false);\n        })",
+            "return Err(crate::WgpuError::ConfigureSurface(error));",
+        ] {
+            assert!(add_surface.contains(patch), "vendor/egui-wgpu lost its surface configure patch: {patch}");
+        }
+    }
+
     #[test]
     fn winit_carries_the_windows_11_monitor_scale_fix() {
         // Issue #324: winit 0.30.13 as released nudges a window dragged onto a monitor with another
diff --git a/docs/development.md b/docs/development.md
index 6506cd65..d622e16e 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -36,6 +36,21 @@ at a correspondingly lower scale instead of panicking in `Surface::configure` (v
 stretched over the window: softer, but complete and lined up with the pointer. wgpu's GL backend
 copies it unscaled into a corner of the window instead.
 
+## Renderer fallback
+
+PdfCraft draws with wgpu, and starts again with eframe's own OpenGL renderer (glow) when wgpu fails
+before the app is created: no adapter, no device, or a window surface the device can't configure.
+The last of these was a panic, not an error, because wgpu's default error handler panics and
+eframe configures the surface before any app code runs; a 2015 Intel GPU whose driver timed out in
+`Surface::configure` on wgpu's GL backend closed PdfCraft at launch (#519). Vendored egui-wgpu
+configures a new window's surface inside `winit::catch_errors` and returns a validation,
+out-of-memory or internal error as `WgpuError::ConfigureSurface` (see `vendor/README.md`). Still a
+panic, as upstream: an error in a later reconfigure (resizing, a lost surface); a device lost
+during that first configure (wgpu reports it only to a callback, so the first frame panics, after
+the app has started); and a window shown at zero size, which is first configured on resize. If
+OpenGL can't start either, PdfCraft exits with both errors in the log. The fallback is logged at
+`error`, with the wgpu error. `PDFCRAFT_RENDERER` skips it or chooses OpenGL from the start.
+
 ## Environment variables
 
 | Variable | Effect |
@@ -45,5 +60,6 @@ copies it unscaled into a corner of the window instead.
 | `XDG_DATA_HOME` | Linux/FreeBSD: base of the settings folder (`pdfcraft/`), the log folder and crash recovery |
 | `WGPU_POWER_PREF` | GPU choice; by default PdfCraft prefers the low-power (integrated) GPU |
 | `WGPU_BACKEND` | Graphics backend; by default Windows uses Direct3D 12, falling back to OpenGL |
+| `PDFCRAFT_RENDERER` | `gl` starts with OpenGL (glow) and never loads wgpu; `wgpu` reports a wgpu failure instead of retrying with OpenGL; unset, wgpu is retried with OpenGL when it can't start (see [Renderer fallback](#renderer-fallback)) |
 | `CRAFT_FONTS_DIR` | Build time: a [craft-fonts](https://github.com/storytold/craft-fonts) checkout to embed (Japanese fonts) |
 | `PDFCRAFT_SYSTEM_FONTS` | `0` stops the desktop app from using an installed font for characters its embedded fonts lack (`cargo xtask screenshots` sets it) |
diff --git a/vendor/README.md b/vendor/README.md
index d1de21fe..88943ae9 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -14,7 +14,7 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices` |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
-| egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::egui_wgpu_carries_the_surface_size_fit`, which keeps the patch in the build and in the paths that size a surface |
+| egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::egui_wgpu_carries_the_surface_size_fit`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::egui_wgpu_returns_a_surface_it_cannot_configure_as_an_error`, which keeps it around `add_surface`'s configure |
 
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
 
diff --git a/vendor/egui-wgpu/src/lib.rs b/vendor/egui-wgpu/src/lib.rs
index 1eb975ae..0603d786 100644
--- a/vendor/egui-wgpu/src/lib.rs
+++ b/vendor/egui-wgpu/src/lib.rs
@@ -62,6 +62,12 @@ pub enum WgpuError {
     #[cfg(feature = "winit")]
     #[error(transparent)]
     HandleError(#[from] ::winit::raw_window_handle::HandleError),
+
+    /// PdfCraft patch (#519): the device raised an error while a new window's surface was
+    /// configured (see [`winit::catch_errors`]).
+    #[cfg(feature = "winit")]
+    #[error("The window's surface couldn't be configured: {0}")]
+    ConfigureSurface(wgpu::Error),
 }
 
 /// Runtime-mutable subset of [`WgpuConfiguration`].
diff --git a/vendor/egui-wgpu/src/winit.rs b/vendor/egui-wgpu/src/winit.rs
index 8ad20c57..62db8b0f 100644
--- a/vendor/egui-wgpu/src/winit.rs
+++ b/vendor/egui-wgpu/src/winit.rs
@@ -63,6 +63,41 @@ pub fn surface_fit(width: u32, height: u32, max_side: u32) -> (u32, u32, f32) {
     (fit(width), fit(height), scale as f32)
 }
 
+/// PdfCraft patch (#519): runs `f` and returns an error it raises on `device`, instead of
+/// handing it to wgpu's uncaptured-error handler, which panics by default.
+///
+/// eframe configures a window's surface before the app is created, so no app code can install
+/// a handler in time, and a surface the device can't configure closed the app before its window
+/// appeared: wgpu's GL backend on a 2015 Intel driver timed out waiting for the GPU to go idle
+/// (`ConfigureSurfaceError::GpuWaitTimeout`). Returned as an error instead, eframe returns
+/// `Error::Wgpu` and the app can fall back (PdfCraft retries with OpenGL).
+///
+/// Validation, out-of-memory and internal errors are caught, one scope each; each scope keeps
+/// the first error of its kind, and a validation error is returned before an out-of-memory one,
+/// which is returned before an internal one. Not caught: a lost device (wgpu reports that only
+/// to the device-lost callback, so `f` seems to succeed), a panic inside `f`, and errors raised
+/// on other threads (wgpu's error scopes belong to the calling thread).
+pub async fn catch_errors<T>(
+    device: &wgpu::Device,
+    f: impl FnOnce() -> T,
+) -> Result<T, wgpu::Error> {
+    let validation = device.push_error_scope(wgpu::ErrorFilter::Validation);
+    let out_of_memory = device.push_error_scope(wgpu::ErrorFilter::OutOfMemory);
+    let internal = device.push_error_scope(wgpu::ErrorFilter::Internal);
+    // Should `f` panic, the guards pop their scopes as they drop, innermost first.
+    let value = f();
+    // Popped innermost first, as wgpu requires; each pop takes effect at once.
+    let internal = internal.pop();
+    let out_of_memory = out_of_memory.pop();
+    let validation = validation.pop();
+    let (validation, out_of_memory, internal) =
+        (validation.await, out_of_memory.await, internal.await);
+    match validation.or(out_of_memory).or(internal) {
+        Some(error) => Err(error),
+        None => Ok(value),
+    }
+}
+
 /// Everything you need to paint egui with [`wgpu`] on [`winit`].
 ///
 /// Alternatively you can use [`crate::Renderer`] directly.
@@ -283,13 +318,31 @@ impl Painter {
         viewport_id: ViewportId,
         size: winit::dpi::PhysicalSize<u32>,
     ) -> Result<(), crate::WgpuError> {
-        if self.render_state.is_none() {
-            let render_state =
+        // PdfCraft patch (#519): the device is kept for `catch_errors` below.
+        let render_state = match self.render_state.take() {
+            Some(render_state) => render_state,
+            None => {
                 RenderState::create(&self.config, &self.instance, Some(&surface), self.options)
-                    .await?;
-            self.render_state = Some(render_state);
+                    .await?
+            }
+        };
+        let device = render_state.device.clone();
+        self.render_state = Some(render_state);
+        // PdfCraft patch (#519): a surface the device can't configure is returned as an error
+        // instead of wgpu's default handler panicking; for the root window at start-up, eframe
+        // returns it as `Error::Wgpu` before the app is created, and the app can fall back.
+        // Nothing is kept for the window. A window whose size is zero here is first configured
+        // later, on resize, outside this.
+        let installed = catch_errors(&device, || {
+            self.install_surface(surface, viewport_id, size.width, size.height, false);
+        })
+        .await;
+        if let Err(error) = installed {
+            self.surfaces.remove(&viewport_id);
+            self.depth_texture_view.remove(&viewport_id);
+            self.msaa_texture_view.remove(&viewport_id);
+            return Err(crate::WgpuError::ConfigureSurface(error));
         }
-        self.install_surface(surface, viewport_id, size.width, size.height, false);
         Ok(())
     }
 

From 4fc99e484584dc77c1eb7785d220bc66de10d5e9 Mon Sep 17 00:00:00 2001
From: Max Abramowitz <max@1e6.org>
Date: Fri, 9 Oct 2026 18:56:45 -0400
Subject: [PATCH 144/149] Tab strip: shrink tabs before scrolling, keep Open in
 sight; ignore about:blank titles (#612)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M3: tabs shrink to fit before they scroll, and Open stays in sight

With more documents open than fit, the tabs kept their full width: they ran
under the buttons on the right (#416 made them scroll) and the Open button
scrolled away with them. Now the tabs shrink first, as browsers do: narrow
tabs keep their width, wider ones share the rest equally and end their names
in "…" (the tooltip has the whole name). Only once they are at their narrowest
does the strip scroll. Open sits after the tabs, outside the scrolling area,
so it is always in sight next to the controls on the right.

Refs #397.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: a placeholder title like about:blank leaves the file name on the tab

A browser's "Save as PDF" of a blank page or pop-up titles the document
"about:blank" and asks viewers to show the title, so its tab and window said
"about:blank". A one-word browser address (about:, blob:, data:) or a bare
"Untitled" now counts as no title, and the file name is shown. A tab that
does show a document title names its file on hover.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: arrows step through tabs that don't fit, and tabs keep most of their name

Tabs shrank to 110 points before the strip scrolled, so with many open they
became a few characters each and nothing showed that more were hidden. Tabs
now stop at 180 points (most of a name), and once even that doesn't fit,
arrows appear either side of them: each steps about one tab, and an arrow is
dimmed at its end, so it is clear whether more tabs lie that way. The mouse
wheel still scrolls them, and the active tab is still brought into view.

New labels "Scroll tabs left" / "Scroll tabs right" are translated in every
catalog (machine-written; native review welcome).

Refs #397.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: William Max & Co. <info@williammax.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 ATTRIBUTION.toml                    |  26 ++--
 crates/engine/src/lib.rs            |  14 +-
 crates/engine/src/tests.rs          |  11 ++
 crates/ui-egui/src/chrome.rs        | 232 +++++++++++++++++++++++-----
 crates/ui-egui/src/i18n/bg.tsv      |   2 +
 crates/ui-egui/src/i18n/cs.tsv      |   2 +
 crates/ui-egui/src/i18n/de.tsv      |   2 +
 crates/ui-egui/src/i18n/es.tsv      |   2 +
 crates/ui-egui/src/i18n/fr.tsv      |   2 +
 crates/ui-egui/src/i18n/hu.tsv      |   2 +
 crates/ui-egui/src/i18n/ja.tsv      |   2 +
 crates/ui-egui/src/i18n/pt-br.tsv   |   2 +
 crates/ui-egui/src/i18n/ru.tsv      |   2 +
 crates/ui-egui/src/i18n/te.tsv      |   2 +
 crates/ui-egui/src/i18n/uk.tsv      |   2 +
 crates/ui-egui/src/i18n/zh-hans.tsv |   2 +
 crates/ui-egui/src/i18n/zh-hant.tsv |   2 +
 crates/ui-egui/src/panels.rs        |   2 +-
 crates/ui-egui/tests/ui.rs          |  53 +++++++
 crates/ui-egui/tests/viewer.rs      |  19 +++
 20 files changed, 328 insertions(+), 55 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 8b5e1a5b..f8b54487 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "df55a2ab783a02419d86c244cd793d4f42616ff842860b9ee8740960526f713d"
+sha256 = "3066b34500d662ac6515806784a20b3b6f39d708dbaea26204995323c0a841f0"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4aee7a68592c36cc2bb828a51e71fdf6ed12e660bd80b2f214a6d3aef554d1d5"
+sha256 = "b8d2b959ae42cd0d1b823d958142f997891ce463e6075b37614536a51b63c190"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "af2e8234147dbcc8da6414e213fe560312d44e816f0bde6271577c4d8041748b"
+sha256 = "e336657e76e498264691f4c55af84ae69af803bae2564e26f87a2bbad31fdf8e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "7abd689f910f5b28f48dc9c0b2d3859965ad27c962d919a011efb959247edfee"
+sha256 = "ca56752387255e66e027eeb6efcac0434a6467997f63e6cfba629a27dd316c9a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9ebeb8cd5168cffaa027f7d4bc08b7987c09661027f64e4067b0975f456737bd"
+sha256 = "a7e06aac931016658d143c0ce0246fcfa55bf8d88eee3b25162fcfa12eebd263"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9b160ff2781512e07eb9f5a6be39681eec0fd413c61e0becc11913ef9baac5e3"
+sha256 = "4120337665604b2799961383d44ab0e01413da5685b233c9051f4ab1a8234790"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e7007083de3633c85fdf98b249e201f50100c3adfa2cf889acd03449a700b1e7"
+sha256 = "0856ff8e37cb40b44f90ff122d638aca6b94c528994abd3b360f7ff01b74508e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "7315ad9ec7e672c9654a399f0142e8f78b9331c654048085f3b4b573edd51fa1"
+sha256 = "1d891722c4bb69968eb3fca2c479ba9cf0d68fd6b2f0f3a5975f154246bdde0e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "54ae61ed7eb2c93cf739200a6ec4b198ce40991eccebfca0bdc1eb40847d64cf"
+sha256 = "3d95becdff6b37d8c1bb878578f6afcb0790f6519154e2dcef323344923abebe"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "46f5a79f8264f3ca3aba4fa5a95877e55f7a55dcee68834854fcc7ee24390c2c"
+sha256 = "b1679b1fca5008f0a7d882204863ddfc9574195f2da0b1d8ef7d1b63b43d00bc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "12d77d9d83b20cea4486f91628655bbd49440d550c6d4516412b448a289e284d"
+sha256 = "5970a230e1bfaf9ee0e0eaa25af6d58017141a88a4859eb9fd7cd47282723d55"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "62e9d95a3dbf94024c059f3a3f7646e99119bffb1da0d60580933bfed6f03985"
+sha256 = "428c8729b83bf044cc2134f6fd4b130b38c9072a3c488889cf1adb6b3df1352c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9a2259eb0a18fae4290f4f5e03b147f689315d02a86a0b1bb9bf4541bc2f984c"
+sha256 = "98ade2903b213f16e9ee196aac9d35c54b923e20750cec84343d53f0ee655fed"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 084c065a..c49c0751 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -467,14 +467,14 @@ impl Document {
     }
 
     /// The name shown on the tab and window: the document title when the document asks for it
-    /// (Initial View ▸ Show: Document Title) and has one, else the file name.
+    /// (Initial View ▸ Show: Document Title) and has a real one, else the file name.
     pub fn display_name(&self) -> String {
         self.editor
             .as_ref()
             .filter(|e| pdfcraft_organize::displays_doc_title(&e.cos))
             .and_then(|e| pdfcraft_organize::info(&e.cos, "Title"))
             .map(|t| t.trim().to_owned())
-            .filter(|t| !t.is_empty())
+            .filter(|t| !t.is_empty() && !is_placeholder_title(t))
             .unwrap_or_else(|| self.name.clone())
     }
 
@@ -490,6 +490,16 @@ impl Document {
     }
 }
 
+/// A title that names no document: what a web browser writes when it saves a blank page or a
+/// pop-up as PDF (`about:blank`), another browser-internal address, or a bare "Untitled". Such a
+/// title says less than the file name, so the file name is shown instead. An address is one
+/// word: "About: our company" is a real title.
+fn is_placeholder_title(title: &str) -> bool {
+    let t = title.trim().to_lowercase();
+    let address = !t.contains(char::is_whitespace) && ["about:", "blob:", "data:"].iter().any(|p| t.starts_with(p));
+    address || t == "untitled"
+}
+
 /// What is displayed: the working file, plus (in memory only, never saved) the appearances
 /// PdfCraft draws for comments that have none ([`pdfcraft_annot::with_missing_appearances`]).
 /// The working file is unchanged, and so is everything that reads it (saving, signatures, …).
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 0cff7d7c..9f956db5 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -2405,3 +2405,14 @@ fn comments_without_appearances_are_drawn_but_not_saved() {
         assert!(reopened.get(r).as_dict().is_some_and(|d| !d.contains(b"AP")), "{r:?} is saved without /AP");
     }
 }
+
+/// Titles a browser writes for a blank page or a pop-up name no document; real titles stay.
+#[test]
+fn placeholder_titles_are_recognised() {
+    for t in ["about:blank", "About:Blank", " about:srcdoc ", "blob:https://bank.example/3f2a", "data:text/html,x", "Untitled", "untitled"] {
+        assert!(is_placeholder_title(t), "{t:?}");
+    }
+    for t in ["Quarterly report", "Untitled report", "About: our company", "Statement", "blank"] {
+        assert!(!is_placeholder_title(t), "{t:?}");
+    }
+}
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index 7ef9361a..314176c9 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -30,6 +30,33 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
                 // Keep the two 28-point buttons, Discord's text/padding and three gaps outside the scrolling tabs.
                 let controls_width = ui.fonts_mut(|f| f.layout_no_wrap("Discord".into(), theme::medium(13.0), t.text).size().x) + 106.0;
+                // Open stays in sight after the tabs: its icon, text and padding, and the gaps around it.
+                let open_width = ui.fonts_mut(|f| f.layout_no_wrap(tl!("Open").into(), theme::medium(13.0), t.text).size().x) + 38.0 + 12.0;
+                let mut tabs_width = (ui.available_width() - controls_width - open_width).max(0.0);
+                // Tabs shrink to share the strip (names end in "…") and scroll only once they reach
+                // their narrowest; then arrows either side say so and step through them.
+                let mut natural: Vec<f32> = Vec::with_capacity(app.views.len() + 1);
+                for v in &app.views {
+                    if let Some(doc) = app.session.get(v.id) {
+                        natural.push(tab_natural_width(ui, &t, &doc.display_name()));
+                    }
+                }
+                if app.combine_tab.open {
+                    natural.push(tab_natural_width(ui, &t, tl!("Combine files")));
+                }
+                let gap = ui.spacing().item_spacing.x;
+                let overflow = tabs_overflow(&natural, tabs_width, gap, TAB_MIN_WIDTH);
+                if overflow {
+                    tabs_width = (tabs_width - 2.0 * (TAB_ARROW + gap)).max(0.0);
+                }
+                let cap = tab_cap(&natural, tabs_width, gap, TAB_MIN_WIDTH);
+                // Where the tabs were scrolled to last frame, and how far they can go.
+                let scroll_id = ui.id().with("tab_scroll");
+                let (offset, max_offset) = ui.data(|d| d.get_temp::<(f32, f32)>(scroll_id)).unwrap_or((0.0, 0.0));
+                let mut scroll_to = None;
+                if overflow && arrow(ui, "chevron-left", offset > 0.5, tl!("Scroll tabs left")) {
+                    scroll_to = Some((offset - (TAB_MIN_WIDTH + gap)).max(0.0));
+                }
                 let state = (app.active, app.views.len(), app.combine_showing());
                 let changed = ui.data_mut(|data| {
                     let id = ui.id().with("active_tab");
@@ -40,47 +67,59 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 let mut close = None;
                 ui.scope(|ui| {
                     ui.style_mut().always_scroll_the_only_direction = true;
-                    egui::ScrollArea::horizontal()
-                        .id_salt("document_tabs")
-                        .max_width((ui.available_width() - controls_width).max(0.0))
-                        .auto_shrink([false, true])
-                        .show(ui, |ui| {
-                            ui.horizontal_centered(|ui| {
-                                for i in 0..app.views.len() {
-                                    let Some(doc) = app.session.get(app.views[i].id) else { continue };
-                                    let (name, dirty) = (doc.display_name(), doc.dirty);
-                                    let response = tab(ui, &t, "file-text", &name, dirty, app.active == Some(i), &mut close, i);
-                                    if changed && app.active == Some(i) && !app.combine_showing() {
-                                        response.scroll_to_me(Some(Align::Center));
-                                    }
-                                    if response.clicked() {
-                                        app.active = Some(i);
-                                    }
+                    let mut area = egui::ScrollArea::horizontal().id_salt("document_tabs").max_width(tabs_width).auto_shrink([true, true]);
+                    if let Some(x) = ui.data_mut(|d| d.remove_temp::<f32>(scroll_id.with("to"))) {
+                        area = area.horizontal_scroll_offset(x);
+                    }
+                    let out = area.show(ui, |ui| {
+                        ui.horizontal_centered(|ui| {
+                            for i in 0..app.views.len() {
+                                let Some(doc) = app.session.get(app.views[i].id) else { continue };
+                                let (name, dirty) = (doc.display_name(), doc.dirty);
+                                // A tab showing the document's title names its file on hover.
+                                let file = (name != doc.name).then_some(doc.name.as_str());
+                                let response = tab(ui, &t, "file-text", &name, file, dirty, app.active == Some(i), &mut close, i, cap);
+                                if changed && app.active == Some(i) && !app.combine_showing() {
+                                    response.scroll_to_me(Some(Align::Center));
                                 }
-                                if let Some(i) = close {
-                                    app.request_close_tab(i);
+                                if response.clicked() {
+                                    app.active = Some(i);
                                 }
-                                if app.combine_tab.open {
-                                    // After the document tabs; its index can't clash with theirs.
-                                    let mut close = None;
-                                    let response = tab(ui, &t, "files", tl!("Combine files"), false, app.combine_showing(), &mut close, usize::MAX);
-                                    if changed && app.combine_showing() {
-                                        response.scroll_to_me(Some(Align::Center));
-                                    }
-                                    if response.clicked() {
-                                        app.open_combine_tab();
-                                    }
-                                    if close.is_some() {
-                                        app.close_combine_tab();
-                                    }
+                            }
+                            if let Some(i) = close {
+                                app.request_close_tab(i);
+                            }
+                            if app.combine_tab.open {
+                                // After the document tabs; its index can't clash with theirs.
+                                let mut close = None;
+                                let response =
+                                    tab(ui, &t, "files", tl!("Combine files"), None, false, app.combine_showing(), &mut close, usize::MAX, cap);
+                                if changed && app.combine_showing() {
+                                    response.scroll_to_me(Some(Align::Center));
                                 }
-                                ui.add_space(4.0);
-                                if widgets::ghost_button(ui, "plus", tl!("Open")).on_hover_text(tl!("Open a PDF (⌘O)")).clicked() {
-                                    app.open_dialog();
+                                if response.clicked() {
+                                    app.open_combine_tab();
                                 }
-                            });
+                                if close.is_some() {
+                                    app.close_combine_tab();
+                                }
+                            }
                         });
+                    });
+                    let max = (out.content_size.x - out.inner_rect.width()).max(0.0);
+                    ui.data_mut(|d| d.insert_temp(scroll_id, (out.state.offset.x, max)));
                 });
+                if overflow && arrow(ui, "chevron-right", offset < max_offset - 0.5, tl!("Scroll tabs right")) {
+                    scroll_to = Some((offset + TAB_MIN_WIDTH + gap).min(max_offset));
+                }
+                if let Some(x) = scroll_to {
+                    ui.data_mut(|d| d.insert_temp(scroll_id.with("to"), x));
+                    ui.ctx().request_repaint();
+                }
+                ui.add_space(4.0);
+                if widgets::ghost_button(ui, "plus", tl!("Open")).on_hover_text(tl!("Open a PDF (⌘O)")).clicked() {
+                    app.open_dialog();
+                }
                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                     let (icon, label) = match app.theme_preference {
                         ThemePreference::System => ("settings", tl!("Use system setting")),
@@ -116,14 +155,86 @@ fn theme_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     }
 }
 
+/// A tab's chrome around its name: the icon on the left, the close button on the right.
+const TAB_CHROME: f32 = 64.0;
+/// The narrowest a tab shrinks to before the strip scrolls: room for most of a name.
+const TAB_MIN_WIDTH: f32 = 180.0;
+/// The arrows either side of tabs that don't fit.
+const TAB_ARROW: f32 = 24.0;
+
+/// Whether tabs of `natural` widths, `gap` apart, are wider than `budget` even at `min` each.
+fn tabs_overflow(natural: &[f32], budget: f32, gap: f32, min: f32) -> bool {
+    let narrowest: f32 = natural.iter().map(|w| w.min(min)).sum();
+    narrowest + gap * natural.len().saturating_sub(1) as f32 > budget
+}
+
+/// A scroll arrow beside the tabs; dimmed (and inert) at its end. True when clicked.
+fn arrow(ui: &mut egui::Ui, icon: &str, enabled: bool, tip: &str) -> bool {
+    ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, TAB_ARROW, false, tip)).inner.clicked()
+}
+
+/// A tab name, at most 28 characters (longer names end in "…").
+fn tab_name(name: &str) -> String {
+    if name.chars().count() > 28 { format!("{}…", name.chars().take(27).collect::<String>()) } else { name.to_string() }
+}
+
+/// The width a tab takes when nothing has to shrink.
+fn tab_natural_width(ui: &egui::Ui, t: &Tokens, name: &str) -> f32 {
+    let label = crate::bidi::visual(&tab_name(name)).into_owned();
+    ui.fonts_mut(|f| f.layout_no_wrap(label, theme::regular(13.0), t.text).size().x) + TAB_CHROME
+}
+
+/// The widest any tab may be so that tabs of `natural` widths, `gap` apart, fit in `budget`:
+/// narrow tabs keep their width and the rest share what is left equally (as browsers do).
+/// `None` when every tab fits as it is; never below `min` (then the strip scrolls).
+fn tab_cap(natural: &[f32], budget: f32, gap: f32, min: f32) -> Option<f32> {
+    let n = natural.len();
+    if n == 0 {
+        return None;
+    }
+    let mut left = budget - gap * (n - 1) as f32;
+    if natural.iter().sum::<f32>() <= left {
+        return None;
+    }
+    let mut sorted = natural.to_vec();
+    sorted.sort_by(f32::total_cmp);
+    for (k, w) in sorted.iter().enumerate() {
+        let share = left / (n - k) as f32;
+        if *w > share {
+            return Some(share.max(min));
+        }
+        left -= w;
+    }
+    None
+}
+
 #[allow(clippy::too_many_arguments)]
-fn tab(ui: &mut egui::Ui, t: &Tokens, icon: &str, name: &str, dirty: bool, active: bool, close: &mut Option<usize>, index: usize) -> egui::Response {
+fn tab(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    icon: &str,
+    name: &str,
+    file: Option<&str>,
+    dirty: bool,
+    active: bool,
+    close: &mut Option<usize>,
+    index: usize,
+    cap: Option<f32>,
+) -> egui::Response {
     let font = theme::regular(13.0);
-    let label: String = if name.chars().count() > 28 { format!("{}…", name.chars().take(27).collect::<String>()) } else { name.to_string() };
+    let mut label = tab_name(name);
+    // A shrunk tab shows as much of its name as fits (the tooltip has all of it).
+    if let Some(cap) = cap {
+        let room = (cap - TAB_CHROME).max(0.0);
+        label = ui.fonts_mut(|f| {
+            crate::panels::ellipsized_prefix(&label, |s| f.layout_no_wrap(crate::bidi::visual(s).into_owned(), font.clone(), t.text).size().x <= room)
+        });
+    }
     // Painted text only: the accessibility name below keeps the logical order.
     let label = crate::bidi::visual(&label).into_owned();
     let text_w = ui.fonts_mut(|f| f.layout_no_wrap(label.clone(), font.clone(), t.text).size().x);
-    let (rect, resp) = ui.allocate_exact_size(vec2(text_w + 64.0, 30.0), Sense::click());
+    let width = cap.map_or(text_w + TAB_CHROME, |cap| (text_w + TAB_CHROME).min(cap));
+    let (rect, resp) = ui.allocate_exact_size(vec2(width, 30.0), Sense::click());
     let a11y = if dirty { format!("{name} (edited)") } else { name.to_string() };
     resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, active, &a11y));
     let bg = if active {
@@ -150,7 +261,10 @@ fn tab(ui: &mut egui::Ui, t: &Tokens, icon: &str, name: &str, dirty: bool, activ
     if x.clicked() {
         *close = Some(index);
     }
-    let shown = crate::bidi::visual(name);
+    let shown = match file {
+        Some(file) => std::borrow::Cow::Owned(format!("{}\n{}", crate::bidi::visual(name), crate::bidi::visual(file))),
+        None => crate::bidi::visual(name),
+    };
     resp.on_hover_text(if dirty { crate::i18n::fmt(tl!("{name} — unsaved changes"), &[("name", shown.as_ref())]) } else { shown.into_owned() })
 }
 
@@ -440,3 +554,43 @@ fn rail_view_menu(ui: &mut egui::Ui, view: &mut DocView) -> Option<&'static str>
     }
     picked
 }
+
+#[cfg(test)]
+mod tab_widths {
+    use super::tab_cap;
+
+    /// Tabs that fit keep their own widths.
+    #[test]
+    fn tabs_that_fit_do_not_shrink() {
+        assert_eq!(tab_cap(&[200.0, 150.0], 400.0, 4.0, 110.0), None);
+        assert_eq!(tab_cap(&[], 0.0, 4.0, 110.0), None);
+    }
+
+    /// Too wide: narrow tabs keep their width, the wide ones share the rest equally, and
+    /// together they fill the strip exactly.
+    #[test]
+    fn wide_tabs_share_what_narrow_ones_leave() {
+        let natural = [120.0, 300.0, 300.0];
+        let cap = tab_cap(&natural, 500.0, 4.0, 110.0).expect("must shrink");
+        let used: f32 = natural.iter().map(|w| w.min(cap)).sum::<f32>() + 2.0 * 4.0;
+        assert!((used - 500.0).abs() < 0.01, "{cap} uses {used}");
+        assert!((cap - 186.0).abs() < 0.01, "{cap}");
+    }
+
+    /// Arrows appear only when the tabs can't fit even at their narrowest.
+    #[test]
+    fn arrows_only_when_the_narrowest_tabs_overflow() {
+        use super::tabs_overflow;
+        assert!(!tabs_overflow(&[250.0; 3], 600.0, 4.0, 180.0), "three shrunk tabs fit");
+        assert!(tabs_overflow(&[250.0; 4], 600.0, 4.0, 180.0), "four don't, even at 180");
+        assert!(!tabs_overflow(&[100.0; 5], 600.0, 4.0, 180.0), "narrow tabs fit as they are");
+        assert!(!tabs_overflow(&[], 0.0, 4.0, 180.0));
+    }
+
+    /// Tabs never get narrower than the minimum: past it, the strip scrolls instead.
+    #[test]
+    fn tabs_stop_at_their_minimum() {
+        assert_eq!(tab_cap(&[250.0; 12], 600.0, 4.0, 110.0), Some(110.0));
+        assert_eq!(tab_cap(&[250.0; 3], 0.0, 4.0, 110.0), Some(110.0));
+    }
+}
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index fcd5f281..dc185101 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2073,3 +2073,5 @@ action wizard	Start	Старт
 	Printer properties	Свойства на принтера
 	Reset to printer defaults	Възстанови настройките по подразбиране на принтера
 	This printer offers no settings of its own.	Този принтер няма собствени настройки.
+	Scroll tabs left	Превърти разделите наляво
+	Scroll tabs right	Превърти разделите надясно
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 69617198..5ce51404 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -125,3 +125,5 @@
 	Reverse open arrow	Otevřená šipka obráceně
 	Reverse closed arrow	Zavřená šipka obráceně
 	Slash	Lomítko
+	Scroll tabs left	Posunout karty doleva
+	Scroll tabs right	Posunout karty doprava
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 9cbd57a4..8b35a4fd 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2111,3 +2111,5 @@ action wizard	Start	Starten
 	Printer properties	Druckereigenschaften
 	Reset to printer defaults	Auf Druckerstandard zurücksetzen
 	This printer offers no settings of its own.	Dieser Drucker bietet keine eigenen Einstellungen.
+	Scroll tabs left	Tabs nach links scrollen
+	Scroll tabs right	Tabs nach rechts scrollen
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index f5dabbaf..6f4c7e9a 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2027,3 +2027,5 @@
 	Printer properties	Propiedades de la impresora
 	Reset to printer defaults	Restablecer los valores predeterminados de la impresora
 	This printer offers no settings of its own.	Esta impresora no ofrece ajustes propios.
+	Scroll tabs left	Desplazar las pestañas a la izquierda
+	Scroll tabs right	Desplazar las pestañas a la derecha
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index db9c0c32..80e0dc1b 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2111,3 +2111,5 @@ action wizard	Start	Démarrer
 certificate	Subject	Titulaire
 comment menu	Edit	Modifier
 signature pad	Type	Saisir
+	Scroll tabs left	Faire défiler les onglets vers la gauche
+	Scroll tabs right	Faire défiler les onglets vers la droite
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 3346103a..171878e4 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2109,3 +2109,5 @@ action wizard	Start	Indítás
 	Printer properties	Nyomtató tulajdonságai
 	Reset to printer defaults	A nyomtató alapértékeinek visszaállítása
 	This printer offers no settings of its own.	Ennek a nyomtatónak nincsenek saját beállításai.
+	Scroll tabs left	Lapok görgetése balra
+	Scroll tabs right	Lapok görgetése jobbra
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index fd9d0bbb..aaddeea2 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -2111,3 +2111,5 @@
 signature pad	Type	入力
 	Flatten Fill & Sign when saving	保存時に入力と署名を統合する
 	Text, marks and signatures become part of the page. Other comments stay editable.	テキスト、マーク、署名がページの一部になります。その他のコメントは引き続き編集できます。
+	Scroll tabs left	タブを左にスクロール
+	Scroll tabs right	タブを右にスクロール
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 3486ecb9..245f4a7d 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -79,3 +79,5 @@
 	Reverse open arrow	Seta aberta invertida
 	Reverse closed arrow	Seta fechada invertida
 	Slash	Barra
+	Scroll tabs left	Rolar as abas para a esquerda
+	Scroll tabs right	Rolar as abas para a direita
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 073e9113..76154df5 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2024,3 +2024,5 @@
 	Printer properties	Свойства принтера
 	Reset to printer defaults	Вернуть параметры принтера по умолчанию
 	This printer offers no settings of its own.	У этого принтера нет собственных параметров.
+	Scroll tabs left	Прокрутить вкладки влево
+	Scroll tabs right	Прокрутить вкладки вправо
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 9014a0ae..9bcb8ed3 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2042,3 +2042,5 @@ action wizard	Start	ప్రారంభించు
 	Printer properties	ప్రింటర్ లక్షణాలు
 	Reset to printer defaults	ప్రింటర్ డిఫాల్ట్‌లకు రీసెట్ చేయి
 	This printer offers no settings of its own.	ఈ ప్రింటర్‌కు దాని స్వంత సెట్టింగ్‌లు లేవు.
+	Scroll tabs left	ట్యాబ్‌లను ఎడమకు స్క్రోల్ చేయి
+	Scroll tabs right	ట్యాబ్‌లను కుడికి స్క్రోల్ చేయి
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 57075537..0921a12a 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2134,3 +2134,5 @@ calendar date	December	грудня
 	Reset to printer defaults	Скинути до налаштувань принтера за замовчуванням
 	This printer offers no settings of its own.	Цей принтер не має власних налаштувань.
 certificate	Subject	Власник сертифіката
+	Scroll tabs left	Прокрутити вкладки ліворуч
+	Scroll tabs right	Прокрутити вкладки праворуч
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index c5832767..9c42b2ae 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2075,3 +2075,5 @@
 	Printer properties	打印机属性
 	Reset to printer defaults	恢复打印机默认设置
 	This printer offers no settings of its own.	此打印机没有专属设置。
+	Scroll tabs left	向左滚动选项卡
+	Scroll tabs right	向右滚动选项卡
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 9d51dfe9..a45f1cc9 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1997,3 +1997,5 @@
 	Reset to printer defaults	還原印表機預設值
 	This printer offers no settings of its own.	此印表機沒有專屬設定。
 	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft 正在不使用圖形處理器的情況下繪製，因此可能較慢。更新顯示卡驅動程式可能會有幫助。
+	Scroll tabs left	向左捲動索引標籤
+	Scroll tabs right	向右捲動索引標籤
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 010e9588..aacc58c0 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -762,7 +762,7 @@ const LABEL_MEASURE_CHARS: usize = 64;
 /// boundary, and the loop always ends (at the ellipsis alone). A label is document text: only
 /// its first [`LABEL_MEASURE_CHARS`] characters are measured, so a huge one can't make each
 /// frame lay out thousands of candidates.
-fn ellipsized_prefix(text: &str, mut fits: impl FnMut(&str) -> bool) -> String {
+pub(crate) fn ellipsized_prefix(text: &str, mut fits: impl FnMut(&str) -> bool) -> String {
     let mut s: String = text.chars().take(LABEL_MEASURE_CHARS).collect();
     if s.len() == text.len() && fits(text) {
         return text.to_owned();
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 46a5e3dc..ba0e3c91 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -172,6 +172,59 @@ fn overflowing_tabs_can_be_reached_by_scrolling() {
     }
 }
 
+/// Whether a node labelled `label` is there and enabled (`None`: not there).
+fn enabled(h: &Harness<'static, PdfCraftApp>, label: &str) -> Option<bool> {
+    h.query_by_label(label)?;
+    Some(h.query_by(|n| n.label().as_deref() == Some(label) && n.is_disabled()).is_none())
+}
+
+#[test]
+fn tabs_shrink_to_fit_then_arrows_step_through_them_and_open_stays_in_sight() {
+    // Five long names are wider than the strip: the tabs shrink instead of running under the
+    // buttons on the right, Open sits after them, and no arrows show.
+    let name = |i: usize| format!("Statement {i} for the office records, scanned.pdf");
+    let mut h = harness(move |app| {
+        for i in 0..5 {
+            app.open_bytes(&name(i), None, FIXTURE.to_vec()).unwrap();
+        }
+    });
+    let open = h.get_by_label("Open").rect();
+    let discord = h.get_by_label("Discord").rect();
+    assert!(open.right() <= discord.left(), "Open {open:?} must not run under Discord {discord:?}");
+    let mut previous_right = f32::MIN;
+    for i in 0..5 {
+        let tab = h.get_by_label(&name(i)).rect();
+        assert!(tab.left() >= previous_right - 0.5, "tabs must not overlap: {i} at {tab:?}");
+        assert!(tab.right() <= open.left() + 0.5, "every tab fits before Open: {i} at {tab:?}, Open at {open:?}");
+        assert!(tab.width() >= 179.0, "tabs keep most of their name: {i} is {tab:?}");
+        previous_right = tab.right();
+    }
+    assert_eq!(enabled(&h, "Scroll tabs left"), None, "no arrows while every tab fits");
+    // Seven don't fit even at their narrowest: arrows show. The newest tab is active and in
+    // sight at the end, so only the left arrow can go further.
+    for i in 5..7 {
+        h.state_mut().open_bytes(&name(i), None, FIXTURE.to_vec()).unwrap();
+    }
+    h.run_steps(6);
+    assert_eq!((enabled(&h, "Scroll tabs left"), enabled(&h, "Scroll tabs right")), (Some(true), Some(false)));
+    let first = h.get_by_label(&name(0)).rect();
+    h.get_by_label("Scroll tabs left").click();
+    h.run_steps(4);
+    assert!(h.get_by_label(&name(0)).rect().left() > first.left(), "the left arrow scrolls the tabs back");
+    assert_eq!(enabled(&h, "Scroll tabs right"), Some(true), "and then there is more to the right");
+    let open = h.get_by_label("Open").rect();
+    let right = h.get_by_label("Scroll tabs right").rect();
+    assert!(right.right() <= open.left() + 0.5 && open.right() <= h.get_by_label("Discord").rect().left());
+    // Twenty: Open stays in sight left of Discord.
+    for i in 0..13 {
+        h.state_mut().open_bytes(&format!("more-{i:02}.pdf"), None, FIXTURE.to_vec()).unwrap();
+    }
+    h.run_steps(4);
+    let open = h.get_by_label("Open").rect();
+    let discord = h.get_by_label("Discord").rect();
+    assert!(open.left() > 0.0 && open.right() <= discord.left(), "Open {open:?} stays in sight left of Discord {discord:?}");
+}
+
 #[test]
 fn narrow_tab_strips_accept_vertical_wheel_scrolling() {
     for width in [600.0, 900.0] {
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index af89def4..46c04cc0 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -331,6 +331,25 @@ fn tab_and_window_show_the_document_title_when_asked() {
     h.get_by_label_contains("Quarterly report");
 }
 
+#[test]
+fn a_placeholder_title_leaves_the_file_name_on_the_tab_and_window() {
+    // A browser's "Save as PDF" of a blank page or pop-up titles the document "about:blank"
+    // and asks viewers to show the title: the file name says more.
+    use pdfcraft_engine::Edit;
+    let mut h = harness();
+    {
+        let s = h.state_mut();
+        let id = s.views[s.active.unwrap()].id;
+        s.session.apply(id, Edit::SetInfo { key: "Title".into(), value: "about:blank".into() }).unwrap();
+        let mut v = s.session.get(id).unwrap().initial_view();
+        v.display_title = true;
+        s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
+    }
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
+    assert!(h.query_by_label_contains("about:blank").is_none());
+}
+
 #[test]
 fn an_earlier_revision_opens_from_document_properties() {
     use pdfcraft_engine::Edit;

From 74e30e58030d890ff0802b49602676a91006658b Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:01:05 -0700
Subject: [PATCH 145/149] CLI: pdfcraft-cli ui refuses a control file another
 user could plant (#597)

* Security: pdfcraft-cli ui refuses a control file another user could plant

`pdfcraft-cli ui --control FILE` sent the token and every command, typed
text included, to whatever port FILE named, without checking who owned it.
The README suggested `/tmp/pc.json`; in a shared /tmp another local user
can create that file first, so the CLI talked to their listener.

The CLI now refuses a symbolic link and anything but a regular file, a file
over 64 KiB, and on Unix a file owned by another user or with any group or
other permission bits (the app writes 600). The owner and mode are read from
the opened file, and its device and inode must match the path's, so a swap
after the check is refused too. std has no geteuid and unsafe is forbidden,
so the effective uid is the owner of a file the CLI creates in the temp
folder and removes. The README now uses a per-user path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Security: stop the app when --control can't be published

A control file that couldn't be written was only logged, and the app ran
on with a listener nobody could reach. The failure can mean another user
already created a file at a shared path to receive the commands, and a
script started with --control would otherwise drive nothing without being
told. The app now exits with the error, before any document opens, so no
work is lost. The README and the app's usage comment say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* CLI: pdfcraft-cli ui refuses a control-file port above 65535

`ui` truncated the control file's port with `as u16`, so 65536 + N reached
port N, and the token and command went to whatever listened there. A port
that doesn't fit is now refused, before connecting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* CLI: learn the effective uid from rustix, not a temp-file probe

Review on #597: the probe made `pdfcraft-cli ui` depend on a writable temp
folder to judge a control file somewhere else, created and removed a file
on every call, and could leave one behind. rustix's `geteuid` is safe and
can't fail, and rustix is already in Cargo.lock; it is a Unix-only
dependency of the CLI, so Windows builds don't compile it.

A control file of your own now works with TMPDIR pointing at a folder that
doesn't exist; the probe refused it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                            |   1 +
 README.md                             |  16 +-
 apps/pdfcraft-cli/Cargo.toml          |   5 +
 apps/pdfcraft-cli/src/main.rs         |  92 ++++++++++-
 apps/pdfcraft-cli/tests/ui_control.rs | 215 ++++++++++++++++++++++++++
 apps/pdfcraft/src/main.rs             |  58 ++++++-
 6 files changed, 370 insertions(+), 17 deletions(-)
 create mode 100644 apps/pdfcraft-cli/tests/ui_control.rs

diff --git a/Cargo.lock b/Cargo.lock
index 9fc6d186..2dcd5d7e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3604,6 +3604,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-engine",
  "pdfcraft-render",
+ "rustix 1.1.5",
  "serde_json",
 ]
 
diff --git a/README.md b/README.md
index 79f0a6c0..da4256e9 100644
--- a/README.md
+++ b/README.md
@@ -303,15 +303,17 @@ Edits stay in memory, undoable, until `doc_save`. Saving to the same file append
 
 ### Driving the app itself
 
-Start the desktop app with `pdfcraft --control /tmp/pc.json` and an agent can see and operate the real interface: the widget tree with labels and positions (from the accessibility tree), clicks, typing, keys, commands, view options and screenshots. This is also off by default. It listens only on loopback, and every connection must present the random token written to that file, which only you can read.
+Start the desktop app with `pdfcraft --control ~/.pdfcraft-control.json` and an agent can see and operate the real interface: the widget tree with labels and positions (from the accessibility tree), clicks, typing, keys, commands, view options and screenshots. This is also off by default. It listens only on loopback, and every connection must present the random token written to that file, which only you can read.
+
+Keep the control file in a folder only you can write, not a shared one such as `/tmp`: another user could create the file there first and receive your commands. `pdfcraft-cli ui` refuses a control file that is a symbolic link, and on macOS, Linux and FreeBSD one that another user owns or can read or write. The app doesn't start if it can't write the file.
 
 ```sh
-pdfcraft-cli ui --control /tmp/pc.json inspect query=rotate      # find widgets
-pdfcraft-cli ui --control /tmp/pc.json click label="Organize pages"
-pdfcraft-cli ui --control /tmp/pc.json key key=K modifiers='["command"]'
-pdfcraft-cli ui --control /tmp/pc.json command id=comment.square   # pick a tool, then draw:
-pdfcraft-cli ui --control /tmp/pc.json drag from='[400,300]' to='[600,420]'
-pdfcraft-cli ui --control /tmp/pc.json screenshot --out window.png
+pdfcraft-cli ui --control ~/.pdfcraft-control.json inspect query=rotate      # find widgets
+pdfcraft-cli ui --control ~/.pdfcraft-control.json click label="Organize pages"
+pdfcraft-cli ui --control ~/.pdfcraft-control.json key key=K modifiers='["command"]'
+pdfcraft-cli ui --control ~/.pdfcraft-control.json command id=comment.square   # pick a tool, then draw:
+pdfcraft-cli ui --control ~/.pdfcraft-control.json drag from='[400,300]' to='[600,420]'
+pdfcraft-cli ui --control ~/.pdfcraft-control.json screenshot --out window.png
 ```
 
 ---
diff --git a/apps/pdfcraft-cli/Cargo.toml b/apps/pdfcraft-cli/Cargo.toml
index d2add5d7..b0f23963 100644
--- a/apps/pdfcraft-cli/Cargo.toml
+++ b/apps/pdfcraft-cli/Cargo.toml
@@ -20,6 +20,11 @@ pdfcraft-cos = { workspace = true }
 pdfcraft-automation = { workspace = true }
 base64 = "0.22"
 
+[target.'cfg(unix)'.dependencies]
+# `geteuid` for `ui`'s control-file owner check: safe, so no `unsafe` libc call here.
+# Already in Cargo.lock through the GUI crates.
+rustix = { version = "1", features = ["process"] }
+
 [features]
 default = ["mcp"]
 # The opt-in MCP server (`pdfcraft-cli mcp`). Build with --no-default-features to leave it out.
diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index 1940d63e..49bb4dfd 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -644,9 +644,10 @@ fn mcp(args: &[String]) -> Result<(), CliError> {
 fn ui(args: &[String]) -> Result<(), CliError> {
     use std::io::{BufRead, BufReader, Write as _};
     let file = flag(args, "--control").ok_or("ui: missing --control FILE (start the app with `pdfcraft --control FILE`)")?;
-    let info: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(file).map_err(|e| format!("{file}: {e}"))?).map_err(|e| format!("{file}: {e}"))?;
+    let info = read_control_file(file)?;
     let port = info["port"].as_u64().ok_or(format!("{file}: no port"))?;
+    // Refused rather than truncated, which would quietly reach some other port.
+    let port = u16::try_from(port).map_err(|_| format!("{file}: {port} is not a port number"))?;
     let token = info["token"].as_str().ok_or(format!("{file}: no token"))?;
     let pos = positional(args);
     let method = *pos.first().ok_or("ui: missing method (state, inspect, click, drag, type, key, command, commands, set, open, screenshot)")?;
@@ -656,8 +657,8 @@ fn ui(args: &[String]) -> Result<(), CliError> {
         let (k, v) = kv.split_once('=').ok_or(format!("ui: expected key=value, got {kv:?}"))?;
         params.insert(k.to_string(), serde_json::from_str(v).unwrap_or_else(|_| serde_json::Value::String(v.to_string())));
     }
-    let stream = std::net::TcpStream::connect(("127.0.0.1", port as u16))
-        .map_err(|e| format!("can't reach the app on port {port}: {e} (is it still running?)"))?;
+    let stream =
+        std::net::TcpStream::connect(("127.0.0.1", port)).map_err(|e| format!("can't reach the app on port {port}: {e} (is it still running?)"))?;
     stream.set_read_timeout(Some(Duration::from_secs(40))).map_err(|e| e.to_string())?;
     let mut write = stream.try_clone().map_err(|e| e.to_string())?;
     let mut lines = BufReader::new(stream).lines();
@@ -681,3 +682,86 @@ fn ui(args: &[String]) -> Result<(), CliError> {
     stdout_line(format_args!("{}", serde_json::to_string_pretty(&result).unwrap_or_default()))?;
     Ok(())
 }
+
+/// Most a control file may hold. The app writes under 100 bytes.
+const CONTROL_FILE_MAX: u64 = 64 * 1024;
+
+const CONTROL_FILE_ADVICE: &str =
+    "Start the app with a control file in a folder only you can write, such as `pdfcraft --control ~/.pdfcraft-control.json`";
+
+/// Read the file written by `pdfcraft --control FILE`.
+///
+/// It names the port that receives the token and every command, typed text included, so it must
+/// be the user's own. In a shared folder such as `/tmp`, another local user can create the file
+/// first; the app then can't write it, and the CLI would talk to the other user's listener.
+/// Refused: a symbolic link, anything but a regular file, and on Unix a file owned by someone
+/// else or open to other users (the app writes it with mode 600).
+fn read_control_file(file: &str) -> Result<serde_json::Value, String> {
+    use std::io::Read as _;
+    let at_path = std::fs::symlink_metadata(file).map_err(|e| format!("{file}: {e}"))?;
+    if at_path.file_type().is_symlink() {
+        return Err(format!("{file}: is a symbolic link, which could point at another user's file. {CONTROL_FILE_ADVICE}"));
+    }
+    if !at_path.is_file() {
+        return Err(format!("{file}: not a regular file. {CONTROL_FILE_ADVICE}"));
+    }
+    let f = std::fs::File::open(file).map_err(|e| format!("{file}: {e}"))?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        // Checked on the open file, so nothing swapped in after `symlink_metadata` gets through.
+        let opened = f.metadata().map_err(|e| format!("{file}: {e}"))?;
+        if (opened.dev(), opened.ino()) != (at_path.dev(), at_path.ino()) {
+            return Err(format!("{file}: was replaced while being opened. {CONTROL_FILE_ADVICE}"));
+        }
+        if let Some(problem) = control_file_problem(opened.uid(), opened.mode(), current_uid()) {
+            return Err(format!("{file}: {problem}. {CONTROL_FILE_ADVICE}"));
+        }
+    }
+    let mut text = String::new();
+    f.take(CONTROL_FILE_MAX.saturating_add(1)).read_to_string(&mut text).map_err(|e| format!("{file}: {e}"))?;
+    if u64::try_from(text.len()).unwrap_or(u64::MAX) > CONTROL_FILE_MAX {
+        return Err(format!("{file}: too large for a control file (over {} KiB)", CONTROL_FILE_MAX / 1024));
+    }
+    serde_json::from_str(&text).map_err(|e| format!("{file}: {e}"))
+}
+
+/// Why user `me` can't trust a control file with this owner and mode, if they can't.
+#[cfg(any(test, unix))]
+fn control_file_problem(owner: u32, mode: u32, me: u32) -> Option<String> {
+    if owner != me {
+        return Some(format!("owned by another user (uid {owner}; you are uid {me}), who may be the one listening for your commands"));
+    }
+    let permissions = mode & 0o7777;
+    (permissions & 0o077 != 0).then(|| format!("other users have access to it (mode {permissions:o}; the app writes it with mode 600)"))
+}
+
+/// The effective user id: the owner of the files this process creates, and so of a control file
+/// the app wrote for this user. std has no `geteuid` and this crate forbids `unsafe`; rustix's is
+/// safe and can't fail.
+#[cfg(unix)]
+fn current_uid() -> u32 {
+    rustix::process::geteuid().as_raw()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::control_file_problem;
+
+    #[test]
+    fn a_control_file_must_be_yours_and_private() {
+        // Regular file type bits (0o100000) don't matter, only the owner and the permission bits.
+        assert_eq!(control_file_problem(1000, 0o100600, 1000), None);
+        assert_eq!(control_file_problem(1000, 0o600, 1000), None);
+        assert_eq!(control_file_problem(1000, 0o400, 1000), None);
+        let other = control_file_problem(1001, 0o600, 1000).unwrap_or_default();
+        assert!(other.contains("owned by another user") && other.contains("1001"), "{other}");
+        // Root gets no exception: a file a user planted is still theirs.
+        assert!(control_file_problem(1000, 0o600, 0).is_some_and(|p| p.contains("owned by another user")));
+        for mode in [0o644, 0o640, 0o604, 0o660, 0o606, 0o620, 0o602, 0o610, 0o601, 0o100666] {
+            let open = control_file_problem(1000, mode, 1000).unwrap_or_default();
+            assert!(open.contains("other users"), "{mode:o}: {open}");
+        }
+        assert!(control_file_problem(1000, 0o100644, 1000).unwrap_or_default().contains("mode 644"));
+    }
+}
diff --git a/apps/pdfcraft-cli/tests/ui_control.rs b/apps/pdfcraft-cli/tests/ui_control.rs
new file mode 100644
index 00000000..f49771b0
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/ui_control.rs
@@ -0,0 +1,215 @@
+//! `pdfcraft-cli ui --control FILE`: commands go only to an app whose control file is plausibly
+//! the user's own. Another local user can create a file at a shared path such as `/tmp/pc.json`
+//! first, naming their own port and token; the CLI must not then send them typed text or trust
+//! their replies.
+
+use std::io::{BufRead, BufReader, Write};
+use std::net::{TcpListener, TcpStream};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::thread::JoinHandle;
+use std::time::Duration;
+
+const TOKEN: &str = "0123456789abcdef0123456789abcdef";
+
+/// A folder for one test, removed when the test ends.
+struct Scratch(PathBuf);
+
+impl std::ops::Deref for Scratch {
+    type Target = Path;
+    fn deref(&self) -> &Path {
+        &self.0
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn scratch(test: &str) -> Scratch {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-cli-ui-{test}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    Scratch(dir)
+}
+
+/// A stand-in for the app's control listener that records everything a client sends.
+struct Spy {
+    port: u16,
+    seen: JoinHandle<String>,
+}
+
+fn spy() -> Spy {
+    let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let seen = std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        stream.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+        let mut write = stream.try_clone().unwrap();
+        let mut seen = String::new();
+        for line in BufReader::new(stream).lines() {
+            let Ok(line) = line else { break };
+            let id = serde_json::from_str::<serde_json::Value>(&line).ok().and_then(|v| v.get("id").cloned()).unwrap_or_default();
+            seen.push_str(&line);
+            seen.push('\n');
+            if writeln!(write, "{}", serde_json::json!({ "jsonrpc": "2.0", "id": id, "result": { "ok": true } })).is_err() {
+                break;
+            }
+        }
+        seen
+    });
+    Spy { port, seen }
+}
+
+impl Spy {
+    /// Everything the client sent. Connects once itself, so the listener wakes up when the client
+    /// never connected; that connection sends nothing.
+    fn received(self) -> String {
+        let _ = TcpStream::connect(("127.0.0.1", self.port));
+        self.seen.join().unwrap()
+    }
+}
+
+fn control_json(port: u16) -> String {
+    serde_json::json!({ "port": port, "token": TOKEN, "pid": 1 }).to_string()
+}
+
+/// Write a control file the way the app does: readable by the owner only.
+fn write_private(path: &Path, text: &str) {
+    let mut opts = std::fs::OpenOptions::new();
+    opts.write(true).create_new(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        opts.mode(0o600);
+    }
+    opts.open(path).unwrap().write_all(text.as_bytes()).unwrap();
+}
+
+fn ui(control: &Path, method: &str) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_pdfcraft-cli")).arg("ui").arg("--control").arg(control).arg(method).output().unwrap()
+}
+
+fn assert_refused(o: &Output, received: &str, expect: &str) {
+    let stderr = String::from_utf8_lossy(&o.stderr);
+    assert!(!received.contains(TOKEN), "the token was sent: {received}");
+    assert!(!o.status.success(), "expected a refusal; stderr: {stderr}");
+    assert!(stderr.contains(expect), "expected {expect:?} in: {stderr}");
+}
+
+#[test]
+fn a_control_file_of_your_own_still_works() {
+    let dir = scratch("own");
+    let spy = spy();
+    let control = dir.join("pc.json");
+    write_private(&control, &control_json(spy.port));
+    let o = ui(&control, "state");
+    let received = spy.received();
+    assert!(o.status.success(), "{}", String::from_utf8_lossy(&o.stderr));
+    assert!(received.contains(TOKEN) && received.contains("ui.state"), "{received}");
+}
+
+/// Checking the owner must not depend on anything but the control file: not on being able to
+/// write the temp folder (a sandbox, a read-only container, an odd `TMPDIR`).
+#[cfg(unix)]
+#[test]
+fn a_control_file_of_your_own_works_without_a_writable_temp_folder() {
+    let dir = scratch("no-tmp");
+    let spy = spy();
+    let control = dir.join("pc.json");
+    write_private(&control, &control_json(spy.port));
+    let missing = dir.join("no-such-temp-folder");
+    let o = Command::new(env!("CARGO_BIN_EXE_pdfcraft-cli"))
+        .env("TMPDIR", &missing)
+        .arg("ui")
+        .arg("--control")
+        .arg(&control)
+        .arg("state")
+        .output()
+        .unwrap();
+    let received = spy.received();
+    assert!(o.status.success(), "{}", String::from_utf8_lossy(&o.stderr));
+    assert!(received.contains(TOKEN) && received.contains("ui.state"), "{received}");
+    assert!(!missing.exists(), "the CLI created the temp folder");
+}
+
+#[test]
+fn a_symlinked_control_file_is_refused_before_connecting() {
+    let dir = scratch("symlink");
+    let spy = spy();
+    let target = dir.join("theirs.json");
+    write_private(&target, &control_json(spy.port));
+    let control = dir.join("pc.json");
+    #[cfg(unix)]
+    let linked = std::os::unix::fs::symlink(&target, &control);
+    #[cfg(windows)]
+    let linked = std::os::windows::fs::symlink_file(&target, &control);
+    if let Err(e) = linked {
+        eprintln!("skipped: can't create a symlink here ({e})");
+        drop(spy.received());
+        return;
+    }
+    let o = ui(&control, "type");
+    assert_refused(&o, &spy.received(), "symbolic link");
+}
+
+#[test]
+fn an_oversized_control_file_is_refused() {
+    let dir = scratch("oversized");
+    let spy = spy();
+    let control = dir.join("pc.json");
+    // Valid JSON, padded far beyond anything the app writes.
+    write_private(&control, &format!("{}{}", control_json(spy.port), " ".repeat(1 << 20)));
+    let o = ui(&control, "state");
+    assert_refused(&o, &spy.received(), "too large");
+}
+
+#[test]
+fn a_port_beyond_65535_is_refused_not_wrapped() {
+    let dir = scratch("port");
+    let spy = spy();
+    let control = dir.join("pc.json");
+    // 65536 more than the spy's port: truncated to 16 bits, it would reach the spy.
+    let json = serde_json::json!({ "port": u64::from(spy.port) + 65536, "token": TOKEN, "pid": 1 }).to_string();
+    write_private(&control, &json);
+    let o = ui(&control, "state");
+    assert_refused(&o, &spy.received(), "not a port number");
+}
+
+#[cfg(unix)]
+#[test]
+fn a_control_file_other_users_can_read_or_write_is_refused() {
+    use std::os::unix::fs::PermissionsExt;
+    let dir = scratch("mode");
+    for mode in [0o644, 0o640, 0o602, 0o620] {
+        let spy = spy();
+        let control = dir.join(format!("pc-{mode:o}.json"));
+        write_private(&control, &control_json(spy.port));
+        std::fs::set_permissions(&control, std::fs::Permissions::from_mode(mode)).unwrap();
+        let o = ui(&control, "state");
+        assert_refused(&o, &spy.received(), "other users");
+    }
+}
+
+/// Needs root to give a file to another user, so it checks something only where the tests run as
+/// root, such as a root container. GitHub's Linux and macOS runners don't, so there the ownership
+/// rule is covered by the unit test alone.
+#[cfg(unix)]
+#[test]
+fn a_control_file_owned_by_another_user_is_refused() {
+    use std::os::unix::fs::MetadataExt;
+    let dir = scratch("owner");
+    let spy = spy();
+    let control = dir.join("pc.json");
+    write_private(&control, &control_json(spy.port));
+    if std::fs::metadata(&control).unwrap().uid() != 0 {
+        eprintln!("skipped: needs root to create a file owned by another user");
+        drop(spy.received());
+        return;
+    }
+    std::os::unix::fs::chown(&control, Some(65534), None).unwrap();
+    let o = ui(&control, "state");
+    assert_refused(&o, &spy.received(), "owned by another user");
+}
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 637ac5fa..859873ba 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -10,7 +10,8 @@
 //!  --cover on|off  --default-layout continuous|two-up|single  --default-zoom fit-width|fit-page|<percent>`
 //!
 //! `--control <file>` enables the UI control channel (off by default): the app listens on a random
-//! loopback port and writes `{"port", "token", "pid"}` to `<file>` (owner-only permissions).
+//! loopback port and writes `{"port", "token", "pid"}` to `<file>` (owner-only permissions). The
+//! app doesn't start if it can't.
 //! Agents then drive it with `pdfcraft-cli ui --control <file> <method> …`.
 
 // Release builds on Windows are GUI-subsystem programs, so launching the app doesn't open a console
@@ -287,11 +288,7 @@ fn app_creator<'a>(
         }
         if let Some(file) = &control_file {
             let client = app.attach_control(&cc.egui_ctx);
-            match pdfcraft_ui_egui::control::serve(client).and_then(|ep| write_control_file(file, ep.port, &ep.token).map(|()| ep.port)) {
-                // Never the token (AGENTS.md §3): it stays in the owner-only file.
-                Ok(port) => log::info!("UI control channel on 127.0.0.1:{port} (connection details in {file})"),
-                Err(e) => log::error!("--control {file}: {e}"),
-            }
+            open_control_channel(file, pdfcraft_ui_egui::control::serve(client))?;
         }
         // Autosave unsaved changes; offer to recover documents a crashed session left behind.
         if let Some(dir) = pdfcraft_ui_egui::RecoveryStore::default_dir() {
@@ -338,6 +335,27 @@ fn notify_software_renderer(app: &mut PdfCraftApp, device_type: eframe::wgpu::De
     }
 }
 
+/// Publish a started control channel in `file`.
+///
+/// A failure stops the app. `--control` was asked for, so carrying on without it would leave a
+/// script driving nothing, and the file that couldn't be replaced may be another user's, planted
+/// at a shared path such as `/tmp/pc.json` to receive the commands. This runs before any document
+/// opens, so nothing is lost.
+fn open_control_channel(file: &str, endpoint: std::io::Result<pdfcraft_ui_egui::control::Endpoint>) -> Result<(), String> {
+    match endpoint.and_then(|ep| write_control_file(file, ep.port, &ep.token).map(|()| ep.port)) {
+        // Never the token (AGENTS.md §3): it stays in the owner-only file.
+        Ok(port) => {
+            log::info!("UI control channel on 127.0.0.1:{port} (connection details in {file})");
+            Ok(())
+        }
+        Err(e) => {
+            let message = format!("--control {file}: {e}. Use a control file in a folder only you can write, such as ~/.pdfcraft-control.json");
+            log::error!("{message}");
+            Err(message)
+        }
+    }
+}
+
 /// Write the control endpoint so that only the current user can read the token.
 ///
 /// The JSON goes to a new file next to `path`, created fresh (owner-only on Unix), which then
@@ -527,6 +545,34 @@ fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[D
 
 #[cfg(test)]
 mod tests {
+    use pdfcraft_ui_egui::control::Endpoint;
+
+    fn endpoint() -> std::io::Result<Endpoint> {
+        Ok(Endpoint { port: 4321, token: "0123456789abcdef".into() })
+    }
+
+    #[test]
+    fn a_control_channel_that_cant_be_published_stops_the_app() {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-app-control-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = |name: &str| dir.join(name).to_str().unwrap().to_owned();
+
+        // A folder in the way stands in for a file another user created first: the write fails.
+        std::fs::create_dir(dir.join("taken.json")).unwrap();
+        let err = super::open_control_channel(&path("taken.json"), endpoint()).unwrap_err();
+        assert!(err.contains("--control") && err.contains("taken.json") && err.contains("only you can write"), "{err}");
+        // No listener: nothing to publish.
+        let err = super::open_control_channel(&path("pc.json"), Err(std::io::Error::other("no loopback"))).unwrap_err();
+        assert!(err.contains("no loopback"), "{err}");
+        assert!(!dir.join("pc.json").exists());
+
+        super::open_control_channel(&path("pc.json"), endpoint()).unwrap();
+        let written: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(dir.join("pc.json")).unwrap()).unwrap();
+        assert_eq!((written["port"].as_u64(), written["token"].as_str()), (Some(4321), Some("0123456789abcdef")));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn path_from_arg_decodes_file_uris() {
         assert_eq!(super::path_from_arg("file:///home/alice/report.pdf".to_string()), "/home/alice/report.pdf");

From 994b42c15c2efb98ca281a53d07534c8434341ed Mon Sep 17 00:00:00 2001
From: jcl-bit <336218001+jcl-bit@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:09:23 -0700
Subject: [PATCH 146/149] CLI: pdfcraft-cli.exe carries a Windows version
 resource (#598)

pdfcraft-cli.exe had no VERSIONINFO, so Explorer's Details tab,
(Get-Item pdfcraft-cli.exe).VersionInfo and inventory tools showed no
version or publisher for it. A build.rs like the app's embeds one with
winresource (already a build dependency of pdfcraft): the same product
name and copyright, its own description and file names, and the package
version. PDFCRAFT_REQUIRE_WINRES=1, which the Windows packaging already
sets, makes a missing resource compiler an error; otherwise it's a
warning, and other targets are unaffected.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                                  |  1 +
 apps/pdfcraft-cli/Cargo.toml                |  4 ++
 apps/pdfcraft-cli/build.rs                  | 28 +++++++++++
 apps/pdfcraft-cli/tests/version_resource.rs | 54 +++++++++++++++++++++
 4 files changed, 87 insertions(+)
 create mode 100644 apps/pdfcraft-cli/build.rs
 create mode 100644 apps/pdfcraft-cli/tests/version_resource.rs

diff --git a/Cargo.lock b/Cargo.lock
index 2dcd5d7e..fb410109 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3606,6 +3606,7 @@ dependencies = [
  "pdfcraft-render",
  "rustix 1.1.5",
  "serde_json",
+ "winresource",
 ]
 
 [[package]]
diff --git a/apps/pdfcraft-cli/Cargo.toml b/apps/pdfcraft-cli/Cargo.toml
index b0f23963..77dfe2f9 100644
--- a/apps/pdfcraft-cli/Cargo.toml
+++ b/apps/pdfcraft-cli/Cargo.toml
@@ -25,6 +25,10 @@ base64 = "0.22"
 # Already in Cargo.lock through the GUI crates.
 rustix = { version = "1", features = ["process"] }
 
+[build-dependencies]
+# VERSIONINFO for pdfcraft-cli.exe; build.rs only uses it when targeting Windows.
+winresource = "0.1"
+
 [features]
 default = ["mcp"]
 # The opt-in MCP server (`pdfcraft-cli mcp`). Build with --no-default-features to leave it out.
diff --git a/apps/pdfcraft-cli/build.rs b/apps/pdfcraft-cli/build.rs
new file mode 100644
index 00000000..ee77f13f
--- /dev/null
+++ b/apps/pdfcraft-cli/build.rs
@@ -0,0 +1,28 @@
+//! Windows only: embed version info (VERSIONINFO) into `pdfcraft-cli.exe`, so Explorer's
+//! Details tab, `(Get-Item pdfcraft-cli.exe).VersionInfo` and inventory tools can read the version
+//! and publisher, as they can for `pdfcraft.exe` (`apps/pdfcraft/build.rs`).
+//!
+//! On every other target this does nothing. A missing resource compiler is a warning, so a
+//! cross-compile from macOS or Linux still links, unless `PDFCRAFT_REQUIRE_WINRES=1` turns it
+//! into an error (for release builds).
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-env-changed=PDFCRAFT_REQUIRE_WINRES");
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+        return;
+    }
+    let mut res = winresource::WindowsResource::new();
+    res.set("ProductName", "PdfCraft")
+        .set("FileDescription", "PdfCraft command-line tool")
+        .set("LegalCopyright", "Copyright (c) the PdfCraft contributors. MIT OR Apache-2.0.")
+        .set("OriginalFilename", "pdfcraft-cli.exe")
+        .set("InternalName", "pdfcraft-cli");
+    if let Err(e) = res.compile() {
+        if std::env::var_os("PDFCRAFT_REQUIRE_WINRES").is_some() {
+            println!("cargo::error=embedding Windows resources failed: {e}");
+            return;
+        }
+        println!("cargo:warning=pdfcraft-cli.exe built without version resources: {e}");
+    }
+}
diff --git a/apps/pdfcraft-cli/tests/version_resource.rs b/apps/pdfcraft-cli/tests/version_resource.rs
new file mode 100644
index 00000000..b680a32a
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/version_resource.rs
@@ -0,0 +1,54 @@
+//! `pdfcraft-cli.exe` carries a Windows version resource (`build.rs`), so Explorer, PowerShell's
+//! `VersionInfo` and inventory tools see its version and publisher, as they do for `pdfcraft.exe`.
+
+#![cfg(windows)]
+
+/// `s` as UTF-16LE, the encoding of every string in a version resource.
+fn utf16(s: &str) -> Vec<u8> {
+    s.encode_utf16().flat_map(u16::to_le_bytes).collect()
+}
+
+fn find(haystack: &[u8], needle: &[u8]) -> Option<usize> {
+    haystack.windows(needle.len()).position(|w| w == needle)
+}
+
+/// A little-endian 32-bit DWORD at `at`.
+fn dword(bytes: &[u8], at: usize) -> u32 {
+    let b: [u8; 4] = bytes[at..at + 4].try_into().unwrap();
+    u32::from_le_bytes(b)
+}
+
+/// The value of string-table entry `key`: the key and its terminator, zero padding to the next
+/// 32-bit boundary, then the value and its terminator.
+fn string_value(resource: &[u8], key: &str) -> Option<String> {
+    let after_key = find(resource, &utf16(&format!("{key}\0")))? + utf16(key).len() + 2;
+    let start = after_key + resource[after_key..].iter().take_while(|&&b| b == 0).count();
+    let units: Vec<u16> = resource[start..].as_chunks::<2>().0.iter().map(|&c| u16::from_le_bytes(c)).take_while(|&u| u != 0).collect();
+    String::from_utf16(&units).ok()
+}
+
+#[test]
+fn the_exe_has_version_info_with_the_package_version() {
+    let exe = std::fs::read(env!("CARGO_BIN_EXE_pdfcraft-cli")).unwrap();
+    let start = find(&exe, &utf16("VS_VERSION_INFO")).expect("no version resource");
+    let resource = &exe[start..];
+    for (key, value) in [
+        ("ProductName", "PdfCraft"),
+        ("FileDescription", "PdfCraft command-line tool"),
+        ("LegalCopyright", "Copyright (c) the PdfCraft contributors. MIT OR Apache-2.0."),
+        ("OriginalFilename", "pdfcraft-cli.exe"),
+        ("InternalName", "pdfcraft-cli"),
+        ("FileVersion", env!("CARGO_PKG_VERSION")),
+        ("ProductVersion", env!("CARGO_PKG_VERSION")),
+    ] {
+        assert_eq!(string_value(resource, key).as_deref(), Some(value), "{key}");
+    }
+    // VS_FIXEDFILEINFO: signature, struct version, then file and product versions as
+    // major << 16 | minor and patch << 16 | build.
+    let fixed = start + find(resource, &0xFEEF_04BDu32.to_le_bytes()).expect("no VS_FIXEDFILEINFO");
+    let number = |s: &str| -> u32 { s.parse().unwrap() };
+    let ms = (number(env!("CARGO_PKG_VERSION_MAJOR")) << 16) | number(env!("CARGO_PKG_VERSION_MINOR"));
+    let ls = number(env!("CARGO_PKG_VERSION_PATCH")) << 16;
+    assert_eq!([dword(&exe, fixed + 8), dword(&exe, fixed + 12)], [ms, ls], "file version");
+    assert_eq!([dword(&exe, fixed + 16), dword(&exe, fixed + 20)], [ms, ls], "product version");
+}

From dc4b3eee84f73bad8564906c141bdda9caad0fd6 Mon Sep 17 00:00:00 2001
From: Reinhard Schuerer <rs@nascom.de>
Date: Sat, 10 Oct 2026 01:10:06 +0200
Subject: [PATCH 147/149] Fix #378: draw on the GPU that drives the primary
 display on Windows (#631)

* Fix #378: draw on the GPU that drives the primary display on Windows

The low-power preference picked the AMD Ryzen integrated GPU on a desktop
whose monitors all hang off an NVIDIA card. Presenting from the headless
iGPU to a window on another GPU took the AMD display driver down, blacking
out every monitor for two minutes before PdfCraft exited.

Windows now gets the display-aware adapter choice Linux already had:
EnumDisplayDevices (through the safe `winsafe` crate, MIT) says which
adapter drives each desktop display and which is primary; `pick_adapter`
matches that to the wgpu adapters by PCI ids. The GPU driving the primary
display wins, as the built-in panel does on Linux (#8). The log names the
GPU chosen, the first question when a window stays black.

Synthetic tests cover the Windows device-id parser and the primary-display
rule; a live test checks the enumeration on the running machine. Verified
on a Ryzen 7000 + RTX 3090 desktop: the app now starts on the 3090.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XBMGuLLMhs1h8orSxcJXER

* 631: the winsafe feature comment says user (and kernel)

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 Cargo.lock                |   7 ++
 ROADMAP.md                |   1 +
 apps/pdfcraft/Cargo.toml  |   5 +
 apps/pdfcraft/src/main.rs | 191 +++++++++++++++++++++++++++++---------
 docs/development.md       |   2 +-
 5 files changed, 163 insertions(+), 43 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index fb410109..42e7df88 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3555,6 +3555,7 @@ dependencies = [
  "serde_json",
  "ureq",
  "winresource",
+ "winsafe",
 ]
 
 [[package]]
@@ -6795,6 +6796,12 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "winsafe"
+version = "0.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
diff --git a/ROADMAP.md b/ROADMAP.md
index b2f34020..fa63c935 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -132,6 +132,7 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 - **2026-10-09 (M5, line-ending labels):** Comment properties names each line ending in words ("Reverse open arrow", "Butt", …) and those labels are translated. The PDF `/LE` token is unchanged. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M3, #171):** A browser startup `?file=` download opens in a background tab once the user has started working, so it cannot switch the active document or the next Save. Deliberate opens still activate their tab; Home, Combine files, workspace choices and another file's password prompt are preserved. Initial-view geometry is applied to the background document, and its script notices wait until its tab is selected. Synthetic shell tests cover the race, saving the local edit, tab switching, encrypted arrivals, errors and converted text. Milestone and overall effort estimates unchanged (about 30–35%).
 
+- **2026-10-09 (never-crash, #378):** On Windows the window is drawn on the GPU that drives the primary display, as on Linux: `EnumDisplayDevices` (through the safe `winsafe` crate) says which adapter shows each desktop display, and `pick_adapter` matches it to the wgpu adapters by PCI ids. Before, the low-power preference chose a Ryzen integrated GPU with no monitor on a desktop whose monitors hang off an NVIDIA card, and presenting across adapters took the AMD display driver down for two minutes. The log now names the GPU chosen. Synthetic tests for the Windows device-id parser and the primary-display rule; a live test on the running machine. Overall unchanged.
 - **2026-10-09 (M5, line endings):** Lines, connected lines and callouts draw all ten standard line-ending styles. `comment_add` accepts `endings`, and Comment properties can change them in one undo step. An unknown name is left undrawn, and a non-finite direction is rejected. Cloudy borders remain polygon-only, so `comment.line-endings` stays partial. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, JPX sample normalization):** JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).
diff --git a/apps/pdfcraft/Cargo.toml b/apps/pdfcraft/Cargo.toml
index b7a3ede5..a65a2ec3 100644
--- a/apps/pdfcraft/Cargo.toml
+++ b/apps/pdfcraft/Cargo.toml
@@ -32,6 +32,11 @@ fmv-macos-events = "=0.1.0"
 # Waits for wgpu's adapter, device and error-scope futures in tests (already in the tree through wgpu).
 pollster = "1.0"
 
+[target.'cfg(target_os = "windows")'.dependencies]
+# Which GPU drives which display (EnumDisplayDevices), so the window is drawn on the GPU that
+# shows it (issue #378). Safe wrappers over Win32; only the `user` feature (which brings `kernel` with it).
+winsafe = { version = "0.0.29", default-features = false, features = ["user"] }
+
 [build-dependencies]
 # Icon + VERSIONINFO for pdfcraft.exe; build.rs only uses it when targeting Windows.
 winresource = "0.1"
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 859873ba..31347705 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -410,11 +410,16 @@ fn write_control_file(path: &str, port: u16, token: &str) -> std::io::Result<()>
 ///   for a discrete GPU, and on hybrid-graphics laptops (NVIDIA Optimus) the discrete one can lose
 ///   or corrupt its memory across suspend and screen lock, leaving the window illegible (issue #8).
 ///   It also saves battery. Machines with one GPU are unaffected.
-/// - On Linux, draw on a GPU that a monitor is plugged into. On a desktop whose monitors all hang
-///   off the discrete GPU, drawing on the integrated one leaves the window black under Wayland
-///   compositors on NVIDIA. When several GPUs drive a display, the one driving a built-in panel
-///   wins (a hybrid laptop, issue #8); without a built-in panel (a desktop with a monitor on each
-///   GPU, issue #445) the discrete one wins, as the integrated one may fail to present there.
+/// - Draw on a GPU that a monitor is plugged into. Drawing on another one means every frame is
+///   handed to the GPU that drives the display, and that path fails: on a desktop whose monitors
+///   all hang off the discrete GPU, the integrated one leaves the window black under Wayland
+///   compositors on NVIDIA, and on Windows an AMD Ryzen integrated GPU takes the display driver
+///   down with it, blacking out every monitor for minutes (issue #378). When several GPUs drive a
+///   display, the one driving the display the user most likely looks at wins: a built-in panel on
+///   Linux (a hybrid laptop, issue #8), the primary display on Windows. Without either (a Linux
+///   desktop with a monitor on each GPU, issue #445) the discrete one wins, as the integrated one
+///   may fail to present there. Where the system doesn't say which GPU drives a display (macOS,
+///   containers, remote sessions) the power preference alone decides.
 /// - On Windows, use Direct3D 12, falling back to OpenGL, and never load Vulkan drivers unless
 ///   `WGPU_BACKEND` asks for them. Creating a Vulkan instance loads every installed Vulkan driver
 ///   into the process, and a faulty one (an Intel driver in issue #37) crashed PdfCraft before
@@ -433,26 +438,28 @@ fn configure_gpu(native: &mut eframe::NativeOptions) {
     });
     if std::env::var_os("WGPU_POWER_PREF").is_none() {
         setup.power_preference = eframe::wgpu::PowerPreference::LowPower;
-        #[cfg(target_os = "linux")]
-        {
-            let displays = linux_display_gpus(std::path::Path::new("/sys/class/drm"));
-            // Without sysfs (containers, remote sessions) the power preference alone decides.
-            if !displays.is_empty() {
-                setup.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
-                    let usable: Vec<&eframe::wgpu::Adapter> = adapters.iter().filter(|a| surface.is_none_or(|s| a.is_surface_supported(s))).collect();
-                    let infos: Vec<(u32, u32, eframe::wgpu::DeviceType)> = usable
-                        .iter()
-                        .map(|a| {
-                            let info = a.get_info();
-                            (info.vendor, info.device, info.device_type)
-                        })
-                        .collect();
-                    pick_adapter(&infos, &displays)
-                        .and_then(|i| usable.get(i))
-                        .map(|a| (*a).clone())
-                        .ok_or_else(|| "no GPU can draw to this window".to_string())
-                }));
-            }
+        let displays = display_gpus();
+        if !displays.is_empty() {
+            setup.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
+                let usable: Vec<&eframe::wgpu::Adapter> = adapters.iter().filter(|a| surface.is_none_or(|s| a.is_surface_supported(s))).collect();
+                let infos: Vec<(u32, u32, eframe::wgpu::DeviceType)> = usable
+                    .iter()
+                    .map(|a| {
+                        let info = a.get_info();
+                        (info.vendor, info.device, info.device_type)
+                    })
+                    .collect();
+                let picked = pick_adapter(&infos, &displays).and_then(|i| usable.get(i)).map(|a| (*a).clone());
+                match &picked {
+                    // Which GPU draws is the first question when a window stays black (#8, #378, #445).
+                    Some(a) => {
+                        let info = a.get_info();
+                        log::info!("drawing on {} ({:?}, {:?})", info.name, info.device_type, info.backend);
+                    }
+                    None => log::warn!("no GPU can draw to this window; {} were considered", usable.len()),
+                }
+                picked.ok_or_else(|| "no GPU can draw to this window".to_string())
+            }));
         }
     }
     if cfg!(target_os = "windows") && std::env::var_os("WGPU_BACKEND").is_none() {
@@ -469,12 +476,79 @@ fn surface_texture_limits(mut required: eframe::wgpu::Limits, supported: &eframe
 
 /// A GPU with a connected monitor.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
-#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
 struct DisplayGpu {
     /// PCI `(vendor, device)` ids.
     pci: (u32, u32),
-    /// Whether one of its connected connectors is a built-in panel (`eDP`, `LVDS` or `DSI`).
-    internal_panel: bool,
+    /// Whether it drives the display the user most likely looks at: on Linux a built-in panel
+    /// (`eDP`, `LVDS` or `DSI`), on Windows the primary display.
+    primary: bool,
+}
+
+/// The GPUs with a connected monitor, as far as the system says: Linux reads the DRM connectors
+/// in sysfs, Windows asks for the display devices attached to the desktop. Empty elsewhere.
+fn display_gpus() -> Vec<DisplayGpu> {
+    #[cfg(target_os = "linux")]
+    {
+        linux_display_gpus(std::path::Path::new("/sys/class/drm"))
+    }
+    #[cfg(target_os = "windows")]
+    {
+        windows_display_gpus()
+    }
+    #[cfg(not(any(target_os = "linux", target_os = "windows")))]
+    {
+        Vec::new()
+    }
+}
+
+/// Records one display of GPU `pci`; a GPU driving several displays is one entry.
+#[cfg_attr(not(any(target_os = "linux", target_os = "windows")), allow(dead_code))]
+fn add_display_gpu(gpus: &mut Vec<DisplayGpu>, pci: (u32, u32), primary: bool) {
+    match gpus.iter_mut().find(|g| g.pci == pci) {
+        Some(gpu) => gpu.primary |= primary,
+        None => gpus.push(DisplayGpu { pci, primary }),
+    }
+}
+
+/// The GPUs driving a display attached to the desktop, from `EnumDisplayDevices`. Each entry it
+/// lists is one display device of an adapter (`\\.\DISPLAY1`, "NVIDIA GeForce RTX 3090"), with the
+/// adapter's PCI ids in its device id (`PCI\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1`); a GPU with
+/// no monitor lists its devices as not attached. Issue #378: a Ryzen desktop with the monitors on
+/// an NVIDIA card, where the integrated GPU would otherwise be chosen.
+#[cfg(target_os = "windows")]
+fn windows_display_gpus() -> Vec<DisplayGpu> {
+    use winsafe::co::DISPLAY_DEVICE as Flags;
+    let mut gpus: Vec<DisplayGpu> = Vec::new();
+    // A machine has a handful of display devices; the cap only bounds a runaway enumeration.
+    for device in winsafe::EnumDisplayDevices(None, None).take(256) {
+        let device = match device {
+            Ok(d) => d,
+            // The enumeration ends with "no more items" or, from a driver, with any error.
+            Err(e) => {
+                log::debug!("display devices: {e}");
+                break;
+            }
+        };
+        if !device.StateFlags.has(Flags::ATTACHED_TO_DESKTOP) {
+            continue;
+        }
+        let Some(pci) = pci_ids(&device.DeviceID()) else { continue };
+        add_display_gpu(&mut gpus, pci, device.StateFlags.has(Flags::PRIMARY_DEVICE));
+    }
+    gpus
+}
+
+/// The PCI `(vendor, device)` ids in a Windows device id such as
+/// `PCI\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1`; `None` for any other kind of device.
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+fn pci_ids(device_id: &str) -> Option<(u32, u32)> {
+    let field = |key: &str| {
+        device_id.split(['\\', '&']).find_map(|part| {
+            let (name, hex) = part.split_at_checked(key.len())?;
+            if name.eq_ignore_ascii_case(key) { u32::from_str_radix(hex, 16).ok() } else { None }
+        })
+    };
+    Some((field("VEN_")?, field("DEV_")?))
 }
 
 /// Whether a DRM connector name (`eDP-1`, `LVDS-1`, `DSI-1`) is a laptop's built-in panel.
@@ -503,31 +577,27 @@ fn linux_display_gpus(drm: &std::path::Path) -> Vec<DisplayGpu> {
         }
         let device = drm.join(card).join("device");
         let (Some(v), Some(d)) = (read_hex(device.join("vendor")), read_hex(device.join("device"))) else { continue };
-        let internal_panel = is_internal_panel(connector);
-        match gpus.iter_mut().find(|g| g.pci == (v, d)) {
-            Some(gpu) => gpu.internal_panel |= internal_panel,
-            None => gpus.push(DisplayGpu { pci: (v, d), internal_panel }),
-        }
+        add_display_gpu(&mut gpus, (v, d), is_internal_panel(connector));
     }
     gpus
 }
 
 /// Index of the adapter to draw with: one that drives a display (by PCI ids) first. Among several
-/// of those, the one driving a built-in panel (a hybrid laptop, #8), or else, with no built-in
-/// panel anywhere (a desktop with a monitor on each GPU, #445), the discrete one. Otherwise the
-/// most frugal kind: integrated, discrete, other, virtual, software.
-#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+/// of those, the one driving the primary display (a hybrid laptop's panel, #8; the primary display
+/// on Windows, #378), or else, with no primary display known (a Linux desktop with a monitor on
+/// each GPU, #445), the discrete one. Otherwise the most frugal kind: integrated, discrete, other,
+/// virtual, software.
 fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[DisplayGpu]) -> Option<usize> {
     use eframe::wgpu::DeviceType;
     let display = |pci: (u32, u32)| displays.iter().find(|g| g.pci == pci);
-    let multi_gpu_desktop = displays.len() > 1 && !displays.iter().any(|g| g.internal_panel);
+    let multi_gpu_desktop = displays.len() > 1 && !displays.iter().any(|g| g.primary);
     adapters
         .iter()
         .enumerate()
         .min_by_key(|(_, (vendor, device, kind))| {
             let shown = display((*vendor, *device));
             let drives_display = shown.is_some();
-            let drives_panel = shown.is_some_and(|g| g.internal_panel);
+            let drives_primary = shown.is_some_and(|g| g.primary);
             let rank = match kind {
                 // On a desktop with monitors on both, the integrated GPU can accept the window and
                 // still fail to present to it (#445).
@@ -538,7 +608,7 @@ fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[D
                 DeviceType::VirtualGpu => 4,
                 DeviceType::Cpu => 5,
             };
-            (!drives_display, !drives_panel, rank)
+            (!drives_display, !drives_primary, rank)
         })
         .map(|(i, _)| i)
 }
@@ -838,6 +908,7 @@ mod tests {
     }
 
     const NVIDIA: (u32, u32) = (0x10de, 0x2684);
+    const NVIDIA_3090: (u32, u32) = (0x10de, 0x2204);
     const AMD_IGPU: (u32, u32) = (0x1002, 0x164e);
 
     fn adapters() -> Vec<(u32, u32, eframe::wgpu::DeviceType)> {
@@ -848,17 +919,53 @@ mod tests {
     const INTEL_IGPU: (u32, u32) = (0x8086, 0xa780);
 
     fn monitor(pci: (u32, u32)) -> super::DisplayGpu {
-        super::DisplayGpu { pci, internal_panel: false }
+        super::DisplayGpu { pci, primary: false }
     }
 
     fn panel(pci: (u32, u32)) -> super::DisplayGpu {
-        super::DisplayGpu { pci, internal_panel: true }
+        super::DisplayGpu { pci, primary: true }
     }
 
     #[test]
     fn pick_adapter_prefers_the_gpu_driving_the_monitors() {
         // A desktop whose monitors are all on the discrete GPU: the integrated one shows black.
         assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA)]), Some(0));
+        // Issue #378: the same on Windows, where the Ryzen integrated GPU without a monitor crashed
+        // the display driver. Windows also says which display is the primary one.
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(NVIDIA)]), Some(0));
+    }
+
+    #[test]
+    fn pick_adapter_prefers_the_gpu_driving_the_primary_display() {
+        // A Windows desktop with a monitor on each GPU: the window opens on the primary display.
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), panel(NVIDIA)]), Some(0));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)]), Some(1));
+    }
+
+    #[test]
+    fn pci_ids_come_from_windows_device_ids() {
+        assert_eq!(super::pci_ids("PCI\\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1"), Some(NVIDIA_3090));
+        assert_eq!(super::pci_ids("PCI\\VEN_1002&DEV_164E&SUBSYS_88771043&REV_C1"), Some(AMD_IGPU));
+        assert_eq!(super::pci_ids("pci\\ven_1002&dev_164e"), Some(AMD_IGPU));
+        // Remote Desktop and other non-PCI display devices, and malformed ids.
+        assert_eq!(super::pci_ids("ROOT\\BasicDisplay\\0000"), None);
+        assert_eq!(super::pci_ids("PCI\\VEN_10DE&SUBSYS_40421458"), None);
+        assert_eq!(super::pci_ids("PCI\\VEN_10DE&DEV_ZZZZ"), None);
+        assert_eq!(super::pci_ids("VEN_&DEV_"), None);
+        assert_eq!(super::pci_ids(""), None);
+    }
+
+    #[cfg(target_os = "windows")]
+    #[test]
+    fn windows_display_gpus_lists_pci_gpus_with_a_monitor() {
+        // Whatever this machine has: every entry is a PCI GPU, at most one drives the primary
+        // display, and no GPU is listed twice. (A headless CI runner may list none.)
+        let gpus = super::windows_display_gpus();
+        assert!(gpus.iter().filter(|g| g.primary).count() <= 1, "{gpus:?}");
+        for (i, g) in gpus.iter().enumerate() {
+            assert!(g.pci.0 != 0, "{gpus:?}");
+            assert!(!gpus[..i].iter().any(|h| h.pci == g.pci), "{gpus:?}");
+        }
     }
 
     #[test]
diff --git a/docs/development.md b/docs/development.md
index d622e16e..7be195b0 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -58,7 +58,7 @@ OpenGL can't start either, PdfCraft exits with both errors in the log. The fallb
 | `RUST_LOG` | Log levels for standard error and the log file (see [Logs](#logs)) |
 | `RUST_BACKTRACE` | `1` adds a backtrace to the report of an internal error |
 | `XDG_DATA_HOME` | Linux/FreeBSD: base of the settings folder (`pdfcraft/`), the log folder and crash recovery |
-| `WGPU_POWER_PREF` | GPU choice; by default PdfCraft prefers the low-power (integrated) GPU |
+| `WGPU_POWER_PREF` | GPU choice; by default PdfCraft draws on the GPU that drives the primary display (Windows) or the built-in panel (Linux), else the low-power (integrated) GPU. The log says which one was chosen |
 | `WGPU_BACKEND` | Graphics backend; by default Windows uses Direct3D 12, falling back to OpenGL |
 | `PDFCRAFT_RENDERER` | `gl` starts with OpenGL (glow) and never loads wgpu; `wgpu` reports a wgpu failure instead of retrying with OpenGL; unset, wgpu is retried with OpenGL when it can't start (see [Renderer fallback](#renderer-fallback)) |
 | `CRAFT_FONTS_DIR` | Build time: a [craft-fonts](https://github.com/storytold/craft-fonts) checkout to embed (Japanese fonts) |

From 6e13a5fc540980a83f59a939a713b9adbdb7704c Mon Sep 17 00:00:00 2001
From: mrme2tiri-hash <252486564+mrme2tiri-hash@users.noreply.github.com>
Date: Sat, 10 Oct 2026 02:29:12 +0200
Subject: [PATCH 148/149] Fill & Sign: remove white background from imported
 signature images (#637)

---
 crates/engine/src/signature_image.rs | 38 ++++++++++++++++++++++++++++
 crates/ui-egui/src/fill_sign.rs      |  3 ++-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index d1e3ad5b..88919541 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -164,6 +164,23 @@ impl SignatureImage {
         self.size
     }
 
+    /// Make near-white paper transparent, keeping darker ink.
+    pub fn remove_white_background(&self, cutoff: u8, feather: u8) -> Result<Self, SignatureImageError> {
+        let [w, h] = self.size;
+        let mut rgba = image::RgbaImage::from_raw(w as u32, h as u32, self.rgba.as_ref().clone()).ok_or(SignatureImageError::Size)?;
+        let high = f32::from(cutoff);
+        let span = f32::from(feather.max(1));
+        for pixel in rgba.pixels_mut() {
+            let [r, g, b, a] = pixel.0;
+            let whiteness = f32::from(r.min(g).min(b));
+            let keep = ((high - whiteness) / span).clamp(0.0, 1.0);
+            pixel.0[3] = (f32::from(a) * keep).round() as u8;
+        }
+        let mut png = Cursor::new(Vec::new());
+        DynamicImage::ImageRgba8(rgba).write_to(&mut png, ImageFormat::Png)?;
+        Self::from_bytes(&png.into_inner())
+    }
+
     /// The user-space box for the image with its left edge at `at` (a user-space point on `page`),
     /// vertically centered, with the same 150 pt width cap as typed names. Left and centered are
     /// as displayed: on a page with `/Rotate` the box runs along the turned page's axes.
@@ -324,4 +341,25 @@ mod tests {
             assert!(rect.iter().zip(want).all(|(a, b)| (a - b).abs() < 0.01), "{rotation}: {rect:?}, want {want:?}");
         }
     }
+
+    #[test]
+    fn white_background_becomes_transparent_and_ink_is_kept() {
+        let mut source = image::RgbaImage::new(4, 1);
+        source.put_pixel(0, 0, image::Rgba([255, 255, 255, 255]));
+        source.put_pixel(1, 0, image::Rgba([20, 20, 20, 255]));
+        source.put_pixel(2, 0, image::Rgba([227, 227, 227, 255]));
+        source.put_pixel(3, 0, image::Rgba([10, 10, 10, 100]));
+        let mut encoded = Cursor::new(Vec::new());
+        source.write_to(&mut encoded, ImageFormat::Png).unwrap();
+
+        let image = SignatureImage::from_bytes(&encoded.into_inner()).unwrap();
+        let cleaned = image.remove_white_background(245, 35).unwrap();
+        let pixels = cleaned.rgba().as_chunks::<4>().0;
+
+        assert_eq!(cleaned.size(), [4, 1]);
+        assert_eq!(pixels[0][3], 0, "white paper must be transparent");
+        assert_eq!(pixels[1], [20, 20, 20, 255], "dark ink must be unchanged");
+        assert!(pixels[2][3] > 0 && pixels[2][3] < 255, "near-white must fade");
+        assert_eq!(pixels[3][3], 100, "existing transparency must be kept");
+    }
 }
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index 152fde4a..27c7ee26 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -706,7 +706,8 @@ impl crate::PdfCraftApp {
     }
 
     fn use_signature_image(&mut self, result: Result<SignatureImage, String>) {
-        match result {
+        let cleaned = result.and_then(|image| image.remove_white_background(245, 35).map_err(|e| e.to_string()));
+        match cleaned {
             Ok(image) => {
                 self.signature_draft.image = Some(image);
                 self.toast = None;

From c110c579a24800bb841b5d643e2e34e161e81f13 Mon Sep 17 00:00:00 2001
From: Max Abramowitz <max@1e6.org>
Date: Fri, 9 Oct 2026 20:29:26 -0400
Subject: [PATCH 149/149] M4: delete pages from the Pages panel (#607)

Right-clicking a thumbnail offers Delete pages, and Delete or Backspace with the
pointer over the panel deletes too, as in the organize grid: the selection, or
the current page. A document keeps at least one page, so with every page
picked the item is off and the keys do nothing. The selection goes and the
current page moves to the page after the deleted ones; one undoable step.

Parity: view.thumbnail-context-ops notes and evidence include Delete pages.

Co-authored-by: William Max & Co. <info@williammax.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/ui-egui/src/panels.rs    | 35 ++++++++++++++++++++
 crates/ui-egui/tests/editing.rs | 58 +++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml    |  4 +--
 3 files changed, 95 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index aacc58c0..e8354e03 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -908,7 +908,17 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
     {
         view.clear_page_selection(Some(view.current));
     }
+    // Delete (or Backspace) deletes the selection, or the current page, likewise.
+    if !modal
+        && editable
+        && !ui.ctx().egui_wants_keyboard_input()
+        && ui.rect_contains_pointer(ui.clip_rect())
+        && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Delete) || i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace))
+    {
+        delete_pages(view, info.pages.len());
+    }
     let w = (ui.available_width() - 40.0).min(150.0);
+    let count = info.pages.len();
     let mut rows: Vec<Rect> = Vec::with_capacity(info.pages.len());
     let mut dropped = false;
     for (i, p) in info.pages.iter().enumerate() {
@@ -986,6 +996,13 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
                     view.pending_action = Some(crate::canvas::ViewAction::PastePages);
                     ui.close();
                 }
+                ui.separator();
+                let some_left = view.target_pages().len() < count;
+                // Never every page: a document keeps at least one.
+                if ui.add_enabled(editable && some_left, egui::Button::new(tl!("Delete pages"))).clicked() {
+                    delete_pages(view, count);
+                    ui.close();
+                }
             });
         });
         ui.add_space(4.0);
@@ -993,6 +1010,24 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
     page_drag(ui, t, view, &rows, dropped);
 }
 
+/// Queue deleting the selection (or the current page) of a document of `n` pages, unless that
+/// would leave no page. The selection goes; the current page stays on the page it showed, or on
+/// the page that follows the deleted ones.
+fn delete_pages(view: &mut crate::DocView, n: usize) {
+    let mut pages = view.target_pages();
+    pages.sort_unstable();
+    pages.dedup();
+    if pages.is_empty() || pages.len() >= n {
+        return;
+    }
+    // Deleted pages before it shift it up; if it was deleted itself, the page after the deleted
+    // run lands where it was (or the last page, when the deletion ran to the end).
+    let before = pages.iter().filter(|p| **p < view.current).count();
+    view.current = view.current.saturating_sub(before).min(n.saturating_sub(pages.len() + 1));
+    view.clear_page_selection(None);
+    view.pending_edit = Some(pdfcraft_engine::Edit::DeletePages { pages });
+}
+
 /// The gap (0 = before the first page, n = after the last) the pointer points at in the Pages
 /// panel, whose thumbnails are `rows`, top to bottom.
 fn panel_gap(rows: &[Rect], y: f32) -> Option<usize> {
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 61410be2..b7d96d1d 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -2077,3 +2077,61 @@ fn a_thumbnail_drag_that_ends_off_the_panel_or_outlives_the_pages_is_dropped() {
     h.state_mut().views[0].document_changed(&info);
     assert!(h.state().views[0].panel_drag.is_none());
 }
+
+/// A Pages panel thumbnail (the rightmost node with that label).
+fn panel_thumb(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Pos2 {
+    h.get_all_by_label(label).map(|n| n.rect()).max_by(|a, b| a.left().total_cmp(&b.left())).expect("the thumbnail").center()
+}
+
+fn right_click_at(h: &mut Harness<'static, PdfCraftApp>, at: egui::Pos2) {
+    h.hover_at(at);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+}
+
+#[test]
+fn deleting_pages_from_the_pages_panel_menu() {
+    let mut h = pages_panel(4);
+    let at = panel_thumb(&h, "Page 2");
+    right_click_at(&mut h, at);
+    h.get_by_label("Delete pages").click();
+    h.run_steps(4);
+    assert_eq!(page_texts(h.state()), ["Page 1", "Page 3", "Page 4"]);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Delete page"));
+    assert!(h.state().views[0].selected.is_empty(), "the deleted pages leave the selection");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(page_texts(h.state()), ["Page 1", "Page 2", "Page 3", "Page 4"]);
+}
+
+#[test]
+fn the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page() {
+    let mut h = pages_panel(3);
+    // ⌘-click picks pages 2 and 3 (and the current page, 1: the first ⌘-click keeps it).
+    h.get_by_label("Page 2").click_modifiers(Modifiers::COMMAND);
+    h.run_steps(2);
+    h.get_by_label("Page 3").click_modifiers(Modifiers::COMMAND);
+    h.run_steps(2);
+    let (p1, p3) = (panel_thumb(&h, "Page 1"), panel_thumb(&h, "Page 3"));
+    h.hover_at(p3);
+    h.run_steps(1);
+    assert_eq!(h.state().views[0].selected.iter().copied().collect::<Vec<_>>(), vec![0, 1, 2]);
+    // Every page picked: Delete does nothing, and the menu item is off.
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    assert_eq!(page_texts(h.state()).len(), 3, "a document keeps at least one page");
+    right_click_at(&mut h, p3);
+    assert!(h.query_by(|n| n.label().as_deref() == Some("Delete pages") && n.is_disabled()).is_some());
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    // Pages 2 and 3 picked (page 2 current): Delete deletes them, and page 1 becomes current.
+    h.state_mut().views[0].select_pages(&[1, 2]);
+    h.hover_at(p1);
+    h.run_steps(1);
+    h.key_press(Key::Delete);
+    h.run_steps(4);
+    assert_eq!(page_texts(h.state()), ["Page 1"]);
+    assert_eq!(h.state().views[0].current, 0);
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index bbe7b097..2a172ae9 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1238,8 +1238,8 @@ milestone = "M4"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/viewer.rs::pages_panel_thumbnails_have_a_context_menu"]
-notes = "Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy and Paste after. Not yet: Rotate, Delete, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
+evidence = ["crates/ui-egui/tests/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
+notes = "Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
 
 [[feature]]
 id = "view.bookmarks-panel"